@proof-holdings/sdk 0.0.0-stage → 1.2.0

package/dist/cjs/jwks/key-set-cache.js

@@ -0,0 +1,277 @@
+"use strict";
+/**
+ * The issuer's key set as offline verification holds it — the I/O half around `keyset.ts`, which
+ * owns the rules. Mirrors `packages/delegation-verifier/src/jwks.ts`, minus persistence: this SDK
+ * keeps tombstones in memory only.
+ *
+ * Replaces jose's `createRemoteJWKSet`, which hid the fetch time and the registry's own JWK members
+ * and so could enforce neither tombstones, windows nor staleness. The behaviours it supplied are
+ * kept: a 10-minute reuse window, one forced refetch per 30 s for an unknown `kid`, one fetch in
+ * flight at a time. What it did not do, and this does:
+ *
+ *   - A fetch is MERGED into what the verifier knows (`mergeFetchedDocument`), never swapped in.
+ *   - A failed refetch does not discard the cache. Within `maxJwksAgeMs` its CONFIRMED keys keep
+ *     answering; beyond it the answer is `stale` — except an applied tombstone, which is `revoked`
+ *     at any age. A set never fetched has nothing to fall back on and stays `unavailable`.
+ *   - A failed refetch of a cached set is retried at most once per cooldown, so an outage does not
+ *     turn every verification into an outbound request.
+ *   - Age is measured on a monotonic clock; claim checks use the wall clock.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeySetCache = exports.MAX_JWKS_AGE_CAP_MS = exports.DEFAULT_MAX_JWKS_AGE_MS = exports.KEY_SET_TTL_MS = exports.KEY_MISS_COOLDOWN_MS = exports.SUPPORTED_ALGORITHMS = void 0;
+exports.setJwksClockForTests = setJwksClockForTests;
+exports.setJwksEventListenerForTests = setJwksEventListenerForTests;
+exports.nowWallMs = nowWallMs;
+exports.assertMaxJwksAgeMs = assertMaxJwksAgeMs;
+exports.isSupportedAlgorithm = isSupportedAlgorithm;
+const jose_1 = require("jose");
+const http_js_1 = require("../http.js");
+const keyset_js_1 = require("./keyset.js");
+const support_js_1 = require("./support.js");
+exports.SUPPORTED_ALGORITHMS = ['RS256', 'ES256'];
+/** How long a `kid` miss — or a failed refetch of a cached set — suppresses further fetches. */
+exports.KEY_MISS_COOLDOWN_MS = 30000;
+/** How long a fetched key set is reused without refetching (jose's default, kept). */
+exports.KEY_SET_TTL_MS = 10 * 60000;
+/** Default `maxJwksAgeMs`. */
+exports.DEFAULT_MAX_JWKS_AGE_MS = 24 * 60 * 60000;
+/** Largest accepted `maxJwksAgeMs` — below the issuer's ~30-day lead on its next key. */
+exports.MAX_JWKS_AGE_CAP_MS = 25 * 24 * 60 * 60000;
+const JWKS_TIMEOUT_MS = 5000;
+/** A key set is kilobytes; anything larger is not one. */
+const MAX_JWKS_BYTES = 512 * 1024;
+const systemClock = {
+    monotonicMs: () => performance.now(),
+    wallMs: () => Date.now(),
+};
+let clock = systemClock;
+let eventListener = null;
+/** Test seam — replaces both clocks; `null` restores the system clocks. Not exported from the package. */
+function setJwksClockForTests(replacement) {
+    clock = replacement ?? systemClock;
+}
+/** Test seam — receives every key-set event; `null` detaches. Not exported from the package. */
+function setJwksEventListenerForTests(listener) {
+    eventListener = listener;
+}
+function nowWallMs() {
+    return clock.wallMs();
+}
+/** Throws unless `value` is a usable `maxJwksAgeMs`: whole milliseconds, 1 … 25 days. */
+function assertMaxJwksAgeMs(value) {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0 || value > exports.MAX_JWKS_AGE_CAP_MS) {
+        throw new Error(`maxJwksAgeMs must be a whole number of milliseconds between 1 and ${exports.MAX_JWKS_AGE_CAP_MS} (25 days)`);
+    }
+}
+function isSupportedAlgorithm(alg) {
+    return typeof alg === 'string' && exports.SUPPORTED_ALGORITHMS.includes(alg);
+}
+class KeySetCache {
+    constructor(http, jwksUri, maxJwksAgeMs) {
+        this.http = http;
+        this.jwksUri = jwksUri;
+        this.maxJwksAgeMs = maxJwksAgeMs;
+        this.state = (0, keyset_js_1.emptyKeySetState)();
+        /** Imported keys by key material + algorithm; `null` records a JWK that failed to import. */
+        this.imported = new Map();
+        this.lastMissAt = null;
+        this.lastFailedAt = null;
+        this.inFlight = null;
+        this.forceNext = false;
+    }
+    /**
+     * The keys that may verify a token of `family` carrying `kid` — or why none may. Fetches when the
+     * set is older than the TTL, after `forceRefresh()`, or once per cooldown when `kid` is unknown.
