@spinajs/authn-keys 0.0.0-stage → 3.0.0

package/lib/cjs/schema.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHN_KEYS_CONFIGURATION_SCHEMA = void 0;
+const stringList = { type: 'array', items: { type: 'string', minLength: 1 } };
+/** The authn.keys fragment of the authn configuration; `assertion.typ` is in the authn schema. */
+exports.AUTHN_KEYS_CONFIGURATION_SCHEMA = {
+    $id: 'spinajs/authn-keys.configuration.schema.json',
+    $configurationModule: 'authn.keys',
+    description: 'Client key configuration (authn.keys)',
+    type: 'object',
+    properties: {
+        algorithms: { type: 'array', minItems: 1, uniqueItems: true, items: { type: 'string', enum: ['EdDSA', 'ES256'] }, default: ['EdDSA', 'ES256'] },
+        challenge: {
+            type: 'object',
+            default: {},
+            properties: {
+                ttlSeconds: { type: 'integer', minimum: 1, maximum: 3600, default: 120 },
+                audience: { type: ['string', 'null'], minLength: 1, default: null, description: "What clients put in a challenge's signing input; default: assertion.audience. Challenges need one of them." },
+            },
+        },
+        assertion: {
+            type: 'object',
+            default: {},
+            properties: {
+                audience: { type: ['string', 'null'], minLength: 1, default: null, description: 'Required once a strategy that reads assertions is listed.' },
+                maxLifetimeSeconds: { type: 'integer', minimum: 1, maximum: 300, default: 300 },
+                skewSeconds: { type: 'integer', minimum: 0, maximum: 300, default: 30 },
+            },
+        },
+        httpSignature: {
+            type: 'object',
+            default: {},
+            properties: {
+                maxAgeSeconds: { type: 'integer', minimum: 1, maximum: 300, default: 300 },
+                skewSeconds: { type: 'integer', minimum: 0, maximum: 300, default: 30 },
+                requiredComponents: { ...stringList, default: ['@method', '@target-uri', 'content-digest'] },
+            },
+        },
+    },
+};
+//# sourceMappingURL=schema.js.map

package/lib/cjs/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":";;;AAAA,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;AAE9E,kGAAkG;AACrF,QAAA,+BAA+B,GAAG;IAC7C,GAAG,EAAE,8CAA8C;IACnD,oBAAoB,EAAE,YAAY;IAClC,WAAW,EAAE,uCAAuC;IACpD,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;QAC/I,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,UAAU,EAAE;gBACV,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;gBACxE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,4GAA4G,EAAE;aAC/L;SACF;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,2DAA2D,EAAE;gBAC7I,kBAAkB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;gBAC/E,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;aACxE;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,UAAU,EAAE;gBACV,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;gBAC1E,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;gBACvE,kBAAkB,EAAE,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,CAAC,EAAE;aAC7F;SACF;KACF;CACF,CAAC"}

package/lib/cjs/strategies/assertion.d.ts

@@ -0,0 +1,29 @@
+import { JwsVerifier } from '@spinajs/authn/contracts';
+import type { AuthnContext, Credentials, StrategyOutcome, ThrottleKey } from '@spinajs/authn/contracts';
+import { KeyNonceStore } from '../nonce/store.js';
+import { KeyStrategy } from './keys.js';
+import type { KeyStrategyDeps } from './keys.js';
+export interface JwsAssertionStrategyDeps extends KeyStrategyDeps {
+    readonly verifier?: JwsVerifier;
+    readonly nonces?: KeyNonceStore;
+}
+/**
+ * Machine clients: `Authorization: Bearer <jws>` signed by a registered key (design §22.10, A17). Header typ
+ * `authn.keys.assertion.typ`; claims iss = the key owner as `<type>:<id>`, aud = `authn.keys.assertion.audience`,
+ * iat, exp (lifetime at most 300 s) and a jti accepted once within its lifetime.
+ */
+export declare class JwsAssertionStrategy extends KeyStrategy<JwsAssertionStrategyDeps> {
+    readonly name = "keys-jws";
+    readonly kinds: string[];
+    readonly interactive = false;
+    protected Verifier: JwsVerifier;
+    protected Nonces: KeyNonceStore;
+    protected get verifier(): JwsVerifier;
+    protected get nonces(): KeyNonceStore;
+    /** The audience the assertions name; which strategies are listed decides that one is required, so this is a boot check, not a schema rule. */
+    protected get audience(): string;
+    resolve(): Promise<void>;
+    throttleKeys(c: Credentials, ctx: AuthnContext): readonly ThrottleKey[];
+    verify(c: Credentials, ctx: AuthnContext): Promise<StrategyOutcome>;
+}
+//# sourceMappingURL=assertion.d.ts.map

