ubid-common 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (129) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +20 -0
  3. package/dist/ParsingEngine.d.ts +3 -0
  4. package/dist/ParsingEngine.d.ts.map +1 -0
  5. package/dist/ParsingEngine.js +25 -0
  6. package/dist/PublicKeyResolverEngine.d.ts +3 -0
  7. package/dist/PublicKeyResolverEngine.d.ts.map +1 -0
  8. package/dist/PublicKeyResolverEngine.js +24 -0
  9. package/dist/VerifyingEngine.d.ts +3 -0
  10. package/dist/VerifyingEngine.d.ts.map +1 -0
  11. package/dist/VerifyingEngine.js +27 -0
  12. package/dist/credential-parsers/MsoMdocParser.d.ts +6 -0
  13. package/dist/credential-parsers/MsoMdocParser.d.ts.map +1 -0
  14. package/dist/credential-parsers/MsoMdocParser.js +164 -0
  15. package/dist/credential-parsers/SDJWTVCParser.d.ts +6 -0
  16. package/dist/credential-parsers/SDJWTVCParser.d.ts.map +1 -0
  17. package/dist/credential-parsers/SDJWTVCParser.js +214 -0
  18. package/dist/credential-verifiers/MsoMdocVerifier.d.ts +8 -0
  19. package/dist/credential-verifiers/MsoMdocVerifier.d.ts.map +1 -0
  20. package/dist/credential-verifiers/MsoMdocVerifier.js +213 -0
  21. package/dist/credential-verifiers/SDJWTVCValidation.d.ts +52 -0
  22. package/dist/credential-verifiers/SDJWTVCValidation.d.ts.map +1 -0
  23. package/dist/credential-verifiers/SDJWTVCValidation.js +248 -0
  24. package/dist/credential-verifiers/SDJWTVCVerifier.d.ts +15 -0
  25. package/dist/credential-verifiers/SDJWTVCVerifier.d.ts.map +1 -0
  26. package/dist/credential-verifiers/SDJWTVCVerifier.js +394 -0
  27. package/dist/defaultHttpClient.d.ts +3 -0
  28. package/dist/defaultHttpClient.d.ts.map +1 -0
  29. package/dist/defaultHttpClient.js +18 -0
  30. package/dist/error.d.ts +134 -0
  31. package/dist/error.d.ts.map +1 -0
  32. package/dist/error.js +160 -0
  33. package/dist/functions/convertDataUriToImage.d.ts +2 -0
  34. package/dist/functions/convertDataUriToImage.d.ts.map +1 -0
  35. package/dist/functions/convertDataUriToImage.js +38 -0
  36. package/dist/functions/convertOpenid4vciToSdjwtvcClaims.d.ts +5 -0
  37. package/dist/functions/convertOpenid4vciToSdjwtvcClaims.d.ts.map +1 -0
  38. package/dist/functions/convertOpenid4vciToSdjwtvcClaims.js +31 -0
  39. package/dist/functions/convertSdjwtvcToOpenid4vciClaims.d.ts +11 -0
  40. package/dist/functions/convertSdjwtvcToOpenid4vciClaims.d.ts.map +1 -0
  41. package/dist/functions/convertSdjwtvcToOpenid4vciClaims.js +35 -0
  42. package/dist/functions/convertSdjwtvcToOpenid4vciDisplay.d.ts +19 -0
  43. package/dist/functions/convertSdjwtvcToOpenid4vciDisplay.d.ts.map +1 -0
  44. package/dist/functions/convertSdjwtvcToOpenid4vciDisplay.js +56 -0
  45. package/dist/functions/formatDate.d.ts +2 -0
  46. package/dist/functions/formatDate.d.ts.map +1 -0
  47. package/dist/functions/formatDate.js +50 -0
  48. package/dist/functions/index.d.ts +3 -0
  49. package/dist/functions/index.d.ts.map +1 -0
  50. package/dist/functions/index.js +19 -0
  51. package/dist/functions/openID4VCICredentialRendering.d.ts +5 -0
  52. package/dist/functions/openID4VCICredentialRendering.d.ts.map +1 -0
  53. package/dist/functions/openID4VCICredentialRendering.js +93 -0
  54. package/dist/index.d.ts +19 -0
  55. package/dist/index.d.ts.map +1 -0
  56. package/dist/index.js +35 -0
  57. package/dist/interfaces.d.ts +112 -0
  58. package/dist/interfaces.d.ts.map +1 -0
  59. package/dist/interfaces.js +3 -0
  60. package/dist/rendering.d.ts +3 -0
  61. package/dist/rendering.d.ts.map +1 -0
  62. package/dist/rendering.js +56 -0
  63. package/dist/resolvers/RemoteJwksResolver.d.ts +17 -0
  64. package/dist/resolvers/RemoteJwksResolver.d.ts.map +1 -0
  65. package/dist/resolvers/RemoteJwksResolver.js +138 -0
  66. package/dist/schemas/CredentialConfigurationSupportedSchema.d.ts +710 -0
  67. package/dist/schemas/CredentialConfigurationSupportedSchema.d.ts.map +1 -0
  68. package/dist/schemas/CredentialConfigurationSupportedSchema.js +60 -0
  69. package/dist/schemas/CredentialOfferSchema.d.ts +40 -0
  70. package/dist/schemas/CredentialOfferSchema.d.ts.map +1 -0
  71. package/dist/schemas/CredentialOfferSchema.js +14 -0
  72. package/dist/schemas/OpenidAuthorizationServerMetadataSchema.d.ts +49 -0
  73. package/dist/schemas/OpenidAuthorizationServerMetadataSchema.d.ts.map +1 -0
  74. package/dist/schemas/OpenidAuthorizationServerMetadataSchema.js +21 -0
  75. package/dist/schemas/OpenidCredentialIssuerMetadataSchema.d.ts +1030 -0
  76. package/dist/schemas/OpenidCredentialIssuerMetadataSchema.d.ts.map +1 -0
  77. package/dist/schemas/OpenidCredentialIssuerMetadataSchema.js +35 -0
  78. package/dist/schemas/SdJwtVcPayloadSchema.d.ts +79 -0
  79. package/dist/schemas/SdJwtVcPayloadSchema.d.ts.map +1 -0
  80. package/dist/schemas/SdJwtVcPayloadSchema.js +27 -0
  81. package/dist/schemas/SdJwtVcTypeMetadataSchema.d.ts +930 -0
  82. package/dist/schemas/SdJwtVcTypeMetadataSchema.d.ts.map +1 -0
  83. package/dist/schemas/SdJwtVcTypeMetadataSchema.js +105 -0
  84. package/dist/schemas/index.d.ts +6 -0
  85. package/dist/schemas/index.d.ts.map +1 -0
  86. package/dist/schemas/index.js +22 -0
  87. package/dist/status/TokenStatusListVerifier.d.ts +41 -0
  88. package/dist/status/TokenStatusListVerifier.d.ts.map +1 -0
  89. package/dist/status/TokenStatusListVerifier.js +410 -0
  90. package/dist/trust/AlgorithmPolicy.d.ts +27 -0
  91. package/dist/trust/AlgorithmPolicy.d.ts.map +1 -0
  92. package/dist/trust/AlgorithmPolicy.js +60 -0
  93. package/dist/trust/TrustRegistry.d.ts +49 -0
  94. package/dist/trust/TrustRegistry.d.ts.map +1 -0
  95. package/dist/trust/TrustRegistry.js +114 -0
  96. package/dist/types.d.ts +76 -0
  97. package/dist/types.d.ts.map +1 -0
  98. package/dist/types.js +10 -0
  99. package/dist/utils/escapeSVG.d.ts +2 -0
  100. package/dist/utils/escapeSVG.d.ts.map +1 -0
  101. package/dist/utils/escapeSVG.js +18 -0
  102. package/dist/utils/getIssuerMetadata.d.ts +8 -0
  103. package/dist/utils/getIssuerMetadata.d.ts.map +1 -0
  104. package/dist/utils/getIssuerMetadata.js +33 -0
  105. package/dist/utils/getSdJwtVcMetadata.d.ts +12 -0
  106. package/dist/utils/getSdJwtVcMetadata.d.ts.map +1 -0
  107. package/dist/utils/getSdJwtVcMetadata.js +274 -0
  108. package/dist/utils/index.d.ts +2 -0
  109. package/dist/utils/index.d.ts.map +1 -0
  110. package/dist/utils/index.js +6 -0
  111. package/dist/utils/matchLocalizedDisplay.d.ts +6 -0
  112. package/dist/utils/matchLocalizedDisplay.d.ts.map +1 -0
  113. package/dist/utils/matchLocalizedDisplay.js +16 -0
  114. package/dist/utils/util.d.ts +6 -0
  115. package/dist/utils/util.d.ts.map +1 -0
  116. package/dist/utils/util.js +53 -0
  117. package/dist/utils/verifyCertificate.d.ts +2 -0
  118. package/dist/utils/verifyCertificate.d.ts.map +1 -0
  119. package/dist/utils/verifyCertificate.js +100 -0
  120. package/dist/utils/verifySRIFromObject.d.ts +10 -0
  121. package/dist/utils/verifySRIFromObject.d.ts.map +1 -0
  122. package/dist/utils/verifySRIFromObject.js +32 -0
  123. package/dist/utils/verifyX5C.d.ts +11 -0
  124. package/dist/utils/verifyX5C.d.ts.map +1 -0
  125. package/dist/utils/verifyX5C.js +19 -0
  126. package/dist/x509/X509ChainVerifier.d.ts +59 -0
