@toa.io/extensions.exposition 1.0.0-alpha.302 → 1.0.0-alpha.304

package/components/identity.basic/types/toa.d.ts

@@ -4,7 +4,7 @@
 import type { Options, Query, RemoteError } from '@toa.io/core/types'
 import type { Secret } from '@toa.io/extensions.configuration'
 import type { FetchInit } from '@toa.io/extensions.fetch'
-import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Logs, Metrics, Span } from '@toa.io/extensions.telemetry'
 import type { Readable } from 'node:stream'
 
 export interface Entity {

package/components/identity.clients/types/toa.d.ts

@@ -4,7 +4,7 @@
 import type { Options, Query, RemoteError } from '@toa.io/core/types'
 import type { FetchInit } from '@toa.io/extensions.fetch'
 import type { Stash } from '@toa.io/extensions.stash'
-import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Logs, Metrics, Span } from '@toa.io/extensions.telemetry'
 import type { Readable } from 'node:stream'
 
 export interface Entity {

package/components/identity.federation/types/toa.d.ts

@@ -4,7 +4,7 @@
 import type { Options, Query, RemoteError } from '@toa.io/core/types'
 import type { Secret } from '@toa.io/extensions.configuration'
 import type { FetchInit } from '@toa.io/extensions.fetch'
-import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Logs, Metrics, Span } from '@toa.io/extensions.telemetry'
 import type { Readable } from 'node:stream'
 
 export interface Entity {

package/components/identity.grants/manifest.toa.yaml

@@ -231,7 +231,9 @@ exposition:
         endpoint: list
       POST:
         io:input: [client, redirect, challenge, method, scope, resource]
-        io:output: [code, expires_in, error, error_description]
+        # `status` is read by `io:status` out of what the operation answers, and taken out of the
+        # body before it is sent
+        io:output: [code, expires_in, error, error_description, status]
         io:status: status
         cache:exact: no-store
         endpoint: authorize

package/components/identity.grants/types/toa.d.ts

@@ -4,7 +4,7 @@
 import type { Options, Query, RemoteError } from '@toa.io/core/types'
 import type { FetchInit } from '@toa.io/extensions.fetch'
 import type { Stash } from '@toa.io/extensions.stash'
-import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Logs, Metrics, Span } from '@toa.io/extensions.telemetry'
 import type { Readable } from 'node:stream'
 
 export interface Entity {

package/components/identity.otp/types/toa.d.ts

@@ -4,7 +4,7 @@
 import type { Options, Query, RemoteError } from '@toa.io/core/types'
 import type { FetchInit } from '@toa.io/extensions.fetch'
 import type { Stash } from '@toa.io/extensions.stash'
-import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Logs, Metrics, Span } from '@toa.io/extensions.telemetry'
 import type { Readable } from 'node:stream'
 
 export interface Entity {

package/components/identity.passkeys/types/toa.d.ts

@@ -4,7 +4,7 @@
 import type { Options, Query, RemoteError } from '@toa.io/core/types'
 import type { FetchInit } from '@toa.io/extensions.fetch'
 import type { Stash } from '@toa.io/extensions.stash'
-import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Logs, Metrics, Span } from '@toa.io/extensions.telemetry'
 import type { Readable } from 'node:stream'
 
