@atlasauth/emulator-core 0.1.0 → 0.3.0

package/dist/handlers/federation.js

@@ -0,0 +1,481 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.federationHandlers = federationHandlers;
+const errors_1 = require("../errors");
+const jws_1 = require("../jws");
+const store_1 = require("../store");
+const device_1 = require("./device");
+const support_1 = require("./support");
+const util_1 = require("./util");
+/**
+ * Workload identity federation for machines: trust policies (`/v1/machine_trust_policies`) and the public exchange
+ * `POST /v1/machines/federate`. A GitHub Actions, Kubernetes, Google Cloud or generic OIDC token is verified against the
+ * issuer's keys (inline `jwks`, `jwks_uri`, or discovery through the engine's `fetch` option), its issuer, audience,
+ * expiry (24 h token age cap), subject pattern and claim conditions are checked, and a short machine token comes back.
+ * An AWS proof is a presigned STS GetCallerIdentity request, validated strictly (STS host, https, path, exact body,
+ * header whitelist, audience signed as `x-atlas-audience`); the engine never contacts AWS itself: the identity comes from
+ * the `fetch` option, which a test points at a fake STS. Every refusal is the same 403.
+ */
+const KINDS = ['github_actions', 'kubernetes', 'aws', 'gcp', 'oidc'];
+const DEFAULT_ISSUERS = { github_actions: 'https://token.actions.githubusercontent.com', gcp: 'https://accounts.google.com' };
+const SLUG = /^[a-z0-9][a-z0-9_.-]{0,63}$/;
+const MAX_PER_MACHINE = 20;
+const MAX_TOKEN_AGE_S = 24 * 3600;
+const SKEW_S = 30;
+const STS_HOST = /^sts(\.[a-z0-9-]{4,30})?\.amazonaws\.com(\.cn)?$/;
+const GET_CALLER_BODY = 'Action=GetCallerIdentity&Version=2011-06-15';
+const AWS_HEADERS = new Set(['authorization', 'host', 'content-type', 'content-length', 'x-amz-date', 'x-amz-security-token', 'x-amz-content-sha256', 'x-atlas-audience', 'user-agent']);
+const st = (0, support_1.engineState)((e) => ({ policies: new store_1.Table('machine_trust_policies', e.clock.now, 'mtp'), spentAws: new Set() }));
+const bad = (message, param) => new errors_1.EmulatorError('VALIDATION_FAILED', message, param);
+const isObj = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const issuerOf = (p) => p.issuer ?? DEFAULT_ISSUERS[p.kind] ?? null;
+function subjectPatternProblem(kind, pattern) {
+    if (!pattern || pattern.length > 512)
+        return 'subject_pattern is 1 to 512 characters.';
+    if (/^[*?]+$/.test(pattern))
+        return 'subject_pattern cannot be only wildcards: name who is trusted.';
+    if (kind === 'github_actions' && !/^repo:[A-Za-z0-9_.-]+\/[^*?]*/.test(pattern))
+        return 'For github_actions the pattern must name the owner, for example repo:my-org/my-repo:ref:refs/heads/main (wildcards allowed after the owner).';
+    if (kind === 'aws' && !/^arn:aws[a-z-]*:(iam|sts)::\d{12}:/.test(pattern))
+        return 'For aws the pattern must start with the account, for example arn:aws:iam::123456789012:role/deployer.';
+    if (kind === 'kubernetes' && !/^system:serviceaccount:[^*?:]+:/.test(pattern))
+        return 'For kubernetes the pattern must name the namespace, for example system:serviceaccount:prod:deployer.';
+    return null;
+}
+function httpsUrl(raw, param) {
+    if (typeof raw !== 'string' || raw.length > 2048)
+        throw bad(`${param} must be an https URL.`, param);
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        throw bad(`${param} must be an https URL.`, param);
+    }
+    if (u.protocol !== 'https:' || u.username || u.password || u.search || u.hash)
+        throw bad(`${param} must be an https URL without credentials, query or fragment.`, param);
+    return raw;
+}
+function conditionsOf(raw) {
+    if (!Array.isArray(raw) || raw.length > 20)
+        throw bad('claim_conditions is a list of at most 20 conditions.', 'claim_conditions');
+    return raw.map((c, i) => {
+        const at = `claim_conditions[${i}]`;
+        if (!isObj(c))
+            throw bad('Each condition is an object with claim, op and value.', at);
+        if (Object.keys(c).some((k) => !['claim', 'op', 'value'].includes(k)))
+            throw bad('A condition takes claim, op and value.', at);
+        if (typeof c.claim !== 'string' || !c.claim || c.claim.length > 128)
+            throw bad('claim is a claim name of 1 to 128 characters.', `${at}.claim`);
+        if (!['equals', 'in', 'glob', 'exists'].includes(c.op))
+            throw bad('op is equals, in, glob or exists.', `${at}.op`);
+        if (c.op === 'exists') {
+            if (c.value !== undefined)
+                throw bad('exists takes no value.', `${at}.value`);
+            return { claim: c.claim, op: 'exists' };
+        }
+        const values = typeof c.value === 'string' ? [c.value] : Array.isArray(c.value) ? c.value : null;
+        if (!values || !values.length || values.length > 20 || values.some((v) => typeof v !== 'string' || !v || v.length > 256))
+            throw bad('value is a string, or a list of up to 20 strings of at most 256 characters.', `${at}.value`);
+        if (c.op === 'glob' && values.some((v) => /^[*?]+$/.test(v)))
+            throw bad('A glob cannot be only wildcards.', `${at}.value`);
+        return { claim: c.claim, op: c.op, value: c.value };
+    });
+}
+function jwksOf(raw) {
+    const keys = isObj(raw) ? raw.keys : undefined;
+    if (!Array.isArray(keys) || !keys.length || keys.length > 20)
+        throw bad('jwks is { keys: [...] } with 1 to 20 public keys.', 'jwks');
+    for (const k of keys)
+        if (!isObj(k) || typeof k.kty !== 'string' || ['d', 'p', 'q', 'dp', 'dq', 'qi', 'k', 'oth'].some((x) => x in k))
+            throw bad('Every key in jwks must be a public JWK (no private parameters).', 'jwks');
+    return { keys };
+}
+function normalize(b, existing) {
+    const kind = b.kind ?? existing?.kind;
+    if (!KINDS.includes(kind))
+        throw bad(`kind must be one of ${KINDS.join(', ')}.`, 'kind');
+    if (existing && kind !== existing.kind)
+        throw bad('kind cannot change. Create a new policy.', 'kind');
+    const name = b.name ?? existing?.name;
+    if (typeof name !== 'string' || !SLUG.test(name))
+        throw bad('name is 1-64 characters: lowercase letters, digits, dot, dash or underscore, starting with a letter or digit.', 'name');
+    const audience = b.audience ?? existing?.audience;
+    if (typeof audience !== 'string' || !audience || audience.length > 255)
+        throw bad('audience is 1 to 255 characters.', 'audience');
+    if (kind === 'aws' && !/^[\x21-\x7e]{1,128}$/.test(audience))
+        throw bad('For aws the audience is 1 to 128 printable characters without spaces.', 'audience');
+    const subjectPattern = b.subject_pattern ?? existing?.subject_pattern;
+    if (typeof subjectPattern !== 'string')
+        throw bad('subject_pattern is required.', 'subject_pattern');
+    const problem = subjectPatternProblem(kind, subjectPattern);
+    if (problem)
+        throw bad(problem, 'subject_pattern');
+    let issuer = b.issuer !== undefined ? (b.issuer === null ? null : httpsUrl(b.issuer, 'issuer')) : (existing?.issuer ?? null);
+    const jwksUri = b.jwks_uri !== undefined ? (b.jwks_uri === null ? null : httpsUrl(b.jwks_uri, 'jwks_uri')) : (existing?.jwks_uri ?? null);
+    const jwks = b.jwks !== undefined ? (b.jwks === null ? null : jwksOf(b.jwks)) : (existing?.jwks ?? null);
+    if (kind === 'aws') {
+        if (issuer || jwksUri || jwks)
+            throw bad('An aws policy takes no issuer, jwks_uri or jwks: the signed STS request is the proof.', 'issuer');
+    }
+    else {
+        if (!issuer && !DEFAULT_ISSUERS[kind])
+            throw bad(`A ${kind} policy needs an issuer.`, 'issuer');
+        if (issuer === DEFAULT_ISSUERS[kind])
+            issuer = null;
+    }
+    const maxTtl = b.max_ttl_seconds ?? existing?.max_ttl_seconds ?? 600;
+    if (typeof maxTtl !== 'number' || !Number.isInteger(maxTtl) || maxTtl < 60 || maxTtl > 3600)
+        throw bad('max_ttl_seconds is an integer from 60 to 3600.', 'max_ttl_seconds');
