@spinajs/authn-keys 0.0.0-stage → 3.0.0

package/lib/mjs/nonce/store.js

@@ -0,0 +1,92 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { createHash } from 'node:crypto';
+import { Autoinject, Injectable } from '@spinajs/di';
+import { Orm } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+import { AuthnNonce } from '../models/AuthnNonce.js';
+/** Single-use values (assertion jti, HTTP signature nonces) until they expire. */
+export class KeyNonceStore {
+}
+/** A fixed-length store key for a value a client chose, scoped to the key that signed it. */
+export const nonceKey = (scope, kid, value) => `${scope}:${createHash('sha256').update(`${kid}\n${value}`, 'utf8').digest('base64url')}`;
+const SWEEP_EVERY = 256;
+export class MemoryKeyNonceStore extends KeyNonceStore {
+    constructor() {
+        super(...arguments);
+        this.live = new Map();
+        this.claims = 0;
+    }
+    async claim(key, expiresAt, now) {
+        const nowMs = now.getTime();
+        this.claims += 1;
+        if (this.claims % SWEEP_EVERY === 0) {
+            for (const [k, until] of this.live) {
+                if (until <= nowMs) {
+                    this.live.delete(k);
+                }
+            }
+        }
+        const until = this.live.get(key);
+        if (until !== undefined && until > nowMs) {
+            return false;
+        }
+        this.live.set(key, expiresAt.getTime());
+        return true;
+    }
+}
+const PURGE_EVERY = 64;
+const PURGE_BATCH = 500;
+/** authn_nonce through the ORM: the primary key makes a claim atomic across processes. */
+let DbKeyNonceStore = class DbKeyNonceStore extends KeyNonceStore {
+    constructor() {
+        super(...arguments);
+        this.claims = 0;
+    }
+    async claim(key, expiresAt, now) {
+        const nowDt = DateTime.fromJSDate(now);
+        this.claims += 1;
+        if (this.claims % PURGE_EVERY === 0) {
+            await this.purge(nowDt);
+        }
+        try {
+            await new AuthnNonce({ k: key, expires_at: DateTime.fromJSDate(expiresAt) }).insert();
+            return true;
+        }
+        catch (e) {
+            // Taken: only an expired row may be taken over, and the conditional update lets one claimant win.
+            const r = (await AuthnNonce.update({ expires_at: DateTime.fromJSDate(expiresAt) })
+                .where('k', key)
+                .where('expires_at', '<=', nowDt));
+            if ((r?.RowsAffected ?? 0) === 1) {
+                return true;
+            }
+            if ((await AuthnNonce.where('k', key)).length === 0) {
+                throw e;
+            }
+            return false;
+        }
+    }
+    async purge(now) {
+        const expired = await AuthnNonce.where('expires_at', '<=', now).take(PURGE_BATCH);
+        if (expired.length > 0) {
+            await AuthnNonce.destroy(expired.map((r) => r.k)).where('expires_at', '<=', now);
+        }
+    }
+};
+__decorate([
+    Autoinject(Orm),
+    __metadata("design:type", Orm)
+], DbKeyNonceStore.prototype, "Orm", void 0);
+DbKeyNonceStore = __decorate([
+    Injectable(KeyNonceStore)
+], DbKeyNonceStore);
+export { DbKeyNonceStore };
+//# sourceMappingURL=store.js.map

