ubid-common 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +20 -0
- package/dist/ParsingEngine.d.ts +3 -0
- package/dist/ParsingEngine.d.ts.map +1 -0
- package/dist/ParsingEngine.js +25 -0
- package/dist/PublicKeyResolverEngine.d.ts +3 -0
- package/dist/PublicKeyResolverEngine.d.ts.map +1 -0
- package/dist/PublicKeyResolverEngine.js +24 -0
- package/dist/VerifyingEngine.d.ts +3 -0
- package/dist/VerifyingEngine.d.ts.map +1 -0
- package/dist/VerifyingEngine.js +27 -0
- package/dist/credential-parsers/MsoMdocParser.d.ts +6 -0
- package/dist/credential-parsers/MsoMdocParser.d.ts.map +1 -0
- package/dist/credential-parsers/MsoMdocParser.js +164 -0
- package/dist/credential-parsers/SDJWTVCParser.d.ts +6 -0
- package/dist/credential-parsers/SDJWTVCParser.d.ts.map +1 -0
- package/dist/credential-parsers/SDJWTVCParser.js +214 -0
- package/dist/credential-verifiers/MsoMdocVerifier.d.ts +8 -0
- package/dist/credential-verifiers/MsoMdocVerifier.d.ts.map +1 -0
- package/dist/credential-verifiers/MsoMdocVerifier.js +213 -0
- package/dist/credential-verifiers/SDJWTVCValidation.d.ts +52 -0
- package/dist/credential-verifiers/SDJWTVCValidation.d.ts.map +1 -0
- package/dist/credential-verifiers/SDJWTVCValidation.js +248 -0
- package/dist/credential-verifiers/SDJWTVCVerifier.d.ts +15 -0
- package/dist/credential-verifiers/SDJWTVCVerifier.d.ts.map +1 -0
- package/dist/credential-verifiers/SDJWTVCVerifier.js +394 -0
- package/dist/defaultHttpClient.d.ts +3 -0
- package/dist/defaultHttpClient.d.ts.map +1 -0
- package/dist/defaultHttpClient.js +18 -0
- package/dist/error.d.ts +134 -0
- package/dist/error.d.ts.map +1 -0
- package/dist/error.js +160 -0
- package/dist/functions/convertDataUriToImage.d.ts +2 -0
- package/dist/functions/convertDataUriToImage.d.ts.map +1 -0
- package/dist/functions/convertDataUriToImage.js +38 -0
- package/dist/functions/convertOpenid4vciToSdjwtvcClaims.d.ts +5 -0
- package/dist/functions/convertOpenid4vciToSdjwtvcClaims.d.ts.map +1 -0
- package/dist/functions/convertOpenid4vciToSdjwtvcClaims.js +31 -0
- package/dist/functions/convertSdjwtvcToOpenid4vciClaims.d.ts +11 -0
- package/dist/functions/convertSdjwtvcToOpenid4vciClaims.d.ts.map +1 -0
- package/dist/functions/convertSdjwtvcToOpenid4vciClaims.js +35 -0
- package/dist/functions/convertSdjwtvcToOpenid4vciDisplay.d.ts +19 -0
- package/dist/functions/convertSdjwtvcToOpenid4vciDisplay.d.ts.map +1 -0
- package/dist/functions/convertSdjwtvcToOpenid4vciDisplay.js +56 -0
- package/dist/functions/formatDate.d.ts +2 -0
- package/dist/functions/formatDate.d.ts.map +1 -0
- package/dist/functions/formatDate.js +50 -0
- package/dist/functions/index.d.ts +3 -0
- package/dist/functions/index.d.ts.map +1 -0
- package/dist/functions/index.js +19 -0
- package/dist/functions/openID4VCICredentialRendering.d.ts +5 -0
- package/dist/functions/openID4VCICredentialRendering.d.ts.map +1 -0
- package/dist/functions/openID4VCICredentialRendering.js +93 -0
- package/dist/index.d.ts +19 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +35 -0
- package/dist/interfaces.d.ts +112 -0
- package/dist/interfaces.d.ts.map +1 -0
- package/dist/interfaces.js +3 -0
- package/dist/rendering.d.ts +3 -0
- package/dist/rendering.d.ts.map +1 -0
- package/dist/rendering.js +56 -0
- package/dist/resolvers/RemoteJwksResolver.d.ts +17 -0
- package/dist/resolvers/RemoteJwksResolver.d.ts.map +1 -0
- package/dist/resolvers/RemoteJwksResolver.js +138 -0
- package/dist/schemas/CredentialConfigurationSupportedSchema.d.ts +710 -0
- package/dist/schemas/CredentialConfigurationSupportedSchema.d.ts.map +1 -0
- package/dist/schemas/CredentialConfigurationSupportedSchema.js +60 -0
- package/dist/schemas/CredentialOfferSchema.d.ts +40 -0
- package/dist/schemas/CredentialOfferSchema.d.ts.map +1 -0
- package/dist/schemas/CredentialOfferSchema.js +14 -0
- package/dist/schemas/OpenidAuthorizationServerMetadataSchema.d.ts +49 -0
- package/dist/schemas/OpenidAuthorizationServerMetadataSchema.d.ts.map +1 -0
- package/dist/schemas/OpenidAuthorizationServerMetadataSchema.js +21 -0
- package/dist/schemas/OpenidCredentialIssuerMetadataSchema.d.ts +1030 -0
- package/dist/schemas/OpenidCredentialIssuerMetadataSchema.d.ts.map +1 -0
- package/dist/schemas/OpenidCredentialIssuerMetadataSchema.js +35 -0
- package/dist/schemas/SdJwtVcPayloadSchema.d.ts +79 -0
- package/dist/schemas/SdJwtVcPayloadSchema.d.ts.map +1 -0
- package/dist/schemas/SdJwtVcPayloadSchema.js +27 -0
- package/dist/schemas/SdJwtVcTypeMetadataSchema.d.ts +930 -0
- package/dist/schemas/SdJwtVcTypeMetadataSchema.d.ts.map +1 -0
- package/dist/schemas/SdJwtVcTypeMetadataSchema.js +105 -0
- package/dist/schemas/index.d.ts +6 -0
- package/dist/schemas/index.d.ts.map +1 -0
- package/dist/schemas/index.js +22 -0
- package/dist/status/TokenStatusListVerifier.d.ts +41 -0
- package/dist/status/TokenStatusListVerifier.d.ts.map +1 -0
- package/dist/status/TokenStatusListVerifier.js +410 -0
- package/dist/trust/AlgorithmPolicy.d.ts +27 -0
- package/dist/trust/AlgorithmPolicy.d.ts.map +1 -0
- package/dist/trust/AlgorithmPolicy.js +60 -0
- package/dist/trust/TrustRegistry.d.ts +49 -0
- package/dist/trust/TrustRegistry.d.ts.map +1 -0
- package/dist/trust/TrustRegistry.js +114 -0
- package/dist/types.d.ts +76 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +10 -0
- package/dist/utils/escapeSVG.d.ts +2 -0
- package/dist/utils/escapeSVG.d.ts.map +1 -0
- package/dist/utils/escapeSVG.js +18 -0
- package/dist/utils/getIssuerMetadata.d.ts +8 -0
- package/dist/utils/getIssuerMetadata.d.ts.map +1 -0
- package/dist/utils/getIssuerMetadata.js +33 -0
- package/dist/utils/getSdJwtVcMetadata.d.ts +12 -0
- package/dist/utils/getSdJwtVcMetadata.d.ts.map +1 -0
- package/dist/utils/getSdJwtVcMetadata.js +274 -0
- package/dist/utils/index.d.ts +2 -0
- package/dist/utils/index.d.ts.map +1 -0
- package/dist/utils/index.js +6 -0
- package/dist/utils/matchLocalizedDisplay.d.ts +6 -0
- package/dist/utils/matchLocalizedDisplay.d.ts.map +1 -0
- package/dist/utils/matchLocalizedDisplay.js +16 -0
- package/dist/utils/util.d.ts +6 -0
- package/dist/utils/util.d.ts.map +1 -0
- package/dist/utils/util.js +53 -0
- package/dist/utils/verifyCertificate.d.ts +2 -0
- package/dist/utils/verifyCertificate.d.ts.map +1 -0
- package/dist/utils/verifyCertificate.js +100 -0
- package/dist/utils/verifySRIFromObject.d.ts +10 -0
- package/dist/utils/verifySRIFromObject.d.ts.map +1 -0
- package/dist/utils/verifySRIFromObject.js +32 -0
- package/dist/utils/verifyX5C.d.ts +11 -0
- package/dist/utils/verifyX5C.d.ts.map +1 -0
- package/dist/utils/verifyX5C.js +19 -0
- package/dist/x509/X509ChainVerifier.d.ts +59 -0
- package/dist/x509/X509ChainVerifier.d.ts.map +1 -0
- package/dist/x509/X509ChainVerifier.js +458 -0
- package/package.json +82 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"SdJwtVcTypeMetadataSchema.d.ts","sourceRoot":"","sources":["../../src/schemas/SdJwtVcTypeMetadataSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+DAA+D;AAC/D,eAAO,MAAM,eAAe,aAAoB,CAAC;AAEjD,eAAO,MAAM,GAAG,aAAmB,CAAC;AAEpC,eAAO,MAAM,SAAS,aAAoB,CAAC;AAE3C,yEAAyE;AACzE,eAAO,MAAM,SAAS,6EAEV,CAAC;AAEb,kDAAkD;AAClD,eAAO,MAAM,KAAK,aAA+C,CAAC;AAElE,sDAAsD;AACtD,eAAO,MAAM,YAAY;;;;;;;;;;;;EAIvB,CAAC;AAEH,6DAA6D;AAC7D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ1B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;EAOjC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI3B,CAAC;AAoBH,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK3B,CAAC;AAEH,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAI5B,CAAC;AAEH,oDAAoD;AACpD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM7B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BtB,CAAC;AAEJ,2CAA2C;AAC3C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAChE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAClD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
