@atrib/verify 0.5.2 → 0.6.0

package/dist/authorization-evidence.js

@@ -0,0 +1,423 @@
+// SPDX-License-Identifier: Apache-2.0
+import { base64urlEncode, sha256 } from '@atrib/mcp';
+import { calculateJwkThumbprint, createLocalJWKSet, decodeJwt, decodeProtectedHeader, importJWK, jwtVerify, } from 'jose';
+function asArray(value) {
+    if (typeof value === 'string')
+        return [value];
+    if (Array.isArray(value))
+        return value.filter((entry) => typeof entry === 'string');
+    return [];
+}
+function asRecord(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    return value;
+}
+function accessTokenHash(accessToken) {
+    return base64urlEncode(sha256(new TextEncoder().encode(accessToken)));
+}
+function normalizeScopes(claims) {
+    if (!claims)
+        return [];
+    const scopeValues = [
+        ...asArray(claims.scope)
+            .flatMap((entry) => entry.split(/\s+/))
+            .filter(Boolean),
+        ...asArray(claims.scp)
+            .flatMap((entry) => entry.split(/\s+/))
+            .filter(Boolean),
+    ];
+    return Array.from(new Set(scopeValues)).sort();
+}
+function normalizeAudience(claims) {
+    if (!claims)
+        return [];
+    return asArray(claims.aud).sort();
+}
+function normalizeResource(claims) {
+    if (!claims)
+        return [];
+    return asArray(claims.resource).sort();
+}
+function normalizeJwks(jwks) {
+    return Array.isArray(jwks) ? { keys: jwks } : jwks;
+}
+function claimsFromIntrospection(introspection) {
+    const claims = {};
+    if (typeof introspection.iss === 'string')
+        claims.iss = introspection.iss;
+    if (typeof introspection.sub === 'string')
+        claims.sub = introspection.sub;
+    if (introspection.aud !== undefined)
+        claims.aud = introspection.aud;
+    if (typeof introspection.exp === 'number')
+        claims.exp = introspection.exp;
+    if (typeof introspection.iat === 'number')
+        claims.iat = introspection.iat;
+    if (typeof introspection.nbf === 'number')
+        claims.nbf = introspection.nbf;
+    if (typeof introspection.jti === 'string')
+        claims.jti = introspection.jti;
+    if (typeof introspection.scope === 'string')
+        claims.scope = introspection.scope;
+    if (typeof introspection.client_id === 'string')
+        claims.client_id = introspection.client_id;
+    if (introspection.resource !== undefined)
+        claims.resource = introspection.resource;
+    if (introspection.authorization_details !== undefined) {
+        claims.authorization_details = introspection.authorization_details;
+    }
+    if (introspection.cnf !== undefined)
+        claims.cnf = introspection.cnf;
+    if (introspection.act !== undefined)
+        claims.act = introspection.act;
+    if (introspection.may_act !== undefined)
+        claims.may_act = introspection.may_act;
+    return claims;
+}
+function check(type, status, expected, actual, reason) {
+    const result = { type, status };
+    if (expected !== undefined)
+        result.expected = expected;
+    if (actual !== undefined)
+        result.actual = actual;
+    if (reason !== undefined)
+        result.reason = reason;
+    return result;
+}
+async function resolveClaims(input) {
+    const signaturePolicy = input.signaturePolicy ?? 'require';
+    const token = {
+        jwt_present: typeof input.accessTokenJwt === 'string',
+        introspection_present: input.introspection !== undefined,
+        verified: null,
+        alg: null,
+        kid: null,
+        claims_verified: input.claimsVerified === true,
+    };
+    if (input.accessTokenJwt) {
+        try {
+            const header = decodeProtectedHeader(input.accessTokenJwt);
+            token.alg = typeof header.alg === 'string' ? header.alg : null;
+            token.kid = typeof header.kid === 'string' ? header.kid : null;
+        }
+        catch {
+            token.alg = null;
+            token.kid = null;
+        }
+        if (input.jwks && signaturePolicy !== 'off') {
+            const verifyOptions = {};
+            if (input.issuer)
+                verifyOptions.issuer = input.issuer;
+            if (input.audience)
+                verifyOptions.audience = input.audience;
+            if (input.clockSkewSeconds !== undefined)
+                verifyOptions.clockTolerance = input.clockSkewSeconds;
+            if (input.nowSeconds !== undefined) {
+                verifyOptions.currentDate = new Date(input.nowSeconds * 1000);
+            }
+            const verified = await jwtVerify(input.accessTokenJwt, createLocalJWKSet(normalizeJwks(input.jwks)), verifyOptions);
+            token.verified = true;
+            token.claims_verified = true;
+            return { claims: verified.payload, token };
+        }
+        const decoded = decodeJwt(input.accessTokenJwt);
+        token.verified = false;
+        token.claims_verified = signaturePolicy === 'off';
+        return { claims: decoded, token };
+    }
+    if (input.introspection) {
+        token.verified = input.introspectionVerified === true;
+        token.claims_verified = input.introspectionVerified === true;
+        return {
+            claims: claimsFromIntrospection(input.introspection),
+            token,
+        };
+    }
+    return {
+        claims: input.claims ?? null,
+        token,
+    };
+}
+function pushScopeChecks(checks, scopes, requiredScopes) {
+    if (!requiredScopes || requiredScopes.length === 0) {
+        checks.push(check('scope', 'not_checked'));
+        return null;
+    }
+    const missing = requiredScopes.filter((scope) => !scopes.includes(scope));
+    checks.push(check('scope', missing.length === 0 ? 'passed' : 'failed', requiredScopes, scopes, missing.length === 0 ? undefined : `missing scopes: ${missing.join(', ')}`));