package/lib/mjs/nonce/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/nonce/store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,kFAAkF;AAClF,MAAM,OAAgB,aAAa;CAGlC;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAoB,EAAE,GAAW,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAEhL,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IAAtD;;QACmB,SAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,WAAM,GAAG,CAAC,CAAC;IAmBrB,CAAC;IAjBC,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS;QACjD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;oBACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,0FAA0F;AAEnF,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,aAAa;IAA3C;;QAKG,WAAM,GAAG,CAAC,CAAC;IAgCrB,CAAC;IA9BC,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kGAAkG;YAClG,MAAM,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;iBAC/E,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;iBACf,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAyC,CAAC;YAC7E,IAAI,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,CAAC;YACV,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAa;QAC/B,MAAM,OAAO,GAAiB,MAAM,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF,CAAA;AAlCW;IADT,UAAU,CAAC,GAAG,CAAC;8BACD,GAAG;4CAAC;AAHR,eAAe;IAD3B,UAAU,CAAC,aAAa,CAAC;GACb,eAAe,CAqC3B"}

package/lib/mjs/options/index.d.ts

@@ -0,0 +1,2 @@
+export * from './options.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/options/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/options/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC"}

package/lib/mjs/options/index.js

@@ -0,0 +1,2 @@
+export * from './options.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/options/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/options/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC"}

package/lib/mjs/options/options.d.ts

@@ -0,0 +1,47 @@
+import type { KeyAlgorithm } from '@spinajs/authn/contracts';
+/** `authn.keys` as the schema validates and defaults it. */
+export interface KeysConfig {
+    readonly algorithms: readonly KeyAlgorithm[];
+    readonly challenge: {
+        readonly ttlSeconds: number;
+        readonly audience: string | null;
+    };
+    readonly assertion: {
+        readonly typ: string;
+        readonly audience: string | null;
+        readonly maxLifetimeSeconds: number;
+        readonly skewSeconds: number;
+    };
+    readonly httpSignature: {
+        readonly maxAgeSeconds: number;
+        readonly skewSeconds: number;
+        readonly requiredComponents: readonly string[];
+    };
+}
+/** `authn.keys` (design §22.5) after defaults. */
+export interface KeysOptions {
+    readonly algorithms: readonly KeyAlgorithm[];
+    readonly challenge: {
+        readonly ttlSeconds: number;
+        /** What clients put in a challenge's signing input; default: assertion.audience. Challenges need one of them. */
+        readonly audience: string | null;
+    };
+    readonly assertion: {
+        readonly typ: string;
+        /** Required once a strategy that reads assertions is listed. */
+        readonly audience: string | null;
+        readonly maxLifetimeSeconds: number;
+        readonly skewSeconds: number;
+    };
+    readonly httpSignature: {
+        readonly maxAgeSeconds: number;
+        readonly skewSeconds: number;
+        readonly requiredComponents: readonly string[];
+    };
+}
+/**
+ * The options of a validated `authn.keys`: frozen, with the challenge audience falling back to the assertion audience.
+ * Cached per config object, so a reloaded configuration gives fresh options. Takes options it returned as they are.
+ */
+export declare function keysOptionsOf(config: KeysConfig): KeysOptions;
+//# sourceMappingURL=options.d.ts.map

package/lib/mjs/options/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG7D,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClJ,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC1I;AAED,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,iHAAiH;QACjH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,gEAAgE;QAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,CAAC;CACH;AAuBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAc7D"}

