@maronn-openid-connect/experimental 0.0.4 → 0.0.6

package/dist/id-jag/redeem-id-jag.d.ts

@@ -0,0 +1,65 @@
+import { type AccessTokenInfo, type JwkSet, type TokenClientInfo } from '@maronn-openid-connect/core';
+import { type IdJagActor } from './issue-id-jag.js';
+export declare const JWT_BEARER_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+export declare const DEFAULT_ASSERTION_CLOCK_SKEW_SEC = 60;
+export interface IdJagTrustedIdentityProvider {
+    issuer: string;
+    jwks: JwkSet;
+}
+export interface ParsedIdJagRedemptionParams {
+    assertion: string;
+    scope?: string;
+}
+export interface IdJagAssertionPayload {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    client_id: string;
+    jti: string;
+    exp: number;
+    iat: number;
+    scope?: string;
+    resource?: string | string[];
+    auth_time?: number;
+    acr?: string;
+    amr?: string[];
+    act?: IdJagActor;
+}
+export interface IdJagRedemptionGrant {
+    subject: string;
+    clientId: string;
+    scope: string[];
+    requestedResources?: string[];
+    expiresIn: number;
+    idpIssuer: string;
+    jti: string;
+    authTime?: number;
+    acr?: string;
+    amr?: string[];
+    actor?: IdJagActor;
+}
+export type IdJagAccessTokenInfo = AccessTokenInfo & {
+    act?: IdJagActor;
+};
+export interface IdJagRedemptionContext {
+    params: Record<string, string>;
+    client: TokenClientInfo;
+    issuer: string;
+    identityProviders: IdJagTrustedIdentityProvider[];
+    configuredExpiresIn: number;
+    now?: Date;
+    clockSkewToleranceSec?: number;
+}
+export declare function authorizeIdJagRedemptionClient(client: TokenClientInfo): void;
+export declare function parseIdJagRedemptionParams(params: Record<string, string>): ParsedIdJagRedemptionParams;
+export declare function verifyIdJagAssertion(options: {
+    assertion: string;
+    issuer: string;
+    clientId: string;
+    identityProviders: IdJagTrustedIdentityProvider[];
+    now?: Date;
+    clockSkewToleranceSec?: number;
+}): Promise<IdJagAssertionPayload>;
+export declare function resolveIdJagGrantScope(requestedScope: string | undefined, assertionScope: string | undefined): string[];
+export declare function processIdJagRedemptionRequest(context: IdJagRedemptionContext): Promise<IdJagRedemptionGrant>;
+//# sourceMappingURL=redeem-id-jag.d.ts.map

package/dist/id-jag/redeem-id-jag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeem-id-jag.d.ts","sourceRoot":"","sources":["../../src/id-jag/redeem-id-jag.ts"],"names":[],"mappings":"AAqBA,OAAO,EAEL,KAAK,eAAe,EAEpB,KAAK,MAAM,EACX,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpE,eAAO,MAAM,qBAAqB,gDAAgD,CAAC;AAMnF,eAAO,MAAM,gCAAgC,KAAK,CAAC;AASnD,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAEf,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAMD,MAAM,WAAW,oBAAoB;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAM9B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;IAElB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAOf,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AASD,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IACnD,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB,CAAC;AAGF,MAAM,WAAW,sBAAsB;IAErC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,eAAe,CAAC;IAExB,MAAM,EAAE,MAAM,CAAC;IAEf,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;IAElD,mBAAmB,EAAE,MAAM,CAAC;IAE5B,GAAG,CAAC,EAAE,IAAI,CAAC;IAEX,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAmBD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAgB5E;AAOD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,2BAA2B,CAkB7B;AAgCD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;IAClD,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyKjC;AAeD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,MAAM,EAAE,CAeV;AAaD,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CA8C/B"}

