@seamless-auth/oidc-provider 0.3.0 → 0.4.0

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAEA;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC;QAChC,MAAM,EAAE,GAAG,CAAC,gBAAgB;QAC5B,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,aAAa,EAAE,GAAG,CAAC,2BAA2B;QAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,UAAU,EAAE,GAAG,CAAC,gBAAgB;QAChC,mBAAmB,EAAE,GAAG,CAAC,sBAAsB;QAC/C,UAAU,EAAE,GAAG,CAAC,WAAW;KAC5B,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,yCAAyC,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAEA;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC;QAChC,MAAM,EAAE,GAAG,CAAC,gBAAgB;QAC5B,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,aAAa,EAAE,GAAG,CAAC,2BAA2B;QAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,UAAU,EAAE,GAAG,CAAC,gBAAgB;QAChC,mBAAmB,EAAE,GAAG,CAAC,sBAAsB;QAC/C,UAAU,EAAE,GAAG,CAAC,WAAW,KAAK,KAAK;KACtC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,yCAAyC,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/signingKey.d.ts

@@ -1,7 +1,12 @@
-import { type KeyObject } from 'node:crypto';
+import { type JsonWebKeyInput, type KeyObject } from 'node:crypto';
 import type { OidcJwksResponse, OidcPublicJwk, OidcSignKind } from '@seamless-auth/types';
 import { ExternalSigningKey } from 'oidc-provider';
 import type { OidcApiClient } from './apiClient.js';
+type PublicJwk = JsonWebKeyInput['key'] & {
+    kid?: string;
+    use?: string;
+    alg?: string;
+};
 export declare class UnsignableTokenError extends Error {
     constructor(reason: string);
 }
@@ -17,13 +22,36 @@ export declare function classifyToken(header: JsonObject, payload: JsonObject, s
  */
 export declare class ApiSigningKey extends ExternalSigningKey {
     #private;
-    constructor(jwk: OidcPublicJwk, client: OidcApiClient, active: boolean);
+    constructor(jwk: OidcPublicJwk, client: OidcApiClient, active: boolean, onUnknownKey?: () => Promise<void>);
     get kid(): string;
     get alg(): string;
     get active(): boolean;
+    /** Public members only, whatever else the API's JWK carried. */
+    get publicJwk(): PublicJwk;
     keyObject(): KeyObject;
     sign(data: Uint8Array): Promise<Uint8Array>;
 }
 /** The active key comes first, which is the one the library selects to sign with. */
-export declare function signingKeysFrom(jwks: OidcJwksResponse, client: OidcApiClient): ApiSigningKey[];
+export declare function signingKeysFrom(jwks: OidcJwksResponse, client: OidcApiClient, onUnknownKey?: () => Promise<void>): ApiSigningKey[];
+/** Re-read the API's keys this often, so a rotation is picked up before anything is refused. */
+export declare const SIGNING_KEY_REFRESH_MS: number;
+/**
+ * The API's provider keys, reloaded on a timer and whenever the API refuses a key as unknown.
+ * The library reads its keystore once, at construction, so it is handed fixed slots that
+ * follow the current keys: the first is always the active key.
+ */
+export declare class SigningKeyRing {
+    #private;
+    constructor(jwks: OidcJwksResponse, client: OidcApiClient);
+    /** Every key the API publishes, the active one first. */
+    get keys(): readonly ApiSigningKey[];
+    /** For the library's `jwks` configuration. */
+    get providerKeys(): ExternalSigningKey[];
+    /** The current keys, active first, for the edge's `/jwks`. */
+    get publicJwks(): PublicJwk[];
+    /** One reload at a time. A failed one keeps the keys already loaded. */
+    reload(): Promise<void>;
+    /** Reloads every `intervalMs` until the returned function is called. Never holds the process. */
+    startRefresh(intervalMs?: number): () => void;
+}
 export {};

