@vibes.diy/identity 3.0.3 → 4.0.2

package/sts/index.js

@@ -0,0 +1,312 @@
+import { BuildURI, KeyedResolvOnce, Option, Result, exception2Result, timeouted } from "@adviser/cement";
+import { exportJWK, importJWK as joseImportJWK, jwtVerify, importSPKI } from "jose";
+import { base58btc } from "multiformats/bases/base58";
+import { z } from "zod";
+import { ensureSuperThis } from "../runtime/superthis.js";
+import { JWKPrivateSchema, JWKPublicSchema, toJwksAlg } from "../types/wire.js";
+import { mimeBlockParser, filterOk } from "./text-blocks.js";
+export const envKeyDefaults = {
+    SECRET: "CLOUD_SESSION_TOKEN_SECRET",
+    PUBLIC: "CLOUD_SESSION_TOKEN_PUBLIC",
+};
+export async function importJWK(jwk, alg, options) {
+    let algorithm;
+    if (alg) {
+        algorithm = alg;
+    }
+    else {
+        const rAlg = toJwksAlg(jwk);
+        if (rAlg.isErr()) {
+            return Result.Err(rAlg);
+        }
+        algorithm = rAlg.Ok();
+    }
+    const rKey = await exception2Result(() => joseImportJWK(jwk, algorithm, options));
+    if (rKey.isErr()) {
+        return Result.Err(rKey);
+    }
+    return Result.Ok({ key: rKey.Ok(), alg: algorithm });
+}
+export async function jwk2env(jwk, sthis = ensureSuperThis()) {
+    const rJwk = await exception2Result(() => exportJWK(jwk));
+    const inPubKey = rJwk.isOk() ? rJwk.Ok() : jwk;
+    return base58btc.encode(sthis.txt.encode(JSON.stringify(inPubKey)));
+}
+export async function env2jwk(env, alg, sthis = ensureSuperThis()) {
+    const jwks = await coerceJWK(sthis, env);
+    if (jwks.length === 0) {
+        throw new Error("No valid JWK found in env");
+    }
+    const keys = [];
+    for (const jwk of jwks) {
+        const rKey = await importJWK(jwk, alg, { extractable: true });
+        if (rKey.isErr()) {
+            throw rKey.Err();
+        }
+        keys.push(rKey.Ok().key);
+    }
+    return keys;
+}
+function coercesJWKplainOrkeysObject(keyOrkeys, validator) {
+    const keys = [];
+    const isKeys = z.object({ keys: z.array(z.any()) }).safeParse(keyOrkeys);
+    if (isKeys.success) {
+        keys.push(...isKeys.data.keys);
+    }
+    else {
+        keys.push(keyOrkeys);
+    }
+    return keys.map((key) => {
+        const parsed = validator.safeParse(key);
+        if (parsed.success) {
+            return Result.Ok(parsed.data);
+        }
+        else {
+            return Result.Err(parsed.error);
+        }
+    });
+}
+export async function coerceJWKWithSchema(sthis, validator, ...inputs) {
+    return Promise.all(inputs.flat().map(async (keys) => {
+        if (typeof keys === "string") {
+            const jwkKeys = [];
+            for (const { content, begin, end } of mimeBlockParser(keys)) {
+                if (begin && end) {
+                    const pem = `${begin}\n${content}\n${end}\n`;
+                    const rKey = await exception2Result(() => importSPKI(pem, "RS256"));
+                    if (rKey.isErr()) {
+                        jwkKeys.push(Result.Err(rKey.Err()));
+                        continue;
+                    }
+                    const key = rKey.Ok();
+                    const jwk = await exportJWK(key);
+                    const parsed = validator.safeParse({ ...jwk, alg: "RS256" });
+                    if (parsed.success) {
+                        jwkKeys.push(Result.Ok(parsed.data));
+                    }
+                    else {
+                        jwkKeys.push(Result.Err(parsed.error));
+                    }
+                    continue;
+                }
+                let encodingFailed = Option.Some(Result.Err("Failed to decode JWK string with any known encoding"));
+                for (const decodeFn of [
+                    (a) => a,
+                    (a) => sthis.txt.base64.decode(a),
+                    (a) => sthis.txt.base58.decode(a),
+                ]) {
