@spine-event-engine/auth 2.0.0-snapshot.10

package/dist/sessions/opaque.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaque.d.ts","sourceRoot":"","sources":["../../src/sessions/opaque.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;;OAGG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,eAAe,GAAG,QAAQ,CAAC;CACzF,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACX,WAAW,GACX,SAAS,GACT,wBAAwB,GACxB,mBAAmB,GACnB,eAAe,GACf,QAAQ,CAAC;CACd,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,eAAe;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,MAAM,CAAS;IAEvB;;;OAGG;gBACS,OAAO,GAAE,qBAA0B;IAiB/C;;;;OAIG;IACH,MAAM,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA8B7E;;;;OAIG;IACH,OAAO,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAQjF;;;;OAIG;IACH,MAAM,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAsC9E;;;;OAIG;IACH,MAAM,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAM9E;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,MAAM;IAmBd,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,GAAG;IAYX,OAAO,CAAC,UAAU;CAInB"}

package/dist/sessions/opaque.js

@@ -0,0 +1,268 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+import { create } from "@bufbuild/protobuf";
+import { TimestampSchema } from "@bufbuild/protobuf/wkt";
+import { randomBytes as nodeRandomBytes } from "node:crypto";
+/**
+ * A bounded, terminal in-memory store of random opaque application sessions.
+ *
+ * It is intentionally process-local: applications needing durable or shared
+ * sessions provide another `SessionResolver` implementation.
+ */
+export class OpaqueSessions {
+    records = new Map();
+    clock;
+    random;
+    ttlMilliseconds;
+    maxSessions;
+    collisionAttempts;
+    closed = false;
+    /**
+     * Creates a bounded in-memory session store.
+     * @param options The optional clock, entropy, lifetime, and capacity settings.
+     */
+    constructor(options = {}) {
+        this.clock = options.clock ?? { now: Date.now };
+        this.random = options.randomBytes ?? nodeRandomBytes;
+        this.ttlMilliseconds = OpaqueSessionValues.positiveSafeInteger(options.ttlMilliseconds ?? 8 * 60 * 60 * 1_000, "ttlMilliseconds");
+        this.maxSessions = OpaqueSessionValues.positiveSafeInteger(options.maxSessions ?? 10_000, "maxSessions");
+        this.collisionAttempts = OpaqueSessionValues.positiveSafeInteger(options.collisionAttempts ?? 3, "collisionAttempts");
+    }
+    /**
+     * Creates a new session unless the terminal or bounded store state rejects it.
+     * @param principal The authenticated principal to retain.
+     * @returns The creation outcome and, when accepted, credential and session.
+     */
+    create(principal) {
+        if (this.isClosed())
+            return Promise.resolve({ kind: "rejected", reason: "closed" });
+        const now = this.now();
+        if (now === undefined)
+            return Promise.resolve({ kind: "rejected", reason: "clock-failure" });
+        this.sweepExpired(now);
+        if (this.records.size >= this.maxSessions)
+            return Promise.resolve({ kind: "rejected", reason: "capacity-exceeded" });
+        const id = this.nextId();
+        if (id === undefined)
+            return Promise.resolve({ kind: "rejected", reason: "entropy-exhausted" });
+        const current = this.now();
+        if (current === undefined)
+            return Promise.resolve({ kind: "rejected", reason: "clock-failure" });
+        this.sweepExpired(current);
+        if (this.isClosed())
+            return Promise.resolve({ kind: "rejected", reason: "closed" });
+        if (this.records.size >= this.maxSessions) {
+            return Promise.resolve({ kind: "rejected", reason: "capacity-exceeded" });
+        }
+        if (this.records.has(id))
+            return Promise.resolve({ kind: "rejected", reason: "entropy-exhausted" });
+        const record = this.record(principal, current);
+        if (record === undefined)
+            return Promise.resolve({ kind: "rejected", reason: "clock-failure" });
+        if (this.isClosed())
+            return Promise.resolve({ kind: "rejected", reason: "closed" });
+        this.records.set(id, record);
+        return Promise.resolve({
+            kind: "created",
+            credential: OpaqueSessionValues.credential(id),
+            session: OpaqueSessionValues.resolved(record),
+        });
+    }
+    /**
+     * Resolves one currently live cookie credential as a defensive copy.
+     * @param credentialInput The credential to resolve.
+     * @returns The live session, or undefined when it is invalid or expired.
