@harperfast/harper 5.3.0-beta.3 → 5.3.0-beta.4

package/dist/security/authn/oidc/tokenExchange.js

@@ -47,7 +47,6 @@ exports.exchangeOidcToken = exchangeOidcToken;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const joi_1 = __importDefault(require("joi"));
 const node_crypto_1 = require("node:crypto");
-const databases_ts_1 = require("../../../resources/databases.js");
 const hdbError_ts_1 = require("../../../utility/errors/hdbError.js");
 const validationWrapper_ts_1 = require("../../../validation/validationWrapper.js");
 const logger_ts_1 = require("../../../utility/logging/logger.js");
@@ -61,6 +60,7 @@ const claims_ts_1 = require("./claims.js");
 const jwks_ts_1 = require("./jwks.js");
 const index_ts_1 = require("./providers/index.js");
 const trustPolicyOperations_ts_1 = require("./trustPolicyOperations.js");
+const tokenUseTable_ts_1 = require("./tokenUseTable.js");
 const logger = (0, logger_ts_1.loggerWithTag)('oidc-trust');
 const { AuthAuditLog } = harper_logger_ts_1.default;
 // Same stream and same switches as every other authentication event (security/auth.ts), so an
@@ -72,7 +72,6 @@ const EXCHANGED_TOKEN_LIFETIME_SECONDS = 3600;
 const REPLAY_RECORD_PADDING_MS = 120_000;
 /** Real identity tokens are ~1-2 KB; this bounds what we are willing to even parse. */
 const MAX_TOKEN_LENGTH = 8192;
-const TOKEN_USE_TABLE = 'hdb_oidc_token_use';
 /**
  * Spent identity tokens, keyed by the fingerprint below and expiring with the token, so the table
  * stays proportional to in-flight tokens rather than to deploy history and never holds a credential.
@@ -82,8 +81,6 @@ const TOKEN_USE_TABLE = 'hdb_oidc_token_use';
  * not a privilege escalation: whoever holds the token could obtain one operation token regardless.
  * What it stops is the realistic case, a token that leaks after a legitimate run and is reused
  * inside its window.
- *
- * table() also registers into `databases.system`, so the lookup finds it after the first call.
  */
 let tokenUseTable;
 /** Drops the memo below so a test can install a different table. Not used in production. */
@@ -91,29 +88,7 @@ function clearTokenUseTableCache() {
     tokenUseTable = undefined;
 }
 function getTokenUseTable() {
-    // Memoized per process, but `table()` is NOT skipped merely because the table already exists.
-    // The systemSchema stub and the 5.3.0 directive declare only the primary key — the `expiresAt`
-    // TTL is not expressible through CreateTableObject — so this call is what actually installs the
-    // TTL, layered on top of the bootstrap. Short-circuiting on existence would mean a table that
-    // arrived any other way (bootstrap, replication, restore, a manual create_table) never gets it,
-    // and replay records would then accumulate in a system table forever. hdb_certificate_cache
-    // does the same two-step for the same reason.
-    tokenUseTable ??= (0, databases_ts_1.table)({
-        table: TOKEN_USE_TABLE,
-        database: 'system',
-        // `audit: true` explicitly, NOT the default (which follows logging.auditLog). Auditing is the
-        // replication change feed (databases.ts: "auditing must be enabled for replication"), and
-        // replay records MUST replicate so a token spent on one node cannot be re-spent on another
-        // inside its window. Without this, an operator with logging.auditLog:false would silently lose
-        // cross-node replay protection. Its sibling hdb_oidc_trust is audited for the same reason.
-        audit: true,
-        attributes: [
-            { name: 'id', isPrimaryKey: true },
-            { name: 'policy_id' },
-            { name: 'used_at' },
-            { name: 'expiresAt', expiresAt: true, indexed: true },
-        ],
-    });
+    tokenUseTable ??= (0, tokenUseTable_ts_1.declareTokenUseTable)();
     return tokenUseTable;
 }
 /**
@@ -229,12 +204,7 @@ async function recordTokenUse(fingerprint, claims, policyId) {
     const useTable = getTokenUseTable();
     if (await useTable.get(fingerprint))
         (0, identityToken_ts_1.rejectToken)(`token ${fingerprint.slice(0, 12)} has already been exchanged`);
-    await useTable.put({
-        id: fingerprint,
-        policy_id: policyId,
-        used_at: Date.now(),
-        expiresAt: claims.exp * 1000 + REPLAY_RECORD_PADDING_MS,
-    });
+    await useTable.put({ id: fingerprint, policy_id: policyId, used_at: Date.now() }, { expiresAt: claims.exp * 1000 + REPLAY_RECORD_PADDING_MS });
 }
 /**
  * Exchanges a CI identity token for a short-lived Harper operation token. Unauthenticated by design —