+                    const res = exception2Result(() => decodeFn(content));
+                    if (res.isErr()) {
+                        continue;
+                    }
+                    const resStr = res.Ok();
+                    const keyOrkeys = exception2Result(() => JSON.parse(resStr));
+                    if (keyOrkeys.isErr()) {
+                        continue;
+                    }
+                    encodingFailed = Option.None();
+                    for (const rKey of coercesJWKplainOrkeysObject(keyOrkeys.Ok(), validator)) {
+                        jwkKeys.push(rKey);
+                    }
+                }
+                if (encodingFailed.IsSome()) {
+                    jwkKeys.push(encodingFailed.Unwrap());
+                }
+            }
+            return jwkKeys;
+        }
+        else {
+            return coercesJWKplainOrkeysObject(keys, validator);
+        }
+    })).then((a) => a.flat());
+}
+export async function coerceJWK(sthis, ...i) {
+    const priv = await coerceJWKWithSchema(sthis, JWKPrivateSchema, ...i);
+    const pub = await coerceJWKWithSchema(sthis, JWKPublicSchema, ...i);
+    if (priv.length !== pub.length) {
+        throw new Error("Mismatched number of private and public keys");
+    }
+    const ret = [];
+    for (let idx = 0; idx < priv.length; idx++) {
+        const rPriv = priv[idx];
+        const rPub = pub[idx];
+        if (rPriv.isOk()) {
+            ret.push(rPriv);
+        }
+        else if (rPub.isOk()) {
+            ret.push(rPub);
+        }
+        else {
+            if (rPriv.Err()) {
+                ret.push(Result.Err(rPriv.Err()));
+            }
+            else {
+                ret.push(Result.Err(rPub.Err()));
+            }
+        }
+    }
+    return filterOk(ret);
+}
+export async function coerceJWKPublic(sthis, ...i) {
+    return filterOk(await coerceJWKWithSchema(sthis, JWKPublicSchema, ...i));
+}
+export async function coerceJWKPrivate(sthis, ...i) {
+    return filterOk(await coerceJWKWithSchema(sthis, JWKPrivateSchema, ...i));
+}
+export async function verifyToken(token, presetPubKey, wellKnownUrls, iopts = {}) {
+    const opts = {
+        fetchTimeoutMs: 1000,
+        parseSchema: (payload) => {
+            return Result.Ok(payload);
+        },
+        fetch: (...args) => globalThis.fetch(...args),
+        verifyToken: async (token, pubKey) => {
+            const rKey = await importJWK(pubKey);
+            if (rKey.isErr()) {
+                return Result.Err(rKey);
+            }
+            const rRes = await exception2Result(() => jwtVerify(token, rKey.Ok().key));
+            if (rRes.isErr()) {
+                return Result.Err(rRes);
+            }
+            const res = rRes.Ok();
+            if (!res) {
+                return Result.Err("JWT verification failed");
+            }
+            return Result.Ok(res);
+        },
+        ...iopts,
+        sthis: iopts.sthis ?? ensureSuperThis(),
+    };
+    for (const pubKey of presetPubKey) {
+        const coercedKeys = await coerceJWKPublic(opts.sthis, pubKey);
+        for (const key of coercedKeys) {
+            const rVerify = await internVerifyToken(token, key, opts);
+            if (rVerify.isOk()) {
+                return rVerify;
+            }
+        }
+    }
+    const errors = [];
+    for (const url of wellKnownUrls) {
+        const rPubKeys = await fetchWellKnownJwks([url], opts);
+        for (const pubKey of rPubKeys) {
+            switch (true) {
+                case isFetchWellKnownJwksResultErr(pubKey):
+                case isFetchWellKnownJwksResultTimeout(pubKey):
+                    errors.push(pubKey);
+                    continue;
+                case isFetchWellKnownJwksResultOk(pubKey):
+                    {
+                        for (const key of pubKey.keys) {
+                            const rVerify = await internVerifyToken(token, key, opts);
