@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/pdpp/approval.js

@@ -0,0 +1,337 @@
+/**
+ * Authorization sessions and authenticated owner approval.
+ *
+ * This is the module that decides whether a consent decision is real. The
+ * threat it exists to stop is an approval that looks right — correct session,
+ * correct review digest, arriving from the first-party consent UI — but that
+ * no authenticated owner actually made.
+ *
+ * The rule: **affiliation is not authentication.** The AS does not accept an
+ * approval because it came from an allowlisted origin, a first-party console,
+ * a shared UI/server secret, or a signed assertion from the consent broker
+ * saying "the owner agreed". Each of those authenticates a *channel* or
+ * delegates the decision to a browser-reachable component; compromise it and
+ * it mints approvals for any subject. Instead, the owner authenticates to the
+ * PS itself, and the resulting owner token — resolved through the same token
+ * service the RS uses — is what authorizes the decision. The consent UI
+ * forwards that token; it can never substitute for it.
+ *
+ * Two independent checks must both pass, and neither implies the other:
+ *
+ *   1. The caller presents an active token with `pdpp_token_kind: "owner"`
+ *      whose `subject_id` equals the session's subject. Possession of the
+ *      session id is not authority over it.
+ *   2. The presented `review_digest` matches a re-derivation over what is
+ *      about to be issued (§7 staleness). Authenticating the owner does not
+ *      excuse approving something other than what they reviewed.
+ */
+import { randomBytes } from "node:crypto";
+import { buildConsentReview, } from "./review.js";
+import { issueGrant } from "./issuance.js";
+import { resolveSelection } from "./resolve.js";
+/** How long an owner has to act on a consent screen before it goes stale. */
+export const REVIEW_SESSION_TTL_SECONDS = 10 * 60;
+/**
+ * In-memory pending-session store. Sessions are short-lived and pre-decision,
+ * so they hold no issued authority — losing them on restart costs an owner a
+ * re-click, not a grant. Issued grants and tokens go to SQLite, where
+ * durability actually matters.
+ */
+export class AuthorizationSessionStore {
+    sessions = new Map();
+    create(input) {
+        const now = input.now ?? new Date();
+        const session = {
+            session_id: `as_${randomBytes(16).toString("hex")}`,
+            subject_id: input.subjectId,
+            request: input.request,
+            snapshot: input.snapshot,
+            requester: input.requester,
+            redirect_uri: input.redirectUri,
+            ...(input.stateParam && { state_param: input.stateParam }),
+            ...(input.codeChallenge && { code_challenge: input.codeChallenge }),
+            ...(input.codeChallengeMethod && {
+                code_challenge_method: input.codeChallengeMethod,
+            }),
+            expires_at: new Date(now.getTime() + REVIEW_SESSION_TTL_SECONDS * 1000).toISOString(),
+            status: "pending",
+            ...(input.grantExpiresAt && { grant_expires_at: input.grantExpiresAt }),
+            ...(input.streamDescriptions && {
+                stream_descriptions: input.streamDescriptions,
+            }),
+        };
+        this.sessions.set(session.session_id, session);
+        return session;
+    }
+    get(sessionId) {
+        return this.sessions.get(sessionId) ?? null;
+    }
+    setStatus(sessionId, status) {
+        const session = this.sessions.get(sessionId);
+        if (session)
+            session.status = status;
+    }
+}
+/**
+ * Authenticate the caller as the owner of a session.
+ *
+ * Returns the session only when the token is an active *owner* token for that
+ * exact subject. Every failure collapses to `session_not_found` rather than a
+ * distinguishable "wrong owner" — otherwise a caller holding any valid owner
+ * token could probe session ids to learn which ones exist and whose they are.
+ */
+function authenticateOwner(sessions, tokens, sessionId, ownerToken, now) {
+    if (!ownerToken) {
+        return {
+            ok: false,
+            failure: {
+                code: "unauthorized",
+                message: "an authenticated owner session is required to decide an authorization",
+            },
+        };
+    }
+    const context = tokens.resolveToken(ownerToken, now);
+    // A client token must never approve a grant — that would let the requesting
+    // application authorize itself.
