@atlasauth/emulator-core 0.1.0 → 0.3.0

package/dist/tokens.js

@@ -1,22 +1,37 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenService = exports.DEFAULT_TEST_ISSUER = void 0;
+exports.TokenService = exports.DEFAULT_KEY_GRACE_S = exports.isSigningAlg = exports.SIGNING_ALGS = exports.DEFAULT_TEST_ISSUER = void 0;
 /* eslint-disable @typescript-eslint/no-explicit-any */
 const backend_1 = require("@atlasauth/backend");
 const store_1 = require("./store");
+const jws_1 = require("./jws");
+const jwe_1 = require("./jwe");
+const emu4_oauth_audit_1 = require("./handlers/emu4-oauth-audit");
 /** The issuer used when none is given: a reserved `.invalid` host, so no production verifier can ever be configured with it. */
 exports.DEFAULT_TEST_ISSUER = 'https://emulator.atlas.invalid';
+/** The algorithms an instance key may use (the same list the real provider publishes). */
+exports.SIGNING_ALGS = ['RS256', 'ES256', 'ES384', 'PS256', 'EdDSA'];
+const isSigningAlg = (v) => exports.SIGNING_ALGS.includes(v);
+exports.isSigningAlg = isSigningAlg;
+/** How long the previous key stays published after a rotation unless the caller says otherwise. */
+exports.DEFAULT_KEY_GRACE_S = 86_400;
 /**
  * Real signed tokens. Keys are generated in memory on first use and never written anywhere, so a token
  * this engine signs can only verify against this engine's own JWKS. Every token also carries
  * `atlas_emulator: true`, and the issuer defaults to a reserved host.
+ *
+ * The key set follows the real provider: one current key signs, a staged key is published before it signs, a previous
+ * key stays published until its grace ends (the engine clock), an emergency rotation publishes only the new key.
  */
 class TokenService {
     engine;
-    issuers = [];
+    keys = [];
     initializing = null;
     issuerUrl;
     rotations = 0;
+    enc = new Map();
+    /** Keys for the algorithms the OP signs responses with that differ from the instance key (as the real provider's OP key table). */
+    opKeys = new Map();
     constructor(engine) {
         this.engine = engine;
         this.issuerUrl = engine.options.issuer ?? exports.DEFAULT_TEST_ISSUER;
@@ -29,48 +44,148 @@ class TokenService {
         if (issuer === this.issuerUrl)
             return;
         this.issuerUrl = issuer;
-        this.issuers = [];
-        this.initializing = null;
-        this.rotations = 0;
+        this.reset();
     }
     reset() {
-        this.issuers = [];
+        this.keys = [];
         this.initializing = null;
         this.rotations = 0;
+        this.enc.clear();
+        this.opKeys.clear();
     }
     async make(alg) {
         const kid = `emu-${this.engine.instanceId}-${++this.rotations}`;
-        return (0, backend_1.createTestIssuer)({ alg, issuer: this.issuerUrl, kid, now: this.engine.clock.now });
+        // The test issuer is typed for RS256 and ES256; its key generation and signing take every algorithm of the list.
+        return (0, backend_1.createTestIssuer)({ alg: alg, issuer: this.issuerUrl, kid, now: this.engine.clock.now });
     }
     async ensure() {
-        this.initializing ??= this.make('RS256').then((i) => void this.issuers.push(i));
+        this.initializing ??= this.make('RS256').then((i) => void this.keys.push({ issuer: i, alg: 'RS256', activatesAt: null, graceMs: exports.DEFAULT_KEY_GRACE_S * 1000, retiresAt: null, trigger: null }));
         await this.initializing;
     }
+    /** Start signing with a staged key that is due, and drop previous keys whose grace has ended. */
+    settle() {
+        const now = this.engine.clock.now();
+        for (const k of this.keys) {
+            if (k.activatesAt === null || k.activatesAt > now)
+                continue;
+            const prev = this.keys.filter((x) => x !== k && x.activatesAt === null).pop();
+            const at = k.activatesAt;
+            k.activatesAt = null;
+            if (prev && prev.retiresAt === null)
+                prev.retiresAt = at + k.graceMs;
+            const data = { object: 'signing_key', kid: k.issuer.kid, alg: k.alg, previous_kid: prev?.issuer.kid ?? null, previous_retires_at: prev?.retiresAt ?? null };
+            this.engine.webhooks.emit('signing_key.activated', data);
+            (0, emu4_oauth_audit_1.recordAudit)(this.engine, 'signing_key.activated', 'system', 'instance', this.engine.instanceId, data);
+        }
+        this.keys = this.keys.filter((k) => k.retiresAt === null || k.retiresAt > now);
+    }
+    /** The clock-driven transitions, when a key exists already (an engine that never signed is left alone). */