+                            if (rVerify.isOk()) {
+                                return rVerify;
+                            }
+                            else {
+                                errors.push({
+                                    type: "error",
+                                    error: rVerify.Err(),
+                                    url: pubKey.url,
+                                });
+                            }
+                        }
+                    }
+                    break;
+                default:
+                    throw new Error("unreachable");
+            }
+        }
+    }
+    return Result.Err(`No well-known JWKS URL could verify the token:\n${JSON.stringify(errors, null, 2)}`);
+}
+async function internVerifyToken(token, presetPubKey, opts) {
+    const rVerify = await opts.verifyToken(token, presetPubKey);
+    if (rVerify.isErr()) {
+        return Result.Err(rVerify);
+    }
+    return opts.parseSchema(rVerify.Ok().payload);
+}
+export function isFetchWellKnownJwksResultOk(r) {
+    return r.type === "ok";
+}
+export function isFetchWellKnownJwksResultErr(r) {
+    return r.type === "error";
+}
+export function isFetchWellKnownJwksResultTimeout(r) {
+    return r.type === "timeout";
+}
+const keysFromWellKnownJwksCache = new KeyedResolvOnce({
+    resetAfter: 30 * 60 * 1000,
+});
+export async function fetchWellKnownJwks(urls, iopts = {}) {
+    const opts = {
+        fetchTimeoutMs: 1000,
+        fetch: (...args) => globalThis.fetch(...args),
+        ...iopts,
+    };
+    return Promise.all((Array.isArray(urls) ? urls : [urls])
+        .flat()
+        .map((u) => {
+        if (!u) {
+            return undefined;
+        }
+        const buri = BuildURI.from(u);
+        const url = buri.URI();
+        if (url.pathname === "" || url.pathname === "/") {
+            buri.pathname("/.well-known/jwks.json");
+        }
+        return buri.toString();
+    })
+        .filter((u) => !!u)
+        .map(async (url) => {
+        const onceFn = keysFromWellKnownJwksCache.get(url);
+        return onceFn.once(async () => {
+            const timeout = await timeouted(opts
+                .fetch(url, {
+                method: "GET",
+            })
+                .then((res) => {
+                if (!res.ok) {
+                    throw new Error(`Failed to fetch well-known JWKS from ${url}: ${res.status} ${res.statusText}`);
+                }
+                return res.json();
+            }), {
+                timeout: opts.fetchTimeoutMs || 1000,
+            });
+            switch (timeout.state) {
+                case "timeout":
+                    onceFn.reset();
+                    return {
+                        type: "timeout",
+                        url,
+                    };
+                case "error":
+                    onceFn.reset();
+                    return {
+                        type: "error",
+                        error: timeout.error,
+                        url,
+                    };
+                case "success": {
+                    const parsed = z.object({ keys: JWKPublicSchema.array() }).safeParse(timeout.value);
+                    if (!parsed.success) {
+                        return {
+                            type: "error",
+                            error: new Error(`Invalid JWKS format from ${url}: ${parsed.error.message}`),
+                            url,
+                        };
+                    }
+                    return {
+                        type: "ok",
+                        keys: parsed.data.keys,
+                        url,
+                    };
+                }
+                default:
+                    throw new Error("unreachable");
+            }
+        });
+    }));
+}
+//# sourceMappingURL=index.js.map