+    return missing.length === 0;
+}
+function pushAudienceChecks(checks, claims, input) {
+    const audience = normalizeAudience(claims);
+    const expectedAudience = asArray(input.audience);
+    if (expectedAudience.length > 0) {
+        const missing = expectedAudience.filter((entry) => !audience.includes(entry));
+        checks.push(check('audience', missing.length === 0 ? 'passed' : 'failed', expectedAudience, audience, missing.length === 0 ? undefined : `missing audience: ${missing.join(', ')}`));
+    }
+    const expectedResource = input.resource ?? input.protectedResourceMetadata?.resource;
+    if (expectedResource) {
+        const resources = normalizeResource(claims);
+        const matchesAudience = audience.includes(expectedResource);
+        const matchesResource = resources.includes(expectedResource);
+        checks.push(check('resource', matchesAudience || matchesResource ? 'passed' : 'failed', expectedResource, { aud: audience, resource: resources }, matchesAudience || matchesResource
+            ? undefined
+            : 'resource not present in aud or resource claims'));
+    }
+}
+function pushMetadataChecks(checks, claims, metadata) {
+    if (!metadata)
+        return;
+    if (metadata.authorization_servers && metadata.authorization_servers.length > 0) {
+        const issuer = typeof claims?.iss === 'string' ? claims.iss : null;
+        checks.push(check('protected_resource.authorization_servers', issuer && metadata.authorization_servers.includes(issuer) ? 'passed' : 'failed', metadata.authorization_servers, issuer));
+    }
+}
+function pushAuthorizationDetailsChecks(checks, claims, required) {
+    if (!required || required.length === 0) {
+        checks.push(check('authorization_details', 'not_checked'));
+        return;
+    }
+    const presented = Array.isArray(claims?.authorization_details) ? claims.authorization_details : [];
+    for (const constraint of required) {
+        const match = presented.some((entry) => authorizationDetailMatches(entry, constraint));
+        checks.push(check('authorization_details', match ? 'passed' : 'failed', constraint, presented, match ? undefined : `missing authorization_details type: ${constraint.type}`));
+    }
+}
+function authorizationDetailMatches(entry, constraint) {
+    if (entry === null || typeof entry !== 'object' || Array.isArray(entry))
+        return false;
+    const record = entry;
+    if (record['type'] !== constraint.type)
+        return false;
+    if (constraint.actions && constraint.actions.length > 0) {
+        const actions = asArray(record['actions']);
+        if (constraint.actions.some((action) => !actions.includes(action)))
+            return false;
+    }
+    if (constraint.locations && constraint.locations.length > 0) {
+        const locations = asArray(record['locations']);
+        if (constraint.locations.some((location) => !locations.includes(location)))
+            return false;
+    }
+    return true;
+}
+function pushIdentityChecks(checks, claims, input) {
+    let delegationOk = null;
+    if (input.issuer) {
+        checks.push(check('issuer', claims?.iss === input.issuer ? 'passed' : 'failed', input.issuer, claims?.iss ?? null));
+    }
+    if (input.expectedSubject) {
+        checks.push(check('subject', claims?.sub === input.expectedSubject ? 'passed' : 'failed', input.expectedSubject, claims?.sub ?? null));
+    }
+    if (input.expectedClientId) {
+        checks.push(check('client_id', claims?.client_id === input.expectedClientId ? 'passed' : 'failed', input.expectedClientId, claims?.client_id ?? null));
+    }
+    if (input.expectedActorSubject) {
+        const actorSubject = claims?.act?.sub ?? claims?.may_act?.sub ?? null;
+        delegationOk = actorSubject === input.expectedActorSubject;
+        checks.push(check('actor_subject', delegationOk ? 'passed' : 'failed', input.expectedActorSubject, actorSubject));
+    }
+    if (input.requireCnf || input.requiredCnfJkt) {
+        const actual = claims?.cnf?.jkt ?? null;
+        const expected = input.requiredCnfJkt ?? 'present';
+        const passed = input.requiredCnfJkt
+            ? actual === input.requiredCnfJkt
+            : typeof actual === 'string';
+        checks.push(check('cnf.jkt', passed ? 'passed' : 'failed', expected, actual));
+    }
+    return delegationOk;
+}
+async function verifyDpopProof(input, claims, requiredCnfJkt, replayCache) {
+    const constraints = [];
+    const errors = [];
+    const dpop = {
+        jwt_present: typeof input.proofJwt === 'string' && input.proofJwt.length > 0,
+        verified: false,
+        alg: null,
+        jkt: null,
+        jti: null,
+        htm: null,
+        htu: null,
+    };
+    try {
+        const header = decodeProtectedHeader(input.proofJwt);
+        dpop.alg = typeof header.alg === 'string' ? header.alg : null;
+        const headerRecord = header;
+        const publicJwk = asRecord(headerRecord['jwk']);
+        if (!publicJwk) {
+            constraints.push(check('dpop.jwk', 'failed', 'present', null, 'missing public jwk'));
+            return { dpop, constraints, errors };
+        }
+        if (header.typ !== 'dpop+jwt') {
+            constraints.push(check('dpop.typ', 'failed', 'dpop+jwt', header.typ ?? null));
+        }
+        else {
+            constraints.push(check('dpop.typ', 'passed', 'dpop+jwt', header.typ));
+        }
+        const key = await importJWK(publicJwk, dpop.alg ?? undefined);
+        const verifyOptions = {};
+        const nowSeconds = input.nowSeconds;
+        if (nowSeconds !== undefined)