+    async settleIfStarted() {
+        if (this.initializing)
+            await this.ready();
+    }
+    /** Make sure the first key exists and the clock-driven transitions have run; every entry point calls this first. */
+    async ready() {
+        await this.ensure();
+        this.settle();
+    }
     current() {
-        const cur = this.issuers[this.issuers.length - 1];
+        const cur = this.keys.filter((k) => k.activatesAt === null).pop();
         if (!cur)
             throw new Error('token service not initialised');
-        return cur;
+        return cur.issuer;
+    }
+    currentRec() {
+        return this.keys.filter((k) => k.activatesAt === null).pop();
     }
     async jwks() {
-        await this.ensure();
-        return { keys: this.issuers.flatMap((i) => i.jwks.keys) };
+        await this.ready();
+        return { keys: [...this.keys.flatMap((k) => k.issuer.jwks.keys), ...[...this.opKeys.values()].flatMap((i) => i.jwks.keys)] };
     }
-    /** Publish a new signing key and sign with it from now on. The old key stays in the JWKS, so tokens already out keep verifying. */
-    async rotate(alg = 'RS256') {
-        await this.ensure();
-        const previous = this.current().kid;
-        const next = await this.make(alg);
-        this.issuers.push(next);
-        return { kid: next.kid, previous_kid: previous };
+    /** The published key set a relying party reads: the signing keys, plus the encryption key once a client registered for encrypted request objects. */
+    async publishedJwks() {
+        const sig = await this.jwks();
+        return { keys: [...sig.keys, ...[...this.enc.values()].map((k) => k.publicJwk)] };
+    }
+    /** Make the key clients encrypt request objects to (and publish it). Idempotent per algorithm. */
+    async ensureEncryptionKey(alg) {
+        let k = this.enc.get(alg);
+        if (!k)
+            this.enc.set(alg, (k = await (0, jwe_1.generateEncKey)(alg, `emu-enc-${this.engine.instanceId}-${alg.toLowerCase()}`)));
+        return k.publicJwk;
+    }
+    /** The plaintext of a JWE addressed to one of this engine's encryption keys (by `kid`, else by `alg`); null when it cannot be decrypted. */
+    async decryptEncrypted(jwe) {
+        try {
+            const header = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(jwe.split('.')[0].replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0))));
+            const key = [...this.enc.values()].find((k) => (header.kid ? k.kid === header.kid : k.alg === header.alg));
+            return key ? await (0, jwe_1.decryptJwe)(jwe, key) : null;
+        }
+        catch {
+            return null;
+        }
     }
+    /**
+     * Publish a new signing key. Immediately it signs and the old key stays published for `graceSeconds` (default 24 h);
+     * `emergency` publishes only the new key; `staged` publishes it now and starts signing at `activatesAt`.
+     * The caller checks the real provider's one-key-at-a-time rules (`keyState`).
+     */
+    async rotate(alg, opts = {}) {
+        await this.ready();
+        const cur = this.currentRec();
+        const now = this.engine.clock.now();
+        const next = alg ?? cur.alg;
+        const issuer = await this.make(next);
+        const rec = { issuer, alg: next, activatesAt: null, graceMs: (opts.graceSeconds ?? exports.DEFAULT_KEY_GRACE_S) * 1000, retiresAt: null, trigger: opts.trigger ?? null };
+        if (opts.staged && !opts.emergency) {
+            rec.activatesAt = opts.activatesAt ?? now + 14 * 86_400_000;
+            rec.graceMs = (opts.graceSeconds ?? exports.DEFAULT_KEY_GRACE_S) * 1000;
+            this.keys.push(rec);
+            return { kid: issuer.kid, alg: next, previous_kid: cur.issuer.kid, previous_retires_at: rec.activatesAt + rec.graceMs, emergency: false, staged: true, activates_at: rec.activatesAt };
+        }
+        if (opts.emergency)
+            this.keys = [];
+        else
+            cur.retiresAt = now + rec.graceMs;
+        this.keys.push(rec);
+        this.settle();
+        return { kid: issuer.kid, alg: next, previous_kid: cur.issuer.kid, previous_retires_at: opts.emergency ? null : cur.retiresAt, emergency: opts.emergency === true };
+    }
+    /** The staged key, unpublished; null when none is staged. */
+    async cancelStaged() {
+        await this.ready();
+        const k = this.keys.find((x) => x.activatesAt !== null);
+        if (!k)
+            return null;
+        this.keys = this.keys.filter((x) => x !== k);
+        return k.issuer.kid;
+    }
