@iwentsourcing/core 0.1.0

package/dist/authentication/create-jwt-instance.js

@@ -0,0 +1,62 @@
+import { createLazy } from '../lazy/create-lazy.js';
+import { resolveSecret } from './resolve-secret.js';
+import { getHmacHashSize } from './jwk/get-jwk-key-algorithm.js';
+import { lazyWrap } from '../lazy/lazy-wrap.js';
+import { validateJwt } from './jwt/validate-jwt.js';
+import { strToUrlBase64 } from './jwk/base64.js';
+import { secs } from '../utils/secs.js';
+import { signJwk } from './jwk/signJwk.js';
+export function createJwtInstance(env, name, provider) {
+    const subKey = 'sub';
+    const lazyJsonKey = createLazy(async () => {
+        const encoder = env.encoder();
+        return env
+            .crypto()
+            .subtle.importKey('raw', encoder.encode(resolveSecret(env, provider.secret)), { name: 'HMAC', hash: getHmacHashSize(provider.algorithm) }, true, ['sign', 'verify']);
+    });
+    const lazyKey = lazyWrap(lazyJsonKey, async (lazyJsonKey) => {
+        const jwk = await env.crypto().subtle.exportKey('jwk', lazyJsonKey);
+        const key = {
+            use: 'sig',
+            kid: name,
+            k: jwk.k,
+            kty: 'oct',
+            alg: provider.algorithm,
+            x5t: undefined,
+        };
+        return key;
+    });
+    return {
+        type: 'jwt',
+        config: provider,
+        validate(access_token, signal) {
+            return validateJwt(env, access_token, subKey, [], () => lazyKey.resolve(), signal);
+        },
+        verify(access_token, signal) {
+            return validateJwt(env, access_token, subKey, [], () => lazyKey.resolve(), signal);
+        },
+        async create(result) {
+            const header = strToUrlBase64(JSON.stringify({ alg: provider.algorithm }));
+            const nowInSecs = Math.floor(new Date().getTime() / 1000);
+            const expiresIn = secs(provider.expirationTime);
+            const payload = strToUrlBase64(JSON.stringify({
+                iat: nowInSecs,
+                sub: result.username,
+                iss: provider.issuer,
+                aud: provider.audience,
+                exp: nowInSecs + expiresIn,
+                attributes: result.attributes,
+            }));
+            const signature = await signJwk(env, { payload, header }, await lazyKey.resolve());
+            const token = header + '.' + payload + '.' + signature;
+            return {
+                id_token: token,
+                refresh_token: result.refresh_token,
+                expires_in: expiresIn,
+                scope: 'openid',
+                username: result.username,
+            };
+        },
+    };
+}
+//# sourceMappingURL=create-jwt-instance.js.map

package/dist/authentication/create-jwt-instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-jwt-instance.js","sourceRoot":"","sources":["../../src/authentication/create-jwt-instance.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAG3C,MAAM,UAAU,iBAAiB,CAC/B,GAAe,EACf,IAAY,EACZ,QAAkB;IAElB,MAAM,MAAM,GAAG,KAAK,CAAC;IACrB,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;QACxC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,GAAG;aACP,MAAM,EAAE;aACR,MAAM,CAAC,SAAS,CACf,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,EACnD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAC3D,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;IACN,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;QAC1D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACpE,MAAM,GAAG,GAAe;YACtB,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,IAAI;YACT,CAAC,EAAE,GAAG,CAAC,CAAE;YACT,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,QAAQ,CAAC,SAAS;YACvB,GAAG,EAAE,SAAS;SACf,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,QAAQ;QAChB,QAAQ,CACN,YAAoB,EACpB,MAAmB;YAEnB,OAAO,WAAW,CAChB,GAAG,EACH,YAAY,EACZ,MAAM,EACN,EAAE,EACF,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EACvB,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,CACJ,YAAoB,EACpB,MAAmB;YAEnB,OAAO,WAAW,CAChB,GAAG,EACH,YAAY,EACZ,MAAM,EACN,EAAE,EACF,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EACvB,MAAM,CACP,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAoB;YAC/B,MAAM,MAAM,GAAG,cAAc,CAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAC5C,CAAC;YACF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,cAAc,CAC5B,IAAI,CAAC,SAAS,CAAC;gBACb,GAAG,EAAE,SAAS;gBACd,GAAG,EAAE,MAAM,CAAC,QAAQ;gBACpB,GAAG,EAAE,QAAQ,CAAC,MAAM;gBACpB,GAAG,EAAE,QAAQ,CAAC,QAAQ;gBACtB,GAAG,EAAE,SAAS,GAAG,SAAS;gBAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CACH,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,GAAG,EACH,EAAE,OAAO,EAAE,MAAM,EAAE,EACnB,MAAM,OAAO,CAAC,OAAO,EAAE,CACxB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,GAAG,GAAG,SAAS,CAAC;YAEvD,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,UAAU,EAAE,SAAS;gBACrB,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authentication/create-open-id-instance.d.ts

