@argos-js/auth 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Argos-JS Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,14 @@
-# Temporary Holding Version
+# @argos-js/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Authentication, authorization, JWT token management, password hashing, HTTP Basic Auth, and OAuth2/PKCE utilities for the Argos-JS framework.
+
+## Features
+
+- 🔐 **JWT Token Pair Management**: Symmetric (HS256, HS512) and Asymmetric (RS256, Ed25519) token generation and verification.
+- 🔄 **Strict Refresh Token Rotation & Reuse Detection**: Automated token family tracking and replay attack prevention.
+- 🛡️ **Guards & Middlewares**: HTTP Basic Authentication, API Key authentication, Bearer tokens, and OAuth2 PKCE helpers.
+- ⚡ **Near-Cache Acceleration**: Fast token caching and session verification with timing-safe comparisons.
+
+## License
+
+MIT

package/dist/certificates/cert-parser.d.ts

@@ -0,0 +1,19 @@
+import type { DistinguishedName, ParsedCertificate } from './cert.types.js';
+/**
+ * Parses a Distinguished Name (DN) string in comma-delimited (RFC 2253 / RFC 4514)
+ * or legacy slash-delimited format into a typed DistinguishedName object.
+ */
+export declare function parseDn(dnString: string): DistinguishedName;
+/**
+ * Parses a PEM-encoded X.509 certificate using Node's native crypto.X509Certificate.
+ */
+export declare function parseX509Pem(pemString: string): ParsedCertificate;
+/**
+ * Parses Node.js tls.PeerCertificate (from req.socket.getPeerCertificate()).
+ */
+export declare function parsePeerCertificate(peerCert: any): ParsedCertificate;
+/**
+ * Parses reverse-proxy certificate header values (e.g. Envoy XFCC, Nginx SSL_CLIENT_CERT).
+ */
+export declare function parseProxyClientCertHeader(headerValue: string): ParsedCertificate | null;
+//# sourceMappingURL=cert-parser.d.ts.map

package/dist/certificates/cert-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-parser.d.ts","sourceRoot":"","sources":["../../src/certificates/cert-parser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE5E;;;GAGG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAqC3D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,CAqDjE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,GAAG,iBAAiB,CAiCrE;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAyBxF"}

