effect 4.1.0 → 4.1.1

package/dist/jose/Jwks.d.ts

@@ -0,0 +1,236 @@
+import * as Context from "../Context.ts";
+import type * as Duration from "../Duration.ts";
+import * as Effect from "../Effect.ts";
+import * as HttpClient from "../http/HttpClient.ts";
+import * as Layer from "../Layer.ts";
+import * as Schema from "../Schema.ts";
+import type * as Scope from "../Scope.ts";
+import * as JoseError from "./JoseError.ts";
+import { type AsymmetricAlgorithm, type PublicKey } from "./Jwk.ts";
+import type * as Jws from "./Jws.ts";
+/**
+ * Schema for a set of public JWKs.
+ *
+ * **Details**
+ *
+ * Keys of other families or curves are kept but never selected. Private or
+ * symmetric members anywhere in the set fail decoding.
+ *
+ * @stability unstable
+ * @category schemas
+ * @since 4.1.1
+ */
+export declare const KeySet: Schema.Struct<{
+    readonly keys: Schema.$Array<Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
+        readonly d: Schema.optionalKey<Schema.Never>;
+        readonly p: Schema.optionalKey<Schema.Never>;
+        readonly q: Schema.optionalKey<Schema.Never>;
+        readonly dp: Schema.optionalKey<Schema.Never>;
+        readonly dq: Schema.optionalKey<Schema.Never>;
+        readonly qi: Schema.optionalKey<Schema.Never>;
+        readonly oth: Schema.optionalKey<Schema.Never>;
+        readonly k: Schema.optionalKey<Schema.Never>;
+        readonly kid: Schema.optionalKey<Schema.String>;
+        readonly alg: Schema.optionalKey<Schema.String>;
+        readonly use: Schema.optionalKey<Schema.String>;
+        readonly key_ops: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly kty: Schema.Literal<"RSA">;
+        readonly n: Schema.String;
+        readonly e: Schema.String;
+    }>, Schema.Struct<{
+        readonly d: Schema.optionalKey<Schema.Never>;
+        readonly p: Schema.optionalKey<Schema.Never>;
+        readonly q: Schema.optionalKey<Schema.Never>;
+        readonly dp: Schema.optionalKey<Schema.Never>;
+        readonly dq: Schema.optionalKey<Schema.Never>;
+        readonly qi: Schema.optionalKey<Schema.Never>;
+        readonly oth: Schema.optionalKey<Schema.Never>;
+        readonly k: Schema.optionalKey<Schema.Never>;
+        readonly kid: Schema.optionalKey<Schema.String>;
+        readonly alg: Schema.optionalKey<Schema.String>;
+        readonly use: Schema.optionalKey<Schema.String>;
+        readonly key_ops: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly kty: Schema.Literal<"EC">;
+        readonly crv: Schema.Literals<readonly ["P-256", "P-384", "P-521"]>;
+        readonly x: Schema.String;
+        readonly y: Schema.String;
+    }>, Schema.Struct<{
+        readonly d: Schema.optionalKey<Schema.Never>;
+        readonly p: Schema.optionalKey<Schema.Never>;
+        readonly q: Schema.optionalKey<Schema.Never>;
+        readonly dp: Schema.optionalKey<Schema.Never>;
+        readonly dq: Schema.optionalKey<Schema.Never>;
+        readonly qi: Schema.optionalKey<Schema.Never>;
+        readonly oth: Schema.optionalKey<Schema.Never>;
+        readonly k: Schema.optionalKey<Schema.Never>;
+        readonly kid: Schema.optionalKey<Schema.String>;
+        readonly alg: Schema.optionalKey<Schema.String>;
+        readonly use: Schema.optionalKey<Schema.String>;
+        readonly key_ops: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly kty: Schema.Literal<"OKP">;
+        readonly crv: Schema.Literal<"Ed25519">;
+        readonly x: Schema.String;
+    }>]>, Schema.StructWithRest<Schema.Struct<{
+        readonly d: Schema.optionalKey<Schema.Never>;
+        readonly p: Schema.optionalKey<Schema.Never>;
+        readonly q: Schema.optionalKey<Schema.Never>;
+        readonly dp: Schema.optionalKey<Schema.Never>;
+        readonly dq: Schema.optionalKey<Schema.Never>;
+        readonly qi: Schema.optionalKey<Schema.Never>;
+        readonly oth: Schema.optionalKey<Schema.Never>;
+        readonly k: Schema.optionalKey<Schema.Never>;
+        readonly kty: Schema.String;
+        readonly crv: Schema.optionalKey<Schema.String>;
+    }>, readonly [Schema.$Record<Schema.String, Schema.Unknown>]>]>>;
+}>;
+/**
+ * A set of public JWKs.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export type KeySet = typeof KeySet.Type;
+/**
+ * The algorithm, and optionally the key id, of the key to resolve.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface Selection {
+    readonly algorithm: AsymmetricAlgorithm;
+    readonly kid?: string | undefined;
+    /**
+     * The unauthenticated header when resolving a token's key. Use it only for
+     * key selection; it is authenticated only after verification succeeds.
