@adcp/sdk 6.6.0 → 6.8.0

package/dist/lib/server/decisioning/buyer-agent.d.ts

@@ -0,0 +1,498 @@
+/**
+ * Buyer-agent identity surface — Phase 1 of #1269.
+ *
+ * Models a buyer agent (the buying entity calling a seller) as a durable
+ * commercial relationship in the seller's records, distinct from the
+ * per-request credential that proves identity. The seller's `BuyerAgent`
+ * record carries onboarding state (status, billing capabilities, default
+ * account terms, allowed brands) that drives commercial behavior.
+ *
+ * The credential answers "who signed?" / "who holds this token?" The
+ * `BuyerAgent` answers "who is this counterparty in our books?" — analogous
+ * to how an SSP has a `buyer_id` row keyed to a DSP regardless of whether
+ * the DSP authenticates via OAuth, signed requests, or a pre-shared API
+ * key. Token proves identity; row drives commercial behavior.
+ *
+ * **Phase 1 scope.** This module ships in 3.0.x with the durable identity
+ * shape. Framework-level billing-capability enforcement and the new error
+ * codes from adcontextprotocol/adcp#3831 land in Phase 2 (#1292), gated on
+ * the SDK's 3.1 cutover.
+ *
+ * @public
+ */
+import type { BillingParty, BusinessEntity, PaymentTerms } from '../../types/tools.generated';
+/**
+ * Wire billing-party enum re-exported here for the registry surface.
+ * Aliased to `BillingMode` in design discussion (#1269); `BillingParty` is
+ * the canonical wire-schema name.
+ *
+ * @public
+ */
+export type BuyerAgentBillingMode = BillingParty;
+/**
+ * Kind-discriminated credential variant on `ResolvedAuthInfo.credential`.
+ *
+ * `kind: 'http_sig'` is cryptographically verified — `agent_url` derives
+ * from the `agents[]` entry whose `jwks_uri` resolved the keyid (per
+ * adcontextprotocol/adcp#3831), NOT from JWK / JWS / envelope claims.
+ * Security-relevant decisions (mutating-tool authorization, brand-side
+ * authorization checks once `BrandAuthorizationResolver` lands) MUST read
+ * `agent_url` from this variant, not from any informational field elsewhere
+ * on `ResolvedAuthInfo`.
+ *
+ * `kind: 'api_key'` and `kind: 'oauth'` carry no `agent_url` on the
+ * credential — the agent identity comes from the registry's
+ * `resolveByCredential` lookup against the seller's onboarding record.
+ *
+ * @public
+ */
+export type AdcpCredential = {
+    readonly kind: 'api_key';
+    readonly key_id: string;
+} | {
+    readonly kind: 'oauth';
+    readonly client_id: string;
+    readonly scopes: readonly string[];
+    readonly expires_at?: number;
+} | {
+    readonly kind: 'http_sig';
+    readonly keyid: string;
+    readonly agent_url: string;
+    readonly verified_at: number;
+};
+/**
+ * Status of a buyer-agent record. Drives framework-level request gating:
+ *
+ * - `'active'` — normal operation; requests dispatch.
+ * - `'suspended'` — temporarily paused; new requests rejected with
+ *   `PERMISSION_DENIED` and `error.details.scope: 'agent'`. In-flight tasks
+ *   are NOT retroactively cancelled — webhooks fire, status updates flow.
+ *   Sellers who need hard cutoff implement that in their platform method
+ *   via `BuyerAgent.status` check.
+ * - `'blocked'` — permanently denied; new requests rejected the same way as
+ *   `'suspended'`. Recovery requires re-onboarding.
+ *
+ * Phase 1 emits `PERMISSION_DENIED + scope:'agent'` for both rejection
+ * states. Phase 2 (#1292) may swap to upstream `AGENT_SUSPENDED` /
+ * `AGENT_BLOCKED` codes if those land via separate spec PR.
+ *
+ * @public
+ */
+export type BuyerAgentStatus = 'active' | 'suspended' | 'blocked';
+/**
+ * Buyer-agent record — durable commercial relationship in the seller's
+ * onboarding ledger. Returned by `BuyerAgentRegistry.resolve` and threaded
+ * to handlers via `ctx.agent`.