package/dist/id-jag/redeem-id-jag.js

@@ -0,0 +1,305 @@
+import { extractAlgorithmParamsFromJwk, } from '@maronn-openid-connect/core';
+import { ASSERTION_UNTRUSTED_DESCRIPTION, IdJagError, } from './errors.js';
+import { ID_JAG_JWT_TYP } from './issue-id-jag.js';
+export const JWT_BEARER_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+export const DEFAULT_ASSERTION_CLOCK_SKEW_SEC = 60;
+const FORBIDDEN_KEY_HEADERS = ['jku', 'x5u', 'jwk', 'x5c'];
+export function authorizeIdJagRedemptionClient(client) {
+    const grantTypes = client.grantTypes ?? ['authorization_code'];
+    if (!grantTypes.includes(JWT_BEARER_GRANT_TYPE)) {
+        throw new IdJagError('unauthorized_client', 'The client is not authorized to use the jwt-bearer grant type');
+    }
+    if (client.tokenEndpointAuthMethod === 'none') {
+        throw new IdJagError('unauthorized_client', 'Public clients are not allowed to use the jwt-bearer grant type');
+    }
+}
+export function parseIdJagRedemptionParams(params) {
+    const assertion = optional(params['assertion']);
+    if (assertion === undefined) {
+        throw new IdJagError('invalid_request', 'assertion is required');
+    }
+    if (optional(params['authorization_details']) !== undefined) {
+        throw new IdJagError('invalid_request', 'authorization_details is not supported for the jwt-bearer grant');
+    }
+    return {
+        assertion,
+        scope: optional(params['scope']),
+    };
+}
+export async function verifyIdJagAssertion(options) {
+    const leeway = options.clockSkewToleranceSec ?? DEFAULT_ASSERTION_CLOCK_SKEW_SEC;
+    const parts = options.assertion.split('.');
+    if (parts.length !== 3) {
+        throw invalidAssertion('The provided assertion is not a valid JWS compact serialization');
+    }
+    const [headerB64, payloadB64, signatureB64] = parts;
+    let header;
+    let payload;
+    try {
+        header = parseBase64UrlJson(headerB64);
+        payload = parseBase64UrlJson(payloadB64);
+    }
+    catch {
+        throw invalidAssertion('The provided assertion is not a valid JWS compact serialization');
+    }
+    if (!isIdJagTyp(header['typ'])) {
+        throw invalidAssertion(`The assertion typ must be ${ID_JAG_JWT_TYP}`);
+    }
+    const headerAlg = typeof header['alg'] === 'string' ? header['alg'] : undefined;
+    if (!headerAlg || headerAlg === 'none') {
+        throw invalidAssertion('The assertion alg is missing or "none"');
+    }
+    for (const field of FORBIDDEN_KEY_HEADERS) {
+        if (field in header) {
+            throw invalidAssertion(`The assertion JOSE header contains unsupported field: ${field}`);
+        }
+    }
+    const iss = payload['iss'];
+    if (typeof iss !== 'string' || iss.length === 0) {
+        throw invalidAssertion(ASSERTION_UNTRUSTED_DESCRIPTION);
+    }
+    if (iss === options.issuer) {
+        throw invalidAssertion('An assertion issued by this authorization server cannot be redeemed here');
+    }
+    const identityProvider = options.identityProviders.find((idp) => idp.issuer === iss);
+    if (identityProvider === undefined) {
+        throw invalidAssertion(ASSERTION_UNTRUSTED_DESCRIPTION);
+    }
+    const headerKid = typeof header['kid'] === 'string' ? header['kid'] : undefined;
+    const candidates = headerKid
+        ? identityProvider.jwks.keys.filter((key) => key.kid === headerKid)
+        : identityProvider.jwks.keys.filter((key) => key.alg === headerAlg);
+    const signingInput = `${headerB64}.${payloadB64}`;
+    let signatureValid = false;
+    for (const jwk of candidates) {
+        if (jwk.alg !== headerAlg) {
+            continue;
+        }
+        if (await verifySignature(signingInput, signatureB64, jwk)) {
+            signatureValid = true;
+            break;
+        }
+    }
+    if (!signatureValid) {
+        throw invalidAssertion(ASSERTION_UNTRUSTED_DESCRIPTION);
+    }
+    const aud = payload['aud'];
+    const audMatches = aud === options.issuer ||
+        (Array.isArray(aud) && aud.length === 1 && aud[0] === options.issuer);
+    if (!audMatches) {
+        throw invalidAssertion('The assertion audience does not match this authorization server');
+    }
+    const nowSeconds = Math.floor((options.now ?? new Date()).getTime() / 1000);
+    const exp = payload['exp'];
+    if (typeof exp !== 'number') {
+        throw invalidAssertion('The assertion is missing an exp claim');
+    }
+    if (exp + leeway < nowSeconds) {
+        throw invalidAssertion('The assertion has expired');
+    }
+    const iat = payload['iat'];
+    if (typeof iat !== 'number') {
+        throw invalidAssertion('The assertion is missing an iat claim');
+    }
+    if (iat > nowSeconds + leeway) {
+        throw invalidAssertion('The assertion iat is in the future');
+    }
+    const nbf = payload['nbf'];
+    if (nbf !== undefined) {
+        if (typeof nbf !== 'number' || nbf > nowSeconds + leeway) {
+            throw invalidAssertion('The assertion is not yet valid');
+        }
+    }
+    const jti = payload['jti'];
+    if (typeof jti !== 'string' || jti.length === 0) {
+        throw invalidAssertion('The assertion is missing a jti claim');
+    }
+    const sub = payload['sub'];
+    if (typeof sub !== 'string' || sub.length === 0) {
+        throw invalidAssertion('The assertion is missing a sub claim');
+    }
+    const clientId = payload['client_id'];
+    if (typeof clientId !== 'string' || clientId.length === 0) {
+        throw invalidAssertion('The assertion is missing a client_id claim');
+    }
+    if (clientId !== options.clientId) {
+        throw invalidAssertion('The assertion client_id does not match the authenticated client');
+    }
+    const scope = payload['scope'];
+    if (scope !== undefined && typeof scope !== 'string') {
+        throw invalidAssertion('The assertion scope claim must be a string');
+    }
+    const resource = payload['resource'];
+    if (resource !== undefined &&
+        typeof resource !== 'string' &&
+        !(Array.isArray(resource) && resource.every((value) => typeof value === 'string'))) {
