@proof-holdings/delegation-verifier 0.1.0 → 0.2.0

package/dist/jwks.js

@@ -1,30 +1,57 @@
 /**
- * JWKS retrieval and key cache.
+ * JWKS retrieval and key cache — the I/O half. The rules a fetched key set is held to (merge,
+ * tombstones, purpose, window) live in `keyset.ts`; this file decides WHEN to fetch and what to
+ * answer when a fetch fails.
  *
- * Three behaviours here are load-bearing rather than tidy, all learned from the hand-rolled Go
- * verifier that shipped before this package:
+ * Behaviours that are load-bearing rather than tidy, the first three learned from the hand-rolled
+ * Go verifier that shipped before this package:
  *
  *   - The algorithm is chosen from THIS list, never from the token's own header. A token that
  *     asks for `none` or for an HMAC is refused before any key is looked up.
- *   - An unknown `kid` is indistinguishable from a rotated key, so a miss triggers at most one
- *     refetch per cooldown window. Without it every junk-kid token costs one outbound request
- *     and a busy verifier trips the issuer's rate limit — failing its GOOD tokens too.
+ *   - An unknown `kid` is indistinguishable from a rotated (or emergency) key, so a miss triggers
+ *     at most one refetch per cooldown window. Without it every junk-kid token costs one outbound
+ *     request and a busy verifier trips the issuer's rate limit — failing its GOOD tokens too.
  *   - Concurrent misses share ONE in-flight fetch per key set, with the cache re-checked after
  *     it resolves. Serialising is what makes the cooldown hold under concurrency.
+ *   - A failed refetch does not discard a cached key set. Under `maxJwksAgeMs` its CONFIRMED keys
+ *     keep answering (a kid they do not cover is `jwks_unavailable`: it may be new); over it the answer
+ *     is `jwks_stale` — except for an applied tombstone, which is `key_revoked` at any age. A set
+ *     that was never fetched has no cache to fall back on, so its failure stays `jwks_unavailable`
+ *     and is retried on every call.
+ *   - Age is measured on a monotonic clock in-process. Only what is persisted uses wall clock.
  */
 import { isRecord } from './jwt.js';
+import { checkKeyPolicy, deserializeKeySetState, emptyKeySetState, isRegistryLive, mergeFetchedDocument, selectKeys, serializeKeySetState, withConfirmedKeysOnly, withoutTombstones, withPersistedTombstones, } from './keyset.js';
 export const SUPPORTED_ALGORITHMS = ['RS256', 'ES256'];
-/** How long a `kid` miss suppresses further refetches of the same key set. */
+/** How long a `kid` miss — or a failed refetch of a cached set — suppresses further fetches. */
 export const KEY_MISS_COOLDOWN_MS = 30_000;
 /** How long a successfully fetched key set is reused without refetching. */
 export const KEY_SET_TTL_MS = 10 * 60_000;
+/** Default `maxJwksAgeMs`. */
+export const DEFAULT_MAX_JWKS_AGE_MS = 24 * 60 * 60_000;
+/** Largest accepted `maxJwksAgeMs` — below the issuer's ~30-day lead on its next key. */
+export const MAX_JWKS_AGE_CAP_MS = 25 * 24 * 60 * 60_000;
+/** Bound on a JWKS fetch and on each `keySetStore` call when the caller passes no `timeoutMs`. */
+const DEFAULT_IO_TIMEOUT_MS = 5_000;
 /**
  * A key set is kilobytes. Anything larger is not a JWKS, and the request is driven by input the
  * verifier does not control, so it is capped rather than streamed to completion.