|
|
@@ -0,0 +1,105 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.TypeMetadata = exports.ClaimMetadataEntry = exports.ClaimDisplayEntry = exports.TypeDisplayEntry = exports.SvgTemplateEntry = exports.SvgTemplateProperties = exports.RenderingSimple = exports.LogoMetadata = exports.SvgId = exports.ClaimPath = exports.LocaleTag = exports.Uri = exports.IntegrityString = void 0;
|
|
4
|
+
const zod_1 = require("zod");
|
|
5
|
+
/** Integrity string per W3C SRI, e.g., "sha256-<base64url>" */
|
|
6
|
+
exports.IntegrityString = zod_1.z.string().min(1);
|
|
7
|
+
exports.Uri = zod_1.z.string().url();
|
|
8
|
+
exports.LocaleTag = zod_1.z.string().min(1);
|
|
9
|
+
/** Claim path per §9.1: array of string | null | non-negative integer */
|
|
10
|
+
exports.ClaimPath = zod_1.z.array(zod_1.z.union([zod_1.z.string(), zod_1.z.null(), zod_1.z.number().int().nonnegative()])).nonempty();
|
|
11
|
+
/** svg_id: [A-Za-z_][A-Za-z0-9_]* per §8.1.2.2 */
|
|
12
|
+
exports.SvgId = zod_1.z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
|
|
13
|
+
/** ---------- §8.1.1 "simple" rendering ---------- */
|
|
14
|
+
exports.LogoMetadata = zod_1.z.object({
|
|
15
|
+
uri: exports.Uri, // REQUIRED
|
|
16
|
+
["uri#integrity"]: exports.IntegrityString.optional(),
|
|
17
|
+
alt_text: zod_1.z.string().optional(),
|
|
18
|
+
});
|
|
19
|
+
/** ---------- §8.1.2 "svg_templates" rendering ---------- */
|
|
20
|
+
exports.RenderingSimple = zod_1.z.object({
|
|
21
|
+
logo: exports.LogoMetadata.optional(),
|
|
22
|
+
background_image: zod_1.z.object({
|
|
23
|
+
uri: exports.Uri,
|
|
24
|
+
["uri#integrity"]: exports.IntegrityString.optional(),
|
|
25
|
+
}).optional(),
|
|
26
|
+
background_color: zod_1.z.string().optional(), // CSS color; keep as string
|
|
27
|
+
text_color: zod_1.z.string().optional(), // CSS color; keep as string
|
|
28
|
+
});
|
|
29
|
+
exports.SvgTemplateProperties = zod_1.z.object({
|
|
30
|
+
orientation: zod_1.z.enum(["portrait", "landscape"]).optional(),
|
|
31
|
+
color_scheme: zod_1.z.enum(["light", "dark"]).optional(),
|
|
32
|
+
contrast: zod_1.z.enum(["normal", "high"]).optional(),
|
|
33
|
+
}).refine((o) => o.orientation !== undefined || o.color_scheme !== undefined || o.contrast !== undefined, { message: "svg_template.properties must contain at least one of orientation, color_scheme, contrast" });
|
|
34
|
+
exports.SvgTemplateEntry = zod_1.z.object({
|
|
35
|
+
uri: exports.Uri, // REQUIRED
|
|
36
|
+
["uri#integrity"]: exports.IntegrityString.optional(),
|
|
37
|
+
properties: exports.SvgTemplateProperties.optional(), // REQUIRED if >1 template; enforced at array level
|
|
38
|
+
});
|
|
39
|
+
const Rendering = zod_1.z.object({
|
|
40
|
+
simple: exports.RenderingSimple.optional(),
|
|
41
|
+
svg_templates: zod_1.z.array(exports.SvgTemplateEntry).optional(), // optional here
|
|
42
|
+
}).superRefine((val, ctx) => {
|
|
43
|
+
const arr = val.svg_templates;
|
|
44
|
+
if (arr && arr.length > 1) {
|
|
45
|
+
arr.forEach((t, i) => {
|
|
46
|
+
if (!t.properties) {
|
|
47
|
+
ctx.addIssue({
|
|
48
|
+
code: zod_1.z.ZodIssueCode.custom,
|
|
49
|
+
message: `rendering.svg_templates[${i}].properties is required when more than one template is present`,
|
|
50
|
+
path: ["svg_templates", i, "properties"],
|
|
51
|
+
});
|
|
52
|
+
}
|
|
53
|
+
});
|
|
54
|
+
}
|
|
55
|
+
});
|
|
56
|
+
/** ---------- §8 Display metadata for the TYPE ---------- */
|
|
57
|
+
exports.TypeDisplayEntry = zod_1.z.object({
|
|
58
|
+
locale: exports.LocaleTag, // REQUIRED
|
|
59
|
+
name: zod_1.z.string().min(1), // REQUIRED
|
|
60
|
+
description: zod_1.z.string().optional(),
|
|
61
|
+
rendering: Rendering.optional(),
|
|
62
|
+
});
|
|
63
|
+
/** ---------- §9.2 Display metadata for CLAIMS ---------- */
|
|
64
|
+
exports.ClaimDisplayEntry = zod_1.z.object({
|
|
65
|
+
locale: exports.LocaleTag, // REQUIRED
|
|
66
|
+
label: zod_1.z.string().min(1), // REQUIRED
|
|
67
|
+
description: zod_1.z.string().optional(),
|
|
68
|
+
});
|
|
69
|
+
/** ---------- §9 Claim metadata entry ---------- */
|
|
70
|
+
exports.ClaimMetadataEntry = zod_1.z.object({
|
|
71
|
+
path: exports.ClaimPath, // REQUIRED
|
|
72
|
+
display: zod_1.z.array(exports.ClaimDisplayEntry).optional(), // §9.2
|
|
73
|
+
mandatory: zod_1.z.boolean().optional(), // §9.3 d12
|
|
74
|
+
sd: zod_1.z.enum(["always", "allowed", "never"]).optional(), // §9.3 (default "allowed")
|
|
75
|
+
svg_id: exports.SvgId.optional(), // §8.1.2.2
|
|
76
|
+
});
|
|
77
|
+
/** ---------- §6.2 Type Metadata Document ---------- */
|
|
78
|
+
exports.TypeMetadata = zod_1.z.object({
|
|
79
|
+
vct: zod_1.z.string(),
|
|
80
|
+
name: zod_1.z.string().optional(),
|
|
81
|
+
description: zod_1.z.string().optional(),
|
|
82
|
+
extends: zod_1.z.string().optional(),
|
|
83
|
+
["extends#integrity"]: exports.IntegrityString.optional(),
|
|
84
|
+
display: zod_1.z.array(exports.TypeDisplayEntry).optional(), // §8
|
|
85
|
+
claims: zod_1.z.array(exports.ClaimMetadataEntry).optional(), // §9
|
|
86
|
+
// §7 integrity for the vct reference when used
|
|
87
|
+
["vct#integrity"]: exports.IntegrityString.optional(),
|
|
88
|
+
})
|
|
89
|
+
.strip() // remove unknown fields but don't error
|
|
90
|
+
.superRefine((val, ctx) => {
|
|
91
|
+
const ids = new Set();
|
|
92
|
+
val.claims?.forEach((c, i) => {
|
|
93
|
+
if (c.svg_id) {
|
|
94
|
+
if (ids.has(c.svg_id)) {
|
|
95
|
+
ctx.addIssue({
|
|
96
|
+
code: zod_1.z.ZodIssueCode.custom,
|
|
97
|
+
message: `svg_id "${c.svg_id}" must be unique within the type metadata`,
|
|
98
|
+
path: ["claims", i, "svg_id"],
|
|
99
|
+
});
|
|
100
|
+
}
|
|
101
|
+
ids.add(c.svg_id);
|
|
102
|
+
}
|
|
103
|
+
});
|
|
104
|
+
});
|
|
105
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2RKd3RWY1R5cGVNZXRhZGF0YVNjaGVtYS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zY2hlbWFzL1NkSnd0VmNUeXBlTWV0YWRhdGFTY2hlbWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsNkJBQXdCO0FBRXhCLCtEQUErRDtBQUNsRCxRQUFBLGVBQWUsR0FBRyxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRXBDLFFBQUEsR0FBRyxHQUFHLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLEVBQUUsQ0FBQztBQUV2QixRQUFBLFNBQVMsR0FBRyxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRTNDLHlFQUF5RTtBQUM1RCxRQUFBLFNBQVMsR0FBRyxPQUFDLENBQUMsS0FBSyxDQUMvQixPQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLE9BQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUMvRCxDQUFDLFFBQVEsRUFBRSxDQUFDO0FBRWIsa0RBQWtEO0FBQ3JDLFFBQUEsS0FBSyxHQUFHLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztBQUVsRSxzREFBc0Q7QUFDekMsUUFBQSxZQUFZLEdBQUcsT0FBQyxDQUFDLE1BQU0sQ0FBQztJQUNwQyxHQUFHLEVBQUUsV0FBRyxFQUErQixXQUFXO0lBQ2xELENBQUMsZUFBZSxDQUFDLEVBQUUsdUJBQWUsQ0FBQyxRQUFRLEVBQUU7SUFDN0MsUUFBUSxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUU7Q0FDL0IsQ0FBQyxDQUFDO0FBRUgsNkRBQTZEO0FBQ2hELFFBQUEsZUFBZSxHQUFHLE9BQUMsQ0FBQyxNQUFNLENBQUM7SUFDdkMsSUFBSSxFQUFFLG9CQUFZLENBQUMsUUFBUSxFQUFFO0lBQzdCLGdCQUFnQixFQUFFLE9BQUMsQ0FBQyxNQUFNLENBQUM7UUFDMUIsR0FBRyxFQUFFLFdBQUc7UUFDUixDQUFDLGVBQWUsQ0FBQyxFQUFFLHVCQUFlLENBQUMsUUFBUSxFQUFFO0tBQzdDLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDYixnQkFBZ0IsRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQUUsNEJBQTRCO0lBQ3JFLFVBQVUsRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQVEsNEJBQTRCO0NBQ3JFLENBQUMsQ0FBQztBQUVVLFFBQUEscUJBQXFCLEdBQUcsT0FBQyxDQUFDLE1BQU0sQ0FBQztJQUM3QyxXQUFXLEVBQUUsT0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUN6RCxZQUFZLEVBQUUsT0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUNsRCxRQUFRLEVBQUUsT0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtDQUMvQyxDQUFDLENBQUMsTUFBTSxDQUNSLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxLQUFLLFNBQVMsSUFBSSxDQUFDLENBQUMsWUFBWSxLQUFLLFNBQVMsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFDOUYsRUFBRSxPQUFPLEVBQUUsMEZBQTBGLEVBQUUsQ0FDdkcsQ0FBQztBQUVXLFFBQUEsZ0JBQWdCLEdBQUcsT0FBQyxDQUFDLE1BQU0sQ0FBQztJQUN4QyxHQUFHLEVBQUUsV0FBRyxFQUFpQyxXQUFXO0lBQ3BELENBQUMsZUFBZSxDQUFDLEVBQUUsdUJBQWUsQ0FBQyxRQUFRLEVBQUU7SUFDN0MsVUFBVSxFQUFFLDZCQUFxQixDQUFDLFFBQVEsRUFBRSxFQUFFLG1EQUFtRDtDQUNqRyxDQUFDLENBQUM7QUFFSCxNQUFNLFNBQVMsR0FBRyxPQUFDLENBQUMsTUFBTSxDQUFDO0lBQzFCLE1BQU0sRUFBRSx1QkFBZSxDQUFDLFFBQVEsRUFBRTtJQUNsQyxhQUFhLEVBQUUsT0FBQyxDQUFDLEtBQUssQ0FBQyx3QkFBZ0IsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLGdCQUFnQjtDQUNyRSxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFO0lBQzNCLE1BQU0sR0FBRyxHQUFHLEdBQUcsQ0FBQyxhQUFhLENBQUM7SUFDOUIsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMzQixHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFO1lBQ3BCLElBQUksQ0FBQyxDQUFDLENBQUMsVUFBVSxFQUFFLENBQUM7Z0JBQ25CLEdBQUcsQ0FBQyxRQUFRLENBQUM7b0JBQ1osSUFBSSxFQUFFLE9BQUMsQ0FBQyxZQUFZLENBQUMsTUFBTTtvQkFDM0IsT0FBTyxFQUFFLDJCQUEyQixDQUFDLGlFQUFpRTtvQkFDdEcsSUFBSSxFQUFFLENBQUMsZUFBZSxFQUFFLENBQUMsRUFBRSxZQUFZLENBQUM7aUJBQ3hDLENBQUMsQ0FBQztZQUNKLENBQUM7UUFDRixDQUFDLENBQUMsQ0FBQztJQUNKLENBQUM7QUFDRixDQUFDLENBQUMsQ0FBQztBQUVILDZEQUE2RDtBQUNoRCxRQUFBLGdCQUFnQixHQUFHLE9BQUMsQ0FBQyxNQUFNLENBQUM7SUFDeEMsTUFBTSxFQUFFLGlCQUFTLEVBQWtCLFdBQVc7SUFDOUMsSUFBSSxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQVEsV0FBVztJQUMxQyxXQUFXLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUNsQyxTQUFTLEVBQUUsU0FBUyxDQUFDLFFBQVEsRUFBRTtDQUMvQixDQUFDLENBQUM7QUFFSCw2REFBNkQ7QUFDaEQsUUFBQSxpQkFBaUIsR0FBRyxPQUFDLENBQUMsTUFBTSxDQUFDO0lBQ3pDLE1BQU0sRUFBRSxpQkFBUyxFQUFrQixXQUFXO0lBQzlDLEtBQUssRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFPLFdBQVc7SUFDMUMsV0FBVyxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUU7Q0FDbEMsQ0FBQyxDQUFDO0FBRUgsb0RBQW9EO0FBQ3ZDLFFBQUEsa0JBQWtCLEdBQUcsT0FBQyxDQUFDLE1BQU0sQ0FBQztJQUMxQyxJQUFJLEVBQUUsaUJBQVMsRUFBcUQsV0FBVztJQUMvRSxPQUFPLEVBQUUsT0FBQyxDQUFDLEtBQUssQ0FBQyx5QkFBaUIsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFzQixPQUFPO0lBQzNFLFNBQVMsRUFBRSxPQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQW1DLFdBQVc7SUFDL0UsRUFBRSxFQUFFLE9BQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQWUsMkJBQTJCO0lBQy9GLE1BQU0sRUFBRSxhQUFLLENBQUMsUUFBUSxFQUFFLEVBQTRDLFdBQVc7Q0FDL0UsQ0FBQyxDQUFDO0FBRUgsd0RBQXdEO0FBQzNDLFFBQUEsWUFBWSxHQUFHLE9BQUMsQ0FBQyxNQUFNLENBQUM7SUFDcEMsR0FBRyxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUU7SUFDZixJQUFJLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUMzQixXQUFXLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUVsQyxPQUFPLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUM5QixDQUFDLG1CQUFtQixDQUFDLEVBQUUsdUJBQWUsQ0FBQyxRQUFRLEVBQUU7SUFFakQsT0FBTyxFQUFFLE9BQUMsQ0FBQyxLQUFLLENBQUMsd0JBQWdCLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBTyxLQUFLO0lBQ3pELE1BQU0sRUFBRSxPQUFDLENBQUMsS0FBSyxDQUFDLDBCQUFrQixDQUFDLENBQUMsUUFBUSxFQUFFLEVBQU0sS0FBSztJQUV6RCwrQ0FBK0M7SUFDL0MsQ0FBQyxlQUFlLENBQUMsRUFBRSx1QkFBZSxDQUFDLFFBQVEsRUFBRTtDQUM3QyxDQUFDO0tBQ0EsS0FBSyxFQUFFLENBQUMsd0NBQXdDO0tBQ2hELFdBQVcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsRUFBRTtJQUN6QixNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQzlCLEdBQUcsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFO1FBQzVCLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ2QsSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO2dCQUN2QixHQUFHLENBQUMsUUFBUSxDQUFDO29CQUNaLElBQUksRUFBRSxPQUFDLENBQUMsWUFBWSxDQUFDLE1BQU07b0JBQzNCLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQyxNQUFNLDJDQUEyQztvQkFDdkUsSUFBSSxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsRUFBRSxRQUFRLENBQUM7aUJBQzdCLENBQUMsQ0FBQztZQUNKLENBQUM7WUFDRCxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNuQixDQUFDO0lBQ0YsQ0FBQyxDQUFDLENBQUM7QUFDSixDQUFDLENBQUMsQ0FBQyJ9
|
|
@@ -0,0 +1,6 @@
|
|
|
1
|
+
export * from './CredentialConfigurationSupportedSchema';
|
|
2
|
+
export * from './CredentialOfferSchema';
|
|
3
|
+
export * from './OpenidAuthorizationServerMetadataSchema';
|
|
4
|
+
export * from './OpenidCredentialIssuerMetadataSchema';
|
|
5
|
+
export * from './SdJwtVcPayloadSchema';
|
|
6
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,0CAA0C,CAAC;AACzD,cAAc,yBAAyB,CAAC;AACxC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,wBAAwB,CAAC"}
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
14
|
+
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
|
+
};
|
|
16
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
+
__exportStar(require("./CredentialConfigurationSupportedSchema"), exports);
|
|
18
|
+
__exportStar(require("./CredentialOfferSchema"), exports);
|
|
19
|
+
__exportStar(require("./OpenidAuthorizationServerMetadataSchema"), exports);
|
|
20
|
+
__exportStar(require("./OpenidCredentialIssuerMetadataSchema"), exports);
|
|
21
|
+
__exportStar(require("./SdJwtVcPayloadSchema"), exports);
|
|
22
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2NoZW1hcy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsMkVBQXlEO0FBQ3pELDBEQUF3QztBQUN4Qyw0RUFBMEQ7QUFDMUQseUVBQXVEO0FBQ3ZELHlEQUF1QyJ9
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
import { TokenStatusListVerificationError } from "../error";
|
|
2
|
+
import { CredentialStatus, HttpClient, PublicKeyResolverEngineI } from "../interfaces";
|
|
3
|
+
import { Result } from "../types";
|
|
4
|
+
import { TrustRegistry } from "../trust/TrustRegistry";
|
|
5
|
+
export interface TokenStatusListVerificationResult {
|
|
6
|
+
status: CredentialStatus;
|
|
7
|
+
statusValue: number;
|
|
8
|
+
index: number;
|
|
9
|
+
bits: number;
|
|
10
|
+
uri: string;
|
|
11
|
+
issuer: string;
|
|
12
|
+
issuedAt: number;
|
|
13
|
+
expiresAt: number;
|
|
14
|
+
ttl: number;
|
|
15
|
+
kid: string;
|
|
16
|
+
}
|
|
17
|
+
export interface TokenStatusListVerifierI {
|
|
18
|
+
verify(args: {
|
|
19
|
+
credentialIssuer: string;
|
|
20
|
+
status: unknown;
|
|
21
|
+
forceRefresh?: boolean;
|
|
22
|
+
}): Promise<Result<TokenStatusListVerificationResult, TokenStatusListVerificationError>>;
|
|
23
|
+
clearCache(uri?: string): void;
|
|
24
|
+
}
|
|
25
|
+
export interface TokenStatusListVerifierOptions {
|
|
26
|
+
trustRegistry: TrustRegistry;
|
|
27
|
+
pkResolverEngine: PublicKeyResolverEngineI;
|
|
28
|
+
httpClient: HttpClient;
|
|
29
|
+
allowedBits?: readonly (1 | 2 | 4 | 8)[];
|
|
30
|
+
clockToleranceSeconds?: number;
|
|
31
|
+
requestTimeoutMs?: number;
|
|
32
|
+
maxResponseBytes?: number;
|
|
33
|
+
maxCompressedBytes?: number;
|
|
34
|
+
maxDecompressedBytes?: number;
|
|
35
|
+
maxTtlSeconds?: number;
|
|
36
|
+
requireExpiration?: boolean;
|
|
37
|
+
requireTtl?: boolean;
|
|
38
|
+
now?: () => Date;
|
|
39
|
+
}
|
|
40
|
+
export declare function TokenStatusListVerifier(options: TokenStatusListVerifierOptions): TokenStatusListVerifierI;
|
|
41
|
+
