@opendatalabs/personal-server-ts-core 1.33.8 → 1.34.1

package/dist/pdpp/approval.js

@@ -0,0 +1,467 @@
+/**
+ * Authorization sessions and authenticated owner approval.
+ *
+ * This is the module that decides whether a consent decision is real. The
+ * threat it exists to stop is an approval that looks right — correct session,
+ * correct review digest, arriving from the first-party consent UI — but that
+ * no authenticated owner actually made.
+ *
+ * The rule: **affiliation is not authentication.** The AS does not accept an
+ * approval because it came from an allowlisted origin, a first-party console,
+ * a shared UI/server secret, or a signed assertion from the consent broker
+ * saying "the owner agreed". Each of those authenticates a *channel* or
+ * delegates the decision to a browser-reachable component; compromise it and
+ * it mints approvals for any subject. Instead, the owner authenticates to the
+ * PS itself, and the resulting owner token — resolved through the same token
+ * service the RS uses — is what authorizes the decision. The consent UI
+ * forwards that token; it can never substitute for it.
+ *
+ * Two independent checks must both pass, and neither implies the other:
+ *
+ *   1. The caller presents an active token with `pdpp_token_kind: "owner"`
+ *      whose `subject_id` equals the session's subject. Possession of the
+ *      session id is not authority over it.
+ *   2. The presented `review_digest` matches a re-derivation over what is
+ *      about to be issued (§7 staleness). Authenticating the owner does not
+ *      excuse approving something other than what they reviewed.
+ */
+import { randomBytes } from "node:crypto";
+import { buildConsentReview, } from "./review.js";
+import { issueGrant } from "./issuance.js";
+import { expandSelections, resolveSelection, } from "./resolve.js";
+import { resolveCommitments } from "./commitments.js";
+/** How long an owner has to act on a consent screen before it goes stale. */
+export const REVIEW_SESSION_TTL_SECONDS = 10 * 60;
+/**
+ * In-memory pending-session store. Sessions are short-lived and pre-decision,
+ * so they hold no issued authority — losing them on restart costs an owner a
+ * re-click, not a grant. Issued grants and tokens go to SQLite, where
+ * durability actually matters.
+ */
+export class AuthorizationSessionStore {
+    sessions = new Map();
+    create(input) {
+        const now = input.now ?? new Date();
+        const session = {
+            session_id: `as_${randomBytes(16).toString("hex")}`,
+            subject_id: input.subjectId,
+            request: input.request,
+            snapshot: input.snapshot,
+            requester: input.requester,
+            redirect_uri: input.redirectUri,
+            ...(input.stateParam && { state_param: input.stateParam }),
+            ...(input.codeChallenge && { code_challenge: input.codeChallenge }),
+            ...(input.codeChallengeMethod && {
+                code_challenge_method: input.codeChallengeMethod,
+            }),
+            expires_at: new Date(now.getTime() + REVIEW_SESSION_TTL_SECONDS * 1000).toISOString(),
+            status: "pending",
+            ...(input.grantExpiresAt && { grant_expires_at: input.grantExpiresAt }),
+            ...(input.streamDescriptions && {
+                stream_descriptions: input.streamDescriptions,
+            }),
+        };
+        this.sessions.set(session.session_id, session);
+        return session;
+    }
+    get(sessionId) {
+        return this.sessions.get(sessionId) ?? null;
+    }
+    setStatus(sessionId, status) {
+        const session = this.sessions.get(sessionId);
+        if (session)
+            session.status = status;
+    }
+    /**
+     * Retain the owner's reason for denying, beside the denial itself.
+     *
+     * Kept on the session rather than in the grant store because there is no
+     * grant: a denial produces no authorization, and the reason is the owner's
+     * note about a decision, not a term of one.
+     */
+    setDenialReason(sessionId, reason) {
+        const session = this.sessions.get(sessionId);
+        if (session)
+            session.denial_reason = reason;
+    }
+}
+/**
+ * Authenticate the caller as the owner of a session.