  */
 export const MAX_REMOTE_BODY_BYTES = 512 * 1024;
+const systemClock = {
+    monotonicMs: () => performance.now(),
+    wallMs: () => Date.now(),
+};
+let clock = systemClock;
+/** Test seam — replaces both clocks; `null` restores the system clocks. Not exported publicly. */
+export function setJwksClockForTests(replacement) {
+    clock = replacement ?? systemClock;
+}
+function readClock() {
+    return { monotonicMs: clock.monotonicMs(), wallMs: clock.wallMs() };
+}
 const cache = new Map();
-/** Test seam — drops every cached key set. */
+/** Test seam — drops every cached key set, tombstones included. */
 export function resetJwksCache() {
     cache.clear();
 }
@@ -34,31 +61,93 @@ export class JwksUnavailableError extends Error {
         this.name = 'JwksUnavailableError';
     }
 }
-function importParams(alg) {
-    if (alg === 'ES256') {
-        return {
-            algorithm: { name: 'ECDSA', namedCurve: 'P-256' },
-            verify: { name: 'ECDSA', hash: 'SHA-256' },
+function entryFor(jwksUri) {
+    let entry = cache.get(jwksUri);
+    if (!entry) {
+        entry = {
+            state: emptyKeySetState(),
+            imported: new Map(),
+            lastMissAt: null,
+            lastFailedAt: null,
+            inFlight: null,
+            storeLoaded: null,
+            storeLoadFailed: false,
         };
+        cache.set(jwksUri, entry);
     }
-    return {
-        algorithm: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
-        verify: { name: 'RSASSA-PKCS1-v1_5' },
-    };
-}
-export function isSupportedAlgorithm(alg) {
-    return typeof alg === 'string' && SUPPORTED_ALGORITHMS.includes(alg);
+    return entry;
 }
-async function importJwk(jwk, alg) {
+function emit(options, jwksUri, event) {
+    if (!options.onJwksEvent)
+        return;
     try {
-        const { algorithm } = importParams(alg);
-        return await crypto.subtle.importKey('jwk', jwk, algorithm, false, ['verify']);
+        options.onJwksEvent({ ...event, jwksUri });
     }
     catch {
-        return null;
+        // A throwing listener must not turn into a verification failure.
+    }
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** A store is the caller's code: a call that never settles must not hang every verification. */
+async function boundedStoreCall(call, timeoutMs) {
+    let timer;
+    const timedOut = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timed out after ${timeoutMs} ms`)), timeoutMs);
+    });
+    try {
+        return await Promise.race([Promise.resolve().then(call), timedOut]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function loadFromStore(entry, jwksUri, options) {
+    const store = options.keySetStore;
+    if (!store || entry.storeLoaded) {
+        if (entry.storeLoaded)
+            await entry.storeLoaded;
+        return;
+    }
+    entry.storeLoaded = (async () => {
+        try {
+            const raw = await boundedStoreCall(() => store.load(jwksUri), options.timeoutMs ?? DEFAULT_IO_TIMEOUT_MS);
+            if (typeof raw !== 'string')
+                return;
+            const loaded = deserializeKeySetState(raw, readClock());
+            if (!loaded) {
+                emit(options, jwksUri, { type: 'store_error', message: 'keySetStore.load returned a state this version cannot read' });
+                return;
+            }
+            // A set fetched in this process before the store was first offered is newer than disk —
+            // except for its tombstones, which no later fetch can restore.
+            entry.state = entry.state.fetchedAt === null ? loaded : withPersistedTombstones(entry.state, loaded);
+        }
+        catch (error) {
+            entry.storeLoadFailed = true;
+            emit(options, jwksUri, { type: 'store_error', message: `keySetStore.load failed: ${errorMessage(error)}` });
+        }
+    })();
+    await entry.storeLoaded;
+}
+async function saveToStore(entry, jwksUri, options) {
+    const store = options.keySetStore;
+    if (!store)
+        return;
+    if (entry.storeLoadFailed) {
+        emit(options, jwksUri, { type: 'store_error', message: 'keySetStore.save skipped: the persisted state could not be loaded, and saving would overwrite it' });
+        return;
+    }
+    const serialized = serializeKeySetState(entry.state);
+    try {
+        await boundedStoreCall(() => store.save(jwksUri, serialized), options.timeoutMs ?? DEFAULT_IO_TIMEOUT_MS);
+    }
+    catch (error) {
+        emit(options, jwksUri, { type: 'store_error', message: `keySetStore.save failed: ${errorMessage(error)}` });
     }
 }
-async function fetchKeySet(entry, jwksUri, alg, fetchImpl, timeoutMs) {
+async function fetchDocument(jwksUri, fetchImpl, timeoutMs) {
     const response = await fetchImpl(jwksUri, {
         signal: AbortSignal.timeout(timeoutMs),
         headers: { accept: 'application/json' },
@@ -86,91 +175,165 @@ async function fetchKeySet(entry, jwksUri, alg, fetchImpl, timeoutMs) {
     if (!isRecord(body) || !Array.isArray(body.keys)) {
         throw new JwksUnavailableError('JWKS response has no `keys` array');
     }
-    const keys = new Map();
-    const anonymousKeys = [];
-    for (const candidate of body.keys) {
-        if (!isRecord(candidate))
-            continue;
-        // A key set may legitimately mix algorithms; only the ones usable for THIS verification
-        // are imported, and an unusable entry is skipped rather than failing the whole set.