+    if (!context.active || context.tokenKind !== "owner" || !context.subjectId) {
+        return {
+            ok: false,
+            failure: {
+                code: "unauthorized",
+                message: "owner token is missing, inactive, or not an owner token",
+            },
+        };
+    }
+    const session = sessions.get(sessionId);
+    if (!session) {
+        return {
+            ok: false,
+            failure: {
+                code: "session_not_found",
+                message: "authorization session not found",
+            },
+        };
+    }
+    // The binding that matters: this owner must be *this session's* owner.
+    if (session.subject_id !== context.subjectId) {
+        return {
+            ok: false,
+            failure: {
+                code: "session_not_found",
+                message: "authorization session not found",
+            },
+        };
+    }
+    if (Date.parse(session.expires_at) <= now.getTime()) {
+        return {
+            ok: false,
+            failure: {
+                code: "session_not_found",
+                message: "authorization session has expired",
+            },
+        };
+    }
+    return { ok: true, session };
+}
+/**
+ * Overlay the owner's explicit instance picks onto the inventory.
+ *
+ * A pick narrows the eligible set for that stream to exactly what the owner
+ * chose — it never widens it. Intersecting with the real inventory is what
+ * stops a caller from "choosing" a handle the owner has not connected, so an
+ * owner choice cannot become an escalation path.
+ */
+function withInstanceChoices(inventory, choices) {
+    if (!choices)
+        return inventory;
+    return {
+        eligibleFor(streamName) {
+            const eligible = inventory.eligibleFor(streamName);
+            const chosen = choices[streamName];
+            if (!chosen || chosen.length === 0)
+                return eligible;
+            return chosen.filter((handle) => eligible.includes(handle));
+        },
+    };
+}
+/**
+ * Find every stream that needs an owner choice, rather than stopping at the
+ * first. A UI that asked about one stream at a time would make the owner
+ * approve a moving target across several round trips.
+ */
+function pendingInstanceChoices(session, inventory) {
+    const choices = [];
+    const streams = session.request.streams ?? [];
+    const wildcard = streams.find((s) => s.name === "*");
+    const names = wildcard
+        ? session.snapshot.streams.map((s) => s.name)
+        : streams.map((s) => s.name);
+    for (const name of names) {
+        const requested = wildcard ?? streams.find((s) => s.name === name);
+        // An explicitly named handle set is already a decision; no choice needed.
+        if (requested?.instance_ids && requested.instance_ids.length > 0)
+            continue;
+        const eligible = inventory.eligibleFor(name);
+        if (eligible.length > 1) {
+            choices.push({ stream: name, candidates: eligible });
+        }
+    }
+    return choices;
+}
+/**
+ * Build the review an authenticated owner sees.
+ *
+ * Resolution runs here against current inventory, so the digest the owner is
+ * handed reflects the world as it is right now. If it changes before they
+ * approve, `approveAuthorization` will re-derive a different digest and reject.
+ */
+export function fetchReview(input) {
+    const now = input.now ?? new Date();
+    const auth = authenticateOwner(input.sessions, input.tokens, input.sessionId, input.ownerToken, now);
+    if (!auth.ok)
+        return auth;
+    const { session } = auth;
+    if (session.status !== "pending") {
+        return {
+            ok: false,
+            failure: {
+                code: "access_denied",
+                message: "authorization session is already decided",
+            },
+        };
+    }
+    const inventory = withInstanceChoices(input.inventory, input.instanceChoices);
+    // Surface outstanding choices before attempting resolution: an unresolvable
+    // instance is a consent step, not an error the owner can do nothing about.