+            verifyOptions.currentDate = new Date(nowSeconds * 1000);
+        if (input.clockSkewSeconds !== undefined) {
+            verifyOptions.clockTolerance = input.clockSkewSeconds;
+        }
+        const verified = await jwtVerify(input.proofJwt, key, verifyOptions);
+        dpop.verified = true;
+        const payload = verified.payload;
+        dpop.htm = typeof payload.htm === 'string' ? payload.htm : null;
+        dpop.htu = typeof payload.htu === 'string' ? payload.htu : null;
+        dpop.jti = typeof payload.jti === 'string' ? payload.jti : null;
+        dpop.jkt = await calculateJwkThumbprint(publicJwk, 'sha256');
+        const expectedMethod = input.method.toUpperCase();
+        constraints.push(check('dpop.htm', dpop.htm === expectedMethod ? 'passed' : 'failed', expectedMethod, dpop.htm));
+        constraints.push(check('dpop.htu', dpop.htu === input.url ? 'passed' : 'failed', input.url, dpop.htu));
+        const jtiSeen = dpop.jti !== null && input.seenJtis?.includes(dpop.jti) === true
+            ? true
+            : dpop.jti !== null && replayCache !== undefined
+                ? !(await replayCache.checkAndRemember(replayKey(dpop.jti, dpop, claims), dpopReplayExpiresAtSeconds(payload, input)))
+                : false;
+        constraints.push(check('dpop.jti', dpop.jti && !jtiSeen ? 'passed' : 'failed', 'present and unseen', dpop.jti, jtiSeen ? 'jti already seen' : dpop.jti ? undefined : 'missing jti'));
+        const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);
+        const skew = input.clockSkewSeconds ?? 0;
+        const maxAge = input.maxAgeSeconds ?? 300;
+        const iat = typeof payload.iat === 'number' ? payload.iat : null;
+        const iatPassed = iat !== null && iat <= now + skew && now - iat <= maxAge + skew;
+        constraints.push(check('dpop.iat', iatPassed ? 'passed' : 'failed', { maxAgeSeconds: maxAge, nowSeconds: now, clockSkewSeconds: skew }, iat));
+        const expectedAth = input.expectedAth ?? (input.accessToken ? accessTokenHash(input.accessToken) : undefined);
+        if (expectedAth) {
+            constraints.push(check('dpop.ath', payload.ath === expectedAth ? 'passed' : 'failed', expectedAth, payload.ath ?? null));
+        }
+        else {
+            constraints.push(check('dpop.ath', 'not_checked'));
+        }
+        if (input.expectedNonce) {
+            constraints.push(check('dpop.nonce', payload.nonce === input.expectedNonce ? 'passed' : 'failed', input.expectedNonce, payload.nonce ?? null));
+        }
+        const expectedJkt = requiredCnfJkt ?? claims?.cnf?.jkt;
+        if (expectedJkt) {
+            constraints.push(check('dpop.cnf.jkt', dpop.jkt === expectedJkt ? 'passed' : 'failed', expectedJkt, dpop.jkt));
+        }
+        else {
+            constraints.push(check('dpop.cnf.jkt', 'unresolved', 'access token cnf.jkt', dpop.jkt));
+        }
+    }
+    catch (err) {
+        errors.push(`oauth_evidence dpop proof error: ${err.message}`);
+    }
+    return { dpop, constraints, errors };
+}
+function replayKey(jti, dpop, claims) {
+    return {
+        jti,
+        ...(dpop.jkt !== null ? { jkt: dpop.jkt } : {}),
+        ...(dpop.htm !== null ? { htm: dpop.htm } : {}),
+        ...(dpop.htu !== null ? { htu: dpop.htu } : {}),
+        ...(typeof claims?.iss === 'string' ? { issuer: claims.iss } : {}),
+        ...(typeof claims?.client_id === 'string' ? { client_id: claims.client_id } : {}),
+    };
+}
+function dpopReplayExpiresAtSeconds(payload, input) {
+    const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);
+    const skew = input.clockSkewSeconds ?? 0;
+    const maxAge = input.maxAgeSeconds ?? 300;
+    const iat = typeof payload.iat === 'number' ? payload.iat : now;
+    return iat + maxAge + skew;
+}
+export async function verifyOAuthAuthorizationEvidence(input) {
+    const errors = [];
+    const warnings = [];
+    const constraints = [];
+    let claims = null;
+    let token = {
+        jwt_present: false,
+        introspection_present: false,
+        verified: null,
+        alg: null,
+        kid: null,
+        claims_verified: false,
+    };
+    let dpop = null;
+    try {
+        const resolved = await resolveClaims(input);
+        claims = resolved.claims;
+        token = resolved.token;
+    }
+    catch (err) {
+        errors.push(`oauth_evidence token verification error: ${err.message}`);
+    }
+    const signaturePolicy = input.signaturePolicy ?? 'require';
+    if (!claims) {
+        errors.push('oauth_evidence missing access token claims');
+    }
+    else if (input.introspection && input.introspection.active !== true) {
+        errors.push('oauth_evidence introspection inactive');
+    }
+    else if (!token.claims_verified) {
+        if (signaturePolicy === 'require') {
+            errors.push('oauth_evidence claims were not verified');
+        }
+        else if (signaturePolicy === 'best-effort') {
+            warnings.push('oauth_evidence claims were not verified');
+        }
+    }
+    const scopes = normalizeScopes(claims);
+    const attenuationOk = pushScopeChecks(constraints, scopes, input.requiredScopes);
+    pushAudienceChecks(constraints, claims, input);
+    pushMetadataChecks(constraints, claims, input.protectedResourceMetadata);
+    pushAuthorizationDetailsChecks(constraints, claims, input.requiredAuthorizationDetails);
+    const delegationOk = pushIdentityChecks(constraints, claims, input);
+    if (input.dpopProof) {
+        const dpopProofInput = {
+            ...input.dpopProof,
+            ...(input.dpopProof.nowSeconds === undefined && input.nowSeconds !== undefined
+                ? { nowSeconds: input.nowSeconds }
+                : {}),