+    /** The key set as the rotation rules see it. */
+    async keyState() {
+        await this.ready();
+        const cur = this.currentRec();
+        const staged = this.keys.find((k) => k.activatesAt !== null);
+        const prev = this.keys.filter((k) => k.retiresAt !== null).map((k) => k.retiresAt);
+        return { currentKid: cur.issuer.kid, alg: cur.alg, staged: staged ? { kid: staged.issuer.kid, alg: staged.alg, activatesAt: staged.activatesAt } : null, previousRetiresAt: prev.length ? Math.max(...prev) : null };
+    }
+    /** The published keys, newest first, with their state. */
     async signingKeys() {
-        await this.ensure();
-        const cur = this.current().kid;
-        return [...this.issuers].reverse().map((i) => ({ object: 'signing_key', kid: i.kid, alg: i.jwks.keys[0].alg, current: i.kid === cur }));
+        await this.ready();
+        const cur = this.currentRec();
+        return [...this.keys].reverse().map((k) => ({
+            object: 'signing_key',
+            kid: k.issuer.kid,
+            alg: k.alg,
+            status: k === cur ? 'current' : k.activatesAt !== null ? 'next' : 'previous',
+            role: 'main',
+            retires_at: k.retiresAt,
+            ...(k.activatesAt !== null ? { activates_at: k.activatesAt } : {}),
+            provider: 'local',
+            current: k === cur,
+        }));
     }
     async mintSession(input) {
-        await this.ensure();
+        await this.ready();
         const ttl = input.ttlSeconds ?? 60;
         const nowS = Math.floor(this.engine.clock.now() / 1000);
         const claims = {
@@ -84,13 +199,70 @@ class TokenService {
         };
         return { jwt: await this.current().mintSession(claims), claims, expiresIn: ttl };
     }
+    /**
+     * Sign any claim set with the current key: `iss`, `iat`, `exp` and `atlas_emulator` are filled in, everything else is yours.
+     * `idToken` uses the OIDC ID-token minting path (aud, nonce, auth_time stay as given).
+     */
+    async signClaims(claims, ttlSeconds = 60) {
+        await this.ready();
+        const nowS = Math.floor(this.engine.clock.now() / 1000);
+        const body = { iss: this.issuerUrl, iat: nowS, exp: nowS + ttlSeconds, atlas_emulator: true, sid: undefined, azp: undefined, sv: undefined, mfa: undefined, ...claims };
+        return this.current().mintSession(body);
+    }
+    /**
+     * Sign claims in a chosen algorithm (an authorization response or ID token the client registered an algorithm for).
+     * The instance key signs when it already has that algorithm (or none is asked); otherwise a key of that algorithm is
+     * made once and published beside it.
+     */
+    async signClaimsAs(alg, claims, ttlSeconds = 60) {
+        await this.ready();
+        if (!alg || !(0, exports.isSigningAlg)(alg) || alg === this.currentRec().alg)
+            return this.signClaims(claims, ttlSeconds);
+        let issuer = this.opKeys.get(alg);
+        if (!issuer)
+            this.opKeys.set(alg, (issuer = await this.make(alg)));
+        const nowS = Math.floor(this.engine.clock.now() / 1000);
+        return issuer.mintSession({ iss: this.issuerUrl, iat: nowS, exp: nowS + ttlSeconds, atlas_emulator: true, sid: undefined, azp: undefined, sv: undefined, mfa: undefined, ...claims });
+    }
     /** Verify as a resource server would: against the engine JWKS, issuer and clock. */
     async verify(token) {
-        await this.ensure();
+        await this.ready();
         const backend = new backend_1.AtlasBackend({ jwks: await this.jwks(), issuer: this.issuerUrl, now: this.engine.clock.now });
         const r = await backend.verify(token);
         return r.ok ? { ok: true, claims: r.claims } : { ok: false, reason: r.reason };
     }
+    /**
+     * Verify any token this engine signed, whatever its `token_use` (session, machine, access, id): signature against
+     * the JWKS, issuer, `exp` and `nbf`. `verify` is the session-only check a resource server would run; this one is
+     * for the engine's own routes (machine verify, introspection, token exchange).
+     */
+    async verifyAny(token, opts = {}) {
+        try {
+            const jwt = (0, jws_1.decodeJwt)(token);
+            if (!jwt)
+                return { ok: false, reason: 'malformed' };
+            const jwk = (await this.jwks()).keys.find((k) => k.kid === jwt.header.kid);
+            if (!jwk)
+                return { ok: false, reason: 'unknown_key' };
+            // The key fixes the algorithm: a token naming another one never verifies (no algorithm confusion).