+    const choices = pendingInstanceChoices(session, inventory);
+    if (choices.length > 0) {
+        return {
+            ok: true,
+            result: {
+                session_id: session.session_id,
+                instance_choice_required: choices,
+                expires_at: session.expires_at,
+            },
+        };
+    }
+    const resolution = resolveSelection(session.request, session.snapshot, inventory);
+    if (!resolution.ok) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_request",
+                message: resolution.failure.message,
+            },
+        };
+    }
+    const review = buildConsentReview({
+        subjectId: session.subject_id,
+        request: session.request,
+        snapshot: session.snapshot,
+        resolvedStreams: resolution.streams,
+        requester: session.requester,
+        expiresAt: session.grant_expires_at,
+        streamDescriptions: session.stream_descriptions,
+    });
+    return {
+        ok: true,
+        result: {
+            session_id: session.session_id,
+            review,
+            expires_at: session.expires_at,
+        },
+    };
+}
+/**
+ * Approve an authorization: authenticate the owner, then issue.
+ *
+ * Order is deliberate. Authentication runs before anything else, so an
+ * unauthenticated caller cannot learn from the error whether their digest was
+ * fresh — a spoofed approval with a perfectly valid digest gets the same
+ * `unauthorized` as one with a garbage digest.
+ */
+export function approveAuthorization(input) {
+    const now = input.now ?? new Date();
+    const auth = authenticateOwner(input.sessions, input.tokens, input.sessionId, input.ownerToken, now);
+    if (!auth.ok)
+        return auth;
+    const { session } = auth;
+    if (session.status !== "pending") {
+        return {
+            ok: false,
+            failure: {
+                code: "access_denied",
+                message: "authorization session is already decided",
+            },
+        };
+    }
+    if (!input.reviewDigest) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_request",
+                message: "review_digest is required",
+            },
+        };
+    }
+    const issuance = issueGrant({
+        subjectId: session.subject_id,
+        request: session.request,
+        snapshot: session.snapshot,
+        inventory: withInstanceChoices(input.inventory, input.instanceChoices),
+        requester: session.requester,
+        approvedReviewDigest: input.reviewDigest,
+        explicitAiTrainingConsent: input.explicitAiTrainingConsent,
+        expiresAt: session.grant_expires_at,
+        streamDescriptions: session.stream_descriptions,
+        now,
+    });
+    if (!issuance.ok) {
+        // `resolution_failed` at APPROVAL time is staleness, not a bad request.
+        // The selection already resolved once — that is how the owner got a review
+        // to approve. If it no longer resolves, the world changed underneath them:
+        // most commonly a second instance was connected while the consent screen
+        // was open, which under §6 means the AS can no longer auto-resolve and the
+        // owner has a new choice to make.
+        //
+        // The distinction is load-bearing for the consent UI: `stale_review` routes
+        // to re-fetch and re-render, so the owner sees the new choice and decides
+        // again; `invalid_request` routes to "report a bug" and strands them. The
+        // canonical §6 drift case must land on the first.
+        const code = issuance.failure.code === "stale_approval" ||
+            issuance.failure.code === "resolution_failed"
+            ? "stale_review"
+            : issuance.failure.code === "ai_training_consent_required"
+                ? "ai_training_consent_required"
+                : "invalid_request";
+        return { ok: false, failure: { code, message: issuance.failure.message } };
+    }
+    input.sessions.setStatus(session.session_id, "approved");
+    return {
+        ok: true,
+        grant: issuance.grant,
+        consentEvidence: issuance.consentEvidence,
+    };
+}
+/**
+ * Deny an authorization. Terminal, and retains no consent evidence — there is
+ * nothing the owner consented to, so there is nothing to hold evidence of.