+        throw invalidAssertion('The assertion resource claim must be a string or an array of strings');
+    }
+    const authTime = typeof payload['auth_time'] === 'number' ? payload['auth_time'] : undefined;
+    const acr = typeof payload['acr'] === 'string' ? payload['acr'] : undefined;
+    const amr = Array.isArray(payload['amr']) && payload['amr'].every((value) => typeof value === 'string')
+        ? payload['amr']
+        : undefined;
+    const act = payload['act'];
+    if (act !== undefined && !isValidActorChain(act)) {
+        throw invalidAssertion('The assertion act claim is malformed');
+    }
+    return {
+        iss,
+        sub,
+        aud: aud,
+        client_id: clientId,
+        jti,
+        exp,
+        iat,
+        ...(scope === undefined ? {} : { scope }),
+        ...(resource === undefined ? {} : { resource: resource }),
+        ...(authTime === undefined ? {} : { auth_time: authTime }),
+        ...(acr === undefined ? {} : { acr }),
+        ...(amr === undefined ? {} : { amr }),
+        ...(act === undefined ? {} : { act: act }),
+    };
+}
+export function resolveIdJagGrantScope(requestedScope, assertionScope) {
+    const granted = splitScope(assertionScope).filter((value) => value !== 'offline_access');
+    const requested = splitScope(requestedScope);
+    if (requested.length === 0) {
+        return granted;
+    }
+    for (const value of requested) {
+        if (!granted.includes(value)) {
+            throw new IdJagError('invalid_scope', 'The requested scope exceeds the scope of the assertion');
+        }
+    }
+    return requested;
+}
+export async function processIdJagRedemptionRequest(context) {
+    if (!Number.isInteger(context.configuredExpiresIn) || context.configuredExpiresIn <= 0) {
+        throw new RangeError(`configuredExpiresIn must be a positive integer, received ${context.configuredExpiresIn}`);
+    }
+    authorizeIdJagRedemptionClient(context.client);
+    const parsed = parseIdJagRedemptionParams(context.params);
+    const assertion = await verifyIdJagAssertion({
+        assertion: parsed.assertion,
+        issuer: context.issuer,
+        clientId: context.client.clientId,
+        identityProviders: context.identityProviders,
+        ...(context.now === undefined ? {} : { now: context.now }),
+        ...(context.clockSkewToleranceSec === undefined
+            ? {}
+            : { clockSkewToleranceSec: context.clockSkewToleranceSec }),
+    });
+    const scope = resolveIdJagGrantScope(parsed.scope, assertion.scope);
+    const requestedResources = assertion.resource === undefined
+        ? undefined
+        : typeof assertion.resource === 'string'
+            ? [assertion.resource]
+            : [...assertion.resource];
+    return {
+        subject: assertion.sub,
+        clientId: context.client.clientId,
+        scope,
+        ...(requestedResources === undefined ? {} : { requestedResources }),
+        expiresIn: context.configuredExpiresIn,
+        idpIssuer: assertion.iss,
+        jti: assertion.jti,
+        ...(assertion.auth_time === undefined ? {} : { authTime: assertion.auth_time }),
+        ...(assertion.acr === undefined ? {} : { acr: assertion.acr }),
+        ...(assertion.amr === undefined ? {} : { amr: assertion.amr }),
+        ...(assertion.act === undefined ? {} : { actor: assertion.act }),
+    };
+}
+function optional(value) {
+    if (value === undefined)
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+function splitScope(scope) {
+    if (scope === undefined)
+        return [];
+    return [...new Set(scope.split(/\s+/).filter((value) => value.length > 0))];
+}
+function invalidAssertion(description) {
+    return new IdJagError('invalid_grant', description);
+}
+function isValidActorChain(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const actor = value;
+    if (typeof actor.sub !== 'string' || actor.sub.length === 0) {
+        return false;
+    }
+    if (actor.act !== undefined && !isValidActorChain(actor.act)) {
+        return false;
+    }
+    return true;
+}
+function isIdJagTyp(typ) {
+    if (typeof typ !== 'string')
+        return false;
+    const normalized = typ.toLowerCase();
+    return normalized === ID_JAG_JWT_TYP || normalized === `application/${ID_JAG_JWT_TYP}`;
+}
+function parseBase64UrlJson(segment) {
+    if (!/^[A-Za-z0-9_-]+$/.test(segment)) {
+        throw new Error('invalid base64url');
+    }
+    const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    const parsed = JSON.parse(new TextDecoder().decode(bytes));
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error('not a JSON object');
+    }
+    return parsed;
+}
+function base64UrlToArrayBuffer(segment) {
+    if (!/^[A-Za-z0-9_-]*$/.test(segment)) {
+        throw new Error('invalid base64url');
+    }
+    const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+}
+async function verifySignature(signingInput, signatureB64, jwk) {
+    let signature;
+    try {
+        signature = base64UrlToArrayBuffer(signatureB64);
+    }
+    catch {
+        return false;
+    }
+    try {
+        const algParams = extractAlgorithmParamsFromJwk(jwk);
+        const publicKey = await crypto.subtle.importKey('jwk', jwk, algParams, false, ['verify']);
+        const algorithm = publicKey.algorithm;
+        let verifyParams;
+        if (algorithm.name === 'RSASSA-PKCS1-v1_5') {
+            verifyParams = { name: 'RSASSA-PKCS1-v1_5' };
+        }
+        else if (algorithm.name === 'ECDSA' && 'namedCurve' in algorithm) {
+            const namedCurve = algorithm.namedCurve;
+            const hash = namedCurve === 'P-256' ? 'SHA-256' : namedCurve === 'P-384' ? 'SHA-384' : 'SHA-512';
+            verifyParams = { name: 'ECDSA', hash };
+        }
+        else {
+            return false;
+        }
+        return await crypto.subtle.verify(verifyParams, publicKey, signature, new TextEncoder().encode(signingInput));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=redeem-id-jag.js.map