+ *
+ * Fields are `readonly` to prevent post-resolution mutation that would
+ * silently affect downstream `accounts.resolve` decisions. Mirrors the
+ * Python frozen-dataclass shape for cross-language parity.
+ *
+ * @public
+ */
+export interface BuyerAgent {
+    /**
+     * Canonical agent URL. Treat like a public key: stable enough that
+     * rotation requires explicit re-onboarding. The framework's signed-path
+     * resolution checks both this canonical URL and any `aliases[]` against
+     * the verified `credential.agent_url`. No separate seller-internal id —
+     * adopters who want one mint it in their own DB and key off `agent_url`.
+     */
+    readonly agent_url: string;
+    /** Human-readable name for ops / reporting / UI. */
+    readonly display_name: string;
+    /** See {@link BuyerAgentStatus}. */
+    readonly status: BuyerAgentStatus;
+    /**
+     * Billing models this agent is permitted to request on `sync_accounts`.
+     * Set-valued so real-world models (mixed-billing holdco with both direct
+     * and agency-mediated brands) can be expressed without picking one mode.
+     *
+     * Migration from earlier single-enum sketches:
+     * - `passthrough_only` ↔ `new Set(['operator'])`
+     * - `agent_billable` ↔ `new Set(['agent', 'operator', 'advertiser'])`
+     *
+     * Phase 1 does not enforce — adopters who want enforcement implement it
+     * adopter-side. Phase 2 (#1292) wires framework-level enforcement to the
+     * `BILLING_NOT_PERMITTED_FOR_AGENT` code from adcp#3831 once the SDK
+     * pin moves to AdCP 3.1.
+     */
+    readonly billing_capabilities: ReadonlySet<BuyerAgentBillingMode>;
+    /**
+     * Commercial defaults applied when accounts are provisioned under this
+     * agent. Framework merges with per-request overrides on a SPARSE-MERGE
+     * basis: per-request values win for any present field including explicit
+     * `null`. The request is the authoritative current intent; defaults are
+     * seeds for fields the buyer didn't speak to. Adopters who want
+     * non-null-override semantics pre-filter nulls themselves.
+     */
+    readonly default_account_terms?: {
+        readonly rate_card?: string;
+        readonly payment_terms?: PaymentTerms;
+        readonly credit_limit?: {
+            readonly amount: number;
+            readonly currency: string;
+        };
+        readonly billing_entity?: BusinessEntity;
+    };
+    /**
+     * Static allowlist of brand domains this agent may act for. Pre-RFC
+     * stand-in for the per-request authorization check that
+     * `BrandAuthorizationResolver` will perform once it lands (gated on
+     * Python's RFC + adcp brand-side authz spec finalizing).
+     *
+     * When both this list and `BrandAuthorizationResolver` are configured,
+     * the framework AND-composes them: registry says "we accept this agent
+     * at all"; resolver says "and they're authorized for THIS brand." One-
+     * minor deprecation cycle starts the release after
+     * `BrandAuthorizationResolver` ships; sellers who want the static gate
+     * gone stop populating the field.
+     */
+    readonly allowed_brands?: readonly string[];
+    /**
+     * Optional grace-period overlap during `agent_url` rotation. Framework's
+     * signed-path resolution checks both canonical `agent_url` AND `aliases`
+     * against the `agents[]` entry that resolved the verified keyid.
+     *
+     * v1 ships with the field present but no special framework behavior
+     * beyond resolution; v1.5 adds the documented sunset window pattern.
+     * Most adopters never populate this.
+     */
+    readonly aliases?: readonly string[];
+    /**
+     * When `true`, this buyer agent may ONLY operate against sandbox
+     * accounts. The framework rejects any request whose resolved
+     * `Account.sandbox !== true` with `PERMISSION_DENIED`,
+     * `error.details.scope: 'agent'`, `error.details.reason: 'sandbox-only'`.
+     *
+     * Defense-in-depth for test agents (CI runners, internal QA agents,
+     * partner pre-prod environments): if the test credential leaks, blast
+     * radius is bounded to sandbox accounts. Production agents leave this
+     * unset (or `false`).