+    const enabled = b.enabled ?? existing?.enabled ?? true;
+    if (typeof enabled !== 'boolean')
+        throw bad('enabled must be true or false.', 'enabled');
+    return { name, kind, issuer, jwks_uri: jwksUri, jwks, audience, subject_pattern: subjectPattern, claim_conditions: b.claim_conditions !== undefined ? conditionsOf(b.claim_conditions) : (existing?.claim_conditions ?? []), max_ttl_seconds: maxTtl, enabled };
+}
+const present = (p) => ({
+    object: 'machine_trust_policy',
+    id: p.id,
+    machine_id: p.machine_id,
+    name: p.name,
+    kind: p.kind,
+    issuer: issuerOf(p),
+    jwks_uri: p.jwks_uri ?? null,
+    jwks: p.jwks ?? null,
+    audience: p.audience,
+    subject_pattern: p.subject_pattern,
+    claim_conditions: p.claim_conditions,
+    max_ttl_seconds: p.max_ttl_seconds,
+    enabled: p.enabled,
+    last_used_at: p.last_used_at ?? null,
+    created_at: p.created_at,
+    updated_at: p.updated_at,
+});
+const claimString = (v) => (Array.isArray(v) ? v : [v]).filter((x) => ['string', 'number', 'boolean'].includes(typeof x)).map(String);
+/** A dotted claim path; `kubernetes.io.namespace` reads `claims['kubernetes.io'].namespace` when the whole key is absent. */
+function claimAt(claims, path) {
+    if (path in claims)
+        return claims[path];
+    let cur = claims;
+    const parts = path.split('.');
+    for (let i = 0; i < parts.length; i++) {
+        if (!cur || typeof cur !== 'object')
+            return undefined;
+        let matched = false;
+        for (let j = parts.length; j > i; j--) {
+            const key = parts.slice(i, j).join('.');
+            if (key in cur) {
+                cur = cur[key];
+                i = j - 1;
+                matched = true;
+                break;
+            }
+        }
+        if (!matched)
+            return undefined;
+    }
+    return cur;
+}
+const conditionsPass = (conditions, claims) => conditions.every((c) => {
+    const got = claimAt(claims, c.claim);
+    if (c.op === 'exists')
+        return got !== undefined && got !== null;
+    const have = got === undefined || got === null ? [] : claimString(got);
+    const want = c.value === undefined ? [] : claimString(c.value);
+    if (!have.length || !want.length)
+        return false;
+    if (c.op === 'equals')
+        return have.some((h) => want.includes(h));
+    if (c.op === 'in')
+        return have.every((h) => want.includes(h));
+    return have.some((h) => want.some((w) => (0, jws_1.globMatch)(w, h)));
+});
+const deny = (reason) => ({ ok: false, reason });
+const judge = (p, subject, claims) => (!(0, jws_1.globMatch)(p.subject_pattern, subject) ? deny('subject_mismatch') : !conditionsPass(p.claim_conditions, claims) ? deny('claim_condition_failed') : { ok: true, subject, claims });
+async function issuerKeys(e, p) {
+    if (p.jwks?.keys?.length)
+        return p.jwks.keys;
+    const http = e.options.fetch ?? fetch;
+    const issuer = issuerOf(p);
+    let uri = p.jwks_uri;
+    const get = async (url) => {
+        const res = await http(url, { method: 'GET', headers: { accept: 'application/json' } });
+        if (!res.ok)
+            throw new Error(`status ${res.status}`);
+        return res.json();
+    };
+    if (!uri) {
+        const doc = await get(`${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`);
+        if (typeof doc.issuer !== 'string' || doc.issuer.replace(/\/+$/, '') !== issuer.replace(/\/+$/, ''))
+            throw new Error('issuer mismatch');
+        uri = doc.jwks_uri;
+    }
+    if (typeof uri !== 'string' || !/^https:\/\//i.test(uri))
+        throw new Error('jwks_uri must be https');
+    const set = await get(uri);
+    return (Array.isArray(set.keys) ? set.keys : []).filter((k) => !('d' in k) && !('k' in k));
+}
+async function verifyOidc(e, p, token) {
+    const issuer = issuerOf(p);
+    if (!issuer || p.kind === 'aws')
+        return deny('not_an_oidc_policy');
+    const jwt = (0, jws_1.decodeJwt)(token);