@@ -0,0 +1,6 @@
+import { RuntimeEnv } from '../environment/runtime-env.js';
+import { OpenIDProvider } from './open-id-provider.js';
+import { OpenIdKeyStoreInstance } from './keystore/open-id-key-store-instance.js';
+export declare function createOpenIdInstance(env: RuntimeEnv, name: string, provider: OpenIDProvider): OpenIdKeyStoreInstance;
+export declare function parseTokenAttributes(token: string, attributeKeys: string[]): Record<string, string>;
+export declare function parseAttributes(token: unknown, attributeKeys: string[]): Record<string, string>;

package/dist/authentication/create-open-id-instance.js

@@ -0,0 +1,68 @@
+import { createJwkStore } from './jwk/create-jwk-store.js';
+import { createJwtInstance } from './create-jwt-instance.js';
+import { JwtPayload } from './jwt/jwt-payload.js';
+import { validateJwt } from './jwt/validate-jwt.js';
+import { validate } from '../typing/validate.js';
+import { AuthTokenResponse } from './oauth/auth-token-response.js';
+import { parseJwt } from './jwt/parse-jwt.js';
+import { record } from '../typing/record.js';
+import { string } from '../typing/string.js';
+import { StateValue } from '../storage/state-value.js';
+import { assert } from '../typing/assert.js';
+export function createOpenIdInstance(env, name, provider) {
+    const store = createJwkStore(provider.jwks.url);
+    const jwt = createJwtInstance(env, name, provider.jwt);
+    return {
+        config: provider,
+        type: 'openid',
+        validate(access_token, signal) {
+            return validateJwt(env, access_token, provider.jwks.subKey, provider.token?.tokenAttributes ?? [], (header, signal) => store.get(header, signal), signal);
+        },
+        verify(access_token, signal) {
+            return jwt.verify(access_token, signal);
+        },
+        create(result, signal) {
+            return jwt.create(result, signal);
+        },
+        parseTokenResult(authResult) {
+            const [err, validatedResult] = validate(authResult, AuthTokenResponse);
+            if (err) {
+                throw err;
+            }
+            const payload = parseJwt(validatedResult.id_token, 1, JwtPayload);
+            return Promise.resolve({
+                payload,
+                token: {
+                    id_token: validatedResult.id_token,
+                    refresh_token: validatedResult.refresh_token,
+                },
+                attributes: parseTokenAttributes(validatedResult.id_token, provider.token?.tokenAttributes ?? []),
+            });
+        },
+    };
+}
+export function parseTokenAttributes(token, attributeKeys) {
+    const payload = parseJwt(token, 1, record(string(), StateValue));
+    return Object.entries(payload)
+        .filter(([key]) => attributeKeys.indexOf(key) >= 0)
+        .reduce((map, [key, value]) => {
+        const [, result] = validate(value, string());
+        if (result) {
+            map[key] = result;
+        }
+        return map;
+    }, {});
+}
+export function parseAttributes(token, attributeKeys) {
+    assert(token, record(string(), StateValue));
+    return Object.entries(token)
+        .filter(([key]) => attributeKeys.indexOf(key) >= 0)
+        .reduce((map, [key, value]) => {
+        const [, result] = validate(value, string());
+        if (result) {
+            map[key] = result;
+        }
+        return map;
+    }, {});
+}
+//# sourceMappingURL=create-open-id-instance.js.map