  127. package/dist/x509/X509ChainVerifier.d.ts.map +1 -0
  128. package/dist/x509/X509ChainVerifier.js +458 -0
  129. package/package.json +82 -0
@@ -0,0 +1 @@
1
+ {"version":3,"file":"SdJwtVcTypeMetadataSchema.d.ts","sourceRoot":"","sources":["../../src/schemas/SdJwtVcTypeMetadataSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+DAA+D;AAC/D,eAAO,MAAM,eAAe,aAAoB,CAAC;AAEjD,eAAO,MAAM,GAAG,aAAmB,CAAC;AAEpC,eAAO,MAAM,SAAS,aAAoB,CAAC;AAE3C,yEAAyE;AACzE,eAAO,MAAM,SAAS,6EAEV,CAAC;AAEb,kDAAkD;AAClD,eAAO,MAAM,KAAK,aAA+C,CAAC;AAElE,sDAAsD;AACtD,eAAO,MAAM,YAAY;;;;;;;;;;;;EAIvB,CAAC;AAEH,6DAA6D;AAC7D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ1B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;EAOjC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI3B,CAAC;AAoBH,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK3B,CAAC;AAEH,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAI5B,CAAC;AAEH,oDAAoD;AACpD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM7B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BtB,CAAC;AAEJ,2CAA2C;AAC3C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAChE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAClD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
@@ -0,0 +1,105 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.TypeMetadata = exports.ClaimMetadataEntry = exports.ClaimDisplayEntry = exports.TypeDisplayEntry = exports.SvgTemplateEntry = exports.SvgTemplateProperties = exports.RenderingSimple = exports.LogoMetadata = exports.SvgId = exports.ClaimPath = exports.LocaleTag = exports.Uri = exports.IntegrityString = void 0;
4
+ const zod_1 = require("zod");
5
+ /** Integrity string per W3C SRI, e.g., "sha256-<base64url>" */
6
+ exports.IntegrityString = zod_1.z.string().min(1);
7
+ exports.Uri = zod_1.z.string().url();
8
+ exports.LocaleTag = zod_1.z.string().min(1);
9
+ /** Claim path per §9.1: array of string | null | non-negative integer */
10
+ exports.ClaimPath = zod_1.z.array(zod_1.z.union([zod_1.z.string(), zod_1.z.null(), zod_1.z.number().int().nonnegative()])).nonempty();
11
+ /** svg_id: [A-Za-z_][A-Za-z0-9_]* per §8.1.2.2 */
12
+ exports.SvgId = zod_1.z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
13
+ /** ---------- §8.1.1 "simple" rendering ---------- */
14
+ exports.LogoMetadata = zod_1.z.object({
15
+ uri: exports.Uri, // REQUIRED
16
+ ["uri#integrity"]: exports.IntegrityString.optional(),
17
+ alt_text: zod_1.z.string().optional(),
18
+ });
19
+ /** ---------- §8.1.2 "svg_templates" rendering ---------- */
20
+ exports.RenderingSimple = zod_1.z.object({
21
+ logo: exports.LogoMetadata.optional(),
22
+ background_image: zod_1.z.object({
23
+ uri: exports.Uri,
24
+ ["uri#integrity"]: exports.IntegrityString.optional(),
25
+ }).optional(),
26
+ background_color: zod_1.z.string().optional(), // CSS color; keep as string
27
+ text_color: zod_1.z.string().optional(), // CSS color; keep as string
28
+ });
29
+ exports.SvgTemplateProperties = zod_1.z.object({
30
+ orientation: zod_1.z.enum(["portrait", "landscape"]).optional(),
31
+ color_scheme: zod_1.z.enum(["light", "dark"]).optional(),
32
+ contrast: zod_1.z.enum(["normal", "high"]).optional(),
33
+ }).refine((o) => o.orientation !== undefined || o.color_scheme !== undefined || o.contrast !== undefined, { message: "svg_template.properties must contain at least one of orientation, color_scheme, contrast" });
34
+ exports.SvgTemplateEntry = zod_1.z.object({
35
+ uri: exports.Uri, // REQUIRED
36
+ ["uri#integrity"]: exports.IntegrityString.optional(),
37
+ properties: exports.SvgTemplateProperties.optional(), // REQUIRED if >1 template; enforced at array level
38
+ });
39
+ const Rendering = zod_1.z.object({
40
+ simple: exports.RenderingSimple.optional(),
41
+ svg_templates: zod_1.z.array(exports.SvgTemplateEntry).optional(), // optional here
42
+ }).superRefine((val, ctx) => {
43
+ const arr = val.svg_templates;
44
+ if (arr && arr.length > 1) {
45
+ arr.forEach((t, i) => {
46
+ if (!t.properties) {
47
+ ctx.addIssue({
48
+ code: zod_1.z.ZodIssueCode.custom,
49
+ message: `rendering.svg_templates[${i}].properties is required when more than one template is present`,
50
+ path: ["svg_templates", i, "properties"],
51
+ });
52
+ }
53
+ });
54
+ }
55
+ });
56
+ /** ---------- §8 Display metadata for the TYPE ---------- */
57
+ exports.TypeDisplayEntry = zod_1.z.object({
58
+ locale: exports.LocaleTag, // REQUIRED
59
+ name: zod_1.z.string().min(1), // REQUIRED
60
+ description: zod_1.z.string().optional(),
61
+ rendering: Rendering.optional(),
62
+ });
63
+ /** ---------- §9.2 Display metadata for CLAIMS ---------- */
64
+ exports.ClaimDisplayEntry = zod_1.z.object({
65
+ locale: exports.LocaleTag, // REQUIRED
66
+ label: zod_1.z.string().min(1), // REQUIRED
67
+ description: zod_1.z.string().optional(),
68
+ });
69
+ /** ---------- §9 Claim metadata entry ---------- */
70
+ exports.ClaimMetadataEntry = zod_1.z.object({
71
+ path: exports.ClaimPath, // REQUIRED
72
+ display: zod_1.z.array(exports.ClaimDisplayEntry).optional(), // §9.2
73
+ mandatory: zod_1.z.boolean().optional(), // §9.3 d12
74
+ sd: zod_1.z.enum(["always", "allowed", "never"]).optional(), // §9.3 (default "allowed")
75
+ svg_id: exports.SvgId.optional(), // §8.1.2.2
76
+ });
77
+ /** ---------- §6.2 Type Metadata Document ---------- */
78
+ exports.TypeMetadata = zod_1.z.object({
79
+ vct: zod_1.z.string(),
80
+ name: zod_1.z.string().optional(),
81
+ description: zod_1.z.string().optional(),
82
+ extends: zod_1.z.string().optional(),
83
+ ["extends#integrity"]: exports.IntegrityString.optional(),
84
+ display: zod_1.z.array(exports.TypeDisplayEntry).optional(), // §8
85
+ claims: zod_1.z.array(exports.ClaimMetadataEntry).optional(), // §9
86
+ // §7 integrity for the vct reference when used
87
+ ["vct#integrity"]: exports.IntegrityString.optional(),
88
+ })
89
+ .strip() // remove unknown fields but don't error
90
+ .superRefine((val, ctx) => {
91
+ const ids = new Set();
92
+ val.claims?.forEach((c, i) => {
93
+ if (c.svg_id) {
94
+ if (ids.has(c.svg_id)) {
95
+ ctx.addIssue({
96
+ code: zod_1.z.ZodIssueCode.custom,
97
+ message: `svg_id "${c.svg_id}" must be unique within the type metadata`,
98
+ path: ["claims", i, "svg_id"],
99
+ });
100
+ }
101
+ ids.add(c.svg_id);
102
+ }
103
+ });
104
+ });
105