+    if (!jwt || !jws_1.SUPPORTED_ALGS.includes(String(jwt.header.alg)))
+        return deny('token_invalid');
+    let keys;
+    try {
+        keys = await issuerKeys(e, p);
+    }
+    catch {
+        return deny('issuer_keys_unavailable');
+    }
+    const candidates = keys.filter((k) => (jwt.header.kid ? k.kid === jwt.header.kid : true) && (!k.alg || k.alg === jwt.header.alg));
+    let verified = false;
+    for (const k of candidates)
+        if (await (0, jws_1.verifyJws)(jwt, k)) {
+            verified = true;
+            break;
+        }
+    if (!verified)
+        return deny('token_invalid');
+    const c = jwt.payload;
+    const nowS = e.clock.now() / 1000;
+    if (c.iss !== issuer)
+        return deny('token_invalid');
+    const aud = Array.isArray(c.aud) ? c.aud : [c.aud];
+    if (!aud.includes(p.audience))
+        return deny('token_invalid');
+    if (typeof c.exp !== 'number')
+        return deny('no_expiry');
+    if (c.exp + SKEW_S <= nowS)
+        return deny('token_invalid');
+    if (typeof c.nbf === 'number' && c.nbf - SKEW_S > nowS)
+        return deny('token_invalid');
+    if (typeof c.iat === 'number' && c.exp - c.iat > MAX_TOKEN_AGE_S)
+        return deny('token_too_long_lived');
+    if (typeof c.sub !== 'string' || !c.sub)
+        return deny('no_subject');
+    return judge(p, c.sub, c);
+}
+function checkAws(proof, audience) {
+    const fail = (reason) => ({ ok: false, reason });
+    if (proof.method !== undefined && String(proof.method).toUpperCase() !== 'POST')
+        return fail('aws_method');
+    if (typeof proof.url !== 'string')
+        return fail('aws_url');
+    let url;
+    try {
+        url = new URL(proof.url);
+    }
+    catch {
+        return fail('aws_url');
+    }
+    if (url.protocol !== 'https:' || !STS_HOST.test(url.hostname) || url.port || url.pathname !== '/' || url.search || url.username || url.password)
+        return fail('aws_url');
+    if (proof.body !== GET_CALLER_BODY)
+        return fail('aws_body');
+    if (!isObj(proof.headers))
+        return fail('aws_headers');
+    const headers = {};
+    for (const [k, v] of Object.entries(proof.headers)) {
+        const name = k.toLowerCase();
+        const value = Array.isArray(v) ? v[0] : v;
+        if (typeof value !== 'string' || !AWS_HEADERS.has(name) || value.length > 4096)
+            return fail('aws_headers');
+        headers[name] = value;
+    }
+    if (!headers.authorization || !headers['x-amz-date'])
+        return fail('aws_headers');
+    if (headers.host && headers.host !== url.host)
+        return fail('aws_headers');
+    if (headers['x-atlas-audience'] !== audience)
+        return fail('aws_audience');
+    const signed = /SignedHeaders=([^,\s]+)/.exec(headers.authorization)?.[1]?.split(';') ?? [];
+    if (!signed.includes('x-atlas-audience'))
+        return fail('aws_audience_unsigned');
+    return { ok: true, url: url.toString(), headers, fingerprint: `${headers.authorization}\n${headers['x-amz-date']}` };
+}
+async function verifyAws(e, p, proof) {
+    if (p.kind !== 'aws')
+        return deny('not_an_aws_policy');
+    const checked = checkAws(proof, p.audience);
+    if (!checked.ok)
+        return deny(checked.reason);
+    if (st(e).spentAws.has(checked.fingerprint))
+        return deny('aws_replayed');
+    let xml;
+    try {
+        const res = await (e.options.fetch ?? (() => Promise.reject(new Error('no fetch'))))(checked.url, { method: 'POST', headers: checked.headers, body: GET_CALLER_BODY });
+        if (!res.ok)
+            return { ...deny('aws_rejected') };
+        xml = await res.text();
+    }
+    catch {
+        return deny('aws_unavailable');
+    }
+    const field = (tag) => new RegExp(`<${tag}>([^<]{1,2048})</${tag}>`).exec(xml)?.[1];
+    const arn = field('Arn');
+    const account = field('Account');
+    if (!arn || !account || !/^\d{12}$/.test(account))
+        return deny('aws_response');
+    // An assumed-role ARN is the role it assumes; other ARNs are their own identity.