package/sts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../jsr/sts/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACzG,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAI7D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EAAE,4BAA4B;IACpC,MAAM,EAAE,4BAA4B;CACrC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,GAAY,EACZ,OAAmC;IAEnC,IAAI,SAAS,CAAC;IACd,IAAI,GAAG,EAAE,CAAC;QACR,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAoB,EAAE,KAAK,GAAc,eAAe,EAAE;IAItF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAsC,CAAC,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/C,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,GAAY,EAAE,KAAK,GAAc,eAAe,EAAE;IAC3F,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAU,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,2BAA2B,CAAC,SAAkB,EAAE,SAAuB;IAC9E,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAgB,EAChB,SAAuB,EACvB,GAAG,MAAiB;IAEpB,OAAO,OAAO,CAAC,GAAG,CAChB,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAsB,EAAE,CAAC;YACtC,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;oBACjB,MAAM,GAAG,GAAG,GAAG,KAAK,KAAK,OAAO,KAAK,GAAG,IAAI,CAAC;oBAC7C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;oBACpE,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;wBACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;wBACrC,SAAS;oBACX,CAAC;oBACD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;oBACtB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC7D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;oBACvC,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzC,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;gBACpG,KAAK,MAAM,QAAQ,IAAI;oBACrB,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;oBAChB,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;oBACzC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;iBAC1C,EAAE,CAAC;oBACF,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;oBACtD,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;wBAChB,SAAS;oBACX,CAAC;oBACD,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC;oBACxB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC7D,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;wBACtB,SAAS;oBACX,CAAC;oBACD,cAAc,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC/B,KAAK,MAAM,IAAI,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;wBAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;gBACD,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,2BAA2B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAgB,EAAE,GAAG,CAAY;IAC/D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAgB,EAAE,GAAG,CAAY;IACrE,OAAO,QAAQ,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAgB,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAgB,EAAE,GAAG,CAAY;IACtE,OAAO,QAAQ,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAiB,CAAC;AAC5F,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,YAAuC,EACvC,aAAgC,EAChC,KAAK,GAAgC,EAAE;IAEvC,MAAM,IAAI,GAAuB;QAC/B,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,CAAC,OAAgB,EAAE,EAAE;YAChC,OAAO,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,EAAE,CAAC,GAAG,IAAyC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAClF,WAAW,EAAE,KAAK,EAAE,KAAa,EAAE,MAAW,EAAE,EAAE;YAChD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3E,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE;KACxC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9D,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,GAAqB,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnB,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,6BAA6B,CAAC,MAAM,CAAC,CAAC;gBAC3C,KAAK,iCAAiC,CAAC,MAAM,CAAC;oBAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACpB,SAAS;gBACX,KAAK,4BAA4B,CAAC,MAAM,CAAC;oBACvC,CAAC;wBACC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC9B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,GAAqB,EAAE,IAAI,CAAC,CAAC;4BAC5E,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gCACnB,OAAO,OAAO,CAAC;4BACjB,CAAC;iCAAM,CAAC;gCACN,MAAM,CAAC,IAAI,CAAC;oCACV,IAAI,EAAE,OAAO;oCACb,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE;oCACpB,GAAG,EAAE,MAAM,CAAC,GAAG;iCAChB,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,MAAM;gBACR;oBACE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,mDAAmD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,YAAiB,EAAE,IAAwB;IACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,CAAE,OAAO,CAAC,EAAE,EAA2B,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC;AAkBD,MAAM,UAAU,4BAA4B,CAAC,CAA2B;IACtE,OAAO,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;AACzB,CAAC;AACD,MAAM,UAAU,6BAA6B,CAAC,CAA2B;IACvE,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;AAC5B,CAAC;AACD,MAAM,UAAU,iCAAiC,CAAC,CAA2B;IAC3E,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,eAAe,CAA2B;IAC/E,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAqC,EACrC,KAAK,GAAkE,EAAE;IAEzE,MAAM,IAAI,GAAG;QACX,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,CAAC,GAAG,IAAyC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAClF,GAAG,KAAK;KACT,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAClC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/B,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,SAAS,CAC7B,IAAI;iBACD,KAAK,CAAC,GAAG,EAAE;gBACV,MAAM,EAAE,KAAK;aACd,CAAC;iBACD,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACZ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;gBAClG,CAAC;gBACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,EACJ;gBACE,OAAO,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;aACrC,CACF,CAAC;YACF,QAAQ,OAAO,CAAC,KAAK,EAAE,CAAC;gBACtB,KAAK,SAAS;oBACZ,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,OAAO;wBACL,IAAI,EAAE,SAAS;wBACf,GAAG;qBACwB,CAAC;gBAChC,KAAK,OAAO;oBACV,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,OAAO;wBACL,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,GAAG;qBACwB,CAAC;gBAChC,KAAK,SAAS,EAAE,CAAC;oBACf,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBACpF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACpB,OAAO;4BACL,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,IAAI,KAAK,CAAC,4BAA4B,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;4BAC5E,GAAG;yBACwB,CAAC;oBAChC,CAAC;oBACD,OAAO;wBACL,IAAI,EAAE,IAAI;wBACV,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;wBACtB,GAAG;qBACwB,CAAC;gBAChC,CAAC;gBACD;oBACE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CACL,CAAC;AACJ,CAAC"}

