ubid-common 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+export * from './rendering';
+export * from './ParsingEngine';
+export * from './credential-parsers/SDJWTVCParser';
+export * from './credential-parsers/MsoMdocParser';
+export * from './VerifyingEngine';
+export * from './credential-verifiers/SDJWTVCVerifier';
+export * from './credential-verifiers/MsoMdocVerifier';
+export * from './PublicKeyResolverEngine';
+export * from './defaultHttpClient';
+export * from './resolvers/RemoteJwksResolver';
+export * from './status/TokenStatusListVerifier';
+export * from './trust/AlgorithmPolicy';
+export * from './trust/TrustRegistry';
+export * from './x509/X509ChainVerifier';
+export * from './interfaces';
+export * from './schemas';
+export * from './utils';
+export * from './functions';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAE5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AAEnD,cAAc,mBAAmB,CAAC;AAClC,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AAEvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AAEzC,cAAc,cAAc,CAAC;AAE7B,cAAc,WAAW,CAAC;AAE1B,cAAc,SAAS,CAAC;AAExB,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,35 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./rendering"), exports);
+__exportStar(require("./ParsingEngine"), exports);
+__exportStar(require("./credential-parsers/SDJWTVCParser"), exports);
+__exportStar(require("./credential-parsers/MsoMdocParser"), exports);
+__exportStar(require("./VerifyingEngine"), exports);
+__exportStar(require("./credential-verifiers/SDJWTVCVerifier"), exports);
+__exportStar(require("./credential-verifiers/MsoMdocVerifier"), exports);
+__exportStar(require("./PublicKeyResolverEngine"), exports);
+__exportStar(require("./defaultHttpClient"), exports);
+__exportStar(require("./resolvers/RemoteJwksResolver"), exports);
+__exportStar(require("./status/TokenStatusListVerifier"), exports);
+__exportStar(require("./trust/AlgorithmPolicy"), exports);
+__exportStar(require("./trust/TrustRegistry"), exports);
+__exportStar(require("./x509/X509ChainVerifier"), exports);
+__exportStar(require("./interfaces"), exports);
+__exportStar(require("./schemas"), exports);
+__exportStar(require("./utils"), exports);
+__exportStar(require("./functions"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDhDQUE0QjtBQUU1QixrREFBZ0M7QUFDaEMscUVBQW1EO0FBQ25ELHFFQUFtRDtBQUVuRCxvREFBa0M7QUFDbEMseUVBQXVEO0FBQ3ZELHlFQUF1RDtBQUV2RCw0REFBMEM7QUFDMUMsc0RBQW9DO0FBQ3BDLGlFQUErQztBQUMvQyxtRUFBaUQ7QUFDakQsMERBQXdDO0FBQ3hDLHdEQUFzQztBQUN0QywyREFBeUM7QUFFekMsK0NBQTZCO0FBRTdCLDRDQUEwQjtBQUUxQiwwQ0FBd0I7QUFFeEIsOENBQTRCIn0=

package/dist/interfaces.d.ts

@@ -0,0 +1,112 @@
+import { JWK } from "jose";
+import { CredentialParsingError, CredentialVerificationError, PublicKeyResolutionError } from "./error";
+import { Result, ParsedCredential, CredentialClaims, ParserResult, CredentialClaimPath } from "./types";
+export interface CredentialRendering {
+    renderSvgTemplate(args: {
+        json: any;
+        credentialImageSvgTemplate: string;
+        sdJwtVcMetadataClaims: any;
+        filter?: Array<CredentialClaimPath>;
+    }): Promise<string | null>;
+}
+export interface OpenID4VCICredentialRendering {
+    renderCustomSvgTemplate(args: {
+        signedClaims: CredentialClaims;
+        displayConfig: any;
+    }): Promise<string>;
+}
+export interface CredentialIssuerInfo {
+    credentialIssuerIdentifier: string;
+    credentialConfigurationId: string;
+}
+export interface ParsingEngineI {
+    register(parser: CredentialParser): void;
+    parse({ rawCredential, credentialIssuer }: {
+        rawCredential: unknown;
+        credentialIssuer?: CredentialIssuerInfo;