package/lib/cjs/strategies/assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertion.d.ts","sourceRoot":"","sources":["../../../src/strategies/assertion.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAgB,WAAW,EAAsC,eAAe,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAM1J,OAAO,EAAE,aAAa,EAAY,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAA+E,MAAM,WAAW,CAAC;AACrH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAkBjD,MAAM,WAAW,wBAAyB,SAAQ,eAAe;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED;;;;GAIG;AACH,qBACa,oBAAqB,SAAQ,WAAW,CAAC,wBAAwB,CAAC;IAC7E,QAAQ,CAAC,IAAI,cAAc;IAC3B,QAAQ,CAAC,KAAK,WAAqB;IACnC,QAAQ,CAAC,WAAW,SAAS;IAG7B,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAGhC,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC;IAEhC,SAAS,KAAK,QAAQ,IAAI,WAAW,CAEpC;IAED,SAAS,KAAK,MAAM,IAAI,aAAa,CAEpC;IAED,8IAA8I;IAC9I,SAAS,KAAK,QAAQ,IAAI,MAAM,CAM/B;IAEY,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAGpC;IAED,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,SAAS,WAAW,EAAE,CAEtE;IAEK,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAwCxE;CACF"}

package/lib/cjs/strategies/assertion.js

@@ -0,0 +1,118 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwsAssertionStrategy = void 0;
+const di_1 = require("@spinajs/di");
+const contracts_1 = require("@spinajs/authn/contracts");
+const util_1 = require("@spinajs/util");
+const exceptions_1 = require("@spinajs/exceptions");
+const base64url_js_1 = require("../jwk/base64url.js");
+const keys_js_1 = require("../jwk/keys.js");
+const json_js_1 = require("../jws/json.js");
+const store_js_1 = require("../nonce/store.js");
+const keys_js_2 = require("./keys.js");
+const MAX_JTI = 128;
+const assertionClaims = (p) => (typeof p.jti === 'string' && p.jti.length > 0 && p.jti.length <= MAX_JTI ? p : null);
+function headerOf(jws) {
+    const text = typeof jws === 'string' && jws.length <= keys_js_2.MAX_CREDENTIAL_LENGTH ? jws.slice(0, jws.indexOf('.')) : '';
+    const bytes = (0, base64url_js_1.decodeB64url)(text);
+    const h = bytes ? (0, json_js_1.parseStrictJson)(bytes) : undefined;
+    const alg = (0, util_1.isPlainObject)(h) && keys_js_1.KEY_ALGORITHMS.includes(h.alg) ? h.alg : 'EdDSA';
+    return { kid: (0, util_1.isPlainObject)(h) && typeof h.kid === 'string' ? h.kid : null, alg };
+}
+/**
+ * Machine clients: `Authorization: Bearer <jws>` signed by a registered key (design §22.10, A17). Header typ
+ * `authn.keys.assertion.typ`; claims iss = the key owner as `<type>:<id>`, aud = `authn.keys.assertion.audience`,
+ * iat, exp (lifetime at most 300 s) and a jti accepted once within its lifetime.
+ */
+let JwsAssertionStrategy = class JwsAssertionStrategy extends keys_js_2.KeyStrategy {
+    constructor() {
+        super(...arguments);
+        this.name = 'keys-jws';
+        this.kinds = ['jws-assertion'];
+        this.interactive = false;
+    }
+    get verifier() {
+        return this.Deps?.verifier ?? this.Verifier;
+    }
+    get nonces() {
+        return this.Deps?.nonces ?? this.Nonces;
+    }
+    /** The audience the assertions name; which strategies are listed decides that one is required, so this is a boot check, not a schema rule. */
+    get audience() {
+        const audience = this.options.assertion.audience;
+        if (audience === null) {
+            throw new exceptions_1.InvalidOption('authn.keys.assertion.audience must be set to accept JWS assertions');
+        }
+        return audience;
+    }
+    async resolve() {
+        void this.audience;
+        await super.resolve();
+    }
+    throttleKeys(c, ctx) {
+        return (0, keys_js_2.keyThrottleKeys)(c.kind === 'jws-assertion' ? headerOf(c.jws).kid : null, ctx);
+    }
+    async verify(c, ctx) {
+        if (c.kind !== 'jws-assertion') {
+            return (0, keys_js_2.failure)('unsupported_credentials');
+        }
+        const [ok, jws] = (0, util_1._try_check_arg)((0, util_1._is_string)((0, util_1._max_length)(keys_js_2.MAX_CREDENTIAL_LENGTH)))(c.jws, 'jws');
+        if (!ok) {
+            return (0, keys_js_2.failure)('invalid_credentials');
+        }
+        const a = this.options.assertion;
+        let unusable = 'invalid_credentials';
+        const r = await this.verifier.verify(jws, {
+            typ: a.typ,
+            algorithms: this.options.algorithms,
+            keys: async (kid) => {
+                const found = await (0, keys_js_2.usableKey)(this.registry, kid, ctx);
+                if (!found.key) {
+                    unusable = found.reason;
+                    return null;
+                }
+                return found.key;
+            },
+            claims: assertionClaims,
+            issuer: (iss, key) => iss === (0, keys_js_2.assertionIssuer)(key.owner),
+            audience: this.audience,
+            now: ctx.now,
+            skewSeconds: a.skewSeconds,
+            maxLifetimeSeconds: a.maxLifetimeSeconds,
+        });
+        if (!r.ok) {
+            if (r.code === 'unknown_key') {
+                const [h, p, s] = jws.split('.');
+                this.unknownKeyWork(headerOf(jws).alg, Buffer.from(`${h}.${p}`, 'ascii'), (0, base64url_js_1.decodeB64url)(s) ?? Buffer.alloc(0));
+                return (0, keys_js_2.failure)(unusable);
+            }
+            return (0, keys_js_2.failure)('invalid_credentials');
+        }
+        if (!(await this.nonces.claim((0, store_js_1.nonceKey)('jti', r.key.kid, r.claims.jti), new Date((r.claims.exp + a.skewSeconds) * 1000), ctx.now))) {
+            return (0, keys_js_2.failure)('invalid_credentials');
+        }
+        return this.success(r.key, 'jws', ctx);
+    }
+};
+exports.JwsAssertionStrategy = JwsAssertionStrategy;
+__decorate([
+    (0, di_1.Autoinject)(contracts_1.JwsVerifier),
+    __metadata("design:type", contracts_1.JwsVerifier)
+], JwsAssertionStrategy.prototype, "Verifier", void 0);
+__decorate([
+    (0, di_1.Autoinject)(store_js_1.KeyNonceStore),
+    __metadata("design:type", store_js_1.KeyNonceStore)
+], JwsAssertionStrategy.prototype, "Nonces", void 0);
+exports.JwsAssertionStrategy = JwsAssertionStrategy = __decorate([
+    (0, di_1.Injectable)(contracts_1.AuthenticationStrategy)
+], JwsAssertionStrategy);
+//# sourceMappingURL=assertion.js.map