package/sts/sts-golden.test.d.ts

@@ -0,0 +1 @@
+export {};

package/sts/sts-golden.test.js

@@ -0,0 +1,63 @@
+import { describe, it, expect } from "vitest";
+import { importJWK as joseImportJWK, exportJWK, SignJWT } from "jose";
+import { ensureSuperThis } from "../index.js";
+import * as exSts from "./index.js";
+import { ES256_PUB_JWK, ES256_PRIV_JWK, JWK2ENV_PUB } from "../golden-fixtures.js";
+const sthis = ensureSuperThis();
+const PUB = { ...ES256_PUB_JWK, alg: "ES256" };
+async function sign(privJwk, claims, expDelta = 300) {
+    const key = await joseImportJWK(privJwk, "ES256");
+    const now = Math.floor(Date.now() / 1000);
+    return new SignJWT(claims)
+        .setProtectedHeader({ alg: "ES256" })
+        .setIssuedAt(now)
+        .setExpirationTime(now + expDelta)
+        .sign(key);
+}
+describe("sts lift — byte-compat against the frozen fireproof contract", () => {
+    it("jwk2env: extracted output is byte-identical to the frozen fireproof value", async () => {
+        const pubKey = await joseImportJWK({ ...ES256_PUB_JWK }, "ES256", { extractable: true });
+        expect(await exSts.jwk2env(pubKey, sthis)).toBe(JWK2ENV_PUB);
+    });
+    it("env2jwk: decodes the frozen env material back to the exact frozen key (Charlie #2858)", async () => {
+        const keys = await exSts.env2jwk(JWK2ENV_PUB, undefined, sthis);
+        expect(keys.length).toBe(1);
+        const jwk = await exportJWK(keys[0]);
+        expect({ kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y }).toEqual({
+            kty: ES256_PUB_JWK.kty,
+            crv: ES256_PUB_JWK.crv,
+            x: ES256_PUB_JWK.x,
+            y: ES256_PUB_JWK.y,
+        });
+    });
+    it("importJWK: ES256 alg + ok", async () => {
+        const r = await exSts.importJWK({ ...PUB });
+        expect(r.isOk()).toBe(true);
+        expect(r.Ok().alg).toBe("ES256");
+    });
+    it("verifyToken (preset key): a token signed by the frozen key verifies", async () => {
+        const token = await sign({ ...ES256_PRIV_JWK, alg: "ES256" }, { sub: "wire-compat" });
+        const r = await exSts.verifyToken(token, [PUB], []);
+        expect(r.isOk()).toBe(true);
+    });
+    it("verifyToken (preset key): a token signed by a DIFFERENT key is rejected (no false accept)", async () => {
+        const { privateKey, publicKey } = await (await import("jose")).generateKeyPair("ES256", { extractable: true });
+        const token = await new SignJWT({ sub: "x" })
+            .setProtectedHeader({ alg: "ES256" })
+            .setIssuedAt()
+            .setExpirationTime("5m")
+            .sign(privateKey);
+        void publicKey;
+        const r = await exSts.verifyToken(token, [PUB], []);
+        expect(r.isOk()).toBe(false);
+    });
+    it("verifyToken (well-known JWKS): fetches the JWKS and verifies via the URL branch", async () => {
+        const token = await sign({ ...ES256_PRIV_JWK, alg: "ES256" }, { sub: "jwks-path" });
+        const jwks = { keys: [{ ...(await exportJWK(await joseImportJWK({ ...ES256_PUB_JWK }, "ES256"))), alg: "ES256" }] };
+        const fetchMock = (async () => new Response(JSON.stringify(jwks), { status: 200, headers: { "content-type": "application/json" } }));
+        const url = `https://clerk.example.test/${Math.random().toString(36).slice(2)}/.well-known/jwks.json`;
+        const r = await exSts.verifyToken(token, [], [url], { fetch: fetchMock });
+        expect(r.isOk()).toBe(true);
+    });
+});
+//# sourceMappingURL=sts-golden.test.js.map