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2RKd3RWY1R5cGVNZXRhZGF0YVNjaGVtYS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zY2hlbWFzL1NkSnd0VmNUeXBlTWV0YWRhdGFTY2hlbWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsNkJBQXdCO0FBRXhCLCtEQUErRDtBQUNsRCxRQUFBLGVBQWUsR0FBRyxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRXBDLFFBQUEsR0FBRyxHQUFHLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLEVBQUUsQ0FBQztBQUV2QixRQUFBLFNBQVMsR0FBRyxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRTNDLHlFQUF5RTtBQUM1RCxRQUFBLFNBQVMsR0FBRyxPQUFDLENBQUMsS0FBSyxDQUMvQixPQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLE9BQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUMvRCxDQUFDLFFBQVEsRUFBRSxDQUFDO0FBRWIsa0RBQWtEO0FBQ3JDLFFBQUEsS0FBSyxHQUFHLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztBQUVsRSxzREFBc0Q7QUFDekMsUUFBQSxZQUFZLEdBQUcsT0FBQyxDQUFDLE1BQU0sQ0FBQztJQUNwQyxHQUFHLEVBQUUsV0FBRyxFQUErQixXQUFXO0lBQ2xELENBQUMsZUFBZSxDQUFDLEVBQUUsdUJBQWUsQ0FBQyxRQUFRLEVBQUU7SUFDN0MsUUFBUSxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUU7Q0FDL0IsQ0FBQyxDQUFDO0FBRUgsNkRBQTZEO0FBQ2hELFFBQUEsZUFBZSxHQUFHLE9BQUMsQ0FBQyxNQUFNLENBQUM7SUFDdkMsSUFBSSxFQUFFLG9CQUFZLENBQUMsUUFBUSxFQUFFO0lBQzdCLGdCQUFnQixFQUFFLE9BQUMsQ0FBQyxNQUFNLENBQUM7UUFDMUIsR0FBRyxFQUFFLFdBQUc7UUFDUixDQUFDLGVBQWUsQ0FBQyxFQUFFLHVCQUFlLENBQUMsUUFBUSxFQUFFO0tBQzdDLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDYixnQkFBZ0IsRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQUUsNEJBQTRCO0lBQ3JFLFVBQVUsRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQVEsNEJBQTRCO0NBQ3JFLENBQUMsQ0FBQztBQUVVLFFBQUEscUJBQXFCLEdBQUcsT0FBQyxDQUFDLE1BQU0sQ0FBQztJQUM3QyxXQUFXLEVBQUUsT0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUN6RCxZQUFZLEVBQUUsT0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUNsRCxRQUFRLEVBQUUsT0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtDQUMvQyxDQUFDLENBQUMsTUFBTSxDQUNSLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxLQUFLLFNBQVMsSUFBSSxDQUFDLENBQUMsWUFBWSxLQUFLLFNBQVMsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFDOUYsRUFBRSxPQUFPLEVBQUUsMEZBQTBGLEVBQUUsQ0FDdkcsQ0FBQztBQUVXLFFBQUEsZ0JBQWdCLEdBQUcsT0FBQyxDQUFDLE1BQU0sQ0FBQztJQUN4QyxHQUFHLEVBQUUsV0FBRyxFQUFpQyxXQUFXO0lBQ3BELENBQUMsZUFBZSxDQUFDLEVBQUUsdUJBQWUsQ0FBQyxRQUFRLEVBQUU7SUFDN0MsVUFBVSxFQUFFLDZCQUFxQixDQUFDLFFBQVEsRUFBRSxFQUFFLG1EQUFtRDtDQUNqRyxDQUFDLENBQUM7QUFFSCxNQUFNLFNBQVMsR0FBRyxPQUFDLENBQUMsTUFBTSxDQUFDO0lBQzFCLE1BQU0sRUFBRSx1QkFBZSxDQUFDLFFBQVEsRUFBRTtJQUNsQyxhQUFhLEVBQUUsT0FBQyxDQUFDLEtBQUssQ0FBQyx3QkFBZ0IsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLGdCQUFnQjtDQUNyRSxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFO0lBQzNCLE1BQU0sR0FBRyxHQUFHLEdBQUcsQ0FBQyxhQUFhLENBQUM7SUFDOUIsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMzQixHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFO1lBQ3BCLElBQUksQ0FBQyxDQUFDLENBQUMsVUFBVSxFQUFFLENBQUM7Z0JBQ25CLEdBQUcsQ0FBQyxRQUFRLENBQUM7b0JBQ1osSUFBSSxFQUFFLE9BQUMsQ0FBQyxZQUFZLENBQUMsTUFBTTtvQkFDM0IsT0FBTyxFQUFFLDJCQUEyQixDQUFDLGlFQUFpRTtvQkFDdEcsSUFBSSxFQUFFLENBQUMsZUFBZSxFQUFFLENBQUMsRUFBRSxZQUFZLENBQUM7aUJBQ3hDLENBQUMsQ0FBQztZQUNKLENBQUM7UUFDRixDQUFDLENBQUMsQ0FBQztJQUNKLENBQUM7QUFDRixDQUFDLENBQUMsQ0FBQztBQUVILDZEQUE2RDtBQUNoRCxRQUFBLGdCQUFnQixHQUFHLE9BQUMsQ0FBQyxNQUFNLENBQUM7SUFDeEMsTUFBTSxFQUFFLGlCQUFTLEVBQWtCLFdBQVc7SUFDOUMsSUFBSSxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQVEsV0FBVztJQUMxQyxXQUFXLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUNsQyxTQUFTLEVBQUUsU0FBUyxDQUFDLFFBQVEsRUFBRTtDQUMvQixDQUFDLENBQUM7QUFFSCw2REFBNkQ7QUFDaEQsUUFBQSxpQkFBaUIsR0FBRyxPQUFDLENBQUMsTUFBTSxDQUFDO0lBQ3pDLE1BQU0sRUFBRSxpQkFBUyxFQUFrQixXQUFXO0lBQzlDLEtBQUssRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFPLFdBQVc7SUFDMUMsV0FBVyxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUU7Q0FDbEMsQ0FBQyxDQUFDO0FBRUgsb0RBQW9EO0FBQ3ZDLFFBQUEsa0JBQWtCLEdBQUcsT0FBQyxDQUFDLE1BQU0sQ0FBQztJQUMxQyxJQUFJLEVBQUUsaUJBQVMsRUFBcUQsV0FBVztJQUMvRSxPQUFPLEVBQUUsT0FBQyxDQUFDLEtBQUssQ0FBQyx5QkFBaUIsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFzQixPQUFPO0lBQzNFLFNBQVMsRUFBRSxPQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQW1DLFdBQVc7SUFDL0UsRUFBRSxFQUFFLE9BQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQWUsMkJBQTJCO0lBQy9GLE1BQU0sRUFBRSxhQUFLLENBQUMsUUFBUSxFQUFFLEVBQTRDLFdBQVc7Q0FDL0UsQ0FBQyxDQUFDO0FBRUgsd0RBQXdEO0FBQzNDLFFBQUEsWUFBWSxHQUFHLE9BQUMsQ0FBQyxNQUFNLENBQUM7SUFDcEMsR0FBRyxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUU7SUFDZixJQUFJLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUMzQixXQUFXLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUVsQyxPQUFPLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUM5QixDQUFDLG1CQUFtQixDQUFDLEVBQUUsdUJBQWUsQ0FBQyxRQUFRLEVBQUU7SUFFakQsT0FBTyxFQUFFLE9BQUMsQ0FBQyxLQUFLLENBQUMsd0JBQWdCLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBTyxLQUFLO0lBQ3pELE1BQU0sRUFBRSxPQUFDLENBQUMsS0FBSyxDQUFDLDBCQUFrQixDQUFDLENBQUMsUUFBUSxFQUFFLEVBQU0sS0FBSztJQUV6RCwrQ0FBK0M7SUFDL0MsQ0FBQyxlQUFlLENBQUMsRUFBRSx1QkFBZSxDQUFDLFFBQVEsRUFBRTtDQUM3QyxDQUFDO0tBQ0EsS0FBSyxFQUFFLENBQUMsd0NBQXdDO0tBQ2hELFdBQVcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsRUFBRTtJQUN6QixNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQzlCLEdBQUcsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFO1FBQzVCLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ2QsSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO2dCQUN2QixHQUFHLENBQUMsUUFBUSxDQUFDO29CQUNaLElBQUksRUFBRSxPQUFDLENBQUMsWUFBWSxDQUFDLE1BQU07b0JBQzNCLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQyxNQUFNLDJDQUEyQztvQkFDdkUsSUFBSSxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsRUFBRSxRQUFRLENBQUM7aUJBQzdCLENBQUMsQ0FBQztZQUNKLENBQUM7WUFDRCxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNuQixDQUFDO0lBQ0YsQ0FBQyxDQUFDLENBQUM7QUFDSixDQUFDLENBQUMsQ0FBQyJ9
@@ -0,0 +1,6 @@
1
+ export * from './CredentialConfigurationSupportedSchema';
2
+ export * from './CredentialOfferSchema';
3
+ export * from './OpenidAuthorizationServerMetadataSchema';
4
+ export * from './OpenidCredentialIssuerMetadataSchema';
5
+ export * from './SdJwtVcPayloadSchema';
6
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,0CAA0C,CAAC;AACzD,cAAc,yBAAyB,CAAC;AACxC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,wBAAwB,CAAC"}
@@ -0,0 +1,22 @@
1
+ "use strict";
2
+ var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
3
+ if (k2 === undefined) k2 = k;
4
+ var desc = Object.getOwnPropertyDescriptor(m, k);
5
+ if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
6
+ desc = { enumerable: true, get: function() { return m[k]; } };
7
+ }
8
+ Object.defineProperty(o, k2, desc);
9
+ }) : (function(o, m, k, k2) {
10
+ if (k2 === undefined) k2 = k;
11
+ o[k2] = m[k];
12
+ }));
13
+ var __exportStar = (this && this.__exportStar) || function(m, exports) {
14
+ for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
15
+ };
16
+ Object.defineProperty(exports, "__esModule", { value: true });
17
+ __exportStar(require("./CredentialConfigurationSupportedSchema"), exports);
18
+ __exportStar(require("./CredentialOfferSchema"), exports);
19
+ __exportStar(require("./OpenidAuthorizationServerMetadataSchema"), exports);
20
+ __exportStar(require("./OpenidCredentialIssuerMetadataSchema"), exports);
21
+ __exportStar(require("./SdJwtVcPayloadSchema"), exports);
22
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2NoZW1hcy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsMkVBQXlEO0FBQ3pELDBEQUF3QztBQUN4Qyw0RUFBMEQ7QUFDMUQseUVBQXVEO0FBQ3ZELHlEQUF1QyJ9
@@ -0,0 +1,41 @@
1
+ import { TokenStatusListVerificationError } from "../error";
2
+ import { CredentialStatus, HttpClient, PublicKeyResolverEngineI } from "../interfaces";
3
+ import { Result } from "../types";
4
+ import { TrustRegistry } from "../trust/TrustRegistry";
5
+ export interface TokenStatusListVerificationResult {
6
+ status: CredentialStatus;
7
+ statusValue: number;
8
+ index: number;
9
+ bits: number;
10
+ uri: string;
11
+ issuer: string;
12
+ issuedAt: number;
13
+ expiresAt: number;
14
+ ttl: number;
15
+ kid: string;
16
+ }
17
+ export interface TokenStatusListVerifierI {
18
+ verify(args: {
19
+ credentialIssuer: string;
20
+ status: unknown;
21
+ forceRefresh?: boolean;
22