 export interface Entity {

package/components/identity.tokens/operations/decrypt.js

@@ -1,7 +1,7 @@
+import { createDecipheriv } from 'node:crypto';
 import { DecryptFactory, ImportKeyFactory } from 'paseto/v3/local';
 import { LRUCache } from 'lru-cache';
 import { form, jweKey } from './lib/index.js';
-import { load } from './lib/jose.js';
 export class Computation {
     keys = {};
     legacy = {};
@@ -23,32 +23,29 @@ export class Computation {
         }
     }
     async execute(token) {
-        const legacy = form(token) === 'paseto';
-        const kid = legacy ? this.pasetoKid(token) : await this.jweKid(token);
-        if (kid instanceof Error)
-            return kid;
-        const key = await this.key(kid, legacy);
+        if (form(token) === 'paseto') {
+            const kid = this.pasetoKid(token);
+            if (kid instanceof Error)
+                return kid;
+            const key = await this.key(kid, true);
+            if (key instanceof Error)
+                return key;
+            const claims = await decryptPaseto(token, key.key);
+            if (claims instanceof Error)
+                return claims;
+            // a token of the form this component leaves behind is answered with a re-issue
+            return this.answer(claims, key, true);
+        }
+        const jwe = parse(token);
+        if (jwe instanceof Error)
+            return jwe;
+        const key = await this.key(jwe.kid, false);
         if (key instanceof Error)
             return key;
-        const claims = legacy
-            ? await decryptPaseto(token, key.key)
-            : await decryptJWE(token, key.key);
+        const claims = open(jwe, key.key);
         if (claims instanceof Error)
             return claims;
-        this.logs.debug('Token claims', claims);
-        if (key.identity !== undefined && claims.identity.id !== key.identity)
-            return ERR_FORGED_KEY;
-        if (key.revokedAt !== undefined)
-            return ERR_REVOKED_KEY;
-        return {
-            iss: claims.iss,
-            iat: claims.iat,
-            exp: claims.exp,
-            identity: claims.identity,
-            ...(claims.aud === undefined ? {} : { aud: claims.aud }),
-            refresh: legacy || (kid !== this.latest && key.identity === undefined),
-            custom: key.identity !== undefined
-        };
+        return this.answer(claims, key, jwe.kid !== this.latest && key.identity === undefined);
     }
     pasetoKid(token) {
         const [, , , footer] = token.split('.');
@@ -65,20 +62,22 @@ export class Computation {
             return ERR_INVALID_TOKEN;
         }
     }
-    async jweKid(token) {
-        try {
-            const { decodeProtectedHeader } = await load();
-            const header = decodeProtectedHeader(token);
-            if (header.alg !== 'dir' ||
-                header.enc !== 'A256GCM' ||
-                header.typ !== 'JWT' ||
-                typeof header.kid !== 'string')
-                return ERR_INVALID_TOKEN;
-            return header.kid;
-        }
-        catch {
-            return ERR_INVALID_TOKEN;
-        }
+    /** What both forms answer once their claims are open. */
+    answer(claims, key, refresh) {
+        this.logs.debug('Token claims', claims);
+        if (key.identity !== undefined && claims.identity.id !== key.identity)
+            return ERR_FORGED_KEY;
+        if (key.revokedAt !== undefined)
+            return ERR_REVOKED_KEY;
+        return {
+            iss: claims.iss,
+            iat: claims.iat,
+            exp: claims.exp,
+            identity: claims.identity,
+            ...(claims.aud === undefined ? {} : { aud: claims.aud }),
+            refresh,
+            custom: key.identity !== undefined
+        };
     }
     async key(kid, legacy) {
         const configured = legacy ? this.legacy : this.keys;
@@ -103,34 +102,81 @@ async function decryptPaseto(token, key) {
         return ERR_INVALID_TOKEN;
     }
 }
-async function decryptJWE(token, key) {
+/**
+ * The five parts of a compact JWE (RFC 7516), of the one form this component issues: `dir`, so
+ * the encrypted key is empty, `A256GCM`, and a `kid` naming the key. A header that asks for
+ * anything else — another algorithm, a critical extension, compression — is refused, as jose
+ * refuses it.
+ */
+function parse(token) {
+    const parts = token.split('.');
+    if (parts.length !== PARTS || parts[1] !== '')
+        return ERR_INVALID_TOKEN;
+    const [header, , iv, ciphertext, tag] = parts;
+    let declared;
     try {
-        const { jwtDecrypt } = await load();
-        const { payload } = await jwtDecrypt(token, jweKey(key), {
-            keyManagementAlgorithms: ['dir'],
-            contentEncryptionAlgorithms: ['A256GCM']
-        });
-        if (typeof payload.iss !== 'string' ||
-            typeof payload.iat !== 'number' ||