package/sts/sts-golden.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts-golden.test.js","sourceRoot":"","sources":["../../jsr/sts/sts-golden.test.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,SAAS,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEnF,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;AAChC,MAAM,GAAG,GAAQ,EAAE,GAAG,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAEpD,KAAK,UAAU,IAAI,CAAC,OAAY,EAAE,MAA+B,EAAE,QAAQ,GAAG,GAAG;IAC/E,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC;SACjC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;IAC5E,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAmB,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE5B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;YACjE,GAAG,EAAE,aAAa,CAAC,GAAG;YACtB,GAAG,EAAE,aAAa,CAAC,GAAG;YACtB,CAAC,EAAE,aAAa,CAAC,CAAC;YAClB,CAAC,EAAE,aAAa,CAAC,CAAC;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,EAAE,OAAO,EAAS,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;aAC1C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,WAAW,EAAE;aACb,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,KAAK,SAAS,CAAC;QAEf,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAKH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,EAAE,OAAO,EAAS,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,aAAa,CAAC,EAAE,GAAG,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACpH,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAC5B,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAiB,CAAC;QAExH,MAAM,GAAG,GAAG,8BAA8B,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC;QACtG,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/sts/text-blocks.d.ts

@@ -0,0 +1,10 @@
+import type { Result } from "@adviser/cement";
+export interface MimeBlock {
+    readonly preBegin: string | undefined;
+    readonly begin: string | undefined;
+    readonly content: string;
+    readonly end: string | undefined;
+    readonly postEnd: string | undefined;
+}
+export declare function mimeBlockParser(mime: string): MimeBlock[];
+export declare function filterOk<T>(results: Result<T>[]): T[];

package/sts/text-blocks.js

@@ -0,0 +1,90 @@
+export function mimeBlockParser(mime) {
+    const blocks = [];
+    const lines = mime.split("\n");
+    let i = 0;
+    let lastProcessedIndex = -1;
+    while (i < lines.length) {
+        const line = lines[i];
+        const beginMatch = line.match(/^(-{3,})\s*(BEGIN)\s+(.+?)\s*(-{3,})$/i);
+        if (beginMatch) {
+            const leadingDashes = beginMatch[1].length;
+            const trailingDashes = beginMatch[4].length;
+            const blockType = beginMatch[3];
+            const escapedBlockType = blockType.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const endPattern = new RegExp(`^-{${leadingDashes}}\\s*(END)\\s+${escapedBlockType}\\s*-{${trailingDashes}}$`, "i");
+            const preBegin = [];
+            for (let j = lastProcessedIndex + 1; j < i; j++) {
+                preBegin.push(lines[j]);
+            }
+            i++;
+            const contentLines = [];
+            let foundEnd = false;
+            let endLine = "";
+            while (i < lines.length) {
+                if (endPattern.test(lines[i])) {
+                    foundEnd = true;
+                    endLine = lines[i];
+                    break;
+                }
+                contentLines.push(lines[i]);
+                i++;
+            }
+            if (foundEnd) {
+                i++;
+                const postEnd = [];
+                while (i < lines.length && !lines[i].match(/^-{3,}\s*BEGIN\s+.+-{3,}$/i)) {
+                    postEnd.push(lines[i]);
+                    i++;
+                }
+                blocks.push({
+                    preBegin: preBegin.length > 0 ? preBegin.join("\n") : undefined,
+                    begin: line,
+                    content: contentLines.join("\n"),
+                    end: endLine,
+                    postEnd: postEnd.length > 0 ? postEnd.join("\n") : undefined,
+                });
+                lastProcessedIndex = i - 1;
+            }
+            else {
+                const allContent = [...preBegin, line, ...contentLines];
+                blocks.push({
+                    begin: undefined,
+                    end: undefined,
+                    content: allContent.join("\n"),
+                    preBegin: undefined,
+                    postEnd: undefined,
+                });
+                lastProcessedIndex = i - 1;
+            }
+        }
+        else {
+            i++;
+        }
+    }
+    if (lastProcessedIndex < lines.length - 1) {
+        const remainingLines = [];
+        for (let j = lastProcessedIndex + 1; j < lines.length; j++) {
+            remainingLines.push(lines[j]);
+        }
+        if (remainingLines.length > 0) {
+            blocks.push({
+                begin: undefined,
+                end: undefined,
+                content: remainingLines.join("\n"),
+                preBegin: undefined,
+                postEnd: undefined,
+            });
+        }
+    }
+    return blocks;
+}
+export function filterOk(results) {
+    const okValues = [];
+    for (const res of results) {
+        if (res.isOk()) {
+            okValues.push(res.Ok());
+        }
+    }
+    return okValues;
+}
+//# sourceMappingURL=text-blocks.js.map