+     */
+    readonly protectedHeader?: Jws.ProtectedHeader | undefined;
+}
+declare const Jwks_base: Context.ServiceClass<Jwks, "effect/jose/Jwks", {
+    readonly resolve: (selection: Selection) => Effect.Effect<PublicKey, JoseError.JoseError>;
+}>;
+/**
+ * Service that resolves the verification key for a selection.
+ *
+ * @stability unstable
+ * @category services
+ * @since 4.1.1
+ */
+export declare class Jwks extends Jwks_base {
+}
+/**
+ * Builds a `Jwks` service for a fixed key set.
+ *
+ * **Example** (Resolving a key by `kid`)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer } from "effect"
+ * import { SecureRandom, Signature } from "effect/crypto"
+ * import { Jwk, Jwks } from "effect/jose"
+ *
+ * const layer = Signature.layerWebCrypto.pipe(Layer.provide(SecureRandom.layerWebCrypto))
+ *
+ * const kid = await Effect.runPromise(Effect.gen(function*() {
+ *   const pair = yield* Jwk.generateKeyPair({ algorithm: "ES256", kid: "signing-1" })
+ *   const jwks = yield* Jwks.makeLocal({ keys: [pair.publicKey] })
+ *   const key = yield* jwks.resolve({ algorithm: "ES256", kid: "signing-1" })
+ *   return key.kid
+ * }).pipe(Effect.provide(layer)))
+ * kid // => "signing-1"
+ * ```
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.1.1
+ */
+export declare const makeLocal: (keySet: KeySet) => Effect.Effect<Jwks["Service"]>;
+/**
+ * Layer that provides `Jwks` for a fixed key set.
+ *
+ * @stability unstable
+ * @category layers
+ * @since 4.1.1
+ */
+export declare const layerLocal: (keySet: KeySet) => Layer.Layer<Jwks>;
+/**
+ * Options for {@link makeRemote} and {@link layerRemote}.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface RemoteOptions {
+    /**
+     * The HTTPS key-set URL, without credentials or a fragment. Take it from
+     * configuration, never from a token.
+     */
+    readonly url: string;
+    /**
+     * How long a fetched key set is used. Defaults to 10 minutes.
+     */
+    readonly timeToLive?: Duration.Input | undefined;
+    /**
+     * Minimum time before retrying after a failed fetch, or refetching for an
+     * unknown key. Defaults to 30 seconds.
+     */
+    readonly cooldown?: Duration.Input | undefined;
+    /**
+     * Timeout for the request and reading its body. Defaults to 5 seconds.
+     */
+    readonly timeout?: Duration.Input | undefined;
+    /**
+     * Maximum response body size. Defaults to 131072 bytes.
+     */
+    readonly maxResponseBytes?: number | undefined;
+    /**
+     * Maximum number of keys in the set. Defaults to 64.
+     */
+    readonly maxKeys?: number | undefined;
+}
+/**
+ * Builds a `Jwks` service for a remote key set, using the `HttpClient`
+ * service. Use it when the URL is only known at runtime, for example from
+ * OpenID Connect discovery.
+ *
+ * **Details**
+ *
+ * The key set is fetched on first use and reused until `timeToLive` passes.
+ * Concurrent callers share one request. A selection that finds no key fetches
+ * the set again, at most once per `cooldown`, so rotated keys are picked up
+ * without letting unknown `kid`s drive a request per token. A failed fetch
+ * fails every caller until `cooldown` passes; there is no fallback to an
+ * expired set.
+ *
+ * Only a 200 response from the configured URL is accepted, so a redirected
+ * key set is rejected. The check runs on the response, so it cannot stop a
+ * client from sending the redirected request.
+ *
+ * **Gotchas**
+ *
+ * Supply a client that does not follow redirects. `FetchHttpClient` follows
+ * them by default: provide `FetchHttpClient.RequestInit` with
+ * `{ redirect: "manual" }` on its layer so a redirect fails before any further
+ * request. Clients wrapped with `HttpClient.followRedirects` also follow them.
+ *
+ * Closing the scope interrupts any request in flight, and later resolutions
+ * fail with `KeySetUnavailable`.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.1.1
+ */
+export declare const makeRemote: (options: RemoteOptions) => Effect.Effect<{
+    readonly resolve: (selection: Selection) => Effect.Effect<PublicKey, JoseError.JoseError>;
+}, JoseError.JoseError, HttpClient.HttpClient | Scope.Scope>;
+/**
+ * Layer that provides `Jwks` from a remote key set built by {@link makeRemote}.
+ * Closing the layer interrupts any request in flight.
+ *
+ * @stability unstable
+ * @category layers
+ * @since 4.1.1
+ */
+export declare const layerRemote: (options: RemoteOptions) => Layer.Layer<Jwks, JoseError.JoseError, HttpClient.HttpClient>;
+export {};
+//# sourceMappingURL=Jwks.d.ts.map

package/dist/jose/Jwks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwks.d.ts","sourceRoot":"","sources":["../../src/jose/Jwks.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAExC,OAAO,KAAK,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AAEtC,OAAO,KAAK,UAAU,MAAM,uBAAuB,CAAA;AACnD,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AACpC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAGzC,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,KAAK,mBAAmB,EAA2B,KAAK,SAAS,EAAE,MAAM,UAAU,CAAA;AAC5F,OAAO,KAAK,KAAK,GAAG,MAAM,UAAU,CAAA;AAkBpC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjB,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAA;AAEvC;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,eAAe,GAAG,SAAS,CAAA;CAC3D;;sBAUmB,CAAC,SAAS,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC;;AAR3F;;;;;;GAMG;AACH,qBAAa,IAAK,SAAQ,SAEF;CAAG;AAsD3B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAOpE,CAAA;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,WAAY,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAA0C,CAAA;AAEtG;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IAChD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IAC9C;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IAC7C;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9C;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,UAAU;sBArMH,CAAC,SAAS,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC;4DAmTzF,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,YACb,aAAa,KACrB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAA4C,CAAA"}

package/dist/jose/Jwks.js

@@ -0,0 +1,306 @@
+/**
+ * JSON Web Key Sets and the `Jwks` service that resolves verification keys
+ * from them.
+ *
+ * A key is selected by algorithm and optional `kid`. It must fit the
+ * algorithm's key family and curve, and its `alg`, `use`, and `key_ops`
+ * members must allow verification with that algorithm. No match fails with
+ * `KeyNotFound` and several matches with `AmbiguousKey`.
+ *
+ * {@link layerLocal} serves a fixed key set. {@link makeRemote} and
+ * {@link layerRemote} fetch one from an HTTPS endpoint and cache it.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+import * as Cause from "../Cause.js";
+import * as Clock from "../Clock.js";
+import * as Context from "../Context.js";
+import * as Deferred from "../Deferred.js";
+import * as Effect from "../Effect.js";
+import * as Exit from "../Exit.js";
+import * as HttpClient from "../http/HttpClient.js";
+import * as Layer from "../Layer.js";
+import * as Schema from "../Schema.js";
+import * as Stream from "../Stream.js";
+import { fail, invalidArgument, millis, noPrivateMembers, parseJsonObject } from "./internal/compact.js";
+import * as JoseError from "./JoseError.js";
+import { importPublic, PublicJwk } from "./Jwk.js";
+// Any other key family or curve, with any other members. Private and
+// symmetric members, including RSA factors, are still rejected.
+const UnsupportedJwk = /*#__PURE__*/Schema.StructWithRest(Schema.Struct({
+  kty: Schema.String,
+  crv: Schema.optionalKey(Schema.String),
+  ...noPrivateMembers
+}), [Schema.Record(Schema.String, Schema.Unknown)]).check(/*#__PURE__*/Schema.makeFilter(jwk => jwk.kty !== "oct" && jwk.kty !== "RSA" && (jwk.kty !== "EC" || jwk.crv !== undefined && jwk.crv !== "P-256" && jwk.crv !== "P-384" && jwk.crv !== "P-521") && (jwk.kty !== "OKP" || jwk.crv !== undefined && jwk.crv !== "Ed25519")));
+/**
+ * Schema for a set of public JWKs.
+ *
+ * **Details**
+ *
+ * Keys of other families or curves are kept but never selected. Private or
+ * symmetric members anywhere in the set fail decoding.