package/dist/certificates/cert-parser.js

@@ -0,0 +1,192 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseDn = parseDn;
+exports.parseX509Pem = parseX509Pem;
+exports.parsePeerCertificate = parsePeerCertificate;
+exports.parseProxyClientCertHeader = parseProxyClientCertHeader;
+const crypto = __importStar(require("node:crypto"));
+/**
+ * Parses a Distinguished Name (DN) string in comma-delimited (RFC 2253 / RFC 4514)
+ * or legacy slash-delimited format into a typed DistinguishedName object.
+ */
+function parseDn(dnString) {
+    const result = {};
+    if (!dnString || typeof dnString !== 'string') {
+        return result;
+    }
+    const clean = dnString.trim();
+    if (clean.startsWith('/')) {
+        // Legacy OpenSSL format: /CN=name/O=org/C=US
+        const parts = clean.split('/').filter(Boolean);
+        for (const part of parts) {
+            const idx = part.indexOf('=');
+            if (idx !== -1) {
+                const key = part.slice(0, idx).trim();
+                const val = part.slice(idx + 1).trim();
+                result[key] = val;
+            }
+        }
+    }
+    else {
+        // Standard RFC format (comma-separated) or Node X509Certificate format (newline-separated)
+        const parts = clean.split(/(?:\r?\n|,\s*)(?=[A-Za-z0-9_.-]+=)/);
+        for (const part of parts) {
+            const idx = part.indexOf('=');
+            if (idx !== -1) {
+                const key = part.slice(0, idx).trim();
+                let val = part.slice(idx + 1).trim();
+                // Remove surrounding quotes if present
+                if (val.startsWith('"') && val.endsWith('"')) {
+                    val = val.slice(1, -1);
+                }
+                result[key] = val;
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Parses a PEM-encoded X.509 certificate using Node's native crypto.X509Certificate.
+ */
+function parseX509Pem(pemString) {
+    let pem = pemString.trim();
+    // If URL-encoded (e.g. from Nginx $ssl_client_cert or Envoy headers)
+    if (pem.includes('%20') || pem.includes('%0A') || pem.includes('%2D')) {
+        try {
+            pem = decodeURIComponent(pem);
+        }
+        catch {
+            // Keep as-is if decoding fails
+        }
+    }
+    // Ensure standard PEM headers if missing
+    if (!pem.includes('-----BEGIN CERTIFICATE-----')) {
+        pem = `-----BEGIN CERTIFICATE-----\n${pem}\n-----END CERTIFICATE-----`;
+    }
+    const cert = new crypto.X509Certificate(pem);
+    const rawSubject = cert.subject;
+    const rawIssuer = cert.issuer;
+    const subject = parseDn(rawSubject);
+    const issuer = parseDn(rawIssuer);
+    const validFrom = new Date(cert.validFrom);
+    const validTo = new Date(cert.validTo);
+    const now = new Date();
+    const isExpired = now < validFrom || now > validTo;
+    // Check self-signed
+    let isSelfSigned = false;
+    if (rawSubject === rawIssuer) {
+        try {
+            isSelfSigned = cert.verify(cert.publicKey);
+        }
+        catch {
+            isSelfSigned = true;
+        }
+    }
+    return {
+        subject,
+        issuer,
+        rawSubject,
+        rawIssuer,
+        commonName: subject.CN,
+        serialNumber: cert.serialNumber,
+        fingerprint256: cert.fingerprint256.replace(/:/g, '').toLowerCase(),
+        validFrom,
+        validTo,
+        isExpired,
+        isSelfSigned,
+        rawPem: pem,
+    };
+}
+/**
+ * Parses Node.js tls.PeerCertificate (from req.socket.getPeerCertificate()).
+ */
+function parsePeerCertificate(peerCert) {
+    if (peerCert.raw && Buffer.isBuffer(peerCert.raw)) {
+        const cert = new crypto.X509Certificate(peerCert.raw);
+        return parseX509Pem(cert.toString());
+    }
+    const subject = peerCert.subject || {};
+    const issuer = peerCert.issuer || {};
+    const rawSubject = typeof peerCert.subject === 'string' ? peerCert.subject : JSON.stringify(peerCert.subject);
+    const rawIssuer = typeof peerCert.issuer === 'string' ? peerCert.issuer : JSON.stringify(peerCert.issuer);
+    const validFrom = peerCert.valid_from ? new Date(peerCert.valid_from) : new Date(0);
+    const validTo = peerCert.valid_to ? new Date(peerCert.valid_to) : new Date(0);
+    const now = new Date();
+    const isExpired = now < validFrom || now > validTo;
+    const fingerprint256 = (peerCert.fingerprint256 || peerCert.fingerprint || '')
+        .replace(/:/g, '')
+        .toLowerCase();
+    return {
+        subject,
+        issuer,
+        rawSubject,
+        rawIssuer,
+        commonName: subject.CN,
+        serialNumber: peerCert.serialNumber || '',
+        fingerprint256,
+        validFrom,
+        validTo,
+        isExpired,
+        isSelfSigned: rawSubject === rawIssuer,
+    };
+}
+/**
+ * Parses reverse-proxy certificate header values (e.g. Envoy XFCC, Nginx SSL_CLIENT_CERT).
+ */
+function parseProxyClientCertHeader(headerValue) {
+    if (!headerValue || typeof headerValue !== 'string') {
+        return null;
+    }
+    const trimmed = headerValue.trim();
+    // Envoy X-Forwarded-Client-Cert: Cert="<url-encoded-pem>";Subject="...";...
+    if (trimmed.startsWith('Cert=') || trimmed.includes(';Cert=')) {
+        const match = trimmed.match(/Cert="([^"]+)"/i);
+        if (match && match[1]) {
+            return parseX509Pem(match[1]);
+        }
+    }
+    // Direct PEM or URL-encoded PEM
+    if (trimmed.includes('BEGIN%20CERTIFICATE') || trimmed.includes('BEGIN CERTIFICATE') || trimmed.length > 100) {
+        try {
+            return parseX509Pem(trimmed);
+        }
+        catch {
+            // Fallback
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=cert-parser.js.map