package/sts/text-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text-blocks.js","sourceRoot":"","sources":["../../jsr/sts/text-blocks.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,kBAAkB,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC1E,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,MAAM,aAAa,iBAAiB,gBAAgB,SAAS,cAAc,IAAI,EAAE,GAAG,CAAC,CAAC;YACpH,MAAM,QAAQ,GAAG,EAAE,CAAC;YACpB,KAAK,IAAI,CAAC,GAAG,kBAAkB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,MAAM,YAAY,GAAG,EAAE,CAAC;YACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9B,QAAQ,GAAG,IAAI,CAAC;oBAChB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC,EAAE,CAAC;YACN,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,CAAC,EAAE,CAAC;gBACJ,MAAM,OAAO,GAAG,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC;oBACzE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvB,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC/D,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;oBAChC,GAAG,EAAE,OAAO;oBACZ,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;iBAC7D,CAAC,CAAC;gBACH,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,CAAC;gBACxD,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,SAAS;oBAChB,GAAG,EAAE,SAAS;oBACd,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC9B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,SAAS;iBACnB,CAAC,CAAC;gBACH,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,kBAAkB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3D,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,SAAS;gBACd,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,SAAS;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAI,OAAoB;IAC9C,MAAM,QAAQ,GAAQ,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/testing.d.ts

@@ -0,0 +1,7 @@
+export { createTestDeviceCA, createTestUser } from "./device-id/test-helpers.js";
+export type { CreateTestUserParams, TestUser } from "./device-id/test-helpers.js";
+export { DeviceIdKey } from "./device-id/key.js";
+export { DeviceIdSignMsg } from "./device-id/sign.js";
+export { DeviceIdCSR } from "./device-id/csr.js";
+export { DeviceIdVerifyMsg } from "./device-id/verify.js";
+export { DeviceIdCA } from "./device-id/ca.js";

package/testing.js

@@ -0,0 +1,7 @@
+export { createTestDeviceCA, createTestUser } from "./device-id/test-helpers.js";
+export { DeviceIdKey } from "./device-id/key.js";
+export { DeviceIdSignMsg } from "./device-id/sign.js";
+export { DeviceIdCSR } from "./device-id/csr.js";
+export { DeviceIdVerifyMsg } from "./device-id/verify.js";
+export { DeviceIdCA } from "./device-id/ca.js";
+//# sourceMappingURL=testing.js.map

package/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../jsr/testing.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEjF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}