package/lib/cjs/strategies/assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertion.js","sourceRoot":"","sources":["../../../src/strategies/assertion.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAqD;AACrD,wDAA+E;AAE/E,wCAAuF;AACvF,oDAAoD;AACpD,sDAAmD;AACnD,4CAAgD;AAChD,4CAAiD;AACjD,gDAA4D;AAC5D,uCAAqH;AAGrH,MAAM,OAAO,GAAG,GAAG,CAAC;AAMpB,MAAM,eAAe,GAAG,CAAC,CAAoC,EAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAE,CAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEhN,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,+BAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,MAAM,KAAK,GAAG,IAAA,2BAAY,EAAC,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,MAAM,GAAG,GAAG,IAAA,oBAAa,EAAC,CAAC,CAAC,IAAI,wBAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAmB,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,GAAoB,CAAC,CAAC,CAAC,OAAO,CAAC;IACnH,OAAO,EAAE,GAAG,EAAE,IAAA,oBAAa,EAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;AACpF,CAAC;AAOD;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,qBAAqC;IAAxE;;QACI,SAAI,GAAG,UAAU,CAAC;QAClB,UAAK,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1B,gBAAW,GAAG,KAAK,CAAC;IA2E/B,CAAC;IAnEC,IAAc,QAAQ;QACpB,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,IAAc,MAAM;QAClB,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAC1C,CAAC;IAED,8IAA8I;IAC9I,IAAc,QAAQ;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;QACjD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAAa,CAAC,oEAAoE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,KAAK,IAAI,CAAC,QAAQ,CAAC;QACnB,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,YAAY,CAAC,CAAc,EAAE,GAAiB;QAC5C,OAAO,IAAA,yBAAe,EAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,CAAc,EAAE,GAAiB;QAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC/B,OAAO,IAAA,iBAAO,EAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,kBAAW,EAAC,+BAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/F,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,IAAA,iBAAO,EAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACjC,IAAI,QAAQ,GAAiB,qBAAqB,CAAC;QACnD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAA6B,GAAG,EAAE;YACpE,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAClB,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAS,EAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;oBACf,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;oBACxB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,KAAK,CAAC,GAAG,CAAC;YACnB,CAAC;YACD,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAA,yBAAe,EAAC,GAAG,CAAC,KAAK,CAAC;YACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC7B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,IAAA,2BAAY,EAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9G,OAAO,IAAA,iBAAO,EAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,IAAA,iBAAO,EAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,mBAAQ,EAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnI,OAAO,IAAA,iBAAO,EAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;;AAxEW;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;sDAAC;AAGtB;IADT,IAAA,eAAU,EAAC,wBAAa,CAAC;8BACR,wBAAa;oDAAC;+BATrB,oBAAoB;IADhC,IAAA,eAAU,EAAC,kCAAsB,CAAC;GACtB,oBAAoB,CA8EhC"}