+            ...(input.dpopProof.clockSkewSeconds === undefined && input.clockSkewSeconds !== undefined
+                ? { clockSkewSeconds: input.clockSkewSeconds }
+                : {}),
+        };
+        const dpopResult = await verifyDpopProof(dpopProofInput, claims, input.requiredCnfJkt, input.dpopReplayCache);
+        dpop = dpopResult.dpop;
+        constraints.push(...dpopResult.constraints);
+        errors.push(...dpopResult.errors);
+    }
+    for (const constraint of constraints) {
+        if (constraint.status === 'failed') {
+            errors.push(`oauth_evidence constraint failed: ${constraint.type}`);
+        }
+    }
+    const audience = normalizeAudience(claims);
+    const resource = normalizeResource(claims);
+    const issuer = typeof claims?.iss === 'string' ? claims.iss : null;
+    const subject = typeof claims?.sub === 'string' ? claims.sub : null;
+    const clientId = typeof claims?.client_id === 'string' ? claims.client_id : null;
+    return {
+        protocol: input.protocol ?? 'oauth2',
+        valid: errors.length === 0,
+        issuer,
+        subject,
+        scope: scopes,
+        attenuation_ok: attenuationOk,
+        delegation_ok: delegationOk,
+        constraints,
+        errors,
+        warnings,
+        details: {
+            token,
+            dpop,
+            audience,
+            resource,
+            client_id: clientId,
+        },
+    };
+}
+export async function verifyAuthorizationEvidence(evidence) {
+    if ('oauth' in evidence) {
+        const protocol = evidence.protocol ?? evidence.oauth.protocol;
+        return verifyOAuthAuthorizationEvidence(protocol ? { ...evidence.oauth, protocol } : { ...evidence.oauth });
+    }
+    return verifyOAuthAuthorizationEvidence(evidence);
+}
+//# sourceMappingURL=authorization-evidence.js.map

package/dist/authorization-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-evidence.js","sourceRoot":"","sources":["../src/authorization-evidence.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,SAAS,GACV,MAAM,MAAM,CAAA;AAiKb,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAA;IAC5E,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAC1C,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,SAAS,eAAe,CAAC,MAAqC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,MAAM,WAAW,GAAG;QAClB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;aACrB,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aACtC,MAAM,CAAC,OAAO,CAAC;QAClB,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;aACnB,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;aACtC,MAAM,CAAC,OAAO,CAAC;KACnB,CAAA;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAChD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAqC;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAqC;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAA;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,IAA2B;IAChD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACpD,CAAC;AAED,SAAS,uBAAuB,CAC9B,aAA8C;IAE9C,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;IACzE,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;IACzE,IAAI,aAAa,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;IACnE,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;IACzE,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;IACzE,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;IACzE,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;IACzE,IAAI,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,KAAK,CAAA;IAC/E,IAAI,OAAO,aAAa,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,SAAS,CAAA;IAC3F,IAAI,aAAa,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAA;IAClF,IAAI,aAAa,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,CAAC,qBAAqB,GAAG,aAAa,CAAC,qBAAqB,CAAA;IACpE,CAAC;IACD,IAAI,aAAa,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;IACnE,IAAI,aAAa,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;IACnE,IAAI,aAAa,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;IAC/E,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,KAAK,CACZ,IAAY,EACZ,MAA2B,EAC3B,QAAkB,EAClB,MAAgB,EAChB,MAAe;IAEf,MAAM,MAAM,GAA4B,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACxD,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;IACtD,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;IAChD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAsC;IACjE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,SAAS,CAAA;IAC1D,MAAM,KAAK,GAAoB;QAC7B,WAAW,EAAE,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QACrD,qBAAqB,EAAE,KAAK,CAAC,aAAa,KAAK,SAAS;QACxD,QAAQ,EAAE,IAAI;QACd,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,eAAe,EAAE,KAAK,CAAC,cAAc,KAAK,IAAI;KAC/C,CAAA;IAED,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;YAC1D,KAAK,CAAC,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;YAC9D,KAAK,CAAC,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,GAAG,GAAG,IAAI,CAAA;YAChB,KAAK,CAAC,GAAG,GAAG,IAAI,CAAA;QAClB,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAqB,EAAE,CAAA;YAC1C,IAAI,KAAK,CAAC,MAAM;gBAAE,aAAa,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;YACrD,IAAI,KAAK,CAAC,QAAQ;gBAAE,aAAa,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YAC3D,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;gBACtC,aAAa,CAAC,cAAc,GAAG,KAAK,CAAC,gBAAgB,CAAA;YACvD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACnC,aAAa,CAAC,WAAW,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;YAC/D,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,KAAK,CAAC,cAAc,EACpB,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAC5C,aAAa,CACd,CAAA;YACD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YACrB,KAAK,CAAC,eAAe,GAAG,IAAI,CAAA;YAC5B,