+     *
+     * Composes with `Account.sandbox` (the wire-level sandbox marker on
+     * the resolved Account record): the gate fires when `agent.sandbox_only
+     * === true AND ctx.account?.sandbox !== true`. Account-less tools
+     * (`provide_performance_feedback`, `list_creative_formats`, etc.) pass
+     * the gate — they don't operate on a specific account, so the
+     * sandbox/production axis doesn't apply.
+     *
+     * **Load-bearing pair.** For the gate to admit ANY traffic from a
+     * `sandbox_only` agent, the seller's `accounts.resolve` MUST return
+     * `sandbox: true` on the accounts that agent should reach. Adopters
+     * cloning the worked example with `sandbox_only: true` on their seed
+     * agent and a hardcoded `sandbox: true` resolver are demoware-correct;
+     * production adopters either flip the agent to `sandbox_only: false`
+     * OR have their resolver return `sandbox: true` only for actually-
+     * sandbox accounts. Mismatches between these two sides 403 every
+     * request — failure is loud, not silent.
+     *
+     * Default `false` (or undefined) — production-allowed.
+     */
+    readonly sandbox_only?: boolean;
+}
+/**
+ * Minimal `ResolvedAuthInfo`-shaped argument to `BuyerAgentRegistry.resolve`.
+ * Defined here to break a circular dependency with `account.ts` and to keep
+ * the registry surface decoupled from the legacy `ResolvedAuthInfo` shape
+ * during the two-minor migration cycle.
+ *
+ * Stage 3 of the implementation will widen `ResolvedAuthInfo` itself with
+ * the `credential` field; this interface is the registry-side contract.
+ *
+ * @public
+ */
+export interface BuyerAgentResolveInput {
+    /**
+     * The kind-discriminated credential proven on the request. Stage 3 of
+     * the Phase 1 implementation will populate this from the verifier
+     * (`http_sig`) or from the legacy `ResolvedAuthInfo` shape (`api_key` /
+     * `oauth`); until then, callers pass it through directly when available.
+     *
+     * When absent, the registry's `resolve` returns `null` — the legacy-
+     * shape synthesis lands in Stage 3 alongside the `ResolvedAuthInfo`
+     * migration shim, not Stage 1.
+     */
+    readonly credential?: AdcpCredential;
+    /**
+     * Adopter-provided extension data threaded from `authenticate()`. Populated
+     * from the `extra` field stamped on the `AuthPrincipal` returned by the
+     * `authenticate()` callback (e.g. `verifyApiKey({ verify: token => ({ ...,
+     * extra: { demo_token: token } }) })`). Forwarded to the second argument of
+     * {@link ResolveBuyerAgentByCredential} by `bearerOnly` and `mixed` factories.
+     *
+     * The full MCP `AuthInfo.extra` bag is forwarded here — it includes JWT
+     * claims (if `verifyBearer` was used) and the SDK-internal `credential` key
+     * alongside adopter-stamped fields. Do not use reserved key names (`credential`,
+     * `iss`, `sub`, `aud`, `exp`, `iat`, `nbf`, `jti`) in the `extra` object
+     * to avoid collisions.
+     */
+    readonly extra?: Record<string, unknown>;
+}
+/**
+ * Buyer-agent registry — durable identity surface called once per request
+ * before `accounts.resolve`. Adopters construct via one of the factory
+ * functions; the resulting object exposes a single `resolve` method the
+ * framework dispatcher invokes.
+ *
+ * Three implementer postures, encoded at construction:
+ *
+ * - {@link signingOnly} — production target. Bearer/API-key/OAuth requests
+ *   refused at the registry layer; signed requests resolve via
+ *   `resolveByAgentUrl` against the verified `credential.agent_url`.
+ * - {@link bearerOnly} — pre-trust beta. No signature support; bearer-shaped
+ *   credentials resolve via `resolveByCredential` against the seller's
+ *   onboarding ledger.
+ * - {@link mixed} — transition. Both paths active. Signed traffic resolves
+ *   cryptographically; bearer falls through to the legacy key table.
+ *
+ * The factories produce a `BuyerAgentRegistry` whose `resolve` method
+ * routes by `credential.kind` and returns `null` when the credential is
+ * not honored by the configured posture (e.g., bearer credential against
+ * a `signingOnly` registry → `null`, framework rejects the request).