+            if (!(0, exports.isSigningAlg)(jwt.header.alg) || jwk.alg !== jwt.header.alg)
+                return { ok: false, reason: 'unsupported_alg' };
+            if (!(await (0, jws_1.verifyJws)(jwt, jwk)))
+                return { ok: false, reason: 'bad_signature' };
+            const claims = jwt.payload;
+            const nowS = this.engine.clock.now() / 1000;
+            if (claims.iss !== this.issuerUrl)
+                return { ok: false, reason: 'wrong_issuer' };
+            if (!opts.ignoreExp && typeof claims.exp === 'number' && claims.exp <= nowS)
+                return { ok: false, reason: 'expired' };
+            if (typeof claims.nbf === 'number' && claims.nbf > nowS + 60)
+                return { ok: false, reason: 'not_yet_valid' };
+            return { ok: true, claims };
+        }
+        catch {
+            return { ok: false, reason: 'malformed' };
+        }
+    }
     secret(prefix) {
         return `${prefix}_${(0, store_1.randomToken)(24)}`;
     }

package/dist/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;;AAAA,uDAAuD;AACvD,gDAAqF;AAGrF,mCAAsC;AAEtC,gIAAgI;AACnH,QAAA,mBAAmB,GAAG,gCAAgC,CAAC;AAUpE;;;;GAIG;AACH,MAAa,YAAY;IAMM;IALrB,OAAO,GAAiB,EAAE,CAAC;IAC3B,YAAY,GAAyB,IAAI,CAAC;IAC1C,SAAS,CAAS;IAClB,SAAS,GAAG,CAAC,CAAC;IAEtB,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,2BAAmB,CAAC;IAChE,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,+FAA+F;IAC/F,SAAS,CAAC,MAAc;QACtB,IAAI,MAAM,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO;QACtC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAsB;QACvC,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChE,OAAO,IAAA,0BAAgB,EAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAEO,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC3D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAa,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,mIAAmI;IACnI,KAAK,CAAC,MAAM,CAAC,MAAyB,OAAO;QAC3C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAS,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IACnJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAAQ;YAClB,GAAG,EAAE,KAAK,CAAC,MAAM;YACjB,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,IAAI,GAAG,GAAG;YACf,cAAc,EAAE,IAAI;YACpB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;SACxB,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,MAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC1F,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAS,CAAC,CAAC;QACzH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,OAAO,GAAG,MAAM,IAAI,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;CACF;AA5FD,oCA4FC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;;AAAA,uDAAuD;AACvD,gDAAqF;AAGrF,mCAAsC;AACtC,+BAA6C;AAC7C,+BAAqF;AACrF,kEAA0D;AAE1D,gIAAgI;AACnH,QAAA,mBAAmB,GAAG,gCAAgC,CAAC;AAUpE,0FAA0F;AAC7E,QAAA,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAE5E,MAAM,YAAY,GAAG,CAAC,CAAU,EAAmB,EAAE,CAAE,oBAAkC,CAAC,QAAQ,CAAC,CAAW,CAAC,CAAC;AAA1G,QAAA,YAAY,gBAA8F;AACvH,mGAAmG;AACtF,QAAA,mBAAmB,GAAG,MAAM,CAAC;AAe1C;;;;;;;GAOG;AACH,MAAa,YAAY;IASM;IARrB,IAAI,GAAa,EAAE,CAAC;IACpB,YAAY,GAAyB,IAAI,CAAC;IAC1C,SAAS,CAAS;IAClB,SAAS,GAAG,CAAC,CAAC;IACd,GAAG,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,mIAAmI;IAC3H,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE/C,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,2BAAmB,CAAC;IAChE,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,+FAA+F;IAC/F,SAAS,CAAC,MAAc;QACtB,IAAI,MAAM,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO;QACtC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAe;QAChC,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChE,iHAAiH;QACjH,OAAO,IAAA,0BAAgB,EAAC,EAAE,GAAG,EAAE,GAAc,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5G,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,2BAAmB,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/L,MAAM,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,iGAAiG;IACzF,MAAM;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,GAAG,GAAG;gBAAE,SAAS;YAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9E,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC;YACzB,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;YACrB,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;gBAAE,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;YACrE,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;YAC5J,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;YACzD,IAAA,8BAAW,EAAC,IAAI,CAAC,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,2GAA2G;IAC3G,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IAED,oHAAoH;IACpH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAEO,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QAClE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC3D,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAEO,UAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,GAAG,EAAG,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAa,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAa,CAAC,CAAC,EAAE,CAAC;IACjJ,CAAC;IAED,qJAAqJ;IACrJ,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAgB,CAAC,CAAC,EAAE,CAAC;IAC3F,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,mBAAmB,CAAC,GAAiB;QACzC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,IAAA,oBAAc,EAAC,GAAG,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC,SAAgB,CAAC;IAC5B,CAAC;IAED,4IAA4I;IAC5I,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7J,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3G,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,IAAA,gBAAU,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,OAAiH,EAAE;QAChJ,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAW,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,YAAY,IAAI,2BAAmB,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACzK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC;YAC5D,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,2BAAmB,CAAC,GAAG,IAAI,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QACzL,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;;YAC9B,GAAG,CAAC,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;IACtK,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAmB,CAAC,CAAC;QAC7F,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAY,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxN,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,aAAa;YACrB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG;YACjB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,MAAM,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;YAC5E,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,CAAC,KAAK,GAAG;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAAQ;YAClB,GAAG,EAAE,KAAK,CAAC,MAAM;YACjB,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,IAAI,GAAG,GAAG;YACf,cAAc,EAAE,IAAI;YACpB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;SACxB,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,MAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC1F,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAW,EAAE,UAAU,GAAG,EAAE;QAC3C,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,MAAM,IAAI,GAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;QAC7K,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,IAAW,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,GAA8B,EAAE,MAAW,EAAE,UAAU,GAAG,EAAE;QAC7E,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,IAAI,CAAC,IAAA,oBAAY,EAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC5G,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,EAAS,CAAC,CAAC;IAC/L,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAS,CAAC,CAAC;QACzH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAgC,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,eAAS,EAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACpD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3E,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACtD,mGAAmG;YACnG,IAAI,CAAC,IAAA,oBAAY,EAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACjH,IAAI,CAAC,CAAC,MAAM,IAAA,eAAS,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAc,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAChF,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrH,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAC5G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,OAAO,GAAG,MAAM,IAAI,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;CACF;AAtPD,oCAsPC"}

package/dist/webauthn-virtual.d.ts

@@ -0,0 +1,70 @@
+export declare function cborEncode(v: any): Uint8Array;
+/** Decode one CBOR item; returns the value and the offset after it (the attested credential data is followed by nothing here, but COSE keys sit mid-buffer). */
+export declare function cborDecode(buf: Uint8Array, at?: number): {
+    value: any;
+    end: number;
+};
+/** ECDSA signatures from Web Crypto are r||s; WebAuthn carries ASN.1 DER. */
+export declare function rawToDer(raw: Uint8Array): Uint8Array;
+export declare function derToRaw(der: Uint8Array, size?: number): Uint8Array;
+export interface CreationOptions {
+    rp: {
+        id?: string;
+        name?: string;
+    };
+    user: {
+        id: string;
+        name?: string;
+        displayName?: string;
+    };
+    challenge: string;
+    excludeCredentials?: Array<{
+        id: string;
+    }>;
+    authenticatorSelection?: {
+        userVerification?: string;
+    };
+}
+export interface RequestOptions {
+    challenge: string;
+    rpId?: string;
+    allowCredentials?: Array<{
+        id: string;
+    }>;
+    userVerification?: string;
+}
+export interface VirtualAuthenticatorOptions {
+    /** The origin it claims in `clientDataJSON`. */
+    origin?: string;
+    /** Whether the simulated user verifies (UV flag). Default true. */
+    userVerified?: boolean;
+    /** Reported in the attestation. Default all zero. */
+    aaguid?: Uint8Array;
+}
+export declare class VirtualAuthenticator {
+    private credentials;
+    userVerified: boolean;
+    /** Set to make the next assertions report a counter that does not advance (a cloned authenticator). */
+    frozenCounter: boolean;
+    readonly origin: string;
+    private readonly aaguid;
+    constructor(options?: VirtualAuthenticatorOptions);
+    get credentialIds(): string[];
+    private flags;
+    /** `navigator.credentials.create` for a registration `options` object (as returned by `registration/init`). */
+    create(options: CreationOptions): Promise<{
+        credential_id: string;
+        attestation_object: string;
+        client_data_json: string;
+        transports: string[];
+    }>;
+    /** `navigator.credentials.get` for an authentication `options` object. */
+    get(options: RequestOptions): Promise<{
+        credential_id: string;
+        authenticator_data: string;
+        client_data_json: string;
+        signature: string;
+        user_handle: string;
+    }>;
+}
+export declare const createVirtualAuthenticator: (options?: VirtualAuthenticatorOptions) => VirtualAuthenticator;

package/dist/webauthn-virtual.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createVirtualAuthenticator = exports.VirtualAuthenticator = void 0;
+exports.cborEncode = cborEncode;
+exports.cborDecode = cborDecode;
+exports.rawToDer = rawToDer;
+exports.derToRaw = derToRaw;
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const crypto_util_1 = require("./crypto-util");
+/**
+ * A virtual WebAuthn authenticator (software "platform" device, ES256, `none` attestation) for tests: it answers
+ * `navigator.credentials.create/get` options with real attestation objects and assertions, so a relying party's own
+ * verification code (or the engine's Passkey API) runs against genuine bytes. Portable: Web Crypto only.