package/dist/authentication/create-open-id-instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-open-id-instance.js","sourceRoot":"","sources":["../../src/authentication/create-open-id-instance.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIpD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,UAAU,oBAAoB,CAClC,GAAe,EACf,IAAY,EACZ,QAAwB;IAExB,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,CACN,YAAoB,EACpB,MAAmB;YAEnB,OAAO,WAAW,CAChB,GAAG,EACH,YAAY,EACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,EACpB,QAAQ,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,EACrC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7C,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,CACJ,YAAoB,EACpB,MAAmB;YAEnB,OAAO,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,MAAoB,EAAE,MAAmB;YAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,gBAAgB,CAAC,UAAmB;YAClC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;YAEvE,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;YAElE,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,OAAO;gBACP,KAAK,EAAE;oBACL,QAAQ,EAAE,eAAe,CAAC,QAAQ;oBAClC,aAAa,EAAE,eAAe,CAAC,aAAa;iBAC7C;gBACD,UAAU,EAAE,oBAAoB,CAC9B,eAAe,CAAC,QAAQ,EACxB,QAAQ,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,CACtC;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,aAAuB;IACzE,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAEjE,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAClD,MAAM,CAAyB,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACpD,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,aAAuB;IACrE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAE5C,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAClD,MAAM,CAAyB,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACpD,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC,CAAC;AACX,CAAC"}

package/dist/authentication/create-token-instance.d.ts

@@ -0,0 +1,4 @@
+import { RuntimeEnv } from '../environment/runtime-env.js';
+import { TokenProvider } from './token-provider.js';
+import { TokenStoreInstance } from './keystore/token-store-instance.js';
+export declare function createTokenInstance(env: RuntimeEnv, name: string, provider: TokenProvider): TokenStoreInstance;

package/dist/authentication/create-token-instance.js

@@ -0,0 +1,69 @@
+import { string } from '../typing/string.js';
+import { createJwtInstance } from './create-jwt-instance.js';
+import { assert } from '../typing/assert.js';
+import { object } from '../typing/object.js';
+import { validate } from '../typing/validate.js';
+import { parseAttributes, parseTokenAttributes, } from './create-open-id-instance.js';
+export function createTokenInstance(env, name, provider) {
+    const jwt = createJwtInstance(env, name, provider.jwt);
+    async function validateToken(access_token, signal) {
+        const userResponse = await fetch(provider.user.url, {
+            headers: {
+                Authorization: `Bearer ${access_token}`,
+            },
+            signal,
+        });
+        if (!userResponse.ok) {
+            return null;
+        }
+        const user = await userResponse.json();
+        assert(user, object('User', {
+            login: string(),
+        }));
+        const tokenAttributes = provider.token?.tokenAttributes ?? [];
+        return {
+            payload: {
+                sub: user.login,
+                iss: provider.issuer,
+                aud: name,
+            },
+            attributes: {
+                ...(tokenAttributes.length > 0
+                    ? parseTokenAttributes(access_token, tokenAttributes)
+                    : {}),
+                ...parseAttributes(user, provider.user.tokenAttributes ?? []),
+            },
+        };
+    }
+    return {
+        create(result, signal) {
+            return jwt.create(result, signal);
+        },
+        validate: validateToken,
+        verify(access_token, signal) {
+            return jwt.verify(access_token, signal);
+        },
+        async parseTokenResult(authResult, signal) {
+            const [err, validatedResult] = validate(authResult, object('TokenResult', {
+                access_token: string(),
+                scope: string(),
+                token_type: string(),
+            }));
+            if (err) {
+                throw err;
+            }
+            const payload = await validateToken(validatedResult.access_token, signal);
+            if (!payload) {
+                return null;
+            }
+            return {
+                payload: payload.payload,
+                token: null,
+                attributes: payload.attributes,
+            };
+        },
+        type: 'token',
+        config: provider,
+    };
+}
+//# sourceMappingURL=create-token-instance.js.map