+     */
+    resolve(credentialInput) {
+        if (this.closed || credentialInput.kind !== "cookie")
+            return Promise.resolve(undefined);
+        const now = this.now();
+        if (now === undefined)
+            return Promise.resolve(undefined);
+        const record = this.live(credentialInput.value, now);
+        return Promise.resolve(record === undefined ? undefined : OpaqueSessionValues.resolved(record));
+    }
+    /**
+     * Updates a live opaque credential without ever retaining both values.
+     * @param credentialInput The credential to replace.
+     * @returns The rotation outcome and, when accepted, the replacement values.
+     */
+    rotate(credentialInput) {
+        if (this.isClosed())
+            return Promise.resolve({ kind: "rejected", reason: "closed" });
+        if (credentialInput.kind !== "cookie")
+            return Promise.resolve({ kind: "rejected", reason: "unsupported-credential" });
+        const now = this.now();
+        if (now === undefined)
+            return Promise.resolve({ kind: "rejected", reason: "clock-failure" });
+        const previous = this.records.get(credentialInput.value);
+        if (previous === undefined)
+            return Promise.resolve({ kind: "rejected", reason: "not-found" });
+        if (this.expired(previous, now)) {
+            this.records.delete(credentialInput.value);
+            return Promise.resolve({ kind: "rejected", reason: "expired" });
+        }
+        const id = this.nextId();
+        if (id === undefined)
+            return Promise.resolve({ kind: "rejected", reason: "entropy-exhausted" });
+        const current = this.now();
+        if (current === undefined)
+            return Promise.resolve({ kind: "rejected", reason: "clock-failure" });
+        if (this.isClosed())
+            return Promise.resolve({ kind: "rejected", reason: "closed" });
+        if (this.records.get(credentialInput.value) !== previous) {
+            return Promise.resolve({ kind: "rejected", reason: "not-found" });
+        }
+        if (this.expired(previous, current)) {
+            this.records.delete(credentialInput.value);
+            return Promise.resolve({ kind: "rejected", reason: "expired" });
+        }
+        if (this.records.has(id))
+            return Promise.resolve({ kind: "rejected", reason: "entropy-exhausted" });
+        const record = this.record(previous.principal, current);
+        if (record === undefined)
+            return Promise.resolve({ kind: "rejected", reason: "clock-failure" });
+        this.records.delete(credentialInput.value);
+        this.records.set(id, record);
+        return Promise.resolve({
+            kind: "rotated",
+            credential: OpaqueSessionValues.credential(id),
+            session: OpaqueSessionValues.resolved(record),
+        });
+    }
+    /**
+     * Deletes a cookie session when present without revealing whether it existed.
+     * @param credentialInput The credential to invalidate.
+     * @returns An enumeration-safe logout acknowledgement.
+     */
+    logout(credentialInput) {
+        if (!this.closed && credentialInput.kind === "cookie")
+            this.records.delete(credentialInput.value);
+        return Promise.resolve({ kind: "logged-out" });
+    }
+    /**
+     * Closes the store and drops retained session identity and record references.
+     * @returns Completes after retained records are dropped.
+     */
+    close() {
+        if (this.closed)
+            return Promise.resolve();
+        this.closed = true;
+        this.records.clear();
+        return Promise.resolve();
+    }
+    isClosed() {
+        return this.closed;
+    }
+    record(principal, now) {
+        const expiresAt = now + this.ttlMilliseconds;
+        if (!Number.isSafeInteger(expiresAt) || !OpaqueSessionValues.timestampValid(expiresAt)) {
+            this.failClosed();
+            return undefined;
+        }
+        return { principal: OpaqueSessionValues.copyPrincipal(principal), expiresAt };
+    }
+    nextId() {
+        for (let attempt = 0; attempt < this.collisionAttempts; attempt += 1) {
+            let bytes;
+            try {
+                bytes = this.random(32);
+            }
+            catch {
+                continue;
+            }
+            try {
+                if (bytes.byteLength !== 32)
+                    continue;
+                const id = Buffer.from(bytes).toString("base64url");
+                if (!this.records.has(id))
+                    return id;
+            }
+            finally {
+                bytes.fill(0);
+            }
+        }
+        return undefined;
+    }
+    live(id, now) {
+        const record = this.records.get(id);
+        if (record === undefined)
+            return undefined;
+        if (!this.expired(record, now))
+            return record;
+        this.records.delete(id);
+        return undefined;
+    }
+    sweepExpired(now) {
+        for (const [id, record] of this.records)
+            if (this.expired(record, now))
+                this.records.delete(id);
+    }
+    expired(record, now) {
+        return now >= record.expiresAt;
+    }
+    now() {
+        try {
+            const value = this.clock.now();
+            if (!Number.isSafeInteger(value) || !OpaqueSessionValues.timestampValid(value))
+                throw new Error("invalid clock");
+            return value;
+        }
+        catch {
+            this.failClosed();
+            return undefined;
+        }
+    }
+    failClosed() {
+        this.closed = true;
+        this.records.clear();
+    }
+}
+/**
+ * Validates opaque-session values and creates immutable credential data.
