@naylence/advanced-security 0.3.0

package/dist/cjs/naylence/fame/stickiness/aft-replica-stickiness-manager.js

@@ -0,0 +1,208 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AFTReplicaStickinessManager = void 0;
+exports.createAftReplicaStickinessManager = createAftReplicaStickinessManager;
+const core_1 = require("@naylence/core");
+const runtime_1 = require("@naylence/runtime");
+const runtime_2 = require("@naylence/runtime");
+const aft_helper_js_1 = require("./aft-helper.js");
+const stickiness_mode_js_1 = require("./stickiness-mode.js");
+const logger = (0, runtime_2.getLogger)("naylence.fame.stickiness.aft_replica_stickiness_manager");
+function isStickinessRequired(context) {
+    if (typeof context.stickinessRequired === "boolean") {
+        return context.stickinessRequired;
+    }
+    if (typeof context.stickiness_required === "boolean") {
+        return context.stickiness_required;
+    }
+    return false;
+}
+class AFTReplicaStickinessManager extends runtime_1.BaseNodeEventListener {
+    constructor(options = {}) {
+        super();
+        this.securityLevel =
+            (0, stickiness_mode_js_1.normalizeStickinessMode)(options.securityLevel ?? aft_helper_js_1.DEFAULT_STICKINESS_SECURITY_LEVEL) ?? aft_helper_js_1.DEFAULT_STICKINESS_SECURITY_LEVEL;
+        this.aftHelper = options.aftHelper ?? null;
+        this.maxTtlSec = options.maxTtlSec ?? 7200;
+        this.isInitialized = this.aftHelper !== null;
+        this.negotiatedStickiness = null;
+        if (this.aftHelper) {
+            logger.debug("aft_replica_stickiness_manager_initialized", {
+                helper_type: this.aftHelper.signer.constructor.name,
+                security_level: this.aftHelper.signer.securityLevel,
+                max_ttl_sec: this.aftHelper.maxTtlSec,
+            });
+        }
+        else {
+            logger.debug("aft_replica_stickiness_manager_created", {
+                security_level: this.securityLevel,
+                max_ttl_sec: this.maxTtlSec,
+            });
+        }
+    }
+    offer() {
+        return { mode: "aft", supportedModes: ["aft", "attr"], version: 1 };
+    }
+    accept(stickiness) {
+        this.negotiatedStickiness = stickiness ?? null;
+        logger.debug("replica_stickiness_policy_set", {
+            enabled: stickiness?.enabled ?? null,
+            mode: stickiness?.mode ?? null,
+            ttl: stickiness?.ttlSec ?? null,
+        });
+    }
+    async onForwardUpstream(_node, envelope, context) {
+        if (!context) {
+            return envelope;
+        }
+        const helper = this.aftHelper;
+        if (!helper) {
+            logger.debug("aft_helper_not_ready_skip_injection", {
+                envelope_id: envelope.id,
+                delivery_origin: context.originType ?? null,
+                reason: "not_initialized",
+            });
+            return envelope;
+        }
+        const stickinessContext = context;
+        if (isStickinessRequired(stickinessContext) &&
+            context.originType === core_1.DeliveryOriginType.LOCAL) {
+            if (this.negotiatedStickiness) {
+                const negotiated = this.negotiatedStickiness;
+                if (negotiated.enabled === false ||
+                    (negotiated.mode !== null &&
+                        negotiated.mode !== undefined &&
+                        negotiated.mode !== "aft")) {
+                    logger.debug("aft_injection_skipped_due_to_policy", {
+                        envelope_id: envelope.id,
+                        policy_mode: negotiated.mode ?? null,
+                        policy_enabled: negotiated.enabled ?? null,
+                    });
+                    return envelope;
+                }
+            }
+            logger.debug("applying_aft_for_upstream_stickiness_required", {
+                envelope_id: envelope.id,
+                from_system_id: context.fromSystemId ?? null,
+                delivery_origin: context.originType ?? null,
+            });