+     */
+    async resolve(kid, alg, family) {
+        const now = clock.monotonicMs();
+        const forced = this.forceNext;
+        if (!forced && this.isFresh(now)) {
+            const cached = await this.resolveFromState(this.state, kid, family, alg);
+            if (cached.kind !== 'unknown')
+                return cached;
+            if (this.lastMissAt !== null && now - this.lastMissAt < exports.KEY_MISS_COOLDOWN_MS) {
+                // The kid may have been published since the last refetch: "could not check", not "no such key".
+                return { kind: 'unavailable', message: 'unknown key; the key set is refetched again after the cooldown' };
+            }
+        }
+        const recentlyFailed = !forced &&
+            this.state.fetchedAt !== null &&
+            this.lastFailedAt !== null &&
+            now - this.lastFailedAt < exports.KEY_MISS_COOLDOWN_MS;
+        const outcome = recentlyFailed
+            ? { ok: false, message: 'JWKS refetch failed recently; it is retried after the cooldown' }
+            : await this.runFetch();
+        if (!outcome.ok) {
+            if (this.state.fetchedAt === null)
+                return { kind: 'unavailable', message: outcome.message };
+            // An applied tombstone is final whatever the cache's age: no refetch could lift it.
+            const known = (0, keyset_js_1.selectKeys)(this.state, kid, family);
+            if (known.kind === 'revoked')
+                return known;
+            const age = this.cacheAgeMs(clock.monotonicMs());
+            if (age > this.maxJwksAgeMs) {
+                return { kind: 'stale', cacheAgeSeconds: Number.isFinite(age) ? Math.floor(age / 1000) : null };
+            }
+            const fallback = (0, keyset_js_1.withConfirmedKeysOnly)(this.state);
+            // A no-kid token tries every candidate: if the fallback lost one, a signature matching none of
+            // the rest may still be that key's — "could not check", not a forgery.