package/lib/cjs/strategies/challenge.d.ts

@@ -0,0 +1,25 @@
+import { SecretStore } from '@spinajs/authn/contracts';
+import type { AuthnContext, Credentials, StrategyOutcome, ThrottleKey } from '@spinajs/authn/contracts';
+import { KeyStrategy } from './keys.js';
+import type { KeyStrategyDeps } from './keys.js';
+export interface KeyChallengeStrategyDeps extends KeyStrategyDeps {
+    readonly secrets?: SecretStore;
+}
+/**
+ * Challenge-response login for CLIs that want a session (design §22.10): `POST /auth/keys/challenge` gives a
+ * challenge for a kid, the client signs `spinajs-key-login:<nonce>:<audience>` with that key, and `POST /auth/keys/login` sends
+ * `{ keyId, challengeId, signature }`. The signing input names this service (lane notes D6). The challenge is redeemed only after the signature holds, so a wrong signature
+ * burns nothing (the throttle counts it).
+ */
+export declare class KeyChallengeStrategy extends KeyStrategy<KeyChallengeStrategyDeps> {
+    readonly name = "keys-challenge";
+    readonly kinds: string[];
+    readonly interactive = true;
+    protected Secrets: SecretStore;
+    protected get secrets(): SecretStore;
+    protected get audience(): string;
+    resolve(): Promise<void>;
+    throttleKeys(c: Credentials, ctx: AuthnContext): readonly ThrottleKey[];
+    verify(c: Credentials, ctx: AuthnContext): Promise<StrategyOutcome>;
+}
+//# sourceMappingURL=challenge.d.ts.map

package/lib/cjs/strategies/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../src/strategies/challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAKxG,OAAO,EAAE,WAAW,EAA8D,MAAM,WAAW,CAAC;AACpG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,WAAW,wBAAyB,SAAQ,eAAe;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;CAChC;AAED;;;;;GAKG;AACH,qBACa,oBAAqB,SAAQ,WAAW,CAAC,wBAAwB,CAAC;IAC7E,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,KAAK,WAAqB;IACnC,QAAQ,CAAC,WAAW,QAAQ;IAG5B,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;IAE/B,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,SAAS,KAAK,QAAQ,IAAI,MAAM,CAM/B;IAEY,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAGpC;IAED,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,SAAS,WAAW,EAAE,CAEtE;IAEK,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAqBxE;CACF"}

package/lib/cjs/strategies/challenge.js

@@ -0,0 +1,81 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyChallengeStrategy = void 0;
+const di_1 = require("@spinajs/di");
+const contracts_1 = require("@spinajs/authn/contracts");
+const exceptions_1 = require("@spinajs/exceptions");
+const challenge_js_1 = require("../challenge/challenge.js");
+const base64url_js_1 = require("../jwk/base64url.js");
+const registry_js_1 = require("../registry/registry.js");
+const keys_js_1 = require("./keys.js");
+/**
+ * Challenge-response login for CLIs that want a session (design §22.10): `POST /auth/keys/challenge` gives a
+ * challenge for a kid, the client signs `spinajs-key-login:<nonce>:<audience>` with that key, and `POST /auth/keys/login` sends
+ * `{ keyId, challengeId, signature }`. The signing input names this service (lane notes D6). The challenge is redeemed only after the signature holds, so a wrong signature
+ * burns nothing (the throttle counts it).
+ */
+let KeyChallengeStrategy = class KeyChallengeStrategy extends keys_js_1.KeyStrategy {
+    constructor() {
+        super(...arguments);
+        this.name = 'keys-challenge';
+        this.kinds = ['key-challenge'];
+        this.interactive = true;
+    }
+    get secrets() {
+        return this.Deps?.secrets ?? this.Secrets;
+    }
+    get audience() {
+        const audience = this.options.challenge.audience;
+        if (audience === null) {
+            throw new exceptions_1.InvalidOption('authn.keys.challenge.audience (or authn.keys.assertion.audience) must be set for key challenge logins');
+        }
+        return audience;
+    }
+    async resolve() {
+        void this.audience;
+        await super.resolve();
+    }
+    throttleKeys(c, ctx) {
+        return (0, keys_js_1.keyThrottleKeys)(c.kind === 'key-challenge' && typeof c.keyId === 'string' ? c.keyId : null, ctx);
+    }
+    async verify(c, ctx) {
+        if (c.kind !== 'key-challenge') {
+            return (0, keys_js_1.failure)('unsupported_credentials');
+        }
+        const { keyId, challengeId, signature } = c;
+        if (typeof keyId !== 'string' || typeof signature !== 'string' || typeof challengeId !== 'string' || keyId.length + challengeId.length + signature.length > keys_js_1.MAX_CREDENTIAL_LENGTH) {
+            return (0, keys_js_1.failure)('invalid_credentials');
+        }
+        const parsed = (0, challenge_js_1.parseChallengeId)(challengeId);
+        const found = await (0, keys_js_1.usableKey)(this.registry, keyId, ctx);
+        if (!found.key || !parsed) {
+            this.unknownKeyWork((found.key ? found.key.alg : found.alg) ?? 'EdDSA', (0, challenge_js_1.challengeSigningInput)({ nonce: parsed?.nonce ?? '' }, 'login', this.audience), (0, base64url_js_1.decodeB64url)(signature) ?? Buffer.alloc(0));
+            return (0, keys_js_1.failure)(found.key ? 'invalid_credentials' : found.reason);
+        }
+        if (!(0, challenge_js_1.verifyChallengeSignature)(found.key, parsed.nonce, 'login', this.audience, signature)) {
+            return (0, keys_js_1.failure)('invalid_credentials');
+        }
+        if (!(await this.secrets.redeem((0, registry_js_1.loginChallengeIdentity)(keyId), (0, challenge_js_1.challengeSecretPurpose)(parsed.rid), parsed.nonce))) {
+            return (0, keys_js_1.failure)('invalid_credentials');
+        }
+        return this.success(found.key, 'key-challenge', ctx);
+    }
+};
+exports.KeyChallengeStrategy = KeyChallengeStrategy;
+__decorate([
+    (0, di_1.Autoinject)(contracts_1.SecretStore),
+    __metadata("design:type", contracts_1.SecretStore)
+], KeyChallengeStrategy.prototype, "Secrets", void 0);
+exports.KeyChallengeStrategy = KeyChallengeStrategy = __decorate([
+    (0, di_1.Injectable)(contracts_1.AuthenticationStrategy)
+], KeyChallengeStrategy);
+//# sourceMappingURL=challenge.js.map