+            const success = await helper.requestStickiness(envelope, {
+                ttlSec: null,
+                scope: "node",
+                context: stickinessContext,
+            });
+            if (success) {
+                logger.debug("aft_token_applied_via_context_flag_upstream", {
+                    envelope_id: envelope.id,
+                    from_system_id: context.fromSystemId ?? null,
+                    delivery_origin: context.originType ?? null,
+                });
+            }
+            else {
+                logger.debug("aft_token_not_applied_upstream", {
+                    envelope_id: envelope.id,
+                    delivery_origin: context.originType ?? null,
+                    reason: "helper_returned_false",
+                });
+            }
+        }
+        return envelope;
+    }
+    async onNodeStarted(node) {
+        if (!this.isInitialized) {
+            await this.initializeAftHelper(node);
+            return;
+        }
+        if (this.aftHelper && node.sid) {
+            this.updateNodeSid(node.sid);
+            logger.debug("aft_replica_stickiness_manager_sid_updated", {
+                node_id: node.id ?? "unknown",
+                node_sid: node.sid,
+                security_level: this.aftHelper.signer.securityLevel,
+            });
+        }
+        else if (!node.sid) {
+            logger.warning("aft_replica_stickiness_manager_no_sid_available", {
+                node_id: node.id ?? "unknown",
+            });
+        }
+        else {
+            logger.error("aft_replica_stickiness_manager_node_missing_sid", {
+                node_type: node.constructor?.name ?? typeof node,
+            });
+        }
+    }
+    updateNodeSid(nodeSid) {
+        if (this.aftHelper) {
+            this.aftHelper.nodeSid = nodeSid;
+            logger.debug("aft_replica_stickiness_manager_sid_updated", {
+                new_sid: nodeSid,
+            });
+        }
+    }
+    async initializeAftHelper(node) {
+        const nodeSid = node.sid;
+        if (!nodeSid) {
+            logger.error("aft_replica_stickiness_manager_cannot_initialize_no_sid", {
+                node_id: node.id ?? "unknown",
+            });
+            return;
+        }
+        const cryptoProvider = node.cryptoProvider ?? null;
+        if (!cryptoProvider) {
+            logger.error("aft_replica_stickiness_manager_cannot_initialize_no_crypto_provider", {
+                node_id: node.id ?? "unknown",
+            });
+            return;
+        }
+        const keyId = typeof cryptoProvider.signatureKeyId === "string" &&
+            cryptoProvider.signatureKeyId.length > 0
+            ? cryptoProvider.signatureKeyId
+            : "default-key-id";
+        const privateKeyPem = typeof cryptoProvider.signingPrivatePem === "string"
+            ? cryptoProvider.signingPrivatePem
+            : null;
+        if (this.securityLevel === stickiness_mode_js_1.StickinessMode.STRICT && !privateKeyPem) {
+            logger.error("aft_replica_stickiness_manager_initialization_failed", {
+                node_id: node.id ?? "unknown",
+                error: "Missing signing private key for strict security level",
+            });
+            return;
+        }
+        try {
+            const helper = (0, aft_helper_js_1.createAftHelper)({
+                securityLevel: this.securityLevel,
+                nodeSid,
+                kid: keyId,
+                privateKeyPem,
+                maxTtlSec: this.maxTtlSec,
+            });
+            this.aftHelper = helper;
+            this.isInitialized = true;
+            logger.debug("aft_replica_stickiness_manager_initialized", {
+                node_id: node.id ?? "unknown",
+                node_sid: nodeSid,
+                key_id: keyId,
+                security_level: helper.signer.securityLevel,
+            });
+        }
+        catch (error) {
+            logger.error("aft_replica_stickiness_manager_initialization_failed", {