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAiC,EAAE,KAAK,EAAE,CAAA;QACtE,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,cAAc,CAA2B,CAAA;QACzE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAA;QACtB,KAAK,CAAC,eAAe,GAAG,eAAe,KAAK,KAAK,CAAA;QACjD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACnC,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,qBAAqB,KAAK,IAAI,CAAA;QACrD,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,qBAAqB,KAAK,IAAI,CAAA;QAC5D,OAAO;YACL,MAAM,EAAE,uBAAuB,CAAC,KAAK,CAAC,aAAa,CAAC;YACpD,KAAK;SACN,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,KAAK;KACN,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CACtB,MAAiC,EACjC,MAAgB,EAChB,cAAoC;IAEpC,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACzE,MAAM,CAAC,IAAI,CACT,KAAK,CACH,OAAO,EACP,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC1C,cAAc,EACd,MAAM,EACN,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3E,CACF,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAiC,EACjC,MAAqC,EACrC,KAAsC;IAEtC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAChD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAC7E,MAAM,CAAC,IAAI,CACT,KAAK,CACH,UAAU,EACV,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC1C,gBAAgB,EAChB,QAAQ,EACR,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7E,CACF,CAAA;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,yBAAyB,EAAE,QAAQ,CAAA;IACpF,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;QAC3C,MAAM,eAAe,GAAG,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAC3D,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAC5D,MAAM,CAAC,IAAI,CACT,KAAK,CACH,UAAU,EACV,eAAe,IAAI,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EACxD,gBAAgB,EAChB,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,EACtC,eAAe,IAAI,eAAe;YAChC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gDAAgD,CACrD,CACF,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAiC,EACjC,MAAqC,EACrC,QAAoD;IAEpD,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,IAAI,QAAQ,CAAC,qBAAqB,IAAI,QAAQ,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QAClE,MAAM,CAAC,IAAI,CACT,KAAK,CACH,0CAA0C,EAC1C,MAAM,IAAI,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC/E,QAAQ,CAAC,qBAAqB,EAC9B,MAAM,CACP,CACF,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAiC,EACjC,MAAqC,EACrC,QAA0D;IAE1D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,aAAa,CAAC,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAA;IAClG,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAA;QACtF,MAAM,CAAC,IAAI,CACT,KAAK,CACH,uBAAuB,EACvB,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC3B,UAAU,EACV,SAAS,EACT,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uCAAuC,UAAU,CAAC,IAAI,EAAE,CAC7E,CACF,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAc,EACd,UAA8C;IAE9C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEpD,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;QAC1C,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAClF,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;QAC9C,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAC1F,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAiC,EACjC,MAAqC,EACrC,KAAsC;IAEtC,IAAI,YAAY,GAAmB,IAAI,CAAA;IAEvC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,QAAQ,EACR,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAClD,KAAK,CAAC,MAAM,EACZ,MAAM,EAAE,GAAG,IAAI,IAAI,CACpB,CACF,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,KAAK,CACH,SAAS,EACT,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC3D,KAAK,CAAC,eAAe,EACrB,MAAM,EAAE,GAAG,IAAI,IAAI,CACpB,CACF,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,KAAK,CACH,WAAW,EACX,MAAM,EAAE,SAAS,KAAK,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAClE,KAAK,CAAC,gBAAgB,EACtB,MAAM,EAAE,SAAS,IAAI,IAAI,CAC1B,CACF,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,CAAA;QACrE,YAAY,GAAG,YAAY,KAAK,KAAK,CAAC,oBAAoB,CAAA;QAC1D,MAAM,CAAC,IAAI,CACT,KAAK,CACH,eAAe,EACf,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAClC,KAAK,CAAC,oBAAoB,EAC1B,YAAY,CACb,CACF,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,CAAA;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,IAAI,SAAS,CAAA;QAClD,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc;YACjC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;YACjC,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAA;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAA0B,EAC1B,MAAqC,EACrC,cAAkC,EAClC,WAAwC;IAExC,MAAM,WAAW,GAA8B,EAAE,CAAA;IACjD,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAmB;QAC3B,WAAW,EAAE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC5E,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;KACV,CAAA;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7D,MAAM,YAAY,GAAG,MAAiC,CAAA;QACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAe,CAAA;QAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAA;YACpF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;QACtC,CAAC;QAED,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAA;QAC/E,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QACvE,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,CAAA;QAC7D,MAAM,aAAa,GAAqB,EAAE,CAAA;QAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;QACnC,IAAI,UAAU,KAAK,SAAS;YAAE,aAAa,CAAC,WAAW,GAAG,IAAI,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;QACrF,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACzC,aAAa,CAAC,cAAc,GAAG,KAAK,CAAC,gBAAgB,CAAA;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAA;QACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QAEpB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAOxB,CAAA;QACD,IAAI,CAAC,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,IAAI,CAAC,