-        if (typeof candidate.alg === 'string' && candidate.alg !== alg)
-            continue;
-        const key = await importJwk(candidate, alg);
-        if (!key)
-            continue;
-        if (typeof candidate.kid === 'string' && candidate.kid.length > 0) {
-            keys.set(candidate.kid, key);
+    return body;
+}
+/**
+ * Fetch and merge once per key set at a time. The shared promise RESOLVES to the outcome rather
+ * than recording it on the entry: a waiter reading shared state after its await could be handed
+ * the state of the NEXT fetch — and a waiter that only saw an empty key set would report
+ * `unknown_key` ("this token names a key that does not exist") for what is actually "I could not
+ * reach the issuer": a false forgery signal during an outage.
+ */
+function runFetch(entry, jwksUri, params) {
+    if (entry.inFlight)
+        return entry.inFlight;
+    const running = (async () => {
+        let failure;
+        try {
+            const body = await fetchDocument(jwksUri, params.fetch, params.timeoutMs);
+            const merged = mergeFetchedDocument(entry.state, body, readClock());
+            for (const event of merged.events)
+                emit(params, jwksUri, event);
+            if (merged.accepted) {
+                entry.state = merged.state;
+                entry.lastFailedAt = null;
+                await saveToStore(entry, jwksUri, params);
+                return { ok: true };
+            }
+            failure = merged.events[0]?.message ?? 'JWKS refused';
         }
-        else {
-            anonymousKeys.push(key);
+        catch (error) {
+            failure = error instanceof JwksUnavailableError ? error.message : errorMessage(error) || 'JWKS fetch failed';
         }
+        // The failure cooldown applies only to a set with a cache to fall back on; a set that was
+        // never fetched is retried on every call, exactly as before.
+        if (entry.state.fetchedAt !== null)
+            entry.lastFailedAt = clock.monotonicMs();
+        return { ok: false, message: failure };
+    })();
+    entry.inFlight = running;
+    void running.finally(() => {
+        if (entry.inFlight === running)
+            entry.inFlight = null;
+    });
+    return running;
+}
+function cacheAgeMs(state, now) {
+    if (state.fetchedAt === null || state.fetchedAtUntrusted)
+        return Number.POSITIVE_INFINITY;
+    return now - state.fetchedAt.monotonicMs;
+}
+function isFresh(state, now) {
+    return cacheAgeMs(state, now) < KEY_SET_TTL_MS;
+}
+function importParams(alg) {
+    if (alg === 'ES256') {
+        return {
+            algorithm: { name: 'ECDSA', namedCurve: 'P-256' },
+            verify: { name: 'ECDSA', hash: 'SHA-256' },
+        };
+    }
+    return {
+        algorithm: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+        verify: { name: 'RSASSA-PKCS1-v1_5' },
+    };
+}
+export function isSupportedAlgorithm(alg) {
+    return typeof alg === 'string' && SUPPORTED_ALGORITHMS.includes(alg);
+}
+async function importRecord(entry, record, alg) {
+    // A key set may legitimately mix algorithms; a key declared for another one is not a candidate.
+    if (typeof record.jwk.alg === 'string' && record.jwk.alg !== alg)
+        return null;
+    // A key the JWKS marks for anything but signatures is not a candidate (RFC 7517 §4.2, §4.3). Only
+    // the material is handed to `importKey`, so these members would otherwise go unread — and the
+    // check precedes the import cache, which is keyed by material and shared across kids.