package/dist/signingKey.js

@@ -64,13 +64,15 @@ export class ApiSigningKey extends ExternalSigningKey {
     #keyObject;
     #client;
     #active;
-    constructor(jwk, client, active) {
+    #onUnknownKey;
+    constructor(jwk, client, active, onUnknownKey) {
         super();
         this.#kid = jwk.kid;
         this.#alg = jwk.alg;
         this.#keyObject = createPublicKey({ key: jwk, format: 'jwk' });
         this.#client = client;
         this.#active = active;
+        this.#onUnknownKey = onUnknownKey;
     }
     get kid() {
         return this.#kid;
@@ -81,6 +83,11 @@ export class ApiSigningKey extends ExternalSigningKey {
     get active() {
         return this.#active;
     }
+    /** Public members only, whatever else the API's JWK carried. */
+    get publicJwk() {
+        const { kty, ...rest } = this.#keyObject.export({ format: 'jwk' });
+        return { kty, use: 'sig', kid: this.#kid, alg: this.#alg, ...rest };
+    }
     keyObject() {
         return this.#keyObject;
     }
@@ -97,6 +104,10 @@ export class ApiSigningKey extends ExternalSigningKey {
         if (header.alg !== this.#alg) {
             throw new UnsignableTokenError(`alg ${String(header.alg)} does not match key ${this.#kid}`);
         }
+        // The library reads the kid before it signs, and the keys can reload in between.
+        if (header.kid !== undefined && header.kid !== this.#kid) {
+            throw new UnsignableTokenError(`kid ${String(header.kid)} does not match key ${this.#kid}`);
+        }
         const sessionId = currentRequestContext()?.sessionId;
         const { kind, clientId } = classifyToken(header, decodePart(payloadPart), sessionId);
         const context = currentRequestContext();
@@ -122,21 +133,110 @@ export class ApiSigningKey extends ExternalSigningKey {
             if (error instanceof OidcSignRefusedError && error.code === 'session_revoked') {
                 throw new errors.InvalidGrant('the session behind this grant has ended');
             }
+            // The API rotated its key. This request fails, and the next one signs with the new key.
+            if (error instanceof OidcSignRefusedError && error.code === 'unknown_key') {
+                await this.#onUnknownKey?.().catch(() => undefined);
+            }
             throw error;
         }
     }
 }
 /** The active key comes first, which is the one the library selects to sign with. */
-export function signingKeysFrom(jwks, client) {
+export function signingKeysFrom(jwks, client, onUnknownKey) {
     const active = jwks.keys.find((key) => key.kid === jwks.activeKid);
     if (!active) {
         throw new Error(`The API's active provider key ${jwks.activeKid} is not in its JWKS`);
     }
     return [
-        new ApiSigningKey(active, client, true),
+        new ApiSigningKey(active, client, true, onUnknownKey),
         ...jwks.keys
             .filter((key) => key.kid !== jwks.activeKid)
-            .map((key) => new ApiSigningKey(key, client, false)),
+            .map((key) => new ApiSigningKey(key, client, false, onUnknownKey)),
     ];
 }
+/** Re-read the API's keys this often, so a rotation is picked up before anything is refused. */
+export const SIGNING_KEY_REFRESH_MS = 5 * 60_000;
+/**
+ * The API's provider keys, reloaded on a timer and whenever the API refuses a key as unknown.
+ * The library reads its keystore once, at construction, so it is handed fixed slots that
+ * follow the current keys: the first is always the active key.
+ */
+export class SigningKeyRing {
+    #client;
+    #alg;
+    #slots;
+    #keys;
+    #reloading;
+    constructor(jwks, client) {
+        this.#client = client;
+        this.#keys = signingKeysFrom(jwks, client, () => this.reload());
+        this.#alg = this.#keys[0].alg;
+        this.#slots = this.#keys.map((_, index) => new SigningKeySlot(this, index));
+    }
+    /** Every key the API publishes, the active one first. */
+    get keys() {
+        return this.#keys;
+    }
+    /** For the library's `jwks` configuration. */
+    get providerKeys() {
+        return this.#slots;
+    }
+    /** The current keys, active first, for the edge's `/jwks`. */
+    get publicJwks() {
+        return this.#keys.map((key) => key.publicJwk);
+    }
+    /** One reload at a time. A failed one keeps the keys already loaded. */
+    reload() {
+        this.#reloading ??= this.#load().finally(() => {
+            this.#reloading = undefined;
+        });
+        return this.#reloading;
+    }
+    async #load() {
+        const jwks = await this.#client.jwks();
+        const keys = signingKeysFrom(jwks, this.#client, () => this.reload());
+        // The library's signing algorithms are fixed when it starts.
+        if (keys[0].alg !== this.#alg) {
+            throw new Error(`The API's active provider key now uses ${keys[0].alg}, not ${this.#alg}; restart this service`);
+        }
+        this.#keys = keys;
+    }
+    /** Reloads every `intervalMs` until the returned function is called. Never holds the process. */
+    startRefresh(intervalMs = SIGNING_KEY_REFRESH_MS) {
+        const timer = setInterval(() => {
+            this.reload().catch((error) => {
+                console.error(`[oidc-provider] could not reload the signing keys: ${String(error)}`);
+            });
+        }, intervalMs);
+        timer.unref();
+        return () => clearInterval(timer);
+    }
+}
+/** One of the library's keys, standing for whichever of the ring's keys is in its place. */
+class SigningKeySlot extends ExternalSigningKey {
+    #ring;
+    #index;
+    constructor(ring, index) {
+        super();
+        this.#ring = ring;
+        this.#index = index;
+    }
+    // A slot past the ring's current keys repeats the active key, which only ever signs first.
+    #key() {
+        const keys = this.#ring.keys;
+        return keys[this.#index] ?? keys[0];
+    }
+    get kid() {
+        return this.#key().kid;
+    }
+    get alg() {
+        return this.#key().alg;
+    }
+    keyObject() {
+        return this.#key().keyObject();
+    }
+    sign(data) {
+        return this.#key().sign(data);
+    }
+}
 //# sourceMappingURL=signingKey.js.map