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,IAAI,CAAC,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,IAAI,CAAC,GAAG,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAE5D,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;QACjD,WAAW,CAAC,IAAI,CACd,KAAK,CACH,UAAU,EACV,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EACjD,cAAc,EACd,IAAI,CAAC,GAAG,CACT,CACF,CAAA;QACD,WAAW,CAAC,IAAI,CACd,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CACrF,CAAA;QAED,MAAM,OAAO,GACX,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;YAC9D,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;gBAC9C,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,EACjC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,CAC3C,CAAC;gBACJ,CAAC,CAAC,KAAK,CAAA;QACb,WAAW,CAAC,IAAI,CACd,KAAK,CACH,UAAU,EACV,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC1C,oBAAoB,EACpB,IAAI,CAAC,GAAG,EACR,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CACpE,CACF,CAAA;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,IAAI,GAAG,CAAA;QACzC,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QAChE,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,GAAG,IAAI,IAAI,GAAG,GAAG,GAAG,IAAI,MAAM,GAAG,IAAI,CAAA;QACjF,WAAW,CAAC,IAAI,CACd,KAAK,CACH,UAAU,EACV,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC/B,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAClE,GAAG,CACJ,CACF,CAAA;QAED,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3F,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,CACd,KAAK,CACH,UAAU,EACV,OAAO,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EACjD,WAAW,EACX,OAAO,CAAC,GAAG,IAAI,IAAI,CACpB,CACF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,WAAW,CAAC,IAAI,CACd,KAAK,CACH,YAAY,EACZ,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC3D,KAAK,CAAC,aAAa,EACnB,OAAO,CAAC,KAAK,IAAI,IAAI,CACtB,CACF,CAAA;QACH,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,IAAI,MAAM,EAAE,GAAG,EAAE,GAAG,CAAA;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,CACd,KAAK,CACH,cAAc,EACd,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAC9C,WAAW,EACX,IAAI,CAAC,GAAG,CACT,CACF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACzF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,SAAS,CAChB,GAAW,EACX,IAAoB,EACpB,MAAqC;IAErC,OAAO;QACL,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAA;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAuC,EACvC,KAA0B;IAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,IAAI,GAAG,CAAA;IACzC,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;IAC/D,OAAO,GAAG,GAAG,MAAM,GAAG,IAAI,CAAA;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAsC;IAEtC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,WAAW,GAA8B,EAAE,CAAA;IACjD,IAAI,MAAM,GAAkC,IAAI,CAAA;IAChD,IAAI,KAAK,GAAoB;QAC3B,WAAW,EAAE,KAAK;QAClB,qBAAqB,EAAE,KAAK;QAC5B,QAAQ,EAAE,IAAI;QACd,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,eAAe,EAAE,KAAK;KACvB,CAAA;IACD,IAAI,IAAI,GAA0B,IAAI,CAAA;IAEtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;QACxB,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,4CAA6C,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,SAAS,CAAA;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;IAC3D,CAAC;SAAM,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;IACtD,CAAC;SAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAClC,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;QACxD,CAAC;aAAM,IAAI,eAAe,KAAK,aAAa,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,aAAa,GAAG,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAA;IAChF,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAC9C,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACxE,8BAA8B,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAEnE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,cAAc,GAAwB;YAC1C,GAAG,KAAK,CAAC,SAAS;YAClB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAC5E,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;gBACxF,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;QACD,MAAM,UAAU,GAAG,MAAM,eAAe,CACtC,cAAc,EACd,MAAM,EACN,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CAAA;QACD,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;QACtB,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,qCAAqC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,MAAM,OAAO,GAAG,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IACnE,MAAM,QAAQ,GAAG,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAEhF,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ;QACpC,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,OAAO;QACP,KAAK,EAAE,MAAM;QACb,cAAc,EAAE,aAAa;QAC7B,aAAa,EAAE,YAAY;QAC3B,WAAW;QACX,MAAM;QACN,QAAQ;QACR,OAAO,EAAE;YACP,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,QAAQ;YACR,SAAS,EAAE,QAAQ;SACpB;KACF,CAAA;AACH,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAoC;IAEpC,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAA;QAC7D,OAAO,gCAAgC,CACrC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CACnE,CAAA;IACH,CAAC;IACD,OAAO,gCAAgC,CAAC,QAAQ,CAAC,CAAA;AACnD,CAAC"}

package/dist/dpop-replay-cache.d.ts

@@ -0,0 +1,35 @@
+export interface DpopReplayCacheKey {
+    jti: string;
+    jkt?: string | null;
+    htm?: string | null;
+    htu?: string | null;
+    issuer?: string | null;
+    client_id?: string | null;
+}
+export interface DpopReplayCache {
+    /**
+     * Atomically remember this proof key until `expiresAtSeconds`.
+     *
+     * Returns true when the key was new and is now stored. Returns false when
+     * the key was already present and unexpired. Deployments can back this with
+     * Redis, Durable Objects, Postgres, or any other shared compare-and-set
+     * primitive. The in-memory implementation below is process-local only.