package/lib/cjs/strategies/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../../src/strategies/challenge.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAqD;AACrD,wDAA+E;AAE/E,oDAAoD;AACpD,4DAAsI;AACtI,sDAAmD;AACnD,yDAAiE;AACjE,uCAAoG;AAOpG;;;;;GAKG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,qBAAqC;IAAxE;;QACI,SAAI,GAAG,gBAAgB,CAAC;QACxB,UAAK,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1B,gBAAW,GAAG,IAAI,CAAC;IAgD9B,CAAC;IA3CC,IAAc,OAAO;QACnB,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;IAC5C,CAAC;IAED,IAAc,QAAQ;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;QACjD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAAa,CAAC,uGAAuG,CAAC,CAAC;QACnI,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,KAAK,IAAI,CAAC,QAAQ,CAAC;QACnB,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,YAAY,CAAC,CAAc,EAAE,GAAiB;QAC5C,OAAO,IAAA,yBAAe,EAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,CAAc,EAAE,GAAiB;QAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC/B,OAAO,IAAA,iBAAO,EAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,CAAoE,CAAC;QAC/G,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,+BAAqB,EAAE,CAAC;YAClL,OAAO,IAAA,iBAAO,EAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAS,EAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,IAAA,oCAAqB,EAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAA,2BAAY,EAAC,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnM,OAAO,IAAA,iBAAO,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,IAAA,uCAAwB,EAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC1F,OAAO,IAAA,iBAAO,EAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAA,oCAAsB,EAAC,KAAK,CAAC,EAAE,IAAA,qCAAsB,EAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClH,OAAO,IAAA,iBAAO,EAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;;AA7CW;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACL,uBAAW;qDAAC;+BANpB,oBAAoB;IADhC,IAAA,eAAU,EAAC,kCAAsB,CAAC;GACtB,oBAAoB,CAmDhC"}

package/lib/cjs/strategies/httpsig.d.ts

@@ -0,0 +1,34 @@
+import type { AuthnContext, Credentials, KeyAlgorithm, SignedRequest, StrategyOutcome, ThrottleKey } from '@spinajs/authn/contracts';
+import type { SignatureInput } from '../httpsig/fields.js';
+import { KeyNonceStore } from '../nonce/store.js';
+import { KeyStrategy } from './keys.js';
+import type { KeyStrategyDeps } from './keys.js';
+interface Checked {
+    readonly input: SignatureInput;
+    readonly signature: Buffer;
+    readonly kid: string;
+    readonly nonce: string;
+    readonly expires: number;
+    readonly alg?: KeyAlgorithm;
+}
+export interface HttpSignatureStrategyDeps extends KeyStrategyDeps {
+    readonly nonces?: KeyNonceStore;
+}
+/**
+ * Per-request HTTP message signatures, an RFC 9421 subset (design §22.10, A18): one signature; `@method`,
+ * `@target-uri` and, with a body, `content-digest` (RFC 9530, checked against the body) covered; `created`, `expires`
+ * at most `maxAgeSeconds` after it, a single-use `nonce` and `keyid`; `alg` optional. Any label is accepted.
+ */
+export declare class HttpSignatureStrategy extends KeyStrategy<HttpSignatureStrategyDeps> {
+    readonly name = "keys-httpsig";
+    readonly kinds: string[];
+    readonly interactive = false;
+    protected Nonces: KeyNonceStore;
+    protected get nonces(): KeyNonceStore;
+    throttleKeys(c: Credentials, ctx: AuthnContext): readonly ThrottleKey[];
+    /** Everything that needs no key: the headers' form, the parameters, coverage, the digest and the time window. */
+    protected check(req: SignedRequest, ctx: AuthnContext): Checked | null;
+    verify(c: Credentials, ctx: AuthnContext): Promise<StrategyOutcome>;
+}
+export {};
+//# sourceMappingURL=httpsig.d.ts.map