+ *
+ * @public
+ */
+export interface BuyerAgentRegistry {
+    /**
+     * Resolve a request's credential to a buyer-agent record.
+     *
+     * Returns `null` when the credential is not recognized OR when the
+     * configured posture rejects the credential's kind (e.g., `bearerOnly`
+     * registry receiving an `http_sig` credential).
+     *
+     * Throws when the underlying lookup fails (DB outage, identity-provider
+     * 5xx). Framework projects the throw to `SERVICE_UNAVAILABLE` so the
+     * buyer can retry; the inner error is logged server-side.
+     */
+    resolve(authInfo: BuyerAgentResolveInput): Promise<BuyerAgent | null>;
+}
+/**
+ * Resolver function type for the signed path. Receives the
+ * cryptographically-verified `agent_url` from the request signature and
+ * returns the seller's record (or `null` for unrecognized agents).
+ *
+ * @public
+ */
+export type ResolveBuyerAgentByAgentUrl = (agent_url: string) => Promise<BuyerAgent | null>;
+/**
+ * Resolver function type for the bearer/API-key/OAuth path. Receives the
+ * raw credential and (optionally) adopter-provided extension data, and
+ * returns the seller's record (or `null` for unrecognized credentials).
+ *
+ * **Implementations MUST switch on `credential.kind`** and reject (return
+ * `null`) on any kind they don't explicitly recognize. A naive
+ * `WHERE token = $1` lookup against an api-key table would otherwise mis-
+ * resolve when handed an `http_sig` credential whose `keyid` happens to
+ * collide with an existing api-key value — the credential variants share
+ * no key namespace, and the registry MUST NOT bridge them.
+ *
+ * **Credential exposure.** This callback receives unredacted credential
+ * payloads (token, key_id, client_id). Adopters MUST NOT log raw credential
+ * values AND MUST NOT include them in thrown `Error` messages — the
+ * framework projects `err.message` into `error.details.reason` on the wire
+ * when `exposeErrorDetails` is on (default: non-production). Throw with
+ * a generic message and log the credential separately if you need it for
+ * server-side debugging. The framework redacts credential payloads in any
+ * log line emitted from registry-resolution code (Stage 4); adopter
+ * implementations are expected to do the same (or to use prepared-statement
+ * parameters that don't log).
+ *
+ * **`extra` — adopter extension data.** When the `authenticate()` callback
+ * stamps an `extra` field on the returned `AuthPrincipal` (e.g.
+ * `verifyApiKey({ verify: token => ({ principal, extra: { demo_token: token } }) })`),
+ * the framework propagates that value through `ResolvedAuthInfo.extra` to
+ * this second argument. Use it to carry pre-hash data your authenticator
+ * already derived (prefix patterns, tenant IDs, test-kit flags) that you
+ * can't recover from the hashed `key_id`. Apply the same care as for
+ * `credential`: do not log raw values from `extra` or include them in
+ * thrown `Error` messages.
+ *
+ * Existing single-argument implementations `(credential) => ...` satisfy
+ * this type — the second argument is optional.
+ *
+ * @public
+ */
+export type ResolveBuyerAgentByCredential = (credential: AdcpCredential, extra?: Record<string, unknown>) => Promise<BuyerAgent | null>;
+/**
+ * Construct a signing-only `BuyerAgentRegistry`. Bearer/API-key/OAuth
+ * requests resolve to `null` (framework rejects); only signed requests
+ * are honored.
+ *
+ * The path-of-least-resistance factory for production sellers — implement
+ * one resolver, traffic that doesn't sign is automatically refused.
+ *
+ * @public
+ */
+export declare function signingOnly(opts: {
+    resolveByAgentUrl: ResolveBuyerAgentByAgentUrl;
+}): BuyerAgentRegistry;
+/**
+ * Construct a bearer-only `BuyerAgentRegistry`. Signed requests still
+ * authenticate via the existing signature-verifier surface, but the
+ * registry resolves all credential kinds via `resolveByCredential` against
+ * the seller's onboarding ledger — useful in pre-trust-beta deployments
+ * where the seller maintains a credential→agent table out-of-band.