package/types/cert-payload.d.ts

@@ -1,3 +1,47 @@
 import { z } from "zod";
-import type { CertificatePayload } from "@fireproof/core-types-base";
+import { type Subject, type Extensions } from "./device-id-payload.js";
+import { type JWKPublic } from "./wire.js";
+import { type ClerkClaim } from "../clerk-claim.js";
+export interface Certificate {
+    version: "3";
+    serialNumber: string;
+    subject: Subject;
+    issuer: Subject;
+    validity: {
+        notBefore: string;
+        notAfter: string;
+    };
+    subjectPublicKeyInfo: JWKPublic;
+    signatureAlgorithm: "ES256";
+    keyUsage: ("digitalSignature" | "nonRepudiation" | "keyEncipherment" | "dataEncipherment" | "keyAgreement" | "keyCertSign" | "cRLSign" | "encipherOnly" | "decipherOnly")[];
+    extendedKeyUsage: ("serverAuth" | "clientAuth" | "codeSigning" | "emailProtection" | "timeStamping" | "OCSPSigning" | "ipsecIKE" | "msCodeInd" | "msCodeCom" | "msCTLSign" | "msEFS")[];
+    extensions?: Extensions;
+}
+export type CertificatePayload = Readonly<{
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    iat: number;
+    nbf: number;
+    exp: number;
+    jti: string;
+    certificate: Certificate;
+    creatingUser?: {
+        type: "clerk";
+        claims: ClerkClaim;
+    };
+}>;
+export interface IssueCertificateResult {
+    readonly certificateJWT: string;
+    readonly certificatePayload: CertificatePayload;
+    readonly format: "JWS";
+    readonly serialNumber: string;
+    readonly issuer: string;
+    readonly subject: string;
+    readonly validityPeriod: {
+        readonly notBefore: Date;
+        readonly notAfter: Date;
+    };
+    readonly publicKey: JWKPublic;
+}
 export declare const CertificatePayloadSchema: z.ZodType<CertificatePayload>;

package/types/cert-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"cert-payload.js","sourceRoot":"","sources":["../../jsr/types/cert-payload.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEzE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAQrD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,MAAM,EAAE,gBAAgB;CACzB,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,aAAa;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,oBAAoB,EAAE,eAAe;IACrC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CACf,CAAC,CAAC,IAAI,CAAC;QACL,kBAAkB;QAClB,gBAAgB;QAChB,iBAAiB;QACjB,kBAAkB;QAClB,cAAc;QACd,aAAa;QACb,SAAS;QACT,cAAc;QACd,cAAc;KACf,CAAC,CACH;IACD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CACvB,CAAC,CAAC,IAAI,CAAC;QACL,YAAY;QACZ,YAAY;QACZ,aAAa;QACb,iBAAiB;QACjB,cAAc;QACd,aAAa;QACb,UAAU;QACV,WAAW;QACX,WAAW;QACX,WAAW;QACX,OAAO;KACR,CAAC,CACH;IACD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,wBAAwB,GAAkC,CAAC;KACrE,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,WAAW,EAAE,iBAAiB;IAC9B,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,QAAQ,EAAmC,CAAC"}
+{"version":3,"file":"cert-payload.js","sourceRoot":"","sources":["../../jsr/types/cert-payload.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAiC,MAAM,wBAAwB,CAAC;AACxG,OAAO,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAmB,MAAM,mBAAmB,CAAC;AA2EtE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,MAAM,EAAE,gBAAgB;CACzB,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,aAAa;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,oBAAoB,EAAE,eAAe;IACrC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CACf,CAAC,CAAC,IAAI,CAAC;QACL,kBAAkB;QAClB,gBAAgB;QAChB,iBAAiB;QACjB,kBAAkB;QAClB,cAAc;QACd,aAAa;QACb,SAAS;QACT,cAAc;QACd,cAAc;KACf,CAAC,CACH;IACD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CACvB,CAAC,CAAC,IAAI,CAAC;QACL,YAAY;QACZ,YAAY;QACZ,aAAa;QACb,iBAAiB;QACjB,cAAc;QACd,aAAa;QACb,UAAU;QACV,WAAW;QACX,WAAW;QACX,WAAW;QACX,OAAO;KACR,CAAC,CACH;IACD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,wBAAwB,GAAkC,CAAC;KACrE,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,WAAW,EAAE,iBAAiB;IAC9B,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,QAAQ,EAAmC,CAAC"}