+                node_id: node.id ?? "unknown",
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    get signer() {
+        return this.aftHelper?.signer ?? null;
+    }
+    getHelper() {
+        return this.aftHelper;
+    }
+}
+exports.AFTReplicaStickinessManager = AFTReplicaStickinessManager;
+function createAftReplicaStickinessManager(aftHelper) {
+    return new AFTReplicaStickinessManager({ aftHelper });
+}
+exports.default = AFTReplicaStickinessManager;
+//# sourceMappingURL=aft-replica-stickiness-manager.js.map

package/dist/cjs/naylence/fame/stickiness/aft-replica-stickiness-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aft-replica-stickiness-manager.js","sourceRoot":"","sources":["../../../../../src/naylence/fame/stickiness/aft-replica-stickiness-manager.ts"],"names":[],"mappings":";;;AA+QA,8EAIC;AA9QD,yCAAoD;AACpD,+CAA0D;AAE1D,+CAA8C;AAG9C,mDAGyB;AAEzB,6DAA+E;AAG/E,MAAM,MAAM,GAAG,IAAA,mBAAS,EACtB,yDAAyD,CAC1D,CAAC;AASF,SAAS,oBAAoB,CAAC,OAA+B;IAC3D,IAAI,OAAO,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,kBAAkB,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,OAAO,CAAC,mBAAmB,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAQD,MAAa,2BACX,SAAQ,+BAAqB;IAS7B,YAAmB,UAA8C,EAAE;QACjE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,aAAa;YAChB,IAAA,4CAAuB,EACrB,OAAO,CAAC,aAAa,IAAI,iDAAiC,CAC3D,IAAI,iDAAiC,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;QAC7C,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QAEjC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBACzD,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI;gBACnD,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa;gBACnD,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;aACtC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;gBACrD,cAAc,EAAE,IAAI,CAAC,aAAa;gBAClC,WAAW,EAAE,IAAI,CAAC,SAAS;aAC5B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK;QACV,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACtE,CAAC;IAEM,MAAM,CAAC,UAA6B;QACzC,IAAI,CAAC,oBAAoB,GAAG,UAAU,IAAI,IAAI,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;YAC5C,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,IAAI;YACpC,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,IAAI;YAC9B,GAAG,EAAE,UAAU,EAAE,MAAM,IAAI,IAAI;SAChC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAC5B,KAAe,EACf,QAAsB,EACtB,OAA6B;QAE7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBAClD,WAAW,EAAE,QAAQ,CAAC,EAAE;gBACxB,eAAe,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;gBAC3C,MAAM,EAAE,iBAAiB;aAC1B,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,iBAAiB,GAAG,OAAiC,CAAC;QAE5D,IACE,oBAAoB,CAAC,iBAAiB,CAAC;YACvC,OAAO,CAAC,UAAU,KAAK,yBAAkB,CAAC,KAAK,EAC/C,CAAC;YACD,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;gBAC7C,IACE,UAAU,CAAC,OAAO,KAAK,KAAK;oBAC5B,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI;wBACvB,UAAU,CAAC,IAAI,KAAK,SAAS;wBAC7B,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,EAC5B,CAAC;oBACD,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;wBAClD,WAAW,EAAE,QAAQ,CAAC,EAAE;wBACxB,WAAW,EAAE,UAAU,CAAC,IAAI,IAAI,IAAI;wBACpC,cAAc,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI;qBAC3C,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE;gBAC5D,WAAW,EAAE,QAAQ,CAAC,EAAE;gBACxB,cAAc,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;gBAC5C,eAAe,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;aAC5C,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE;gBACvD,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,iBAAiB;aAC3B,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBAC1D,WAAW,EAAE,QAAQ,CAAC,EAAE;oBACxB,cAAc,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;oBAC5C,eAAe,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;iBAC5C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;oBAC7C,WAAW,EAAE,QAAQ,CAAC,EAAE;oBACxB,eAAe,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;oBAC3C,MAAM,EAAE,uBAAuB;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,IAAc;QACvC