+ *
+ * Returns the session only when the token is an active *owner* token for that
+ * exact subject. Every failure collapses to `session_not_found` rather than a
+ * distinguishable "wrong owner" — otherwise a caller holding any valid owner
+ * token could probe session ids to learn which ones exist and whose they are.
+ */
+function authenticateOwner(sessions, tokens, sessionId, ownerToken, now) {
+    if (!ownerToken) {
+        return {
+            ok: false,
+            failure: {
+                code: "unauthorized",
+                message: "an authenticated owner session is required to decide an authorization",
+            },
+        };
+    }
+    const context = tokens.resolveToken(ownerToken, now);
+    // A client token must never approve a grant — that would let the requesting
+    // application authorize itself.
+    if (!context.active || context.tokenKind !== "owner" || !context.subjectId) {
+        return {
+            ok: false,
+            failure: {
+                code: "unauthorized",
+                message: "owner token is missing, inactive, or not an owner token",
+            },
+        };
+    }
+    const session = sessions.get(sessionId);
+    if (!session) {
+        return {
+            ok: false,
+            failure: {
+                code: "session_not_found",
+                message: "authorization session not found",
+            },
+        };
+    }
+    // The binding that matters: this owner must be *this session's* owner.
+    if (session.subject_id !== context.subjectId) {
+        return {
+            ok: false,
+            failure: {
+                code: "session_not_found",
+                message: "authorization session not found",
+            },
+        };
+    }
+    if (Date.parse(session.expires_at) <= now.getTime()) {
+        return {
+            ok: false,
+            failure: {
+                code: "session_not_found",
+                message: "authorization session has expired",
+            },
+        };
+    }
+    return { ok: true, session };
+}
+/**
+ * Overlay the owner's explicit instance picks onto the inventory.
+ *
+ * A pick narrows the eligible set for that stream to exactly what the owner
+ * chose — it never widens it. Intersecting with the real inventory is what
+ * stops a caller from "choosing" a handle the owner has not connected, so an
+ * owner choice cannot become an escalation path.
+ */
+function withInstanceChoices(inventory, choices) {
+    if (!choices)
+        return inventory;
+    return {
+        eligibleFor(streamName) {
+            const eligible = inventory.eligibleFor(streamName);
+            const chosen = choices[streamName];
+            if (!chosen || chosen.length === 0)
+                return eligible;
+            return chosen.filter((handle) => eligible.includes(handle));
+        },
+    };
+}
+/**
+ * Find every stream that needs an owner choice, rather than stopping at the
+ * first. A UI that asked about one stream at a time would make the owner
+ * approve a moving target across several round trips.
+ *
+ * The streams are expanded by `expandSelections` — the same function
+ * resolution uses — so the three ways of naming streams (an explicit list, a
+ * wildcard, a `selection_preset`) all reach this step. They must: "omission
+ * is not fan-in, the owner picks" is a property of the request, not of the
+ * syntax it was written in.
+ *
+ * Deriving the list here instead let a preset expand to nothing, so the owner
+ * was never offered a choice, while resolution expanded it to a stream with
+ * two eligible instances and returned `instance_choice_required` — which this
+ * module then reported as an invalid request. A valid preset was unapprovable
+ * on any source with two connected instances, and the owner had no way to
+ * move. Sharing the expansion is what makes that class of divergence
+ * impossible rather than merely fixed.
+ */
+function pendingInstanceChoices(session, inventory) {
+    const choices = [];
+    for (const stream of expandSelections(session.request, session.snapshot)) {
+        // An explicitly named handle set is already a decision; no choice needed.
+        if (stream.instance_ids && stream.instance_ids.length > 0)
+            continue;
+        const eligible = inventory.eligibleFor(stream.name);
+        if (eligible.length > 1) {
+            choices.push({ stream: stream.name, candidates: eligible });
+        }
+    }
+    return choices;
+}
+/**
+ * This client's currently-active grants for this owner, newest first —
+ * excludes revoked, expired, and consumed single-use grants, and never
+ * carries tokens, consent evidence, or review digests: informational only.