+ */
+const OpaqueSessionValues = Object.freeze({
+    positiveSafeInteger(value, name) {
+        if (!Number.isSafeInteger(value) || value <= 0)
+            throw new Error(`${name} must be a positive safe integer`);
+        return value;
+    },
+    credential(value) {
+        return Object.freeze({ kind: "cookie", value });
+    },
+    copyPrincipal(principal) {
+        if (typeof principal.id !== "string")
+            throw new Error("principal.id must be a string");
+        const attributes = principal.attributes === undefined ? undefined : Object.freeze({ ...principal.attributes });
+        return Object.freeze(attributes === undefined ? { id: principal.id } : { id: principal.id, attributes });
+    },
+    resolved(record) {
+        return Object.freeze({
+            principal: OpaqueSessionValues.copyPrincipal(record.principal),
+            expiresAt: OpaqueSessionValues.timestamp(record.expiresAt),
+        });
+    },
+    timestamp(milliseconds) {
+        const seconds = Math.floor(milliseconds / 1_000);
+        return create(TimestampSchema, {
+            seconds: BigInt(seconds),
+            nanos: (milliseconds - seconds * 1_000) * 1_000_000,
+        });
+    },
+    timestampValid(milliseconds) {
+        const seconds = Math.floor(milliseconds / 1_000);
+        return seconds >= -62_135_596_800 && seconds <= 253_402_300_799;
+    },
+});
+//# sourceMappingURL=opaque.js.map

package/dist/sessions/opaque.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaque.js","sourceRoot":"","sources":["../../src/sessions/opaque.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AA0J7D;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC3C,KAAK,CAAqB;IAC1B,MAAM,CAAsB;IAC5B,eAAe,CAAS;IACxB,WAAW,CAAS;IACpB,iBAAiB,CAAS;IACnC,MAAM,GAAG,KAAK,CAAC;IAEvB;;;OAGG;IACH,YAAY,UAAiC,EAAE;QAC7C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,mBAAmB,CAC5D,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAC9C,iBAAiB,CAClB,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,mBAAmB,CAAC,mBAAmB,CACxD,OAAO,CAAC,WAAW,IAAI,MAAM,EAC7B,aAAa,CACd,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,mBAAmB,CAAC,mBAAmB,CAC9D,OAAO,CAAC,iBAAiB,IAAI,CAAC,EAC9B,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAiC;QACtC,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,eAAkC;QACxC,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClG,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,eAAkC;QACvC,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ;YACnC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,eAAkC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ;YACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEO,QAAQ;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,SAAiC,EAAE,GAAW;QAC3D,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YACvF,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IAChF,CAAC;IAEO,MAAM;QACZ,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,KAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE;oBAAE,SAAS;gBACtC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,OAAO,EAAE,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,IAAI,CAAC,EAAU,EAAE,GAAW;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAEO,OAAO,CAAC,MAAqB,EAAE,GAAW;QAChD,OAAO,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC;IACjC,CAAC;IAEO,GAAG;QACT,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,KAAK,CAAC;gBAC5E,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAOD;;GAEG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,mBAAmB,CAAC,KAAa,EAAE,IAAY;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,aAAa,CAAC,SAAiC;QAC7C,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvF,MAAM,UAAU,GACd,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC,MAAM,CAClB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,MAAqB;QAC5B,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,SAAS,EAAE,mBAAmB,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9D,SAAS,EAAE,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,YAAoB;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,eAAe,EAAE;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;YACxB,KAAK,EAAE,CAAC,YAAY,GAAG,OAAO,GAAG,KAAK,CAAC,GAAG,SAAS;SACpD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,YAAoB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC;QACjD,OAAO,OAAO,IAAI,CAAC,cAAc,IAAI,OAAO,IAAI,eAAe,CAAC;IAClE,CAAC;CACF,CAAC,CAAC"}

package/dist/sessions/signed.d.ts

@@ -0,0 +1,245 @@
+import { KeyObject } from "node:crypto";
+import { type Timestamp } from "@bufbuild/protobuf/wkt";
+import type { AuthenticatedPrincipal, BearerCredential, RequestCredential, ResolvedSession, SessionResolver } from "../index.js";
+/**
+ * Clock used by signed sessions; values are Unix epoch milliseconds.