package/dist/security/authn/oidc/tokenExchange.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../../../security/authn/oidc/tokenExchange.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4Db,0DAEC;AAwKD,8CAoEC;AAxSD,qFAAqF;AACrF,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,iGAAiG;AACjG,2EAA2E;AAE3E,gEAA+B;AAC/B,8CAAsB;AACtB,6CAAyC;AACzC,kEAAoE;AACpE,qEAAkE;AAClE,mFAA4E;AAC5E,kEAAmE;AACnE,iGAAqE;AACrE,wFAA0E;AAC1E,8DAAkG;AAClG,2CAAgD;AAChD,yEAAoE;AACpE,yDAAsE;AACtE,2CAAqD;AACrD,uCAA4C;AAC5C,mDAAsF;AACtF,yEAAiE;AAGjE,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC;AAC3C,MAAM,EAAE,YAAY,EAAE,GAAG,0BAAY,CAAC;AACtC,8FAA8F;AAC9F,6FAA6F;AAC7F,MAAM,YAAY,GAAG,0BAAY,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAEvF,qGAAqG;AACrG,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAE9C,sGAAsG;AACtG,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEzC,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,IAAI,aAAkB,CAAC;AAEvB,4FAA4F;AAC5F,SAAgB,uBAAuB;IACtC,aAAa,GAAG,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB;IACxB,8FAA8F;IAC9F,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,gGAAgG;IAChG,4FAA4F;IAC5F,8CAA8C;IAC9C,aAAa,KAAK,IAAA,oBAAK,EAAQ;QAC9B,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,QAAQ;QAClB,8FAA8F;QAC9F,0FAA0F;QAC1F,2FAA2F;QAC3F,+FAA+F;QAC/F,2FAA2F;QAC3F,KAAK,EAAE,IAAI;QACX,UAAU,EAAE;YACX,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;YAClC,EAAE,IAAI,EAAE,WAAW,EAAE;YACrB,EAAE,IAAI,EAAE,SAAS,EAAE;YACnB,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;SACrD;KACD,CAAC,CAAC;IACH,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAQ,EAAE,QAA4B,EAAE,MAAc,EAAE,MAA+B;IAC7G,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,qCAAqC,CAAC,IAAI,KAAK,CAAC;IAC5F,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,iCAAiC,CAAC,IAAI,KAAK,CAAC;IACpF,IAAI,MAAM,KAAK,+BAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO;IAE/E,gGAAgG;IAChG,+EAA+E;IAC/E,MAAM,WAAW,GAAG,GAAG,EAAE,WAAW,CAAC;IACrC,MAAM,GAAG,GAAQ,IAAK,YAAoB,CACzC,QAAQ,EACR,MAAM,EACN,8BAAgB,CAAC,cAAc;IAC/B,yFAAyF;IACzF,4FAA4F;IAC5F,2FAA2F;IAC3F,WAAW,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,IAAI,WAAW,EAAE,EAAE,EAC5D,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,QAAQ,CACrB,CAAC;IACF,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,IAAI,MAAM,KAAK,+BAAiB,CAAC,OAAO;QAAE,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;;QAC9D,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAQ,EAAE,QAA4B,EAAE,MAAc,EAAE,MAA+B;IACnH,IAAI,CAAC;QACJ,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,EAAE,CAAC,8CAA+C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;AACF,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,kBAAkB,CAChC,KAAa,EACb,MAAc,EACd,QAA2B,EAC3B,OAAgC;IAEhC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEpE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,gGAAgG;QAChG,iGAAiG;QACjG,gGAAgG;QAChG,8FAA8F;QAC9F,uFAAuF;QACvF,IAAI,CAAC;YACJ,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,EAAE,CAAC,0BAA0B,MAAM,CAAC,EAAE,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,SAAS;QACV,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,yFAAyF;YACzF,wFAAwF;YACxF,sFAAsF;YACtF,0FAA0F;YAC1F,6EAA6E;YAC7E,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,MAAM,IAAA,sCAAmB,EAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxG,MAAM,CAAC,IAAI,EAAE,CACZ,mCAAmC,MAAM,CAAC,EAAE,gBAAgB,MAAM,CAAC,QAAQ,OAAQ,KAAe,CAAC,OAAO,EAAE,CAC5G,CAAC;gBACF,OAAO,SAAS,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,MAAM,QAAQ,GAAG,IAAA,kCAAsB,EAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9G,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACzC,MAAM,CAAC,KAAK,EAAE,CAAC,iBAAiB,MAAM,CAAC,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACtC,gGAAgG;IAChG,4FAA4F;IAC5F,uFAAuF;IACvF,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,WAAmB,EAAE,MAAmB,EAAE,QAAgB;IACvF,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,IAAA,8BAAW,EAAC,SAAS,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,CAAC;IAEjH,MAAM,QAAQ,CAAC,GAAG,CAAC;QAClB,EAAE,EAAE,WAAW;QACf,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;QACnB,SAAS,EAAG,MAAM,CAAC,GAAc,GAAG,IAAI,GAAG,wBAAwB;KACnE,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAQ;IAC/C,MAAM,UAAU,GAAG,IAAA,uCAAgB,EAClC,GAAG,EACH,aAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CACzF,CAAC;IACF,IAAI,UAAU;QAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE1D,4FAA4F;IAC5F,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACJ,6FAA6F;QAC7F,6DAA6D;QAC7D,MAAM,UAAU,GAAG,sBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAA,yBAAe,EAAE,UAAU,EAAE,OAAe,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACR,IAAA,8BAAW,EAAC,+BAA+B,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QAEtB,MAAM,OAAO,GAAG,IAAA,2BAAgB,EAAC,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;QAE9B,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAmB,EAAC,MAAM,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,IAAA,8BAAW,EAAC,sCAAsC,MAAM,EAAE,CAAC,CAAC;QAEvF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO;YAAE,IAAA,8BAAW,EAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACnC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAEpD,6FAA6F;QAC7F,qDAAqD;QACrD,MAAM,IAAI,GAAG,IAAA,yBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,IAAA,8BAAW,EAAC,iBAAiB,MAAM,CAAC,EAAE,iBAAiB,MAAM,CAAC,IAAI,yBAAyB,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;YAAE,IAAA,8BAAW,EAAC,iBAAiB,MAAM,CAAC,EAAE,0BAA0B,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3G,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAEzB,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,CAAC,iBAAiB,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,cAAc,GAAG,MAAM,IAAA,6CAAoB,EAChD;YACC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,KAAK,IAAI;YACtD,UAAU,EAAE,MAAM,CAAC,UAAU;SAC7B,EACD,gCAAgC,CAChC,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM;YAAE,KAAK,CAAC,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC;QAE3E,MAAM,CAAC,IAAI,EAAE,CAAC,0BAA0B,MAAM,CAAC,EAAE,oBAAoB,IAAI,CAAC,QAAQ,SAAS,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9G,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAErE,OAAO;YACN,eAAe,EAAE,cAAc;YAC/B,UAAU,EAAE,gCAAgC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,MAAM,CAAC,EAAE;SACjB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrE,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC"}
+{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../../../security/authn/oidc/tokenExchange.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDb,0DAEC;AAgJD,8CAoEC;AA5QD,qFAAqF;AACrF,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,iGAAiG;AACjG,2EAA2E;AAE3E,gEAA+B;AAC/B,8CAAsB;AACtB,6CAAyC;AACzC,qEAAkE;AAClE,mFAA4E;AAC5E,kEAAmE;AACnE,iGAAqE;AACrE,wFAA0E;AAC1E,8DAAkG;AAClG,2CAAgD;AAChD,yEAAoE;AACpE,yDAAsE;AACtE,2CAAqD;AACrD,uCAA4C;AAC5C,mDAAsF;AACtF,yEAAiE;AACjE,yDAA0D;AAG1D,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC;AAC3C,MAAM,EAAE,YAAY,EAAE,GAAG,0BAAY,CAAC;AACtC,8FAA8F;AAC9F,6FAA6F;AAC7F,MAAM,YAAY,GAAG,0BAAY,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAEvF,qGAAqG;AACrG,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAE9C,sGAAsG;AACtG,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEzC,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;;;;;GASG;AACH,IAAI,aAAkB,CAAC;AAEvB,4FAA4F;AAC5F,SAAgB,uBAAuB;IACtC,aAAa,GAAG,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB;IACxB,aAAa,KAAK,IAAA,uCAAoB,GAAE,CAAC;IACzC,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAQ,EAAE,QAA4B,EAAE,MAAc,EAAE,MAA+B;IAC7G,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,qCAAqC,CAAC,IAAI,KAAK,CAAC;IAC5F,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,iCAAiC,CAAC,IAAI,KAAK,CAAC;IACpF,IAAI,MAAM,KAAK,+BAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO;IAE/E,gGAAgG;IAChG,+EAA+E;IAC/E,MAAM,WAAW,GAAG,GAAG,EAAE,WAAW,CAAC;IACrC,MAAM,GAAG,GAAQ,IAAK,YAAoB,CACzC,QAAQ,EACR,MAAM,EACN,8BAAgB,CAAC,cAAc;IAC/B,yFAAyF;IACzF,4FAA4F;IAC5F,2FAA2F;IAC3F,WAAW,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,IAAI,WAAW,EAAE,EAAE,EAC5D,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,QAAQ,CACrB,CAAC;IACF,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,IAAI,MAAM,KAAK,+BAAiB,CAAC,OAAO;QAAE,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;;QAC9D,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAQ,EAAE,QAA4B,EAAE,MAAc,EAAE,MAA+B;IACnH,IAAI,CAAC;QACJ,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,EAAE,CAAC,8CAA+C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;AACF,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,kBAAkB,CAChC,KAAa,EACb,MAAc,EACd,QAA2B,EAC3B,OAAgC;IAEhC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEpE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,gGAAgG;QAChG,iGAAiG;QACjG,gGAAgG;QAChG,8FAA8F;QAC9F,uFAAuF;QACvF,IAAI,CAAC;YACJ,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,EAAE,CAAC,0BAA0B,MAAM,CAAC,EAAE,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,SAAS;QACV,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,yFAAyF;YACzF,wFAAwF;YACxF,sFAAsF;YACtF,0FAA0F;YAC1F,6EAA6E;YAC7E,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,MAAM,IAAA,sCAAmB,EAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxG,MAAM,CAAC,IAAI,EAAE,CACZ,mCAAmC,MAAM,CAAC,EAAE,gBAAgB,MAAM,CAAC,QAAQ,OAAQ,KAAe,CAAC,OAAO,EAAE,CAC5G,CAAC;gBACF,OAAO,SAAS,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,MAAM,QAAQ,GAAG,IAAA,kCAAsB,EAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9G,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACzC,MAAM,CAAC,KAAK,EAAE,CAAC,iBAAiB,MAAM,CAAC,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACtC,gGAAgG;IAChG,4FAA4F;IAC5F,uFAAuF;IACvF,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,WAAmB,EAAE,MAAmB,EAAE,QAAgB;IACvF,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,IAAA,8BAAW,EAAC,SAAS,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,CAAC;IAEjH,MAAM,QAAQ,CAAC,GAAG,CACjB,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAC7D,EAAE,SAAS,EAAG,MAAM,CAAC,GAAc,GAAG,IAAI,GAAG,wBAAwB,EAAE,CACvE,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAQ;IAC/C,MAAM,UAAU,GAAG,IAAA,uCAAgB,EAClC,GAAG,EACH,aAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CACzF,CAAC;IACF,IAAI,UAAU;QAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE1D,4FAA4F;IAC5F,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACJ,6FAA6F;QAC7F,6DAA6D;QAC7D,MAAM,UAAU,GAAG,sBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAA,yBAAe,EAAE,UAAU,EAAE,OAAe,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACR,IAAA,8BAAW,EAAC,+BAA+B,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QAEtB,MAAM,OAAO,GAAG,IAAA,2BAAgB,EAAC,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;QAE9B,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAmB,EAAC,MAAM,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,IAAA,8BAAW,EAAC,sCAAsC,MAAM,EAAE,CAAC,CAAC;QAEvF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO;YAAE,IAAA,8BAAW,EAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACnC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAEpD,6FAA6F;QAC7F,qDAAqD;QACrD,MAAM,IAAI,GAAG,IAAA,yBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,IAAA,8BAAW,EAAC,iBAAiB,MAAM,CAAC,EAAE,iBAAiB,MAAM,CAAC,IAAI,yBAAyB,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;YAAE,IAAA,8BAAW,EAAC,iBAAiB,MAAM,CAAC,EAAE,0BAA0B,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3G,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAEzB,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,CAAC,iBAAiB,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,cAAc,GAAG,MAAM,IAAA,6CAAoB,EAChD;YACC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,KAAK,IAAI;YACtD,UAAU,EAAE,MAAM,CAAC,UAAU;SAC7B,EACD,gCAAgC,CAChC,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM;YAAE,KAAK,CAAC,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC;QAE3E,MAAM,CAAC,IAAI,EAAE,CAAC,0BAA0B,MAAM,CAAC,EAAE,oBAAoB,IAAI,CAAC,QAAQ,SAAS,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9G,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAErE,OAAO;YACN,eAAe,EAAE,cAAc;YAC/B,UAAU,EAAE,gCAAgC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,MAAM,CAAC,EAAE;SACjB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrE,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC"}