-            typeof payload.identity !== 'object' ||
-            payload.identity === null)
-            return ERR_INVALID_TOKEN;
-        if (payload.exp !== undefined && payload.exp * 1000 <= Date.now())
-            return ERR_INVALID_TOKEN;
-        return {
-            iss: payload.iss,
-            iat: new Date(payload.iat * 1000).toISOString(),
-            ...(payload.exp === undefined
-                ? {}
-                : { exp: new Date(payload.exp * 1000).toISOString() }),
-            identity: payload.identity,
-            ...(payload.aud === undefined ? {} : { aud: payload.aud })
-        };
+        declared = JSON.parse(Buffer.from(header, 'base64url').toString('utf-8'));
+    }
+    catch {
+        return ERR_INVALID_TOKEN;
+    }
+    if (declared === null ||
+        typeof declared !== 'object' ||
+        declared.alg !== 'dir' ||
+        declared.enc !== 'A256GCM' ||
+        declared.typ !== 'JWT' ||
+        typeof declared.kid !== 'string' ||
+        declared.crit !== undefined ||
+        declared.zip !== undefined)
+        return ERR_INVALID_TOKEN;
+    return {
+        kid: declared.kid,
+        // the header as it was written, which is what it was encrypted against
+        aad: Buffer.from(header, 'ascii'),
+        iv: Buffer.from(iv, 'base64url'),
+        ciphertext: Buffer.from(ciphertext, 'base64url'),
+        tag: Buffer.from(tag, 'base64url')
+    };
+}
+/** The claims a token carries, where its tag holds and its times admit it. */
+function open(jwe, key) {
+    if (jwe.iv.length !== IV || jwe.tag.length !== TAG)
+        return ERR_INVALID_TOKEN;
+    let payload;
+    try {
+        const decipher = createDecipheriv('aes-256-gcm', jweKey(key), jwe.iv);
+        decipher.setAAD(jwe.aad);
+        decipher.setAuthTag(jwe.tag);
+        payload = JSON.parse(Buffer.concat([decipher.update(jwe.ciphertext), decipher.final()]).toString('utf-8'));
     }
     catch {
         return ERR_INVALID_TOKEN;
     }
+    if (payload === null ||
+        typeof payload !== 'object' ||
+        typeof payload.iss !== 'string' ||
+        typeof payload.iat !== 'number' ||
+        typeof payload.identity !== 'object' ||
+        payload.identity === null)
+        return ERR_INVALID_TOKEN;
+    const now = Date.now();
+    if (payload.exp !== undefined && payload.exp * 1000 <= now)
+        return ERR_INVALID_TOKEN;
+    if (payload.nbf !== undefined && payload.nbf * 1000 > now)
+        return ERR_INVALID_TOKEN;
+    return {
+        iss: payload.iss,
+        iat: new Date(payload.iat * 1000).toISOString(),
+        ...(payload.exp === undefined
+            ? {}
+            : { exp: new Date(payload.exp * 1000).toISOString() }),
+        identity: payload.identity,
+        ...(payload.aud === undefined ? {} : { aud: payload.aud })
+    };
 }
+const PARTS = 5;
+const IV = 12;
+const TAG = 16;
 const importKey = ImportKeyFactory().run;
 const decryptLocal = DecryptFactory().run;
 const ERR_INVALID_TOKEN = new (class InvalidTokenError extends Error {
@@ -145,4 +191,4 @@ const ERR_FORGED_KEY = new (class ForgedKeyError extends Error {
 const ERR_REVOKED_KEY = new (class RevokedKeyError extends Error {
     code = 'REVOKED_KEY';
 })();
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVjcnlwdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9kZWNyeXB0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQUNsRSxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sV0FBVyxDQUFBO0FBQ3BDLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFDN0MsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLGVBQWUsQ0FBQTtBQUtwQyxNQUFNLE9BQU8sV0FBVztJQUNMLElBQUksR0FBd0IsRUFBRSxDQUFBO0lBQzlCLE1BQU0sR0FBd0IsRUFBRSxDQUFBO0lBQ3pDLEtBQUssQ0FBNkI7SUFDbEMsTUFBTSxDQUFTO0lBQ2YsTUFBTSxDQUF3QztJQUM5QyxJQUFJLENBQWtCO0lBRXZCLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUUsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUE7UUFFbkYsSUFBSSxNQUFNLEtBQUssU0FBUztZQUN0QixNQUFNLElBQUksU0FBUyxDQUFDLHlDQUF5QyxDQUFDLENBQUE7UUFFaEUsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFBO1FBQ3ZCLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFBO1FBQzFDLElBQUksQ0FBQyxLQUFLLEdBQUcsSUFBSSxRQUFRLENBQW1CLE9BQU8sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUE7UUFDeEUsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFBO1FBRXhCLEtBQUssTUFBTSxFQUFFLEVBQUUsRUFBRSxHQUFHLEVBQUUsTUFBTSxFQUFFLElBQUksT0FBTyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUM3RCxNQUFNLE1BQU0sR0FBRyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFBO1lBRTVELE1BQU0sQ0FBQyxFQUFFLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQTtRQUNwQyxDQUFDO0lBQ0gsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBYTtRQUNoQyxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssUUFBUSxDQUFBO1FBQ3ZDLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBRXJFLElBQUksR0FBRyxZQUFZLEtBQUs7WUFBRSxPQUFPLEdBQUcsQ0FBQTtRQUVwQyxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUFBO1FBRXZDLElBQUksR0FBRyxZQUFZLEtBQUs7WUFBRSxPQUFPLEdBQUcsQ0FBQTtRQUVwQyxNQUFNLE1BQU0sR0FBRyxNQUFNO1lBQ25CLENBQUMsQ0FBQyxNQUFNLGFBQWEsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLEdBQUcsQ0FBQztZQUNyQyxDQUFDLENBQUMsTUFBTSxVQUFVLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUVwQyxJQUFJLE1BQU0sWUFBWSxLQUFLO1lBQUUsT0FBTyxNQUFNLENBQUE7UUFFMUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsY0FBYyxFQUFFLE1BQU0sQ0FBQyxDQUFBO1FBRXZDLElBQUksR0FBRyxDQUFDLFFBQVEsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEtBQUssR0FBRyxDQUFDLFFBQVE7WUFDbkUsT0FBTyxjQUFjLENBQUE7UUFFdkIsSUFBSSxHQUFHLENBQUMsU0FBUyxLQUFLLFNBQVM7WUFBRSxPQUFPLGVBQWUsQ0FBQTtRQUV2RCxPQUFPO1lBQ0wsR0FBRyxFQUFFLE1BQU0sQ0FBQyxHQUFHO1lBQ2YsR0FBRyxFQUFFLE1BQU0sQ0FBQyxHQUFHO1lBQ2YsR0FBRyxFQUFFLE1BQU0sQ0FBQyxHQUFHO1lBQ2YsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO1lBQ3pCLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDeEQsT0FBTyxFQUFFLE1BQU0sSUFBSSxDQUFDLEdBQUcsS0FBSyxJQUFJLENBQUMsTUFBTSxJQUFJLEdBQUcsQ0FBQyxRQUFRLEtBQUssU0FBUyxDQUFDO1lBQ3RFLE1BQU0sRUFBRSxHQUFHLENBQUMsUUFBUSxLQUFLLFNBQVM7U0FDbkMsQ0FBQTtJQUNILENBQUM7SUFFTyxTQUFTLENBQUMsS0FBYTtRQUM3QixNQUFNLENBQUMsRUFBRSxBQUFELEVBQUcsQUFBRCxFQUFHLE1BQU0sQ0FBQyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUE7UUFFdkMsSUFBSSxNQUFNLEtBQUssU0FBUztZQUFFLE9BQU8saUJBQWlCLENBQUE7UUFFbEQsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFBO1lBQy9ELE1BQU0sRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFBO1lBRWhDLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUTtnQkFBRSxPQUFPLGlCQUFpQixDQUFBO1lBRXJELE9BQU8sR0FBRyxDQUFBO1FBQ1osQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE9BQU8saUJBQWlCLENBQUE7UUFDMUIsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsTUFBTSxDQUFDLEtBQWE7UUFDaEMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxFQUFFLHFCQUFxQixFQUFFLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQTtZQUM5QyxNQUFNLE1BQU0sR0FBRyxxQkFBcUIsQ0FBQyxLQUFLLENBQUMsQ0FBQTtZQUUzQyxJQUNFLE1BQU0sQ0FBQyxHQUFHLEtBQUssS0FBSztnQkFDcEIsTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTO2dCQUN4QixNQUFNLENBQUMsR0FBRyxLQUFLLEtBQUs7Z0JBQ3BCLE9BQU8sTUFBTSxDQUFDLEdBQUcsS0FBSyxRQUFRO2dCQUU5QixPQUFPLGlCQUFpQixDQUFBO1lBRTFCLE9BQU8sTUFBTSxDQUFDLEdBQUcsQ0FBQTtRQUNuQixDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxpQkFBaUIsQ0FBQTtRQUMxQixDQUFDO0lBQ0gsQ0FBQztJQUVPLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBVyxFQUFFLE1BQWU7UUFDNUMsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFBO1FBRW5ELElBQUksR0FBRyxJQUFJLFVBQVU7WUFBRSxPQUFPLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUU3QyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN6QixNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQTtZQUUvRCxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFBO1FBQ2hDLENBQUM7UUFFRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUVqQyxPQUFPLEtBQUssRUFBRSxLQUFLLElBQUksZUFBZSxDQUFBO0lBQ3hDLENBQUM7Q0FDRjtBQUVELEtBQUssVUFBVSxhQUFhLENBQUMsS0FBYSxFQUFFLEdBQVc7SUFDckQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxTQUFTLENBQUMsR0FBMkIsQ0FBQyxDQUFBO1FBQzNELGlGQUFpRjtRQUNqRixNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxZQUFZLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxFQUFFLGdCQUFnQixFQUFFLElBQUksRUFBRSxDQUFDLENBQUE7UUFFaEYsT0FBTyxNQUEyQixDQUFBO0lBQ3BDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLGlCQUFpQixDQUFBO0lBQzFCLENBQUM7QUFDSCxDQUFDO0FBRUQsS0FBSyxVQUFVLFVBQVUsQ0FBQyxLQUFhLEVBQUUsR0FBVztJQUNsRCxJQUFJLENBQUM7UUFDSCxNQUFNLEVBQUUsVUFBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQTtRQUVuQyxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxVQUFVLENBQVksS0FBSyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRTtZQUNsRSx1QkFBdUIsRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQywyQkFBMkIsRUFBRSxDQUFDLFNBQVMsQ0FBQztTQUN6QyxDQUFDLENBQUE7UUFFRixJQUNFLE9BQU8sT0FBTyxDQUFDLEdBQUcsS0FBSyxRQUFRO1lBQy9CLE9BQU8sT0FBTyxDQUFDLEdBQUcsS0FBSyxRQUFRO1lBQy9CLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRO1lBQ3BDLE9BQU8sQ0FBQyxRQUFRLEtBQUssSUFBSTtZQUV6QixPQUFPLGlCQUFpQixDQUFBO1FBRTFCLElBQUksT0FBTyxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLEdBQUcsR0FBRyxJQUFJLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRTtZQUMvRCxPQUFPLGlCQUFpQixDQUFBO1FBRTFCLE9BQU87WUFDTCxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUc7WUFDaEIsR0FBRyxFQUFFLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFO1lBQy9DLEdBQUcsQ0FBQyxPQUFPLENBQUMsR0FBRyxLQUFLLFNBQVM7Z0JBQzNCLENBQUMsQ0FBQyxFQUFFO2dCQUNKLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUM7WUFDeEQsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1lBQzFCLEdBQUcsQ0FBQyxPQUFPLENBQUMsR0FBRyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRyxFQUFFLENBQUM7U0FDM0QsQ0FBQTtJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLGlCQUFpQixDQUFBO0lBQzFCLENBQUM7QUFDSCxDQUFDO0FBRUQsTUFBTSxTQUFTLEdBQUcsZ0JBQWdCLEVBQUUsQ0FBQyxHQUFHLENBQUE7QUFDeEMsTUFBTSxZQUFZLEdBQUcsY0FBYyxFQUFFLENBQUMsR0FBRyxDQUFBO0FBWXpDLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxDQUFDLE1BQU0saUJBQWtCLFNBQVEsS0FBSztJQUNsRCxJQUFJLEdBQUcsZUFBZSxDQUFBO0NBQ3ZDLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxlQUFlLEdBQUcsSUFBSSxDQUFDLE1BQU0sZUFBZ0IsU0FBUSxLQUFLO0lBQzlDLElBQUksR0FBRyxhQUFhLENBQUE7Q0FDckMsQ0FBQyxFQUFFLENBQUE7QUFFSixNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsTUFBTSxjQUFlLFNBQVEsS0FBSztJQUM1QyxJQUFJLEdBQUcsWUFBWSxDQUFBO0NBQ3BDLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxlQUFlLEdBQUcsSUFBSSxDQUFDLE1BQU0sZUFBZ0IsU0FBUSxLQUFLO0lBQzlDLElBQUksR0FBRyxhQUFhLENBQUE7Q0FDckMsQ0FBQyxFQUFFLENBQUEifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVjcnlwdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9kZWNyeXB0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUM5QyxPQUFPLEVBQUUsY0FBYyxFQUFFLGdCQUFnQixFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFDbEUsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLFdBQVcsQ0FBQTtBQUNwQyxPQUFPLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBSzdDLE1BQU0sT0FBTyxXQUFXO0lBQ0wsSUFBSSxHQUF3QixFQUFFLENBQUE7SUFDOUIsTUFBTSxHQUF3QixFQUFFLENBQUE7SUFDekMsS0FBSyxDQUE2QjtJQUNsQyxNQUFNLENBQVM7SUFDZixNQUFNLENBQXdDO0lBQzlDLElBQUksQ0FBa0I7SUFFdkIsS0FBSyxDQUFDLE9BQWdCO1FBQzNCLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQTtRQUVuRixJQUFJLE1BQU0sS0FBSyxTQUFTO1lBQ3RCLE1BQU0sSUFBSSxTQUFTLENBQUMseUNBQXlDLENBQUMsQ0FBQTtRQUVoRSxJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQyxFQUFFLENBQUE7UUFDdkIsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUE7UUFDMUMsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLFFBQVEsQ0FBbUIsT0FBTyxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQTtRQUN4RSxJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUE7UUFFeEIsS0FBSyxNQUFNLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxNQUFNLEVBQUUsSUFBSSxPQUFPLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQzdELE1BQU0sTUFBTSxHQUFHLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUE7WUFFNUQsTUFBTSxDQUFDLEVBQUUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFBO1FBQ3BDLENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFhO1FBQ2hDLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzdCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUE7WUFFakMsSUFBSSxHQUFHLFlBQVksS0FBSztnQkFBRSxPQUFPLEdBQUcsQ0FBQTtZQUVwQyxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFBO1lBRXJDLElBQUksR0FBRyxZQUFZLEtBQUs7Z0JBQUUsT0FBTyxHQUFHLENBQUE7WUFFcEMsTUFBTSxNQUFNLEdBQUcsTUFBTSxhQUFhLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQTtZQUVsRCxJQUFJLE1BQU0sWUFBWSxLQUFLO2dCQUFFLE9BQU8sTUFBTSxDQUFBO1lBRTFDLCtFQUErRTtZQUMvRSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQTtRQUN2QyxDQUFDO1FBRUQsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBRXhCLElBQUksR0FBRyxZQUFZLEtBQUs7WUFBRSxPQUFPLEdBQUcsQ0FBQTtRQUVwQyxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQTtRQUUxQyxJQUFJLEdBQUcsWUFBWSxLQUFLO1lBQUUsT0FBTyxHQUFHLENBQUE7UUFFcEMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUE7UUFFakMsSUFBSSxNQUFNLFlBQVksS0FBSztZQUFFLE9BQU8sTUFBTSxDQUFBO1FBRTFDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FDaEIsTUFBTSxFQUNOLEdBQUcsRUFDSCxHQUFHLENBQUMsR0FBRyxLQUFLLElBQUksQ0FBQyxNQUFNLElBQUksR0FBRyxDQUFDLFFBQVEsS0FBSyxTQUFTLENBQ3RELENBQUE7SUFDSCxDQUFDO0lBRU8sU0FBUyxDQUFDLEtBQWE7UUFDN0IsTUFBTSxDQUFDLEVBQUUsQUFBRCxFQUFHLEFBQUQsRUFBRyxNQUFNLENBQUMsR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBRXZDLElBQUksTUFBTSxLQUFLLFNBQVM7WUFBRSxPQUFPLGlCQUFpQixDQUFBO1FBRWxELElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQTtZQUMvRCxNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQTtZQUVoQyxJQUFJLE9BQU8sR0FBRyxLQUFLLFFBQVE7Z0JBQUUsT0FBTyxpQkFBaUIsQ0FBQTtZQUVyRCxPQUFPLEdBQUcsQ0FBQTtRQUNaLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxPQUFPLGlCQUFpQixDQUFBO1FBQzFCLENBQUM7SUFDSCxDQUFDO0lBRUQseURBQXlEO0lBQ2pELE1BQU0sQ0FBQyxNQUFjLEVBQUUsR0FBUSxFQUFFLE9BQWdCO1FBQ3ZELElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxNQUFNLENBQUMsQ0FBQTtRQUV2QyxJQUFJLEdBQUcsQ0FBQyxRQUFRLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLEdBQUcsQ0FBQyxRQUFRO1lBQ25FLE9BQU8sY0FBYyxDQUFBO1FBRXZCLElBQUksR0FBRyxDQUFDLFNBQVMsS0FBSyxTQUFTO1lBQUUsT0FBTyxlQUFlLENBQUE7UUFFdkQsT0FBTztZQUNMLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztZQUNmLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztZQUNmLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztZQUNmLFFBQVEsRUFBRSxNQUFNLENBQUMsUUFBUTtZQUN6QixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ3hELE9BQU87WUFDUCxNQUFNLEVBQUUsR0FBRyxDQUFDLFFBQVEsS0FBSyxTQUFTO1NBQ25DLENBQUE7SUFDSCxDQUFDO0lBRU8sS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFXLEVBQUUsTUFBZTtRQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUE7UUFFbkQsSUFBSSxHQUFHLElBQUksVUFBVTtZQUFFLE9BQU8sVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBRTdDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1lBRS9ELElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUE7UUFDaEMsQ0FBQztRQUVELE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBRWpDLE9BQU8sS0FBSyxFQUFFLEtBQUssSUFBSSxlQUFlLENBQUE7SUFDeEMsQ0FBQztDQUNGO0FBRUQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUFhLEVBQUUsR0FBVztJQUNyRCxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLFNBQVMsQ0FBQyxHQUEyQixDQUFDLENBQUE7UUFDM0QsaUZBQWlGO1FBQ2pGLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLFlBQVksQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQTtRQUVoRixPQUFPLE1BQTJCLENBQUE7SUFDcEMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8saUJBQWlCLENBQUE7SUFDMUIsQ0FBQztBQUNILENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILFNBQVMsS0FBSyxDQUFDLEtBQWE7SUFDMUIsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUU5QixJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssS0FBSyxJQUFJLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxFQUFFO1FBQUUsT0FBTyxpQkFBaUIsQ0FBQTtJQUV2RSxNQUFNLENBQUMsTUFBTSxFQUFFLEFBQUQsRUFBRyxFQUFFLEVBQUUsVUFBVSxFQUFFLEdBQUcsQ0FBQyxHQUFHLEtBQUssQ0FBQTtJQUU3QyxJQUFJLFFBQWlDLENBQUE7SUFFckMsSUFBSSxDQUFDO1FBQ0gsUUFBUSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUE7SUFDM0UsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8saUJBQWlCLENBQUE7SUFDMUIsQ0FBQztJQUVELElBQ0UsUUFBUSxLQUFLLElBQUk7UUFDakIsT0FBTyxRQUFRLEtBQUssUUFBUTtRQUM1QixRQUFRLENBQUMsR0FBRyxLQUFLLEtBQUs7UUFDdEIsUUFBUSxDQUFDLEdBQUcsS0FBSyxTQUFTO1FBQzFCLFFBQVEsQ0FBQyxHQUFHLEtBQUssS0FBSztRQUN0QixPQUFPLFFBQVEsQ0FBQyxHQUFHLEtBQUssUUFBUTtRQUNoQyxRQUFRLENBQUMsSUFBSSxLQUFLLFNBQVM7UUFDM0IsUUFBUSxDQUFDLEdBQUcsS0FBSyxTQUFTO1FBRTFCLE9BQU8saUJBQWlCLENBQUE7SUFFMUIsT0FBTztRQUNMLEdBQUcsRUFBRSxRQUFRLENBQUMsR0FBRztRQUNqQix1RUFBdUU7UUFDdkUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQztRQUNqQyxFQUFFLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsV0FBVyxDQUFDO1FBQ2hDLFVBQVUsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUM7UUFDaEQsR0FBRyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLFdBQVcsQ0FBQztLQUNuQyxDQUFBO0FBQ0gsQ0FBQztBQUVELDhFQUE4RTtBQUM5RSxTQUFTLElBQUksQ0FBQyxHQUFRLEVBQUUsR0FBVztJQUNqQyxJQUFJLEdBQUcsQ0FBQyxFQUFFLENBQUMsTUFBTSxLQUFLLEVBQUUsSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLE1BQU0sS0FBSyxHQUFHO1FBQUUsT0FBTyxpQkFBaUIsQ0FBQTtJQUU1RSxJQUFJLE9BQWtCLENBQUE7SUFFdEIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUE7UUFFckUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUE7UUFDeEIsUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUE7UUFFNUIsT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQ2xCLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FDckYsQ0FBQTtJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLGlCQUFpQixDQUFBO0lBQzFCLENBQUM7SUFFRCxJQUNFLE9BQU8sS0FBSyxJQUFJO1FBQ2hCLE9BQU8sT0FBTyxLQUFLLFFBQVE7UUFDM0IsT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVE7UUFDL0IsT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVE7UUFDL0IsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7UUFDcEMsT0FBTyxDQUFDLFFBQVEsS0FBSyxJQUFJO1FBRXpCLE9BQU8saUJBQWlCLENBQUE7SUFFMUIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFBO0lBRXRCLElBQUksT0FBTyxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLEdBQUcsR0FBRyxJQUFJLElBQUksR0FBRztRQUFFLE9BQU8saUJBQWlCLENBQUE7SUFFcEYsSUFBSSxPQUFPLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsR0FBRyxHQUFHLElBQUksR0FBRyxHQUFHO1FBQUUsT0FBTyxpQkFBaUIsQ0FBQTtJQUVuRixPQUFPO1FBQ0wsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHO1FBQ2hCLEdBQUcsRUFBRSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRTtRQUMvQyxHQUFHLENBQUMsT0FBTyxDQUFDLEdBQUcsS0FBSyxTQUFTO1lBQzNCLENBQUMsQ0FBQyxFQUFFO1lBQ0osQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQztRQUN4RCxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVE7UUFDMUIsR0FBRyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHLEVBQUUsQ0FBQztLQUMzRCxDQUFBO0FBQ0gsQ0FBQztBQVVELE1BQU0sS0FBSyxHQUFHLENBQUMsQ0FBQTtBQUNmLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQTtBQUNiLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQTtBQUVkLE1BQU0sU0FBUyxHQUFHLGdCQUFnQixFQUFFLENBQUMsR0FBRyxDQUFBO0FBQ3hDLE1BQU0sWUFBWSxHQUFHLGNBQWMsRUFBRSxDQUFDLEdBQUcsQ0FBQTtBQVl6QyxNQUFNLGlCQUFpQixHQUFHLElBQUksQ0FBQyxNQUFNLGlCQUFrQixTQUFRLEtBQUs7SUFDbEQsSUFBSSxHQUFHLGVBQWUsQ0FBQTtDQUN2QyxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sZUFBZSxHQUFHLElBQUksQ0FBQyxNQUFNLGVBQWdCLFNBQVEsS0FBSztJQUM5QyxJQUFJLEdBQUcsYUFBYSxDQUFBO0NBQ3JDLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxjQUFjLEdBQUcsSUFBSSxDQUFDLE1BQU0sY0FBZSxTQUFRLEtBQUs7SUFDNUMsSUFBSSxHQUFHLFlBQVksQ0FBQTtDQUNwQyxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sZUFBZSxHQUFHLElBQUksQ0FBQyxNQUFNLGVBQWdCLFNBQVEsS0FBSztJQUM5QyxJQUFJLEdBQUcsYUFBYSxDQUFBO0NBQ3JDLENBQUMsRUFBRSxDQUFBIn0=