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBACzD,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS;gBAC7B,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa;aACpD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,OAAO,CAAC,iDAAiD,EAAE;gBAChE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS;aAC9B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE;gBAC9D,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,OAAO,IAAI;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,aAAa,CAAC,OAAe;QAClC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBACzD,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,IAAc;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;QACzB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE;gBACtE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS;aAC9B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;QACnD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CACV,qEAAqE,EACrE;gBACE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS;aAC9B,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GACT,OAAO,cAAc,CAAC,cAAc,KAAK,QAAQ;YACjD,cAAc,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACtC,CAAC,CAAC,cAAc,CAAC,cAAc;YAC/B,CAAC,CAAC,gBAAgB,CAAC;QACvB,MAAM,aAAa,GACjB,OAAO,cAAc,CAAC,iBAAiB,KAAK,QAAQ;YAClD,CAAC,CAAC,cAAc,CAAC,iBAAiB;YAClC,CAAC,CAAC,IAAI,CAAC;QAEX,IAAI,IAAI,CAAC,aAAa,KAAK,mCAAc,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;gBACnE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS;gBAC7B,KAAK,EAAE,uDAAuD;aAC/D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,+BAAe,EAAC;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,OAAO;gBACP,GAAG,EAAE,KAAK;gBACV,aAAa;gBACb,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;YACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAE1B,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBACzD,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,KAAK;gBACb,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;gBACnE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS;gBAC7B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,IAAI,CAAC;IACxC,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF;AA/ND,kEA+NC;AAED,SAAgB,iCAAiC,CAC/C,SAAoB;IAEpB,OAAO,IAAI,2BAA2B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,kBAAe,2BAA2B,CAAC"}

package/dist/cjs/naylence/fame/stickiness/aft-signer.js

@@ -0,0 +1,154 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignedAFTSigner = exports.NoAFTSigner = exports.UnsignedAFTSigner = void 0;
+exports.createAftSigner = createAftSigner;
+const jose_1 = require("jose");
+const runtime_1 = require("@naylence/runtime");
+const aft_model_js_1 = require("./aft-model.js");
+const aft_utils_js_1 = require("./aft-utils.js");
+const stickiness_mode_js_1 = require("./stickiness-mode.js");
+const logger = (0, runtime_1.getLogger)("naylence.fame.stickiness.aft_signer");
+class AbstractAFTSigner {
+    constructor(kid, maxTtlSec = 7200) {
+        this.kid = kid;
+        this.maxTtlSec = maxTtlSec;
+    }
+    clampTtl(ttlSec) {
+        const requested = typeof ttlSec === "number" && Number.isFinite(ttlSec)
+            ? Math.max(0, ttlSec)
+            : 0;
+        if (this.maxTtlSec <= 0) {
+            return 0;
+        }
+        if (requested <= 0) {
+            return Math.min(30, this.maxTtlSec);
+        }
+        return Math.min(Math.floor(requested), this.maxTtlSec);
+    }
+    createPayload(options, algorithm) {
+        const ttl = this.clampTtl(options.ttlSec);
+        return (0, aft_model_js_1.createAftPayload)({
+            sid: options.sid,
+            kid: this.kid,
+            algorithm,
+            ttlSeconds: ttl,
+            scope: options.scope ?? null,
+            clientSid: options.clientSid ?? null,
+        });
+    }
+}
+class UnsignedAFTSigner extends AbstractAFTSigner {
+    constructor(kid, maxTtlSec = 7200) {
+        super(kid, maxTtlSec);
+    }
+    get securityLevel() {
+        return stickiness_mode_js_1.StickinessMode.SIGNED_OPTIONAL;
+    }