//# sourceMappingURL=TokenStatusListVerifier.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"TokenStatusListVerifier.d.ts","sourceRoot":"","sources":["../../src/status/TokenStatusListVerifier.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gCAAgC,EAChC,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,gBAAgB,EAChB,UAAU,EACV,wBAAwB,EACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,aAAa,EAAsB,MAAM,wBAAwB,CAAC;AAG3E,MAAM,WAAW,iCAAiC;IACjD,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,wBAAwB;IACxC,MAAM,CAAC,IAAI,EAAE;QACZ,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,OAAO,CAAC;QAChB,YAAY,CAAC,EAAE,OAAO,CAAC;KACvB,GAAG,OAAO,CAAC,MAAM,CAAC,iCAAiC,EAAE,gCAAgC,CAAC,CAAC,CAAC;IACzF,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,8BAA8B;IAC9C,aAAa,EAAE,aAAa,CAAC;IAC7B,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IACzC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACjB;AAqKD,wBAAgB,uBAAuB,CACtC,OAAO,EAAE,8BAA8B,GACrC,wBAAwB,CAgU1B"}
|
|
@@ -0,0 +1,410 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.TokenStatusListVerifier = TokenStatusListVerifier;
|
|
4
|
+
const jose_1 = require("jose");
|
|
5
|
+
const pako_1 = require("pako");
|
|
6
|
+
const error_1 = require("../error");
|
|
7
|
+
const util_1 = require("../utils/util");
|
|
8
|
+
const DEFAULT_REQUEST_TIMEOUT_MS = 5_000;
|
|
9
|
+
const DEFAULT_MAX_RESPONSE_BYTES = 256 * 1024;
|
|
10
|
+
const DEFAULT_MAX_COMPRESSED_BYTES = 128 * 1024;
|
|
11
|
+
const DEFAULT_MAX_DECOMPRESSED_BYTES = 512 * 1024;
|
|
12
|
+
const DEFAULT_MAX_TTL_SECONDS = 86_400;
|
|
13
|
+
const COMPACT_JWT = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
|
|
14
|
+
const BASE64URL = /^[A-Za-z0-9_-]+$/;
|
|
15
|
+
function failure(error) {
|
|
16
|
+
return { success: false, error };
|
|
17
|
+
}
|
|
18
|
+
function isObject(value) {
|
|
19
|
+
return typeof value === "object" && value !== null && !Array.isArray(value);
|
|
20
|
+
}
|
|
21
|
+
function isNonNegativeInteger(value) {
|
|
22
|
+
return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
|
|
23
|
+
}
|
|
24
|
+
function isPositiveInteger(value) {
|
|
25
|
+
return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
|
|
26
|
+
}
|
|
27
|
+
function normalizeStatusUri(value) {
|
|
28
|
+
try {
|
|
29
|
+
const url = new URL(value);
|
|
30
|
+
if (url.protocol !== "https:" ||
|
|
31
|
+
url.username ||
|
|
32
|
+
url.password ||
|
|
33
|
+
url.hash) {
|
|
34
|
+
return undefined;
|
|
35
|
+
}
|
|
36
|
+
return url.href;
|
|
37
|
+
}
|
|
38
|
+
catch {
|
|
39
|
+
return undefined;
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
function parseReference(status) {
|
|
43
|
+
if (!isObject(status) || !isObject(status.status_list))
|
|
44
|
+
return undefined;
|
|
45
|
+
const idx = status.status_list.idx;
|
|
46
|
+
const uri = status.status_list.uri;
|
|
47
|
+
if (!isNonNegativeInteger(idx) || typeof uri !== "string")
|
|
48
|
+
return undefined;
|
|
49
|
+
const normalizedUri = normalizeStatusUri(uri);
|
|
50
|
+
if (!normalizedUri)
|
|
51
|
+
return undefined;
|
|
52
|
+
return { idx, uri: normalizedUri };
|
|
53
|
+
}
|
|
54
|
+
function responseText(data) {
|
|
55
|
+
if (typeof data === "string")
|
|
56
|
+
return data.trim();
|
|
57
|
+
if (data instanceof Uint8Array) {
|
|
58
|
+
try {
|
|
59
|
+
return new TextDecoder("utf-8", { fatal: true }).decode(data).trim();
|
|
60
|
+
}
|
|
61
|
+
catch {
|
|
62
|
+
return undefined;
|
|
63
|
+
}
|
|
64
|
+
}
|
|
65
|
+
return undefined;
|
|
66
|
+
}
|
|
67
|
+
function headerValue(headers, name) {
|
|
68
|
+
const expected = name.toLowerCase();
|
|
69
|
+
for (const [key, value] of Object.entries(headers ?? {})) {
|
|
70
|
+
if (key.toLowerCase() === expected && typeof value === "string") {
|
|
71
|
+
return value;
|
|
72
|
+
}
|
|
73
|
+
}
|
|
74
|
+
return undefined;
|
|
75
|
+
}
|
|
76
|
+
function statusName(value) {
|
|
77
|
+
if (value === 0)
|
|
78
|
+
return "valid";
|
|
79
|
+
if (value === 1)
|
|
80
|
+
return "revoked";
|
|
81
|
+
if (value === 2)
|
|
82
|
+
return "suspended";
|
|
83
|
+
return "application-specific";
|
|
84
|
+
}
|
|
85
|
+
function inflateBounded(compressed, maxDecompressedBytes) {
|
|
86
|
+
const chunks = [];
|
|
87
|
+
let size = 0;
|
|
88
|
+
try {
|
|
89
|
+
const inflater = new pako_1.Inflate({
|
|
90
|
+
chunkSize: Math.min(16 * 1024, maxDecompressedBytes + 1),
|
|
91
|
+
});
|
|
92
|
+
inflater.onData = (chunk) => {
|
|
93
|
+
size += chunk.byteLength;
|
|
94
|
+
if (size > maxDecompressedBytes) {
|
|
95
|
+
throw new RangeError("Token Status List exceeds the decompression limit");
|
|
96
|
+
}
|
|
97
|
+
chunks.push(new Uint8Array(chunk));
|
|
98
|
+
};
|
|
99
|
+
const completed = inflater.push(compressed, true);
|
|
100
|
+
if (!completed || inflater.err) {
|
|
101
|
+
return failure(error_1.TokenStatusListVerificationError.DecompressionFailed);
|
|
102
|
+
}
|
|
103
|
+
}
|
|
104
|
+
catch (error) {
|
|
105
|
+
if (error instanceof RangeError) {
|
|
106
|
+
return failure(error_1.TokenStatusListVerificationError.DecompressedListTooLarge);
|
|
107
|
+
}
|
|
108
|
+
return failure(error_1.TokenStatusListVerificationError.DecompressionFailed);
|
|
109
|
+
}
|
|
110
|
+
const output = new Uint8Array(size);
|
|
111
|
+
let offset = 0;
|
|
112
|
+
for (const chunk of chunks) {
|
|
113
|
+
output.set(chunk, offset);
|
|
114
|
+
offset += chunk.byteLength;
|
|
115
|
+
}
|
|
116
|
+
return { success: true, value: output };
|
|
117
|
+
}
|
|
118
|
+
function validateOptions(options) {
|
|
119
|
+
const allowedBits = options.allowedBits ?? [2];
|
|
120
|
+
const values = [
|
|
121
|
+
options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,
|
|
122
|
+
options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES,
|
|
123
|
+
options.maxCompressedBytes ?? DEFAULT_MAX_COMPRESSED_BYTES,
|
|
124
|
+
options.maxDecompressedBytes ?? DEFAULT_MAX_DECOMPRESSED_BYTES,
|
|
125
|
+
options.maxTtlSeconds ?? DEFAULT_MAX_TTL_SECONDS,
|
|
126
|
+
];
|
|
127
|
+
if (allowedBits.length === 0 ||
|
|
128
|
+
new Set(allowedBits).size !== allowedBits.length ||
|
|
129
|
+
allowedBits.some((bits) => ![1, 2, 4, 8].includes(bits)) ||
|
|
130
|
+
values.some((value) => !Number.isSafeInteger(value) || value <= 0) ||
|
|
131
|
+
!Number.isSafeInteger(options.clockToleranceSeconds ?? 0) ||
|
|
132
|
+
(options.clockToleranceSeconds ?? 0) < 0) {
|
|
133
|
+
throw new TypeError("TokenStatusListVerifier options are invalid");
|
|
134
|
+
}
|
|
135
|
+
return Object.freeze([...allowedBits]);
|
|
136
|
+
}
|
|
137
|
+
function TokenStatusListVerifier(options) {
|
|
138
|
+
const allowedBits = validateOptions(options);
|
|
139
|
+
const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
|
|
140
|
+
const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
|
|
141
|
+
const maxCompressedBytes = options.maxCompressedBytes ?? DEFAULT_MAX_COMPRESSED_BYTES;
|
|
142
|
+
const maxDecompressedBytes = options.maxDecompressedBytes ?? DEFAULT_MAX_DECOMPRESSED_BYTES;
|
|
143
|
+
const maxTtlSeconds = options.maxTtlSeconds ?? DEFAULT_MAX_TTL_SECONDS;
|
|
144
|
+
const clockToleranceSeconds = options.clockToleranceSeconds ?? 0;
|
|
145
|
+
const requireExpiration = options.requireExpiration ?? true;
|
|
146
|
+
const requireTtl = options.requireTtl ?? true;
|
|
147
|
+
const now = options.now ?? (() => new Date());
|
|
148
|
+
const cache = new Map();
|
|
149
|
+
const inflight = new Map();
|
|
150
|
+
function cacheKey(credentialIssuer, uri) {
|
|
151
|
+
return `${credentialIssuer}\n${uri}`;
|
|
152
|
+
}
|
|
153
|
+
function trustedReference(credentialIssuer, status) {
|
|
154
|
+
const entry = options.trustRegistry.get(credentialIssuer);