+    const m = /^arn:(aws[a-z-]*):sts::(\d{12}):assumed-role\/([^/]+)\/(.+)$/.exec(arn);
+    const subject = m ? `arn:${m[1]}:iam::${m[2]}:role/${m[3]}` : arn;
+    const verdict = judge(p, subject, { arn, account, ...(field('UserId') ? { user_id: field('UserId') } : {}), ...(m ? { session_name: m[4] } : {}), sub: subject });
+    return verdict.ok ? { ...verdict, fingerprint: checked.fingerprint } : verdict;
+}
+/** First enabled policy that accepts the subject proof; every refusal reason is kept for the dry run. */
+async function match(e, policies, input, policyId) {
+    const reasons = [];
+    const pool = policies.filter((p) => p.enabled && (!policyId || p.id === policyId));
+    if (!pool.length)
+        return { reasons: ['no_matching_policy'] };
+    for (const p of pool) {
+        let v;
+        if (input.token !== undefined) {
+            const iss = (0, jws_1.decodeJwt)(input.token)?.payload.iss;
+            if (typeof iss !== 'string' || (p.kind === 'aws') || (issuerOf(p) ?? '').replace(/\/+$/, '') !== iss.replace(/\/+$/, '')) {
+                reasons.push('issuer_mismatch');
+                continue;
+            }
+            v = await verifyOidc(e, p, input.token);
+        }
+        else
+            v = await verifyAws(e, p, input.aws);
+        if (v.ok)
+            return { policy: p, verdict: v };
+        reasons.push(v.reason);
+    }
+    return { reasons };
+}
+const policyOf = (e, id) => {
+    const p = st(e).policies.get(id);
+    if (!p)
+        throw (0, errors_1.notFound)('Trust policy');
+    return p;
+};
+function federationHandlers() {
+    const machineOf = (e, id) => {
+        const m = e.db.machines.get(String(id ?? ''));
+        if (!m || m.deleted)
+            throw new errors_1.EmulatorError('NOT_FOUND', 'machine_id is not a machine.', 'machine_id');
+        return m;
+    };
+    return [
+        {
+            method: 'GET',
+            pattern: '/v1/machine_trust_policies',
+            scope: 'machines:read',
+            handler: (c) => {
+                const mid = c.query.get('machine_id');
+                return { body: { object: 'list', data: st(c.engine).policies.filter((p) => !mid || p.machine_id === mid).map(present), has_more: false } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/machine_trust_policies',
+            scope: 'machines:write',
+            handler: (c) => {
+                const e = c.engine;
+                const m = machineOf(e, (0, util_1.need)(c.body, 'machine_id'));
+                const fields = normalize(c.body);
+                const s = st(e);
+                if (s.policies.filter((p) => p.machine_id === m.id).length >= MAX_PER_MACHINE)
+                    throw new errors_1.EmulatorError('CONFLICT', `A machine has at most ${MAX_PER_MACHINE} trust policies.`);
+                if (s.policies.find((p) => p.machine_id === m.id && p.name === fields.name))
+                    throw new errors_1.EmulatorError('CONFLICT', `This machine already has a trust policy named "${fields.name}".`, 'name');
+                const now = e.clock.now();
+                const row = s.policies.insert({ machine_id: m.id, ...fields, last_used_at: null, created_at: now, updated_at: now });
+                return { status: 201, body: present(row) };
+            },
+        },
+        { method: 'GET', pattern: '/v1/machine_trust_policies/:id', scope: 'machines:read', handler: (c) => ({ body: present(policyOf(c.engine, c.params.id)) }) },
+        {
+            method: 'PATCH',
+            pattern: '/v1/machine_trust_policies/:id',
+            scope: 'machines:write',
+            handler: (c) => {
+                const e = c.engine;
+                const p = policyOf(e, c.params.id);
+                const fields = normalize(c.body, p);
+                if (fields.name !== p.name && st(e).policies.find((x) => x.machine_id === p.machine_id && x.name === fields.name))
+                    throw new errors_1.EmulatorError('CONFLICT', `This machine already has a trust policy named "${fields.name}".`, 'name');
+                Object.assign(p, fields, { updated_at: e.clock.now() });
+                return { body: present(p) };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/machine_trust_policies/:id',
+            scope: 'machines:write',
+            handler: (c) => {
+                const p = policyOf(c.engine, c.params.id);
+                st(c.engine).policies.delete(p.id);
+                return { body: { object: 'machine_trust_policy', id: p.id, deleted: true } };
+            },
+        },
+        {
+            // A dry run: would this proof be accepted by this policy (even disabled)? Mints and spends nothing.