+            if (kid === undefined && candidateCount(fallback, family) < candidateCount(this.state, family)) {
+                return { kind: 'unavailable', message: outcome.message };
+            }
+            const cached = await this.resolveFromState(fallback, kid, family, alg);
+            return cached.kind === 'unknown' ? { kind: 'unavailable', message: outcome.message } : cached;
+        }
+        const resolved = await this.resolveFromState(this.state, kid, family, alg);
+        if (resolved.kind === 'unknown')
+            this.lastMissAt = clock.monotonicMs();
+        return resolved;
+    }
+    /** Make the next resolution refetch, ignoring the TTL and both cooldowns. Keeps what is known. */
+    forceRefresh() {
+        this.forceNext = true;
+    }
+    /** Forget every applied and pending tombstone — the documented manual reset. */
+    clearTombstones() {
+        this.state = (0, keyset_js_1.withoutTombstones)(this.state);
+    }
+    /** What the cache holds, for tests. */
+    diagnostics() {
+        const age = this.cacheAgeMs(clock.monotonicMs());
+        return {
+            cacheAgeSeconds: Number.isFinite(age) ? Math.floor(age / 1000) : null,
+            registryLive: (0, keyset_js_1.isRegistryLive)(this.state),
+            vanishedKids: [...this.state.keys.values()]
+                .filter((record) => record.vanished && record.kid)
+                .map((record) => record.kid),
+        };
+    }
+    cacheAgeMs(now) {
+        if (this.state.fetchedAt === null || this.state.fetchedAtUntrusted)
+            return Number.POSITIVE_INFINITY;
+        return now - this.state.fetchedAt.monotonicMs;
+    }
+    isFresh(now) {
+        return this.cacheAgeMs(now) < exports.KEY_SET_TTL_MS;
+    }
+    /**
+     * One fetch at a time. The shared promise RESOLVES to the outcome rather than recording it on
+     * the instance, so a waiter cannot be handed the result of the NEXT fetch.
+     */
+    runFetch() {
+        if (this.inFlight)
+            return this.inFlight;
+        this.forceNext = false;
+        const running = (async () => {
+            let failure;
+            try {
+                const body = await this.fetchDocument();
+                const merged = (0, keyset_js_1.mergeFetchedDocument)(this.state, body, {
+                    monotonicMs: clock.monotonicMs(),
+                    wallMs: clock.wallMs(),
+                });
+                for (const event of merged.events)
+                    emit(event);
+                if (merged.accepted) {
+                    this.state = merged.state;
+                    this.lastFailedAt = null;
+                    return { ok: true };
+                }
+                failure = merged.events[0]?.message ?? 'JWKS refused';
+            }
+            catch (error) {
+                failure = error instanceof Error && error.message ? error.message : 'JWKS fetch failed';
+            }
+            // Only a set with a cache to fall back on is held back; one never fetched is retried every call.
+            if (this.state.fetchedAt !== null)
+                this.lastFailedAt = clock.monotonicMs();
+            return { ok: false, message: failure };
+        })();
+        this.inFlight = running;
+        void running.finally(() => {
+            if (this.inFlight === running)
+                this.inFlight = null;
+        });
+        return running;
+    }
+    async fetchDocument() {
+        const response = await this.http.fetchPublic(this.jwksUri, {
+            timeoutMs: JWKS_TIMEOUT_MS,
+            headers: { accept: 'application/json' },
+        });
+        if (!response.ok)
+            throw new Error(`JWKS fetch failed with HTTP ${response.status}`);
+        const declaredLength = Number(response.headers.get('content-length'));
+        if (Number.isFinite(declaredLength) && declaredLength > MAX_JWKS_BYTES) {
+            throw new Error('JWKS response is too large');
+        }
+        const raw = await (0, http_js_1.readCapped)(response, MAX_JWKS_BYTES);
+        if (raw === null)
+            throw new Error('JWKS response is too large');
+        let body;
+        try {
+            body = JSON.parse(raw);
+        }
+        catch {
+            throw new Error('JWKS response is not JSON');
+        }
+        if (!(0, support_js_1.isRecord)(body) || !Array.isArray(body.keys))
+            throw new Error('JWKS response has no `keys` array');
+        return body;
+    }
+    async resolveFromState(state, kid, family, alg) {
+        const selection = (0, keyset_js_1.selectKeys)(state, kid, family);
+        if (selection.kind !== 'candidates')
+            return selection;
+        const candidates = [];
+        for (const record of selection.records) {
+            const key = await this.importRecord(record, alg);
+            if (key)
+                candidates.push({ key, record });
+        }
+        if (candidates.length === 0)
+            return { kind: 'unknown' };
+        return { kind: 'keys', candidates, registryLive: (0, keyset_js_1.isRegistryLive)(state) };
+    }
+    async importRecord(record, alg) {
+        // A key declared for another algorithm, or for anything but signatures (RFC 7517 §4.2, §4.3), is
+        // not a candidate. Checked before the import cache, which is keyed by material and shared across kids.