+     */
+    checkAndRemember(key: DpopReplayCacheKey, expiresAtSeconds: number): boolean | Promise<boolean>;
+}
+export interface MemoryDpopReplayCacheOptions {
+    maxEntries?: number;
+    nowSeconds?: () => number;
+}
+export declare class MemoryDpopReplayCache implements DpopReplayCache {
+    private readonly entries;
+    private readonly maxEntries;
+    private readonly nowSeconds;
+    constructor(options?: MemoryDpopReplayCacheOptions);
+    checkAndRemember(key: DpopReplayCacheKey, expiresAtSeconds: number): boolean;
+    size(): number;
+    private prune;
+    private pruneToMax;
+}
+export declare function dpopReplayCacheKeyId(key: DpopReplayCacheKey): string;
+//# sourceMappingURL=dpop-replay-cache.d.ts.map

package/dist/dpop-replay-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop-replay-cache.d.ts","sourceRoot":"","sources":["../src/dpop-replay-cache.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,gBAAgB,CACd,GAAG,EAAE,kBAAkB,EACvB,gBAAgB,EAAE,MAAM,GACvB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAA;CAC1B;AAED,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAc;gBAE7B,OAAO,GAAE,4BAAiC;IAKtD,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO;IAW5E,IAAI,IAAI,MAAM;IAKd,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,UAAU;CAOnB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CASpE"}

package/dist/dpop-replay-cache.js

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: Apache-2.0
+export class MemoryDpopReplayCache {
+    entries = new Map();
+    maxEntries;
+    nowSeconds;
+    constructor(options = {}) {
+        this.maxEntries = options.maxEntries ?? 10_000;
+        this.nowSeconds = options.nowSeconds ?? (() => Math.floor(Date.now() / 1000));
+    }
+    checkAndRemember(key, expiresAtSeconds) {
+        const now = this.nowSeconds();
+        this.prune(now);
+        const id = dpopReplayCacheKeyId(key);
+        const existingExpiry = this.entries.get(id);
+        if (existingExpiry !== undefined && existingExpiry > now)
+            return false;
+        this.entries.set(id, Math.max(expiresAtSeconds, now + 1));
+        this.pruneToMax();
+        return true;
+    }
+    size() {
+        this.prune(this.nowSeconds());
+        return this.entries.size;
+    }
+    prune(now) {
+        for (const [key, expiresAt] of this.entries) {
+            if (expiresAt <= now)
+                this.entries.delete(key);
+        }
+    }
+    pruneToMax() {
+        while (this.entries.size > this.maxEntries) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest === undefined)
+                return;
+            this.entries.delete(oldest);
+        }
+    }
+}
+export function dpopReplayCacheKeyId(key) {
+    return JSON.stringify({
+        issuer: key.issuer ?? null,
+        client_id: key.client_id ?? null,
+        jkt: key.jkt ?? null,
+        htm: key.htm ?? null,
+        htu: key.htu ?? null,
+        jti: key.jti,
+    });
+}
+//# sourceMappingURL=dpop-replay-cache.js.map

package/dist/dpop-replay-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop-replay-cache.js","sourceRoot":"","sources":["../src/dpop-replay-cache.ts"],"names":[],"mappings":"AAAA,sCAAsC;AA+BtC,MAAM,OAAO,qBAAqB;IACf,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IACnC,UAAU,CAAQ;IAClB,UAAU,CAAc;IAEzC,YAAY,UAAwC,EAAE;QACpD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAA;QAC9C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;IAC/E,CAAC;IAED,gBAAgB,CAAC,GAAuB,EAAE,gBAAwB;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACf,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3C,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,GAAG;YAAE,OAAO,KAAK,CAAA;QACtE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,UAAU,EAAE,CAAA;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAM;YAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC,CAAA;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,13 @@
 export { AtribVerifier } from './verifier.js';
 export type { AtribVerifierOptions, CalculateOptions, VerifyRecommendationOptions, } from './verifier.js';
 export { verifyRecord } from './verify-record.js';
-export type { RecordVerificationResult, ProvenanceAnnotation, VerifyRecordOptions, CrossAttestationAnnotation, } from './verify-record.js';
+export type { RecordVerificationResult, ProvenanceAnnotation, VerifyRecordOptions, ResolvedCapabilityFacts, CrossAttestationAnnotation, } from './verify-record.js';
+export { verifyAuthorizationEvidence, verifyOAuthAuthorizationEvidence, } from './authorization-evidence.js';
+export type { AuthorizationEvidenceInput, EvidenceCheckStatus, EvidenceConstraintCheck, EvidenceVerificationBlock, OAuthAccessTokenClaims, OAuthAuthorizationDetailConstraint, OAuthAuthorizationEvidenceInput, OAuthAuthorizationEvidenceVerification, OAuthDpopCheck, OAuthDpopProofInput, OAuthEvidenceProtocol, OAuthProtectedResourceMetadata, OAuthSignaturePolicy, OAuthTokenIntrospectionResponse, OAuthTokenCheck, } from './authorization-evidence.js';
+export { MemoryDpopReplayCache, dpopReplayCacheKeyId, } from './dpop-replay-cache.js';
+export type { DpopReplayCache, DpopReplayCacheKey, MemoryDpopReplayCacheOptions, } from './dpop-replay-cache.js';
+export { introspectOAuthToken, oauthEvidenceFromIntrospectionResult, } from './oauth-introspection.js';
+export type { OAuthIntrospectionClientAuthentication, OAuthIntrospectionOptions, OAuthIntrospectionResult, } from './oauth-introspection.js';
 export { handoffClaimsFromEvidencePacket, verifyHandoffClaims } from './handoff.js';
 export type { HandoffBodyVerification, HandoffClaimsFromEvidenceOptions, HandoffClaimInput, HandoffClaimVerification, HandoffEvidenceEntry, HandoffEvidencePacket, HandoffProofVerification, HandoffRejectionReason, HandoffVerificationResult, VerifyHandoffClaimsOptions, } from './handoff.js';