+            method: 'POST',
+            pattern: '/v1/machine_trust_policies/:id/test',
+            scope: 'machines:read',
+            handler: async (c) => {
+                const p = policyOf(c.engine, c.params.id);
+                if ((c.body.token === undefined) === (c.body.aws === undefined))
+                    throw bad('Send token (OIDC kinds) or aws (aws kind), not both and not neither.', 'token');
+                if (c.body.token !== undefined && typeof c.body.token !== 'string')
+                    throw bad('token must be a string.', 'token');
+                if (c.body.aws !== undefined && !isObj(c.body.aws))
+                    throw bad('aws must be an object.', 'aws');
+                const found = await match(c.engine, [{ ...p, enabled: true }], { token: c.body.token, aws: c.body.aws }, p.id);
+                return 'verdict' in found
+                    ? { body: { object: 'machine_trust_policy_test', accepted: true, subject: found.verdict.subject, claims: found.verdict.claims, reasons: [] } }
+                    : { body: { object: 'machine_trust_policy_test', accepted: false, subject: null, claims: null, reasons: [...new Set(found.reasons)] } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/machines/federate',
+            public: true,
+            handler: (c) => federate(c),
+        },
+    ];
+}
+async function federate(c) {
+    const e = c.engine;
+    const b = c.body;
+    const machineId = typeof b.machine_id === 'string' ? b.machine_id.trim() : '';
+    if (!machineId)
+        throw bad('A `machine_id` is required.', 'machine_id');
+    if ((b.token === undefined) === (b.aws === undefined))
+        throw bad('Send `token` (a GitHub Actions, Kubernetes, GCP or OIDC token) or `aws` (a signed GetCallerIdentity request), not both and not neither.', 'token');
+    if (b.token !== undefined && (typeof b.token !== 'string' || !b.token || b.token.length > 16_384))
+        throw bad('`token` must be a JWT string.', 'token');
+    if (b.aws !== undefined && !isObj(b.aws))
+        throw bad('`aws` must be an object.', 'aws');
+    if (b.policy_id !== undefined && typeof b.policy_id !== 'string')
+        throw bad('`policy_id` must be a trust policy id.', 'policy_id');
+    // The same answer as a refused token: a caller learns nothing about which machines exist.
+    const refused = () => new errors_1.EmulatorError('FORBIDDEN', 'No trust policy of this machine accepts that token.');
+    const m = e.db.machines.get(machineId);
+    if (!m || m.deleted || m.status !== 'active')
+        throw refused();
+    const proved = await (0, device_1.provedBindingOf)(c);
+    (0, device_1.enforceTokenBinding)(m, proved);
+    const found = await match(e, st(e).policies.filter((p) => p.machine_id === m.id), { token: b.token, aws: b.aws }, b.policy_id);
+    if (!('verdict' in found))
+        throw refused();
+    const { policy, verdict } = found;
+    const issued = await (0, device_1.issueMachineToken)(c, m, b, {
+        proved,
+        maxTtlSeconds: policy.max_ttl_seconds,
+        extraClaims: { fed: { kind: policy.kind, policy_id: policy.id, sub: verdict.subject } },
+        // The signed AWS request is spent only once the token is certain to be issued.
+        beforeIssue: () => {
+            if (verdict.fingerprint)
+                st(e).spentAws.add(verdict.fingerprint);
+        },
+    });
+    policy.last_used_at = e.clock.now();
+    return issued;
+}
+//# sourceMappingURL=federation.js.map

package/dist/handlers/federation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/handlers/federation.ts"],"names":[],"mappings":";;AAySA,gDA+EC;AAtXD,sCAAoD;AACpD,gCAAyE;AAEzE,oCAAiC;AACjC,qCAAmF;AACnF,uCAAwC;AACxC,iCAA8B;AAE9B;;;;;;;;GAQG;AACH,MAAM,KAAK,GAAG,CAAC,gBAAgB,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC;AAC9E,MAAM,eAAe,GAA2B,EAAE,cAAc,EAAE,6CAA6C,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC;AACtJ,MAAM,IAAI,GAAG,6BAA6B,CAAC;AAC3C,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,QAAQ,GAAG,kDAAkD,CAAC;AACpE,MAAM,eAAe,GAAG,6CAA6C,CAAC;AACtE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzL,MAAM,EAAE,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,aAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC,CAAC,CAAC;AAE5I,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACvG,MAAM,KAAK,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1F,MAAM,QAAQ,GAAG,CAAC,CAAM,EAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAExF,SAAS,qBAAqB,CAAC,IAAY,EAAE,OAAe;IAC1D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,yCAAyC,CAAC;IACvF,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,gEAAgE,CAAC;IACrG,IAAI,IAAI,KAAK,gBAAgB,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,8IAA8I,CAAC;IACvO,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,uGAAuG,CAAC;IAC1L,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,sGAAsG,CAAC;IAC7L,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY,EAAE,KAAa;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,GAAG,CAAC,GAAG,KAAK,wBAAwB,EAAE,KAAK,CAAC,CAAC;IACrG,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,CAAC,GAAG,KAAK,wBAAwB,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI;QAAE,MAAM,GAAG,CAAC,GAAG,KAAK,+DAA+D,EAAE,KAAK,CAAC,CAAC;IACzK,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,GAAG,CAAC,sDAAsD,EAAE,kBAAkB,CAAC,CAAC;IAClI,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,uDAAuD,EAAE,EAAE,CAAC,CAAC;QACtF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,wCAAwC,EAAE,EAAE,CAAC,CAAC;QAC/H,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,GAAG,CAAC,+CAA+C,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/I,IAAI,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,GAAG,CAAC,mCAAmC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnH,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,GAAG,CAAC,wBAAwB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9E,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACjG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC,6EAA6E,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3O,