package/lib/mjs/options/options.js

@@ -0,0 +1,39 @@
+import { InvalidOption } from '@spinajs/exceptions';
+const derived = new WeakMap();
+const RANGES = [
+    ['challenge', 'ttlSeconds', 1, 3600],
+    ['assertion', 'maxLifetimeSeconds', 1, 300],
+    ['assertion', 'skewSeconds', 0, 300],
+    ['httpSignature', 'maxAgeSeconds', 1, 300],
+    ['httpSignature', 'skewSeconds', 0, 300],
+];
+// The schema is the gate; this floor holds for values that never went through it (explicit Options, runtime
+// Configuration.set): a NaN or missing bound switches the lifetime and skew checks off.
+function checkRanges(config) {
+    for (const [block, key, min, max] of RANGES) {
+        const value = config[block]?.[key];
+        if (!(Number.isInteger(value) && value >= min && value <= max)) {
+            throw new InvalidOption(`authn.keys.${block}.${key} must be an integer from ${min} to ${max}`);
+        }
+    }
+}
+/**
+ * The options of a validated `authn.keys`: frozen, with the challenge audience falling back to the assertion audience.
+ * Cached per config object, so a reloaded configuration gives fresh options. Takes options it returned as they are.
+ */
+export function keysOptionsOf(config) {
+    let options = derived.get(config);
+    if (!options) {
+        checkRanges(config);
+        options = Object.freeze({
+            algorithms: Object.freeze([...config.algorithms]),
+            challenge: Object.freeze({ ttlSeconds: config.challenge.ttlSeconds, audience: config.challenge.audience ?? config.assertion.audience }),
+            assertion: Object.freeze({ ...config.assertion }),
+            httpSignature: Object.freeze({ ...config.httpSignature, requiredComponents: Object.freeze([...config.httpSignature.requiredComponents]) }),
+        });
+        derived.set(config, options);
+        derived.set(options, options);
+    }
+    return options;
+}
+//# sourceMappingURL=options.js.map

package/lib/mjs/options/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAgCpD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAuB,CAAC;AAEnD,MAAM,MAAM,GAAsH;IAChI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC;IACpC,CAAC,WAAW,EAAE,oBAAoB,EAAE,CAAC,EAAE,GAAG,CAAC;IAC3C,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;IACpC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,GAAG,CAAC;IAC1C,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;CACzC,CAAC;AAEF,4GAA4G;AAC5G,wFAAwF;AACxF,SAAS,WAAW,CAAC,MAAkB;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAa,MAAM,CAAC,KAAK,CAAoD,EAAE,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,GAAG,IAAK,KAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,aAAa,CAAC,cAAc,KAAK,IAAI,GAAG,4BAA4B,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB;IAC9C,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvI,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;SAC3I,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/lib/mjs/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/mjs/register-schema.d.ts

@@ -0,0 +1,2 @@
+import '@spinajs/authn/register-schema';
+//# sourceMappingURL=register-schema.d.ts.map

package/lib/mjs/register-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-schema.d.ts","sourceRoot":"","sources":["../../src/register-schema.ts"],"names":[],"mappings":"AAAA,OAAO,gCAAgC,CAAC"}

package/lib/mjs/register-schema.js

@@ -0,0 +1,7 @@
+import '@spinajs/authn/register-schema';
+import { registerConfigurationSchemaAtImport } from '@spinajs/configuration';
+import { AUTHN_KEYS_CONFIGURATION_SCHEMA } from './schema.js';
+// What `@spinajs/authn/register-schema` is for authn.*, for authn.keys: every module of this package that reads it
+// imports it.
+registerConfigurationSchemaAtImport(AUTHN_KEYS_CONFIGURATION_SCHEMA);
+//# sourceMappingURL=register-schema.js.map

package/lib/mjs/register-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-schema.js","sourceRoot":"","sources":["../../src/register-schema.ts"],"names":[],"mappings":"AAAA,OAAO,gCAAgC,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAE7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAE9D,mHAAmH;AACnH,cAAc;AACd,mCAAmC,CAAC,+BAA+B,CAAC,CAAC"}

package/lib/mjs/registry/index.d.ts

@@ -0,0 +1,4 @@
+export * from './store.js';
+export * from './orm-store.js';
+export * from './registry.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/registry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/registry/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC"}

package/lib/mjs/registry/index.js

@@ -0,0 +1,4 @@
+export * from './store.js';
+export * from './orm-store.js';
+export * from './registry.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/registry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/registry/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC"}