+ */
+export function denyAuthorization(input) {
+    const now = input.now ?? new Date();
+    const auth = authenticateOwner(input.sessions, input.tokens, input.sessionId, input.ownerToken, now);
+    if (!auth.ok)
+        return auth;
+    if (auth.session.status !== "pending") {
+        return {
+            ok: false,
+            failure: {
+                code: "access_denied",
+                message: "authorization session is already decided",
+            },
+        };
+    }
+    input.sessions.setStatus(auth.session.session_id, "denied");
+    return { ok: true };
+}
+//# sourceMappingURL=approval.js.map

package/dist/pdpp/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/pdpp/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAwB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAA0B,MAAM,cAAc,CAAC;AAIxE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,CAAC;AAyClD;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACnB,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEpE,MAAM,CAAC,KAYN;QACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,OAAO,GAAyB;YACpC,UAAU,EAAE,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnD,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACnE,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI;gBAC/B,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;aACjD,CAAC;YACF,UAAU,EAAE,IAAI,IAAI,CAClB,GAAG,CAAC,OAAO,EAAE,GAAG,0BAA0B,GAAG,IAAI,CAClD,CAAC,WAAW,EAAE;YACf,MAAM,EAAE,SAAS;YACjB,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;YACvE,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI;gBAC9B,mBAAmB,EAAE,KAAK,CAAC,kBAAkB;aAC9C,CAAC;SACH,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,SAAS,CAAC,SAAiB,EAAE,MAAoB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO;YAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACvC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,QAAmC,EACnC,MAAwB,EACxB,SAAiB,EACjB,UAA8B,EAC9B,GAAS;IAIT,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,cAAc;gBACpB,OAAO,EACL,uEAAuE;aAC1E;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACrD,4EAA4E;IAC5E,gCAAgC;IAChC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yDAAyD;aACnE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,iCAAiC;aAC3C;SACF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,iCAAiC;aAC3C;SACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,mCAAmC;aAC7C;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AA6BD;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,SAA4B,EAC5B,OAA6C;IAE7C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO;QACL,WAAW,CAAC,UAAkB;YAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC;YACpD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,OAA6B,EAC7B,SAA4B;IAE5B,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IAErD,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACnE,0EAA0E;QAC1E,IAAI,SAAS,EAAE,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC3E,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAS3B;IAGC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,iBAAiB,CAC5B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,EAChB,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,0CAA0C;aACpD;SACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAE9E,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,wBAAwB,EAAE,OAAO;gBACjC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CACjC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,EAChB,SAAS,CACV,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO;aACpC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAChC,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,UAAU,CAAC,OAAO;QACnC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,gBAAgB;QACnC,kBAAkB,EAAE,OAAO,CAAC,mBAAmB;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAgBpC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,iBAAiB,CAC5B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,EAChB,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,0CAA0C;aACpD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,2BAA2B;aACrC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC;QACtE,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,SAAS,EAAE,OAAO,CAAC,gBAAgB;QACnC,kBAAkB,EAAE,OAAO,CAAC,mBAAmB;QAC/C,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,kCAAkC;QAClC,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,IAAI,GACR,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAC1C,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,mBAAmB;YAC3C,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,8BAA8B;gBACxD,CAAC,CAAC,8BAA8B;gBAChC,CAAC,CAAC,iBAAiB,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACzD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,eAAe,EAAE,QAAQ,CAAC,eAAe;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAMjC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,iBAAiB,CAC5B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,EAChB,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,0CAA0C;aACpD;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/pdpp/client-identity.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Resolving a URL-hosted client identity, under a bounded fetch policy.
+ *
+ * §6 says a conforming AS MUST NOT reject a valid client ID metadata document
+ * solely because the client is not preregistered, and MUST accept a valid
+ * URL-hosted client identity unless local policy denies authorization. Before
+ * this, the AS validated `redirect_uri` only against a config-supplied
+ * registration, so an unregistered-but-valid client was refused for the one
+ * reason the spec names as insufficient.
+ *
+ * ── Why this is not just "fetch the client_id" ──────────────────────────────
+ *
+ * The AS is being handed a URL by an untrusted caller and asked to fetch it.