+ *
+ * @stability unstable
+ * @category schemas
+ * @since 4.1.1
+ */
+export const KeySet = /*#__PURE__*/Schema.Struct({
+  keys: /*#__PURE__*/Schema.Array(/*#__PURE__*/Schema.Union([PublicJwk, UnsupportedJwk]))
+});
+/**
+ * Service that resolves the verification key for a selection.
+ *
+ * @stability unstable
+ * @category services
+ * @since 4.1.1
+ */
+export class Jwks extends /*#__PURE__*/Context.Service()("effect/jose/Jwks") {}
+const isPublicJwk = /*#__PURE__*/Schema.is(PublicJwk);
+const keyTypes = {
+  RS256: {
+    kty: "RSA"
+  },
+  RS384: {
+    kty: "RSA"
+  },
+  RS512: {
+    kty: "RSA"
+  },
+  PS256: {
+    kty: "RSA"
+  },
+  PS384: {
+    kty: "RSA"
+  },
+  PS512: {
+    kty: "RSA"
+  },
+  ES256: {
+    kty: "EC",
+    crv: "P-256"
+  },
+  ES384: {
+    kty: "EC",
+    crv: "P-384"
+  },
+  ES512: {
+    kty: "EC",
+    crv: "P-521"
+  },
+  EdDSA: {
+    kty: "OKP",
+    crv: "Ed25519"
+  }
+};
+// The keys that can ever be selected, computed once per key set rather than
+// on every lookup.
+const supportedKeys = keySet => keySet.keys.filter(isPublicJwk);
+const candidates = (keys, selection) => {
+  const {
+    crv,
+    kty
+  } = keyTypes[selection.algorithm];
+  return keys.filter(key => key.kty === kty && ("crv" in key ? key.crv : undefined) === crv && (selection.kid === undefined || key.kid === selection.kid) && (key.alg === undefined || key.alg === selection.algorithm) && (key.use === undefined || key.use === "sig") && (key.key_ops === undefined || key.key_ops.includes("verify")));
+};
+// Imports each JWK once per algorithm. Keyed weakly so replaced key sets can be collected.
+const makeImporter = () => {
+  const imported = new WeakMap();
+  return (found, algorithm) => {
+    if (found.length === 0) return fail(new JoseError.KeyNotFound());
+    if (found.length > 1) return fail(new JoseError.AmbiguousKey());
+    const jwk = found[0];
+    const cached = imported.get(jwk)?.get(algorithm);
+    if (cached !== undefined) return Effect.succeed(cached);
+    return Effect.tap(importPublic(jwk, algorithm), key => Effect.sync(() => {
+      let byAlgorithm = imported.get(jwk);
+      if (byAlgorithm === undefined) imported.set(jwk, byAlgorithm = new Map());
+      byAlgorithm.set(algorithm, key);
+    }));
+  };
+};
+/**
+ * Builds a `Jwks` service for a fixed key set.
+ *
+ * **Example** (Resolving a key by `kid`)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer } from "effect"
+ * import { SecureRandom, Signature } from "effect/crypto"
+ * import { Jwk, Jwks } from "effect/jose"
+ *
+ * const layer = Signature.layerWebCrypto.pipe(Layer.provide(SecureRandom.layerWebCrypto))
+ *
+ * const kid = await Effect.runPromise(Effect.gen(function*() {
+ *   const pair = yield* Jwk.generateKeyPair({ algorithm: "ES256", kid: "signing-1" })
+ *   const jwks = yield* Jwks.makeLocal({ keys: [pair.publicKey] })
+ *   const key = yield* jwks.resolve({ algorithm: "ES256", kid: "signing-1" })
+ *   return key.kid
+ * }).pipe(Effect.provide(layer)))
+ * kid // => "signing-1"
+ * ```
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.1.1
+ */
+export const makeLocal = keySet => Effect.sync(() => {
+  const keys = supportedKeys(keySet);
+  const importKey = makeImporter();
+  return Jwks.of({
+    resolve: selection => importKey(candidates(keys, selection), selection.algorithm)
+  });
+});
+/**
+ * Layer that provides `Jwks` for a fixed key set.
+ *
+ * @stability unstable
+ * @category layers
+ * @since 4.1.1
+ */
+export const layerLocal = keySet => Layer.effect(Jwks, makeLocal(keySet));
+const unavailable = (description, cause) => new JoseError.JoseError({
+  reason: new JoseError.KeySetUnavailable({
+    description,
+    cause
+  })
+});
+const positiveInteger = (name, value) => Number.isSafeInteger(value) && value > 0 ? Effect.succeed(value) : invalidArgument(`${name} must be a positive integer`);
+const positiveMillis = (name, input) => Effect.flatMap(millis(name, input), value => value > 0 ? Effect.succeed(value) : invalidArgument(`${name} must be positive`));
+const readUrl = input => {
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    url = undefined;
+  }
+  return url !== undefined && url.protocol === "https:" && url.username === "" && url.password === "" && url.hash === "" ? Effect.succeed(url) : invalidArgument("url must be an HTTPS URL without credentials or a fragment");
+};
+/**
+ * Builds a `Jwks` service for a remote key set, using the `HttpClient`
+ * service. Use it when the URL is only known at runtime, for example from
+ * OpenID Connect discovery.