 export { calculate, DEFAULT_POLICY, isValidPolicy } from './calculate.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,eAAe,CAAA;AAKtB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA;AAK3B,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACnF,YAAY,EACV,uBAAuB,EACvB,gCAAgC,EAChC,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAGzE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAG5F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3E,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAGxF,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,MAAM,GACP,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,YAAY,EACV,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,eAAe,CAAA;AAKtB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,EACtB,kCAAkC,EAClC,+BAA+B,EAC/B,sCAAsC,EACtC,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,EACpB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,sCAAsC,EACtC,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAKjC,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACnF,YAAY,EACV,uBAAuB,EACvB,gCAAgC,EAChC,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAGzE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAG5F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3E,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAGxF,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,MAAM,GACP,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,YAAY,EACV,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -6,6 +6,10 @@ export { AtribVerifier } from './verifier.js';
 // AtribVerifier.verify which operates on a settlement RecommendationDocument.
 // Surfaces the implemented D044, D041, D045, D051, D052, and D094 annotations.
 export { verifyRecord } from './verify-record.js';
+// Generic external authorization evidence checks. Off the atrib record-validity path.
+export { verifyAuthorizationEvidence, verifyOAuthAuthorizationEvidence, } from './authorization-evidence.js';
+export { MemoryDpopReplayCache, dpopReplayCacheKeyId, } from './dpop-replay-cache.js';
+export { introspectOAuthToken, oauthEvidenceFromIntrospectionResult, } from './oauth-introspection.js';
 // Cross-agent handoff claim verification. Used when one agent receives a
 // record_hash claim plus private body material from another agent and must
 // decide whether to link its next record through informed_by.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAO7C,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAQjD,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAcnF,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEzE,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE7D,+BAA+B;AAC/B,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,6BAA6B;AAC7B,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAG3E,6EAA6E;AAC7E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AA6B7B,0DAA0D;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAgCvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAO7C,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AASjD,sFAAsF;AACtF,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AAmBpC,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAO/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AAOjC,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAcnF,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEzE,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE7D,+BAA+B;AAC/B,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,6BAA6B;AAC7B,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAG3E,6EAA6E;AAC7E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AA6B7B,0DAA0D;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAgCvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}

package/dist/oauth-introspection.d.ts

@@ -0,0 +1,38 @@
+import type { OAuthAuthorizationEvidenceInput, OAuthTokenIntrospectionResponse } from './authorization-evidence.js';
+export type OAuthIntrospectionClientAuthentication = {
+    method: 'none';
+} | {
+    method: 'basic';
+    clientId: string;
+    clientSecret: string;
+} | {
+    method: 'bearer';
+    token: string;
+} | {
+    method: 'headers';
+    headers: Record<string, string>;
+};
+export interface OAuthIntrospectionOptions {
+    endpoint: string;
+    token: string;
+    tokenTypeHint?: string;
+    clientAuthentication?: OAuthIntrospectionClientAuthentication;
+    extraParams?: Record<string, string>;
+    expectedIssuer?: string;
+    expectedAudience?: string | string[];
+    expectedResource?: string;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    fetchImpl?: typeof fetch;
+}
+export interface OAuthIntrospectionResult {
+    ok: boolean;
+    endpoint: string;
+    introspection?: OAuthTokenIntrospectionResponse;
+    introspectionVerified: boolean;
+    errors: string[];
+    warnings: string[];
+}
+export declare function introspectOAuthToken(options: OAuthIntrospectionOptions): Promise<OAuthIntrospectionResult>;
+export declare function oauthEvidenceFromIntrospectionResult(introspection: OAuthIntrospectionResult, base?: Omit<OAuthAuthorizationEvidenceInput, 'introspection' | 'introspectionVerified'>): OAuthAuthorizationEvidenceInput;
+//# sourceMappingURL=oauth-introspection.d.ts.map

package/dist/oauth-introspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-introspection.d.ts","sourceRoot":"","sources":["../src/oauth-introspection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,+BAA+B,EAC/B,+BAA+B,EAChC,MAAM,6BAA6B,CAAA;AAEpC,MAAM,MAAM,sCAAsC,GAC9C;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,oBAAoB,CAAC,EAAE,sCAAsC,CAAA;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,+BAA+B,CAAA;IAC/C,qBAAqB,EAAE,OAAO,CAAA;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAiDnC;AAED,wBAAgB,oCAAoC,CAClD,aAAa,EAAE,wBAAwB,EACvC,IAAI,GAAE,IAAI,CAAC,+BAA+B,EAAE,eAAe,GAAG,uBAAuB,CAAM,GAC1F,+BAA+B,CASjC"}