+    const { use, key_ops: keyOps } = record.jwk;
+    if (use !== undefined && use !== 'sig')
+        return null;
+    if (keyOps !== undefined && !(Array.isArray(keyOps) && keyOps.includes('verify')))
+        return null;
+    const cacheKey = `${record.fingerprint}|${alg}`;
+    if (entry.imported.has(cacheKey))
+        return entry.imported.get(cacheKey) ?? null;
+    let key = null;
+    try {
+        const { kty, crv, x, y, n, e } = record.jwk;
+        const material = Object.fromEntries(Object.entries({ kty, crv, x, y, n, e }).filter(([, value]) => value !== undefined));
+        key = await crypto.subtle.importKey('jwk', material, importParams(alg).algorithm, false, ['verify']);
+    }
+    catch {
+        key = null;
     }
-    entry.keys = keys;
-    entry.anonymousKeys = anonymousKeys;
-    entry.fetchedAt = Date.now();
+    entry.imported.set(cacheKey, key);
+    return key;
 }
-function lookup(entry, kid) {
-    if (kid) {
-        const key = entry.keys.get(kid);
-        return key ? [key] : [];
+async function resolveFromState(entry, state, kid, family, alg) {
+    const selection = selectKeys(state, kid, family);
+    if (selection.kind !== 'candidates')
+        return selection;
+    const candidates = [];
+    for (const record of selection.records) {
+        const key = await importRecord(entry, record, alg);
+        if (key)
+            candidates.push({ key, record });
     }
-    // No `kid` in the header: every key in the set is a candidate.
-    return [...entry.anonymousKeys, ...entry.keys.values()];
+    if (candidates.length === 0)
+        return { kind: 'unknown' };
+    return { kind: 'keys', candidates, registryLive: isRegistryLive(state) };
+}
+function candidateCount(state, family) {
+    const selection = selectKeys(state, undefined, family);
+    return selection.kind === 'candidates' ? selection.records.length : 0;
 }
 /**
- * Candidate verification keys for `kid`, fetching the key set at most once per cooldown.
- * Returns an empty array when the key is genuinely unknown; throws `JwksUnavailableError`
- * when the key set could not be read at all ("I could not check" is not "the token is bad").
+ * The keys that may verify a token of `family` carrying `kid` — or why none may. Fetches the key
+ * set when it is older than the TTL, or once per cooldown when `kid` is unknown.
  */
-export async function getVerificationKeys(params) {
-    const cacheKey = `${params.jwksUri}|${params.alg}`;
-    let entry = cache.get(cacheKey);
-    if (!entry) {
-        entry = {
-            keys: new Map(),
-            anonymousKeys: [],
-            fetchedAt: 0,
-            lastMissAt: 0,
-            inFlight: null,
-        };
-        cache.set(cacheKey, entry);
-    }
-    const fresh = entry.fetchedAt > 0 && Date.now() - entry.fetchedAt < KEY_SET_TTL_MS;
-    const hit = lookup(entry, params.kid);
-    if (fresh && hit.length > 0)
-        return hit;
-    if (fresh && Date.now() - entry.lastMissAt < KEY_MISS_COOLDOWN_MS) {
-        return []; // Cooldown: a miss we already paid a request for.
-    }
-    const current = entry;
-    if (!current.inFlight) {
-        const running = fetchKeySet(current, params.jwksUri, params.alg, params.fetch, params.timeoutMs);
-        // The shared promise RESOLVES to the outcome rather than recording it on the entry: a
-        // waiter reading shared state after its await could be handed the state of the NEXT
-        // fetch. Carried, not stored — a waiter that only saw an empty key set would report
-        // `unknown_key` ("this token names a key that does not exist") for what is actually
-        // "I could not reach the issuer": a false forgery signal during an outage.
-        current.inFlight = running.then(() => null, (error) => error instanceof JwksUnavailableError
-            ? error
-            : new JwksUnavailableError(error instanceof Error ? error.message : 'JWKS fetch failed'));
-        const settled = current.inFlight;
-        settled.finally(() => {
-            if (current.inFlight === settled)
-                current.inFlight = null;
-        });
-        const failure = await settled;
-        if (failure)
-            throw failure;
-    }
-    else {
-        const failure = await current.inFlight;
-        if (failure)
-            throw failure;
-    }
-    const after = lookup(current, params.kid);
-    if (after.length === 0)
-        current.lastMissAt = Date.now();
-    return after;
+export async function resolveVerificationKeys(params) {
+    const entry = entryFor(params.jwksUri);
+    await loadFromStore(entry, params.jwksUri, params);
+    const now = clock.monotonicMs();
+    if (isFresh(entry.state, now)) {
+        const cached = await resolveFromState(entry, entry.state, params.kid, params.family, params.alg);
+        if (cached.kind !== 'unknown')
+            return cached;
+        if (entry.lastMissAt !== null && now - entry.lastMissAt < KEY_MISS_COOLDOWN_MS) {
+            // Cooldown: no refetch. The kid may have been published since the last one, so this is
+            // "could not check", not "this key does not exist".