+ *
+ * **Details**
+ *
+ * The key set is fetched on first use and reused until `timeToLive` passes.
+ * Concurrent callers share one request. A selection that finds no key fetches
+ * the set again, at most once per `cooldown`, so rotated keys are picked up
+ * without letting unknown `kid`s drive a request per token. A failed fetch
+ * fails every caller until `cooldown` passes; there is no fallback to an
+ * expired set.
+ *
+ * Only a 200 response from the configured URL is accepted, so a redirected
+ * key set is rejected. The check runs on the response, so it cannot stop a
+ * client from sending the redirected request.
+ *
+ * **Gotchas**
+ *
+ * Supply a client that does not follow redirects. `FetchHttpClient` follows
+ * them by default: provide `FetchHttpClient.RequestInit` with
+ * `{ redirect: "manual" }` on its layer so a redirect fails before any further
+ * request. Clients wrapped with `HttpClient.followRedirects` also follow them.
+ *
+ * Closing the scope interrupts any request in flight, and later resolutions
+ * fail with `KeySetUnavailable`.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.1.1
+ */
+export const makeRemote = /*#__PURE__*/Effect.fnUntraced(function* (options) {
+  const url = yield* readUrl(options.url);
+  const timeToLive = yield* positiveMillis("timeToLive", options.timeToLive ?? "10 minutes");
+  const cooldown = yield* millis("cooldown", options.cooldown ?? "30 seconds");
+  const timeout = yield* positiveMillis("timeout", options.timeout ?? "5 seconds");
+  const maxResponseBytes = yield* positiveInteger("maxResponseBytes", options.maxResponseBytes ?? 131072);
+  const maxKeys = yield* positiveInteger("maxKeys", options.maxKeys ?? 64);
+  const client = HttpClient.withScope(yield* HttpClient.HttpClient);
+  const scope = yield* Effect.scope;
+  const importKey = makeImporter();
+  let cache;
+  let pending;
+  let lastAttempt = -Infinity;
+  let lastFailed = false;
+  let closed = false;
+  const closedExit = Exit.fail(unavailable("The key set scope is closed"));
+  yield* Effect.addFinalizer(() => Effect.sync(() => {
+    closed = true;
+    if (pending !== undefined) Deferred.doneUnsafe(pending, closedExit);
+  }));
+  const fetch = Effect.gen(function* () {
+    const response = yield* client.get(url.href, {
+      headers: {
+        accept: "application/json"
+      }
+    });
+    if (response.status !== 200) {
+      return yield* unavailable(`The key set endpoint responded with status ${response.status}`);
+    }
+    if (response.url !== url.href) {
+      return yield* unavailable("The key set response came from another URL");
+    }
+    const body = new Uint8Array(maxResponseBytes);
+    const length = yield* Stream.runFoldEffect(response.stream, () => 0, (length, chunk) => {
+      if (chunk.length > body.length - length) {
+        return Effect.fail(unavailable(`The key set response exceeds ${maxResponseBytes} bytes`));
+      }
+      body.set(chunk, length);
+      return Effect.succeed(length + chunk.length);
+    });
+    const keySet = yield* Schema.decodeUnknownEffect(KeySet)(parseJsonObject(body.subarray(0, length))).pipe(Effect.mapError(cause => unavailable("The key set document is invalid", cause)));
+    if (keySet.keys.length > maxKeys) {
+      return yield* unavailable(`The key set has more than ${maxKeys} keys`);
+    }
+    return {
+      keys: supportedKeys(keySet),
+      expiresAt: (yield* Clock.currentTimeMillis) + timeToLive
+    };
+  }).pipe(Effect.scoped, Effect.catchTag("HttpClientError", cause => Effect.fail(unavailable("The key set request failed", cause))), Effect.timeoutOrElse({
+    duration: timeout,
+    orElse: () => Effect.fail(unavailable("The key set request timed out"))
+  }));
+  // Returns `undefined` while cooling down, which applies only to unknown-key
+  // refetches (`stale` lacked the key) and retries after a failure.