+    }): Promise<Result<ParsedCredential, CredentialParsingError>>;
+}
+export interface VerifyingEngineI {
+    register(credentialVerifier: CredentialVerifier): void;
+    verify({ rawCredential, opts }: {
+        rawCredential: unknown;
+        opts: CredentialVerificationOptions;
+    }): Promise<Result<VerifiedCredential, CredentialVerificationError>>;
+}
+export interface PublicKeyResolverEngineI {
+    register(resolver: PublicKeyResolver): void;
+    resolve(args: PublicKeyResolutionRequest): Promise<Result<{
+        jwk: JWK;
+    }, PublicKeyResolutionError>>;
+}
+export interface CredentialParser {
+    parse(args: {
+        rawCredential: unknown;
+        credentialIssuer?: CredentialIssuerInfo;
+    }): Promise<ParserResult>;
+}
+export interface CredentialVerifier {
+    verify(args: {
+        rawCredential: unknown;
+        opts: CredentialVerificationOptions;
+    }): Promise<Result<VerifiedCredential, CredentialVerificationError>>;
+}
+export type CredentialStatus = "valid" | "revoked" | "suspended" | "application-specific";
+export interface VerifiedCredential {
+    holderPublicKey: JWK;
+    credentialStatus?: CredentialStatus;
+    statusListUri?: string;
+    statusListIndex?: number;
+}
+export interface CredentialVerificationOptions {
+    expectedNonce?: string;
+    expectedAudience?: string;
+    expectedIssuer?: string;
+    expectedCredentialType?: string;
+    requiredClaimKeys?: readonly string[];
+    requireKeyBinding?: boolean;
+    holderNonce?: string;
+    responseUri?: string;
+}
+export interface PublicKeyResolver {
+    resolve(args: PublicKeyResolutionRequest): Promise<Result<{
+        jwk: JWK;
+    }, PublicKeyResolutionError>>;
+}
+export type TokenVerificationType = "credential" | "kb-jwt" | "status-list";
+/**
+ * `identifier` is the exact issuer identifier. `kid` and `alg` come from the
+ * protected JOSE header and must never be inferred from untrusted metadata.
+ */
+export interface PublicKeyResolutionRequest {
+    identifier: string;
+    kid?: string;
+    alg?: string;
+    tokenType?: TokenVerificationType;
+    credentialType?: string;
+}
+export interface HttpClient {
+    get(url: string, headers?: Record<string, unknown>, options?: any): Promise<{
+        status: number;
+        headers: Record<string, unknown>;
+        data: unknown;
+    }>;
+    post(url: string, body: any, headers?: Record<string, unknown>, options?: any): Promise<{
+        status: number;
+        headers: Record<string, unknown>;
+        data: unknown;
+    }>;
+}
+export interface Context {
+    clockTolerance: number;
+    lang: string;
+    subtle: SubtleCrypto;
+    /**
+     * each string is Base64-encoded DER representation without line breaks or headers like -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----
+     */
+    trustedCertificates: string[];
+    config?: {
+        vctRegistryUri: string;
+    };
+}
+//# sourceMappingURL=interfaces.d.ts.map

package/dist/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,wBAAwB,EAAmE,MAAM,SAAS,CAAC;AACzK,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAExG,MAAM,WAAW,mBAAmB;IACnC,iBAAiB,CAAC,IAAI,EAAE;QACvB,IAAI,EAAE,GAAG,CAAC;QACV,0BAA0B,EAAE,MAAM,CAAC;QACnC,qBAAqB,EAAE,GAAG,CAAC;QAC3B,MAAM,CAAC,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC7C,uBAAuB,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,gBAAgB,CAAC;QAAC,aAAa,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvG;AAED,MAAM,WAAW,oBAAoB;IACpC,0BAA0B,EAAE,MAAM,CAAC;IACnC,yBAAyB,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACzC,KAAK,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,EAAE;QAC1C,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvD,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE;QAAE,aAAa,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,6BAA6B,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,CAAC,CAAC;CACnK;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC5C,OAAO,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,CAAC;QACzD,GAAG,EAAE,GAAG,CAAA;KACR,EAAE,wBAAwB,CAAC,CAAC,CAAC;CAC9B;AAGD,MAAM,WAAW,gBAAgB;IAChC,KAAK,CAAC,IAAI,EAAE;QACX,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;KACxC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,IAAI,EAAE;QAAE,aAAa,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,6BAA6B,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,CAAC,CAAC;CAChJ;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,sBAAsB,CAAC;AAE1F,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,GAAG,CAAC;IACrB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,6BAA6B;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,WAAW,iBAAiB;IACjC,OAAO,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,CAAC;QACzD,GAAG,EAAE,GAAG,CAAA;KACR,EAAE,wBAAwB,CAAC,CAAC,CAAC;CAC9B;AAED,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE5E;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjJ,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC7J;AAKD,MAAM,WAAW,OAAO;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB;;OAEG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE;QACR,cAAc,EAAE,MAAM,CAAC;KACvB,CAAC;CACF"}

package/dist/interfaces.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZXJmYWNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9pbnRlcmZhY2VzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist/rendering.d.ts

@@ -0,0 +1,3 @@
+import { CredentialRendering } from './interfaces';
+export declare function CredentialRenderingService(): CredentialRendering;
+//# sourceMappingURL=rendering.d.ts.map

package/dist/rendering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rendering.d.ts","sourceRoot":"","sources":["../src/rendering.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAInD,wBAAgB,0BAA0B,IAAI,mBAAmB,CAoDhE"}

package/dist/rendering.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialRenderingService = CredentialRenderingService;
+const jsonpointer_1 = __importDefault(require("jsonpointer"));
+const formatDate_1 = require("./functions/formatDate");
+const escapeSVG_1 = require("./utils/escapeSVG");
+function CredentialRenderingService() {
+    const renderSvgTemplate = async ({ json, credentialImageSvgTemplate, sdJwtVcMetadataClaims, filter }) => {
+        let svgContent = null;
+        try {
+            svgContent = credentialImageSvgTemplate;
+        }
+        catch (error) {
+            return null; // Return null if fetching fails
+        }
+        if (svgContent) {
+            // Build pathMap from credentialHeader.vctm.claims
+            const pathMap = sdJwtVcMetadataClaims.reduce((acc, claim) => {
+                if (claim.svg_id && claim.path) {
+                    acc[claim.svg_id] = claim.path;
+                }
+                return acc;
+            }, {});
+            // Regular expression to match {{svg_id}} placeholders
+            const regex = /{{([^}]+)}}/g;
+            const replacedSvgText = svgContent.replace(regex, (_match, svgId) => {
+                // Retrieve the path array for the current svgId from pathMap
+                const pathArray = pathMap[svgId];
+                if (Array.isArray(pathArray) && filter && !filter.map(f => f.join('.')).includes(pathArray.join('.'))) {
+                    return '-';
+                }
+                // If pathArray exists, convert it to a JSON pointer path