package/lib/mjs/registry/orm-store.d.ts

@@ -0,0 +1,15 @@
+import { Orm } from '@spinajs/orm';
+import type { IdentityRef, KeyRecord } from '@spinajs/authn/contracts';
+import { KeyStore } from './store.js';
+/** authn_key through the ORM (connection 'default', migration AuthnKeys_2026_10_02_00_00_00). */
+export declare class OrmKeyStore extends KeyStore {
+    /** The cli resolves only the command it runs, so without this the models are unbound and every query throws. */
+    protected Orm: Orm;
+    private taken;
+    insert(key: KeyRecord): Promise<'inserted' | 'duplicate'>;
+    get(kid: string): Promise<KeyRecord | null>;
+    listByOwner(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    revoke(owner: IdentityRef, kid: string, at: Date): Promise<'revoked' | 'already' | 'none'>;
+    touch(kid: string, at: Date): Promise<void>;
+}
+//# sourceMappingURL=orm-store.d.ts.map

package/lib/mjs/registry/orm-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-store.d.ts","sourceRoot":"","sources":["../../../src/registry/orm-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAgB,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAY,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAIjF,OAAO,EAAwE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAuB5G,iGAAiG;AACjG,qBACa,WAAY,SAAQ,QAAQ;IACvC,gHAAgH;IAEhH,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;YAEL,KAAK;IAMb,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,WAAW,CAAC,CA2B9D;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAIhD;IAEK,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAGnE;IAEK,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAY/F;IAEK,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhD;CACF"}

package/lib/mjs/registry/orm-store.js

@@ -0,0 +1,106 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Autoinject, Injectable } from '@spinajs/di';
+import { Orm, rowsAffected } from '@spinajs/orm';
+import { sameRef } from '@spinajs/authn/contracts';
+import { AuthnKey } from '../models/AuthnKey.js';
+import { DateTime } from 'luxon';
+import { decodeCeiling, decodePrincipalRef, encodeCeiling, encodePrincipalRef, KeyStore } from './store.js';
+function toRecord(row) {
+    const createdBy = row.created_by ? decodePrincipalRef(row.created_by) : undefined;
+    const expiresAt = row.expires_at?.toJSDate();
+    const revokedAt = row.revoked_at?.toJSDate();
+    const lastUsedAt = row.last_used_at?.toJSDate();
+    return Object.freeze({
+        kid: row.kid,
+        owner: Object.freeze({ type: row.owner_type, id: row.owner_id }),
+        alg: row.alg,
+        jwk: Object.freeze(JSON.parse(row.jwk)),
+        thumbprint: row.thumbprint,
+        ...(row.name ? { name: row.name } : {}),
+        ...(row.scope ? { scope: decodeCeiling(row.scope) } : {}),
+        createdAt: row.created_at.toJSDate(),
+        ...(createdBy ? { createdBy } : {}),
+        ...(expiresAt ? { expiresAt } : {}),
+        ...(revokedAt ? { revokedAt } : {}),
+        ...(lastUsedAt ? { lastUsedAt } : {}),
+    });
+}
+/** authn_key through the ORM (connection 'default', migration AuthnKeys_2026_10_02_00_00_00). */
+let OrmKeyStore = class OrmKeyStore extends KeyStore {
+    async taken(key) {
+        const byKid = await AuthnKey.where('kid', key.kid);
+        const byThumb = await AuthnKey.where('thumbprint', key.thumbprint);
+        return byKid.length > 0 || byThumb.length > 0;
+    }
+    async insert(key) {
+        if (await this.taken(key)) {
+            return 'duplicate';
+        }
+        const row = new AuthnKey({
+            kid: key.kid,
+            owner_type: key.owner.type,
+            owner_id: key.owner.id,
+            alg: key.alg,
+            jwk: JSON.stringify(key.jwk),
+            thumbprint: key.thumbprint,
+            scope: key.scope ? encodeCeiling(key.scope) : null,
+            name: key.name ?? null,
+            created_by: key.createdBy ? encodePrincipalRef(key.createdBy) : null,
+            created_at: DateTime.fromJSDate(key.createdAt),
+            ...(key.expiresAt ? { expires_at: DateTime.fromJSDate(key.expiresAt) } : {}),
+        });
+        try {
+            await row.insert();
+        }
+        catch (e) {
+            // Drivers report a unique violation differently; a row that now exists means another insert won the race.
+            if (await this.taken(key)) {
+                return 'duplicate';
+            }
+            throw e;
+        }
+        return 'inserted';
+    }
+    async get(kid) {
+        // A case-insensitive collation (MySQL's default) would also match another case of the kid.
+        const row = (await AuthnKey.where('kid', kid)).find((r) => r.kid === kid);
+        return row ? toRecord(row) : null;
+    }
+    async listByOwner(owner) {
+        const rows = await AuthnKey.where({ owner_type: owner.type, owner_id: owner.id });
+        return rows.map(toRecord);
+    }
+    async revoke(owner, kid, at) {
+        const row = await this.get(kid);
+        if (!row || !sameRef(row.owner, owner)) {
+            return 'none';
+        }
+        if (row.revokedAt) {
+            return 'already';
+        }
+        const r = await AuthnKey.update({ revoked_at: DateTime.fromJSDate(at) })
+            .where('kid', kid)
+            .whereNull('revoked_at');
+        return rowsAffected(r) > 0 ? 'revoked' : 'already';
+    }
+    async touch(kid, at) {
+        await AuthnKey.update({ last_used_at: DateTime.fromJSDate(at) }).where('kid', kid);
+    }
+};
+__decorate([
+    Autoinject(Orm),
+    __metadata("design:type", Orm)
+], OrmKeyStore.prototype, "Orm", void 0);
+OrmKeyStore = __decorate([
+    Injectable(KeyStore)
+], OrmKeyStore);
+export { OrmKeyStore };
+//# sourceMappingURL=orm-store.js.map