+  const refresh = (now, stale) => Effect.uninterruptibleMask(restore => Effect.suspend(() => {
+    if (closed) return closedExit;
+    if (cache !== undefined && cache !== stale && cache.expiresAt > now) return Effect.succeed(cache);
+    if (pending !== undefined) return restore(Deferred.await(pending));
+    if ((stale !== undefined || lastFailed) && now - lastAttempt < cooldown) return Effect.succeed(undefined);
+    lastAttempt = now;
+    const result = pending = Deferred.makeUnsafe();
+    return fetch.pipe(Effect.onExit(exit => Effect.sync(() => {
+      pending = undefined;
+      lastFailed = Exit.isFailure(exit);
+      if (Exit.isSuccess(exit)) cache = exit.value;
+      Deferred.doneUnsafe(result, Exit.isFailure(exit) && Cause.hasInterruptsOnly(exit.cause) ? closedExit : exit);
+    })), Effect.forkIn(scope, {
+      uninterruptible: false
+    }), Effect.andThen(restore(Deferred.await(result))));
+  }));
+  const resolve = selection => Effect.flatMap(Clock.currentTimeMillis, now => {
+    if (closed) return closedExit;
+    const lookup = snapshot => importKey(candidates(snapshot.keys, selection), selection.algorithm);
+    const current = cache;
+    if (current !== undefined && current.expiresAt > now) {
+      const found = candidates(current.keys, selection);
+      if (found.length > 0) return importKey(found, selection.algorithm);
+      // An unknown key may have been rotated in. Refetch, unless cooling down.
+      return Effect.flatMap(refresh(now, current), snapshot => snapshot === undefined ? fail(new JoseError.KeyNotFound()) : lookup(snapshot));
+    }
+    return Effect.flatMap(refresh(now), snapshot => snapshot === undefined ? Effect.fail(unavailable("The key set is cooling down after a failed fetch")) : lookup(snapshot));
+  });
+  return Jwks.of({
+    resolve
+  });
+});
+/**
+ * Layer that provides `Jwks` from a remote key set built by {@link makeRemote}.
+ * Closing the layer interrupts any request in flight.
+ *
+ * @stability unstable
+ * @category layers
+ * @since 4.1.1
+ */
+export const layerRemote = options => Layer.effect(Jwks, makeRemote(options));
+//# sourceMappingURL=Jwks.js.map

package/dist/jose/Jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwks.js","names":[],"sources":["../../src/jose/Jwks.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;AAeA,OAAO,KAAK,KAAK,MAAM,aAAa;AACpC,OAAO,KAAK,KAAK,MAAM,aAAa;AACpC,OAAO,KAAK,OAAO,MAAM,eAAe;AACxC,OAAO,KAAK,QAAQ,MAAM,gBAAgB;AAE1C,OAAO,KAAK,MAAM,MAAM,cAAc;AACtC,OAAO,KAAK,IAAI,MAAM,YAAY;AAClC,OAAO,KAAK,UAAU,MAAM,uBAAuB;AACnD,OAAO,KAAK,KAAK,MAAM,aAAa;AACpC,OAAO,KAAK,MAAM,MAAM,cAAc;AAEtC,OAAO,KAAK,MAAM,MAAM,cAAc;AACtC,SAAS,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,eAAe,QAAQ,uBAAuB;AACxG,OAAO,KAAK,SAAS,MAAM,gBAAgB;AAC3C,SAAmC,YAAY,EAAE,SAAS,QAAwB,UAAU;AAG5F;AACA;AACA,MAAM,cAAc,gBAAG,MAAM,CAAC,cAAc,CAC1C,MAAM,CAAC,MAAM,CAAC;EACZ,GAAG,EAAE,MAAM,CAAC,MAAM;EAClB,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG;CACJ,CAAC,EACF,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAC/C,CAAC,KAAK,cAAC,MAAM,CAAC,UAAU,CAAE,GAAG,IAC5B,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,KACrC,GAAG,CAAC,GAAG,KAAK,IAAI,IACd,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,GAAG,KAAK,OAAQ,CAAC,KAC9F,GAAG,CAAC,GAAG,KAAK,KAAK,IAAK,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,SAAU,CAAC,CACxE,CAAC;AAEF;;;;;;;;;;;;AAYA,OAAO,MAAM,MAAM,gBAAG,MAAM,CAAC,MAAM,CAAC;EAClC,IAAI,eAAE,MAAM,CAAC,KAAK,cAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;CAC7D,CAAC;AA4BF;;;;;;;AAOA,OAAM,MAAO,IAAK,sBAAQ,OAAO,CAAC,OAAO,EAErC,CAAC,kBAAkB,CAAC;AAExB,MAAM,WAAW,gBAAG,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC;AAExC,MAAM,QAAQ,GAAiF;EAC7F,KAAK,EAAE;IAAE,GAAG,EAAE;EAAK,