+                if (Array.isArray(pathArray)) {
+                    const jsonPointerPath = `/${pathArray.join('/')}`;
+                    // Retrieve the value from beautifiedForm using jsonpointer
+                    let value = (0, escapeSVG_1.escapeSVG)(jsonpointer_1.default.get(json, jsonPointerPath));
+                    if (value !== undefined) {
+                        value = (0, formatDate_1.formatDate)(value, 'date');
+                        return value;
+                    }
+                }
+                return '-';
+            });
+            const dataUri = `data:image/svg+xml;utf8,${encodeURIComponent(replacedSvgText)}`;
+            return dataUri; // Return the data URI for the SVG
+        }
+        return null;
+    };
+    return {
+        renderSvgTemplate,
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVuZGVyaW5nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3JlbmRlcmluZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQU1BLGdFQW9EQztBQTFERCw4REFBc0M7QUFDdEMsdURBQW9EO0FBRXBELGlEQUE4QztBQUc5QyxTQUFnQiwwQkFBMEI7SUFDekMsTUFBTSxpQkFBaUIsR0FBRyxLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxFQUFzSCxFQUFFLEVBQUU7UUFFM04sSUFBSSxVQUFVLEdBQUcsSUFBSSxDQUFDO1FBQ3RCLElBQUksQ0FBQztZQUNKLFVBQVUsR0FBRywwQkFBMEIsQ0FBQztRQUN6QyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNoQixPQUFPLElBQUksQ0FBQyxDQUFDLGdDQUFnQztRQUM5QyxDQUFDO1FBRUQsSUFBSSxVQUFVLEVBQUUsQ0FBQztZQUNoQixrREFBa0Q7WUFDbEQsTUFBTSxPQUFPLEdBQUcscUJBQXFCLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBUSxFQUFFLEtBQVUsRUFBRSxFQUFFO2dCQUNyRSxJQUFJLEtBQUssQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO29CQUNoQyxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUM7Z0JBQ2hDLENBQUM7Z0JBQ0QsT0FBTyxHQUFHLENBQUM7WUFDWixDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFFUCxzREFBc0Q7WUFDdEQsTUFBTSxLQUFLLEdBQUcsY0FBYyxDQUFDO1lBQzdCLE1BQU0sZUFBZSxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxFQUFFO2dCQUNuRSw2REFBNkQ7Z0JBQzdELE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFFakMsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO29CQUN2RyxPQUFPLEdBQUcsQ0FBQztnQkFDWixDQUFDO2dCQUNELHlEQUF5RDtnQkFDekQsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7b0JBQzlCLE1BQU0sZUFBZSxHQUFHLElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUVsRCwyREFBMkQ7b0JBQzNELElBQUksS0FBSyxHQUFHLElBQUEscUJBQVMsRUFBQyxxQkFBVyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsZUFBZSxDQUFDLENBQUMsQ0FBQztvQkFFOUQsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7d0JBQ3pCLEtBQUssR0FBRyxJQUFBLHVCQUFVLEVBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO3dCQUNsQyxPQUFPLEtBQUssQ0FBQztvQkFDZCxDQUFDO2dCQUNGLENBQUM7Z0JBQ0QsT0FBTyxHQUFHLENBQUM7WUFDWixDQUFDLENBQUMsQ0FBQztZQUNILE1BQU0sT0FBTyxHQUFHLDJCQUEyQixrQkFBa0IsQ0FBQyxlQUFlLENBQUMsRUFBRSxDQUFDO1lBQ2pGLE9BQU8sT0FBTyxDQUFDLENBQUMsa0NBQWtDO1FBQ25ELENBQUM7UUFFRCxPQUFPLElBQUksQ0FBQztJQUNiLENBQUMsQ0FBQztJQUVGLE9BQU87UUFDTixpQkFBaUI7S0FDakIsQ0FBQTtBQUNGLENBQUMifQ==

package/dist/resolvers/RemoteJwksResolver.d.ts

@@ -0,0 +1,17 @@
+import { HttpClient, PublicKeyResolver } from "../interfaces";
+import { AlgorithmPolicy } from "../trust/AlgorithmPolicy";
+import { TrustRegistry } from "../trust/TrustRegistry";
+export interface RemoteJwksResolverOptions {
+    trustRegistry: TrustRegistry;
+    algorithmPolicy: AlgorithmPolicy;
+    httpClient: HttpClient;
+    cacheTtlMs?: number;
+    requestTimeoutMs?: number;
+    maxResponseBytes?: number;
+    maxKeys?: number;
+    maxFetchAttempts?: number;
+    retryDelayMs?: number;
+    now?: () => number;
+}
+export declare function RemoteJwksResolver(options: RemoteJwksResolverOptions): PublicKeyResolver;