+ * That is a server-side request forgery primitive: without bounds, a client_id
+ * of `http://169.254.169.254/...` turns the AS into a proxy for whatever the
+ * deployment can reach. So this reuses `checkDeclarationUrl`, the same guard
+ * the declaration retrieval path already applies — https-only, no private or
+ * loopback literals, and the deployment's host allowlist unless it has
+ * explicitly opted into any HTTPS host.
+ *
+ * The response is size-capped and redirect-bounded for the same reason: an
+ * unbounded body is a memory exhaustion vector, and unbounded redirects defeat
+ * the host check by hopping somewhere it would have refused.
+ *
+ * ── Registration still wins ────────────────────────────────────────────────
+ *
+ * A locally registered client is resolved from config without any fetch at
+ * all. This path exists only for clients the deployment has NOT registered,
+ * and a deployment that wants registration-only behavior gets it by leaving
+ * the fetcher unset — in which case nothing here runs and the previous
+ * behavior is preserved exactly.
+ */
+import { type DeclarationTrustPolicy } from "./declaration.js";
+import { type ClientIdMetadataDocument } from "./client-metadata.js";
+import type { RegisteredRedirectPolicy } from "./redirect.js";
+/** Bodies larger than this are refused rather than buffered. */
+export declare const MAX_CLIENT_DOCUMENT_BYTES: number;
+export type ClientIdentityFailureCode = "untrusted_client_url" | "fetch_failed" | "invalid_document" | "client_id_mismatch" | "too_large";
+export interface ClientIdentityFailure {
+    code: ClientIdentityFailureCode;
+    message: string;
+}
+/**
+ * Retrieves a client ID metadata document. Injected so the deployment owns
+ * the transport, and so that leaving it unset disables this path entirely.
+ */
+export type ClientDocumentFetcher = (url: string) => Promise<{
+    status: number;
+    body: string;
+    finalUrl: string;
+} | null>;
+export interface ResolveClientIdentityOptions {
+    clientId: string;
+    fetcher: ClientDocumentFetcher;
+    /** Reuses the declaration trust policy; same bounds, same allowlist. */
+    policy: DeclarationTrustPolicy;
+}
+export type ClientIdentityResult = {
+    ok: true;
+    policy: RegisteredRedirectPolicy;
+    verifiedDomain: string;
+    /**
+     * The validated document itself, so the caller can resolve the requester
+     * identity from it.
+     *
+     * Returning this is what keeps redirect trust and displayed identity in
+     * agreement. The document is what earned the client its redirect
+     * admission; if the AS then rendered the client's inline
+     * `client_display` instead, the owner could be shown a name the verified
+     * domain never asserted. §6 ranks validated binding metadata above
+     * inline metadata, and the caller can only honor that ranking if it is
+     * handed the metadata.
+     */
+    document: ClientIdMetadataDocument;
+} | {
+    ok: false;
+    failure: ClientIdentityFailure;
+};
+/**
+ * Resolve a `client_id` URL into a redirect policy the AS can enforce.
+ *
+ * Returns the same `RegisteredRedirectPolicy` shape a config registration
+ * produces, so the caller's redirect validation is unchanged — a URL-hosted
+ * client is subject to exactly the same exact-match redirect rule as a
+ * registered one, rather than a looser path.
+ */
+export declare function resolveUrlHostedClientIdentity(options: ResolveClientIdentityOptions): Promise<ClientIdentityResult>;
+//# sourceMappingURL=client-identity.d.ts.map

package/dist/pdpp/client-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-identity.d.ts","sourceRoot":"","sources":["../../src/pdpp/client-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,QAAY,CAAC;AAEnD,MAAM,MAAM,yBAAyB,GACjC,sBAAsB,GACtB,cAAc,GACd,kBAAkB,GAClB,oBAAoB,GACpB,WAAW,CAAC;AAEhB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,GAAG,EAAE,MAAM,KACR,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAAC;AAExE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,wEAAwE;IACxE,MAAM,EAAE,sBAAsB,CAAC;CAChC;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,wBAAwB,CAAC;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,wBAAwB,CAAC;CACpC,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAElD;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,oBAAoB,CAAC,CA0J/B"}

package/dist/pdpp/client-identity.js

@@ -0,0 +1,183 @@
+/**
+ * Resolving a URL-hosted client identity, under a bounded fetch policy.