+ */
+function existingActiveGrantsForClient(store, subjectId, clientId, now, instanceIds) {
+    return store
+        .listGrantsForSubject(subjectId)
+        .filter((stored) => stored.clientId === clientId)
+        .filter((stored) => store.grantStatus(stored, now) === "active" &&
+        !(stored.grant.access_mode === "single_use" && stored.consumedAt))
+        .filter((stored) => instanceIds
+        ? stored.grant.streams.every((stream) => stream.instance_ids.every((instanceId) => instanceIds.includes(instanceId)))
+        : true)
+        .map((stored) => ({
+        grant_id: stored.grant.grant_id,
+        issued_at: stored.grant.issued_at,
+        ...(stored.grant.expires_at && { expires_at: stored.grant.expires_at }),
+        access_mode: stored.grant.access_mode,
+        purpose_code: stored.grant.purpose_code,
+        streams: stored.grant.streams.map((s) => ({
+            name: s.name,
+            fields: s.fields,
+        })),
+    }));
+}
+/**
+ * Build the review an authenticated owner sees.
+ *
+ * Resolution runs here against current inventory, so the digest the owner is
+ * handed reflects the world as it is right now. If it changes before they
+ * approve, `approveAuthorization` will re-derive a different digest and reject.
+ */
+export function fetchReview(input) {
+    const now = input.now ?? new Date();
+    const auth = authenticateOwner(input.sessions, input.tokens, input.sessionId, input.ownerToken, now);
+    if (!auth.ok)
+        return auth;
+    const { session } = auth;
+    if (session.status !== "pending") {
+        return {
+            ok: false,
+            failure: {
+                code: "access_denied",
+                message: "authorization session is already decided",
+            },
+        };
+    }
+    if (requestsFanIn(session.request, session.snapshot, input.instanceChoices)) {
+        return {
+            ok: false,
+            failure: {
+                code: "unsupported_instance_fan_in",
+                message: "Select one connection per stream",
+            },
+        };
+    }
+    const inventory = withInstanceChoices(input.inventory, input.instanceChoices);
+    // Surface outstanding choices before attempting resolution: an unresolvable
+    // instance is a consent step, not an error the owner can do nothing about.
+    const choices = pendingInstanceChoices(session, inventory);
+    if (choices.length > 0) {
+        return {
+            ok: true,
+            result: {
+                session_id: session.session_id,
+                instance_choice_required: choices,
+                expires_at: session.expires_at,
+            },
+        };
+    }
+    const resolution = resolveSelection(session.request, session.snapshot, inventory, input.ownerChoices);
+    if (!resolution.ok) {
+        // A narrowing incompatible with the request's own requirements is the
+        // owner's choice colliding with the client's floor, not a malformed
+        // request. Reporting it as `access_denied` is what lets the consent UI
+        // say "this combination cannot be approved" and let the owner adjust,
+        // rather than routing them to a bug report.
+        const refused = resolution.failure.code === "minimum_not_met" ||
+            resolution.failure.code === "required_stream_declined" ||
+            resolution.failure.code === "no_streams_approved";
+        return {
+            ok: false,
+            failure: {
+                code: refused ? "selection_refused" : "invalid_request",
+                message: resolution.failure.message,
+            },
+        };
+    }
+    // Resolved before the review is built, so an uncovered owner condition is
+    // reported to the surface rather than thrown out of `buildConsentReview`.
+    // v0.2 requires the owner to see the resolved commitments before approving,
+    // which means there is no review to show when they cannot be resolved.