package/dist/authentication/create-token-instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-token-instance.js","sourceRoot":"","sources":["../../src/authentication/create-token-instance.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAI7C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAGtC,MAAM,UAAU,mBAAmB,CACjC,GAAe,EACf,IAAY,EACZ,QAAuB;IAEvB,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEvD,KAAK,UAAU,aAAa,CAC1B,YAAoB,EACpB,MAAmB;QAEnB,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE;YAClD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,YAAY,EAAE;aACxC;YACD,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAEvC,MAAM,CACJ,IAAI,EACJ,MAAM,CAAC,MAAM,EAAE;YACb,KAAK,EAAE,MAAM,EAAE;SAChB,CAAC,CACH,CAAC;QAEF,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,CAAC;QAE9D,OAAO;YACL,OAAO,EAAE;gBACP,GAAG,EAAE,IAAI,CAAC,KAAK;gBACf,GAAG,EAAE,QAAQ,CAAC,MAAM;gBACpB,GAAG,EAAE,IAAI;aACV;YACD,UAAU,EAAE;gBACV,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;oBAC5B,CAAC,CAAC,oBAAoB,CAAC,YAAY,EAAE,eAAe,CAAC;oBACrD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;aAC9D;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,CAAC,MAAoB,EAAE,MAAmB;YAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,QAAQ,EAAE,aAAa;QACvB,MAAM,CACJ,YAAoB,EACpB,MAAmB;YAEnB,OAAO,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,UAAmB,EACnB,MAAmB;YAEnB,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,QAAQ,CACrC,UAAU,EACV,MAAM,CAAC,aAAa,EAAE;gBACpB,YAAY,EAAE,MAAM,EAAE;gBACtB,KAAK,EAAE,MAAM,EAAE;gBACf,UAAU,EAAE,MAAM,EAAE;aACrB,CAAC,CACH,CAAC;YAEF,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC"}

package/dist/authentication/get-auth-id.d.ts

@@ -0,0 +1,3 @@
+import { EventAuth } from '../event-store/event-auth.js';
+import { RuntimeEnv } from '../environment/runtime-env.js';
+export declare function getAuthId(env: RuntimeEnv, auth: EventAuth): Promise<string>;

package/dist/authentication/get-auth-id.js

@@ -0,0 +1,5 @@
+import { sha1 } from './sha1.js';
+export function getAuthId(env, auth) {
+    return sha1(env, `${auth.iss}:${auth.aud}:${auth.sub}`);
+}
+//# sourceMappingURL=get-auth-id.js.map

package/dist/authentication/get-auth-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-auth-id.js","sourceRoot":"","sources":["../../src/authentication/get-auth-id.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,IAAe;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC1D,CAAC"}

package/dist/authentication/jwk/base64.d.ts

@@ -0,0 +1,6 @@
+export declare function base64ToUint8Array(base64Contents: string): Uint8Array;
+export declare function stringToUint8Array(contents: string): Uint8Array;
+export declare function strToUrlBase64(str: string): string;
+export declare function binToUrlBase64(bin: string): string;
+export declare function utf8ToBinaryString(str: string): string;
+export declare function uint8ToUrlBase64(uint8: Uint8Array): string;

package/dist/authentication/jwk/base64.js

@@ -0,0 +1,55 @@
+export function base64ToUint8Array(base64Contents) {
+    // RFC 4648
+    base64Contents = base64Contents
+        .replace(/-/g, '+')
+        .replace(/_/g, '/')
+        .replace(/\s/g, '');
+    const content = atob(base64Contents);
+    return new Uint8Array(content.split('').map((c) => c.charCodeAt(0)));
+}
+export function stringToUint8Array(contents) {
+    const encoded = btoa(unescape(encodeURIComponent(contents)));
+    return base64ToUint8Array(encoded);
+}
+// String (UCS-2) to Uint8Array
+//
+// because... JavaScript, Strings, and Buffers
+// export function strToUint8(str: string) {
+//   return new TextEncoder().encode(str);
+// }
+// UCS-2 String to URL-Safe Base64
+//
+// btoa doesn't work on UTF-8 strings
+export function strToUrlBase64(str) {
+    return binToUrlBase64(utf8ToBinaryString(str));
+}
+// Binary String to URL-Safe Base64
+//
+// btoa (Binary-to-Ascii) means "binary string" to base64
+export function binToUrlBase64(bin) {
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+/g, '');
+}
+// UTF-8 to Binary String
+//
+// Because JavaScript has a strange relationship with strings
+// https://coolaj86.com/articles/base64-unicode-utf-8-javascript-and-you/
+export function utf8ToBinaryString(str) {
+    const escstr = encodeURIComponent(str);
+    // replaces any uri escape sequence, such as %0A,
+    // with binary escape, such as 0x0A
+    const binstr = escstr.replace(/%([0-9A-F]{2})/g, function (match, p1) {
+        return String.fromCharCode(parseInt(p1, 16));
+    });
+    return binstr;
+}
+// Uint8Array to URL Safe Base64
+//
+// the shortest distant between two encodings... binary string
+export function uint8ToUrlBase64(uint8) {
+    let bin = '';
+    uint8.forEach(function (code) {
+        bin += String.fromCharCode(code);
+    });
+    return binToUrlBase64(bin);
+}
+//# sourceMappingURL=base64.js.map