+ *
+ * §6 says a conforming AS MUST NOT reject a valid client ID metadata document
+ * solely because the client is not preregistered, and MUST accept a valid
+ * URL-hosted client identity unless local policy denies authorization. Before
+ * this, the AS validated `redirect_uri` only against a config-supplied
+ * registration, so an unregistered-but-valid client was refused for the one
+ * reason the spec names as insufficient.
+ *
+ * ── Why this is not just "fetch the client_id" ──────────────────────────────
+ *
+ * The AS is being handed a URL by an untrusted caller and asked to fetch it.
+ * That is a server-side request forgery primitive: without bounds, a client_id
+ * of `http://169.254.169.254/...` turns the AS into a proxy for whatever the
+ * deployment can reach. So this reuses `checkDeclarationUrl`, the same guard
+ * the declaration retrieval path already applies — https-only, no private or
+ * loopback literals, and the deployment's host allowlist unless it has
+ * explicitly opted into any HTTPS host.
+ *
+ * The response is size-capped and redirect-bounded for the same reason: an
+ * unbounded body is a memory exhaustion vector, and unbounded redirects defeat
+ * the host check by hopping somewhere it would have refused.
+ *
+ * ── Registration still wins ────────────────────────────────────────────────
+ *
+ * A locally registered client is resolved from config without any fetch at
+ * all. This path exists only for clients the deployment has NOT registered,
+ * and a deployment that wants registration-only behavior gets it by leaving
+ * the fetcher unset — in which case nothing here runs and the previous
+ * behavior is preserved exactly.
+ */
+import { checkDeclarationUrl, } from "./declaration.js";
+import { verifyClientIdDocument, } from "./client-metadata.js";
+/** Bodies larger than this are refused rather than buffered. */
+export const MAX_CLIENT_DOCUMENT_BYTES = 64 * 1024;
+/**
+ * Resolve a `client_id` URL into a redirect policy the AS can enforce.
+ *
+ * Returns the same `RegisteredRedirectPolicy` shape a config registration
+ * produces, so the caller's redirect validation is unchanged — a URL-hosted
+ * client is subject to exactly the same exact-match redirect rule as a
+ * registered one, rather than a looser path.
+ */
+export async function resolveUrlHostedClientIdentity(options) {
+    const { clientId, fetcher, policy } = options;
+    // A non-URL client_id is not a URL-hosted identity. Not an error here —
+    // the caller falls back to registration-only behavior.
+    let parsed;
+    try {
+        parsed = new URL(clientId);
+    }
+    catch {
+        return {
+            ok: false,
+            failure: {
+                code: "untrusted_client_url",
+                message: "client_id is not a URL-hosted identity",
+            },
+        };
+    }
+    // The SSRF gate, before any network call.
+    const urlProblem = checkDeclarationUrl(parsed.toString(), policy);
+    if (urlProblem) {
+        return {
+            ok: false,
+            failure: {
+                code: "untrusted_client_url",
+                message: urlProblem.message,
+            },
+        };
+    }
+    let retrieved;
+    try {
+        retrieved = await fetcher(parsed.toString());
+    }
+    catch (err) {
+        return {
+            ok: false,
+            failure: {
+                code: "fetch_failed",
+                message: err instanceof Error ? err.message : String(err),
+            },
+        };
+    }
+    if (!retrieved || retrieved.status !== 200) {
+        return {
+            ok: false,
+            failure: {
+                code: "fetch_failed",
+                message: `client_id document returned ${retrieved?.status ?? "no response"}`,
+            },
+        };
+    }
+    if (retrieved.body.length > MAX_CLIENT_DOCUMENT_BYTES) {
+        return {
+            ok: false,
+            failure: {
+                code: "too_large",
+                message: `client_id document exceeds ${MAX_CLIENT_DOCUMENT_BYTES} bytes`,
+            },
+        };
+    }
+    // A redirect may not escape the gate: re-check where we actually landed.