+ */
+const enc = new TextEncoder();
+const concat = (...parts) => {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let o = 0;
+    for (const p of parts)
+        (out.set(p, o), (o += p.length));
+    return out;
+};
+const unb64url = (s) => {
+    const b = s.replace(/-/g, '+').replace(/_/g, '/');
+    return Uint8Array.from(atob(b + '='.repeat((4 - (b.length % 4)) % 4)), (c) => c.charCodeAt(0));
+};
+// ── CBOR (the subset WebAuthn uses: unsigned/negative ints, byte/text strings, arrays, maps) ──
+const head = (major, n) => {
+    if (n < 24)
+        return Uint8Array.of((major << 5) | n);
+    if (n < 256)
+        return Uint8Array.of((major << 5) | 24, n);
+    if (n < 65536)
+        return Uint8Array.of((major << 5) | 25, n >> 8, n & 255);
+    return Uint8Array.of((major << 5) | 26, (n >>> 24) & 255, (n >>> 16) & 255, (n >>> 8) & 255, n & 255);
+};
+function cborEncode(v) {
+    if (v instanceof Uint8Array)
+        return concat(head(2, v.length), v);
+    if (typeof v === 'string') {
+        const b = enc.encode(v);
+        return concat(head(3, b.length), b);
+    }
+    if (typeof v === 'number')
+        return v >= 0 ? head(0, v) : head(1, -1 - v);
+    if (Array.isArray(v))
+        return concat(head(4, v.length), ...v.map(cborEncode));
+    if (v instanceof Map)
+        return concat(head(5, v.size), ...[...v].flatMap(([k, x]) => [cborEncode(k), cborEncode(x)]));
+    if (v && typeof v === 'object')
+        return cborEncode(new Map(Object.entries(v)));
+    throw new Error('cbor: unsupported value');
+}
+/** Decode one CBOR item; returns the value and the offset after it (the attested credential data is followed by nothing here, but COSE keys sit mid-buffer). */
+function cborDecode(buf, at = 0) {
+    const first = buf[at];
+    const major = first >> 5;
+    const info = first & 31;
+    let i = at + 1;
+    let n = info;
+    if (info === 24)
+        (n = buf[i], (i += 1));
+    else if (info === 25)
+        (n = (buf[i] << 8) | buf[i + 1], (i += 2));
+    else if (info === 26)
+        (n = buf[i] * 2 ** 24 + (buf[i + 1] << 16) + (buf[i + 2] << 8) + buf[i + 3], (i += 4));
+    else if (info > 26)
+        throw new Error('cbor: length too large');
+    if (major === 0)
+        return { value: n, end: i };
+    if (major === 1)
+        return { value: -1 - n, end: i };
+    if (major === 2)
+        return { value: buf.slice(i, i + n), end: i + n };
+    if (major === 3)
+        return { value: new TextDecoder().decode(buf.slice(i, i + n)), end: i + n };
+    if (major === 4) {
+        const arr = [];
+        for (let k = 0; k < n; k++) {
+            const r = cborDecode(buf, i);
+            arr.push(r.value);
+            i = r.end;
+        }
+        return { value: arr, end: i };
+    }
+    if (major === 5) {
+        const map = new Map();
+        for (let k = 0; k < n; k++) {
+            const key = cborDecode(buf, i);
+            const val = cborDecode(buf, key.end);
+            map.set(key.value, val.value);
+            i = val.end;
+        }
+        return { value: map, end: i };
+    }
+    throw new Error('cbor: unsupported major type');
+}
+/** ECDSA signatures from Web Crypto are r||s; WebAuthn carries ASN.1 DER. */
+function rawToDer(raw) {
+    const half = raw.length / 2;
+    const int = (b) => {
+        let s = 0;
+        while (s < b.length - 1 && b[s] === 0)
+            s++;
+        const trimmed = b.slice(s);
+        const body = trimmed[0] & 0x80 ? concat(Uint8Array.of(0), trimmed) : trimmed;
+        return concat(Uint8Array.of(0x02, body.length), body);
+    };
+    const r = int(raw.slice(0, half));
+    const s = int(raw.slice(half));
+    return concat(Uint8Array.of(0x30, r.length + s.length), r, s);
+}
+function derToRaw(der, size = 32) {
+    let i = 2;
+    if (der[1] & 0x80)
+        i += der[1] & 0x7f;
+    const read = () => {
+        const len = der[i + 1];
+        let v = der.slice(i + 2, i + 2 + len);
+        i += 2 + len;
+        while (v.length > size && v[0] === 0)
+            v = v.slice(1);
+        return concat(new Uint8Array(size - v.length), v);
+    };
+    return concat(read(), read());
+}
+class VirtualAuthenticator {
+    credentials = [];
+    userVerified;
+    /** Set to make the next assertions report a counter that does not advance (a cloned authenticator). */
+    frozenCounter = false;
+    origin;
+    aaguid;
+    constructor(options = {}) {
+        this.origin = options.origin ?? 'https://localhost';
+        this.userVerified = options.userVerified ?? true;
+        this.aaguid = options.aaguid ?? new Uint8Array(16);
+    }
+    get credentialIds() {
+        return this.credentials.map((c) => (0, crypto_util_1.bytesToB64url)(c.id));
+    }