+ }): Promise<Result<TokenStatusListVerificationResult, TokenStatusListVerificationError>>;
23
+ clearCache(uri?: string): void;
24
+ }
25
+ export interface TokenStatusListVerifierOptions {
26
+ trustRegistry: TrustRegistry;
27
+ pkResolverEngine: PublicKeyResolverEngineI;
28
+ httpClient: HttpClient;
29
+ allowedBits?: readonly (1 | 2 | 4 | 8)[];
30
+ clockToleranceSeconds?: number;
31
+ requestTimeoutMs?: number;
32
+ maxResponseBytes?: number;
33
+ maxCompressedBytes?: number;
34
+ maxDecompressedBytes?: number;
35
+ maxTtlSeconds?: number;
36
+ requireExpiration?: boolean;
37
+ requireTtl?: boolean;
38
+ now?: () => Date;
39
+ }
40
+ export declare function TokenStatusListVerifier(options: TokenStatusListVerifierOptions): TokenStatusListVerifierI;
41
+ //# sourceMappingURL=TokenStatusListVerifier.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"TokenStatusListVerifier.d.ts","sourceRoot":"","sources":["../../src/status/TokenStatusListVerifier.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gCAAgC,EAChC,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,gBAAgB,EAChB,UAAU,EACV,wBAAwB,EACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,aAAa,EAAsB,MAAM,wBAAwB,CAAC;AAG3E,MAAM,WAAW,iCAAiC;IACjD,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,wBAAwB;IACxC,MAAM,CAAC,IAAI,EAAE;QACZ,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,OAAO,CAAC;QAChB,YAAY,CAAC,EAAE,OAAO,CAAC;KACvB,GAAG,OAAO,CAAC,MAAM,CAAC,iCAAiC,EAAE,gCAAgC,CAAC,CAAC,CAAC;IACzF,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,8BAA8B;IAC9C,aAAa,EAAE,aAAa,CAAC;IAC7B,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IACzC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACjB;AAqKD,wBAAgB,uBAAuB,CACtC,OAAO,EAAE,8BAA8B,GACrC,wBAAwB,CAgU1B"}
@@ -0,0 +1,410 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.TokenStatusListVerifier = TokenStatusListVerifier;
4
+ const jose_1 = require("jose");
5
+ const pako_1 = require("pako");
6
+ const error_1 = require("../error");
7
+ const util_1 = require("../utils/util");
8
+ const DEFAULT_REQUEST_TIMEOUT_MS = 5_000;
9
+ const DEFAULT_MAX_RESPONSE_BYTES = 256 * 1024;
10
+ const DEFAULT_MAX_COMPRESSED_BYTES = 128 * 1024;
11
+ const DEFAULT_MAX_DECOMPRESSED_BYTES = 512 * 1024;
12
+ const DEFAULT_MAX_TTL_SECONDS = 86_400;
13
+ const COMPACT_JWT = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
14
+ const BASE64URL = /^[A-Za-z0-9_-]+$/;
15
+ function failure(error) {
16
+ return { success: false, error };
17
+ }
18
+ function isObject(value) {
19
+ return typeof value === "object" && value !== null && !Array.isArray(value);
20
+ }
21
+ function isNonNegativeInteger(value) {
22
+ return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
23
+ }
24
+ function isPositiveInteger(value) {
25
+ return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
26
+ }
27
+ function normalizeStatusUri(value) {
28
+ try {
29
+ const url = new URL(value);
30
+ if (url.protocol !== "https:" ||
31
+ url.username ||
32
+ url.password ||
33
+ url.hash) {
34
+ return undefined;
35
+ }
36
+ return url.href;
37
+ }
38
+ catch {
39
+ return undefined;
40
+ }
41
+ }
42
+ function parseReference(status) {
43
+ if (!isObject(status) || !isObject(status.status_list))
44
+ return undefined;
45
+ const idx = status.status_list.idx;
46
+ const uri = status.status_list.uri;
47
+ if (!isNonNegativeInteger(idx) || typeof uri !== "string")
48
+ return undefined;
49
+ const normalizedUri = normalizeStatusUri(uri);
50
+ if (!normalizedUri)
51
+ return undefined;
52
+ return { idx, uri: normalizedUri };
53
+ }
54
+ function responseText(data) {
55
+ if (typeof data === "string")
56
+ return data.trim();
57
+ if (data instanceof Uint8Array) {
58
+ try {
59
+ return new TextDecoder("utf-8", { fatal: true }).decode(data).trim();
60
+ }
61
+ catch {
62
+ return undefined;
63
+ }
64
+ }
65
+ return undefined;
66
+ }
67
+ function headerValue(headers, name) {
68
+ const expected = name.toLowerCase();
69
+ for (const [key, value] of Object.entries(headers ?? {})) {
70
+ if (key.toLowerCase() === expected && typeof value === "string") {
71
+ return value;
72
+ }
73
+ }
74
+ return undefined;
75
+ }
76
+ function statusName(value) {
77
+ if (value === 0)
78
+ return "valid";
79
+ if (value === 1)
80
+ return "revoked";
81
+ if (value === 2)
82
+ return "suspended";
83
+ return "application-specific";
84
+ }
85
+ function inflateBounded(compressed, maxDecompressedBytes) {
86
+ const chunks = [];
87
+ let size = 0;
88
+ try {
89
+ const inflater = new pako_1.Inflate({
90
+ chunkSize: Math.min(16 * 1024, maxDecompressedBytes + 1),
91
+ });
92
+ inflater.onData = (chunk) => {
93
+ size += chunk.byteLength;
94
+ if (size > maxDecompressedBytes) {
95
+ throw new RangeError("Token Status List exceeds the decompression limit");
96
+ }
97
+ chunks.push(new Uint8Array(chunk));
98
+ };
99
+ const completed = inflater.push(compressed, true);
100
+ if (!completed || inflater.err) {
101
+ return failure(error_1.TokenStatusListVerificationError.DecompressionFailed);
102
+ }
103
+ }
104
+ catch (error) {
105
+ if (error instanceof RangeError) {
106
+ return failure(error_1.TokenStatusListVerificationError.DecompressedListTooLarge);
107
+ }
108
+ return failure(error_1.TokenStatusListVerificationError.DecompressionFailed);
109
+ }
110
+ const output = new Uint8Array(size);
111
+ let offset = 0;
112
+ for (const chunk of chunks) {
113
+ output.set(chunk, offset);
114
+ offset += chunk.byteLength;
115
+ }
116
+ return { success: true, value: output };
117
+ }
118
+ function validateOptions(options) {
119
+ const allowedBits = options.allowedBits ?? [2];
120
+ const values = [
121
+ options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,
122
+ options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES,
123
+ options.maxCompressedBytes ?? DEFAULT_MAX_COMPRESSED_BYTES,
124
+ options.maxDecompressedBytes ?? DEFAULT_MAX_DECOMPRESSED_BYTES,
125
+ options.maxTtlSeconds ?? DEFAULT_MAX_TTL_SECONDS,
126
+ ];
127
+ if (allowedBits.length === 0 ||
128
+ new Set(allowedBits).size !== allowedBits.length ||
129
+ allowedBits.some((bits) => ![1, 2, 4, 8].includes(bits)) ||
130
+ values.some((value) => !Number.isSafeInteger(value) || value <= 0) ||
131
+ !Number.isSafeInteger(options.clockToleranceSeconds ?? 0) ||
132
+ (options.clockToleranceSeconds ?? 0) < 0) {
133
+ throw new TypeError("TokenStatusListVerifier options are invalid");
134
+ }
135
+ return Object.freeze([...allowedBits]);
136
+ }
137
+ function TokenStatusListVerifier(options) {
138
+ const allowedBits = validateOptions(options);
139
+ const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
140
+ const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
141
+ const maxCompressedBytes = options.maxCompressedBytes ?? DEFAULT_MAX_COMPRESSED_BYTES;
142
+ const maxDecompressedBytes = options.maxDecompressedBytes ?? DEFAULT_MAX_DECOMPRESSED_BYTES;
143
+ const maxTtlSeconds = options.maxTtlSeconds ?? DEFAULT_MAX_TTL_SECONDS;
144
+ const clockToleranceSeconds = options.clockToleranceSeconds ?? 0;
145
+ const requireExpiration = options.requireExpiration ?? true;
146
+ const requireTtl = options.requireTtl ?? true;
147
+ const now = options.now ?? (() => new Date());
148
+ const cache = new Map();
149