package/lib/mjs/registry/orm-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-store.js","sourceRoot":"","sources":["../../../src/registry/orm-store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE5G,SAAS,QAAQ,CAAC,GAAa;IAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAa;QAC5E,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE;QACpC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAc,CAAC;AAClB,CAAC;AAED,iGAAiG;AAE1F,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,QAAQ;IAK/B,KAAK,CAAC,KAAK,CAAC,GAAc;QAChC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAc;QACzB,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC;YACvB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI;YAC1B,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;YACtB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YAClD,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YACpE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0GAA0G;YAC1G,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,2FAA2F;QAC3F,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC1E,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAkB;QAClC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB,EAAE,GAAW,EAAE,EAAQ;QACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;aACrE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;aACjB,SAAS,CAAC,YAAY,CAAC,CAAC;QAC3B,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,EAAQ;QAC/B,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;CACF,CAAA;AAjEW;IADT,UAAU,CAAC,GAAG,CAAC;8BACD,GAAG;wCAAC;AAHR,WAAW;IADvB,UAAU,CAAC,QAAQ,CAAC;GACR,WAAW,CAoEvB"}

package/lib/mjs/registry/registry.d.ts

@@ -0,0 +1,54 @@
+import '../register-schema.js';
+import { AuthnAudit } from '@spinajs/authn/audit';
+import type { AuthnAuditor, AuthnEventBody } from '@spinajs/authn/audit';
+import { AuthnThrottle, KeyRegistry, SecretStore } from '@spinajs/authn/contracts';
+import type { AuthnContext, IdentityRef, KeyChallengeRequest, KeyChallengeResult, KeyMaterial, KeyOwner, KeyRecord, KeyRegisterResult, KeyRegistration, PrincipalRef } from '@spinajs/authn/contracts';
+import type { KeysConfig, KeysOptions } from '../options/options.js';
+import { KeyStore } from './store.js';
+/** Usable for verification: neither revoked nor expired at `now`. */
+export declare const isUsableKey: (key: KeyRecord, now: Date) => boolean;
+/**
+ * A login challenge is stored for the key it names; a name that is not a kid still gets a challenge of the same shape
+ * (A02), stored under a digest so anonymous input never becomes a long identity id.
+ */
+export declare const loginChallengeIdentity: (kid: string) => IdentityRef;
+/** A test seam for building the registry with `new`: each field replaces what DI injects. */
+export interface DefaultKeyRegistryDeps {
+    readonly store?: KeyStore;
+    readonly secrets?: SecretStore;
+    readonly throttle?: AuthnThrottle;
+    /** Published to instead of the container's AuthnAudit. */
+    readonly audit?: AuthnAuditor;
+    /** Complete options that bypass the configuration. */
+    readonly options?: KeysOptions;
+}
+/** KeyRegistry over a KeyStore, challenges in SecretStore (lane notes D7, D12). */
+export declare class DefaultKeyRegistry extends KeyRegistry {
+    protected readonly Deps?: DefaultKeyRegistryDeps | undefined;