package/dist/certificates/cert-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-parser.js","sourceRoot":"","sources":["../../src/certificates/cert-parser.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,0BAqCC;AAKD,oCAqDC;AAKD,oDAiCC;AAKD,gEAyBC;AA1KD,oDAAsC;AAGtC;;;GAGG;AACH,SAAgB,OAAO,CAAC,QAAgB;IACtC,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE9B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,6CAA6C;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,2FAA2F;QAC3F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrC,uCAAuC;gBACvC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzB,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,SAAiB;IAC5C,IAAI,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE3B,qEAAqE;IACrE,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC;YACH,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACjD,GAAG,GAAG,gCAAgC,GAAG,6BAA6B,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAElC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,IAAI,GAAG,GAAG,OAAO,CAAC;IAEnD,oBAAoB;IACpB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,MAAM;QACN,UAAU;QACV,SAAS;QACT,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;QACnE,SAAS;QACT,OAAO;QACP,SAAS;QACT,YAAY;QACZ,MAAM,EAAE,GAAG;KACZ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,QAAa;IAChD,IAAI,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,OAAO,GAAsB,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAsB,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9G,MAAM,SAAS,GAAG,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE1G,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,IAAI,GAAG,GAAG,OAAO,CAAC;IAEnD,MAAM,cAAc,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;SAC3E,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,WAAW,EAAE,CAAC;IAEjB,OAAO;QACL,OAAO;QACP,MAAM;QACN,UAAU;QACV,SAAS;QACT,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;QACzC,cAAc;QACd,SAAS;QACT,OAAO;QACP,SAAS;QACT,YAAY,EAAE,UAAU,KAAK,SAAS;KACvC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,0BAA0B,CAAC,WAAmB;IAC5D,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAEnC,4EAA4E;IAC5E,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC/C,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC7G,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/certificates/cert.types.d.ts

@@ -0,0 +1,60 @@
+import type { AuthUser } from '../guards/guard.interface.js';
+export interface DistinguishedName {
+    CN?: string;
+    O?: string;
+    OU?: string;
+    L?: string;
+    ST?: string;
+    C?: string;
+    emailAddress?: string;
+    [key: string]: string | undefined;
+}
+export interface ParsedCertificate {
+    subject: DistinguishedName;
+    issuer: DistinguishedName;
+    rawSubject: string;
+    rawIssuer: string;
+    commonName?: string;
+    serialNumber: string;
+    fingerprint256: string;
+    validFrom: Date;
+    validTo: Date;
+    isExpired: boolean;
+    isSelfSigned: boolean;
+    rawPem?: string;
+}
+export interface MtlsGuardOptions {
+    /**
+     * Whitelist of allowed Common Names (CN). If empty, any valid CN is accepted.
+     */
+    allowedCommonNames?: string[];
+    /**
+     * Whitelist of allowed Issuer Common Names or DN strings.
+     */
+    allowedIssuers?: string[];
+    /**
+     * Whether to permit expired certificates (default: false).
+     */
+    allowExpired?: boolean;
+    /**
+     * Whether to allow self-signed certificates (default: false).
+     */
+    allowSelfSigned?: boolean;
+    /**
+     * Whether to trust proxy headers (e.g. X-Forwarded-Client-Cert, SSL_CLIENT_S_DN).
+     */
+    trustedProxies?: boolean;
+    /**
+     * Custom header names when behind reverse proxies (Nginx, Envoy, Traefik, Cloudflare).
+     */
+    headerNames?: {
+        cert?: string;
+        dn?: string;
+        verify?: string;
+    };
+    /**
+     * Custom user resolver transforming the validated certificate into an AuthUser.
+     */
+    userResolver?: (cert: ParsedCertificate) => Promise<AuthUser | null> | AuthUser | null;
+}
+//# sourceMappingURL=cert.types.d.ts.map