package/dist/security/authn/oidc/tokenUseTable.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Every node must declare system.hdb_oidc_token_use in this shape whether or not it ever performs an
+ * exchange: passive cluster members receive every replicated replay row, and only an `expiration` stored
+ * in the node's own catalog arms the cleanup scan that removes them. See dataLayer/DESIGN.md, "System
+ * table bootstrap".
+ */
+import { type Table } from '../../../resources/databases.ts';
+export declare const TOKEN_USE_TABLE: "hdb_oidc_token_use";
+export declare function declareTokenUseTable(): Table;

package/dist/security/authn/oidc/tokenUseTable.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * Every node must declare system.hdb_oidc_token_use in this shape whether or not it ever performs an
+ * exchange: passive cluster members receive every replicated replay row, and only an `expiration` stored
+ * in the node's own catalog arms the cleanup scan that removes them. See dataLayer/DESIGN.md, "System
+ * table bootstrap".
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOKEN_USE_TABLE = void 0;
+exports.declareTokenUseTable = declareTokenUseTable;
+const databases_ts_1 = require("../../../resources/databases.js");
+const hdbTerms_ts_1 = require("../../../utility/hdbTerms.js");
+exports.TOKEN_USE_TABLE = hdbTerms_ts_1.SYSTEM_TABLE_NAMES.OIDC_TOKEN_USE_TABLE_NAME;
+/** Bounds only a row written without an expiry of its own; each replay record carries its token's. */
+const FALLBACK_EXPIRATION_SECONDS = 86_400;
+function declareTokenUseTable() {
+    return (0, databases_ts_1.table)({
+        table: exports.TOKEN_USE_TABLE,
+        database: hdbTerms_ts_1.SYSTEM_SCHEMA_NAME,
+        // Explicit rather than the logging.auditLog default: auditing is the replication change feed, and a
+        // token spent on one node must be refused on the others.
+        audit: true,
+        schemaDefined: true,
+        expiration: FALLBACK_EXPIRATION_SECONDS,
+        attributes: [{ name: 'id', isPrimaryKey: true }, { name: 'policy_id' }, { name: 'used_at' }],
+    });
+}
+//# sourceMappingURL=tokenUseTable.js.map

package/dist/security/authn/oidc/tokenUseTable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenUseTable.js","sourceRoot":"","sources":["../../../../security/authn/oidc/tokenUseTable.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAUH,oDAWC;AAnBD,kEAAoE;AACpE,8DAAsF;AAEzE,QAAA,eAAe,GAAG,gCAAkB,CAAC,yBAAyB,CAAC;AAE5E,sGAAsG;AACtG,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAE3C,SAAgB,oBAAoB;IACnC,OAAO,IAAA,oBAAK,EAAQ;QACnB,KAAK,EAAE,uBAAe;QACtB,QAAQ,EAAE,gCAAkB;QAC5B,oGAAoG;QACpG,yDAAyD;QACzD,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,IAAI;QACnB,UAAU,EAAE,2BAA2B;QACvC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC5F,CAAC,CAAC;AACJ,CAAC"}

package/dist/security/certificateVerification/certificateVerificationSource.d.ts

@@ -12,7 +12,6 @@ export declare class CertificateVerificationSource extends Resource {
         status: any;
         reason: any;
         checked_at: number;
-        expiresAt: any;
         method: string;
     }>;
 }

package/dist/security/certificateVerification/certificateVerificationSource.js

@@ -62,14 +62,14 @@ class CertificateVerificationSource extends Resource_ts_1.Resource {
         else {
             throw new Error(`Unsupported verification method: ${method} for ID: ${id}`);
         }
-        // Handle result consistently
-        const expiresAt = Date.now() + methodConfig.cacheTtl;
+        // without a cacheTtl, the table's expiration applies rather than none
+        if (Number.isFinite(methodConfig.cacheTtl))
+            context.expiresAt = Date.now() + methodConfig.cacheTtl;
         return {
             certificate_id: id,
             status: result.status,
             reason: result.reason,
             checked_at: Date.now(),
-            expiresAt,
             method,
         };
     }

package/dist/security/certificateVerification/certificateVerificationSource.js.map

@@ -1 +1 @@
-{"version":3,"file":"certificateVerificationSource.js","sourceRoot":"","sources":["../../../security/certificateVerification/certificateVerificationSource.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,6DAAuD;AAIvD,gCAAgC;AAChC,IAAI,eAAoB,CAAC;AACzB,IAAI,gBAAqB,CAAC;AAE1B,2CAA2C;AAC3C,KAAK,UAAU,yBAAyB;IACvC,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACvD,eAAe,GAAI,SAAiB,CAAC,eAAe,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzD,gBAAgB,GAAI,UAAkB,CAAC,gBAAgB,CAAC;IACzD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAa,6BAA8B,SAAQ,sBAAQ;IAC1D,KAAK,CAAC,GAAG,CAAC,KAAY;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAY,CAAC;QAE9B,+CAA+C;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAmD,CAAC;QACnF,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;QAE/C,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;YAC7E,8FAA8F;YAC9F,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAE1F,kCAAkC;QAClC,IAAI,MAAc,CAAC;QACnB,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,KAAK,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,MAAM,CAAC;QACjB,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACpB,CAAC;QAED,8BAA8B;QAC9B,MAAM,yBAAyB,EAAE,CAAC;QAElC,uCAAuC;QACvC,IAAI,MAAM,CAAC;QACX,IAAI,YAAY,CAAC;QAEjB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACtB,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC;YAC1B,kEAAkE;YAClE,MAAM,OAAO,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,6BAA6B;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;QAErD,OAAO;YACN,cAAc,EAAE,EAAE;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,SAAS;YACT,MAAM;SACN,CAAC;IACH,CAAC;CACD;AAxDD,sEAwDC"}
+{"version":3,"file":"certificateVerificationSource.js","sourceRoot":"","sources":["../../../security/certificateVerification/certificateVerificationSource.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,6DAAuD;AAIvD,gCAAgC;AAChC,IAAI,eAAoB,CAAC;AACzB,IAAI,gBAAqB,CAAC;AAE1B,2CAA2C;AAC3C,KAAK,UAAU,yBAAyB;IACvC,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACvD,eAAe,GAAI,SAAiB,CAAC,eAAe,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzD,gBAAgB,GAAI,UAAkB,CAAC,gBAAgB,CAAC;IACzD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAa,6BAA8B,SAAQ,sBAAQ;IAC1D,KAAK,CAAC,GAAG,CAAC,KAAY;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAY,CAAC;QAE9B,+CAA+C;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAmD,CAAC;QACnF,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;QAE/C,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;YAC7E,8FAA8F;YAC9F,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAE1F,kCAAkC;QAClC,IAAI,MAAc,CAAC;QACnB,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,KAAK,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,MAAM,CAAC;QACjB,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACpB,CAAC;QAED,8BAA8B;QAC9B,MAAM,yBAAyB,EAAE,CAAC;QAElC,uCAAuC;QACvC,IAAI,MAAM,CAAC;QACX,IAAI,YAAY,CAAC;QAEjB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACtB,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC;YAC1B,kEAAkE;YAClE,MAAM,OAAO,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;QAEnG,OAAO;YACN,cAAc,EAAE,EAAE;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,MAAM;SACN,CAAC;IACH,CAAC;CACD;AAvDD,sEAuDC"}