package/dist/signingKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"signingKey.js","sourceRoot":"","sources":["../src/signingKey.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAmC,MAAM,aAAa,CAAC;AAG/E,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAG3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,MAAc;QACxB,KAAK,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAID,SAAS,UAAU,CAAC,IAAwB;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAOD,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,OAAmB,EACnB,SAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAAC,iDAAiD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GACR,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,QAAQ;YACpD,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,cAAc,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACnD,MAAM,QAAQ,GACZ,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,aAAc,SAAQ,kBAAkB;IAC1C,IAAI,CAAS;IACb,IAAI,CAAS;IACb,UAAU,CAAY;IACtB,OAAO,CAAgB;IACvB,OAAO,CAAU;IAE1B,YAAY,GAAkB,EAAE,MAAqB,EAAE,MAAe;QACpE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,IAAa,GAAG;QACd,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAa,GAAG;QACd,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEQ,SAAS;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,IAAgB;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,oBAAoB,CAAC,OAAO,IAAI,CAAC,IAAI,8BAA8B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,oBAAoB,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,EAAE,EAAE,SAAS,CAAC;QACrD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YAC7C,IAAI;YACJ,GAAG,EAAE,IAAI,CAAC,IAAI;YACd,QAAQ;YACR,YAAY;YACZ,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,KAAK,oBAAoB;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;SACnF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED,wFAAwF;IACxF,oFAAoF;IACpF,KAAK,CAAC,aAAa,CAAC,IAA0C;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAC9E,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,yCAAyC,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,MAAqB;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,qBAAqB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC;QACvC,GAAG,IAAI,CAAC,IAAI;aACT,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC;aAC3C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;KACvD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"signingKey.js","sourceRoot":"","sources":["../src/signingKey.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAwC,MAAM,aAAa,CAAC;AAGpF,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAG3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAK5D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,MAAc;QACxB,KAAK,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAID,SAAS,UAAU,CAAC,IAAwB;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAOD,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,OAAmB,EACnB,SAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAAC,iDAAiD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GACR,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,QAAQ;YACpD,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,cAAc,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACnD,MAAM,QAAQ,GACZ,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,aAAc,SAAQ,kBAAkB;IAC1C,IAAI,CAAS;IACb,IAAI,CAAS;IACb,UAAU,CAAY;IACtB,OAAO,CAAgB;IACvB,OAAO,CAAU;IACjB,aAAa,CAAoC;IAE1D,YACE,GAAkB,EAClB,MAAqB,EACrB,MAAe,EACf,YAAkC;QAElC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAA6B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IAED,IAAa,GAAG;QACd,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAa,GAAG;QACd,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,gEAAgE;IAChE,IAAI,SAAS;QACX,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IACtE,CAAC;IAEQ,SAAS;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,IAAgB;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,oBAAoB,CAAC,OAAO,IAAI,CAAC,IAAI,8BAA8B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,oBAAoB,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,iFAAiF;QACjF,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAoB,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,EAAE,EAAE,SAAS,CAAC;QACrD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YAC7C,IAAI;YACJ,GAAG,EAAE,IAAI,CAAC,IAAI;YACd,QAAQ;YACR,YAAY;YACZ,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,KAAK,oBAAoB;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;SACnF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED,wFAAwF;IACxF,oFAAoF;IACpF,KAAK,CAAC,aAAa,CAAC,IAA0C;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAC9E,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,yCAAyC,CAAC,CAAC;YAC3E,CAAC;YACD,wFAAwF;YACxF,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC1E,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAC7B,IAAsB,EACtB,MAAqB,EACrB,YAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,qBAAqB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;QACrD,GAAG,IAAI,CAAC,IAAI;aACT,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC;aAC3C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEjD;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAChB,OAAO,CAAgB;IACvB,IAAI,CAAS;IACb,MAAM,CAAmB;IAClC,KAAK,CAAkB;IACvB,UAAU,CAA4B;IAEtC,YAAY,IAAsB,EAAE,MAAqB;QACvD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,yDAAyD;IACzD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,8CAA8C;IAC9C,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,8DAA8D;IAC9D,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IACxE,MAAM;QACJ,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC5C,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,6DAA6D;QAC7D,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,SAAS,IAAI,CAAC,IAAI,wBAAwB,CACjG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,iGAAiG;IACjG,YAAY,CAAC,UAAU,GAAG,sBAAsB;QAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACrC,OAAO,CAAC,KAAK,CAAC,sDAAsD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvF,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,cAAe,SAAQ,kBAAkB;IACpC,KAAK,CAAiB;IACtB,MAAM,CAAS;IAExB,YAAY,IAAoB,EAAE,KAAa;QAC7C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,2FAA2F;IAC3F,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC;IACvC,CAAC;IAED,IAAa,GAAG;QACd,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC;IACzB,CAAC;IAED,IAAa,GAAG;QACd,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC;IACzB,CAAC;IAEQ,SAAS;QAChB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;IACjC,CAAC;IAEQ,IAAI,CAAC,IAAgB;QAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;CACF"}