package/dist/authentication/jwk/base64.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.js","sourceRoot":"","sources":["../../../src/authentication/jwk/base64.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,kBAAkB,CAAC,cAAsB;IACvD,WAAW;IACX,cAAc,GAAG,cAAc;SAC5B,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACrC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,+BAA+B;AAC/B,EAAE;AACF,8CAA8C;AAC9C,4CAA4C;AAC5C,0CAA0C;AAC1C,IAAI;AAEJ,kCAAkC;AAClC,EAAE;AACF,qCAAqC;AACrC,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,mCAAmC;AACnC,EAAE;AACF,yDAAyD;AACzD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,yBAAyB;AACzB,EAAE;AACF,6DAA6D;AAC7D,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,iDAAiD;IACjD,mCAAmC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,UAAU,KAAK,EAAE,EAAE;QAClE,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gCAAgC;AAChC,EAAE;AACF,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI;QAC1B,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/authentication/jwk/create-jwk-store.d.ts

@@ -0,0 +1,7 @@
+import { JwkKey } from './jwk-key.js';
+export declare function createJwkStore(url: string): {
+    get(header: {
+        kid: string | undefined;
+        x5t: string | undefined;
+    }, signal: AbortSignal): Promise<JwkKey>;
+};

package/dist/authentication/jwk/create-jwk-store.js

@@ -0,0 +1,73 @@
+import { JwkResponse } from './jwk-response.js';
+import { validate } from '../../typing/validate.js';
+import { CustomError } from '../../error/custom-error.js';
+import { reusableResolvable } from '../../utils/reusable-resolvable.js';
+import { getErrorMessage } from '../../runtime/get-error-message.js';
+export function createJwkStore(url) {
+    const keysByKid = {};
+    const keysByX5t = {};
+    let defaultKey = null;
+    const reusableFetch = reusableResolvable();
+    function resolveKey(header) {
+        if (header.kid) {
+            const key = keysByKid[header.kid];
+            if (key) {
+                return key;
+            }
+        }
+        if (header.x5t) {
+            const key = keysByX5t[header.x5t];
+            if (key) {
+                return key;
+            }
+        }
+        return null;
+    }
+    return {
+        async get(header, signal) {
+            const existingKey = resolveKey(header);
+            if (existingKey) {
+                return existingKey;
+            }
+            await reusableFetch.resolve(async () => {
+                const res = await fetch(url, {
+                    signal,
+                    method: 'GET',
+                });
+                if (!res.ok) {
+                    throw new CustomError('invalid jwk response', {
+                        statusCode: res.status.toString(),
+                        statusText: res.statusText,
+                    });
+                }
+                const body = await res.json();
+                const [err, response] = validate(body, JwkResponse);
+                if (err) {
+                    throw new CustomError('invalid jwk response', {
+                        statusCode: res.status.toString(),
+                        statusText: res.statusText,
+                        validateError: getErrorMessage(err),
+                    });
+                }
+                for (const key of response.keys) {
+                    if (!!key.kid && !keysByKid[key.kid]) {
+                        keysByKid[key.kid] = key;
+                    }
+                    if (!!key.x5t && !keysByKid[key.x5t]) {
+                        keysByX5t[key.x5t] = key;
+                    }
+                }
+                defaultKey = response.keys[0] ?? null;
+            });
+            const newKey = resolveKey(header);
+            if (newKey) {
+                return newKey;
+            }
+            if (defaultKey) {
+                return defaultKey;
+            }
+            throw new CustomError('missing keys', {});
+        },
+    };
+}
+//# sourceMappingURL=create-jwk-store.js.map