+    const commitments = resolveCommitments({
+        request: session.request,
+        ownerConditions: input.ownerConditions,
+        standingTerms: input.standingTerms,
+        declarationVersion: session.snapshot.version,
+    });
+    if (!commitments.ok) {
+        return {
+            ok: false,
+            failure: {
+                code: "recipient_terms_unsupported",
+                message: commitments.failure.message,
+            },
+        };
+    }
+    const review = buildConsentReview({
+        commitments: commitments.commitments,
+        subjectId: session.subject_id,
+        request: session.request,
+        snapshot: session.snapshot,
+        resolvedStreams: resolution.streams,
+        omittedStreams: resolution.omittedStreams,
+        requestedStreams: resolution.requestedStreams,
+        requester: session.requester,
+        expiresAt: session.grant_expires_at,
+        streamDescriptions: session.stream_descriptions,
+        existingGrants: input.store
+            ? existingActiveGrantsForClient(input.store, session.subject_id, session.requester.client_id, now, input.existingGrantInstanceIds)
+            : undefined,
+    });
+    return {
+        ok: true,
+        result: {
+            session_id: session.session_id,
+            review,
+            expires_at: session.expires_at,
+        },
+    };
+}
+/**
+ * Approve an authorization: authenticate the owner, then issue.
+ *
+ * Order is deliberate. Authentication runs before anything else, so an
+ * unauthenticated caller cannot learn from the error whether their digest was
+ * fresh — a spoofed approval with a perfectly valid digest gets the same
+ * `unauthorized` as one with a garbage digest.
+ *
+ * This function does not mark the session `"approved"` — it only decides
+ * whether the review is valid and computes what to issue. The session
+ * transitions to `"approved"` only once the caller has durably persisted the
+ * grant and its authorization code (see `pdpp-auth.ts`'s approve route). A
+ * session marked approved before that write lands would leave a caller whose
+ * persistence failed with no way to retry: the session is already terminal
+ * (`status !== "pending"` above), so a retry of the same reviewed approval
+ * would be rejected as already-decided even though nothing durable exists.
+ */
+export function approveAuthorization(input) {
+    const now = input.now ?? new Date();
+    const auth = authenticateOwner(input.sessions, input.tokens, input.sessionId, input.ownerToken, now);
+    if (!auth.ok)
+        return auth;
+    const { session } = auth;
+    if (session.status !== "pending") {
+        return {
+            ok: false,
+            failure: {
+                code: "access_denied",
+                message: "authorization session is already decided",
+            },
+        };
+    }
+    if (requestsFanIn(session.request, session.snapshot, input.instanceChoices)) {
+        return {
+            ok: false,
+            failure: {
+                code: "unsupported_instance_fan_in",
+                message: "Select one connection per stream",
+            },
+        };
+    }
+    if (!input.reviewDigest) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_request",
+                message: "review_digest is required",
+            },
+        };
+    }
+    const issuance = issueGrant({
+        subjectId: session.subject_id,
+        request: session.request,
+        snapshot: session.snapshot,
+        inventory: withInstanceChoices(input.inventory, input.instanceChoices),
+        ownerChoices: input.ownerChoices,
+        ownerConditions: input.ownerConditions,
+        standingTerms: input.standingTerms,
+        requester: session.requester,
+        approvedReviewDigest: input.reviewDigest,
+        explicitAiTrainingConsent: input.explicitAiTrainingConsent,
+        expiresAt: session.grant_expires_at,
+        streamDescriptions: session.stream_descriptions,
+        now,
+    });
+    if (!issuance.ok) {
+        // `resolution_failed` at APPROVAL time is staleness, not a bad request.
+        // The selection already resolved once — that is how the owner got a review
+        // to approve. If it no longer resolves, the world changed underneath them:
+        // most commonly a second instance was connected while the consent screen
+        // was open, which under §6 means the AS can no longer auto-resolve and the
+        // owner has a new choice to make.
+        //
+        // The distinction is load-bearing for the consent UI: `stale_review` routes
+        // to re-fetch and re-render, so the owner sees the new choice and decides
+        // again; `invalid_request` routes to "report a bug" and strands them. The
+        // canonical §6 drift case must land on the first.