+ const inflight = new Map();
150
+ function cacheKey(credentialIssuer, uri) {
151
+ return `${credentialIssuer}\n${uri}`;
152
+ }
153
+ function trustedReference(credentialIssuer, status) {
154
+ const entry = options.trustRegistry.get(credentialIssuer);
155
+ const reference = parseReference(status);
156
+ if (!entry || !reference) {
157
+ return failure(error_1.TokenStatusListVerificationError.InvalidReference);
158
+ }
159
+ if (!entry.statusListUris ||
160
+ !entry.statusListUris.includes(reference.uri)) {
161
+ return failure(error_1.TokenStatusListVerificationError.StatusListUriNotTrusted);
162
+ }
163
+ const statusIssuer = entry.statusListIssuer ?? entry.issuer;
164
+ const statusIssuerEntry = options.trustRegistry.get(statusIssuer);
165
+ if (!statusIssuerEntry?.algorithms["status-list"]?.length) {
166
+ return failure(error_1.TokenStatusListVerificationError.StatusListUriNotTrusted);
167
+ }
168
+ return {
169
+ success: true,
170
+ value: { entry, reference, statusIssuer },
171
+ };
172
+ }
173
+ async function fetchAndVerify(reference, statusIssuer) {
174
+ const currentDate = now();
175
+ const currentSeconds = Math.floor(currentDate.getTime() / 1000);
176
+ const requestUrl = new URL(reference.uri);
177
+ requestUrl.searchParams.set("time", String(currentSeconds));
178
+ let response;
179
+ try {
180
+ response = await options.httpClient.get(requestUrl.href, { Accept: "application/statuslist+jwt" }, {
181
+ useCache: false,
182
+ timeout: requestTimeoutMs,
183
+ maxRedirects: 0,
184
+ maxContentLength: maxResponseBytes,
185
+ maxBodyLength: maxResponseBytes,
186
+ responseType: "text",
187
+ });
188
+ }
189
+ catch {
190
+ return failure(error_1.TokenStatusListVerificationError.FetchFailed);
191
+ }
192
+ if (!response || response.status < 200 || response.status >= 300) {
193
+ return failure(error_1.TokenStatusListVerificationError.FetchFailed);
194
+ }
195
+ const contentType = headerValue(response.headers, "content-type");
196
+ if (!contentType ||
197
+ contentType.split(";", 1)[0].trim().toLowerCase() !==
198
+ "application/statuslist+jwt") {
199
+ return failure(error_1.TokenStatusListVerificationError.InvalidResponse);
200
+ }
201
+ const token = responseText(response.data);
202
+ if (!token) {
203
+ return failure(error_1.TokenStatusListVerificationError.InvalidResponse);
204
+ }
205
+ if (new TextEncoder().encode(token).byteLength > maxResponseBytes) {
206
+ return failure(error_1.TokenStatusListVerificationError.ResponseTooLarge);
207
+ }
208
+ if (!COMPACT_JWT.test(token)) {
209
+ return failure(error_1.TokenStatusListVerificationError.InvalidResponse);
210
+ }
211
+ let header;
212
+ let unverifiedPayload;
213
+ try {
214
+ header = (0, jose_1.decodeProtectedHeader)(token);
215
+ unverifiedPayload = (0, jose_1.decodeJwt)(token);
216
+ }
217
+ catch {
218
+ return failure(error_1.TokenStatusListVerificationError.InvalidResponse);
219
+ }
220
+ if (header.typ !== "statuslist+jwt" ||
221
+ typeof header.alg !== "string" ||
222
+ !header.alg ||
223
+ header.alg === "none" ||
224
+ typeof header.kid !== "string" ||
225
+ !header.kid ||
226
+ header.b64 !== undefined ||
227
+ header.jku !== undefined ||
228
+ header.x5u !== undefined ||
229
+ header.jwk !== undefined ||
230
+ header.x5c !== undefined ||
231
+ (header.crit !== undefined &&
232
+ (!Array.isArray(header.crit) || header.crit.length > 0))) {
233
+ return failure(error_1.TokenStatusListVerificationError.InvalidHeader);
234
+ }
235
+ if (unverifiedPayload.iss !== statusIssuer ||
236
+ unverifiedPayload.sub !== reference.uri) {
237
+ return failure(error_1.TokenStatusListVerificationError.InvalidPayload);
238
+ }
239
+ const keyResult = await options.pkResolverEngine.resolve({
240
+ identifier: statusIssuer,
241
+ kid: header.kid,
242
+ alg: header.alg,
243
+ tokenType: "status-list",
244
+ });
245
+ if (!keyResult.success) {
246
+ return failure(error_1.TokenStatusListVerificationError.CannotResolveSigningKey);
247
+ }
248
+ let key;
249
+ try {
250
+ key = await (0, jose_1.importJWK)(keyResult.value.jwk, header.alg);
251
+ }
252
+ catch {
253
+ return failure(error_1.TokenStatusListVerificationError.CannotImportSigningKey);
254
+ }
255
+ let payload;
256
+ try {
257
+ const verified = await (0, jose_1.jwtVerify)(token, key, {
258
+ algorithms: [header.alg],
259
+ issuer: statusIssuer,
260
+ subject: reference.uri,
261
+ clockTolerance: clockToleranceSeconds,
262
+ currentDate,
263
+ });
264
+ payload = verified.payload;
265
+ }
266
+ catch (error) {
267
+ if (error instanceof Error &&
268
+ (error.name === "JWTExpired" ||
269
+ error.name === "JWTClaimValidationFailed")) {
270
+ return failure(error_1.TokenStatusListVerificationError.ExpiredStatusList);
271
+ }
272
+ return failure(error_1.TokenStatusListVerificationError.InvalidSignature);
273
+ }
274
+ const issuedAt = payload.iat;
275
+ const expiresAt = payload.exp;
276
+ const ttl = payload.ttl;
277
+ const statusList = payload.status_list;
278
+ if (!isNonNegativeInteger(issuedAt) ||
279
+ (requireExpiration && !isNonNegativeInteger(expiresAt)) ||
280
+ (expiresAt !== undefined && !isNonNegativeInteger(expiresAt)) ||
281
+ (requireTtl && !isPositiveInteger(ttl)) ||
282
+ (ttl !== undefined && !isPositiveInteger(ttl)) ||
283
+ (typeof ttl === "number" && ttl > maxTtlSeconds) ||
284
+ !isObject(statusList) ||
285
+ !allowedBits.includes(statusList.bits) ||
286
+ typeof statusList.lst !== "string" ||
287
+ !BASE64URL.test(statusList.lst)) {
288
+ return failure(error_1.TokenStatusListVerificationError.InvalidPayload);
289
+ }
290
+ if (issuedAt > currentSeconds + clockToleranceSeconds ||
291
+ (typeof expiresAt === "number" &&
292
+ (expiresAt <= currentSeconds - clockToleranceSeconds ||
293
+ issuedAt >= expiresAt))) {
294
+ return failure(error_1.TokenStatusListVerificationError.ExpiredStatusList);
295
+ }
296
+ let compressed;
297
+ try {
298
+ compressed = (0, util_1.fromBase64Url)(statusList.lst);
299
+ }
300
+ catch {
301
+ return failure(error_1.TokenStatusListVerificationError.InvalidPayload);
302
+ }
303
+ if (compressed.byteLength === 0 ||
304
+ compressed.byteLength > maxCompressedBytes) {
305
+ return failure(error_1.TokenStatusListVerificationError.ResponseTooLarge);
306
+ }
307
+ const inflated = inflateBounded(compressed, maxDecompressedBytes);
308
+ if (!inflated.success)
309
+ return inflated;
310
+ if (inflated.value.byteLength === 0) {
311
+ return failure(error_1.TokenStatusListVerificationError.InvalidPayload);
312
+ }
313
+ const effectiveExpiresAt = typeof expiresAt === "number"
314
+ ? expiresAt
315
+ : currentSeconds + (typeof ttl === "number" ? ttl : 0);
316
+ const advertisedTtl = typeof ttl === "number"
317
+ ? ttl
318
+ : Math.max(0, effectiveExpiresAt - currentSeconds);
319
+ const effectiveTtl = Math.min(advertisedTtl, maxTtlSeconds);
320
+ const cacheUntil = Math.min(currentDate.getTime() + effectiveTtl * 1000, effectiveExpiresAt * 1000);
321
+ return {
322
+ success: true,
323
+ value: {
324
+ bytes: inflated.value,
325
+ bits: statusList.bits,
326
+ uri: reference.uri,
327
+ issuer: statusIssuer,
328
+ issuedAt,
329
+ expiresAt: effectiveExpiresAt,
330
+ ttl: effectiveTtl,
331
+ kid: header.kid,
332
+ cacheUntil,
333
+ },
334
+ };
335
+ }
336