package/dist/authentication/jwk/create-jwk-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-jwk-store.js","sourceRoot":"","sources":["../../../src/authentication/jwk/create-jwk-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,MAAM,aAAa,GAAG,kBAAkB,EAAQ,CAAC;IAEjD,SAAS,UAAU,CAAC,MAGnB;QACC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CACP,MAA4D,EAC5D,MAAmB;YAEnB,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;gBACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAC3B,MAAM;oBACN,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;gBAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE;wBAC5C,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;wBACjC,UAAU,EAAE,GAAG,CAAC,UAAU;qBAC3B,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACpD,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE;wBAC5C,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;wBACjC,UAAU,EAAE,GAAG,CAAC,UAAU;wBAC1B,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC;qBACpC,CAAC,CAAC;gBACL,CAAC;gBAED,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAChC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACrC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;oBAC3B,CAAC;oBACD,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACrC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;oBAC3B,CAAC;gBACH,CAAC;gBAED,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YACxC,CAAC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authentication/jwk/get-jwk-key-algorithm.d.ts

@@ -0,0 +1,18 @@
+import { JwkHmacKey, JwkKey } from './jwk-key.js';
+import { JsonWebKey } from 'crypto';
+export declare function getJwkSignKey(jwk: JwkKey): JsonWebKey;
+export declare function getJwkVerifyKey(jwk: JwkKey): JsonWebKey;
+export declare function getJwkKeyAlgorithm(jwk: JwkKey): {
+    name: string;
+    hash: {
+        name: string;
+    };
+    namedCurve?: undefined;
+} | {
+    name: string;
+    namedCurve: "P-256" | "P-384" | "P-521";
+    hash: {
+        name: string;
+    };
+};
+export declare function getHmacHashSize(rsa: JwkHmacKey['alg']): "SHA-256" | "SHA-384" | "SHA-512";