package/dist/security/certificateVerification/crlVerification.js

@@ -41,9 +41,10 @@ exports.verifyCRL = verifyCRL;
 exports.performCRLCheck = performCRLCheck;
 const pkijs = __importStar(require("pkijs"));
 const logger_ts_1 = require("../../utility/logging/logger.js");
-const databases_ts_1 = require("../../resources/databases.js");
 const Resource_ts_1 = require("../../resources/Resource.js");
+const transaction_ts_1 = require("../../resources/transaction.js");
 const verificationUtils_ts_1 = require("./verificationUtils.js");
+const verificationTables_ts_1 = require("./verificationTables.js");
 const verificationConfig_ts_1 = require("./verificationConfig.js");
 /**
  * Custom error for CRL signature verification failures
@@ -80,15 +81,10 @@ class CertificateRevocationListSource extends Resource_ts_1.Resource {
         }
         const { distributionPoint, issuerPem: issuerPemStr, config } = requestContext;
         try {
-            const result = await downloadAndParseCRL(distributionPoint, issuerPemStr, config.timeout);
+            const { entry } = await downloadAndParseCRLOnce(distributionPoint, issuerPemStr, config);
             // Set expiration - use the CRL's nextUpdate time or configured TTL, whichever is sooner
-            const crlExpiry = result.next_update;
-            const configExpiry = Date.now() + config.cacheTtl;
-            const expiresAt = Math.min(crlExpiry, configExpiry);
-            return {
-                ...result,
-                expiresAt,
-            };
+            context.expiresAt = Math.min(entry.next_update, Date.now() + config.cacheTtl);
+            return entry;
         }
         catch (error) {
             logger.error?.(`CRL fetch error for: ${distributionPoint} - ${error}`);
@@ -98,16 +94,15 @@ class CertificateRevocationListSource extends Resource_ts_1.Resource {
             // Check failure mode
             if (config.failureMode === 'fail-closed') {
                 // Cache the error for faster recovery
-                const expiresAt = Date.now() + verificationConfig_ts_1.ERROR_CACHE_TTL;
+                context.expiresAt = Date.now() + verificationConfig_ts_1.ERROR_CACHE_TTL;
                 return {
                     crl_id: id,
                     distribution_point: distributionPoint,
                     issuer_dn: 'unknown',
                     crl_blob: Buffer.alloc(0),
                     this_update: Date.now(),
-                    next_update: expiresAt,
+                    next_update: context.expiresAt,
                     signature_valid: false,
-                    expiresAt,
                 };
             }
             // Fail open - return null to not cache
@@ -121,80 +116,14 @@ let crlCacheTable;
 let revokedCertificateTable;
 function getCRLCacheTable() {
     if (!crlCacheTable) {
-        crlCacheTable = (0, databases_ts_1.table)({
-            table: 'hdb_crl_cache',
-            database: 'system',
-            attributes: [
-                {
-                    name: 'distribution_point',
-                    isPrimaryKey: true,
-                },
-                {
-                    name: 'issuer_dn',
-                },
-                {
-                    name: 'crl_blob',
-                },
-                {
-                    name: 'this_update',
-                },
-                {
-                    name: 'next_update',
-                },
-                {
-                    name: 'signature_valid',
-                },
-                {
-                    name: 'expiresAt',
-                    expiresAt: true,
-                    indexed: true,
-                },
-            ],
-        });
+        crlCacheTable = (0, verificationTables_ts_1.declareCRLCacheTable)();
         // Configure the caching source
         crlCacheTable.sourcedFrom(CertificateRevocationListSource);
     }
     return crlCacheTable;
 }
 function getRevokedCertificateTable() {
-    if (!revokedCertificateTable) {
-        revokedCertificateTable = (0, databases_ts_1.table)({
-            table: 'hdb_revoked_certificates',
-            database: 'system',
-            attributes: [
-                {
-                    name: 'composite_id',
-                    isPrimaryKey: true,
-                },
-                {
-                    name: 'serial_number',
-                    indexed: true,
-                },
-                {
-                    name: 'issuer_key_id',
-                    indexed: true,
-                },
-                {
-                    name: 'revocation_date',
-                },
-                {
-                    name: 'revocation_reason',
-                },
-                {
-                    name: 'crl_source',
-                    indexed: true, // Links to CRL cache
-                },
-                {
-                    name: 'crl_next_update',
-                },
-                {
-                    name: 'expiresAt',
-                    expiresAt: true,
-                    indexed: true,
-                },
-            ],
-        });
-    }
+    revokedCertificateTable ??= (0, verificationTables_ts_1.declareRevokedCertificatesTable)();
     return revokedCertificateTable;
 }
 /**
@@ -319,9 +248,15 @@ async function performCRLCheck(certPem, issuerPem, config, crlUrls) {
         // This requires checking if CRLs for the distribution points are up to date
         const crlStatus = await checkCRLFreshness(distributionPoints, issuerPem, config);
         if (crlStatus.upToDate) {
-            // CRL was just fetched/refreshed — re-check the revoked table since it may have
-            // been populated by processRevokedCertificates during the download above
-            const revokedEntryFresh = await revokedTable.get(compositeId);
+            // A CRL this check downloaded decides it: by now another thread may have replaced the stored set with
+            // a different generation of that CRL
+            if (crlStatus.revokedIds) {
+                return crlStatus.revokedIds.has(compositeId)
+                    ? { status: 'revoked', reason: 'unspecified', source: crlStatus.source }
+                    : { status: 'good', source: crlStatus.source };
+            }
+            // Outside the verdict fill's transaction: on LMDB its read snapshot predates rows committed since
+            const revokedEntryFresh = await revokedTable.get(compositeId, {});
             if (revokedEntryFresh) {
                 const entry = revokedEntryFresh;
                 const now = Date.now();
@@ -386,8 +321,9 @@ async function checkCRLFreshness(distributionPoints, issuerPem, config) {
                 // Failed to check cache, continue
             }
             // If no valid cached CRL, download and parse fresh
+            let revokedIds;
             if (!crlData) {
-                crlData = await downloadAndParseCRL(distributionPoint, issuerPem, config.timeout);
+                ({ entry: crlData, revokedIds } = await downloadAndParseCRLOnce(distributionPoint, issuerPem, config));
             }
             // Check if CRL is current
             const crlExpiry = crlData.next_update;
@@ -395,16 +331,16 @@ async function checkCRLFreshness(distributionPoints, issuerPem, config) {
                 // Store in cache for future use (only if we downloaded it fresh)
                 if (!cachedCRL) {
                     try {
-                        await crlTable.put(distributionPoint, crlData);
+                        await crlTable.put(distributionPoint, crlData, { expiresAt: crlExpiry });
                     }
                     catch {
                         // Failed to cache, but continue anyway
                     }
                 }
-                return { upToDate: true, source: distributionPoint };
+                return { upToDate: true, source: distributionPoint, revokedIds };
             }
             else if (crlExpiry + config.gracePeriod > now) {
-                return { upToDate: true, source: distributionPoint };
+                return { upToDate: true, source: distributionPoint, revokedIds };
             }
             else {
                 return { upToDate: false, reason: 'crl-expired' };
@@ -421,19 +357,32 @@ async function checkCRLFreshness(distributionPoints, issuerPem, config) {
     }
     return { upToDate: false, reason: 'no-current-crl-data' };
 }
+// Concurrent checks of certificates from one CA share one download and replacement per distribution point on
+// this thread; each replacing the same rows would make their commits conflict, and past the retry limit that
+// fails the check. The key holds every input the download uses, so no check inherits another's deadline.
+const crlDownloads = new Map();
+function downloadAndParseCRLOnce(distributionPoint, issuerPemStr, config) {
+    const key = `${distributionPoint}\n${config.gracePeriod}\n${config.timeout}\n${issuerPemStr}`;