|
|
155
|
+
const reference = parseReference(status);
|
|
156
|
+
if (!entry || !reference) {
|
|
157
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidReference);
|
|
158
|
+
}
|
|
159
|
+
if (!entry.statusListUris ||
|
|
160
|
+
!entry.statusListUris.includes(reference.uri)) {
|
|
161
|
+
return failure(error_1.TokenStatusListVerificationError.StatusListUriNotTrusted);
|
|
162
|
+
}
|
|
163
|
+
const statusIssuer = entry.statusListIssuer ?? entry.issuer;
|
|
164
|
+
const statusIssuerEntry = options.trustRegistry.get(statusIssuer);
|
|
165
|
+
if (!statusIssuerEntry?.algorithms["status-list"]?.length) {
|
|
166
|
+
return failure(error_1.TokenStatusListVerificationError.StatusListUriNotTrusted);
|
|
167
|
+
}
|
|
168
|
+
return {
|
|
169
|
+
success: true,
|
|
170
|
+
value: { entry, reference, statusIssuer },
|
|
171
|
+
};
|
|
172
|
+
}
|
|
173
|
+
async function fetchAndVerify(reference, statusIssuer) {
|
|
174
|
+
const currentDate = now();
|
|
175
|
+
const currentSeconds = Math.floor(currentDate.getTime() / 1000);
|
|
176
|
+
const requestUrl = new URL(reference.uri);
|
|
177
|
+
requestUrl.searchParams.set("time", String(currentSeconds));
|
|
178
|
+
let response;
|
|
179
|
+
try {
|
|
180
|
+
response = await options.httpClient.get(requestUrl.href, { Accept: "application/statuslist+jwt" }, {
|
|
181
|
+
useCache: false,
|
|
182
|
+
timeout: requestTimeoutMs,
|
|
183
|
+
maxRedirects: 0,
|
|
184
|
+
maxContentLength: maxResponseBytes,
|
|
185
|
+
maxBodyLength: maxResponseBytes,
|
|
186
|
+
responseType: "text",
|
|
187
|
+
});
|
|
188
|
+
}
|
|
189
|
+
catch {
|
|
190
|
+
return failure(error_1.TokenStatusListVerificationError.FetchFailed);
|
|
191
|
+
}
|
|
192
|
+
if (!response || response.status < 200 || response.status >= 300) {
|
|
193
|
+
return failure(error_1.TokenStatusListVerificationError.FetchFailed);
|
|
194
|
+
}
|
|
195
|
+
const contentType = headerValue(response.headers, "content-type");
|
|
196
|
+
if (!contentType ||
|
|
197
|
+
contentType.split(";", 1)[0].trim().toLowerCase() !==
|
|
198
|
+
"application/statuslist+jwt") {
|
|
199
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidResponse);
|
|
200
|
+
}
|
|
201
|
+
const token = responseText(response.data);
|
|
202
|
+
if (!token) {
|
|
203
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidResponse);
|
|
204
|
+
}
|
|
205
|
+
if (new TextEncoder().encode(token).byteLength > maxResponseBytes) {
|
|
206
|
+
return failure(error_1.TokenStatusListVerificationError.ResponseTooLarge);
|
|
207
|
+
}
|
|
208
|
+
if (!COMPACT_JWT.test(token)) {
|
|
209
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidResponse);
|
|
210
|
+
}
|
|
211
|
+
let header;
|
|
212
|
+
let unverifiedPayload;
|
|
213
|
+
try {
|
|
214
|
+
header = (0, jose_1.decodeProtectedHeader)(token);
|
|
215
|
+
unverifiedPayload = (0, jose_1.decodeJwt)(token);
|
|
216
|
+
}
|
|
217
|
+
catch {
|
|
218
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidResponse);
|
|
219
|
+
}
|
|
220
|
+
if (header.typ !== "statuslist+jwt" ||
|
|
221
|
+
typeof header.alg !== "string" ||
|
|
222
|
+
!header.alg ||
|
|
223
|
+
header.alg === "none" ||
|
|
224
|
+
typeof header.kid !== "string" ||
|
|
225
|
+
!header.kid ||
|
|
226
|
+
header.b64 !== undefined ||
|
|
227
|
+
header.jku !== undefined ||
|
|
228
|
+
header.x5u !== undefined ||
|
|
229
|
+
header.jwk !== undefined ||
|
|
230
|
+
header.x5c !== undefined ||
|
|
231
|
+
(header.crit !== undefined &&
|
|
232
|
+
(!Array.isArray(header.crit) || header.crit.length > 0))) {
|
|
233
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidHeader);
|
|
234
|
+
}
|
|
235
|
+
if (unverifiedPayload.iss !== statusIssuer ||
|
|
236
|
+
unverifiedPayload.sub !== reference.uri) {
|
|
237
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidPayload);
|
|
238
|
+
}
|
|
239
|
+
const keyResult = await options.pkResolverEngine.resolve({
|
|
240
|
+
identifier: statusIssuer,
|
|
241
|
+
kid: header.kid,
|
|
242
|
+
alg: header.alg,
|
|
243
|
+
tokenType: "status-list",
|
|
244
|
+
});
|
|
245
|
+
if (!keyResult.success) {
|
|
246
|
+
return failure(error_1.TokenStatusListVerificationError.CannotResolveSigningKey);
|
|
247
|
+
}
|
|
248
|
+
let key;
|
|
249
|
+
try {
|
|
250
|
+
key = await (0, jose_1.importJWK)(keyResult.value.jwk, header.alg);
|
|
251
|
+
}
|
|
252
|
+
catch {
|
|
253
|
+
return failure(error_1.TokenStatusListVerificationError.CannotImportSigningKey);
|
|
254
|
+
}
|
|
255
|
+
let payload;
|
|
256
|
+
try {
|
|
257
|
+
const verified = await (0, jose_1.jwtVerify)(token, key, {
|
|
258
|
+
algorithms: [header.alg],
|
|
259
|
+
issuer: statusIssuer,
|
|
260
|
+
subject: reference.uri,
|
|
261
|
+
clockTolerance: clockToleranceSeconds,
|
|
262
|
+
currentDate,
|
|
263
|
+
});
|
|
264
|
+
payload = verified.payload;
|
|
265
|
+
}
|
|
266
|
+
catch (error) {
|
|
267
|
+
if (error instanceof Error &&
|
|
268
|
+
(error.name === "JWTExpired" ||
|
|
269
|
+
error.name === "JWTClaimValidationFailed")) {
|
|
270
|
+
return failure(error_1.TokenStatusListVerificationError.ExpiredStatusList);
|
|
271
|
+
}
|
|
272
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidSignature);
|
|
273
|
+
}
|
|
274
|
+
const issuedAt = payload.iat;
|
|
275
|
+
const expiresAt = payload.exp;
|
|
276
|
+
const ttl = payload.ttl;
|
|
277
|
+
const statusList = payload.status_list;
|
|
278
|
+
if (!isNonNegativeInteger(issuedAt) ||
|
|
279
|
+
(requireExpiration && !isNonNegativeInteger(expiresAt)) ||
|
|
280
|
+
(expiresAt !== undefined && !isNonNegativeInteger(expiresAt)) ||
|
|
281
|
+
(requireTtl && !isPositiveInteger(ttl)) ||
|
|
282
|
+
(ttl !== undefined && !isPositiveInteger(ttl)) ||
|
|
283
|
+
(typeof ttl === "number" && ttl > maxTtlSeconds) ||
|
|
284
|
+
!isObject(statusList) ||
|
|
285
|
+
!allowedBits.includes(statusList.bits) ||
|
|
286
|
+
typeof statusList.lst !== "string" ||
|
|
287
|
+
!BASE64URL.test(statusList.lst)) {
|
|
288
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidPayload);
|
|
289
|
+
}
|
|
290
|
+
if (issuedAt > currentSeconds + clockToleranceSeconds ||
|
|
291
|
+
(typeof expiresAt === "number" &&
|
|
292
|
+
(expiresAt <= currentSeconds - clockToleranceSeconds ||
|
|
293
|
+
issuedAt >= expiresAt))) {
|
|
294
|
+
return failure(error_1.TokenStatusListVerificationError.ExpiredStatusList);
|
|
295
|
+
}
|
|
296
|
+
let compressed;
|
|
297
|
+
try {
|
|
298
|
+
compressed = (0, util_1.fromBase64Url)(statusList.lst);
|
|
299
|
+
}
|
|
300
|
+
catch {
|
|
301
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidPayload);
|
|
302
|
+
}
|
|
303
|
+
if (compressed.byteLength === 0 ||
|
|
304
|
+
compressed.byteLength > maxCompressedBytes) {
|
|
305
|
+
return failure(error_1.TokenStatusListVerificationError.ResponseTooLarge);
|
|
306
|
+
}
|
|
307
|
+
const inflated = inflateBounded(compressed, maxDecompressedBytes);
|
|
308
|
+
if (!inflated.success)
|
|
309
|
+
return inflated;
|
|
310
|
+
if (inflated.value.byteLength === 0) {
|
|
311
|
+
return failure(error_1.TokenStatusListVerificationError.InvalidPayload);
|
|
312
|
+
}
|
|
313
|
+
const effectiveExpiresAt = typeof expiresAt === "number"
|
|
314
|
+
? expiresAt
|
|
315
|
+
: currentSeconds + (typeof ttl === "number" ? ttl : 0);
|
|
316
|
+
const advertisedTtl = typeof ttl === "number"
|
|
317
|
+
? ttl
|
|
318
|
+
: Math.max(0, effectiveExpiresAt - currentSeconds);
|
|
319
|
+
const effectiveTtl = Math.min(advertisedTtl, maxTtlSeconds);
|
|
320
|
+
const cacheUntil = Math.min(currentDate.getTime() + effectiveTtl * 1000, effectiveExpiresAt * 1000);