package/lib/cjs/strategies/httpsig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpsig.d.ts","sourceRoot":"","sources":["../../../src/strategies/httpsig.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAIrI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAY,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAA8D,MAAM,WAAW,CAAC;AACpG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAQjD,UAAU,OAAO;IACf,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;CAC7B;AAOD,MAAM,WAAW,yBAA0B,SAAQ,eAAe;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED;;;;GAIG;AACH,qBACa,qBAAsB,SAAQ,WAAW,CAAC,yBAAyB,CAAC;IAC/E,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,KAAK,WAAsB;IACpC,QAAQ,CAAC,WAAW,SAAS;IAG7B,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC;IAEhC,SAAS,KAAK,MAAM,IAAI,aAAa,CAEpC;IAED,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,SAAS,WAAW,EAAE,CAKtE;IAED,iHAAiH;IACjH,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,GAAG,IAAI,CAuCrE;IAEK,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CA4BxE;CACF"}

package/lib/cjs/strategies/httpsig.js

@@ -0,0 +1,127 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpSignatureStrategy = void 0;
+const di_1 = require("@spinajs/di");
+const contracts_1 = require("@spinajs/authn/contracts");
+const signature_js_1 = require("../jwk/signature.js");
+const base_js_1 = require("../httpsig/base.js");
+const fields_js_1 = require("../httpsig/fields.js");
+const store_js_1 = require("../nonce/store.js");
+const keys_js_1 = require("./keys.js");
+/** RFC 9421 algorithm names; the `alg` parameter is optional and, when sent, must name the key's algorithm. */
+const ALG_PARAM = { ed25519: 'EdDSA', 'ecdsa-p256-sha256': 'ES256' };
+const PARAMS = ['created', 'expires', 'nonce', 'keyid', 'alg'];
+const MAX_NONCE = 256;
+const EMPTY = Buffer.alloc(0);
+const isRequest = (r) => {
+    const o = r;
+    return typeof o === 'object' && o !== null && typeof o.method === 'string' && typeof o.targetUri === 'string' && typeof o.headers === 'object' && o.headers !== null && (o.body === undefined || o.body instanceof Uint8Array);
+};
+/**
+ * Per-request HTTP message signatures, an RFC 9421 subset (design §22.10, A18): one signature; `@method`,
+ * `@target-uri` and, with a body, `content-digest` (RFC 9530, checked against the body) covered; `created`, `expires`
+ * at most `maxAgeSeconds` after it, a single-use `nonce` and `keyid`; `alg` optional. Any label is accepted.
+ */
+let HttpSignatureStrategy = class HttpSignatureStrategy extends keys_js_1.KeyStrategy {
+    constructor() {
+        super(...arguments);
+        this.name = 'keys-httpsig';
+        this.kinds = ['http-signature'];
+        this.interactive = false;
+    }
+    get nonces() {
+        return this.Deps?.nonces ?? this.Nonces;
+    }
+    throttleKeys(c, ctx) {
+        const req = c.kind === 'http-signature' && isRequest(c.request) ? c.request : null;
+        const input = req ? (0, base_js_1.lowerCaseHeaders)(req.headers)['signature-input'] : undefined;
+        const keyid = typeof input === 'string' && input.length <= keys_js_1.MAX_CREDENTIAL_LENGTH ? (0, fields_js_1.parseSignatureInput)(input)?.params.get('keyid') : undefined;
+        return (0, keys_js_1.keyThrottleKeys)(typeof keyid === 'string' ? keyid : null, ctx);
+    }
+    /** Everything that needs no key: the headers' form, the parameters, coverage, the digest and the time window. */
+    check(req, ctx) {
+        const headers = (0, base_js_1.lowerCaseHeaders)(req.headers);
+        if ([headers['signature-input'], headers.signature].some((v) => typeof v !== 'string' || v.length > keys_js_1.MAX_CREDENTIAL_LENGTH)) {
+            return null;
+        }
+        const input = (0, fields_js_1.parseSignatureInput)(headers['signature-input']);
+        const signatures = (0, fields_js_1.parseByteSequenceDictionary)(headers.signature);
+        if (!input || !signatures || signatures.size !== 1 || !signatures.has(input.label)) {
+            return null;
+        }
+        const p = input.params;
+        const created = p.get('created');
+        const expires = p.get('expires');
+        const nonce = p.get('nonce');
+        const kid = p.get('keyid');
+        const alg = p.get('alg');
+        if ([...p.keys()].some((k) => !PARAMS.includes(k)) || typeof created !== 'number' || typeof expires !== 'number' || typeof nonce !== 'string' || nonce.length === 0 || nonce.length > MAX_NONCE || typeof kid !== 'string') {
+            return null;
+        }
+        if (alg !== undefined && (typeof alg !== 'string' || !Object.hasOwn(ALG_PARAM, alg))) {
+            return null;
+        }
+        const covered = new Set(input.components);
+        const hasBody = req.body !== undefined;
+        const required = this.options.httpSignature.requiredComponents.filter((c) => c !== 'content-digest' || hasBody);
+        if (!covered.has('@method') || !covered.has('@target-uri') || (hasBody && !covered.has('content-digest')) || required.some((c) => !covered.has(c))) {
+            return null;
+        }
+        if (covered.has('content-digest') && !(0, base_js_1.digestMatches)(headers['content-digest'], req.body ?? EMPTY)) {
+            return null;
+        }
+        const h = this.options.httpSignature;
+        const nowS = Math.floor(ctx.now.getTime() / 1000);
+        if (created > nowS + h.skewSeconds || expires <= created || expires - created > h.maxAgeSeconds || nowS >= expires) {
+            return null;
+        }
+        return { input, signature: signatures.get(input.label), kid, nonce, expires, ...(alg !== undefined ? { alg: ALG_PARAM[alg] } : {}) };
+    }
+    async verify(c, ctx) {
+        if (c.kind !== 'http-signature') {
+            return (0, keys_js_1.failure)('unsupported_credentials');
+        }
+        if (!isRequest(c.request)) {
+            return (0, keys_js_1.failure)('invalid_credentials');
+        }
+        const req = c.request;
+        const checked = this.check(req, ctx);
+        const base = checked ? (0, base_js_1.signatureBase)(req, checked.input) : null;
+        if (!checked || base === null) {
+            return (0, keys_js_1.failure)('invalid_credentials');
+        }
+        const data = Buffer.from(base, 'utf8');
+        const found = await (0, keys_js_1.usableKey)(this.registry, checked.kid, ctx);
+        if (!found.key) {
+            this.unknownKeyWork(found.alg ?? checked.alg ?? 'EdDSA', data, checked.signature);
+            return (0, keys_js_1.failure)(found.reason);
+        }
+        const key = found.key;
+        if ((checked.alg !== undefined && checked.alg !== key.alg) || !(0, signature_js_1.verifySignature)(key, data, checked.signature)) {
+            return (0, keys_js_1.failure)('invalid_credentials');
+        }
+        const expiresAt = new Date((checked.expires + this.options.httpSignature.skewSeconds) * 1000);
+        if (!(await this.nonces.claim((0, store_js_1.nonceKey)('sig', key.kid, checked.nonce), expiresAt, ctx.now))) {
+            return (0, keys_js_1.failure)('invalid_credentials');
+        }
+        return this.success(key, 'http-signature', ctx);
+    }
+};
+exports.HttpSignatureStrategy = HttpSignatureStrategy;
+__decorate([
+    (0, di_1.Autoinject)(store_js_1.KeyNonceStore),
+    __metadata("design:type", store_js_1.KeyNonceStore)
+], HttpSignatureStrategy.prototype, "Nonces", void 0);
+exports.HttpSignatureStrategy = HttpSignatureStrategy = __decorate([
+    (0, di_1.Injectable)(contracts_1.AuthenticationStrategy)
+], HttpSignatureStrategy);
+//# sourceMappingURL=httpsig.js.map