package/dist/id-jag/redeem-id-jag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeem-id-jag.js","sourceRoot":"","sources":["../../src/id-jag/redeem-id-jag.ts"],"names":[],"mappings":"AAqBA,OAAO,EACL,6BAA6B,GAK9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,+BAA+B,EAC/B,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAmB,MAAM,mBAAmB,CAAC;AAGpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,6CAA6C,CAAC;AAMnF,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AA6GnD,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAYpE,MAAM,UAAU,8BAA8B,CAAC,MAAuB;IAGpE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,iEAAiE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,0BAA0B,CACxC,MAA8B;IAE9B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACnE,CAAC;IAGD,IAAI,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KACjC,CAAC;AACJ,CAAC;AAgCD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAO1C;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAEjF,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAiC,CAAC;IAEhF,IAAI,MAA+B,CAAC;IACpC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAC5F,CAAC;IAID,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,gBAAgB,CAAC,6BAA6B,cAAc,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACpB,MAAM,gBAAgB,CAAC,yDAAyD,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;IAC1D,CAAC;IAID,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,gBAAgB,CACpB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACrF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;IAC1D,CAAC;IAKD,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC;QACnE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IAEtE,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,MAAM,eAAe,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3D,cAAc,GAAG,IAAI,CAAC;YACtB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QAEpB,MAAM,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;IAC1D,CAAC;IAGD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GACd,GAAG,KAAK,OAAO,CAAC,MAAM;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,gBAAgB,CAAC,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,GAAG,GAAG,MAAM,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,gBAAgB,CAAC,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,GAAG,GAAG,UAAU,GAAG,MAAM,EAAE,CAAC;QAC9B,MAAM,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,UAAU,GAAG,MAAM,EAAE,CAAC;YACzD,MAAM,gBAAgB,CAAC,gCAAgC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACjE,CAAC;IAID,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,gBAAgB,CAAC,4CAA4C,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,gBAAgB,CAAC,4CAA4C,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IACE,QAAQ,KAAK,SAAS;QACtB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,EAClF,CAAC;QACD,MAAM,gBAAgB,CAAC,sEAAsE,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,GAAG,GACP,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACzF,CAAC,CAAE,OAAO,CAAC,KAAK,CAAc;QAC9B,CAAC,CAAC,SAAS,CAAC;IAKhB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG;QACH,GAAG,EAAE,GAAwB;QAC7B,SAAS,EAAE,QAAQ;QACnB,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAA6B,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAiB,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAeD,MAAM,UAAU,sBAAsB,CACpC,cAAkC,EAClC,cAAkC;IAElC,MAAM,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,wDAAwD,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA+B;IAE/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,mBAAmB,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,UAAU,CAClB,4DAA4D,OAAO,CAAC,mBAAmB,EAAE,CAC1F,CAAC;IACJ,CAAC;IAID,8BAA8B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;KAC9D,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpE,MAAM,kBAAkB,GACtB,SAAS,CAAC,QAAQ,KAAK,SAAS;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;YACtC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;YACtB,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEhC,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,GAAG;QACtB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,KAAK;QACL,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC;QACnE,SAAS,EAAE,OAAO,CAAC,mBAAmB;QACtC,SAAS,EAAE,SAAS,CAAC,GAAG;QACxB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;QAC/E,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;QAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;QAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAGD,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC;AAMD,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,KAAyC,CAAC;IACxD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,UAAU,KAAK,cAAc,IAAI,UAAU,KAAK,eAAe,cAAc,EAAE,CAAC;AACzF,CAAC;AAGD,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAUD,KAAK,UAAU,eAAe,CAC5B,YAAoB,EACpB,YAAoB,EACpB,GAAQ;IAER,IAAI,SAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,6BAA6B,CAAC,GAA2B,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,GAA2B,EAC3B,SAAS,EACT,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QACtC,IAAI,YAAmE,CAAC;QACxE,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC3C,YAAY,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;QAC/C,CAAC;aAAM,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;YACnE,MAAM,UAAU,GAAI,SAAsC,CAAC,UAAU,CAAC;YACtE,MAAM,IAAI,GACR,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,YAAY,EACZ,SAAS,EACT,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/token-exchange/index.d.ts