+ */
+export interface SignedSessionClock {
+    /**
+     * Returns a safe Unix epoch millisecond in the Protobuf Timestamp range.
+     * Invalid values and exceptions fail closed.
+     * @returns The current milliseconds.
+     */
+    now(): number;
+}
+/**
+ * Creates 16 random bytes for a JWT ID.
+ * @param length The required 16-byte length.
+ * @returns The generated identifier bytes.
+ */
+export type SignedSessionRandom = (length: 16) => Uint8Array;
+/**
+ * An active P-256 signing key.
+ */
+export interface SignedSessionSigningKey {
+    /**
+     * Non-empty local key ID of at most 256 characters.
+     */
+    readonly kid: string;
+    /**
+     * Caller-owned P-256 private `KeyObject`; the strategy imports an owned copy.
+     */
+    readonly privateKey: KeyObject;
+}
+/**
+ * A P-256 public key retained for tokens issued before rotation.
+ */
+export interface SignedSessionVerificationKey {
+    /**
+     * Non-empty local key ID of at most 256 characters.
+     */
+    readonly kid: string;
+    /**
+     * Caller-owned P-256 public `KeyObject`; the strategy imports an owned copy.
+     */
+    readonly publicKey: KeyObject;
+}
+/**
+ * Optional application-owned, durable token revocation capability.
+ */
+export interface SignedTokenRevocation {
+    /**
+     * Discriminator which makes immediate revocation support explicit.
+     */
+    readonly kind: "supported";
+    /**
+     * Checks whether the exact 16-byte token ID is revoked.
+     * @param jti The token identifier to check.
+     * @returns Whether the token is revoked.
+     */
+    isRevoked(jti: string): Promise<boolean>;
+    /**
+     * Stores the exact token ID through its Protobuf Timestamp expiry.
+     * The application owns persistence, cleanup, availability, and atomicity.
+     * @param jti The token identifier to retain.
+     * @param expiresAt The expiry after which retention may end.
+     * @returns Completes after the token ID is retained.
+     */
+    revoke(jti: string, expiresAt: Timestamp): Promise<void>;
+}
+/**
+ * Finite configuration for locally-issued ES256 bearer sessions.
+ */
+export interface SignedSessionsOptions {
+    /**
+     * Exact non-empty token issuer, at most 256 characters.
+     */
+    readonly issuer: string;
+    /**
+     * Exact non-empty single token audience, at most 256 characters.
+     */
+    readonly audience: string;
+    /**
+     * Initial active P-256 signing key.
+     */
+    readonly activeKey: SignedSessionSigningKey;
+    /**
+     * Initially retired P-256 verification keys; defaults to none.
+     * Each is retained for `ttlSeconds + clockSkewSeconds` after construction.
+     */
+    readonly retiredKeys?: readonly SignedSessionVerificationKey[];
+    /**
+     * Optional application-owned immediate-revocation capability; defaults to expiry-only.
+     */
+    readonly revocation?: SignedTokenRevocation;
+    /**
+     * Unix-millisecond clock; defaults to `Date.now`.
+     */
+    readonly clock?: SignedSessionClock;
+    /**
+     * Random callback called with 16 and required to return 16 bytes; defaults to Node crypto.
+     */
+    readonly randomBytes?: SignedSessionRandom;
+    /**
+     * Positive safe token lifetime in seconds; defaults to 28,800.
+     */
+    readonly ttlSeconds?: number;
+    /**
+     * Non-negative safe temporal tolerance in seconds; defaults to 60.
+     */
+    readonly clockSkewSeconds?: number;
+    /**
+     * Positive safe input and output token character bound; defaults to 8,192.
+     */
+    readonly maxTokenCharacters?: number;
+    /**
+     * Positive safe active-plus-retired key bound; defaults to 16.
+     */
+    readonly maxKeys?: number;
+    /**
+     * Positive safe principal-ID character bound; defaults to 256.
+     */
+    readonly maxPrincipalIdCharacters?: number;
+    /**
+     * Non-negative safe attribute count bound; defaults to 32.
+     */
+    readonly maxAttributes?: number;
+    /**
+     * Non-negative safe total attribute name/value character bound; defaults to 4,096.
+     */
+    readonly maxAttributeCharacters?: number;
+}
+/**
+ * Result of issuing a signed session.
+ *
+ * Rejections distinguish terminal close, clock/entropy/signing failure, and
+ * a principal outside the configured finite bounds.
+ */
+export type SignedSessionIssueResult = {
+    /**
+     * Identifies successful token issuance.
+     */
+    readonly kind: "issued";
+    /**
+     * Provides the issued bearer credential.