+            return { kind: 'unavailable', message: 'unknown key; the key set is refetched again after the cooldown' };
+        }
+    }
+    const recentlyFailed = entry.state.fetchedAt !== null && entry.lastFailedAt !== null && now - entry.lastFailedAt < KEY_MISS_COOLDOWN_MS;
+    const outcome = recentlyFailed
+        ? { ok: false, message: 'JWKS refetch failed recently; it is retried after the cooldown' }
+        : await runFetch(entry, params.jwksUri, params);
+    if (!outcome.ok) {
+        if (entry.state.fetchedAt === null)
+            return { kind: 'unavailable', message: outcome.message };
+        // An applied tombstone is final whatever the cache's age: no refetch could lift it.
+        const known = selectKeys(entry.state, params.kid, params.family);
+        if (known.kind === 'revoked')
+            return known;
+        const age = cacheAgeMs(entry.state, clock.monotonicMs());
+        if (age > params.maxJwksAgeMs) {
+            return { kind: 'stale', cacheAgeSeconds: Number.isFinite(age) ? Math.floor(age / 1000) : null };
+        }
+        // Only confirmed keys answer from a cache we failed to refresh (`withConfirmedKeysOnly`).
+        const fallback = withConfirmedKeysOnly(entry.state);
+        // A no-kid token tries every candidate: if the fallback lost one, a signature that matches none
+        // of the rest may still be that key's — "could not check", not a forgery.
+        if (params.kid === undefined && candidateCount(fallback, params.family) < candidateCount(entry.state, params.family)) {
+            return { kind: 'unavailable', message: outcome.message };
+        }
+        const cached = await resolveFromState(entry, fallback, params.kid, params.family, params.alg);
+        // An unknown kid we could not refetch may be a key the issuer just added: "could not check".
+        return cached.kind === 'unknown' ? { kind: 'unavailable', message: outcome.message } : cached;
+    }
+    const resolved = await resolveFromState(entry, entry.state, params.kid, params.family, params.alg);
+    if (resolved.kind === 'unknown')
+        entry.lastMissAt = clock.monotonicMs();
+    return resolved;
 }
 /** Verify a JWS signature against one candidate key. */
 export async function verifySignature(key, alg, signingInput, signature) {
@@ -182,4 +345,64 @@ export async function verifySignature(key, alg, signingInput, signature) {
         return false;
     }
 }
+/**
+ * Signature first, then the window and lifetime of the key that verified it — so a forged token
+ * is reported as `bad_signature`, not as a policy violation of a key it never came from.
+ */
+export async function verifyWithCandidates(resolution, alg, signingInput, signature, token) {
+    for (const candidate of resolution.candidates) {
+        if (await verifySignature(candidate.key, alg, signingInput, signature)) {
+            return checkKeyPolicy(candidate.record, token, resolution.registryLive) ?? 'ok';
+        }
+    }
+    return 'bad_signature';
+}
+/**
+ * Refetch a key set now, ignoring the TTL and cooldowns — the method a `jwks_stale` answer names.
+ * Resolves with the outcome rather than throwing.
+ */
+export async function refreshJwks(params) {
+    const entry = entryFor(params.jwksUri);
+    await loadFromStore(entry, params.jwksUri, params);
+    return runFetch(entry, params.jwksUri, {
+        ...params,
+        fetch: params.fetch ?? ((input, init) => fetch(input, init)),
+        timeoutMs: params.timeoutMs ?? DEFAULT_IO_TIMEOUT_MS,
+    });
+}
+/**
+ * Forget every applied and pending tombstone — the documented manual reset. With `jwksUri`, only
+ * that key set (and, given a `keySetStore`, its persisted copy); without, every set in memory.