+    async signAft(options) {
+        const payload = this.createPayload(options, "none");
+        const headerJson = (0, aft_model_js_1.serializeAftHeader)(payload.header);
+        const claimsJson = (0, aft_model_js_1.serializeAftClaims)(payload.claims);
+        const headerB64 = (0, aft_utils_js_1.base64UrlEncode)(headerJson);
+        const payloadB64 = (0, aft_utils_js_1.base64UrlEncode)(claimsJson);
+        return `${headerB64}.${payloadB64}.`;
+    }
+}
+exports.UnsignedAFTSigner = UnsignedAFTSigner;
+class NoAFTSigner extends AbstractAFTSigner {
+    constructor() {
+        super("none", 0);
+    }
+    get securityLevel() {
+        return stickiness_mode_js_1.StickinessMode.SID_ONLY;
+    }
+    async signAft() {
+        return "";
+    }
+}
+exports.NoAFTSigner = NoAFTSigner;
+class SignedAFTSigner extends AbstractAFTSigner {
+    constructor(options) {
+        super(options.kid, options.maxTtlSec ?? 7200);
+        this.cryptoKeyPromise = null;
+        this.privateKeyPem = options.privateKeyPem;
+        this.algorithm = options.algorithm ?? "EdDSA";
+    }
+    get securityLevel() {
+        return stickiness_mode_js_1.StickinessMode.STRICT;
+    }
+    async signAft(options) {
+        const payload = this.createPayload(options, this.algorithm);
+        const key = await this.resolveKey();
+        const claimsPayload = {
+            sid: payload.claims.sid,
+        };
+        if (typeof payload.claims.scp === "string" &&
+            payload.claims.scp.length > 0) {
+            claimsPayload.scp = payload.claims.scp;
+        }
+        if (typeof payload.claims.client_sid === "string" &&
+            payload.claims.client_sid.length > 0) {
+            claimsPayload.client_sid = payload.claims.client_sid;
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const exp = payload.claims.exp;
+        try {
+            const token = await new jose_1.SignJWT(claimsPayload)
+                .setProtectedHeader({ alg: this.algorithm, kid: this.kid })
+                .setIssuedAt(now)
+                .setExpirationTime(exp)
+                .sign(key);
+            return token;
+        }
+        catch (error) {
+            logger.error("aft_signing_failed", {
+                kid: this.kid,
+                algorithm: this.algorithm,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    async resolveKey() {
+        if (!this.cryptoKeyPromise) {
+            this.cryptoKeyPromise = (0, jose_1.importPKCS8)(this.privateKeyPem, this.algorithm).catch((error) => {
+                this.cryptoKeyPromise = null;
+                logger.error("aft_private_key_import_failed", {
+                    kid: this.kid,
+                    algorithm: this.algorithm,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                throw error instanceof Error ? error : new Error(String(error));
+            });
+        }
+        return this.cryptoKeyPromise;
+    }
+}
+exports.SignedAFTSigner = SignedAFTSigner;
+function createAftSigner(options) {
+    const { securityLevel, kid, privateKeyPem = null, algorithm = "EdDSA", maxTtlSec = 7200, } = options;
+    switch (securityLevel) {
+        case stickiness_mode_js_1.StickinessMode.STRICT: {
+            if (!privateKeyPem) {
+                throw new Error("Private key PEM required for strict security level");
+            }
+            return new SignedAFTSigner({ kid, privateKeyPem, algorithm, maxTtlSec });
+        }
+        case stickiness_mode_js_1.StickinessMode.SIGNED_OPTIONAL: {
+            if (privateKeyPem) {
+                return new SignedAFTSigner({
+                    kid,
+                    privateKeyPem,
+                    algorithm,
+                    maxTtlSec,
+                });
+            }
+            return new UnsignedAFTSigner(kid, maxTtlSec);
+        }
+        case stickiness_mode_js_1.StickinessMode.SID_ONLY:
+            return new NoAFTSigner();
+        default:
+            throw new Error(`Unknown security level: ${securityLevel}`);