+    let download = crlDownloads.get(key);
+    if (!download) {
+        download = downloadAndParseCRL(distributionPoint, issuerPemStr, config).finally(() => crlDownloads.delete(key));
+        crlDownloads.set(key, download);
+    }
+    return download;
+}
 /**
  * Download and parse a CRL from a distribution point
  * @param distributionPoint - CRL URL
  * @param issuerPemStr - Issuer certificate for signature verification
- * @param timeout - Download timeout in milliseconds
- * @returns Parsed CRL entry for caching
+ * @param config - CRL configuration (download timeout, grace period)
+ * @returns Parsed CRL entry for caching, and the certificates it revokes
  */
-async function downloadAndParseCRL(distributionPoint, issuerPemStr, timeout) {
+async function downloadAndParseCRL(distributionPoint, issuerPemStr, config) {
     // Download the CRL
     // Note: Using fetch here since CRL downloads are cached and infrequent
     // (typically one per CA), so this is not a hot path
     const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    const timeoutId = setTimeout(() => controller.abort(), config.timeout);
     try {
         const response = await fetch(distributionPoint, {
             signal: controller.signal,
@@ -441,7 +390,6 @@ async function downloadAndParseCRL(distributionPoint, issuerPemStr, timeout) {
                 'User-Agent': verificationConfig_ts_1.CRL_USER_AGENT,
             },
         });
-        clearTimeout(timeoutId);
         if (!response.ok) {
             throw new Error(`CRL download failed: ${response.status}`);
         }
@@ -479,105 +427,69 @@ async function downloadAndParseCRL(distributionPoint, issuerPemStr, timeout) {
             this_update: thisUpdate,
             next_update: nextUpdate,
             signature_valid: signatureValid,
-            expiresAt: nextUpdate,
         };
         // Process revoked certificates before returning so the revoked table is populated
         // before any subsequent lookup in performCRLCheck
-        await processRevokedCertificates(crl, issuerPemStr, distributionPoint, nextUpdate);
-        return cacheEntry;
+        const revokedIds = await processRevokedCertificates(crl, issuerPemStr, distributionPoint, nextUpdate, config.gracePeriod ?? 0);
+        return { entry: cacheEntry, revokedIds };
     }
     finally {
         clearTimeout(timeoutId);
     }
 }
 /**
- * Process revoked certificates from CRL and store them in the revoked certificates table
+ * Replace this CRL's rows in the revoked certificates table with its current revocations
  * @param crl - Parsed CRL object
  * @param issuerPemStr - Issuer certificate PEM
  * @param distributionPoint - CRL distribution point URL
  * @param nextUpdate - When this CRL expires
+ * @param gracePeriod - How long past nextUpdate performCRLCheck still honors a revocation
+ * @returns The composite ids of the revoked certificates
  */
-async function processRevokedCertificates(crl, issuerPemStr, distributionPoint, nextUpdate) {
+async function processRevokedCertificates(crl, issuerPemStr, distributionPoint, nextUpdate, gracePeriod) {
     const revokedTable = getRevokedCertificateTable();
     const issuerKeyId = (0, verificationUtils_ts_1.extractIssuerKeyId)(issuerPemStr);
     const cacheKey = distributionPoint;
-    // Clear existing entries for this CRL to ensure data consistency
-    // This prevents stale revocation data when certificates are removed from updated CRLs
-    try {
+    const revokedIds = new Set();
+    // All or nothing, so a failure leaves the previous revocations rather than a partial set that would read
+    // as good. Its own transaction, not the verdict fill's, so the rows are committed before performCRLCheck
+    // reads them back; the context's expiresAt is what each row stores as its expiry.
+    await (0, transaction_ts_1.transaction)({ expiresAt: nextUpdate + gracePeriod }, async () => {
         await clearExistingCRLEntries(revokedTable, cacheKey);
-    }
-    catch (error) {
-        logger.warn?.(`Failed to clear existing CRL entries: ${error}`);
-        // Continue with processing - partial cleanup is better than no update
-    }
-    // Add new revoked certificates
-    if (crl.revokedCertificates) {
-        for (const revokedCert of crl.revokedCertificates) {
-            try {
-                // Extract serial number using PKI.js - same method as extractSerialNumber() function
-                // This gives us the clean serial number without ASN.1 encoding
-                const serialHex = revokedCert.userCertificate.valueBlock.valueHexView;
-                if (!serialHex) {
-                    logger.warn?.('Could not extract serial number from revoked certificate');
-                    continue;
-                }
-                const serialNumber = Array.from(serialHex)
-                    .map((b) => b.toString(16).padStart(2, '0'))
-                    .join('');
-                const compositeId = (0, verificationUtils_ts_1.createRevokedCertificateId)(issuerKeyId, serialNumber);
-                // Extract revocation date
-                const revocationDate = revokedCert.revocationDate.value.getTime();
+        for (const revokedCert of crl.revokedCertificates ?? []) {
+            // Extract serial number using PKI.js - same method as extractSerialNumber() function
+            // This gives us the clean serial number without ASN.1 encoding
+            const serialHex = revokedCert.userCertificate.valueBlock.valueHexView;
+            if (!serialHex)
+                throw new Error(`A revoked certificate in the CRL from ${distributionPoint} has no serial number`);
+            const serialNumber = Buffer.from(serialHex).toString('hex');
+            const entry = {
+                composite_id: (0, verificationUtils_ts_1.createRevokedCertificateId)(issuerKeyId, serialNumber),
+                serial_number: serialNumber,
+                issuer_key_id: issuerKeyId,
+                revocation_date: revokedCert.revocationDate.value.getTime(),
                 // For now, skip complex extension parsing and just use default reason
-                const revocationReason = 'unspecified';
-                const entry = {
-                    composite_id: compositeId,
-                    serial_number: serialNumber,
-                    issuer_key_id: issuerKeyId,
-                    revocation_date: revocationDate,
-                    revocation_reason: revocationReason,
-                    crl_source: cacheKey,
-                    crl_next_update: nextUpdate,
-                    expiresAt: nextUpdate,
-                };
-                await revokedTable.put(entry.composite_id, entry);
-            }
-            catch (error) {
-                logger.warn?.(`Failed to process revoked certificate: ${error}`);
-                // Continue with other certificates
-            }
+                revocation_reason: 'unspecified',
+                crl_source: cacheKey,
+                crl_next_update: nextUpdate,
+            };
+            revokedIds.add(entry.composite_id);
+            await revokedTable.put(entry.composite_id, entry);
         }
-    }
+    });
+    return revokedIds;
 }
 /**
- * Clear existing revoked certificate entries for a specific CRL source
- * This ensures data consistency when CRLs are updated and certificates are removed
+ * Delete the revoked certificate entries stored for a specific CRL source
  * @param revokedTable - Harper table for revoked certificates
  * @param crlSource - CRL cache key to identify entries to remove
  */
 async function clearExistingCRLEntries(revokedTable, crlSource) {
-    // We need to find all entries with the matching crl_source and delete them individually
-    try {
-        // Use Harper's search capabilities to find entries by crl_source
-        // Note: This assumes the crl_source field is indexed (which it is)
-        const existingEntries = revokedTable.search([
-            {
-                attribute: 'crl_source',
-                value: crlSource,
-            },
-        ]);
-        for await (const entry of existingEntries) {
-            try {
-                await revokedTable.delete(entry.composite_id);
-            }
-            catch (deleteError) {
-                logger.warn?.(`Failed to delete revoked certificate entry: ${deleteError}`);
-                // Continue with other entries
-            }
-        }
-    }
-    catch (searchError) {
-        logger.error?.(`Failed to search for existing CRL entries: ${searchError}`);
-        throw searchError;
+    const compositeIds = [];
+    for await (const entry of revokedTable.search([{ attribute: 'crl_source', value: crlSource }])) {
+        compositeIds.push(entry.composite_id);
     }
+    for (const compositeId of compositeIds)
+        await revokedTable.delete(compositeId);
 }
 //# sourceMappingURL=crlVerification.js.map