+ */
+export async function clearTombstones(params = {}) {
+    const uris = params.jwksUri !== undefined ? [params.jwksUri] : [...cache.keys()];
+    for (const jwksUri of uris) {
+        const entry = entryFor(jwksUri);
+        await loadFromStore(entry, jwksUri, params);
+        entry.state = withoutTombstones(entry.state);
+        await saveToStore(entry, jwksUri, params);
+    }
+}
+/** What the verifier currently holds for one key set, or null if it has never been used. */
+export function getJwksDiagnostics(jwksUri) {
+    const entry = cache.get(jwksUri);
+    if (!entry)
+        return null;
+    const now = clock.monotonicMs();
+    const age = cacheAgeMs(entry.state, now);
+    return {
+        jwksUri,
+        cacheAgeSeconds: Number.isFinite(age) ? Math.floor(age / 1000) : null,
+        registryLive: isRegistryLive(entry.state),
+        vanishedKids: [...entry.state.keys.values()]
+            .filter((record) => record.vanished && record.kid)
+            .map((record) => record.kid),
+        pendingTombstones: [...entry.state.pending.values()].map((pending) => ({
+            kid: pending.kid,
+            revokedAt: pending.revokedAt,
+            pendingForSeconds: Math.floor((now - pending.firstSeen.monotonicMs) / 1000),
+        })),
+        appliedTombstones: [...entry.state.applied.values()].map((applied) => ({ ...applied })),
+    };
+}
 //# sourceMappingURL=jwks.js.map

package/dist/jwks.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAGpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAGhE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AAYhD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;AAE7C,8CAA8C;AAC9C,MAAM,UAAU,cAAc;IAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,SAAS,YAAY,CAAC,GAAuB;IAI3C,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE;YACjD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAiB;SAC1D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;QACzD,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAK,oBAA0C,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAA4B,EAAE,GAAuB;IAC5E,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAkB,EAClB,OAAe,EACf,GAAuB,EACvB,SAAoB,EACpB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE;QACxC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,wFAAwF;QACxF,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,qBAAqB,EAAE,CAAC;QAC9E,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,oBAAoB,CAAC,mCAAmC,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,MAAM,aAAa,GAAgB,EAAE,CAAC;IACtC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QACnC,wFAAwF;QACxF,oFAAoF;QACpF,IAAI,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,KAAK,GAAG;YAAE,SAAS;QACzE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IACpC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,MAAM,CAAC,KAAkB,EAAE,GAAuB;IACzD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1B,CAAC;IACD,+DAA+D;IAC/D,OAAO,CAAC,GAAG,KAAK,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAMzC;IACC,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;IACnD,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG;YACN,IAAI,EAAE,IAAI,GAAG,EAAE;YACf,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,cAAc,CAAC;IACnF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAExC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,oBAAoB,EAAE,CAAC;QAClE,OAAO,EAAE,CAAC,CAAC,kDAAkD;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACjG,sFAAsF;QACtF,oFAAoF;QACpF,oFAAoF;QACpF,oFAAoF;QACpF,2EAA2E;QAC3E,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAC7B,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,KAAc,EAAE,EAAE,CACjB,KAAK,YAAY,oBAAoB;YACnC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,oBAAoB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAC7F,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;YACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;QAC9B,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;QACvC,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAc,EACd,GAAuB,EACvB,YAAoB,EACpB,SAAqB;IAErB,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,MAAM,EACN,GAAG,EACH,SAAoC,EACpC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAA4B,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAIrB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAGhE,gGAAgG;AAChG,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,8BAA8B;AAC9B,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACxD,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACzD,kGAAkG;AAClG,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AAOhD,MAAM,WAAW,GAAc;IAC7B,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;IACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;CACzB,CAAC;AAEF,IAAI,KAAK,GAAc,WAAW,CAAC;AAEnC,kGAAkG;AAClG,MAAM,UAAU,oBAAoB,CAAC,WAA6B;IAChE,KAAK,GAAG,WAAW,IAAI,WAAW,CAAC;AACrC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;AACtE,CAAC;AAyBD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;AAE7C,mEAAmE;AACnE,MAAM,UAAU,cAAc;IAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG;YACN,KAAK,EAAE,gBAAgB,EAAE;YACzB,QAAQ,EAAE,IAAI,GAAG,EAAE;YACnB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,KAAK;SACvB,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,OAA2C,EAAE,OAAe,EAAE,KAA+C;IACzH,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,gBAAgB,CAAI,IAA0B,EAAE,SAAiB;IAC9E,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,SAAS,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAkB,EAAE,OAAe,EAAE,OAAqB;IACrF,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,WAAW;YAAE,MAAM,KAAK,CAAC,WAAW,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,KAAK,CAAC,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,qBAAqB,CAAC,CAAC;YAC1G,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO;YACpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;gBACvH,OAAO;YACT,CAAC;YACD,wFAAwF;YACxF,+DAA+D;YAC/D,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC;YAC7B,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,KAAK,CAAC,WAAW,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAkB,EAAE,OAAe,EAAE,OAAqB;IACnF,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kGAAkG,EAAE,CAAC,CAAC;QAC7J,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,qBAAqB,CAAC,CAAC;IAC5G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,SAAoB,EAAE,SAAiB;IACnF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE;QACxC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,wFAAwF;QACxF,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,qBAAqB,EAAE,CAAC;QAC9E,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,oBAAoB,CAAC,mCAAmC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CACf,KAAkB,EAClB,OAAe,EACf,MAAwE;IAExE,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IAC1C,MAAM,OAAO,GAAG,CAAC,KAAK,IAA2B,EAAE;QACjD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACpE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC3B,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC1B,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;YACD,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,KAAK,YAAY,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC;QAC/G,CAAC;QACD,0FAA0F;QAC1F,6DAA6D;QAC7D,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI;YAAE,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACzC,CAAC,CAAC,EAAE,CAAC;IACL,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC;IACzB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;QACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;YAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAkB,EAAE,GAAW;IACjD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,kBAAkB;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAC1F,OAAO,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC;AAC3C,CAAC;AAED,SAAS,OAAO,CAAC,KAAkB,EAAE,GAAW;IAC9C,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,cAAc,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAI3C,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE;YACjD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAiB;SAC1D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;QACzD,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAK,oBAA0C,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAkB,EAAE,MAAiB,EAAE,GAAuB;IACxF,gGAAgG;IAChG,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9E,kGAAkG;IAClG,8FAA8F;IAC9F,sFAAsF;IACtF,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;IAC5C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/F,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC9E,IAAI,GAAG,GAAqB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CACtE,CAAC;QAChB,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAeD,KAAK,UAAU,gBAAgB,CAC7B,KAAkB,EAClB,KAAkB,EAClB,GAAuB,EACvB,MAAiB,EACjB,GAAuB;IAEvB,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,UAAU,GAAmB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,GAAG;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,cAAc,CAAC,KAAkB,EAAE,MAAiB;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAOiB;IAEjB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QAC7C,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,oBAAoB,EAAE,CAAC;YAC/E,uFAAuF;YACvF,oDAAoD;YACpD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;QAC5G,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAClB,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,YAAY,GAAG,oBAAoB,CAAC;IACnH,MAAM,OAAO,GAAiB,cAAc;QAC1C,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gEAAgE,EAAE;QAC1F,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7F,oFAAoF;QACpF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClG,CAAC;QACD,0FAA0F;QAC1F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,gGAAgG;QAChG,0EAA0E;QAC1E,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACrH,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9F,6FAA6F;QAC7F,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAChG,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACnG,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACxE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAc,EACd,GAAuB,EACvB,YAAoB,EACpB,SAAqB;IAErB,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,MAAM,EACN,GAAG,EACH,SAAoC,EACpC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAA4B,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAoD,EACpD,GAAuB,EACvB,YAAoB,EACpB,SAAqB,EACrB,KAAqC;IAErC,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9C,IAAI,MAAM,eAAe,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;YACvE,OAAO,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAMjC;IACC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE;QACrC,GAAG,MAAM;QACT,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5D,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,qBAAqB;KACrD,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAA0D,EAAE;IAChG,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACjF,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,KAAK,CAAC,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAaD,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO;QACL,OAAO;QACP,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACrE,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;QACzC,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;aACzC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC;aACjD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAa,CAAC;QACxC,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;SAC5E,CAAC,CAAC;QACH,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;KACxF,CAAC;AACJ,CAAC"}