+    flags(attested) {
+        return 0x01 | (this.userVerified ? 0x04 : 0) | (attested ? 0x40 : 0);
+    }
+    /** `navigator.credentials.create` for a registration `options` object (as returned by `registration/init`). */
+    async create(options) {
+        const rpId = options.rp.id ?? new URL(this.origin).hostname;
+        if (options.excludeCredentials?.some((c) => this.credentials.some((m) => (0, crypto_util_1.bytesToB64url)(m.id) === c.id)))
+            throw new Error('InvalidStateError: a credential for this account already exists on this authenticator.');
+        const pair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+        const id = crypto.getRandomValues(new Uint8Array(32));
+        const jwk = (await crypto.subtle.exportKey('jwk', pair.publicKey));
+        const cose = cborEncode(new Map([[1, 2], [3, -7], [-1, 1], [-2, unb64url(jwk.x)], [-3, unb64url(jwk.y)]]));
+        const attested = concat(this.aaguid, Uint8Array.of(id.length >> 8, id.length & 255), id, cose);
+        const authData = concat(await (0, crypto_util_1.sha256)(rpId), Uint8Array.of(this.flags(true)), new Uint8Array(4), attested);
+        this.credentials.push({ id, rpId, userHandle: options.user.id, privateKey: pair.privateKey, counter: 0 });
+        const clientData = JSON.stringify({ type: 'webauthn.create', challenge: options.challenge, origin: this.origin, crossOrigin: false });
+        return {
+            credential_id: (0, crypto_util_1.bytesToB64url)(id),
+            attestation_object: (0, crypto_util_1.bytesToB64url)(cborEncode(new Map([['fmt', 'none'], ['attStmt', new Map()], ['authData', authData]]))),
+            client_data_json: (0, crypto_util_1.bytesToB64url)(enc.encode(clientData)),
+            transports: ['internal'],
+        };
+    }
+    /** `navigator.credentials.get` for an authentication `options` object. */
+    async get(options) {
+        const rpId = options.rpId ?? new URL(this.origin).hostname;
+        const allowed = options.allowCredentials?.map((c) => c.id);
+        const cred = this.credentials.find((c) => c.rpId === rpId && (!allowed?.length || allowed.includes((0, crypto_util_1.bytesToB64url)(c.id))));
+        if (!cred)
+            throw new Error('NotAllowedError: no matching credential on this authenticator.');
+        if (!this.frozenCounter)
+            cred.counter += 1;
+        const counter = new Uint8Array(4);
+        new DataView(counter.buffer).setUint32(0, cred.counter);
+        const authData = concat(await (0, crypto_util_1.sha256)(rpId), Uint8Array.of(this.flags(false)), counter);
+        const clientDataJSON = enc.encode(JSON.stringify({ type: 'webauthn.get', challenge: options.challenge, origin: this.origin, crossOrigin: false }));
+        const signed = concat(authData, await (0, crypto_util_1.sha256)(clientDataJSON));
+        const raw = new Uint8Array(await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, cred.privateKey, signed));
+        return { credential_id: (0, crypto_util_1.bytesToB64url)(cred.id), authenticator_data: (0, crypto_util_1.bytesToB64url)(authData), client_data_json: (0, crypto_util_1.bytesToB64url)(clientDataJSON), signature: (0, crypto_util_1.bytesToB64url)(rawToDer(raw)), user_handle: cred.userHandle };
+    }
+}
+exports.VirtualAuthenticator = VirtualAuthenticator;
+const createVirtualAuthenticator = (options) => new VirtualAuthenticator(options);
+exports.createVirtualAuthenticator = createVirtualAuthenticator;
+//# sourceMappingURL=webauthn-virtual.js.map

package/dist/webauthn-virtual.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-virtual.js","sourceRoot":"","sources":["../src/webauthn-virtual.ts"],"names":[],"mappings":";;;AA6BA,gCAWC;AAED,gCAkCC;AAGD,4BAYC;AACD,4BAWC;AAvGD,uDAAuD;AACvD,+CAAsD;AAEtD;;;;GAIG;AAEH,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,KAAmB,EAAc,EAAE;IACpD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAc,EAAE;IACzC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC,CAAC;AAEF,iGAAiG;AAEjG,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,CAAS,EAAc,EAAE;IACpD,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG,KAAK;QAAE,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IACxE,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;AACxG,CAAC,CAAC;AACF,SAAgB,UAAU,CAAC,CAAM;IAC/B,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,YAAY,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC7C,CAAC;AACD,gKAAgK;AAChK,SAAgB,UAAU,CAAC,GAAe,EAAE,EAAE,GAAG,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAE,CAAC;IACvB,MAAM,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACf,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACpC,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC9D,