package/dist/certificates/cert.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert.types.d.ts","sourceRoot":"","sources":["../../src/certificates/cert.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE7D,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;OAEG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF;;OAEG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;CACxF"}

package/dist/certificates/cert.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=cert.types.js.map

package/dist/certificates/cert.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert.types.js","sourceRoot":"","sources":["../../src/certificates/cert.types.ts"],"names":[],"mappings":""}

package/dist/certificates/index.d.ts

@@ -0,0 +1,5 @@
+export * from './cert.types.js';
+export * from './cert-parser.js';
+export * from './mtls.guard.js';
+export * from './jwks.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/certificates/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/certificates/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC"}

package/dist/certificates/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./cert.types.js"), exports);
+__exportStar(require("./cert-parser.js"), exports);
+__exportStar(require("./mtls.guard.js"), exports);
+__exportStar(require("./jwks.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/certificates/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/certificates/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,mDAAiC;AACjC,kDAAgC;AAChC,4CAA0B"}

package/dist/certificates/jwks.d.ts

@@ -0,0 +1,90 @@
+import * as crypto from 'node:crypto';
+import type { ArgosContext } from '@argos-js/net';
+export interface JwkPublicKey {
+    kty: 'RSA' | 'OKP' | string;
+    use?: 'sig' | 'enc' | string;
+    alg?: 'RS256' | 'EdDSA' | string;
+    kid: string;
+    n?: string;
+    e?: string;
+    crv?: string;
+    x?: string;
+    [key: string]: unknown;
+}
+export interface JwksResponse {
+    keys: JwkPublicKey[];
+}
+export interface ManagedKey {
+    kid: string;
+    algorithm: 'RS256' | 'EdDSA';
+    publicKey: crypto.KeyObject;
+    privateKey?: crypto.KeyObject;
+    jwk: JwkPublicKey;
+    createdAt: Date;
+    expiresAt?: Date;
+}
+export interface JwksManagerOptions {
+    keys?: Array<{
+        kid: string;
+        algorithm: 'RS256' | 'EdDSA';
+        publicKey: crypto.KeyObject | string;
+        privateKey?: crypto.KeyObject | string;
+        isDefaultSigning?: boolean;
+    }>;
+}
+export declare class JwksManager {
+    private keysMap;
+    private defaultSigningKid?;
+    constructor(options?: JwksManagerOptions);
+    /**
+     * Adds or registers a public/private key pair to the manager.
+     */
+    addKey(options: {
+        kid: string;
+        algorithm: 'RS256' | 'EdDSA';
+        publicKey: crypto.KeyObject | string;
+        privateKey?: crypto.KeyObject | string;
+        isDefaultSigning?: boolean;
+        expiresAt?: Date;
+    }): ManagedKey;
+    /**
+     * Rotates key: Registers a new active signing key while keeping older keys
+     * valid for signature verification (zero-downtime rotation).
+     */
+    rotateKey(options: {
+        kid: string;
+        algorithm: 'RS256' | 'EdDSA';
+        publicKey: crypto.KeyObject | string;
+        privateKey?: crypto.KeyObject | string;
+    }): ManagedKey;
+    /**
+     * Generates the RFC 7517 compliant JWKS JSON document for /.well-known/jwks.json
+     */
+    getJwks(): JwksResponse;
+    getKey(kid: string): ManagedKey | undefined;
+    getSigningKey(): ManagedKey | undefined;
+    getAllKeys(): ManagedKey[];
+}
+/**
+ * Creates an Argos route handler that serves the /.well-known/jwks.json endpoint.
+ */
+export declare function createJwksHandler(manager: JwksManager): (ctx: ArgosContext) => unknown;
+export interface JwksClientOptions {
+    jwksUri: string;
+    cacheTtlMs?: number;
+    fetcher?: (url: string) => Promise<JwksResponse>;
+}
+/**
+ * Remote JWKS client with in-memory caching and automatic key fetching.
+ */
+export declare class JwksClient {
+    private jwksUri;
+    private cacheTtlMs;
+    private cachedKeys;
+    private lastFetchedAt;
+    private fetcher;
+    constructor(options: JwksClientOptions);
+    private refreshCache;
+    getSigningKey(kid: string): Promise<crypto.KeyObject | undefined>;
+}
+//# sourceMappingURL=jwks.d.ts.map