+     */
+    readonly credential: BearerCredential;
+    /**
+     * Provides the session represented by the credential.
+     */
+    readonly session: ResolvedSession;
+} | {
+    /**
+     * Identifies rejected token issuance.
+     */
+    readonly kind: "rejected";
+    /**
+     * Explains why token issuance was rejected.
+     */
+    readonly reason: "closed" | "clock-failure" | "entropy-failure" | "principal-invalid" | "signing-failure";
+};
+/**
+ * Result of atomically changing the active signing key.
+ *
+ * A rejection never changes the active key or verification ring.
+ */
+export type SignedSessionRotationResult = {
+    /**
+     * Identifies successful signing-key rotation.
+     */
+    readonly kind: "rotated";
+} | {
+    /**
+     * Identifies rejected signing-key rotation.
+     */
+    readonly kind: "rejected";
+    /**
+     * Explains why signing-key rotation was rejected.
+     */
+    readonly reason: "closed" | "clock-failure" | "invalid-key" | "duplicate-key" | "key-capacity-exceeded";
+};
+/**
+ * Enumeration-safe result of a signed-session logout.
+ *
+ * `expiryOnly` means no immediate revocation guarantee exists, while
+ * `unavailable` means the configured revocation store failed.
+ */
+export interface SignedSessionLogoutResult {
+    /**
+     * Reports the immediate-revocation outcome.
+     */
+    readonly kind: "revoked" | "expiryOnly" | "unavailable";
+}
+/**
+ * Finite, local ES256/JWT application sessions. This class has no remote key
+ * discovery, persistence, OIDC behavior, or authorization policy. It imports
+ * owned key copies, but Node does not expose explicit `KeyObject` zeroing.
+ */
+export declare class SignedSessions implements SessionResolver {
+    #private;
+    /**
+     * Creates signed sessions with copied finite configuration and P-256 keys.
+     * @param options The issuer, key ring, limits, clock, entropy, and revocation settings.
+     */
+    constructor(options: SignedSessionsOptions);
+    /**
+     * Creates one compact ES256 bearer token inside configured identity bounds.
+     * @param principal The authenticated principal to encode.
+     * @returns The issuance outcome and, when accepted, credential and session.
+     */
+    issue(principal: AuthenticatedPrincipal): Promise<SignedSessionIssueResult>;
+    /**
+     * Resolves one locally verifiable bearer credential.
+     *
+     * Cookie credentials and every malformed, invalid, expired, revoked, or
+     * unavailable-revocation result return `undefined`.
+     * @param credential The credential to resolve.
+     * @returns The verified session, or undefined when it cannot be trusted.
+     */
+    resolve(credential: RequestCredential): Promise<ResolvedSession | undefined>;
+    /**
+     * Updates the active P-256 key atomically.
+     *
+     * The previous verifier remains through the configured token lifetime plus
+     * clock skew, subject to the finite key bound.
+     * @param next The next active signing key.
+     * @returns The rotation outcome.
+     */
+    rotate(next: SignedSessionSigningKey): Promise<SignedSessionRotationResult>;
+    /**
+     * Sends a logout request without revealing invalid-token state.
+     *
+     * Immediate revocation requires `SignedTokenRevocation`; otherwise valid and
+     * invalid input both report `expiryOnly`.
+     * @param credential The credential to revoke when valid.
+     * @returns The enumeration-safe logout outcome.
+     */
+    logout(credential: RequestCredential): Promise<SignedSessionLogoutResult>;
+    /**
+     * Closes the resolver and clears active, verification-key, and revocation references.
+     * Node `KeyObject` memory cannot be explicitly zeroed.
+     * @returns Completes after resolver references are cleared.
+     */
+    close(): Promise<void>;
+}
+//# sourceMappingURL=signed.d.ts.map

package/dist/sessions/signed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed.d.ts","sourceRoot":"","sources":["../../src/sessions/signed.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,SAAS,EAMV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEzE,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;;;OAIG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,UAAU,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAG3C;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAE/D;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,QAAQ,GAAG,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;CAC5F,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GACnC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,QAAQ,GAAG,eAAe,GAAG,aAAa,GAAG,eAAe,GAAG,uBAAuB,CAAC;CAC1F,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,aAAa,CAAC;CACzD;AAyBD;;;;GAIG;AACH,qBAAa,cAAe,YAAW,eAAe;;IAiBpD;;;OAGG;gBACS,OAAO,EAAE,qBAAqB;IAmD1C;;;;OAIG;IACH,KAAK,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAiE3E;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAoBlF;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA0C3E;;;;;;;OAOG;IACG,MAAM,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAY/E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA6HvB"}