+ *
+ * @public
+ */
+export declare function bearerOnly(opts: {
+    resolveByCredential: ResolveBuyerAgentByCredential;
+}): BuyerAgentRegistry;
+/**
+ * Construct a mixed-mode `BuyerAgentRegistry` that supports both signed and
+ * bearer/OAuth/API-key credentials. Signed traffic resolves through
+ * `resolveByAgentUrl` against the verified `credential.agent_url`; non-
+ * signed credentials fall through to `resolveByCredential`.
+ *
+ * Framework prefers the signed path: when both an `Authorization: Bearer`
+ * and a valid `Signature: ...` are present on the same request, the
+ * `http_sig` credential variant is what reaches `resolve`, and only
+ * `resolveByAgentUrl` is invoked. The bearer path is never consulted on
+ * signed traffic.
+ *
+ * @public
+ */
+export declare function mixed(opts: {
+    resolveByAgentUrl: ResolveBuyerAgentByAgentUrl;
+    resolveByCredential: ResolveBuyerAgentByCredential;
+}): BuyerAgentRegistry;
+/**
+ * Options for {@link cached}.
+ *
+ * @public
+ */
+export interface BuyerAgentCacheOptions {
+    /**
+     * TTL (seconds) for successful resolutions. Default: 60.
+     *
+     * Adopters whose registry sits in front of a Postgres / external lookup
+     * benefit from caching for the request lifecycle of a single buyer's
+     * traffic burst. Long TTLs (several minutes) are appropriate for
+     * stable agent records; short TTLs (a few seconds) for rapidly-mutating
+     * relationships (suspension flags, billing-capability changes).
+     *
+     * Status changes propagate within `ttlSeconds` of the seller flipping
+     * the agent's row in their store — adopters needing instant
+     * propagation either set a short TTL or invalidate the cache out-of-
+     * band when they mutate.
+     */
+    ttlSeconds?: number;
+    /**
+     * TTL (seconds) for `null` returns (negative cache). Default: 0
+     * (don't cache nulls). A freshly onboarded agent is recognized within
+     * one request when nulls aren't cached; sellers willing to delay
+     * recognition by N seconds in exchange for fewer DB hits set this to
+     * a small positive value.
+     *
+     * **Timing-oracle note.** When null caching is enabled, an
+     * unauthenticated prober comparing hit vs. miss latency on null
+     * returns can infer "this credential was probed recently." Pair with
+     * rate-limiting at the edge if your deployment runs in a hostile
+     * environment. The default (0) avoids the oracle entirely.
+     */
+    cacheNullsTtlSeconds?: number;
+    /**
+     * Maximum cache entries before LRU eviction. Default: 10000.
+     * The cache is bounded so a malicious or misconfigured caller spamming
+     * unique credentials (e.g., random api keys probing the seller's
+     * onboarding surface) can't exhaust memory.
+     */
+    maxSize?: number;
+    /** Override clock for deterministic tests. Returns ms since epoch. */
+    now?: () => number;
+}
+/**
+ * Cached registry surface. Strict superset of {@link BuyerAgentRegistry}
+ * with explicit invalidation hooks adopters call when they mutate the
+ * backing record (status flip, billing-capability change). Without
+ * `invalidate`, adopters could only purge stale entries by waiting for
+ * `ttlSeconds` to expire — for status changes that's exactly the
+ * window during which a now-suspended agent retains access.
+ *
+ * `BuyerAgentRegistry.cached(...)` returns this richer type so adopters
+ * can hold a reference and call the invalidation methods directly.
+ *
+ * @public
+ */
+export interface CachedBuyerAgentRegistry extends BuyerAgentRegistry {
+    /**
+     * Drop the cache entry for a single credential. No-op when the
+     * credential isn't currently cached. Use this when the agent's
+     * record is mutated in your backing store so the next request
+     * re-resolves rather than serving the stale entry.
+     */
+    invalidate(credential: AdcpCredential): void;
+    /**
+     * Drop all cached entries. Use on bulk record mutations (onboarding-
+     * record migration, daily reset) or test-environment cleanup.