+//# sourceMappingURL=RemoteJwksResolver.d.ts.map

package/dist/resolvers/RemoteJwksResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoteJwksResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/RemoteJwksResolver.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,UAAU,EAEV,iBAAiB,EAEjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAsB,MAAM,wBAAwB,CAAC;AAO3E,MAAM,WAAW,yBAAyB;IACzC,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,eAAe,CAAC;IACjC,UAAU,EAAE,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAiBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,iBAAiB,CA4HxF"}

package/dist/resolvers/RemoteJwksResolver.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteJwksResolver = RemoteJwksResolver;
+const error_1 = require("../error");
+const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 5_000;
+const DEFAULT_MAX_RESPONSE_BYTES = 256 * 1024;
+const DEFAULT_MAX_KEYS = 100;
+const DEFAULT_MAX_FETCH_ATTEMPTS = 2;
+const DEFAULT_RETRY_DELAY_MS = 250;
+function failure(error) {
+    return { success: false, error };
+}
+function isJwk(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function RemoteJwksResolver(options) {
+    const cache = new Map();
+    const cacheTtlMs = options.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
+    const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+    const maxKeys = options.maxKeys ?? DEFAULT_MAX_KEYS;
+    const maxFetchAttempts = options.maxFetchAttempts ?? DEFAULT_MAX_FETCH_ATTEMPTS;
+    const retryDelayMs = options.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;
+    const now = options.now ?? Date.now;
+    if (cacheTtlMs < 0 || requestTimeoutMs <= 0 || maxResponseBytes <= 0 || maxKeys <= 0 ||
+        !Number.isSafeInteger(maxFetchAttempts) || maxFetchAttempts <= 0 ||
+        !Number.isSafeInteger(retryDelayMs) || retryDelayMs < 0) {
+        throw new TypeError("Invalid RemoteJwksResolver limits");
+    }
+    async function fetchJwksOnce(entry) {
+        let response;
+        try {
+            response = await options.httpClient.get(entry.jwksUri, { Accept: "application/json" }, {
+                useCache: false,
+                timeout: requestTimeoutMs,
+                maxRedirects: 0,
+                maxContentLength: maxResponseBytes,
+                maxBodyLength: maxResponseBytes,
+            });
+        }
+        catch {
+            return failure(error_1.PublicKeyResolutionError.RemoteJwksFetchFailed);
+        }
+        if (!response || response.status !== 200) {
+            return failure(error_1.PublicKeyResolutionError.RemoteJwksFetchFailed);
+        }
+        if (typeof response.data !== "object" || response.data === null) {
+            return failure(error_1.PublicKeyResolutionError.InvalidJwksResponse);
+        }
+        let encodedLength;
+        try {
+            encodedLength = new TextEncoder().encode(JSON.stringify(response.data)).byteLength;
+        }
+        catch {
+            return failure(error_1.PublicKeyResolutionError.InvalidJwksResponse);
+        }
+        if (encodedLength > maxResponseBytes) {
+            return failure(error_1.PublicKeyResolutionError.InvalidJwksResponse);
+        }
+        const keys = response.data.keys;
+        if (!Array.isArray(keys) || keys.length === 0 || keys.length > maxKeys || !keys.every(isJwk)) {
+            return failure(error_1.PublicKeyResolutionError.InvalidJwksResponse);
+        }
+        const cached = { expiresAt: now() + cacheTtlMs, keys: [...keys] };
+        cache.set(entry.issuer, cached);
+        return { success: true, value: cached };
+    }
+    async function fetchJwks(entry) {
+        for (let attempt = 1; attempt <= maxFetchAttempts; attempt++) {