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,kCAAkC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACnI,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,GAAG,CAAC,mDAAmD,EAAE,MAAM,CAAC,CAAC;IACrI,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,iEAAiE,EAAE,MAAM,CAAC,CAAC;IAC5N,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,CAAM,EAAE,QAAc;IACvC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,EAAE,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,GAAG,CAAC,uBAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzF,IAAI,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI;QAAE,MAAM,GAAG,CAAC,0CAA0C,EAAE,MAAM,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,EAAE,IAAI,CAAC;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,GAAG,CAAC,+GAA+G,EAAE,MAAM,CAAC,CAAC;IACrL,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ,CAAC;IAClD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,GAAG,CAAC,kCAAkC,EAAE,UAAU,CAAC,CAAC;IAClI,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,GAAG,CAAC,uEAAuE,EAAE,UAAU,CAAC,CAAC;IAC7J,MAAM,cAAc,GAAG,CAAC,CAAC,eAAe,IAAI,QAAQ,EAAE,eAAe,CAAC;IACtE,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,8BAA8B,EAAE,iBAAiB,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5D,IAAI,OAAO;QAAE,MAAM,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACnD,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;IAC7H,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;IACzG,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,MAAM,IAAI,OAAO,IAAI,IAAI;YAAE,MAAM,GAAG,CAAC,uFAAuF,EAAE,QAAQ,CAAC,CAAC;IAC9I,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,CAAC,KAAK,IAAI,0BAA0B,EAAE,QAAQ,CAAC,CAAC;QAChG,IAAI,MAAM,KAAK,eAAe,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,eAAe,IAAI,QAAQ,EAAE,eAAe,IAAI,GAAG,CAAC;IACrE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,IAAI;QAAE,MAAM,GAAG,CAAC,gDAAgD,EAAE,iBAAiB,CAAC,CAAC;IAC5K,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;IACvD,IAAI,OAAO,OAAO,KAAK,SAAS;QAAE,MAAM,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAClQ,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAM,EAAO,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,sBAAsB;IAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;IAC5B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;IACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,eAAe,EAAE,CAAC,CAAC,eAAe;IAClC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;IACpC,eAAe,EAAE,CAAC,CAAC,eAAe;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;IACpC,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,UAAU,EAAE,CAAC,CAAC,UAAU;CACzB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAEzJ,6HAA6H;AAC7H,SAAS,OAAO,CAAC,MAAW,EAAE,IAAY;IACxC,IAAI,IAAI,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,GAAG,GAAQ,MAAM,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;gBACf,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBACf,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACV,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,UAAiB,EAAE,MAAW,EAAW,EAAE,CACjE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,eAAS,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAGL,MAAM,IAAI,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,MAAM,KAAK,GAAG,CAAC,CAAM,EAAE,OAAe,EAAE,MAAW,EAAW,EAAE,CAAC,CAAC,CAAC,IAAA,eAAS,EAAC,CAAC,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AAEpP,KAAK,UAAU,UAAU,CAAC,CAAS,EAAE,CAAM;IACzC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IAC5B,IAAI,GAAG,GAAkB,CAAC,CAAC,QAAQ,CAAC;IACpC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAW,EAAgB,EAAE;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAC;QACxF,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxI,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAS,EAAE,CAAM,EAAE,KAAa;IACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAA,eAAS,EAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3F,IAAI,IAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClI,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,IAAI,MAAM,IAAA,eAAS,EAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;IACpF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAClC,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,GAAG,GAAG,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,MAAM,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,eAAe;QAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAU,EAAE,QAAgB;IAC5C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3G,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IACxK,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3G,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,kBAAkB,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;AACvH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,CAAS,EAAE,CAAM,EAAE,KAAU;IACpD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IACzE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACvK,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAChD,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,oBAAoB,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/E,iFAAiF;IACjF,MAAM,CAAC,GAAG,8DAA8D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAClK,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACjF,CAAC;AAED,yGAAyG;AACzG,KAAK,UAAU,KAAK,CAAC,CAAS,EAAE,QAAe,EAAE,KAAoC,EAAE,QAAiB;IACtG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAU,CAAC;QACf,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAA,eAAS,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC;YAChD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;gBACzH,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;;YAAM,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,GAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAsB,EAAO,EAAE;IAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAA,iBAAQ,EAAC,cAAc,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,SAAgB,kBAAkB;IAChC,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAW,EAAO,EAAE;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,8BAA8B,EAAE,YAAY,CAAC,CAAC;QACxG,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