CAAE;EACrB,KAAK,EAAE;IAAE,GAAG,EAAE;EAAK,CAAE;EACrB,KAAK,EAAE;IAAE,GAAG,EAAE;EAAK,CAAE;EACrB,KAAK,EAAE;IAAE,GAAG,EAAE;EAAK,CAAE;EACrB,KAAK,EAAE;IAAE,GAAG,EAAE;EAAK,CAAE;EACrB,KAAK,EAAE;IAAE,GAAG,EAAE;EAAK,CAAE;EACrB,KAAK,EAAE;IAAE,GAAG,EAAE,IAAI;IAAE,GAAG,EAAE;EAAO,CAAE;EAClC,KAAK,EAAE;IAAE,GAAG,EAAE,IAAI;IAAE,GAAG,EAAE;EAAO,CAAE;EAClC,KAAK,EAAE;IAAE,GAAG,EAAE,IAAI;IAAE,GAAG,EAAE;EAAO,CAAE;EAClC,KAAK,EAAE;IAAE,GAAG,EAAE,KAAK;IAAE,GAAG,EAAE;EAAS;CACpC;AAED;AACA;AACA,MAAM,aAAa,GAAI,MAAc,IAA+B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;AAEnG,MAAM,UAAU,GAAG,CAAC,IAA8B,EAAE,SAAoB,KAA8B;EACpG,MAAM;IAAE,GAAG;IAAE;EAAG,CAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;EAClD,OAAO,IAAI,CAAC,MAAM,CAAE,GAAG,IACrB,GAAG,CAAC,GAAG,KAAK,GAAG,IACf,CAAC,KAAK,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,SAAS,MAAM,GAAG,KAC3C,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,CAAC,KACzD,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,SAAS,CAAC,KACzD,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,KAC3C,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAC9D;AACH,CAAC;AAED;AACA,MAAM,YAAY,GAAG,MAAK;EACxB,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAkD;EAC9E,OAAO,CACL,KAA+B,EAC/B,SAA8B,KACmB;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IACvD,OAAO,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,EAAG,GAAG,IAClD,MAAM,CAAC,IAAI,CAAC,MAAK;MACf,IAAI,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;MACnC,IAAI,WAAW,KAAK,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;MACzE,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;IACjC,CAAC,CAAC,CAAC;EACP,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,OAAO,MAAM,SAAS,GAAI,MAAc,IACtC,MAAM,CAAC,IAAI,CAAC,MAAK;EACf,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC;EAClC,MAAM,SAAS,GAAG,YAAY,EAAE;EAChC,OAAO,IAAI,CAAC,EAAE,CAAC;IACb,OAAO,EAAG,SAAS,IAAK,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,SAAS;GACnF,CAAC;AACJ,CAAC,CAAC;AAEJ;;;;;;;AAOA,OAAO,MAAM,UAAU,GAAI,MAAc,IAAwB,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;AA2CtG,MAAM,WAAW,GAAG,CAAC,WAAmB,EAAE,KAAe,KACvD,IAAI,SAAS,CAAC,SAAS,CAAC;EAAE,MAAM,EAAE,IAAI,SAAS,CAAC,iBAAiB,CAAC;IAAE,WAAW;IAAE;EAAK,CAAE;AAAC,CAAE,CAAC;AAE9F,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,KAAa,KAClD,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,GACpC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GACrB,eAAe,CAAC,GAAG,IAAI,6BAA6B,CAAC;AAE3D,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,KAAqB,KACzD,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,EAClB,KAAK,IAAK,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAC3F;AAEH,MAAM,OAAO,GAAI,KAAa,IAAI;EAChC,IAAI,GAAoB;EACxB,IAAI;IACF,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC;EACtB,CAAC,CAAC,MAAM;IACN,GAAG,GAAG,SAAS;EACjB;EACA,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,GAClH,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GACnB,eAAe,CAAC,4DAA4D,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,OAAO,MAAM,UAAU,gBAAG,MAAM,CAAC,UAAU,CAAC,WAC1C,OAAsB;EAEtB,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;EACvC,MAAM,UAAU,GAAG,OAAO,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;EAC1F,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC;EAC5E,MAAM,OAAO,GAAG,OAAO,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC;EAChF,MAAM,gBAAgB,GAAG,OAAO,eAAe,CAAC,kBAAkB,EAAE,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;EACvG,MAAM,OAAO,GAAG,OAAO,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;EAExE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,UAAU,CAAC,UAAU,CAAC;EACjE,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,KAAK;EACjC,MAAM,SAAS,GAAG,YAAY,EAAE;EAEhC,IAAI,KAA2B;EAC/B,IAAI,OAAqE;EACzE,