+            const result = await fetchJwksOnce(entry);
+            if (result.success || result.error !== error_1.PublicKeyResolutionError.RemoteJwksFetchFailed) {
+                return result;
+            }
+            if (attempt < maxFetchAttempts && retryDelayMs > 0) {
+                await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
+            }
+        }
+        return failure(error_1.PublicKeyResolutionError.RemoteJwksFetchFailed);
+    }
+    async function getJwks(entry, forceRefresh) {
+        const cached = cache.get(entry.issuer);
+        if (!forceRefresh && cached && cached.expiresAt > now()) {
+            return { success: true, value: cached };
+        }
+        return fetchJwks(entry);
+    }
+    return {
+        async resolve(request) {
+            const entry = options.trustRegistry.get(request.identifier);
+            if (!entry)
+                return failure(error_1.PublicKeyResolutionError.IssuerNotTrusted);
+            if (!request.kid)
+                return failure(error_1.PublicKeyResolutionError.MissingKeyIdentifier);
+            if (!request.alg)
+                return failure(error_1.PublicKeyResolutionError.MissingAlgorithm);
+            const tokenType = request.tokenType ?? "credential";
+            if (tokenType === "credential" &&
+                entry.credentialTypes !== undefined &&
+                (!request.credentialType || !entry.credentialTypes.includes(request.credentialType))) {
+                return failure(error_1.PublicKeyResolutionError.CredentialTypeNotAllowed);
+            }
+            const algorithmResult = options.algorithmPolicy.validateAlgorithm({
+                entry,
+                alg: request.alg,
+                tokenType,
+            });
+            if (!algorithmResult.success)
+                return algorithmResult;
+            const hadUsableCache = Boolean(cache.get(entry.issuer)?.expiresAt && cache.get(entry.issuer).expiresAt > now());
+            let jwksResult = await getJwks(entry, false);
+            if (!jwksResult.success)
+                return jwksResult;
+            let matches = jwksResult.value.keys.filter((key) => key.kid === request.kid);
+            if (matches.length === 0 && hadUsableCache) {
+                jwksResult = await getJwks(entry, true);
+                if (!jwksResult.success)
+                    return jwksResult;
+                matches = jwksResult.value.keys.filter((key) => key.kid === request.kid);
+            }
+            if (matches.length === 0)
+                return failure(error_1.PublicKeyResolutionError.KeyNotFound);
+            if (matches.length !== 1)
+                return failure(error_1.PublicKeyResolutionError.DuplicateKeyIdentifier);
+            const keyResult = options.algorithmPolicy.validateKey({
+                entry,
+                jwk: matches[0],
+                kid: request.kid,
+                alg: request.alg,
+                tokenType,
+            });
+            if (!keyResult.success)
+                return keyResult;
+            return { success: true, value: { jwk: { ...matches[0] } } };
+        },