+ async function statusList(credentialIssuer, reference, statusIssuer, forceRefresh) {
337
+ const key = cacheKey(credentialIssuer, reference.uri);
338
+ const cached = cache.get(key);
339
+ if (!forceRefresh && cached && cached.value.cacheUntil > now().getTime()) {
340
+ return { success: true, value: cached.value };
341
+ }
342
+ if (!forceRefresh) {
343
+ const pending = inflight.get(key);
344
+ if (pending)
345
+ return pending;
346
+ }
347
+ const pending = fetchAndVerify(reference, statusIssuer);
348
+ if (!forceRefresh)
349
+ inflight.set(key, pending);
350
+ try {
351
+ const result = await pending;
352
+ if (result.success)
353
+ cache.set(key, { value: result.value });
354
+ return result;
355
+ }
356
+ finally {
357
+ if (!forceRefresh)
358
+ inflight.delete(key);
359
+ }
360
+ }
361
+ return {
362
+ async verify({ credentialIssuer, status, forceRefresh = false }) {
363
+ const trusted = trustedReference(credentialIssuer, status);
364
+ if (!trusted.success)
365
+ return trusted;
366
+ const { reference, statusIssuer } = trusted.value;
367
+ const list = await statusList(credentialIssuer, reference, statusIssuer, forceRefresh);
368
+ if (!list.success)
369
+ return list;
370
+ const bitOffset = reference.idx * list.value.bits;
371
+ if (!Number.isSafeInteger(bitOffset)) {
372
+ return failure(error_1.TokenStatusListVerificationError.IndexOutOfRange);
373
+ }
374
+ const byteIndex = Math.floor(bitOffset / 8);
375
+ if (byteIndex >= list.value.bytes.byteLength) {
376
+ return failure(error_1.TokenStatusListVerificationError.IndexOutOfRange);
377
+ }
378
+ const shift = bitOffset % 8;
379
+ const mask = (1 << list.value.bits) - 1;
380
+ const statusValue = (list.value.bytes[byteIndex] >> shift) & mask;
381
+ return {
382
+ success: true,
383
+ value: {
384
+ status: statusName(statusValue),
385
+ statusValue,
386
+ index: reference.idx,
387
+ bits: list.value.bits,
388
+ uri: list.value.uri,
389
+ issuer: list.value.issuer,
390
+ issuedAt: list.value.issuedAt,
391
+ expiresAt: list.value.expiresAt,
392
+ ttl: list.value.ttl,
393
+ kid: list.value.kid,
394
+ },
395
+ };
396
+ },
397
+ clearCache(uri) {
398
+ if (uri === undefined) {
399
+ cache.clear();
400
+ return;
401
+ }
402
+ const normalized = normalizeStatusUri(uri);
403
+ for (const key of cache.keys()) {
404
+ if (normalized && key.endsWith(`\n${normalized}`))
405
+ cache.delete(key);
406
+ }
407
+ },
408
+ };
409
+ }
410
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiVG9rZW5TdGF0dXNMaXN0VmVyaWZpZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc3RhdHVzL1Rva2VuU3RhdHVzTGlzdFZlcmlmaWVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBdU5BLDBEQWtVQztBQXpoQkQsK0JBQThFO0FBQzlFLCtCQUErQjtBQUMvQixvQ0FFa0I7QUFRbEIsd0NBQThDO0FBNkQ5QyxNQUFNLDBCQUEwQixHQUFHLEtBQUssQ0FBQztBQUN6QyxNQUFNLDBCQUEwQixHQUFHLEdBQUcsR0FBRyxJQUFJLENBQUM7QUFDOUMsTUFBTSw0QkFBNEIsR0FBRyxHQUFHLEdBQUcsSUFBSSxDQUFDO0FBQ2hELE1BQU0sOEJBQThCLEdBQUcsR0FBRyxHQUFHLElBQUksQ0FBQztBQUNsRCxNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQztBQUN2QyxNQUFNLFdBQVcsR0FBRyxrREFBa0QsQ0FBQztBQUN2RSxNQUFNLFNBQVMsR0FBRyxrQkFBa0IsQ0FBQztBQUVyQyxTQUFTLE9BQU8sQ0FBQyxLQUF1QztJQUN2RCxPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQWMsRUFBRSxLQUFLLEVBQUUsQ0FBQztBQUMzQyxDQUFDO0FBRUQsU0FBUyxRQUFRLENBQUMsS0FBYztJQUMvQixPQUFPLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUM3RSxDQUFDO0FBRUQsU0FBUyxvQkFBb0IsQ0FBQyxLQUFjO0lBQzNDLE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxJQUFJLENBQUMsQ0FBQztBQUMvRSxDQUFDO0FBRUQsU0FBUyxpQkFBaUIsQ0FBQyxLQUFjO0lBQ3hDLE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztBQUM5RSxDQUFDO0FBRUQsU0FBUyxrQkFBa0IsQ0FBQyxLQUFhO0lBQ3hDLElBQUksQ0FBQztRQUNKLE1BQU0sR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzNCLElBQ0MsR0FBRyxDQUFDLFFBQVEsS0FBSyxRQUFRO1lBQ3pCLEdBQUcsQ0FBQyxRQUFRO1lBQ1osR0FBRyxDQUFDLFFBQVE7WUFDWixHQUFHLENBQUMsSUFBSSxFQUNQLENBQUM7WUFDRixPQUFPLFNBQVMsQ0FBQztRQUNsQixDQUFDO1FBQ0QsT0FBTyxHQUFHLENBQUMsSUFBSSxDQUFDO0lBQ2pCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUixPQUFPLFNBQVMsQ0FBQztJQUNsQixDQUFDO0FBQ0YsQ0FBQztBQUVELFNBQVMsY0FBYyxDQUFDLE1BQWU7SUFDdEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDekUsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUM7SUFDbkMsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUM7SUFDbkMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxJQUFJLE9BQU8sR0FBRyxLQUFLLFFBQVE7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUM1RSxNQUFNLGFBQWEsR0FBRyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUM5QyxJQUFJLENBQUMsYUFBYTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ3JDLE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLGFBQWEsRUFBRSxDQUFDO0FBQ3BDLENBQUM7QUFFRCxTQUFTLFlBQVksQ0FBQyxJQUFhO0lBQ2xDLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUTtRQUFFLE9BQU8sSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2pELElBQUksSUFBSSxZQUFZLFVBQVUsRUFBRSxDQUFDO1FBQ2hDLElBQUksQ0FBQztZQUNKLE9BQU8sSUFBSSxXQUFXLENBQUMsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3RFLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUixPQUFPLFNBQVMsQ0FBQztRQUNsQixDQUFDO0lBQ0YsQ0FBQztJQUNELE9BQU8sU0FBUyxDQUFDO0FBQ2xCLENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FDbkIsT0FBZ0MsRUFDaEMsSUFBWTtJQUVaLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztJQUNwQyxLQUFLLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxPQUFPLElBQUksRUFBRSxDQUFDLEVBQUUsQ0FBQztRQUMxRCxJQUFJLEdBQUcsQ0FBQyxXQUFXLEVBQUUsS0FBSyxRQUFRLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDakUsT0FBTyxLQUFLLENBQUM7UUFDZCxDQUFDO0lBQ0YsQ0FBQztJQUNELE9BQU8sU0FBUyxDQUFDO0FBQ2xCLENBQUM7QUFFRCxTQUFTLFVBQVUsQ0FBQyxLQUFhO0lBQ2hDLElBQUksS0FBSyxLQUFLLENBQUM7UUFBRSxPQUFPLE9BQU8sQ0FBQztJQUNoQyxJQUFJLEtBQUssS0FBSyxDQUFDO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDbEMsSUFBSSxLQUFLLEtBQUssQ0FBQztRQUFFLE9BQU8sV0FBVyxDQUFDO0lBQ3BDLE9BQU8sc0JBQXNCLENBQUM7QUFDL0IsQ0FBQztBQUVELFNBQVMsY0FBYyxDQUN0QixVQUFzQixFQUN0QixvQkFBNEI7SUFFNUIsTUFBTSxNQUFNLEdBQWlCLEVBQUUsQ0FBQztJQUNoQyxJQUFJLElBQUksR0FBRyxDQUFDLENBQUM7SUFDYixJQUFJLENBQUM7UUFDSixNQUFNLFFBQVEsR0FBRyxJQUFJLGNBQU8sQ0FBQztZQUM1QixTQUFTLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLEdBQUcsSUFBSSxFQUFFLG9CQUFvQixHQUFHLENBQUMsQ0FBQztTQUN4RCxDQUFDLENBQUM7UUFDSCxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsS0FBaUIsRUFBRSxFQUFFO1lBQ3ZDLElBQUksSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDO1lBQ3pCLElBQUksSUFBSSxHQUFHLG9CQUFvQixFQUFFLENBQUM7Z0JBQ2pDLE1BQU0sSUFBSSxVQUFVLENBQUMsbURBQW1ELENBQUMsQ0FBQztZQUMzRSxDQUFDO1lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ3BDLENBQUMsQ0FBQztRQUNGLE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2xELElBQUksQ0FBQyxTQUFTLElBQUksUUFBUSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ2hDLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDdEUsQ0FBQztJQUNGLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2hCLElBQUksS0FBSyxZQUFZLFVBQVUsRUFBRSxDQUFDO1lBQ2pDLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFDM0UsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUVELE1BQU0sTUFBTSxHQUFHLElBQUksVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3BDLElBQUksTUFBTSxHQUFHLENBQUMsQ0FBQztJQUNmLEtBQUssTUFBTSxLQUFLLElBQUksTUFBTSxFQUFFLENBQUM7UUFDNUIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUM7SUFDNUIsQ0FBQztJQUNELE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUN6QyxDQUFDO0FBRUQsU0FBUyxlQUFlLENBQUMsT0FBdUM7SUFDL0QsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLFdBQVcsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQy9DLE1BQU0sTUFBTSxHQUFHO1FBQ2QsT0FBTyxDQUFDLGdCQUFnQixJQUFJLDBCQUEwQjtRQUN0RCxPQUFPLENBQUMsZ0JBQWdCLElBQUksMEJBQTBCO1FBQ3RELE9BQU8sQ0FBQyxrQkFBa0IsSUFBSSw0QkFBNEI7UUFDMUQsT0FBTyxDQUFDLG9CQUFvQixJQUFJLDhCQUE4QjtRQUM5RCxPQUFPLENBQUMsYUFBYSxJQUFJLHVCQUF1QjtLQUNoRCxDQUFDO0lBQ0YsSUFDQyxXQUFXLENBQUMsTUFBTSxLQUFLLENBQUM7UUFDeEIsSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUMsSUFBSSxLQUFLLFdBQVcsQ0FBQyxNQUFNO1FBQ2hELFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDbEUsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLENBQUM7UUFDekQsQ0FBQyxPQUFPLENBQUMscUJBQXFCLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUN2QyxDQUFDO1FBQ0YsTUFBTSxJQUFJLFNBQVMsQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLFdBQVcsQ0FBQyxDQUFDLENBQUM7QUFDeEMsQ0FBQztBQUVELFNBQWdCLHVCQUF1QixDQUN0QyxPQUF1QztJQUV2QyxNQUFNLFdBQVcsR0FBRyxlQUFlLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDN0MsTUFBTSxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsZ0JBQWdCLElBQUksMEJBQTBCLENBQUM7SUFDaEYsTUFBTSxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsZ0JBQWdCLElBQUksMEJBQTBCLENBQUM7SUFDaEYsTUFBTSxrQkFBa0IsR0FBRyxPQUFPLENBQUMsa0JBQWtCLElBQUksNEJBQTRCLENBQUM7SUFDdEYsTUFBTSxvQkFBb0IsR0FDekIsT0FBTyxDQUFDLG9CQUFvQixJQUFJLDhCQUE4QixDQUFDO0lBQ2hFLE1BQU0sYUFBYSxHQUFHLE9BQU8sQ0FBQyxhQUFhLElBQUksdUJBQXVCLENBQUM7SUFDdkUsTUFBTSxxQkFBcUIsR0FBRyxPQUFPLENBQUMscUJBQXFCLElBQUksQ0FBQyxDQUFDO0lBQ2pFLE1BQU0saUJBQWlCLEdBQUcsT0FBTyxDQUFDLGlCQUFpQixJQUFJLElBQUksQ0FBQztJQUM1RCxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsVUFBVSxJQUFJLElBQUksQ0FBQztJQUM5QyxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzlDLE1BQU0sS0FBSyxHQUFHLElBQUksR0FBRyxFQUE0QixDQUFDO0lBQ2xELE1BQU0sUUFBUSxHQUFHLElBQUksR0FBRyxFQUFpRixDQUFDO0lBRTFHLFNBQVMsUUFBUSxDQUFDLGdCQUF3QixFQUFFLEdBQVc7UUFDdEQsT0FBTyxHQUFHLGdCQUFnQixLQUFLLEdBQUcsRUFBRSxDQUFDO0lBQ3RDLENBQUM7SUFFRCxTQUFTLGdCQUFnQixDQUN4QixnQkFBd0IsRUFDeEIsTUFBZTtRQU1mLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDMUQsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pDLElBQUksQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUMxQixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFDRCxJQUNDLENBQUMsS0FBSyxDQUFDLGNBQWM7WUFDckIsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQzVDLENBQUM7WUFDRixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsZ0JBQWdCLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUM1RCxNQUFNLGlCQUFpQixHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ2xFLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxVQUFVLENBQUMsYUFBYSxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUM7WUFDM0QsT0FBTyxPQUFPLENBQUMsd0NBQWdDLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUMxRSxDQUFDO1FBQ0QsT0FBTztZQUNOLE9BQU8sRUFBRSxJQUFJO1lBQ2IsS0FBSyxFQUFFLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxZQUFZLEVBQUU7U0FDekMsQ0FBQztJQUNILENBQUM7SUFFRCxLQUFLLFVBQVUsY0FBYyxDQUM1QixTQUE4QixFQUM5QixZQUFvQjtRQUVwQixNQUFNLFdBQVcsR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUMxQixNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztRQUNoRSxNQUFNLFVBQVUsR0FBRyxJQUFJLEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDMUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDO1FBRTVELElBQUksUUFBZ0QsQ0FBQztRQUNyRCxJQUFJLENBQUM7WUFDSixRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FDdEMsVUFBVSxDQUFDLElBQUksRUFDZixFQUFFLE1BQU0sRUFBRSw0QkFBNEIsRUFBRSxFQUN4QztnQkFDQyxRQUFRLEVBQUUsS0FBSztnQkFDZixPQUFPLEVBQUUsZ0JBQWdCO2dCQUN6QixZQUFZLEVBQUUsQ0FBQztnQkFDZixnQkFBZ0IsRUFBRSxnQkFBZ0I7Z0JBQ2xDLGFBQWEsRUFBRSxnQkFBZ0I7Z0JBQy9CLFlBQVksRUFBRSxNQUFNO2FBQ3BCLENBQ0QsQ0FBQztRQUNILENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLEdBQUcsSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLEdBQUcsRUFBRSxDQUFDO1lBQ2xFLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFDRCxNQUFNLFdBQVcsR0FBRyxXQUFXLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxjQUFjLENBQUMsQ0FBQztRQUNsRSxJQUNDLENBQUMsV0FBVztZQUNaLFdBQVcsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRTtnQkFDaEQsNEJBQTRCLEVBQzVCLENBQUM7WUFDRixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUMxQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDWixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBQ0QsSUFBSSxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLEdBQUcsZ0JBQWdCLEVBQUUsQ0FBQztZQUNuRSxPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFDRCxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzlCLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFFRCxJQUFJLE1BQStCLENBQUM7UUFDcEMsSUFBSSxpQkFBMEMsQ0FBQztRQUMvQyxJQUFJLENBQUM7WUFDSixNQUFNLEdBQUcsSUFBQSw0QkFBcUIsRUFBQyxLQUFLLENBQUMsQ0FBQztZQUN0QyxpQkFBaUIsR0FBRyxJQUFBLGdCQUFTLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFDdEMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNSLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUNDLE1BQU0sQ0FBQyxHQUFHLEtBQUssZ0JBQWdCO1lBQy9CLE9BQU8sTUFBTSxDQUFDLEdBQUcsS0FBSyxRQUFRO1lBQzlCLENBQUMsTUFBTSxDQUFDLEdBQUc7WUFDWCxNQUFNLENBQUMsR0FBRyxLQUFLLE1BQU07WUFDckIsT0FBTyxNQUFNLENBQUMsR0FBRyxLQUFLLFFBQVE7WUFDOUIsQ0FBQyxNQUFNLENBQUMsR0FBRztZQUNYLE1BQU0sQ0FBQyxHQUFHLEtBQUssU0FBUztZQUN4QixNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVM7WUFDeEIsTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTO1lBQ3hCLE1BQU0sQ0FBQyxHQUFHLEtBQUssU0FBUztZQUN4QixNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVM7WUFDeEIsQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLFNBQVM7Z0JBQ3pCLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUN4RCxDQUFDO1lBQ0YsT0FBTyxPQUFPLENBQUMsd0NBQWdDLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDaEUsQ0FBQztRQUNELElBQ0MsaUJBQWlCLENBQUMsR0FBRyxLQUFLLFlBQVk7WUFDdEMsaUJBQWlCLENBQUMsR0FBRyxLQUFLLFNBQVMsQ0FBQyxHQUFHLEVBQ3RDLENBQUM7WUFDRixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBRUQsTUFBTSxTQUFTLEdBQUcsTUFBTSxPQUFPLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDO1lBQ3hELFVBQVUsRUFBRSxZQUFZO1lBQ3hCLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztZQUNmLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztZQUNmLFNBQVMsRUFBRSxhQUFhO1NBQ3hCLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDeEIsT0FBTyxPQUFPLENBQUMsd0NBQWdDLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUMxRSxDQUFDO1FBRUQsSUFBSSxHQUEwQyxDQUFDO1FBQy9DLElBQUksQ0FBQztZQUNKLEdBQUcsR0FBRyxNQUFNLElBQUEsZ0JBQVMsRUFBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDeEQsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNSLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLHNCQUFzQixDQUFDLENBQUM7UUFDekUsQ0FBQztRQUVELElBQUksT0FBZ0MsQ0FBQztRQUNyQyxJQUFJLENBQUM7WUFDSixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUEsZ0JBQVMsRUFBQyxLQUFLLEVBQUUsR0FBRyxFQUFFO2dCQUM1QyxVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDO2dCQUN4QixNQUFNLEVBQUUsWUFBWTtnQkFDcEIsT0FBTyxFQUFFLFNBQVMsQ0FBQyxHQUFHO2dCQUN0QixjQUFjLEVBQUUscUJBQXFCO2dCQUNyQyxXQUFXO2FBQ1gsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUM7UUFDNUIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDaEIsSUFDQyxLQUFLLFlBQVksS0FBSztnQkFDdEIsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFlBQVk7b0JBQzNCLEtBQUssQ0FBQyxJQUFJLEtBQUssMEJBQTBCLENBQUMsRUFDMUMsQ0FBQztnQkFDRixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1lBQ3BFLENBQUM7WUFDRCxPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFFRCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDO1FBQzdCLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDOUIsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQztRQUN4QixNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQ3ZDLElBQ0MsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUM7WUFDL0IsQ0FBQyxpQkFBaUIsSUFBSSxDQUFDLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ3ZELENBQUMsU0FBUyxLQUFLLFNBQVMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQzdELENBQUMsVUFBVSxJQUFJLENBQUMsaUJBQWlCLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDdkMsQ0FBQyxHQUFHLEtBQUssU0FBUyxJQUFJLENBQUMsaUJBQWlCLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDOUMsQ0FBQyxPQUFPLEdBQUcsS0FBSyxRQUFRLElBQUksR0FBRyxHQUFHLGFBQWEsQ0FBQztZQUNoRCxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7WUFDckIsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxJQUFxQixDQUFDO1lBQ3ZELE9BQU8sVUFBVSxDQUFDLEdBQUcsS0FBSyxRQUFRO1lBQ2xDLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQzlCLENBQUM7WUFDRixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsSUFDQyxRQUFRLEdBQUcsY0FBYyxHQUFHLHFCQUFxQjtZQUNqRCxDQUFDLE9BQU8sU0FBUyxLQUFLLFFBQVE7Z0JBQzdCLENBQUMsU0FBUyxJQUFJLGNBQWMsR0FBRyxxQkFBcUI7b0JBQ25ELFFBQVEsSUFBSSxTQUFTLENBQUMsQ0FBQyxFQUN4QixDQUFDO1lBQ0YsT0FBTyxPQUFPLENBQUMsd0NBQWdDLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUNwRSxDQUFDO1FBRUQsSUFBSSxVQUFzQixDQUFDO1FBQzNCLElBQUksQ0FBQztZQUNKLFVBQVUsR0FBRyxJQUFBLG9CQUFhLEVBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzVDLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUixPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsSUFDQyxVQUFVLENBQUMsVUFBVSxLQUFLLENBQUM7WUFDM0IsVUFBVSxDQUFDLFVBQVUsR0FBRyxrQkFBa0IsRUFDekMsQ0FBQztZQUNGLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDbkUsQ0FBQztRQUNELE1BQU0sUUFBUSxHQUFHLGNBQWMsQ0FBQyxVQUFVLEVBQUUsb0JBQW9CLENBQUMsQ0FBQztRQUNsRSxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU87WUFBRSxPQUFPLFFBQVEsQ0FBQztRQUN2QyxJQUFJLFFBQVEsQ0FBQyxLQUFLLENBQUMsVUFBVSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3JDLE9BQU8sT0FBTyxDQUFDLHdDQUFnQyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7UUFFRCxNQUFNLGtCQUFrQixHQUN2QixPQUFPLFNBQVMsS0FBSyxRQUFRO1lBQzVCLENBQUMsQ0FBQyxTQUFTO1lBQ1gsQ0FBQyxDQUFDLGNBQWMsR0FBRyxDQUFDLE9BQU8sR0FBRyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN6RCxNQUFNLGFBQWEsR0FDbEIsT0FBTyxHQUFHLEtBQUssUUFBUTtZQUN0QixDQUFDLENBQUMsR0FBRztZQUNMLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxrQkFBa0IsR0FBRyxjQUFjLENBQUMsQ0FBQztRQUNyRCxNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUM1RCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUMxQixXQUFXLENBQUMsT0FBTyxFQUFFLEdBQUcsWUFBWSxHQUFHLElBQUksRUFDM0Msa0JBQWtCLEdBQUcsSUFBSSxDQUN6QixDQUFDO1FBQ0YsT0FBTztZQUNOLE9BQU8sRUFBRSxJQUFJO1lBQ2IsS0FBSyxFQUFFO2dCQUNOLEtBQUssRUFBRSxRQUFRLENBQUMsS0FBSztnQkFDckIsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFjO2dCQUMvQixHQUFHLEVBQUUsU0FBUyxDQUFDLEdBQUc7Z0JBQ2xCLE1BQU0sRUFBRSxZQUFZO2dCQUNwQixRQUFRO2dCQUNSLFNBQVMsRUFBRSxrQkFBa0I7Z0JBQzdCLEdBQUcsRUFBRSxZQUFZO2dCQUNqQixHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUc7Z0JBQ2YsVUFBVTthQUNWO1NBQ0QsQ0FBQztJQUNILENBQUM7SUFFRCxLQUFLLFVBQVUsVUFBVSxDQUN4QixnQkFBd0IsRUFDeEIsU0FBOEIsRUFDOUIsWUFBb0IsRUFDcEIsWUFBcUI7UUFFckIsTUFBTSxHQUFHLEdBQUcsUUFBUSxDQUFDLGdCQUFnQixFQUFFLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN0RCxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzlCLElBQUksQ0FBQyxZQUFZLElBQUksTUFBTSxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxHQUFHLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7WUFDMUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFhLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUN4RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ25CLE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDbEMsSUFBSSxPQUFPO2dCQUFFLE9BQU8sT0FBTyxDQUFDO1FBQzdCLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxjQUFjLENBQUMsU0FBUyxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQ3hELElBQUksQ0FBQyxZQUFZO1lBQUUsUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDOUMsSUFBSSxDQUFDO1lBQ0osTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUM7WUFDN0IsSUFBSSxNQUFNLENBQUMsT0FBTztnQkFBRSxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUM1RCxPQUFPLE1BQU0sQ0FBQztRQUNmLENBQUM7Z0JBQVMsQ0FBQztZQUNWLElBQUksQ0FBQyxZQUFZO2dCQUFFLFFBQVEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDekMsQ0FBQztJQUNGLENBQUM7SUFFRCxPQUFPO1FBQ04sS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sRUFBRSxZQUFZLEdBQUcsS0FBSyxFQUFFO1lBQzlELE1BQU0sT0FBTyxHQUFHLGdCQUFnQixDQUFDLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQzNELElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTztnQkFBRSxPQUFPLE9BQU8sQ0FBQztZQUNyQyxNQUFNLEVBQUUsU0FBUyxFQUFFLFlBQVksRUFBRSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUM7WUFDbEQsTUFBTSxJQUFJLEdBQUcsTUFBTSxVQUFVLENBQzVCLGdCQUFnQixFQUNoQixTQUFTLEVBQ1QsWUFBWSxFQUNaLFlBQVksQ0FDWixDQUFDO1lBQ0YsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPO2dCQUFFLE9BQU8sSUFBSSxDQUFDO1lBRS9CLE1BQU0sU0FBUyxHQUFHLFNBQVMsQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7WUFDbEQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztnQkFDdEMsT0FBTyxPQUFPLENBQUMsd0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7WUFDbEUsQ0FBQztZQUNELE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQzVDLElBQUksU0FBUyxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxDQUFDO2dCQUM5QyxPQUFPLE9BQU8sQ0FBQyx3Q0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztZQUNsRSxDQUFDO1lBQ0QsTUFBTSxLQUFLLEdBQUcsU0FBUyxHQUFHLENBQUMsQ0FBQztZQUM1QixNQUFNLElBQUksR0FBRyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUN4QyxNQUFNLFdBQVcsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLEtBQUssQ0FBQyxHQUFHLElBQUksQ0FBQztZQUNsRSxPQUFPO2dCQUNOLE9BQU8sRUFBRSxJQUFJO2dCQUNiLEtBQUssRUFBRTtvQkFDTixNQUFNLEVBQUUsVUFBVSxDQUFDLFdBQVcsQ0FBQztvQkFDL0IsV0FBVztvQkFDWCxLQUFLLEVBQUUsU0FBUyxDQUFDLEdBQUc7b0JBQ3BCLElBQUksRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUk7b0JBQ3JCLEdBQUcsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUc7b0JBQ25CLE1BQU0sRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU07b0JBQ3pCLFFBQVEsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVE7b0JBQzdCLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVM7b0JBQy9CLEdBQUcsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUc7b0JBQ25CLEdBQUcsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUc7aUJBQ25CO2FBQ0QsQ0FBQztRQUNILENBQUM7UUFFRCxVQUFVLENBQUMsR0FBWTtZQUN0QixJQUFJLEdBQUcsS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDdkIsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUNkLE9BQU87WUFDUixDQUFDO1lBQ0QsTUFBTSxVQUFVLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDM0MsS0FBSyxNQUFNLEdBQUcsSUFBSSxLQUFLLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztnQkFDaEMsSUFBSSxVQUFVLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxLQUFLLFVBQVUsRUFBRSxDQUFDO29CQUFFLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDdEUsQ0FBQztRQUNGLENBQUM7S0FDRCxDQUFDO0FBQ0gsQ0FBQyJ9