+    }
+}
+//# sourceMappingURL=aft-signer.js.map

package/dist/cjs/naylence/fame/stickiness/aft-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aft-signer.js","sourceRoot":"","sources":["../../../../../src/naylence/fame/stickiness/aft-signer.ts"],"names":[],"mappings":";;;AAoMA,0CAgCC;AApOD,+BAA4C;AAC5C,+CAA8C;AAE9C,iDAKwB;AACxB,iDAAiD;AACjD,6DAAsD;AAEtD,MAAM,MAAM,GAAG,IAAA,mBAAS,EAAC,qCAAqC,CAAC,CAAC;AAchE,MAAe,iBAAiB;IAI9B,YAAsB,GAAW,EAAE,YAAoB,IAAI;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAMS,QAAQ,CAAC,MAA0B;QAC3C,MAAM,SAAS,GACb,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC;YACrB,CAAC,CAAC,CAAC,CAAC;QACR,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAES,aAAa,CACrB,OAAuB,EACvB,SAAiB;QAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,IAAA,+BAAgB,EAAC;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS;YACT,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAa,iBAAkB,SAAQ,iBAAiB;IACtD,YAAmB,GAAW,EAAE,YAAoB,IAAI;QACtD,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxB,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,mCAAc,CAAC,eAAe,CAAC;IACxC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,OAAuB;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEpD,MAAM,UAAU,GAAG,IAAA,iCAAkB,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAA,iCAAkB,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEtD,MAAM,SAAS,GAAG,IAAA,8BAAe,EAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,UAAU,CAAC,CAAC;QAE/C,OAAO,GAAG,SAAS,IAAI,UAAU,GAAG,CAAC;IACvC,CAAC;CACF;AApBD,8CAoBC;AAED,MAAa,WAAY,SAAQ,iBAAiB;IAChD;QACE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,mCAAc,CAAC,QAAQ,CAAC;IACjC,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AAZD,kCAYC;AAED,MAAa,eAAgB,SAAQ,iBAAiB;IAKpD,YAAmB,OAKlB;QACC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;QARxC,qBAAgB,GAA8B,IAAI,CAAC;QASzD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;IAChD,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,mCAAc,CAAC,MAAM,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,OAAuB;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAEpC,MAAM,aAAa,GAA4B;YAC7C,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;SACxB,CAAC;QAEF,IACE,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ;YACtC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAC7B,CAAC;YACD,aAAa,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QACzC,CAAC;QAED,IACE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ;YAC7C,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EACpC,CAAC;YACD,aAAa,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QACvD,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,cAAO,CAAC,aAAa,CAAC;iBAC3C,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;iBAC1D,WAAW,CAAC,GAAG,CAAC;iBAChB,iBAAiB,CAAC,GAAG,CAAC;iBACtB,IAAI,CAAC,GAAG,CAAC,CAAC;YAEb,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;gBACjC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAA,kBAAW,EACjC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,CACf,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAChB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;oBAC5C,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAjFD,0CAiFC;AAUD,SAAgB,eAAe,CAAC,OAA+B;IAC7D,MAAM,EACJ,aAAa,EACb,GAAG,EACH,aAAa,GAAG,IAAI,EACpB,SAAS,GAAG,OAAO,EACnB,SAAS,GAAG,IAAI,GACjB,GAAG,OAAO,CAAC;IAEZ,QAAQ,aAAa,EAAE,CAAC;QACtB,KAAK,mCAAc,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,mCAAc,CAAC,eAAe,CAAC,CAAC,CAAC;YACpC,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,IAAI,eAAe,CAAC;oBACzB,GAAG;oBACH,aAAa;oBACb,SAAS;oBACT,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,mCAAc,CAAC,QAAQ;YAC1B,OAAO,IAAI,WAAW,EAAE,CAAC;QAC3B;YACE,MAAM,IAAI,KAAK,CAAC,2BAA2B,aAAa,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/cjs/naylence/fame/stickiness/aft-utils.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.base64UrlEncode = base64UrlEncode;
+exports.base64UrlDecode = base64UrlDecode;
+exports.utf8Decode = utf8Decode;
+function toUint8Array(data) {