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiUmVtb3RlSndrc1Jlc29sdmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3Jlc29sdmVycy9SZW1vdGVKd2tzUmVzb2x2ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUE0Q0EsZ0RBNEhDO0FBdktELG9DQUFvRDtBQTRCcEQsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztBQUMzQyxNQUFNLDBCQUEwQixHQUFHLEtBQUssQ0FBQztBQUN6QyxNQUFNLDBCQUEwQixHQUFHLEdBQUcsR0FBRyxJQUFJLENBQUM7QUFDOUMsTUFBTSxnQkFBZ0IsR0FBRyxHQUFHLENBQUM7QUFDN0IsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLENBQUM7QUFDckMsTUFBTSxzQkFBc0IsR0FBRyxHQUFHLENBQUM7QUFFbkMsU0FBUyxPQUFPLENBQUMsS0FBK0I7SUFDL0MsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFjLEVBQUUsS0FBSyxFQUFFLENBQUM7QUFDM0MsQ0FBQztBQUVELFNBQVMsS0FBSyxDQUFDLEtBQWM7SUFDNUIsT0FBTyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDN0UsQ0FBQztBQUVELFNBQWdCLGtCQUFrQixDQUFDLE9BQWtDO0lBQ3BFLE1BQU0sS0FBSyxHQUFHLElBQUksR0FBRyxFQUFzQixDQUFDO0lBQzVDLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUksb0JBQW9CLENBQUM7SUFDOUQsTUFBTSxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsZ0JBQWdCLElBQUksMEJBQTBCLENBQUM7SUFDaEYsTUFBTSxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsZ0JBQWdCLElBQUksMEJBQTBCLENBQUM7SUFDaEYsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sSUFBSSxnQkFBZ0IsQ0FBQztJQUNwRCxNQUFNLGdCQUFnQixHQUFHLE9BQU8sQ0FBQyxnQkFBZ0IsSUFBSSwwQkFBMEIsQ0FBQztJQUNoRixNQUFNLFlBQVksR0FBRyxPQUFPLENBQUMsWUFBWSxJQUFJLHNCQUFzQixDQUFDO0lBQ3BFLE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLElBQUksSUFBSSxDQUFDLEdBQUcsQ0FBQztJQUVwQyxJQUNDLFVBQVUsR0FBRyxDQUFDLElBQUksZ0JBQWdCLElBQUksQ0FBQyxJQUFJLGdCQUFnQixJQUFJLENBQUMsSUFBSSxPQUFPLElBQUksQ0FBQztRQUNoRixDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxnQkFBZ0IsSUFBSSxDQUFDO1FBQ2hFLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxZQUFZLENBQUMsSUFBSSxZQUFZLEdBQUcsQ0FBQyxFQUN0RCxDQUFDO1FBQ0YsTUFBTSxJQUFJLFNBQVMsQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFFRCxLQUFLLFVBQVUsYUFBYSxDQUFDLEtBQW1DO1FBQy9ELElBQUksUUFBZ0QsQ0FBQztRQUNyRCxJQUFJLENBQUM7WUFDSixRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLEVBQUUsTUFBTSxFQUFFLGtCQUFrQixFQUFFLEVBQUU7Z0JBQ3RGLFFBQVEsRUFBRSxLQUFLO2dCQUNmLE9BQU8sRUFBRSxnQkFBZ0I7Z0JBQ3pCLFlBQVksRUFBRSxDQUFDO2dCQUNmLGdCQUFnQixFQUFFLGdCQUFnQjtnQkFDbEMsYUFBYSxFQUFFLGdCQUFnQjthQUMvQixDQUFDLENBQUM7UUFDSixDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1IsT0FBTyxPQUFPLENBQUMsZ0NBQXdCLENBQUMscUJBQXFCLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFDO1lBQzFDLE9BQU8sT0FBTyxDQUFDLGdDQUF3QixDQUFDLHFCQUFxQixDQUFDLENBQUM7UUFDaEUsQ0FBQztRQUNELElBQUksT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ2pFLE9BQU8sT0FBTyxDQUFDLGdDQUF3QixDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUVELElBQUksYUFBcUIsQ0FBQztRQUMxQixJQUFJLENBQUM7WUFDSixhQUFhLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUM7UUFDcEYsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNSLE9BQU8sT0FBTyxDQUFDLGdDQUF3QixDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELElBQUksYUFBYSxHQUFHLGdCQUFnQixFQUFFLENBQUM7WUFDdEMsT0FBTyxPQUFPLENBQUMsZ0NBQXdCLENBQUMsbUJBQW1CLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBRUQsTUFBTSxJQUFJLEdBQUksUUFBUSxDQUFDLElBQTJCLENBQUMsSUFBSSxDQUFDO1FBQ3hELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzlGLE9BQU8sT0FBTyxDQUFDLGdDQUF3QixDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFlLEVBQUUsU0FBUyxFQUFFLEdBQUcsRUFBRSxHQUFHLFVBQVUsRUFBRSxJQUFJLEVBQUUsQ0FBQyxHQUFHLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDOUUsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ2hDLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBYSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsQ0FBQztJQUNsRCxDQUFDO0lBRUQsS0FBSyxVQUFVLFNBQVMsQ0FBQyxLQUFtQztRQUMzRCxLQUFLLElBQUksT0FBTyxHQUFHLENBQUMsRUFBRSxPQUFPLElBQUksZ0JBQWdCLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUM5RCxNQUFNLE1BQU0sR0FBRyxNQUFNLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMxQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLElBQUksTUFBTSxDQUFDLEtBQUssS0FBSyxnQ0FBd0IsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO2dCQUN2RixPQUFPLE1BQU0sQ0FBQztZQUNmLENBQUM7WUFDRCxJQUFJLE9BQU8sR0FBRyxnQkFBZ0IsSUFBSSxZQUFZLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