+        const code = issuance.failure.code === "stale_approval" ||
+            issuance.failure.code === "resolution_failed"
+            ? "stale_review"
+            : issuance.failure.code === "ai_training_consent_required"
+                ? "ai_training_consent_required"
+                : // v0.2 names `access_denied` for a refused issuance: a required
+                    // stream declined, a required minimum the narrowing cannot meet,
+                    // or an empty approval. It is not staleness — re-reviewing
+                    // changes nothing while the same choices stand — and not an
+                    // invalid request, since the client sent a well-formed one.
+                    issuance.failure.code === "access_denied"
+                        ? "selection_refused"
+                        : issuance.failure.code === "recipient_terms_unsupported"
+                            ? "recipient_terms_unsupported"
+                            : "invalid_request";
+        return { ok: false, failure: { code, message: issuance.failure.message } };
+    }
+    return {
+        ok: true,
+        grant: issuance.grant,
+        consentEvidence: issuance.consentEvidence,
+    };
+}
+function requestsFanIn(request, snapshot, choices) {
+    return expandSelections(request, snapshot).some((stream) => {
+        const ids = choices?.[stream.name] ?? stream.instance_ids ?? [];
+        return new Set(ids).size > 1;
+    });
+}
+/**
+ * Deny an authorization. Terminal, and retains no consent evidence — there is
+ * nothing the owner consented to, so there is nothing to hold evidence of.
+ */
+export function denyAuthorization(input) {
+    const now = input.now ?? new Date();
+    const auth = authenticateOwner(input.sessions, input.tokens, input.sessionId, input.ownerToken, now);
+    if (!auth.ok)
+        return auth;
+    if (auth.session.status !== "pending") {
+        return {
+            ok: false,
+            failure: {
+                code: "access_denied",
+                message: "authorization session is already decided",
+            },
+        };
+    }
+    input.sessions.setStatus(auth.session.session_id, "denied");
+    // Trimmed, and only when it carries something: an empty box is not a reason,
+    // and retaining "" would make a denial look annotated when it was not.
+    const reason = input.reason?.trim();
+    if (reason) {
+        input.sessions.setDenialReason(auth.session.session_id, reason);
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=approval.js.map

package/dist/pdpp/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/pdpp/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,kBAAkB,GAInB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAwB,MAAM,eAAe,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAStD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,CAAC;AA8DlD;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACnB,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEpE,MAAM,CAAC,KAYN;QACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,OAAO,GAAyB;YACpC,UAAU,EAAE,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnD,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACnE,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI;gBAC/B,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;aACjD,CAAC;YACF,UAAU,EAAE,IAAI,IAAI,CAClB,GAAG,CAAC,OAAO,EAAE,GAAG,0BAA0B,GAAG,IAAI,CAClD,CAAC,WAAW,EAAE;YACf,MAAM,EAAE,SAAS;YACjB,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;YACvE,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI;gBAC9B,mBAAmB,EAAE,KAAK,CAAC,kBAAkB;aAC9C,CAAC;SACH,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,SAAS,CAAC,SAAiB,EAAE,MAAoB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO;YAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,SAAiB,EAAE,MAAc;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO;YAAE,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,QAAmC,EACnC,MAAwB,EACxB,SAAiB,EACjB,UAA8B,EAC9B,GAAS;IAIT,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,cAAc;gBACpB,OAAO,EACL,uEAAuE;aAC1E;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACrD,4EAA4E;IAC5E,gCAAgC;IAChC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yDAAyD;aACnE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,iCAAiC;aAC3C;SACF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,iCAAiC;aAC3C;SACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,mCAAmC;aAC7C;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AA6BD;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,SAA4B,EAC5B,OAA6C;IAE7C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO;QACL,WAAW,CAAC,UAAkB;YAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC;YACpD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,sBAAsB,CAC7B,OAA6B,EAC7B,SAA4B;IAE5B,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,KAAK,MAAM,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,0EAA0E;QAC1E,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CACpC,KAAoB,EACpB,SAAiB,EACjB,QAAgB,EAChB,GAAS,EACT,WAAsB;IAEtB,OAAO,KAAK;SACT,oBAAoB,CAAC,SAAS,CAAC;SAC/B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAChD,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,QAAQ;QAC3C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,CACpE;SACA,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACjB,WAAW;QACT,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CACpC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CACvC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CACjC,CACF;QACH,CAAC,CAAC,IAAI,CACT;SACA,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;QAC/B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACvE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;QACrC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;QACvC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAgC3B;IAGC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,iBAAiB,CAC5B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,EAChB,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,0CAA0C;aACpD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,kCAAkC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAE9E,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,wBAAwB,EAAE,OAAO;gBACjC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CACjC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,EAChB,SAAS,EACT,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,4CAA4C;QAC5C,MAAM,OAAO,GACX,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,iBAAiB;YAC7C,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,0BAA0B;YACtD,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAqB,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB;gBACvD,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO;aACpC;SACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,WAAW,GAAG,kBAAkB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,kBAAkB,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO;aACrC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAChC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,UAAU,CAAC,OAAO;QACnC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,gBAAgB;QACnC,kBAAkB,EAAE,OAAO,CAAC,mBAAmB;QAC/C,cAAc,EAAE,KAAK,CAAC,KAAK;YACzB,CAAC,CAAC,6BAA6B,CAC3B,KAAK,CAAC,KAAK,EACX,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,SAAS,CAAC,SAAS,EAC3B,GAAG,EACH,KAAK,CAAC,wBAAwB,CAC/B;YACH,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KA8BpC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,iBAAiB,CAC5B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,EAChB,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,0CAA0C;aACpD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,kCAAkC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,2BAA2B;aACrC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC;QACtE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QAC1D,SAAS,EAAE,OAAO,CAAC,gBAAgB;QACnC,kBAAkB,EAAE,OAAO,CAAC,mBAAmB;QAC/C,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,kCAAkC;QAClC,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,IAAI,GACR,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAC1C,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,mBAAmB;YAC3C,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,8BAA8B;gBACxD,CAAC,CAAC,8BAA8B;gBAChC,CAAC,CAAC,gEAAgE;oBAChE,iEAAiE;oBACjE,2DAA2D;oBAC3D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe;wBACzC,CAAC,CAAC,mBAAmB;wBACrB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,6BAA6B;4BACvD,CAAC,CAAC,6BAA6B;4BAC/B,CAAC,CAAC,iBAAiB,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,eAAe,EAAE,QAAQ,CAAC,eAAe;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAyB,EACzB,QAA6B,EAC7B,OAA6C;IAE7C,OAAO,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACzD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAChE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAmBjC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,iBAAiB,CAC5B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,EAChB,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,0CAA0C;aACpD;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5D,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/pdpp/client-identity.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Resolving a URL-hosted client identity, under a bounded fetch policy.
+ *
+ * §6 says a conforming AS MUST NOT reject a valid client ID metadata document
+ * solely because the client is not preregistered, and MUST accept a valid
+ * URL-hosted client identity unless local policy denies authorization. Before
+ * this, the AS validated `redirect_uri` only against a config-supplied
+ * registration, so an unregistered-but-valid client was refused for the one
+ * reason the spec names as insufficient.
+ *
+ * ── Why this is not just "fetch the client_id" ──────────────────────────────
+ *
+ * The AS is being handed a URL by an untrusted caller and asked to fetch it.
+ * That is a server-side request forgery primitive: without bounds, a client_id
+ * of `http://169.254.169.254/...` turns the AS into a proxy for whatever the
+ * deployment can reach. So this reuses `checkDeclarationUrl`, the same guard
+ * the declaration retrieval path already applies — https-only, no private or
+ * loopback literals, and the deployment's host allowlist unless it has
+ * explicitly opted into any HTTPS host.