package/components/identity.tokens/operations/lib/jose.js

@@ -1,2 +1,5 @@
-export const load = async () => await import('jose');
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiam9zZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvam9zZS5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxNQUFNLENBQUMsTUFBTSxJQUFJLEdBQUcsS0FBSyxJQUFJLEVBQUUsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQSJ9
+/** @type {Promise<typeof import('jose')> | undefined} */
+let loading;
+// resolved once: an import per call resolves the module again on every token
+export const load = () => (loading ??= import('jose'));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiam9zZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvam9zZS5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSx5REFBeUQ7QUFDekQsSUFBSSxPQUFPLENBQUE7QUFFWCw2RUFBNkU7QUFDN0UsTUFBTSxDQUFDLE1BQU0sSUFBSSxHQUFHLEdBQUcsRUFBRSxDQUFDLENBQUMsT0FBTyxLQUFLLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFBIn0=

package/components/identity.tokens/source/decrypt.ts

@@ -1,7 +1,7 @@
+import { createDecipheriv } from 'node:crypto'
 import { DecryptFactory, ImportKeyFactory } from 'paseto/v3/local'
 import { LRUCache } from 'lru-cache'
 import { form, jweKey } from './lib/index.ts'
-import { load } from './lib/jose.js'
 import type { Maybe } from '@toa.io/core/types'
 import type { Operation } from '@toa.io/bridges.node'
 import type { Context, Claims, DecryptOutput, JWEClaims } from './lib/index.ts'
@@ -33,37 +33,40 @@ export class Computation implements Operation {
   }
 
   public async execute(token: string): Promise<Maybe<DecryptOutput>> {
-    const legacy = form(token) === 'paseto'
-    const kid = legacy ? this.pasetoKid(token) : await this.jweKid(token)
+    if (form(token) === 'paseto') {
+      const kid = this.pasetoKid(token)
 
-    if (kid instanceof Error) return kid
+      if (kid instanceof Error) return kid
 
-    const key = await this.key(kid, legacy)
+      const key = await this.key(kid, true)
 
-    if (key instanceof Error) return key
+      if (key instanceof Error) return key
 
-    const claims = legacy
-      ? await decryptPaseto(token, key.key)
-      : await decryptJWE(token, key.key)
+      const claims = await decryptPaseto(token, key.key)
 
-    if (claims instanceof Error) return claims
+      if (claims instanceof Error) return claims
 
-    this.logs.debug('Token claims', claims)
+      // a token of the form this component leaves behind is answered with a re-issue
+      return this.answer(claims, key, true)
+    }
 
-    if (key.identity !== undefined && claims.identity.id !== key.identity)
-      return ERR_FORGED_KEY
+    const jwe = parse(token)
 
-    if (key.revokedAt !== undefined) return ERR_REVOKED_KEY
+    if (jwe instanceof Error) return jwe
 
-    return {
-      iss: claims.iss,
-      iat: claims.iat,
-      exp: claims.exp,
-      identity: claims.identity,
-      ...(claims.aud === undefined ? {} : { aud: claims.aud }),
-      refresh: legacy || (kid !== this.latest && key.identity === undefined),
-      custom: key.identity !== undefined
-    }
+    const key = await this.key(jwe.kid, false)
+
+    if (key instanceof Error) return key
+
+    const claims = open(jwe, key.key)
+
+    if (claims instanceof Error) return claims
+
+    return this.answer(
+      claims,
+      key,
+      jwe.kid !== this.latest && key.identity === undefined
+    )
   }
 
   private pasetoKid(token: string): Maybe<string> {
@@ -83,22 +86,23 @@ export class Computation implements Operation {
     }
   }
 
-  private async jweKid(token: string): Promise<Maybe<string>> {
-    try {
-      const { decodeProtectedHeader } = await load()
-      const header = decodeProtectedHeader(token)
-
-      if (
-        header.alg !== 'dir' ||
-        header.enc !== 'A256GCM' ||
-        header.typ !== 'JWT' ||
-        typeof header.kid !== 'string'
-      )
-        return ERR_INVALID_TOKEN
-
-      return header.kid
-    } catch {
-      return ERR_INVALID_TOKEN
+  /** What both forms answer once their claims are open. */
+  private answer(claims: Claims, key: Key, refresh: boolean): Maybe<DecryptOutput> {
+    this.logs.debug('Token claims', claims)
+
+    if (key.identity !== undefined && claims.identity.id !== key.identity)
+      return ERR_FORGED_KEY
+
+    if (key.revokedAt !== undefined) return ERR_REVOKED_KEY
+
+    return {
+      iss: claims.iss,
+      iat: claims.iat,
+      exp: claims.exp,
+      identity: claims.identity,
+      ...(claims.aud === undefined ? {} : { aud: claims.aud }),
+      refresh,
+      custom: key.identity !== undefined
     }
   }
 
@@ -131,40 +135,107 @@ async function decryptPaseto(token: string, key: string): Promise<Maybe<Claims>>
   }
 }
 
-async function decryptJWE(token: string, key: string): Promise<Maybe<Claims>> {
+/**
+ * The five parts of a compact JWE (RFC 7516), of the one form this component issues: `dir`, so
+ * the encrypted key is empty, `A256GCM`, and a `kid` naming the key. A header that asks for
+ * anything else — another algorithm, a critical extension, compression — is refused, as jose
+ * refuses it.
+ */
+function parse(token: string): Maybe<JWE> {
+  const parts = token.split('.')
+
+  if (parts.length !== PARTS || parts[1] !== '') return ERR_INVALID_TOKEN
+
+  const [header, , iv, ciphertext, tag] = parts
+
+  let declared: Record<string, unknown>
+
   try {
-    const { jwtDecrypt } = await load()
-
-    const { payload } = await jwtDecrypt<JWEClaims>(token, jweKey(key), {
-      keyManagementAlgorithms: ['dir'],
-      contentEncryptionAlgorithms: ['A256GCM']
-    })
-
-    if (
-      typeof payload.iss !== 'string' ||
-      typeof payload.iat !== 'number' ||
-      typeof payload.identity !== 'object' ||
-      payload.identity === null
-    )
-      return ERR_INVALID_TOKEN
+    declared = JSON.parse(Buffer.from(header, 'base64url').toString('utf-8'))
+  } catch {
+    return ERR_INVALID_TOKEN
+  }
 