3BELE1BQU0sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztZQUNuRSxDQUFDO1FBQ0YsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDLGdDQUF3QixDQUFDLHFCQUFxQixDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUVELEtBQUssVUFBVSxPQUFPLENBQUMsS0FBbUMsRUFBRSxZQUFxQjtRQUNoRixNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN2QyxJQUFJLENBQUMsWUFBWSxJQUFJLE1BQU0sSUFBSSxNQUFNLENBQUMsU0FBUyxHQUFHLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDekQsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFhLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDO1FBQ2xELENBQUM7UUFDRCxPQUFPLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN6QixDQUFDO0lBRUQsT0FBTztRQUNOLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBbUM7WUFDaEQsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQzVELElBQUksQ0FBQyxLQUFLO2dCQUFFLE9BQU8sT0FBTyxDQUFDLGdDQUF3QixDQUFDLGdCQUFnQixDQUFDLENBQUM7WUFDdEUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHO2dCQUFFLE9BQU8sT0FBTyxDQUFDLGdDQUF3QixDQUFDLG9CQUFvQixDQUFDLENBQUM7WUFDaEYsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHO2dCQUFFLE9BQU8sT0FBTyxDQUFDLGdDQUF3QixDQUFDLGdCQUFnQixDQUFDLENBQUM7WUFFNUUsTUFBTSxTQUFTLEdBQTBCLE9BQU8sQ0FBQyxTQUFTLElBQUksWUFBWSxDQUFDO1lBQzNFLElBQ0MsU0FBUyxLQUFLLFlBQVk7Z0JBQzFCLEtBQUssQ0FBQyxlQUFlLEtBQUssU0FBUztnQkFDbkMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxjQUFjLElBQUksQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLENBQUMsRUFDbkYsQ0FBQztnQkFDRixPQUFPLE9BQU8sQ0FBQyxnQ0FBd0IsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1lBQ25FLENBQUM7WUFDRCxNQUFNLGVBQWUsR0FBRyxPQUFPLENBQUMsZUFBZSxDQUFDLGlCQUFpQixDQUFDO2dCQUNqRSxLQUFLO2dCQUNMLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRztnQkFDaEIsU0FBUzthQUNULENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxlQUFlLENBQUMsT0FBTztnQkFBRSxPQUFPLGVBQWUsQ0FBQztZQUVyRCxNQUFNLGNBQWMsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxJQUFJLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBRSxDQUFDLFNBQVMsR0FBRyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQ2pILElBQUksVUFBVSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQztZQUM3QyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU87Z0JBQUUsT0FBTyxVQUFVLENBQUM7WUFFM0MsSUFBSSxPQUFPLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsR0FBRyxLQUFLLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUM3RSxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLGNBQWMsRUFBRSxDQUFDO2dCQUM1QyxVQUFVLEdBQUcsTUFBTSxPQUFPLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDO2dCQUN4QyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU87b0JBQUUsT0FBTyxVQUFVLENBQUM7Z0JBQzNDLE9BQU8sR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEtBQUssT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQzFFLENBQUM7WUFDRCxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQztnQkFBRSxPQUFPLE9BQU8sQ0FBQyxnQ0FBd0IsQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUMvRSxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQztnQkFBRSxPQUFPLE9BQU8sQ0FBQyxnQ0FBd0IsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1lBRTFGLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxlQUFlLENBQUMsV0FBVyxDQUFDO2dCQUNyRCxLQUFLO2dCQUNMLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO2dCQUNmLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRztnQkFDaEIsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHO2dCQUNoQixTQUFTO2FBQ1QsQ0FBQyxDQUFDO1lBQ0gsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPO2dCQUFFLE9BQU8sU0FBUyxDQUFDO1lBQ3pDLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLEdBQUcsRUFBRSxFQUFFLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDO1FBQzdELENBQUM7S0FDRCxDQUFDO0FBQ0gsQ0FBQyJ9