|
|
321
|
+
return {
|
|
322
|
+
success: true,
|
|
323
|
+
value: {
|
|
324
|
+
bytes: inflated.value,
|
|
325
|
+
bits: statusList.bits,
|
|
326
|
+
uri: reference.uri,
|
|
327
|
+
issuer: statusIssuer,
|
|
328
|
+
issuedAt,
|
|
329
|
+
expiresAt: effectiveExpiresAt,
|
|
330
|
+
ttl: effectiveTtl,
|
|
331
|
+
kid: header.kid,
|
|
332
|
+
cacheUntil,
|
|
333
|
+
},
|
|
334
|
+
};
|
|
335
|
+
}
|
|
336
|
+
async function statusList(credentialIssuer, reference, statusIssuer, forceRefresh) {
|
|
337
|
+
const key = cacheKey(credentialIssuer, reference.uri);
|
|
338
|
+
const cached = cache.get(key);
|
|
339
|
+
if (!forceRefresh && cached && cached.value.cacheUntil > now().getTime()) {
|
|
340
|
+
return { success: true, value: cached.value };
|
|
341
|
+
}
|
|
342
|
+
if (!forceRefresh) {
|
|
343
|
+
const pending = inflight.get(key);
|
|
344
|
+
if (pending)
|
|
345
|
+
return pending;
|
|
346
|
+
}
|
|
347
|
+
const pending = fetchAndVerify(reference, statusIssuer);
|
|
348
|
+
if (!forceRefresh)
|
|
349
|
+
inflight.set(key, pending);
|
|
350
|
+
try {
|
|
351
|
+
const result = await pending;
|
|
352
|
+
if (result.success)
|
|
353
|
+
cache.set(key, { value: result.value });
|
|
354
|
+
return result;
|
|
355
|
+
}
|
|
356
|
+
finally {
|
|
357
|
+
if (!forceRefresh)
|
|
358
|
+
inflight.delete(key);
|
|
359
|
+
}
|
|
360
|
+
}
|
|
361
|
+
return {
|
|
362
|
+
async verify({ credentialIssuer, status, forceRefresh = false }) {
|
|
363
|
+
const trusted = trustedReference(credentialIssuer, status);
|
|
364
|
+
if (!trusted.success)
|
|
365
|
+
return trusted;
|
|
366
|
+
const { reference, statusIssuer } = trusted.value;
|
|
367
|
+
const list = await statusList(credentialIssuer, reference, statusIssuer, forceRefresh);
|
|
368
|
+
if (!list.success)
|
|
369
|
+
return list;
|
|
370
|
+
const bitOffset = reference.idx * list.value.bits;
|
|
371
|
+
if (!Number.isSafeInteger(bitOffset)) {
|
|
372
|
+
return failure(error_1.TokenStatusListVerificationError.IndexOutOfRange);
|
|
373
|
+
}
|
|
374
|
+
const byteIndex = Math.floor(bitOffset / 8);
|
|
375
|
+
if (byteIndex >= list.value.bytes.byteLength) {
|
|
376
|
+
return failure(error_1.TokenStatusListVerificationError.IndexOutOfRange);
|
|
377
|
+
}
|
|
378
|
+
const shift = bitOffset % 8;
|
|
379
|
+
const mask = (1 << list.value.bits) - 1;
|
|
380
|
+
const statusValue = (list.value.bytes[byteIndex] >> shift) & mask;
|
|
381
|
+
return {
|
|
382
|
+
success: true,
|
|
383
|
+
value: {
|
|
384
|
+
status: statusName(statusValue),
|
|
385
|
+
statusValue,
|
|
386
|
+
index: reference.idx,
|
|
387
|
+
bits: list.value.bits,
|
|
388
|
+
uri: list.value.uri,
|
|
389
|
+
issuer: list.value.issuer,
|
|
390
|
+
issuedAt: list.value.issuedAt,
|
|
391
|
+
expiresAt: list.value.expiresAt,
|
|
392
|
+
ttl: list.value.ttl,
|
|
393
|
+
kid: list.value.kid,
|
|
394
|
+
},
|
|
395
|
+
};
|
|
396
|
+
},
|
|
397
|
+
clearCache(uri) {
|
|
398
|
+
if (uri === undefined) {
|
|
399
|
+
cache.clear();
|
|
400
|
+
return;
|
|
401
|
+
}
|
|
402
|
+
const normalized = normalizeStatusUri(uri);
|
|
403
|
+
for (const key of cache.keys()) {
|
|
404
|
+
if (normalized && key.endsWith(`\n${normalized}`))
|
|
405
|
+
cache.delete(key);
|
|
406
|
+
}
|
|
407
|
+
},
|
|
408
|
+
};
|
|
409
|
+
}
|
|
410
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiVG9rZW5TdGF0dXNMaXN0VmVyaWZpZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc3RhdHVzL1Rva2VuU3RhdHVzTGlzdFZlcmlmaWVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBdU5BLDBEQWtVQztBQXpoQkQsK0JBQThFO0FBQzlFLCtCQUErQjtBQUMvQixvQ0FFa0I7QUFRbEIsd0NBQThDO0FBNkQ5QyxNQUFNLDBCQUEwQixHQUFHLEtBQUssQ0FBQztBQUN6QyxNQUFNLDBCQUEwQixHQUFHLEdBQUcsR0FBRyxJQUFJLENBQUM7QUFDOUMsTUFBTSw0QkFBNEIsR0FBRyxHQUFHLEdBQUcsSUFBSSxDQUFDO0FBQ2hELE1BQU0sOEJBQThCLEdBQUcsR0FBRyxHQUFHLElBQUksQ0FBQztBQUNsRCxNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQztBQUN2QyxNQUFNLFdBQVcsR0FBRyxrREFBa0QsQ0FBQztBQUN2RSxNQUFNLFNBQVMsR0FBRyxrQkFBa0IsQ0FBQztBQUVyQyxTQUFTLE9BQU8sQ0FBQyxLQUF1QztJQUN2RCxPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQWMsRUFBRSxLQUFLLEVBQUUsQ0FBQztBQUMzQyxDQUFDO0FBRUQsU0FBUyxRQUFRLENBQUMsS0FBYztJQUMvQixPQUFPLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUM3RSxDQUFDO0FBRUQsU0FBUyxvQkFBb0IsQ0FBQyxLQUFjO0lBQzNDLE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxJQUFJLENBQUMsQ0FBQztBQUMvRSxDQUFDO0FBRUQsU0FBUyxpQkFBaUIsQ0FBQyxLQUFjO0lBQ3hDLE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztBQUM5RSxDQUFDO0FBRUQsU0FBUyxrQkFBa0IsQ0FBQyxLQUFhO0lBQ3hDLElBQUksQ0FBQztRQUNKLE1BQU0sR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzNCLElBQ0MsR0FBRyxDQUFDLFFBQVEsS0FBSyxRQUFRO1lBQ3pCLEdBQUcsQ0FBQyxRQUFRO1lBQ1osR0FBRyxDQUFDLFFBQVE7WUFDWixHQUFHLENBQUMsSUFBSSxFQUNQLENBQUM7WUFDRixPQUFPLFNBQVMsQ0FBQztRQUNsQixDQUFDO1FBQ0QsT0FBTyxHQUFHLENBQUMsSUFBSSxDQUFDO0lBQ2pCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUixPQUFPLFNBQVMsQ0FBQztJQUNsQixDQUFDO0FBQ0YsQ0FBQztBQUVELFNBQVMsY0FBYyxDQUFDLE1BQWU7SUFDdEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDekUsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUM7SUFDbkMsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUM7SUFDbkMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxJQUFJLE9BQU8sR0FBRyxLQUFLLFFBQVE7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUM1RSxNQUFNLGFBQWEsR0FBRyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUM5QyxJQUFJLENBQUMsYUFBYTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ3JDLE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLGFBQWEsRUFBRSxDQUFDO0FBQ3BDLENBQUM7QUFFRCxTQUFTLFlBQVksQ0FBQyxJQUFhO0lBQ2xDLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUTtRQUFFLE9BQU8sSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2pELElBQUksSUFBSSxZQUFZLFVBQVUsRUFBRSxDQUFDO1FBQ2hDLElBQUksQ0FBQztZQUNKLE9BQU8sSUFBSSxXQUFXLENBQUMsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3RFLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUixPQUFPLFNBQVMsQ0FBQztRQUNsQixDQUFDO0lBQ0YsQ0FBQztJQUNELE9BQU8sU0FBUyxDQUFDO0FBQ2xCLENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FDbkIsT0FBZ0MsRUFDaEMsSUFBWTtJQUVaLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztJQUNwQyxLQUFLLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxPQUFPLElBQUksRUFBRSxDQUFDLEVBQUUsQ0FBQztRQUMxRCxJQUFJLEdBQUcsQ0FBQyxXQUFXLEVBQUUsS0FBSyxRQUFRLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDakUsT0FBTyxLQUFLLENBQUM7UUFDZCxDQUFDO0lBQ0YsQ0FBQztJQUNELE9BQU8sU0FBUyxDQUFDO0FBQ2xCLENBQUM7QUFFRCxTQUFTLFVBQVUsQ0FBQyxLQUFhO0lBQ2hDLElBQUksS0FBSyxLQUFLLENBQUM7UUFBRSxPQUFPLE9BQU8sQ0FBQztJQUNoQyxJQUFJLEtBQUssS0FBSyxDQUFDO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDbEMsSUFBSSxLQUFLLEtBQUssQ0FBQztRQUFFLE9BQU8sV0FBVyxDQUFDO0lBQ3BDLE9BQU8sc0JBQXNCLENBQUM7QUFDL0IsQ0FBQztBQUVELFNBQVMsY0FBYyxDQUN0QixVQUFzQixFQUN0QixvQkFBNEI7SUFFNUIsTUFBTSxNQUFNLEdBQWlCLEVBQUUsQ0FBQztJQUNoQyxJQUFJLElBQUksR0FBRyxDQUFDLENBQUM7SUFDYixJQUFJLENBQUM7UUFDSixNQUFNLFFBQVEsR0FBRyxJQUFJLGNBQU8sQ0FBQztZQUM1QixTQUFTLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLEdBQUcsSUFBSSxFQUFFLG9CQUFvQixHQUFHLENBQUMsQ0FBQztTQUN4RCxDQUFDLENBQUM7UUFDSCxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsS0FBaUIsRUFBRSxFQUFFO1lBQ3ZDLElBQUksSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDO1lBQ3pCLElBQUksSUFBSSxHQUFHLG9CQUFvQixFQUFFLENBQUM7Z0JBQ2pDLE1BQU0sSUFBSSxVQUFVLENBQUMsbURBQW1ELENBQUMsQ0FBQztZQUMzRSxDQUFDO1lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ3BDLENBQUMsQ0FBQztRQUNGLE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2xELElBQUksQ0FBQyxTQUFTLElBQUksUUFBUSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ2hDLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDdEUsQ0FBQztJQUNGLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2hCLElBQUksS0FBSyxZQUFZLFVBQVUsRUFBRSxDQUFDO1lBQ2pDLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFDM0UsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUVELE1BQU0sTUFBTSxHQUFHLElBQUksVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3BDLElBQUksTUFBTSxHQUFHLENBQUMsQ0FBQztJQUNmLEtBQUssTUFBTSxLQUFLLElBQUksTUFBTSxFQUFFLENBQUM7UUFDNUIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUM7SUFDNUIsQ0FBQztJQUNELE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUN6QyxDQUFDO0FBRUQsU0FBUyxlQUFlLENBQUMsT0FBdUM7SUFDL0QsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLFdBQVcsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQy9DLE1BQU0sTUFBTSxHQUFHO1FBQ2QsT0FBTyxDQUFDLGdCQUFnQixJQUFJLDBCQUEwQjtRQUN0RCxPQUFPLENBQUMsZ0JBQWdCLElBQUksMEJBQTBCO1FBQ3RELE9BQU8sQ0FBQyxrQkFBa0IsSUFBSSw0QkFBNEI7UUFDMUQsT0FBTyxDQUFDLG9CQUFvQixJQUFJLDhCQUE4QjtRQUM5RCxPQUFPLENBQUMsYUFBYSxJQUFJLHVCQUF1QjtLQUNoRCxDQUFDO0lBQ0YsSUFDQyxXQUFXLENBQUMsTUFBTSxLQUFLLENBQUM7UUFDeEIsSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUMsSUFBSSxLQUFLLFdBQVcsQ0FBQyxNQUFNO1FBQ2hELFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDbEUsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLENBQUM7UUFDekQsQ0FBQyxPQUFPLENBQUMscUJBQXFCLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUN2QyxDQUFDO1FBQ0YsTUFBTSxJQUFJLFNBQVMsQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLFdBQVcsQ0FBQyxDQUFDLENBQUM7QUFDeEMsQ0FBQztBQUVELFNBQWdCLHVCQUF1QixDQUN0QyxPQUF1QztJQUV2QyxNQUFNLFdBQVcsR0FBRyxlQUFlLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDN0MsTUFBTSxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsZ0JBQWdCLElBQUksMEJBQTBCLENBQUM7SUFDaEYsTUFBTSxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsZ0JBQWdCLElBQUksMEJBQTBCLENBQUM7SUFDaEYsTUFBTSxrQkFBa0IsR0FBRyxPQUFPLENBQUMsa0JBQWtCLElBQUksNEJBQTRCLENBQUM7SUFDdEYsTUFBTSxvQkFBb0IsR0FDekIsT0FBTyxDQUFDLG9CQUFvQixJQUFJLDhCQUE4QixDQUFDO0lBQ2hFLE1BQU0sYUFBYSxHQUFHLE9BQU8sQ0FBQyxhQUFhLElBQUksdUJBQXVCLENBQUM7SUFDdkUsTUFBTSxxQkFBcUIsR0FBRyxPQUFPLENBQUMscUJBQXFCLElBQUksQ0FBQyxDQUFDO0lBQ2pFLE1BQU0saUJBQWlCLEdBQUcsT0FBTyxDQUFDLGlCQUFpQixJQUFJLElBQUksQ0FBQztJQUM1RCxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsVUFBVSxJQUFJLElBQUksQ0FBQztJQUM5QyxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzlDLE1BQU0sS0FBSyxHQUFHLElBQUksR0FBRyxFQUE0QixDQUFDO0lBQ2xELE1BQU0sUUFBUSxHQUFHLElBQUksR0FBRyxFQUFpRixDQUFDO0lBRTFHLFNBQVMsUUFBUSxDQUFDLGdCQUF3QixFQUFFLEdBQVc7UUFDdEQsT0FBTyxHQUFHLGdCQUFnQixLQUFLLEdBQUcsRUFBRSxDQUFDO0lBQ3RDLENBQUM7SUFFRCxTQUFTLGdCQUFnQixDQUN4QixnQkFBd0IsRUFDeEIsTUFBZTtRQU1mLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDMUQsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pDLElBQUksQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUMxQixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFDRCxJQUNDLENBQUMsS0FBSyxDQUFDLGNBQWM7WUFDckIsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQzVDLENBQUM7WUFDRixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsZ0JBQWdCLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUM1RCxNQUFNLGlCQUFpQixHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ2xFLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxVQUFVLENBQUMsYUFBYSxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUM7WUFDM0QsT0FBTyxPQUFPLENBQUMsd0NBQWdDLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUMxRSxDQUFDO1FBQ0QsT0FBTztZQUNOLE9BQU8sRUFBRSxJQUFJO1lBQ2IsS0FBSyxFQUFFLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxZQUFZLEVBQUU7U0FDekMsQ0FBQztJQUNILENBQUM7SUFFRCxLQUFLLFVBQVUsY0FBYyxDQUM1QixTQUE4QixFQUM5QixZQUFvQjtRQUVwQixNQUFNLFdBQVcsR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUMxQixNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztRQUNoRSxNQUFNLFVBQVUsR0FBRyxJQUFJLEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDMUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDO1FBRTVELElBQUksUUFBZ0QsQ0FBQztRQUNyRCxJQUFJLENBQUM7WUFDSixRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FDdEMsVUFBVSxDQUFDLElBQUksRUFDZixFQUFFLE1BQU0sRUFBRSw0QkFBNEIsRUFBRSxFQUN4QztnQkFDQyxRQUFRLEVBQUUsS0FBSztnQkFDZixPQUFPLEVBQUUsZ0JBQWdCO2dCQUN6QixZQUFZLEVBQUUsQ0FBQztnQkFDZixnQkFBZ0IsRUFBRSxnQkFBZ0I7Z0JBQ2xDLGFBQWEsRUFBRSxnQkFBZ0I7Z0JBQy9CLFlBQVksRUFBRSxNQUFNO2FBQ3BCLENBQ0QsQ0FBQztRQUNILENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLEdBQUcsSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLEdBQUcsRUFBRSxDQUFDO1lBQ2xFLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFDRCxNQUFNLFdBQVcsR0FBRyxXQUFXLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxjQUFjLENBQUMsQ0FBQztRQUNsRSxJQUNDLENBQUMsV0FBVztZQUNaLFdBQVcsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRTtnQkFDaEQsNEJBQTRCLEVBQzVCLENBQUM7WUFDRixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUMxQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDWixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBQ0QsSUFBSSxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLEdBQUcsZ0JBQWdCLEVBQUUsQ0FBQztZQUNuRSxPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFDRCxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzlCLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFFRCxJQUFJLE1BQStCLENBQUM7UUFDcEMsSUFBSSxpQkFBMEMsQ0FBQztRQUMvQyxJQUFJLENBQUM7WUFDSixNQUFNLEdBQUcsSUFBQSw0QkFBcUIsRUFBQyxLQUFLLENBQUMsQ0FBQztZQUN0QyxpQkFBaUIsR0FBRyxJQUFBLGdCQUFTLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFDdEMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNSLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUNDLE1BQU0sQ0FBQyxHQUFHLEtBQUssZ0JBQWdCO1lBQy9CLE9BQU8sTUFBTSxDQUFDLEdBQUcsS0FBSyxRQUFRO1lBQzlCLENBQUMsTUFBTSxDQUFDLEdBQUc7WUFDWCxNQUFNLENBQUMsR0FBRyxLQUFLLE1BQU07WUFDckIsT0FBTyxNQUFNLENBQUMsR0FBRyxLQUFLLFFBQVE7WUFDOUIsQ0FBQyxNQUFNLENBQUMsR0FBRztZQUNYLE1BQU0sQ0FBQyxHQUFHLEtBQUssU0FBUztZQUN4QixNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVM7WUFDeEIsTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTO1lBQ3hCLE1BQU0sQ0FBQyxHQUFHLEtBQUssU0FBUztZQUN4QixNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVM7WUFDeEIsQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLFNBQVM7Z0JBQ3pCLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUN4RCxDQUFDO1lBQ0YsT0FBTyxPQUFPLENBQUMsd0NBQWdDLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDaEUsQ0FBQztRQUNELElBQ0MsaUJBQWlCLENBQUMsR0FBRyxLQUFLLFlBQVk7WUFDdEMsaUJBQWlCLENBQUMsR0FBRyxLQUFLLFNBQVMsQ0FBQyxHQUFHLEVBQ3RDLENBQUM7WUFDRixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBRUQsTUFBTSxTQUFTLEdBQUcsTUFBTSxPQUFPLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDO1lBQ3hELFVBQVUsRUFBRSxZQUFZO1lBQ3hCLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztZQUNmLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztZQUNmLFNBQVMsRUFBRSxhQUFhO1NBQ3hCLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDeEIsT0FBTyxPQUFPLENBQUMsd0NBQWdDLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUMxRSxDQUFDO1FBRUQsSUFBSSxHQUEwQyxDQUFDO1FBQy9DLElBQUksQ0FBQztZQUNKLEdBQUcsR0FBRyxNQUFNLElBQUEsZ0JBQVMsRUFBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDeEQsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNSLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLHNCQUFzQixDQUFDLENBQUM7UUFDekUsQ0FBQztRQUVELElBQUksT0FBZ0MsQ0FBQztRQUNyQyxJQUFJLENBQUM7WUFDSixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUEsZ0JBQVMsRUFBQyxLQUFLLEVBQUUsR0FBRyxFQUFFO2dCQUM1QyxVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDO2dCQUN4QixNQUFNLEVBQUUsWUFBWTtnQkFDcEIsT0FBTyxFQUFFLFNBQVMsQ0FBQyxHQUFHO2dCQUN0QixjQUFjLEVBQUUscUJBQXFCO2dCQUNyQyxXQUFXO2FBQ1gsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUM7UUFDNUIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDaEIsSUFDQyxLQUFLLFlBQVksS0FBSztnQkFDdEIsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFlBQVk7b0JBQzNCLEtBQUssQ0FBQyxJQUFJLEtBQUssMEJBQTBCLENBQUMsRUFDMUMsQ0FBQztnQkFDRixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1lBQ3BFLENBQUM7WUFDRCxPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFFRCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDO1FBQzdCLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDOUIsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQztRQUN4QixNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQ3ZDLElBQ0MsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUM7WUFDL0IsQ0FBQyxpQkFBaUIsSUFBSSxDQUFDLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ3ZELENBQUMsU0FBUyxLQUFLLFNBQVMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQzdELENBQUMsVUFBVSxJQUFJLENBQUMsaUJBQWlCLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDdkMsQ0FBQyxHQUFHLEtBQUssU0FBUyxJQUFJLENBQUMsaUJBQWlCLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDOUMsQ0FBQyxPQUFPLEdBQUcsS0FBSyxRQUFRLElBQUksR0FBRyxHQUFHLGFBQWEsQ0FBQztZQUNoRCxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7WUFDckIsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxJQUFxQixDQUFDO1lBQ3ZELE9BQU8sVUFBVSxDQUFDLEdBQUcsS0FBSyxRQUFRO1lBQ2xDLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQzlCLENBQUM7WUFDRixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsSUFDQyxRQUFRLEdBQUcsY0FBYyxHQUFHLHFCQUFxQjtZQUNqRCxDQUFDLE9BQU8sU0FBUyxLQUFLLFFBQVE7Z0JBQzdCLENBQUMsU0FBUyxJQUFJLGNBQWMsR0FBRyxxQkFBcUI7b0JBQ25ELFFBQVEsSUFBSSxTQUFTLENBQUMsQ0FBQyxFQUN4QixDQUFDO1lBQ0YsT0FBTyxPQUFPLENBQUMsd0NBQWdDLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUNwRSxDQUFDO1FBRUQsSUFBSSxVQUFzQixDQUFDO1FBQzNCLElBQUksQ0FBQztZQUNKLFVBQVUsR0FBRyxJQUFBLG9CQUFhLEVBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzVDLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsSUFDQyxVQUFVLENBQUMsVUFBVSxLQUFLLENBQUM7WUFDM0IsVUFBVSxDQUFDLFVBQVUsR0FBRyxrQkFBa0IsRUFDekMsQ0FBQztZQUNGLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDbkUsQ0FBQztRQUNELE1BQU0sUUFBUSxHQUFHLGNBQWMsQ0FBQyxVQUFVLEVBQUUsb0JBQW9CLENBQUMsQ0FBQztRQUNsRSxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU87WUFBRSxPQUFPLFFBQVEsQ0FBQztRQUN2QyxJQUFJLFFBQVEsQ0FBQyxLQUFLLENBQUMsVUFBVSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3JDLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7UUFFRCxNQUFNLGtCQUFrQixHQUN2QixPQUFPLFNBQVMsS0FBSyxRQUFRO1lBQzVCLENBQUMsQ0FBQyxTQUFTO1lBQ1gsQ0FBQyxDQUFDLGNBQWMsR0FBRyxDQUFDLE9BQU8sR0FBRyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN6RCxNQUFNLGFBQWEsR0FDbEIsT0FBTyxHQUFHLEtBQUssUUFBUTtZQUN0QixDQUFDLENBQUMsR0FBRztZQUNMLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxrQkFBa0IsR0FBRyxjQUFjLENBQUMsQ0FBQztRQUNyRCxNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUM1RCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUMxQixXQUFXLENBQUMsT0FBTyxFQUFFLEdBQUcsWUFBWSxHQUFHLElBQUksRUFDM0Msa0JBQWtCLEdBQUcsSUFBSSxDQUN6QixDQUFDO1FBQ0YsT0FBTztZQUNOLE9BQU8sRUFBRSxJQUFJO1lBQ2IsS0FBSyxFQUFFO2dCQUNOLEtBQUssRUFBRSxRQUFRLENBQUMsS0FBSztnQkFDckIsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFjO2dCQUMvQixHQUFHLEVBQUUsU0FBUyxDQUFDLEdBQUc7Z0JBQ2xCLE1BQU0sRUFBRSxZQUFZO2dCQUNwQixRQUFRO2dCQUNSLFNBQVMsRUFBRSxrQkFBa0I7Z0JBQzdCLEdBQUcsRUFBRSxZQUFZO2dCQUNqQixHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUc7Z0JBQ2YsVUFBVTthQUNWO1NBQ0QsQ0FBQztJQUNILENBQUM7SUFFRCxLQUFLLFVBQVUsVUFBVSxDQUN4QixnQkFBd0IsRUFDeEIsU0FBOEIsRUFDOUIsWUFBb0IsRUFDcEIsWUFBcUI7UUFFckIsTUFBTSxHQUFHLEdBQUcsUUFBUSxDQUFDLGdCQUFnQixFQUFFLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN0RCxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzlCLElBQUksQ0FBQyxZQUFZLElBQUksTUFBTSxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxHQUFHLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7WUFDMUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFhLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUN4RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ25CLE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDbEMsSUFBSSxPQUFPO2dCQUFFLE9BQU8sT0FBTyxDQUFDO1FBQzdCLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxjQUFjLENBQUMsU0FBUyxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQ3hELElBQUksQ0FBQyxZQUFZO1lBQUUsUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDOUMsSUFBSSxDQUFDO1lBQ0osTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUM7WUFDN0IsSUFBSSxNQUFNLENBQUMsT0FBTztnQkFBRSxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUM1RCxPQUFPLE1BQU0sQ0FBQztRQUNmLENBQUM7Z0JBQVMsQ0FBQztZQUNWLElBQUksQ0FBQyxZQUFZO2dCQUFFLFFBQVEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDekMsQ0FBQztJQUNGLENBQUM7SUFFRCxPQUFPO1FBQ04sS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sRUFBRSxZQUFZLEdBQUcsS0FBSyxFQUFFO1lBQzlELE1BQU0sT0FBTyxHQUFHLGdCQUFnQixDQUFDLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQzNELElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTztnQkFBRSxPQUFPLE9BQU8sQ0FBQztZQUNyQyxNQUFNLEVBQUUsU0FBUyxFQUFFLFlBQVksRUFBRSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUM7WUFDbEQsTUFBTSxJQUFJLEdBQUcsTUFBTSxVQUFVLENBQzVCLGdCQUFnQixFQUNoQixTQUFTLEVBQ1QsWUFBWSxFQUNaLFlBQVksQ0FDWixDQUFDO1lBQ0YsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPO2dCQUFFLE9BQU8sSUFBSSxDQUFDO1lBRS9CLE1BQU0sU0FBUyxHQUFHLFNBQVMsQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7WUFDbEQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztnQkFDdEMsT0FBTyxPQUFPLENBQUMsd0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7WUFDbEUsQ0FBQztZQUNELE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQzVDLElBQUksU0FBUyxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxDQUFDO2dCQUM5QyxPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztZQUNsRSxDQUFDO1lBQ0QsTUFBTSxLQUFLLEdBQUcsU0FBUyxHQUFHLENBQUMsQ0FBQztZQUM1QixNQUFNLElBQUksR0FBRyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUN4QyxNQUFNLFdBQVcsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLEtBQUssQ0FBQyxHQUFHLElBQUksQ0FBQztZQUNsRSxPQUFPO2dCQUNOLE9BQU8sRUFBRSxJQUFJO2dCQUNiLEtBQUssRUFBRTtvQkFDTixNQUFNLEVBQUUsVUFBVSxDQUFDLFdBQVcsQ0FBQztvQkFDL0IsV0FBVztvQkFDWCxLQUFLLEVBQUUsU0FBUyxDQUFDLEdBQUc7b0JBQ3BCLElBQUksRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUk7b0JBQ3JCLEdBQUcsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUc7b0JBQ25CLE1BQU0sRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU07b0JBQ3pCLFFBQVEsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVE7b0JBQzdCLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVM7b0JBQy9CLEdBQUcsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUc7b0JBQ25CLEdBQUcsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUc7aUJBQ25CO2FBQ0QsQ0FBQztRQUNILENBQUM7UUFFRCxVQUFVLENBQUMsR0FBWTtZQUN0QixJQUFJLEdBQUcsS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDdkIsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUNkLE9BQU87WUFDUixDQUFDO1lBQ0QsTUFBTSxVQUFVLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDM0MsS0FBSyxNQUFNLEdBQUcsSUFBSSxLQUFLLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztnQkFDaEMsSUFBSSxVQUFVLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxLQUFLLFVBQVUsRUFBRSxDQUFDO29CQUFFLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDdEUsQ0FBQztRQUNGLENBQUM7S0FDRCxDQUFDO0FBQ0gsQ0FBQyJ9
|