IAAI,WAAW,GAAG,CAAC,QAAQ;EAC3B,IAAI,UAAU,GAAG,KAAK;EACtB,IAAI,MAAM,GAAG,KAAK;EAElB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;EACxE,OAAO,MAAM,CAAC,YAAY,CAAC,MACzB,MAAM,CAAC,IAAI,CAAC,MAAK;IACf,MAAM,GAAG,IAAI;IACb,IAAI,OAAO,KAAK,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC;EACrE,CAAC,CAAC,CACH;EAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,aAAS;IAChC,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;MAAE,OAAO,EAAE;QAAE,MAAM,EAAE;MAAkB;IAAE,CAAE,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;MAC3B,OAAO,OAAO,WAAW,CAAC,8CAA8C,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5F;IACA,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,EAAE;MAC7B,OAAO,OAAO,WAAW,CAAC,4CAA4C,CAAC;IACzE;IACA,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,KAAI;MACrF,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE;QACvC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,gCAAgC,gBAAgB,QAAQ,CAAC,CAAC;MAC3F;MACA,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;MACvB,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9C,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CACtG,MAAM,CAAC,QAAQ,CAAE,KAAK,IAAK,WAAW,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC,CAClF;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE;MAChC,OAAO,OAAO,WAAW,CAAC,6BAA6B,OAAO,OAAO,CAAC;IACxE;IACA,OAAO;MAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC;MAAE,SAAS,EAAE,CAAC,OAAO,KAAK,CAAC,iBAAiB,IAAI;IAAU,CAAE;EAClG,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAG,KAAK,IAAK,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC,CAAC,EAC5G,MAAM,CAAC,aAAa,CAAC;IACnB,QAAQ,EAAE,OAAO;IACjB,MAAM,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,+BAA+B,CAAC;GACvE,CAAC,CACH;EAED;EACA;EACA,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,KAAgB,KAC5C,MAAM,CAAC,mBAAmB,CAAE,OAAO,IACjC,MAAM,CAAC,OAAO,CAAC,MAA+D;IAC5E,IAAI,MAAM,EAAE,OAAO,UAAU;IAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;IACjG,IAAI,OAAO,KAAK,SAAS,EAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,GAAG,GAAG,WAAW,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IACzG,WAAW,GAAG,GAAG;IACjB,MAAM,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC,UAAU,EAAiC;IAC7E,OAAO,KAAK,CAAC,IAAI,CACf,MAAM,CAAC,MAAM,CAAE,IAAI,IACjB,MAAM,CAAC,IAAI,CAAC,MAAK;MACf,OAAO,GAAG,SAAS;MACnB,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;MACjC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK;MAC5C,QAAQ,CAAC,UAAU,CACjB,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,UAAU,GAAG,IAAI,CAChF;IACH,CAAC,CAAC,CACH,EACD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;MAAE,eAAe,EAAE;IAAK,CAAE,CAAC,EAChD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAChD;EACH,CAAC,CAAC,CACH;EAEH,MAAM,OAAO,GAAI,SAAoB,IACnC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAG,GAAG,IAAmD;IAC7F,IAAI,MAAM,EAAE,OAAO,UAAU;IAC7B,MAAM,MAAM,GAAI,QAAkB,IAAK,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC;IAC3G,MAAM,OAAO,GAAG,KAAK;IACrB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE;MACpD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;MACjD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC;MAClE;MACA,OAAO,MAAM,CAAC,OAAO,CACnB,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EACpB,QAAQ,IAAK,QAAQ,KAAK,SAAS,GAAG,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAC5F;IACH;IACA,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAG,QAAQ,IAC3C,QAAQ,KAAK,SAAS,GAClB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,kDAAkD,CAAC,CAAC,GAC5E,MAAM,CAAC,QAAQ,CAAC,CAAC;EACzB,CAAC,CAAC;EAEJ,OAAO,IAAI,CAAC,EAAE,CAAC;IAAE;EAAO,CAAE,CAAC;AAC7B,CAAC,CAAC;AAEF;;;;;;;;AAQA,OAAO,MAAM,WAAW,GACtB,OAAsB,IAC4C,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC","ignoreList":[]}