package/dist/security/certificateVerification/crlVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"crlVerification.js","sourceRoot":"","sources":["../../../security/certificateVerification/crlVerification.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2MH,8BAwEC;AAUD,0CA8FC;AAzXD,6CAA+B;AAC/B,+DAAgE;AAChE,+DAAqD;AACrD,6DAAuD;AAEvD,iEASgC;AAChC,mEAAuG;AAWvG;;;GAGG;AACH,MAAa,6BAA8B,SAAQ,KAAK;IACvD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC7C,CAAC;CACD;AALD,sEAKC;AACD,yFAAmF;AAEnF,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,kBAAkB,CAAC,CAAC;AAEjD,gFAAgF;AAChF,IAAI,cAAiE,CAAC;AACtE,SAAS,wBAAwB;IAChC,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,cAAc,GAAG,IAAA,+CAA8B,GAAE,CAAC;QAClD,oFAAoF;QACnF,cAAsB,CAAC,WAAW,CAAC,gEAA6B,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,+BAAgC,SAAQ,sBAAQ;IACrD,KAAK,CAAC,GAAG,CAAC,EAAU;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAA2C,CAAC;QAC3E,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;QAE/C,IAAI,CAAC,cAAc,EAAE,iBAAiB,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAE9E,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAE1F,wFAAwF;YACxF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC;YACrC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAEpD,OAAO;gBACN,GAAG,MAAM;gBACT,SAAS;aACT,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,EAAE,CAAC,wBAAwB,iBAAiB,MAAM,KAAK,EAAE,CAAC,CAAC;YAEvE,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;gBACpD,MAAM,KAAK,CAAC;YACb,CAAC;YAED,qBAAqB;YACrB,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;gBAC1C,sCAAsC;gBACtC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,uCAAe,CAAC;gBAE/C,OAAO;oBACN,MAAM,EAAE,EAAE;oBACV,kBAAkB,EAAE,iBAAiB;oBACrC,SAAS,EAAE,SAAS;oBACpB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;oBACvB,WAAW,EAAE,SAAS;oBACtB,eAAe,EAAE,KAAK;oBACtB,SAAS;iBACT,CAAC;YACH,CAAC;YAED,uCAAuC;YACvC,MAAM,CAAC,IAAI,EAAE,CAAC,gDAAgD,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;CACD;AAED,0BAA0B;AAC1B,IAAI,aAAuC,CAAC;AAC5C,IAAI,uBAAiD,CAAC;AAEtD,SAAS,gBAAgB;IACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,aAAa,GAAG,IAAA,oBAAK,EAAC;YACrB,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE;gBACX;oBACC,IAAI,EAAE,oBAAoB;oBAC1B,YAAY,EAAE,IAAI;iBAClB;gBACD;oBACC,IAAI,EAAE,WAAW;iBACjB;gBACD;oBACC,IAAI,EAAE,UAAU;iBAChB;gBACD;oBACC,IAAI,EAAE,aAAa;iBACnB;gBACD;oBACC,IAAI,EAAE,aAAa;iBACnB;gBACD;oBACC,IAAI,EAAE,iBAAiB;iBACvB;gBACD;oBACC,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,IAAI;iBACb;aACD;SACD,CAAC,CAAC;QAEH,+BAA+B;QAC9B,aAAqB,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,SAAS,0BAA0B;IAClC,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC9B,uBAAuB,GAAG,IAAA,oBAAK,EAAC;YAC/B,KAAK,EAAE,0BAA0B;YACjC,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE;gBACX;oBACC,IAAI,EAAE,cAAc;oBACpB,YAAY,EAAE,IAAI;iBAClB;gBACD;oBACC,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,IAAI;iBACb;gBACD;oBACC,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,IAAI;iBACb;gBACD;oBACC,IAAI,EAAE,iBAAiB;iBACvB;gBACD;oBACC,IAAI,EAAE,mBAAmB;iBACzB;gBACD;oBACC,IAAI,EAAE,YAAY;oBAClB,OAAO,EAAE,IAAI,EAAE,qBAAqB;iBACpC;gBACD;oBACC,IAAI,EAAE,iBAAiB;iBACvB;gBACD;oBACC,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,IAAI;iBACb;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,uBAAuB,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,SAAS,CAC9B,OAAe,EACf,SAAiB,EACjB,MAAkB,EAClB,OAAkB;IAElB,wCAAwC;IACxC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,CAAC;QACJ,uEAAuE;QACvE,oFAAoF;QACpF,MAAM,UAAU,GAAG,IAAA,kCAAW,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,IAAA,kCAAW,EAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAE3D,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,OAAO,IAAI,IAAA,mDAA4B,EAAC,UAAU,CAAC,CAAC;QAE/E,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC7E,CAAC;QAED,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAA,qCAAc,EAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QAEjE,mGAAmG;QACnG,MAAM,UAAU,GAAG,MAAO,wBAAwB,EAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE;YACrF,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,YAAY;YACvB,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,6CAA6C;YACvF,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE;SACtB,CAAC,CAAC;QAEV,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,wFAAwF;YACxF,MAAM,CAAC,KAAK,EAAE,CAAC,yEAAyE,CAAC,CAAC;YAC1F,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACtF,CAAC;YAED,MAAM,CAAC,IAAI,EAAE,CAAC,8DAA8D,CAAC,CAAC;YAC9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,MAAM,GAAG,UAA8C,CAAC;QAC9D,MAAM,mBAAmB,GAAI,UAAkB,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,CAAC;QAE5F,OAAO;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,MAAM;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,CAAC,mBAAmB;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,KAAK;SAC9B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAEnD,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;YACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC;QAED,qBAAqB;QACrB,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC;QAED,6CAA6C;QAC7C,MAAM,CAAC,IAAI,EAAE,CAAC,wDAAwD,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,eAAe,CACpC,OAAe,EACf,SAAiB,EACjB,MAAiB,EACjB,OAAkB;IAElB,iFAAiF;IACjF,MAAM,kBAAkB,GAAG,OAAO,IAAI,IAAA,mDAA4B,EAAC,OAAO,CAAC,CAAC;IAE5E,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,6CAA6C;IAC7C,MAAM,YAAY,GAAG,IAAA,0CAAmB,EAAC,OAAO,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAA,yCAAkB,EAAC,SAAS,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAA,iDAA0B,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAE1E,IAAI,CAAC;QACJ,qCAAqC;QACrC,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAElD,8CAA8C;QAC9C,MAAM,YAAY,GAAG,MAAO,YAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAElE,IAAI,YAAY,EAAE,CAAC;YAClB,oEAAoE;YACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,MAAM,KAAK,GAAG,YAAmB,CAAC;YAClC,IAAI,KAAK,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;gBACjC,qBAAqB;gBACrB,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,aAAa;oBAChD,MAAM,EAAE,KAAK,CAAC,UAAU;iBACxB,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;gBAC7D,yCAAyC;gBACzC,MAAM,CAAC,IAAI,EAAE,CAAC,4CAA4C,CAAC,CAAC;gBAC5D,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,aAAa;oBAChD,MAAM,EAAE,KAAK,CAAC,UAAU;iBACxB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,mCAAmC;gBACnC,MAAM,CAAC,IAAI,EAAE,CAAC,0CAA0C,CAAC,CAAC;gBAC1D,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,aAAa;iBACrB,CAAC;YACH,CAAC;QACF,CAAC;QAED,+EAA+E;QAC/E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAEjF,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,gFAAgF;YAChF,yEAAyE;YACzE,MAAM,iBAAiB,GAAG,MAAO,YAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,iBAAiB,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,iBAAwB,CAAC;gBACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,IAAI,KAAK,CAAC,eAAe,GAAG,GAAG,IAAI,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBACrF,OAAO;wBACN,MAAM,EAAE,SAAS;wBACjB,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,aAAa;wBAChD,MAAM,EAAE,KAAK,CAAC,UAAU;qBACxB,CAAC;gBACH,CAAC;YACF,CAAC;YACD,kDAAkD;YAClD,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,SAAS,CAAC,MAAM;aACxB,CAAC;QACH,CAAC;aAAM,CAAC;YACP,+BAA+B;YAC/B,MAAM,CAAC,IAAI,EAAE,CAAC,mDAAmD,CAAC,CAAC;YACnE,OAAO;gBACN,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,iBAAiB;aAC7C,CAAC;QACH,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;QAC7C,OAAO;YACN,MAAM,EAAE,SAAS;YACjB,MAAM,EAAG,KAAe,CAAC,OAAO;SAChC,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC/B,kBAA4B,EAC5B,SAAiB,EACjB,MAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,gCAAgC;IAChC,KAAK,MAAM,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;QACpD,IAAI,CAAC;YACJ,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;YACpC,IAAI,OAAO,GAAyB,IAAI,CAAC;YACzC,IAAI,SAAS,GAAyB,IAAI,CAAC;YAE3C,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAO,QAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC9D,SAAS,GAAG,MAAkC,CAAC;gBAC/C,IAAI,SAAS,IAAI,SAAS,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBAC9C,OAAO,GAAG,SAAS,CAAC;gBACrB,CAAC;qBAAM,IAAI,SAAS,IAAI,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBAC1E,OAAO,GAAG,SAAS,CAAC;gBACrB,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,kCAAkC;YACnC,CAAC;YAED,mDAAmD;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YAED,0BAA0B;YAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;YACtC,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;gBACrB,iEAAiE;gBACjE,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACJ,MAAO,QAAgB,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;oBACzD,CAAC;oBAAC,MAAM,CAAC;wBACR,uCAAuC;oBACxC,CAAC;gBACF,CAAC;gBAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACtD,CAAC;iBAAM,IAAI,SAAS,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;gBACjD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACnD,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,kFAAkF;YAClF,+DAA+D;YAC/D,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;gBACpD,MAAM,KAAK,CAAC;YACb,CAAC;YACD,8FAA8F;QAC/F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CACjC,iBAAyB,EACzB,YAAoB,EACpB,OAAe;IAEf,mBAAmB;IACnB,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAEhE,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC/C,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACR,YAAY,EAAE,sCAAc;aAC5B;SACD,CAAC,CAAC;QAEH,YAAY,CAAC,SAAS,CAAC,CAAC;QAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5D,2DAA2D;QAC3D,IAAI,YAAoB,CAAC;QACzB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAClD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,kCAAW,EAAC,OAAO,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACP,YAAY,GAAG,SAAS,CAAC;QAC1B,CAAC;QAED,6BAA6B;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,OAAO,CAAC,YAAmB,CAAC,CAAC;QAEzE,uBAAuB;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,IAAA,kCAAW,EAAC,YAAY,CAAC,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC;QAE3E,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,mGAAmG;YACnG,0GAA0G;YAC1G,MAAM,GAAG,GAAG,0CAA0C,iBAAiB,EAAE,CAAC;YAC1E,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QAED,6BAA6B;QAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,UAAU,GAAG,mDAA2B,CAAC;QAE/F,oBAAoB;QACpB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEnH,MAAM,UAAU,GAAkB;YACjC,kBAAkB,EAAE,iBAAiB;YACrC,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,UAAU;YACvB,eAAe,EAAE,cAAc;YAC/B,SAAS,EAAE,UAAU;SACrB,CAAC;QAEF,kFAAkF;QAClF,kDAAkD;QAClD,MAAM,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAEnF,OAAO,UAAU,CAAC;IACnB,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,0BAA0B,CACxC,GAAoC,EACpC,YAAoB,EACpB,iBAAyB,EACzB,UAAkB;IAElB,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;IAClD,MAAM,WAAW,GAAG,IAAA,yCAAkB,EAAC,YAAY,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IAEnC,iEAAiE;IACjE,sFAAsF;IACtF,IAAI,CAAC;QACJ,MAAM,uBAAuB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,EAAE,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;QAChE,sEAAsE;IACvE,CAAC;IAED,+BAA+B;IAC/B,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC7B,KAAK,MAAM,WAAW,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACnD,IAAI,CAAC;gBACJ,qFAAqF;gBACrF,+DAA+D;gBAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC;gBAEtE,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,MAAM,CAAC,IAAI,EAAE,CAAC,0DAA0D,CAAC,CAAC;oBAC1E,SAAS;gBACV,CAAC;gBAED,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;qBACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;qBAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;gBAEX,MAAM,WAAW,GAAG,IAAA,iDAA0B,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;gBAE1E,0BAA0B;gBAC1B,MAAM,cAAc,GAAG,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAElE,sEAAsE;gBACtE,MAAM,gBAAgB,GAAG,aAAa,CAAC;gBAEvC,MAAM,KAAK,GAA4B;oBACtC,YAAY,EAAE,WAAW;oBACzB,aAAa,EAAE,YAAY;oBAC3B,aAAa,EAAE,WAAW;oBAC1B,eAAe,EAAE,cAAc;oBAC/B,iBAAiB,EAAE,gBAAgB;oBACnC,UAAU,EAAE,QAAQ;oBACpB,eAAe,EAAE,UAAU;oBAC3B,SAAS,EAAE,UAAU;iBACrB,CAAC;gBAEF,MAAO,YAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,EAAE,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;gBACjE,mCAAmC;YACpC,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CACrC,YAA2D,EAC3D,SAAiB;IAEjB,wFAAwF;IACxF,IAAI,CAAC;QACJ,iEAAiE;QACjE,mEAAmE;QACnE,MAAM,eAAe,GAAI,YAAoB,CAAC,MAAM,CAAC;YACpD;gBACC,SAAS,EAAE,YAAY;gBACvB,KAAK,EAAE,SAAS;aAChB;SACD,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACJ,MAAO,YAAoB,CAAC,MAAM,CAAE,KAAa,CAAC,YAAY,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,EAAE,CAAC,+CAA+C,WAAW,EAAE,CAAC,CAAC;gBAC5E,8BAA8B;YAC/B,CAAC;QACF,CAAC;IACF,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,EAAE,CAAC,8CAA8C,WAAW,EAAE,CAAC,CAAC;QAC5E,MAAM,WAAW,CAAC;IACnB,CAAC;AACF,CAAC"}
+{"version":3,"file":"crlVerification.js","sourceRoot":"","sources":["../../../security/certificateVerification/crlVerification.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmIH,8BAwEC;AAUD,0CAoGC;AAvTD,6CAA+B;AAC/B,+DAAgE;AAChE,6DAAuD;AACvD,mEAA6D;AAE7D,iEASgC;AAChC,mEAAgG;AAChG,mEAAuG;AAWvG;;;GAGG;AACH,MAAa,6BAA8B,SAAQ,KAAK;IACvD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC7C,CAAC;CACD;AALD,sEAKC;AACD,yFAAmF;AAEnF,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,kBAAkB,CAAC,CAAC;AAEjD,gFAAgF;AAChF,IAAI,cAAiE,CAAC;AACtE,SAAS,wBAAwB;IAChC,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,cAAc,GAAG,IAAA,+CAA8B,GAAE,CAAC;QAClD,oFAAoF;QACnF,cAAsB,CAAC,WAAW,CAAC,gEAA6B,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,+BAAgC,SAAQ,sBAAQ;IACrD,KAAK,CAAC,GAAG,CAAC,EAAU;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAA2C,CAAC;QAC3E,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;QAE/C,IAAI,CAAC,cAAc,EAAE,iBAAiB,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAE9E,IAAI,CAAC;YACJ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YAEzF,wFAAwF;YACxF,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE9E,OAAO,KAAK,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,EAAE,CAAC,wBAAwB,iBAAiB,MAAM,KAAK,EAAE,CAAC,CAAC;YAEvE,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;gBACpD,MAAM,KAAK,CAAC;YACb,CAAC;YAED,qBAAqB;YACrB,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;gBAC1C,sCAAsC;gBACtC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,uCAAe,CAAC;gBAEjD,OAAO;oBACN,MAAM,EAAE,EAAE;oBACV,kBAAkB,EAAE,iBAAiB;oBACrC,SAAS,EAAE,SAAS;oBACpB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;oBACvB,WAAW,EAAE,OAAO,CAAC,SAAS;oBAC9B,eAAe,EAAE,KAAK;iBACtB,CAAC;YACH,CAAC;YAED,uCAAuC;YACvC,MAAM,CAAC,IAAI,EAAE,CAAC,gDAAgD,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;CACD;AAED,0BAA0B;AAC1B,IAAI,aAAsD,CAAC;AAC3D,IAAI,uBAA2E,CAAC;AAEhF,SAAS,gBAAgB;IACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,aAAa,GAAG,IAAA,4CAAoB,GAAE,CAAC;QACvC,+BAA+B;QAC9B,aAAqB,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,SAAS,0BAA0B;IAClC,uBAAuB,KAAK,IAAA,uDAA+B,GAAE,CAAC;IAC9D,OAAO,uBAAuB,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,SAAS,CAC9B,OAAe,EACf,SAAiB,EACjB,MAAkB,EAClB,OAAkB;IAElB,wCAAwC;IACxC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,CAAC;QACJ,uEAAuE;QACvE,oFAAoF;QACpF,MAAM,UAAU,GAAG,IAAA,kCAAW,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,IAAA,kCAAW,EAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAE3D,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,OAAO,IAAI,IAAA,mDAA4B,EAAC,UAAU,CAAC,CAAC;QAE/E,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC7E,CAAC;QAED,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAA,qCAAc,EAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QAEjE,mGAAmG;QACnG,MAAM,UAAU,GAAG,MAAO,wBAAwB,EAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE;YACrF,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,YAAY;YACvB,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,6CAA6C;YACvF,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE;SACtB,CAAC,CAAC;QAEV,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,wFAAwF;YACxF,MAAM,CAAC,KAAK,EAAE,CAAC,yEAAyE,CAAC,CAAC;YAC1F,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACtF,CAAC;YAED,MAAM,CAAC,IAAI,EAAE,CAAC,8DAA8D,CAAC,CAAC;YAC9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,MAAM,GAAG,UAA8C,CAAC;QAC9D,MAAM,mBAAmB,GAAI,UAAkB,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,CAAC;QAE5F,OAAO;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