+ *
+ * The response is size-capped and redirect-bounded for the same reason: an
+ * unbounded body is a memory exhaustion vector, and unbounded redirects defeat
+ * the host check by hopping somewhere it would have refused.
+ *
+ * ── Registration still wins ────────────────────────────────────────────────
+ *
+ * A locally registered client is resolved from config without any fetch at
+ * all. This path exists only for clients the deployment has NOT registered,
+ * and a deployment that wants registration-only behavior gets it by leaving
+ * the fetcher unset — in which case nothing here runs and the previous
+ * behavior is preserved exactly.
+ */
+import { type DeclarationTrustPolicy } from "./declaration.js";
+import { type ClientIdMetadataDocument } from "./client-metadata.js";
+import type { RegisteredRedirectPolicy } from "./redirect.js";
+/** Bodies larger than this are refused rather than buffered. */
+export declare const MAX_CLIENT_DOCUMENT_BYTES: number;
+export type ClientIdentityFailureCode = "untrusted_client_url" | "fetch_failed" | "invalid_document" | "client_id_mismatch" | "too_large";
+export interface ClientIdentityFailure {
+    code: ClientIdentityFailureCode;
+    message: string;
+}
+/**
+ * Retrieves a client ID metadata document. Injected so the deployment owns
+ * the transport, and so that leaving it unset disables this path entirely.
+ */
+export type ClientDocumentFetcher = (url: string) => Promise<{
+    status: number;
+    body: string;
+    finalUrl: string;
+} | null>;
+export interface ResolveClientIdentityOptions {
+    clientId: string;
+    fetcher: ClientDocumentFetcher;
+    /** Reuses the declaration trust policy; same bounds, same allowlist. */
+    policy: DeclarationTrustPolicy;
+}
+export type ClientIdentityResult = {
+    ok: true;
+    policy: RegisteredRedirectPolicy;
+    verifiedDomain: string;
+    /**
+     * The validated document itself, so the caller can resolve the requester
+     * identity from it.
+     *
+     * Returning this is what keeps redirect trust and displayed identity in
+     * agreement. The document is what earned the client its redirect
+     * admission; if the AS then rendered the client's inline
+     * `client_display` instead, the owner could be shown a name the verified
+     * domain never asserted. §6 ranks validated binding metadata above
+     * inline metadata, and the caller can only honor that ranking if it is
+     * handed the metadata.
+     */
+    document: ClientIdMetadataDocument;
+} | {
+    ok: false;
+    failure: ClientIdentityFailure;
+};
+/**
+ * Resolve a `client_id` URL into a redirect policy the AS can enforce.
+ *
+ * Returns the same `RegisteredRedirectPolicy` shape a config registration
+ * produces, so the caller's redirect validation is unchanged — a URL-hosted
+ * client is subject to exactly the same exact-match redirect rule as a
+ * registered one, rather than a looser path.
+ */
+export declare function resolveUrlHostedClientIdentity(options: ResolveClientIdentityOptions): Promise<ClientIdentityResult>;
+//# sourceMappingURL=client-identity.d.ts.map

package/dist/pdpp/client-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-identity.d.ts","sourceRoot":"","sources":["../../src/pdpp/client-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,QAAY,CAAC;AAEnD,MAAM,MAAM,yBAAyB,GACjC,sBAAsB,GACtB,cAAc,GACd,kBAAkB,GAClB,oBAAoB,GACpB,WAAW,CAAC;AAEhB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,GAAG,EAAE,MAAM,KACR,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAAC;AAExE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,wEAAwE;IACxE,MAAM,EAAE,sBAAsB,CAAC;CAChC;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,wBAAwB,CAAC;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,wBAAwB,CAAC;CACpC,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAElD;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAyK/B"}