+        if (typeof record.jwk.alg === 'string' && record.jwk.alg !== alg)
+            return null;
+        const { use, key_ops: keyOps } = record.jwk;
+        if (use !== undefined && use !== 'sig')
+            return null;
+        if (keyOps !== undefined && !(Array.isArray(keyOps) && keyOps.includes('verify')))
+            return null;
+        const cacheKey = `${record.fingerprint}|${alg}`;
+        if (this.imported.has(cacheKey))
+            return this.imported.get(cacheKey) ?? null;
+        let key;
+        try {
+            const { kty, crv, x, y, n, e } = record.jwk;
+            const material = Object.fromEntries(Object.entries({ kty, crv, x, y, n, e }).filter(([, value]) => value !== undefined));
+            key = await (0, jose_1.importJWK)(material, alg);
+        }
+        catch {
+            key = null;
+        }
+        this.imported.set(cacheKey, key);
+        return key;
+    }
+}
+exports.KeySetCache = KeySetCache;
+function candidateCount(state, family) {
+    const selection = (0, keyset_js_1.selectKeys)(state, undefined, family);
+    return selection.kind === 'candidates' ? selection.records.length : 0;
+}
+function emit(event) {
+    if (!eventListener)
+        return;
+    try {
+        eventListener(event);
+    }
+    catch {
+        // A throwing listener must not turn into a verification failure.
+    }
+}
+//# sourceMappingURL=key-set-cache.js.map

package/dist/cjs/jwks/key-set-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-set-cache.js","sourceRoot":"","sources":["../../../src/jwks/key-set-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AA8CH,oDAEC;AAGD,oEAEC;AAED,8BAEC;AAGD,gDAMC;AAED,oDAEC;AApED,+BAAyD;AAEzD,wCAAyD;AACzD,2CAOqB;AAErB,6CAAwC;AAE3B,QAAA,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAGhE,gGAAgG;AACnF,QAAA,oBAAoB,GAAG,KAAM,CAAC;AAC3C,sFAAsF;AACzE,QAAA,cAAc,GAAG,EAAE,GAAG,KAAM,CAAC;AAC1C,8BAA8B;AACjB,QAAA,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,KAAM,CAAC;AACxD,yFAAyF;AAC5E,QAAA,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAM,CAAC;AAEzD,MAAM,eAAe,GAAG,IAAK,CAAC;AAC9B,0DAA0D;AAC1D,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAOlC,MAAM,WAAW,GAAc;IAC7B,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;IACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;CACzB,CAAC;AAEF,IAAI,KAAK,GAAc,WAAW,CAAC;AACnC,IAAI,aAAa,GAA0C,IAAI,CAAC;AAEhE,0GAA0G;AAC1G,SAAgB,oBAAoB,CAAC,WAA6B;IAChE,KAAK,GAAG,WAAW,IAAI,WAAW,CAAC;AACrC,CAAC;AAED,gGAAgG;AAChG,SAAgB,4BAA4B,CAAC,QAA+C;IAC1F,aAAa,GAAG,QAAQ,CAAC;AAC3B,CAAC;AAED,SAAgB,SAAS;IACvB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;AACxB,CAAC;AAED,yFAAyF;AACzF,SAAgB,kBAAkB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,2BAAmB,EAAE,CAAC;QACvG,MAAM,IAAI,KAAK,CACb,qEAAqE,2BAAmB,YAAY,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,oBAAoB,CAAC,GAAY;IAC/C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAK,4BAA0C,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC9F,CAAC;AAiBD,MAAa,WAAW;IAStB,YACmB,IAAgB,EAChB,OAAe,EACf,YAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAY;QAChB,YAAO,GAAP,OAAO,CAAQ;QACf,iBAAY,GAAZ,YAAY,CAAQ;QAX/B,UAAK,GAAgB,IAAA,4BAAgB,GAAE,CAAC;QAChD,6FAA6F;QAC5E,aAAQ,GAAG,IAAI,GAAG,EAAuC,CAAC;QACnE,eAAU,GAAkB,IAAI,CAAC;QACjC,iBAAY,GAAkB,IAAI,CAAC;QACnC,aAAQ,GAAiC,IAAI,CAAC;QAC9C,cAAS,GAAG,KAAK,CAAC;IAMvB,CAAC;IAEJ;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,GAAuB,EAAE,GAAuB,EAAE,MAAiB;QAC/E,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC;YAC7C,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,4BAAoB,EAAE,CAAC;gBAC7E,gGAAgG;gBAChG,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;YAC5G,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAClB,CAAC,MAAM;YACP,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI;YAC7B,IAAI,CAAC,YAAY,KAAK,IAAI;YAC1B,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,4BAAoB,CAAC;QACjD,MAAM,OAAO,GAAiB,cAAc;YAC1C,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gEAAgE,EAAE;YAC1F,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAE1B,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5F,oFAAoF;YACpF,MAAM,KAAK,GAAG,IAAA,sBAAU,EAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC5B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClG,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,iCAAqB,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,+FAA+F;YAC/F,uEAAuE;YACvE,IAAI,GAAG,KAAK,SAAS,IAAI,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC/F,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3D,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACvE,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAChG,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kGAAkG;IAClG,YAAY;QACV,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,gFAAgF;IAChF,eAAe;QACb,IAAI,CAAC,KAAK,GAAG,IAAA,6BAAiB,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,uCAAuC;IACvC,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACrE,YAAY,EAAE,IAAA,0BAAc,EAAC,IAAI,CAAC,KAAK,CAAC;YACxC,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;iBACxC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC;iBACjD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAa,CAAC;SACzC,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;QACpG,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC;IAChD,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,sBAAc,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACK,QAAQ;QACd,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,KAAK,IAA2B,EAAE;YACjD,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,IAAA,gCAAoB,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;oBACpD,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;oBAChC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;iBACvB,CAAC,CAAC;gBACH,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACpB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;oBAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;oBACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACtB,CAAC;gBACD,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;YAC1F,CAAC;YACD,iGAAiG;YACjG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI;gBAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;YACxB,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE;YACzD,SAAS,EAAE,eAAe;YAC1B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAEpF,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,cAAc,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAA,oBAAU,EAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvD,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAEhE,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,IAAA,qBAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,KAAkB,EAClB,GAAuB,EACvB,MAAiB,EACjB,GAAuB;QAEvB,MAAM,SAAS,GAAG,IAAA,sBAAU,EAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACtD,MAAM,UAAU,GAAmB,EAAE,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,GAAG;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,IAAA,0BAAc,EAAC,KAAK,CAAC,EAAE,CAAC;IAC3E,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAAiB,EAAE,GAAuB;QACnE,iGAAiG;QACjG,uGAAuG;QACvG,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/F,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC5E,IAAI,GAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAClE,CAAC;YACpB,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAlMD,kCAkMC;AAED,SAAS,cAAc,CAAC,KAAkB,EAAE,MAAiB;IAC3D,MAAM,SAAS,GAAG,IAAA,sBAAU,EAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,IAAI,CAAC,KAAkB;IAC9B,IAAI,CAAC,aAAa;QAAE,OAAO;IAC3B,IAAI,CAAC;QACH,aAAa,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC"}

package/dist/cjs/jwks/keyset.d.ts

@@ -0,0 +1,139 @@
+/**
+ * LOCKSTEP COPY of `packages/delegation-verifier/src/keyset.ts` — the key-rotation rules, free of
+ * I/O. Everything below the imports must stay byte-identical to that file:
+ * `src/__tests__/drift/jwks-rotation-fixtures.test.ts` in the repository root fails otherwise, and
+ * `sdks/shared/fixtures/jwks_rotation/` pins the outcome of each rule across all five verifiers.