package/lib/cjs/strategies/httpsig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpsig.js","sourceRoot":"","sources":["../../../src/strategies/httpsig.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAqD;AACrD,wDAAkE;AAElE,sDAAsD;AACtD,gDAAoF;AACpF,oDAAwF;AAExF,gDAA4D;AAC5D,uCAAoG;AAGpG,+GAA+G;AAC/G,MAAM,SAAS,GAA2C,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;AAC7G,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC/D,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAW9B,MAAM,SAAS,GAAG,CAAC,CAAU,EAAsB,EAAE;IACnD,MAAM,CAAC,GAAG,CAAmC,CAAC;IAC9C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,CAAC;AACjO,CAAC,CAAC;AAMF;;;;GAIG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,qBAAsC;IAA1E;;QACI,SAAI,GAAG,cAAc,CAAC;QACtB,UAAK,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3B,gBAAW,GAAG,KAAK,CAAC;IAuF/B,CAAC;IAlFC,IAAc,MAAM;QAClB,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAC1C,CAAC;IAED,YAAY,CAAC,CAAc,EAAE,GAAiB;QAC5C,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,0BAAgB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,+BAAqB,CAAC,CAAC,CAAC,IAAA,+BAAmB,EAAC,KAAK,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/I,OAAO,IAAA,yBAAe,EAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,iHAAiH;IACvG,KAAK,CAAC,GAAkB,EAAE,GAAiB;QACnD,MAAM,OAAO,GAAG,IAAA,0BAAgB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,+BAAqB,CAAC,EAAE,CAAC;YAC3H,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,+BAAmB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAA,uCAA2B,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC3N,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,IAAI,OAAO,CAAC,CAAC;QAChH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnJ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAA,uBAAa,EAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YAClG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAClD,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,GAAG,OAAO,GAAG,CAAC,CAAC,aAAa,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,CAAc,EAAE,GAAiB;QAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAChC,OAAO,IAAA,iBAAO,EAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAA,iBAAO,EAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,uBAAa,EAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAA,iBAAO,EAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAS,EAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAClF,OAAO,IAAA,iBAAO,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAA,8BAAe,EAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7G,OAAO,IAAA,iBAAO,EAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,mBAAQ,EAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5F,OAAO,IAAA,iBAAO,EAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;;AApFW;IADT,IAAA,eAAU,EAAC,wBAAa,CAAC;8BACR,wBAAa;qDAAC;gCANrB,qBAAqB;IADjC,IAAA,eAAU,EAAC,kCAAsB,CAAC;GACtB,qBAAqB,CA0FjC"}