@@ -1,2 +1,2 @@
-export { SUBJECT_TOKEN_INVALID_DESCRIPTION, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TokenExchangeError, authorizeTokenExchangeClient, buildTokenExchangeResponse, computeExchangedTokenLifetime, parseTokenExchangeParams, processTokenExchangeRequest, resolveExchangeTarget, resolveSubjectToken, validateExchangeScope, type ParsedTokenExchangeParams, type TokenExchangeErrorCode, type TokenExchangeGrant, type TokenExchangeRequestContext, type TokenExchangeResponse, } from './token-exchange-request.js';
+export { ACTOR_TOKEN_INVALID_DESCRIPTION, SUBJECT_TOKEN_INVALID_DESCRIPTION, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TokenExchangeError, authorizeTokenExchangeClient, buildTokenExchangeResponse, composeActClaim, computeExchangedTokenLifetime, parseTokenExchangeParams, processTokenExchangeRequest, resolveActorToken, resolveExchangeTarget, resolveSubjectToken, validateExchangeScope, type ExchangedAccessTokenInfo, type ParsedTokenExchangeParams, type TokenExchangeActor, type TokenExchangeErrorCode, type TokenExchangeGrant, type TokenExchangeRequestContext, type TokenExchangeResponse, } from './token-exchange-request.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/token-exchange/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/token-exchange/index.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAC1B,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/token-exchange/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,EACjC,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAC1B,eAAe,EACf,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC"}

package/dist/token-exchange/index.js

@@ -1,2 +1,2 @@
-export { SUBJECT_TOKEN_INVALID_DESCRIPTION, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TokenExchangeError, authorizeTokenExchangeClient, buildTokenExchangeResponse, computeExchangedTokenLifetime, parseTokenExchangeParams, processTokenExchangeRequest, resolveExchangeTarget, resolveSubjectToken, validateExchangeScope, } from './token-exchange-request.js';
+export { ACTOR_TOKEN_INVALID_DESCRIPTION, SUBJECT_TOKEN_INVALID_DESCRIPTION, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TokenExchangeError, authorizeTokenExchangeClient, buildTokenExchangeResponse, composeActClaim, computeExchangedTokenLifetime, parseTokenExchangeParams, processTokenExchangeRequest, resolveActorToken, resolveExchangeTarget, resolveSubjectToken, validateExchangeScope, } from './token-exchange-request.js';
 //# sourceMappingURL=index.js.map

package/dist/token-exchange/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/token-exchange/index.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAC1B,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,GAMtB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/token-exchange/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,EACjC,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAC1B,eAAe,EACf,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,GAQtB,MAAM,6BAA6B,CAAC"}