-    if (payload.exp !== undefined && payload.exp * 1000 <= Date.now())
-      return ERR_INVALID_TOKEN
+  if (
+    declared === null ||
+    typeof declared !== 'object' ||
+    declared.alg !== 'dir' ||
+    declared.enc !== 'A256GCM' ||
+    declared.typ !== 'JWT' ||
+    typeof declared.kid !== 'string' ||
+    declared.crit !== undefined ||
+    declared.zip !== undefined
+  )
+    return ERR_INVALID_TOKEN
 
-    return {
-      iss: payload.iss,
-      iat: new Date(payload.iat * 1000).toISOString(),
-      ...(payload.exp === undefined
-        ? {}
-        : { exp: new Date(payload.exp * 1000).toISOString() }),
-      identity: payload.identity,
-      ...(payload.aud === undefined ? {} : { aud: payload.aud })
-    }
+  return {
+    kid: declared.kid,
+    // the header as it was written, which is what it was encrypted against
+    aad: Buffer.from(header, 'ascii'),
+    iv: Buffer.from(iv, 'base64url'),
+    ciphertext: Buffer.from(ciphertext, 'base64url'),
+    tag: Buffer.from(tag, 'base64url')
+  }
+}
+
+/** The claims a token carries, where its tag holds and its times admit it. */
+function open(jwe: JWE, key: string): Maybe<Claims> {
+  if (jwe.iv.length !== IV || jwe.tag.length !== TAG) return ERR_INVALID_TOKEN
+
+  let payload: JWEClaims
+
+  try {
+    const decipher = createDecipheriv('aes-256-gcm', jweKey(key), jwe.iv)
+
+    decipher.setAAD(jwe.aad)
+    decipher.setAuthTag(jwe.tag)
+
+    payload = JSON.parse(
+      Buffer.concat([decipher.update(jwe.ciphertext), decipher.final()]).toString('utf-8')
+    )
   } catch {
     return ERR_INVALID_TOKEN
   }
+
+  if (
+    payload === null ||
+    typeof payload !== 'object' ||
+    typeof payload.iss !== 'string' ||
+    typeof payload.iat !== 'number' ||
+    typeof payload.identity !== 'object' ||
+    payload.identity === null
+  )
+    return ERR_INVALID_TOKEN
+
+  const now = Date.now()
+
+  if (payload.exp !== undefined && payload.exp * 1000 <= now) return ERR_INVALID_TOKEN
+
+  if (payload.nbf !== undefined && payload.nbf * 1000 > now) return ERR_INVALID_TOKEN
+
+  return {
+    iss: payload.iss,
+    iat: new Date(payload.iat * 1000).toISOString(),
+    ...(payload.exp === undefined
+      ? {}
+      : { exp: new Date(payload.exp * 1000).toISOString() }),
+    identity: payload.identity,
+    ...(payload.aud === undefined ? {} : { aud: payload.aud })
+  }
+}
+
+interface JWE {
+  kid: string
+  aad: Buffer
+  iv: Buffer
+  ciphertext: Buffer
+  tag: Buffer
 }
 
+const PARTS = 5
+const IV = 12
+const TAG = 16
+
 const importKey = ImportKeyFactory().run
 const decryptLocal = DecryptFactory().run
 

package/components/identity.tokens/source/lib/jose.js

@@ -1 +1,5 @@
-export const load = async () => await import('jose')
+/** @type {Promise<typeof import('jose')> | undefined} */
+let loading
+
+// resolved once: an import per call resolves the module again on every token
+export const load = () => (loading ??= import('jose'))

package/components/identity.tokens/types/index.d.ts

@@ -38,6 +38,7 @@ export interface Claims {
 export interface JWEClaims extends Omit<Claims, 'iat' | 'exp'> {
   iat: number
   exp?: number
+  nbf?: number
 }
 
 /** What this component is given: its own operations, and the two it reads keys and roles from. */

package/components/identity.tokens/types/toa.d.ts

@@ -4,7 +4,7 @@
 import type { Options, Query, RemoteError } from '@toa.io/core/types'
 import type { Secret } from '@toa.io/extensions.configuration'
 import type { FetchInit } from '@toa.io/extensions.fetch'
-import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Logs, Metrics, Span } from '@toa.io/extensions.telemetry'
 import type { Readable } from 'node:stream'
 
 export interface Entity {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/extensions.exposition",
-  "version": "1.0.0-alpha.302",
+  "version": "1.0.0-alpha.304",
   "type": "module",
   "description": "Toa Exposition",
   "author": "temich <tema.gurtovoy@gmail.com>",
@@ -28,16 +28,16 @@
     "!**/.env*"
   ],
   "dependencies": {
-    "@toa.io/core": "1.0.0-alpha.302",
-    "@toa.io/definitions": "1.0.0-alpha.302",
-    "@toa.io/generic": "1.0.0-alpha.301",
-    "@toa.io/schemas": "1.0.0-alpha.301",
+    "@toa.io/core": "1.0.0-alpha.304",
+    "@toa.io/definitions": "1.0.0-alpha.304",
+    "@toa.io/generic": "1.0.0-alpha.304",
+    "@toa.io/schemas": "1.0.0-alpha.304",
     "content-type": "3.0.0",
     "matchacho": "0.6.1",
     "minimatch": "10.2.6",
     "msgpackr": "2.1.0",
     "negotiator": "1.1.0",
-    "openspan": "1.0.0-alpha.301"
+    "openspan": "1.0.0-alpha.304"
   },
   "scripts": {
     "test": "echo \"Error: run tests from root\" && exit 1",
@@ -72,5 +72,5 @@
     "lru-cache": "11.5.2",
     "paseto": "4.0.1"
   },
-  "gitHead": "3cbbca55a61711db78f98b13e50cf4d1afaf5c08"
+  "gitHead": "a95a5a5a64922b11b23142d4acbcee1331ed31aa"
 }