package/dist/certificates/jwks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../../src/certificates/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;IAC9B,GAAG,EAAE,YAAY,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,KAAK,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;QACrC,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;QACvC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC,CAAC;CACJ;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,iBAAiB,CAAC,CAAS;gBAEvB,OAAO,GAAE,kBAAuB;IAQ5C;;OAEG;IACI,MAAM,CAAC,OAAO,EAAE;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;QACrC,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;QACvC,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,SAAS,CAAC,EAAE,IAAI,CAAC;KAClB,GAAG,UAAU;IAuCd;;;OAGG;IACI,SAAS,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;QACrC,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;KACxC,GAAG,UAAU;IAOd;;OAEG;IACI,OAAO,IAAI,YAAY;IAcvB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAI3C,aAAa,IAAI,UAAU,GAAG,SAAS;IAKvC,UAAU,IAAI,UAAU,EAAE;CAGlC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAMtF;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,UAAU,CAAuC;IACzD,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,OAAO,CAAyC;gBAE5C,OAAO,EAAE,iBAAiB;YAYxB,YAAY;IAoBb,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;CAU/E"}

package/dist/certificates/jwks.js

@@ -0,0 +1,180 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwksClient = exports.JwksManager = void 0;
+exports.createJwksHandler = createJwksHandler;
+const crypto = __importStar(require("node:crypto"));
+class JwksManager {
+    keysMap = new Map();
+    defaultSigningKid;
+    constructor(options = {}) {
+        if (options.keys) {
+            for (const k of options.keys) {
+                this.addKey(k);
+            }
+        }
+    }
+    /**
+     * Adds or registers a public/private key pair to the manager.
+     */
+    addKey(options) {
+        const pubKeyObj = typeof options.publicKey === 'string'
+            ? crypto.createPublicKey(options.publicKey)
+            : options.publicKey;
+        const privKeyObj = options.privateKey
+            ? typeof options.privateKey === 'string'
+                ? crypto.createPrivateKey(options.privateKey)
+                : options.privateKey
+            : undefined;
+        // Export public key as JWK using native crypto KeyObject export
+        const jwkExport = pubKeyObj.export({ format: 'jwk' });
+        const jwk = {
+            ...jwkExport,
+            use: 'sig',
+            alg: options.algorithm,
+            kid: options.kid,
+        };
+        const managed = {
+            kid: options.kid,
+            algorithm: options.algorithm,
+            publicKey: pubKeyObj,
+            privateKey: privKeyObj,
+            jwk,
+            createdAt: new Date(),
+            expiresAt: options.expiresAt,
+        };
+        this.keysMap.set(options.kid, managed);
+        if (options.isDefaultSigning || !this.defaultSigningKid) {
+            this.defaultSigningKid = options.kid;
+        }
+        return managed;
+    }
+    /**
+     * Rotates key: Registers a new active signing key while keeping older keys
+     * valid for signature verification (zero-downtime rotation).
+     */
+    rotateKey(options) {
+        return this.addKey({
+            ...options,
+            isDefaultSigning: true,
+        });
+    }
+    /**
+     * Generates the RFC 7517 compliant JWKS JSON document for /.well-known/jwks.json
+     */
+    getJwks() {
+        const now = new Date();
+        const publicKeys = [];
+        for (const key of this.keysMap.values()) {
+            if (key.expiresAt && key.expiresAt < now) {
+                continue;
+            }
+            publicKeys.push(key.jwk);
+        }
+        return { keys: publicKeys };
+    }
+    getKey(kid) {
+        return this.keysMap.get(kid);
+    }
+    getSigningKey() {
+        if (!this.defaultSigningKid)
+            return undefined;
+        return this.keysMap.get(this.defaultSigningKid);
+    }
+    getAllKeys() {
+        return Array.from(this.keysMap.values());
+    }
+}
+exports.JwksManager = JwksManager;
+/**
+ * Creates an Argos route handler that serves the /.well-known/jwks.json endpoint.
+ */
+function createJwksHandler(manager) {
+    return (ctx) => {
+        return ctx.json(manager.getJwks(), 200, {
+            'cache-control': 'public, max-age=3600, stale-while-revalidate=86400',
+        });
+    };
+}
+/**
+ * Remote JWKS client with in-memory caching and automatic key fetching.
+ */
+class JwksClient {
+    jwksUri;
+    cacheTtlMs;
+    cachedKeys = new Map();
+    lastFetchedAt = 0;
+    fetcher;
+    constructor(options) {
+        this.jwksUri = options.jwksUri;
+        this.cacheTtlMs = options.cacheTtlMs ?? 600000;
+        this.fetcher = options.fetcher ?? (async (url) => {
+            const res = await fetch(url);
+            if (!res.ok) {
+                throw new Error(`Failed to fetch JWKS from ${url}: HTTP ${res.status}`);
+            }
+            return (await res.json());
+        });
+    }
+    async refreshCache() {
+        const data = await this.fetcher(this.jwksUri);
+        this.cachedKeys.clear();
+        if (Array.isArray(data.keys)) {
+            for (const jwk of data.keys) {
+                try {
+                    const keyObject = crypto.createPublicKey({
+                        key: jwk,
+                        format: 'jwk',
+                    });
+                    this.cachedKeys.set(jwk.kid, keyObject);
+                }
+                catch {
+                    // ignore unsupported or invalid keys
+                }
+            }
+        }
+        this.lastFetchedAt = Date.now();
+    }
+    async getSigningKey(kid) {
+        const now = Date.now();
+        const isCacheExpired = now - this.lastFetchedAt > this.cacheTtlMs;
+        if (isCacheExpired || !this.cachedKeys.has(kid)) {
+            await this.refreshCache();
+        }
+        return this.cachedKeys.get(kid);
+    }
+}
+exports.JwksClient = JwksClient;
+//# sourceMappingURL=jwks.js.map