package/dist/token-exchange/token-exchange-request.d.ts

@@ -2,6 +2,7 @@ import { type AccessTokenInfo, type AccessTokenResolver, type TokenClientInfo }
 export declare const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
 export declare const TOKEN_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
 export declare const SUBJECT_TOKEN_INVALID_DESCRIPTION = "The provided subject_token is not valid";
+export declare const ACTOR_TOKEN_INVALID_DESCRIPTION = "The provided actor_token is not valid";
 export type TokenExchangeErrorCode = 'invalid_request' | 'unauthorized_client' | 'invalid_scope' | 'invalid_target';
 export declare class TokenExchangeError extends Error {
     readonly code: TokenExchangeErrorCode;
@@ -9,11 +10,19 @@ export declare class TokenExchangeError extends Error {
     constructor(code: TokenExchangeErrorCode, errorDescription: string);
     get statusCode(): 400;
 }
+export interface TokenExchangeActor {
+    sub: string;
+    act?: TokenExchangeActor;
+}
+export type ExchangedAccessTokenInfo = AccessTokenInfo & {
+    act?: TokenExchangeActor;
+};
 export interface ParsedTokenExchangeParams {
     subjectToken: string;
     scope?: string;
     audience?: string;
     resource?: string;
+    actorToken?: string;
 }
 export interface TokenExchangeGrant {
     subject: string;
@@ -22,6 +31,7 @@ export interface TokenExchangeGrant {
     requestedAudience?: string[];
     expiresIn: number;
     grantId?: string;
+    actor?: TokenExchangeActor;
 }
 export interface TokenExchangeResponse {
     access_token: string;
@@ -45,6 +55,15 @@ export declare function resolveSubjectToken(options: {
     accessTokenResolver: AccessTokenResolver;
     now?: Date;
 }): Promise<AccessTokenInfo>;
+export declare function resolveActorToken(options: {
+    actorToken: string;
+    accessTokenResolver: AccessTokenResolver;
+    now?: Date;
+}): Promise<AccessTokenInfo>;
+export declare function composeActClaim(options: {
+    actorSub: string;
+    subjectActChain?: TokenExchangeActor;
+}): TokenExchangeActor;
 export declare function validateExchangeScope(requestedScope: string | undefined, subjectScope: string[]): string[];
 export declare function resolveExchangeTarget(options: {
     audience?: string;

package/dist/token-exchange/token-exchange-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-exchange-request.d.ts","sourceRoot":"","sources":["../../src/token-exchange/token-exchange-request.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAGrC,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAG3F,eAAO,MAAM,uBAAuB,kDAAkD,CAAC;AASvF,eAAO,MAAM,iCAAiC,4CACH,CAAC;AAS5C,MAAM,MAAM,sBAAsB,GAC9B,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,gBAAgB,CAAC;AASrB,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,IAAI,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM;IAUlE,IAAI,UAAU,IAAI,GAAG,CAEpB;CACF;AAGD,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IAErB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,kBAAkB;IAEjC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,uBAAuB,CAAC;IAClD,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,2BAA2B;IAE1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,eAAe,CAAC;IACxB,mBAAmB,EAAE,mBAAmB,CAAC;IAEzC,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB,mBAAmB,EAAE,MAAM,CAAC;IAE5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAgB1E;AAUD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,yBAAyB,CAoD3B;AAaD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,eAAe,CAAC,CAe3B;AAWD,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,EAAE,CAcV;AAcD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,GAAG,MAAM,EAAE,GAAG,SAAS,CAmBvB;AAeD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IAErD,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,MAAM,CAcT;AAGD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,qBAAqB,CAUxB;AAUD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAoC7B"}
+{"version":3,"file":"token-exchange-request.d.ts","sourceRoot":"","sources":["../../src/token-exchange/token-exchange-request.ts"],"names":[],"mappings":"AAmBA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAGrC,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAG3F,eAAO,MAAM,uBAAuB,kDAAkD,CAAC;AASvF,eAAO,MAAM,iCAAiC,4CACH,CAAC;AAO5C,eAAO,MAAM,+BAA+B,0CACH,CAAC;AAS1C,MAAM,MAAM,sBAAsB,GAC9B,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,gBAAgB,CAAC;AASrB,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,IAAI,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM;IAUlE,IAAI,UAAU,IAAI,GAAG,CAEpB;CACF;AAQD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,kBAAkB,CAAC;CAC1B;AAUD,MAAM,MAAM,wBAAwB,GAAG,eAAe,GAAG;IACvD,GAAG,CAAC,EAAE,kBAAkB,CAAC;CAC1B,CAAC;AAGF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IAErB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,kBAAkB;IAEjC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,CAAC,EAAE,MAAM,CAAC;IAKjB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAGD,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,uBAAuB,CAAC;IAClD,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,2BAA2B;IAE1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,eAAe,CAAC;IACxB,mBAAmB,EAAE,mBAAmB,CAAC;IAEzC,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB,mBAAmB,EAAE,MAAM,CAAC;IAE5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAgB1E;AAUD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,yBAAyB,CAoE3B;AAaD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,eAAe,CAAC,CAO3B;AAcD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,eAAe,CAAC,CAO3B;AASD,wBAAgB,eAAe,CAAC,OAAO,EAAE;IAEvC,QAAQ,EAAE,MAAM,CAAC;IAEjB,eAAe,CAAC,EAAE,kBAAkB,CAAC;CACtC,GAAG,kBAAkB,CAKrB;AAWD,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,EAAE,CAcV;AAcD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,GAAG,MAAM,EAAE,GAAG,SAAS,CAmBvB;AAeD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IAErD,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,MAAM,CAcT;AAGD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,qBAAqB,CAUxB;AAUD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAoD7B"}