package/lib/cjs/strategies/index.d.ts

@@ -0,0 +1,5 @@
+export * from './keys.js';
+export * from './assertion.js';
+export * from './httpsig.js';
+export * from './challenge.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/strategies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/strategies/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC"}

package/lib/cjs/strategies/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./keys.js"), exports);
+__exportStar(require("./assertion.js"), exports);
+__exportStar(require("./httpsig.js"), exports);
+__exportStar(require("./challenge.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/strategies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/strategies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,iDAA+B;AAC/B,+CAA6B;AAC7B,iDAA+B"}

package/lib/cjs/strategies/keys.d.ts

@@ -0,0 +1,43 @@
+import { Log } from '@spinajs/log';
+import '../register-schema.js';
+import { AuthenticationStrategy, KeyRegistry } from '@spinajs/authn/contracts';
+import type { AuthnContext, AuthnFailure, KeyAlgorithm, IdentityRef, KeyOwner, KeyRecord, StrategyOutcome, ThrottleKey } from '@spinajs/authn/contracts';
+import type { KeysConfig, KeysOptions } from '../options/options.js';
+/** Credentials longer than this are refused before any parsing (a header is parsed before its signature is checked). */
+export declare const MAX_CREDENTIAL_LENGTH = 8192;
+/** An assertion's `iss`: the key owner as `<type>:<id>` (lane notes D8), e.g. `user:<uuid>` or `service:runner-1`. */
+export declare const assertionIssuer: (owner: KeyOwner | IdentityRef) => string;
+/** Credentials name a kid before anything is verified; one that cannot be read throttles under one shared key. */
+export declare function keyThrottleKeys(kid: string | null, ctx: AuthnContext): readonly ThrottleKey[];
+/** `alg`: the algorithm of a revoked or expired key, so the dummy verification costs what its real one would. */
+export type KeyLookup = {
+    readonly key: KeyRecord;
+} | {
+    readonly key: null;
+    readonly reason: AuthnFailure;
+    readonly alg?: KeyAlgorithm;
+};
+/** byId for verifiers: only a key that is neither revoked nor expired at ctx.now is usable; the reason goes to audit. */
+export declare function usableKey(registry: KeyRegistry, kid: string, ctx: AuthnContext): Promise<KeyLookup>;
+export declare const failure: (reason: AuthnFailure) => StrategyOutcome;
+/** A test seam for building a key strategy with `new`: each field replaces what DI injects. */
+export interface KeyStrategyDeps {
+    readonly registry?: KeyRegistry;
+    /** Complete options that bypass the configuration. */
+    readonly options?: KeysOptions;
+}
+/** What the key strategies share: the registry, `authn.keys`, the cost of an unusable key and the success outcome. */
+export declare abstract class KeyStrategy<D extends KeyStrategyDeps = KeyStrategyDeps> extends AuthenticationStrategy {
+    protected readonly Deps?: D | undefined;
+    protected KeysConfig: KeysConfig;
+    protected Registry: KeyRegistry;
+    protected Log: Log;
+    constructor(Deps?: D | undefined);
+    protected get registry(): KeyRegistry;
+    protected get options(): KeysOptions;
+    /** The signature work an unknown, revoked or expired key costs, so it answers in the time a known key does (A02). */
+    protected unknownKeyWork(alg: KeyAlgorithm, data: Uint8Array, signature: Uint8Array): void;
+    /** Stamps the key's last use when the registry can; a failed stamp costs the stamp, never the login. */
+    protected success(key: KeyRecord, method: string, ctx: AuthnContext): Promise<StrategyOutcome>;
+}
+//# sourceMappingURL=keys.d.ts.map

package/lib/cjs/strategies/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/strategies/keys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAIzJ,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGrE,wHAAwH;AACxH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,sHAAsH;AACtH,eAAO,MAAM,eAAe,UAAW,QAAQ,GAAG,WAAW,KAAG,MAAqC,CAAC;AAEtG,kHAAkH;AAClH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,YAAY,GAAG,SAAS,WAAW,EAAE,CAM7F;AAED,iHAAiH;AACjH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAA;CAAE,CAAC;AAEzI,yHAAyH;AACzH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CASzG;AAED,eAAO,MAAM,OAAO,WAAY,YAAY,KAAG,eAA0C,CAAC;AAE1F,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;CAChC;AAED,sHAAsH;AACtH,8BAAsB,WAAW,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,CAAE,SAAQ,sBAAsB;IAU/F,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IARvC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAGjC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAGhC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,YAA+B,IAAI,CAAC,EAAE,CAAC,YAAA,EAEtC;IAED,SAAS,KAAK,QAAQ,IAAI,WAAW,CAEpC;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,qHAAqH;IACrH,SAAS,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,IAAI,CAEzF;IAED,wGAAwG;IACxG,UAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAUnG;CACF"}