+    protected KeysConfig: KeysConfig;
+    protected Audit: AuthnAudit;
+    protected Store: KeyStore;
+    protected Secrets: SecretStore;
+    protected Throttle: AuthnThrottle;
+    private readonly stamped;
+    /** Kids whose last stamp is remembered; past this the least recently stamped is forgotten and costs one extra write. */
+    protected readonly maxStamped: number;
+    constructor(Deps?: DefaultKeyRegistryDeps | undefined);
+    protected get store(): KeyStore;
+    protected get secrets(): SecretStore;
+    protected get throttle(): AuthnThrottle;
+    protected get options(): KeysOptions;
+    protected publish(ctx: AuthnContext, e: AuthnEventBody): Promise<void>;
+    /** The new key's signature over a 'register' challenge issued to this user; the challenge is redeemed only after the signature holds. */
+    protected proofHolds(owner: KeyOwner, key: KeyMaterial, proof: unknown): Promise<boolean>;
+    register(reg: KeyRegistration, ctx: AuthnContext): Promise<KeyRegisterResult>;
+    list(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    revoke(owner: IdentityRef, kid: string, ctx: AuthnContext, opts?: {
+        readonly actor?: PrincipalRef;
+    }): Promise<boolean>;
+    byId(kid: string): Promise<KeyRecord | null>;
+    /** Stamps last_used_at after a successful verification, at most once a minute per key so busy clients write little. */
+    touch(kid: string, at: Date): Promise<void>;
+    challenge(req: KeyChallengeRequest, ctx: AuthnContext): Promise<KeyChallengeResult>;
+}
+//# sourceMappingURL=registry.d.ts.map

package/lib/mjs/registry/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/registry/registry.ts"],"names":[],"mappings":"AAGA,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAW,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAMhN,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAoD,QAAQ,EAAE,MAAM,YAAY,CAAC;AA4CxF,qEAAqE;AACrE,eAAO,MAAM,WAAW,QAAS,SAAS,OAAO,IAAI,KAAG,OAAwF,CAAC;AAEjJ;;;GAGG;AACH,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,WAAoH,CAAC;AAE1K,6FAA6F;AAC7F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;CAChC;AAED,mFAAmF;AACnF,qBACa,kBAAmB,SAAQ,WAAW;IAqBrC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB;IAnB5D,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAGjC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;IAG5B,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;IAG1B,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;IAG/B,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,wHAAwH;IACxH,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAU;IAE/C,YAA+B,IAAI,CAAC,EAAE,sBAAsB,YAAA,EAE3D;IAED,SAAS,KAAK,KAAK,IAAI,QAAQ,CAE9B;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,SAAS,KAAK,QAAQ,IAAI,aAAa,CAEtC;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;IAED,yIAAyI;IACzI,UAAgB,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9F;IAEK,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkDlF;IAEK,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAE5D;IAEK,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAU3H;IAEK,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAEjD;IAED,uHAAuH;IACjH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhD;IAEK,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8BxF;CACF"}