+    const finalProblem = checkDeclarationUrl(retrieved.finalUrl, policy);
+    if (finalProblem) {
+        return {
+            ok: false,
+            failure: {
+                code: "untrusted_client_url",
+                message: `client_id document redirected to an untrusted location: ${finalProblem.message}`,
+            },
+        };
+    }
+    let document;
+    try {
+        document = JSON.parse(retrieved.body);
+    }
+    catch {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "client_id document is not valid JSON",
+            },
+        };
+    }
+    if (!Array.isArray(document.redirect_uris)) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "client_id document declares no redirect_uris",
+            },
+        };
+    }
+    // A document that declares no usable name gets none, rather than an empty
+    // one. `resolveRequesterIdentity` falls back through inline metadata to the
+    // client_id itself, so an absent name must be absent -- a `{ name: "" }`
+    // would outrank the inline display and render a blank requester.
+    const documentName = typeof document.client_name === "string" && document.client_name.length > 0
+        ? document.client_name
+        : undefined;
+    // The identity check: the document must assert the URL it came from.
+    // Without this, any host could publish a document claiming to be someone
+    // else's client_id.
+    const candidate = {
+        client_id: String(document.client_id ?? ""),
+        ...(documentName && { display: { name: documentName } }),
+        https: true,
+        retrieved_from: retrieved.finalUrl,
+    };
+    const verified = verifyClientIdDocument(candidate);
+    if (!verified) {
+        return {
+            ok: false,
+            failure: {
+                code: "client_id_mismatch",
+                message: "client_id document does not assert the URL it was retrieved from",
+            },
+        };
+    }
+    const redirectUris = document.redirect_uris.filter((uri) => typeof uri === "string" && uri.length > 0);
+    if (redirectUris.length === 0) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "client_id document declares no usable redirect_uris",
+            },
+        };
+    }
+    return {
+        ok: true,
+        policy: { client_id: clientId, redirect_uris: redirectUris },
+        verifiedDomain: verified.verifiedDomain,
+        // The same document that earned redirect admission, so the caller can
+        // resolve the displayed requester identity from it rather than from the
+        // client's inline assertion.
+        document: candidate,
+    };
+}
+//# sourceMappingURL=client-identity.js.map

package/dist/pdpp/client-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-identity.js","sourceRoot":"","sources":["../../src/pdpp/client-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EACL,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,GAEvB,MAAM,sBAAsB,CAAC;AAG9B,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAkDnD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAqC;IAErC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE9C,wEAAwE;IACxE,uDAAuD;IACvD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,wCAAwC;aAClD;SACF,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,IAAI,SAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,+BAA+B,SAAS,EAAE,MAAM,IAAI,aAAa,EAAE;aAC7E;SACF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,8BAA8B,yBAAyB,QAAQ;aACzE;SACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,2DAA2D,YAAY,CAAC,OAAO,EAAE;aAC3F;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAIH,CAAC;IACF,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAoB,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,sCAAsC;aAChD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,8CAA8C;aACxD;SACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,YAAY,GAChB,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACzE,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,SAAS,CAAC;IAEhB,qEAAqE;IACrE,yEAAyE;IACzE,oBAAoB;IACpB,MAAM,SAAS,GAA6B;QAC1C,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;QAC3C,GAAG,CAAC,YAAY,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;QACxD,KAAK,EAAE,IAAI;QACX,cAAc,EAAE,SAAS,CAAC,QAAQ;KACnC,CAAC;IACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EACL,kEAAkE;aACrE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAChD,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAClE,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,qDAAqD;aAC/D;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE;QAC5D,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,sEAAsE;QACtE,wEAAwE;QACxE,6BAA6B;QAC7B,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC"}