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC5G,IAAI,IAAI,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC7C,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAClD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACnE,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7F,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,GAAG,GAAU,EAAE,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAY,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAClD,CAAC;AAED,6EAA6E;AAC7E,SAAgB,QAAQ,CAAC,GAAe;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAa,EAAc,EAAE;QACxC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9E,OAAO,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AACD,SAAgB,QAAQ,CAAC,GAAe,EAAE,IAAI,GAAG,EAAE;IACjD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,GAAG,CAAC,CAAC,CAAE,GAAG,IAAI;QAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,GAAe,EAAE;QAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QACtC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACb,OAAO,CAAC,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAChC,CAAC;AAiCD,MAAa,oBAAoB;IACvB,WAAW,GAAa,EAAE,CAAC;IACnC,YAAY,CAAU;IACtB,uGAAuG;IACvG,aAAa,GAAG,KAAK,CAAC;IACb,MAAM,CAAS;IACP,MAAM,CAAa;IAEpC,YAAY,UAAuC,EAAE;QACnD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC;QACpD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,2BAAa,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,QAAiB;QAC7B,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,+GAA+G;IAC/G,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC5D,IAAI,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,2BAAa,EAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;QACnN,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/G,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAA2B,CAAC;QAC7F,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,GAAG,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1H,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAA,oBAAM,EAAC,IAAI,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1G,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1G,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACtI,OAAO;YACL,aAAa,EAAE,IAAA,2BAAa,EAAC,EAAE,CAAC;YAChC,kBAAkB,EAAE,IAAA,2BAAa,EAAC,UAAU,CAAC,IAAI,GAAG,CAAc,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACtI,gBAAgB,EAAE,IAAA,2BAAa,EAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvD,UAAU,EAAE,CAAC,UAAU,CAAC;SACzB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,GAAG,CAAC,OAAuB;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAA,2BAAa,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1H,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAA,oBAAM,EAAC,IAAI,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvF,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACnJ,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAA,oBAAM,EAAC,cAAc,CAAC,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,MAAsB,CAAC,CAAC,CAAC;QAClI,OAAO,EAAE,aAAa,EAAE,IAAA,2BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,IAAA,2BAAa,EAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,IAAA,2BAAa,EAAC,cAAc,CAAC,EAAE,SAAS,EAAE,IAAA,2BAAa,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACxN,CAAC;CACF;AAzDD,oDAyDC;AAEM,MAAM,0BAA0B,GAAG,CAAC,OAAqC,EAAwB,EAAE,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAAhI,QAAA,0BAA0B,8BAAsG"}

package/dist/webhook-ext.d.ts

@@ -0,0 +1,16 @@
+import type { Engine } from './engine';
+import type { Obj } from './openapi';
+/** The endpoint fields a create or update body sets (only the ones sent; null clears). Throws a validation error. */
+export declare function parseEndpointExtras(body: Obj, current?: Obj): Obj;
+/** The read side: header names only, no secret of any kind. */
+export declare function presentEndpointExtras(ep: Obj): Obj;
+/** The organization an event belongs to: `data.organization_id`, or the id of an organization object. */
+export declare const eventOrgId: (data: Obj) => string | null;
+/** Does an event pass an endpoint's filters? No filters = yes. Fails closed on anything unreadable. */
+export declare function filtersMatch(filters: Obj | null | undefined, data: Obj): boolean;
+/** Extra request headers for one delivery: the static ones, plus a bearer token fetched with client credentials. */
+export declare function deliveryHeaders(e: Engine, ep: Obj): Promise<Record<string, string>>;
+/** A receiver that answered 401 gets a fresh token next time. */
+export declare const evictToken: (e: Engine, endpointId: string) => void;
+/** The `max_rps` budget: true when this delivery fits the current one-second window, false when it must wait for the next. */
+export declare function takeRate(e: Engine, ep: Obj): boolean;