,MAAM;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,CAAC,mBAAmB;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,KAAK;SAC9B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAEnD,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;YACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC;QAED,qBAAqB;QACrB,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC;QAED,6CAA6C;QAC7C,MAAM,CAAC,IAAI,EAAE,CAAC,wDAAwD,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,eAAe,CACpC,OAAe,EACf,SAAiB,EACjB,MAAiB,EACjB,OAAkB;IAElB,iFAAiF;IACjF,MAAM,kBAAkB,GAAG,OAAO,IAAI,IAAA,mDAA4B,EAAC,OAAO,CAAC,CAAC;IAE5E,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,6CAA6C;IAC7C,MAAM,YAAY,GAAG,IAAA,0CAAmB,EAAC,OAAO,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAA,yCAAkB,EAAC,SAAS,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAA,iDAA0B,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAE1E,IAAI,CAAC;QACJ,qCAAqC;QACrC,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAElD,8CAA8C;QAC9C,MAAM,YAAY,GAAG,MAAO,YAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAElE,IAAI,YAAY,EAAE,CAAC;YAClB,oEAAoE;YACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,MAAM,KAAK,GAAG,YAAmB,CAAC;YAClC,IAAI,KAAK,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;gBACjC,qBAAqB;gBACrB,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,aAAa;oBAChD,MAAM,EAAE,KAAK,CAAC,UAAU;iBACxB,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;gBAC7D,yCAAyC;gBACzC,MAAM,CAAC,IAAI,EAAE,CAAC,4CAA4C,CAAC,CAAC;gBAC5D,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,aAAa;oBAChD,MAAM,EAAE,KAAK,CAAC,UAAU;iBACxB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,mCAAmC;gBACnC,MAAM,CAAC,IAAI,EAAE,CAAC,0CAA0C,CAAC,CAAC;gBAC1D,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,aAAa;iBACrB,CAAC;YACH,CAAC;QACF,CAAC;QAED,+EAA+E;QAC/E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAEjF,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,sGAAsG;YACtG,qCAAqC;YACrC,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;gBAC1B,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;oBAC3C,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;oBACxE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;YACjD,CAAC;YACD,kGAAkG;YAClG,MAAM,iBAAiB,GAAG,MAAO,YAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3E,IAAI,iBAAiB,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,iBAAwB,CAAC;gBACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,IAAI,KAAK,CAAC,eAAe,GAAG,GAAG,IAAI,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBACrF,OAAO;wBACN,MAAM,EAAE,SAAS;wBACjB,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,aAAa;wBAChD,MAAM,EAAE,KAAK,CAAC,UAAU;qBACxB,CAAC;gBACH,CAAC;YACF,CAAC;YACD,kDAAkD;YAClD,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,SAAS,CAAC,MAAM;aACxB,CAAC;QACH,CAAC;aAAM,CAAC;YACP,+BAA+B;YAC/B,MAAM,CAAC,IAAI,EAAE,CAAC,mDAAmD,CAAC,CAAC;YACnE,OAAO;gBACN,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,iBAAiB;aAC7C,CAAC;QACH,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;QAC7C,OAAO;YACN,MAAM,EAAE,SAAS;YACjB,MAAM,EAAG,KAAe,CAAC,OAAO;SAChC,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC/B,kBAA4B,EAC5B,SAAiB,EACjB,MAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,gCAAgC;IAChC,KAAK,MAAM,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;QACpD,IAAI,CAAC;YACJ,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;YACpC,IAAI,OAAO,GAAyB,IAAI,CAAC;YACzC,IAAI,SAAS,GAAyB,IAAI,CAAC;YAE3C,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAO,QAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC9D,SAAS,GAAG,MAAkC,CAAC;gBAC/C,IAAI,SAAS,IAAI,SAAS,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBAC9C,OAAO,GAAG,SAAS,CAAC;gBACrB,CAAC;qBAAM,IAAI,SAAS,IAAI,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBAC1E,OAAO,GAAG,SAAS,CAAC;gBACrB,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,kCAAkC;YACnC,CAAC;YAED,mDAAmD;YACnD,IAAI,UAAmC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,uBAAuB,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YACxG,CAAC;YAED,0BAA0B;YAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;YACtC,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;gBACrB,iEAAiE;gBACjE,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACJ,MAAO,QAAgB,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;oBACnF,CAAC;oBAAC,MAAM,CAAC;wBACR,uCAAuC;oBACxC,CAAC;gBACF,CAAC;gBAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;YAClE,CAAC;iBAAM,IAAI,SAAS,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;gBACjD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACnD,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,kFAAkF;YAClF,+DAA+D;YAC/D,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;gBACpD,MAAM,KAAK,CAAC;YACb,CAAC;YACD,8FAA8F;QAC/F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;AAC3D,CAAC;AAED,6GAA6G;AAC7G,6GAA6G;AAC7G,yGAAyG;AACzG,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkC,CAAC;AAE/D,SAAS,uBAAuB,CAAC,iBAAyB,EAAE,YAAoB,EAAE,MAAiB;IAClG,MAAM,GAAG,GAAG,GAAG,iBAAiB,KAAK,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;IAC9F,IAAI,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChH,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAOD;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CACjC,iBAAyB,EACzB,YAAoB,EACpB,MAAiB;IAEjB,mBAAmB;IACnB,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvE,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC/C,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACR,YAAY,EAAE,sCAAc;aAC5B;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5D,2DAA2D;QAC3D,IAAI,YAAoB,CAAC;QACzB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAClD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,kCAAW,EAAC,OAAO,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACP,YAAY,GAAG,SAAS,CAAC;QAC1B,CAAC;QAED,6BAA6B;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,OAAO,CAAC,YAAmB,CAAC,CAAC;QAEzE,uBAAuB;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,IAAA,kCAAW,EAAC,YAAY,CAAC,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC;QAE3E,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,mGAAmG;YACnG,0GAA0G;YAC1G,MAAM,GAAG,GAAG,0CAA0C,iBAAiB,EAAE,CAAC;YAC1E,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QAED,6BAA6B;QAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,UAAU,GAAG,mDAA2B,CAAC;QAE/F,oBAAoB;QACpB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEnH,MAAM,UAAU,GAAkB;YACjC,kBAAkB,EAAE,iBAAiB;YACrC,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,UAAU;YACvB,eAAe,EAAE,cAAc;SAC/B,CAAC;QAEF,kFAAkF;QAClF,kDAAkD;QAClD,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAClD,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,UAAU,EACV,MAAM,CAAC,WAAW,IAAI,CAAC,CACvB,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,0BAA0B,CACxC,GAAoC,EACpC,YAAoB,EACpB,iBAAyB,EACzB,UAAkB,EAClB,WAAmB;IAEnB,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;IAClD,MAAM,WAAW,GAAG,IAAA,yCAAkB,EAAC,YAAY,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,yGAAyG;IACzG,yGAAyG;IACzG,kFAAkF;IAClF,MAAM,IAAA,4BAAW,EAAC,EAAE,SAAS,EAAE,UAAU,GAAG,WAAW,EAAE,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,uBAAuB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAEtD,KAAK,MAAM,WAAW,IAAI,GAAG,CAAC,mBAAmB,IAAI,EAAE,EAAE,CAAC;YACzD,qFAAqF;YACrF,+DAA+D;YAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC;YACtE,IAAI,CAAC,SAAS;gBACb,MAAM,IAAI,KAAK,CAAC,yCAAyC,iBAAiB,uBAAuB,CAAC,CAAC;YAEpG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAE5D,MAAM,KAAK,GAA4B;gBACtC,YAAY,EAAE,IAAA,iDAA0B,EAAC,WAAW,EAAE,YAAY,CAAC;gBACnE,aAAa,EAAE,YAAY;gBAC3B,aAAa,EAAE,WAAW;gBAC1B,eAAe,EAAE,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC3D,sEAAsE;gBACtE,iBAAiB,EAAE,aAAa;gBAChC,UAAU,EAAE,QAAQ;gBACpB,eAAe,EAAE,UAAU;aAC3B,CAAC;YAEF,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnC,MAAO,YAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CACrC,YAA2D,EAC3D,SAAiB;IAEjB,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAK,YAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;QACzG,YAAY,CAAC,IAAI,CAAE,KAAa,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,YAAY;QAAE,MAAO,YAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzF,CAAC"}