+ * Change a rule there, then copy it here; do not edit this file on its own.
+ *
+ * The persistence half (`serializeKeySetState` and friends) is carried along unused: this SDK keeps
+ * its key set in memory only, but trimming the copy would turn "identical" into "identical except".
+ */
+import type { JwksEventType } from './support.js';
+export declare const KEY_FAMILIES: readonly ["proof", "delegation", "status-list"];
+export type KeyFamily = (typeof KEY_FAMILIES)[number];
+/** Clock skew tolerated on each edge of a key's `[not_before, not_after]` window. */
+export declare const KEY_WINDOW_SKEW_SECONDS = 300;
+/** Minimum spacing between the two fetches that confirm a key, a narrowed window or a tombstone. */
+export declare const CONFIRM_SPACING_MS: number;
+/** An applied tombstone is kept until `revoked_at` plus this. */
+export declare const TOMBSTONE_RETENTION_SECONDS: number;
+/** Both clocks at one instant: monotonic for in-process intervals, wall for anything persisted. */
+export interface KeySetClockReading {
+    monotonicMs: number;
+    wallMs: number;
+}
+export interface KeyRecord {
+    kid?: string;
+    /** The JWK as last accepted, with any narrowing of its window applied. */
+    jwk: Record<string, unknown>;
+    /** Identity of the key material: a protected kid keeps its first material, an unprotected one takes the latest. */
+    fingerprint: string;
+    /** `alg`, `use` and `key_ops` — the members that decide whether the key may verify at all. */
+    usage: string;
+    hasPurposeMember: boolean;
+    purpose?: KeyFamily;
+    legacy: boolean;
+    notBefore?: number;
+    notAfter?: number;
+    maxTokenLifetime?: number;
+    vanished: boolean;
+    /** When this exact description of the key was first served. */
+    firstSeen: KeySetClockReading;
+    /** Served unchanged by two fetches at least `CONFIRM_SPACING_MS` apart. */
+    confirmed: boolean;
+    /** A narrower window served for a confirmed key, applied once a later fetch confirms it. */
+    pendingWindow?: PendingWindow;
+}
+export interface PendingWindow {
+    notBefore: number;
+    notAfter: number;
+    firstSeen: KeySetClockReading;
+}
+export interface PendingTombstone {
+    kid: string;
+    revokedAt: number;
+    firstSeen: KeySetClockReading;
+}
+export interface AppliedTombstone {
+    kid: string;
+    revokedAt: number;
+}
+export interface KeySetState {
+    keys: Map<string, KeyRecord>;
+    /** Keys served without a `kid` — tolerant mode only ever needs them. */
+    anonymous: KeyRecord[];
+    pending: Map<string, PendingTombstone>;
+    applied: Map<string, AppliedTombstone>;
+    fetchedAt: KeySetClockReading | null;
+    /** A persisted `fetched_at` lay in the future: its age is unknown, so it counts as stale. */
+    fetchedAtUntrusted: boolean;
+}
+export type KeySetEventType = Exclude<JwksEventType, 'store_error'>;
+export interface KeySetEvent {
+    type: KeySetEventType;
+    kid?: string;
+    message: string;
+}
+export interface MergeResult {
+    state: KeySetState;
+    events: KeySetEvent[];
+    /** False when the document was refused whole; `state` is then the unchanged input. */
+    accepted: boolean;
+}
+export type KeySelection = {
+    kind: 'candidates';
+    records: KeyRecord[];
+} | {
+    kind: 'revoked';
+    kid: string;
+} | {
+    kind: 'wrong_purpose';
+    kid: string;
+} | {
+    kind: 'unknown';
+};
+export type KeyPolicyViolation = 'outside_key_window' | 'token_lifetime_exceeded';
+export declare function emptyKeySetState(): KeySetState;
+export declare function parseKeyRecord(jwk: Record<string, unknown>, firstSeen: KeySetClockReading): KeyRecord;
+export declare function isRegistryLive(state: KeySetState): boolean;
+/**
+ * Merge one fetched JWKS body (already known to be an object with a `keys` array) into `state`.
+ * Pure: returns a new state and the events the caller should report.
+ */
+export declare function mergeFetchedDocument(state: KeySetState, body: Record<string, unknown>, now: KeySetClockReading): MergeResult;
+/**
+ * Which keys may verify a token of `family` carrying `kid`. Checks the applied tombstone and the
+ * key's purpose; the signature and the window are the caller's next steps, in that order.
+ */
+export declare function selectKeys(state: KeySetState, kid: string | undefined, family: KeyFamily): KeySelection;
+/** The window and lifetime rules for a key whose signature has verified. */
+export declare function checkKeyPolicy(record: KeyRecord, token: {
+    iat: unknown;
+    exp: unknown;
+}, registryLive: boolean): KeyPolicyViolation | null;
+/**
+ * Fold the tombstones of a persisted state into a set this process has already fetched. The
+ * fetched keys are newer than disk, but a tombstone is not something a later fetch can restore:
+ * dropping the persisted one would silently un-revoke a key until two more fetches agreed again.
+ */
+export declare function withPersistedTombstones(state: KeySetState, persisted: KeySetState): KeySetState;
+/**
+ * The part of a cached set that may answer after a refetch FAILED: confirmed keys only. An
+ * unconfirmed key is trusted until the next document, and a failing fetch must not stretch that to
+ * `maxJwksAgeMs` — otherwise one poisoned response followed by an outage would keep its key, and
+ * the registry mode it switched on, for a day.
+ */
+export declare function withConfirmedKeysOnly(state: KeySetState): KeySetState;
+/** Drop every applied and pending tombstone — the documented manual reset. */
+export declare function withoutTombstones(state: KeySetState): KeySetState;
+/**
+ * Persisted form. Every timestamp is wall-clock milliseconds: a monotonic reading means nothing
+ * to another process.
+ */
+export declare function serializeKeySetState(state: KeySetState): string;
+/**
+ * Rebuild a persisted state, or null when the blob is not one. A `fetched_at` in the future marks
+ * the set stale; a pending tombstone first seen in the future is dropped.
+ */
+export declare function deserializeKeySetState(raw: string, now: KeySetClockReading): KeySetState | null;
+//# sourceMappingURL=keyset.d.ts.map

package/dist/cjs/jwks/keyset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyset.d.ts","sourceRoot":"","sources":["../../../src/jwks/keyset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,eAAO,MAAM,YAAY,iDAAkD,CAAC;AAC5E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtD,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,oGAAoG;AACpG,eAAO,MAAM,kBAAkB,QAAa,CAAC;AAC7C,iEAAiE;AACjE,eAAO,MAAM,2BAA2B,QAAe,CAAC;AAExD,mGAAmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,mHAAmH;IACnH,WAAW,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,SAAS,EAAE,kBAAkB,CAAC;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB,4FAA4F;IAC5F,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,kBAAkB,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,kBAAkB,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7B,wEAAwE;IACxE,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACvC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACvC,SAAS,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrC,6FAA6F;IAC7F,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAEpE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,sFAAsF;IACtF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,SAAS,EAAE,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAExB,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,GAAG,yBAAyB,CAAC;AAElF,wBAAgB,gBAAgB,IAAI,WAAW,CAS9C;AAoBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,kBAAkB,GAAG,SAAS,CAiBrG;AAuCD,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAG1D;AAmCD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,kBAAkB,GACtB,WAAW,CA4Jb;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,YAAY,CAkBvG;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,EACrC,YAAY,EAAE,OAAO,GACpB,kBAAkB,GAAG,IAAI,CAU3B;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,GAAG,WAAW,CAS/F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,CAOrE;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,CAKjE;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA2B/D;AAMD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,WAAW,GAAG,IAAI,CA+D/F"}