package/dist/token-exchange/token-exchange-request.js

@@ -2,6 +2,7 @@ import { sanitizeErrorDescription, } from '@maronn-openid-connect/core';
 export const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
 export const TOKEN_TYPE_ACCESS_TOKEN = 'urn:ietf:params:oauth:token-type:access_token';
 export const SUBJECT_TOKEN_INVALID_DESCRIPTION = 'The provided subject_token is not valid';
+export const ACTOR_TOKEN_INVALID_DESCRIPTION = 'The provided actor_token is not valid';
 export class TokenExchangeError extends Error {
     code;
     errorDescription;
@@ -26,9 +27,6 @@ export function authorizeTokenExchangeClient(client) {
     }
 }
 export function parseTokenExchangeParams(params) {
-    if (params['actor_token'] !== undefined || params['actor_token_type'] !== undefined) {
-        throw new TokenExchangeError('invalid_request', 'Delegation is not supported: actor_token and actor_token_type must not be present.');
-    }
     const subjectToken = optional(params['subject_token']);
     if (subjectToken === undefined) {
         throw new TokenExchangeError('invalid_request', 'subject_token is required');
@@ -48,26 +46,36 @@ export function parseTokenExchangeParams(params) {
     if (resource !== undefined && !isAbsoluteUriWithoutFragment(resource)) {
         throw new TokenExchangeError('invalid_request', 'resource must be an absolute URI without a fragment component');
     }
+    const actorToken = optional(params['actor_token']);
+    const actorTokenType = optional(params['actor_token_type']);
+    if (actorToken !== undefined && actorTokenType === undefined) {
+        throw new TokenExchangeError('invalid_request', 'actor_token_type is required when actor_token is present');
+    }
+    if (actorToken === undefined && actorTokenType !== undefined) {
+        throw new TokenExchangeError('invalid_request', 'actor_token_type must not be present without actor_token');
+    }
+    if (actorTokenType !== undefined && actorTokenType !== TOKEN_TYPE_ACCESS_TOKEN) {
+        throw new TokenExchangeError('invalid_request', `Unsupported actor_token_type. Only ${TOKEN_TYPE_ACCESS_TOKEN} is supported.`);
+    }
     return {
         subjectToken,
         scope: optional(params['scope']),
         audience: optional(params['audience']),
         resource,
+        actorToken,
     };
 }
 export async function resolveSubjectToken(options) {
-    const info = await options.accessTokenResolver.findAccessToken(options.subjectToken);
-    if (info === null) {
-        throw invalidSubjectToken();
-    }
-    const nowSeconds = toEpochSeconds(options.now);
-    if (info.expiresAt <= nowSeconds) {
-        throw invalidSubjectToken();
-    }
-    if (info.nbf !== undefined && info.nbf > nowSeconds) {
-        throw invalidSubjectToken();
+    return resolveExchangeToken(options.subjectToken, options.accessTokenResolver, options.now, invalidSubjectToken);
+}
+export async function resolveActorToken(options) {
+    return resolveExchangeToken(options.actorToken, options.accessTokenResolver, options.now, invalidActorToken);
+}
+export function composeActClaim(options) {
+    if (options.subjectActChain === undefined) {
+        return { sub: options.actorSub };
     }
-    return info;
+    return { sub: options.actorSub, act: options.subjectActChain };
 }
 export function validateExchangeScope(requestedScope, subjectScope) {
     const requested = splitScope(requestedScope);
@@ -125,6 +133,18 @@ export async function processTokenExchangeRequest(context) {
         accessTokenResolver: context.accessTokenResolver,
         now: context.now,
     });
+    let actor;
+    if (parsed.actorToken !== undefined) {
+        const actorInfo = await resolveActorToken({
+            actorToken: parsed.actorToken,
+            accessTokenResolver: context.accessTokenResolver,
+            now: context.now,
+        });
+        actor = composeActClaim({
+            actorSub: actorInfo.sub,
+            subjectActChain: subject.act,
+        });
+    }
     const scope = validateExchangeScope(parsed.scope, subject.scope);
     const requestedAudience = resolveExchangeTarget({
         audience: parsed.audience,
@@ -144,6 +164,7 @@ export async function processTokenExchangeRequest(context) {
         requestedAudience,
         expiresIn,
         grantId: subject.grantId,
+        ...(actor === undefined ? {} : { actor }),
     };
 }
 function optional(value) {
@@ -163,6 +184,23 @@ function toEpochSeconds(now) {
 function invalidSubjectToken() {
     return new TokenExchangeError('invalid_request', SUBJECT_TOKEN_INVALID_DESCRIPTION);
 }
+function invalidActorToken() {
+    return new TokenExchangeError('invalid_request', ACTOR_TOKEN_INVALID_DESCRIPTION);
+}
+async function resolveExchangeToken(token, accessTokenResolver, now, invalidToken) {
+    const info = await accessTokenResolver.findAccessToken(token);
+    if (info === null) {
+        throw invalidToken();
+    }
+    const nowSeconds = toEpochSeconds(now);
+    if (info.expiresAt <= nowSeconds) {
+        throw invalidToken();
+    }
+    if (info.nbf !== undefined && info.nbf > nowSeconds) {
+        throw invalidToken();
+    }
+    return info;
+}
 function isAbsoluteUriWithoutFragment(value) {
     if (value.includes('#'))
         return false;