package/dist/authentication/jwk/get-jwk-key-algorithm.js

@@ -0,0 +1,169 @@
+import { failNever } from '../../utils/fail-never.js';
+export function getJwkSignKey(jwk) {
+    if (jwk.kty === 'RSA') {
+        return {
+            kty: 'RSA',
+            alg: getRsaAlg(jwk.alg),
+            e: jwk.e,
+            n: jwk.n,
+            d: jwk.d,
+            p: jwk.p,
+            q: jwk.q,
+            dp: jwk.dp,
+            dq: jwk.dq,
+            qi: jwk.qi,
+            ext: true,
+        };
+    }
+    else if (jwk.kty === 'EC') {
+        return {
+            kty: 'EC',
+            crv: jwk.crv,
+            ext: true,
+            x: jwk.x,
+            y: jwk.y,
+            d: jwk.d,
+        };
+    }
+    else if (jwk.kty === 'oct') {
+        return {
+            kty: 'oct',
+            k: jwk.k,
+            alg: jwk.alg ?? 'HS256',
+            ext: true,
+        };
+    }
+    else {
+        failNever(jwk, 'unknown jwk key');
+    }
+}
+export function getJwkVerifyKey(jwk) {
+    if (jwk.kty === 'RSA') {
+        return {
+            kty: 'RSA',
+            alg: getRsaAlg(jwk.alg),
+            e: jwk.e,
+            n: jwk.n,
+            ext: true,
+        };
+    }
+    else if (jwk.kty === 'EC') {
+        return {
+            kty: 'EC',
+            crv: jwk.crv,
+            ext: true,
+            x: jwk.x,
+            y: jwk.y,
+        };
+    }
+    else if (jwk.kty === 'oct') {
+        return {
+            kty: 'oct',
+            k: jwk.k,
+            alg: jwk.alg ?? 'HS256',
+            ext: true,
+        };
+    }
+    else {
+        failNever(jwk, 'unknown jwk key');
+    }
+}
+export function getJwkKeyAlgorithm(jwk) {
+    if (jwk.kty === 'RSA') {
+        if (jwk.alg) {
+            if (jwk.alg.startsWith('PS')) {
+                return { name: 'RSA-PSS', hash: { name: getHashSize(jwk.alg) } };
+            }
+            else if (jwk.alg === 'RSA-OAEP') {
+                return { name: 'RSA-AEP', hash: { name: getHashSize(jwk.alg) } };
+            }
+        }
+        return { name: 'RSASSA-PKCS1-v1_5', hash: { name: getHashSize(jwk.alg) } };
+    }
+    else if (jwk.kty === 'EC') {
+        return {
+            name: 'ECDSA',
+            namedCurve: jwk.crv,
+            hash: { name: getEcHashSize(jwk.alg) ?? getEcHashSizeFromCurve(jwk.crv) },
+        };
+    }
+    else if (jwk.kty === 'oct') {
+        return {
+            name: 'HMAC',
+            hash: { name: getHmacHashSize(jwk.alg) },
+        };
+    }
+    else {
+        failNever(jwk, 'unknown jwk key');
+    }
+}
+function getRsaAlg(rsa) {
+    if (rsa) {
+        return rsa;
+    }
+    return 'RS256';
+}
+function getHashSize(rsa) {
+    if (!rsa) {
+        return 'SHA-256';
+    }
+    if (rsa === 'RS256' ||
+        rsa === 'RSA-OAEP-256' ||
+        rsa === 'PS256' ||
+        rsa === 'RSA-OAEP') {
+        return 'SHA-256';
+    }
+    else if (rsa === 'RS384' || rsa === 'PS384') {
+        return 'SHA-384';
+    }
+    else if (rsa === 'RS512' || rsa === 'PS512') {
+        return 'SHA-512';
+    }
+    else {
+        failNever(rsa, 'unknown rsa alg');
+    }
+}
+function getEcHashSizeFromCurve(alg) {
+    if (alg === 'P-256') {
+        return 'SHA-256';
+    }
+    else if (alg === 'P-384') {
+        return 'SHA-384';
+    }
+    else if (alg === 'P-521') {
+        return 'SHA-512';
+    }
+    else {
+        failNever(alg, 'unknown ec alg');
+    }
+}
+function getEcHashSize(alg) {
+    if (alg === 'ES256') {
+        return 'SHA-256';
+    }
+    else if (alg === 'ES384') {
+        return 'SHA-384';
+    }
+    else if (alg === 'ES512') {
+        return 'SHA-512';
+    }
+    return undefined;
+}
+export function getHmacHashSize(rsa) {
+    if (!rsa) {
+        return 'SHA-256';
+    }
+    if (rsa === 'HS256') {
+        return 'SHA-256';
+    }
+    else if (rsa === 'HS384') {
+        return 'SHA-384';
+    }
+    else if (rsa === 'HS512') {
+        return 'SHA-512';
+    }
+    else {
+        failNever(rsa, 'unknown hmac alg');
+    }
+}
+//# sourceMappingURL=get-jwk-key-algorithm.js.map

package/dist/authentication/jwk/get-jwk-key-algorithm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-jwk-key-algorithm.js","sourceRoot":"","sources":["../../../src/authentication/jwk/get-jwk-key-algorithm.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAGtD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,EAAE,IAAI;SACV,CAAC;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO;YACL,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,IAAI;YACT,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;SACT,CAAC;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,GAAG,EAAE,KAAK;YACV,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,OAAO;YACvB,GAAG,EAAE,IAAI;SACV,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YACvB,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,GAAG,EAAE,IAAI;SACV,CAAC;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO;YACL,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,IAAI;YACT,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;SACT,CAAC;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,GAAG,EAAE,KAAK;YACV,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,OAAO;YACvB,GAAG,EAAE,IAAI;SACV,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACnE,CAAC;iBAAM,IAAI,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7E,CAAC;SAAM,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,GAAG,CAAC,GAAG;YACnB,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;SAC1E,CAAC;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;SACzC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAqB;IACtC,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,GAAqB;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IACE,GAAG,KAAK,OAAO;QACf,GAAG,KAAK,cAAc;QACtB,GAAG,KAAK,OAAO;QACf,GAAG,KAAK,UAAU,EAClB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAoB;IAClD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAoB;IACzC,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAsB;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}