+    if (typeof data === "string") {
+        if (typeof TextEncoder !== "undefined") {
+            return new TextEncoder().encode(data);
+        }
+        if (typeof Buffer !== "undefined") {
+            return Buffer.from(data, "utf-8");
+        }
+        const arr = new Uint8Array(data.length);
+        for (let i = 0; i < data.length; i += 1) {
+            arr[i] = data.charCodeAt(i);
+        }
+        return arr;
+    }
+    return data;
+}
+function base64UrlEncode(data) {
+    const bytes = toUint8Array(data);
+    let base64;
+    if (typeof Buffer !== "undefined") {
+        base64 = Buffer.from(bytes).toString("base64");
+    }
+    else {
+        let binary = "";
+        const length = bytes.length ?? 0;
+        for (let i = 0; i < length; i += 1) {
+            const charCode = bytes[i];
+            if (charCode !== undefined) {
+                binary += String.fromCharCode(charCode);
+            }
+        }
+        if (typeof btoa === "function") {
+            base64 = btoa(binary);
+        }
+        else if (typeof globalThis !== "undefined" &&
+            "btoa" in globalThis &&
+            typeof globalThis.btoa === "function") {
+            base64 = globalThis.btoa(binary);
+        }
+        else {
+            throw new Error("No base64 encoder available in this environment");
+        }
+    }
+    return base64.replace(/=+$/u, "").replace(/\+/gu, "-").replace(/\//gu, "_");
+}
+function base64UrlDecode(data) {
+    const normalized = data.replace(/-/gu, "+").replace(/_/gu, "/");
+    const padding = normalized.length % 4 === 0 ? "" : "=".repeat(4 - (normalized.length % 4));
+    const base64 = normalized + padding;
+    if (typeof Buffer !== "undefined") {
+        return new Uint8Array(Buffer.from(base64, "base64"));
+    }
+    let binary;
+    if (typeof atob === "function") {
+        binary = atob(base64);
+    }
+    else if (typeof globalThis !== "undefined" &&
+        "atob" in globalThis &&
+        typeof globalThis.atob === "function") {
+        binary = globalThis.atob(base64);
+    }
+    else {
+        throw new Error("No base64 decoder available in this environment");
+    }
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) {
+        const charCode = binary.charCodeAt(i);
+        if (charCode !== undefined) {
+            bytes[i] = charCode;
+        }
+    }
+    return bytes;
+}
+function utf8Decode(data) {
+    if (typeof TextDecoder !== "undefined") {
+        return new TextDecoder().decode(data);
+    }
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(data).toString("utf-8");
+    }
+    let str = "";
+    for (let i = 0; i < data.length; i += 1) {
+        const charCode = data[i];
+        if (charCode !== undefined) {
+            str += String.fromCharCode(charCode);
+        }
+    }
+    return decodeURIComponent(escape(str));
+}
+//# sourceMappingURL=aft-utils.js.map

package/dist/cjs/naylence/fame/stickiness/aft-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aft-utils.js","sourceRoot":"","sources":["../../../../../src/naylence/fame/stickiness/aft-utils.ts"],"names":[],"mappings":";;AAoBA,0CA8BC;AAED,0CA8BC;AAED,gCAiBC;AArGD,SAAS,YAAY,CAAC,IAAyB;IAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,eAAe,CAAC,IAAyB;IACvD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,MAAc,CAAC;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;aAAM,IACL,OAAO,UAAU,KAAK,WAAW;YACjC,MAAM,IAAI,UAAU;YACpB,OAAQ,UAAiC,CAAC,IAAI,KAAK,UAAU,EAC7D,CAAC;YACD,MAAM,GAAI,UAAgD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,eAAe,CAAC,IAAY;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,OAAO,GACX,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IAEpC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;SAAM,IACL,OAAO,UAAU,KAAK,WAAW;QACjC,MAAM,IAAI,UAAU;QACpB,OAAQ,UAAiC,CAAC,IAAI,KAAK,UAAU,EAC7D,CAAC;QACD,MAAM,GAAI,UAAgD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,UAAU,CAAC,IAAgB;IACzC,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC"}