package/dist/token-exchange/token-exchange-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-exchange-request.js","sourceRoot":"","sources":["../../src/token-exchange/token-exchange-request.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,wBAAwB,GAIzB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,CAAC,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAG3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AASvF,MAAM,CAAC,MAAM,iCAAiC,GAC5C,yCAAyC,CAAC;AAsB5C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAC7B,gBAAgB,CAAS;IAElC,YAAY,IAA4B,EAAE,gBAAwB;QAEhE,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AA+DD,MAAM,UAAU,4BAA4B,CAAC,MAAuB;IAGlE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,wBAAwB,CACtC,MAA8B;IAG9B,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAChE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,wCAAwC,uBAAuB,gBAAgB,CAChF,CAAC;IACJ,CAAC;IAID,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACpE,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,KAAK,uBAAuB,EAAE,CAAC;QACvF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,0CAA0C,uBAAuB,gBAAgB,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAItE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,QAAQ;KACT,CAAC;AACJ,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAIzC;IACC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAElB,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,MAAM,UAAU,qBAAqB,CACnC,cAAkC,EAClC,YAAsB;IAEtB,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAExC,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAeD,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,UAAU,CAClB,4DAA4D,mBAAmB,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAEnB,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,iBAAiB,EAAE,uBAAuB;QAE1C,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,OAAO,CAAC,SAAS;QAE7B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC;IAIpC,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEjE,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,QAAQ;KAClC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,gBAAgB,EAAE,OAAO,CAAC,SAAS;QACnC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,KAAK;QACL,iBAAiB;QACjB,SAAS;QACT,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAGD,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,GAAqB;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;AACtF,CAAC;AAMD,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"token-exchange-request.js","sourceRoot":"","sources":["../../src/token-exchange/token-exchange-request.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,wBAAwB,GAIzB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,CAAC,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAG3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AASvF,MAAM,CAAC,MAAM,iCAAiC,GAC5C,yCAAyC,CAAC;AAO5C,MAAM,CAAC,MAAM,+BAA+B,GAC1C,uCAAuC,CAAC;AAsB1C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAC7B,gBAAgB,CAAS;IAElC,YAAY,IAA4B,EAAE,gBAAwB;QAEhE,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AA6FD,MAAM,UAAU,4BAA4B,CAAC,MAAuB;IAGlE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,wBAAwB,CACtC,MAA8B;IAE9B,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAChE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,wCAAwC,uBAAuB,gBAAgB,CAChF,CAAC;IACJ,CAAC;IAID,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACpE,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,KAAK,uBAAuB,EAAE,CAAC;QACvF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,0CAA0C,uBAAuB,gBAAgB,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAItE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAID,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5D,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,uBAAuB,EAAE,CAAC;QAC/E,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,sCAAsC,uBAAuB,gBAAgB,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,QAAQ;QACR,UAAU;KACX,CAAC;AACJ,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAIzC;IACC,OAAO,oBAAoB,CACzB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,GAAG,EACX,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAIvC;IACC,OAAO,oBAAoB,CACzB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,GAAG,EACX,iBAAiB,CAClB,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,eAAe,CAAC,OAK/B;IACC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;AACjE,CAAC;AAWD,MAAM,UAAU,qBAAqB,CACnC,cAAkC,EAClC,YAAsB;IAEtB,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAExC,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAeD,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,UAAU,CAClB,4DAA4D,mBAAmB,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAEnB,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,iBAAiB,EAAE,uBAAuB;QAE1C,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,OAAO,CAAC,SAAS;QAE7B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC;IAIpC,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAIH,IAAI,KAAqC,CAAC;IAC1C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,KAAK,GAAG,eAAe,CAAC;YACtB,QAAQ,EAAE,SAAS,CAAC,GAAG;YACvB,eAAe,EAAG,OAAoC,CAAC,GAAG;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEjE,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,QAAQ;KAClC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,gBAAgB,EAAE,OAAO,CAAC,SAAS;QACnC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,KAAK;QACL,iBAAiB;QACjB,SAAS;QACT,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAGD,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,GAAqB;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;AACpF,CAAC;AAQD,KAAK,UAAU,oBAAoB,CACjC,KAAa,EACb,mBAAwC,EACxC,GAAqB,EACrB,YAAsC;IAEtC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAElB,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;QACpD,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AACpC,CAAC"}