package/dist/certificates/jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../src/certificates/jwks.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsJA,8CAMC;AA5JD,oDAAsC;AAuCtC,MAAa,WAAW;IACd,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IACxC,iBAAiB,CAAU;IAEnC,YAAY,UAA8B,EAAE;QAC1C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,OAOb;QACC,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;YACrD,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3C,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAEtB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU;YACnC,CAAC,CAAC,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;gBACtC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC7C,CAAC,CAAC,OAAO,CAAC,UAAU;YACtB,CAAC,CAAC,SAAS,CAAC;QAEd,gEAAgE;QAChE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAiB,CAAC;QACtE,MAAM,GAAG,GAAiB;YACxB,GAAG,SAAS;YACZ,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO,CAAC,SAAS;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC;QAEF,MAAM,OAAO,GAAe;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,UAAU;YACtB,GAAG;YACH,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAEvC,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC;QACvC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACI,SAAS,CAAC,OAKhB;QACC,OAAO,IAAI,CAAC,MAAM,CAAC;YACjB,GAAG,OAAO;YACV,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAmB,EAAE,CAAC;QAEtC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAEM,MAAM,CAAC,GAAW;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAEM,aAAa;QAClB,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClD,CAAC;IAEM,UAAU;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;CACF;AA1GD,kCA0GC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,OAAoB;IACpD,OAAO,CAAC,GAAiB,EAAE,EAAE;QAC3B,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE;YACtC,eAAe,EAAE,oDAAoD;SACtE,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAQD;;GAEG;AACH,MAAa,UAAU;IACb,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,aAAa,GAAW,CAAC,CAAC;IAC1B,OAAO,CAAyC;IAExD,YAAY,OAA0B;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAExB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;wBACvC,GAAG,EAAE,GAAU;wBACf,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;oBACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,qCAAqC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,GAAW;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC;QAElE,IAAI,cAAc,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;CACF;AAjDD,gCAiDC"}