+     */
+    clear(): void;
+}
+/**
+ * Wrap a {@link BuyerAgentRegistry} with TTL-based result caching and
+ * concurrent-resolve coalescing. Adopters whose `resolveByAgentUrl` /
+ * `resolveByCredential` hit a database or external service compose
+ * the cache via:
+ *
+ * ```ts
+ * const registry = BuyerAgentRegistry.cached(
+ *   BuyerAgentRegistry.signingOnly({
+ *     resolveByAgentUrl: async url => db.findBuyerAgent(url),
+ *   }),
+ *   { ttlSeconds: 60 }
+ * );
+ * ```
+ *
+ * Cache properties:
+ * - **TTL-bounded.** Entries expire after `ttlSeconds` (default 60).
+ *   Negative cache (null returns) is opt-in via `cacheNullsTtlSeconds`.
+ * - **LRU-evicted.** Bounded to `maxSize` entries (default 10000).
+ *   Oldest-accessed entry evicts on overflow.
+ * - **Concurrent-resolve coalesced.** N parallel `resolve()` calls on
+ *   the same key produce ONE upstream invocation. Subsequent callers
+ *   await the in-flight promise — important when the seller front-ends
+ *   a slow upstream and a buyer burst arrives.
+ * - **Per-kind cache keys.** Keys are namespaced (`http_sig:`,
+ *   `api_key:`, `oauth:`) so cross-kind collisions cannot leak an agent
+ *   resolved through one credential type to a different type.
+ * - **`extra` is not part of the cache key.** The cache keys on credential
+ *   identity only. Two requests with the same credential but different
+ *   `authInfo.extra` content return the same cached result. This is the
+ *   right behaviour when `extra` carries pre-hash data derived from the
+ *   same token (the motivating use-case), but can be surprising if you
+ *   put per-request session context in `extra`. Set a short `ttlSeconds`
+ *   or skip the cache decorator if your resolution is sensitive to `extra`
+ *   variance across requests with the same credential.
+ * - **Skips uncacheable inputs.** When the credential is undefined,
+ *   `resolve()` falls through to the inner registry on each call —
+ *   adopters wiring custom auth without `credential` synthesis (Stage 3
+ *   migration cycle) see no behavior change.
+ * - **Explicit invalidation.** Returns a {@link CachedBuyerAgentRegistry}
+ *   with `.invalidate(credential)` and `.clear()` methods. Call
+ *   `invalidate` when you mutate an agent's record (status flip,
+ *   billing-capability change) so the next request re-resolves rather
+ *   than serving the stale entry. Without this, the stale-status window
+ *   is bounded by `ttlSeconds` — a now-suspended agent retains access
+ *   for up to that long.
+ *
+ * Mirrors the `AsyncCachingJwksResolver` over `JwksResolver` pattern
+ * already in `src/lib/signing/`.
+ *
+ * @public
+ */
+export declare function cached(inner: BuyerAgentRegistry, options?: BuyerAgentCacheOptions): CachedBuyerAgentRegistry;
+/**
+ * Factory namespace mirroring the documented surface from #1269. Adopters
+ * import the namespace and call `BuyerAgentRegistry.signingOnly({...})`,
+ * etc. Individual functions are also exported above for direct use.
+ *
+ * @public
+ */
+export declare const BuyerAgentRegistry: {
+    signingOnly: typeof signingOnly;
+    bearerOnly: typeof bearerOnly;
+    mixed: typeof mixed;
+    cached: typeof cached;
+};
+//# sourceMappingURL=buyer-agent.d.ts.map

package/dist/lib/server/decisioning/buyer-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buyer-agent.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/decisioning/buyer-agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE9F;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAElE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,oDAAoD;IACpD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAElC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAElE;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE;QAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC;QACtC,QAAQ,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;KAC1C,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAMD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACvE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;AAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC1C,UAAU,EAAE,cAAc,EAC1B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;AAyEhC;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,iBAAiB,EAAE,2BAA2B,CAAA;CAAE,GAAG,kBAAkB,CAmBxG;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAAE,mBAAmB,EAAE,6BAA6B,CAAA;CAAE,GAAG,kBAAkB,CAa3G;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE;IAC1B,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,mBAAmB,EAAE,6BAA6B,CAAC;CACpD,GAAG,kBAAkB,CA6BrB;AAMD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAClE;;;;;OAKG;IACH,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAE7C;;;OAGG;IACH,KAAK,IAAI,IAAI,CAAC;CACf;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,GAAE,sBAA2B,GAAG,wBAAwB,CA6FhH;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;;;CAK9B,CAAC"}