,4BAA4B;YACrC,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7I,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4BAA4B;YACrC,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,IAAA,WAAI,EAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,eAAe;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,yBAAyB,eAAe,kBAAkB,CAAC,CAAC;gBAC/K,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,kDAAkD,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC5L,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,CAAC;SACF;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;QAC1J;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,gCAAgC;YACzC,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACpC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,kDAAkD,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;gBAClO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACxD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,gCAAgC;YACzC,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1C,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YAC/E,CAAC;SACF;QACD;YACE,oGAAoG;YACpG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qCAAqC;YAC9C,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;oBAAE,MAAM,GAAG,CAAC,sEAAsE,EAAE,OAAO,CAAC,CAAC;gBAC5J,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;gBAClH,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;gBAC/F,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC/G,OAAO,SAAS,IAAI,KAAK;oBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;oBAC9I,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5I,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC5B;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,CAAe;IACrC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACjB,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,IAAI,CAAC,SAAS;QAAE,MAAM,GAAG,CAAC,6BAA6B,EAAE,YAAY,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;QAAE,MAAM,GAAG,CAAC,yIAAyI,EAAE,OAAO,CAAC,CAAC;IACrN,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QAAE,MAAM,GAAG,CAAC,+BAA+B,EAAE,OAAO,CAAC,CAAC;IACvJ,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,wCAAwC,EAAE,WAAW,CAAC,CAAC;IACnI,0FAA0F;IAC1F,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,sBAAa,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,OAAO,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAe,EAAC,CAAC,CAAC,CAAC;IACxC,IAAA,4BAAmB,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/H,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC3C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAiB,EAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;QAC9C,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,eAAe;QACrC,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE;QACvF,+EAA+E;QAC/E,WAAW,EAAE,GAAG,EAAE;YAChB,IAAI,OAAO,CAAC,WAAW;gBAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/handlers/fga-engine.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The relationship-model engine behind the FGA routes: an OpenFGA-style authorization model (JSON `type_definitions` or DSL
+ * text) with the six rewrite operators (direct, computed, tuple-to-userset, union, intersection, exclusion), tuple
+ * conditions over a small CEL subset, and check / list-objects / list-users / expand over a set of tuples.
+ *
+ * shortcut: conditions support comparisons, boolean and arithmetic operators, `in`, field and index access, list literals
+ * and the string functions startsWith, endsWith, contains, matches, size; no ipaddress, duration or map-typed parameters.
+ * Upgrade by running the real engine if a model depends on those.
+ */
+export declare class ModelError extends Error {
+    readonly errors: string[];
+    constructor(errors: string[]);
+}
+export declare class TupleError extends Error {
+}
+type Us = any;
+export interface Ref {
+    type: string;
+    relation?: string;
+    wildcard?: Record<string, never>;
+    condition?: string;
+}
+export interface Compiled {
+    types: Map<string, Map<string, Us>>;
+    refs: Map<string, Map<string, Ref[]>>;
+    conds: Map<string, {
+        params: Map<string, string>;
+        ast: Cel;
+    }>;
+}
+export interface FgaTuple {
+    user: string;
+    relation: string;
+    object: string;
+    condition?: {
+        name: string;
+        context?: Record<string, unknown>;
+    };
+}
+/** OpenFGA DSL text to the JSON model. */
+export declare function dslToModel(dsl: string): any;
+/** Validate and compile a JSON model. Throws ModelError with every problem found. */
+export declare function compileModel(model: unknown): Compiled;
+export declare function compileStored(model: unknown): Compiled | null;
+interface PUser {
+    type: string;
+    id: string;
+    rel: string | null;
+    wild: boolean;
+}
+export declare function parseUser(s: string): PUser;
+export declare function parseObject(s: string): {
+    type: string;
+    id: string;
+};
+/** Write-time type validation: the same rules the real store applies against the latest model. Null when allowed. */
+export declare function validateTuple(m: Compiled, t: FgaTuple): string | null;
+type Cel = any;
+export declare class Resolver {
+    readonly model: Compiled;
+    private readonly context;
+    private readonly by;
+    private readonly objects;
+    errors: number;
+    constructor(model: Compiled, tuples: readonly FgaTuple[], context: Record<string, unknown> | undefined);
+    private read;
+    private holds;
+    check(user: PUser, object: string, relation: string): boolean;
+    private relation;
+    private node;
+    /** Ids of `type` objects the user holds `relation` on (candidates are the objects named in any tuple). */
+    listObjects(user: PUser, relation: string, type: string): string[];
+    /** Concrete users of `userType` that hold `relation` on the object. */
+    listUsers(object: string, relation: string, userType: string): string[];
+    /** The userset tree of a relation (the rewrite structure with the direct users at each `this` leaf). */
+    expand(object: string, relation: string): any;
+}
+export {};