@adcp/sdk 6.6.0 → 6.8.0

package/dist/lib/server/upstream-helpers.js

@@ -0,0 +1,140 @@
+"use strict";
+/**
+ * Adapter translation helpers for AdCP seller agents.
+ *
+ * Every AdCP adapter needs the same two things:
+ *
+ * 1. Bidirectional key translation (AdCP wire values ↔ upstream platform values).
+ * 2. A thin typed HTTP client for upstream platform APIs.
+ *
+ * These helpers replace the per-adapter boilerplate that appears in every
+ * reference adapter (sales-social, signal-marketplace, creative-template,
+ * sales-guaranteed) without encoding any domain-specific logic.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTranslationMap = createTranslationMap;
+exports.createUpstreamHttpClient = createUpstreamHttpClient;
+/**
+ * Build a bidirectional translation map from a `{ adcpKey: upstreamKey }`
+ * record. Keys on the left are AdCP wire values; values on the right are
+ * upstream platform values.
+ *
+ * TypeScript infers literal types from the object literal, so `toUpstream`
+ * and `toAdcp` return the precise union of known values rather than `string`.
+ *
+ * @example
+ * ```ts
+ * const channelMap = createTranslationMap({
+ *   olv: 'video',
+ *   ctv: 'ctv',
+ * });
+ * channelMap.toUpstream('olv'); // 'video' | undefined
+ * channelMap.toAdcp('video');   // 'olv' | undefined
+ * ```
+ */
+function createTranslationMap(adcpToUpstream) {
+    const forward = new Map(Object.entries(adcpToUpstream));
+    const reverse = new Map();
+    for (const [a, b] of forward) {
+        reverse.set(b, a);
+    }
+    return {
+        toUpstream: (k) => forward.get(k),
+        toAdcp: (k) => reverse.get(k),
+        hasAdcp: (k) => forward.has(k),
+        hasUpstream: (k) => reverse.has(k),
+    };
+}
+async function resolveAuthHeader(auth, ctx) {
+    switch (auth.kind) {
+        case 'static_bearer':
+            return { Authorization: `Bearer ${auth.token}` };
+        case 'dynamic_bearer': {
+            const token = await auth.getToken(ctx);
+            return { Authorization: `Bearer ${token}` };
+        }
+        case 'api_key':
+            return { [auth.header]: auth.key };
+        case 'none':
+            return {};
+    }
+}
+async function doRequest(baseUrl, auth, defaultHeaders, fetchImpl, method, path, options) {
+    const authHeader = await resolveAuthHeader(auth, options.authContext);
+    const mergedHeaders = {
+        ...defaultHeaders,
+        ...authHeader,
+        ...options.headers,
+    };
+    let url = `${baseUrl}${path}`;
+    if (options.params) {
+        const qs = Object.entries(options.params)
+            .filter(([, v]) => v !== undefined)
+            .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`)
+            .join('&');
+        if (qs)
+            url = `${url}?${qs}`;
+    }
+    const init = { method, headers: mergedHeaders };
+    if (options.body !== undefined) {
+        init.body = JSON.stringify(options.body);
+        mergedHeaders['Content-Type'] = 'application/json';
+    }
+    const res = await fetchImpl(url, init);
+    // 404 → null body (not an error — resource absent is a common upstream signal)
+    if (res.status === 404)
+        return { status: 404, body: null };
+    const text = await res.text();
+    // Non-2xx always throws — callers must not silently swallow errors
+    if (!res.ok) {
+        throw new Error(`Upstream ${method} ${path} failed: ${res.status} ${text.slice(0, 200)}`);
+    }
+    // Empty body (204 No Content, etc.)
+    if (!text)
+        return { status: res.status, body: null };
+    const body = JSON.parse(text);
+    return { status: res.status, body };
+}
+/**
+ * Create a thin typed HTTP client for upstream platform APIs.
+ *
+ * Handles auth injection, query-string serialization, and 404→null
+ * translation so adapters can focus on domain logic.
+ *
+ * @example
+ * ```ts
+ * const upstream = createUpstreamHttpClient({
+ *   baseUrl: process.env.UPSTREAM_URL!,
+ *   auth: { kind: 'static_bearer', token: process.env.UPSTREAM_TOKEN! },
+ *   defaultHeaders: { 'X-Tenant-Id': tenantId },
+ * });
+ *
+ * const { body } = await upstream.get<Cohort[]>('/v2/cohorts');
+ * const cohorts = body ?? [];
+ * ```
+ */
+function createUpstreamHttpClient(options) {
+    const { baseUrl, auth, defaultHeaders = {}, fetch: fetchImpl = globalThis.fetch } = options;
+    return {
+        get: (path, params, headers, opts) => doRequest(baseUrl, auth, defaultHeaders, fetchImpl, 'GET', path, {
+            params,
+            headers,
+            authContext: opts?.authContext,
+        }),
+        post: (path, body, headers, opts) => doRequest(baseUrl, auth, defaultHeaders, fetchImpl, 'POST', path, {
+            body,
+            headers,
+            authContext: opts?.authContext,
+        }),
+        put: (path, body, headers, opts) => doRequest(baseUrl, auth, defaultHeaders, fetchImpl, 'PUT', path, {
+            body,
+            headers,
+            authContext: opts?.authContext,
+        }),
+        delete: (path, headers, opts) => doRequest(baseUrl, auth, defaultHeaders, fetchImpl, 'DELETE', path, {
+            headers,
+            authContext: opts?.authContext,
+        }),
+    };
+}
+//# sourceMappingURL=upstream-helpers.js.map

package/dist/lib/server/upstream-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-helpers.js","sourceRoot":"","sources":["../../../src/lib/server/upstream-helpers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AA2DH,oDAgBC;AAgND,4DA2BC;AA7QD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,oBAAoB,CAClC,cAAiB;IAIjB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAkB,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAQ,CAAC;IAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,CAAC,CAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,MAAM,EAAE,CAAC,CAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,OAAO,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAM,CAAC;QACnD,WAAW,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAM,CAAC;KACxD,CAAC;AACJ,CAAC;AAwHD,KAAK,UAAU,iBAAiB,CAAC,IAAkB,EAAE,GAAiB;IACpE,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,eAAe;YAClB,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACnD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAAe,EACf,IAAkB,EAClB,cAAsC,EACtC,SAAkC,EAClC,MAAc,EACd,IAAY,EACZ,OAKC;IAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,aAAa,GAA2B;QAC5C,GAAG,cAAc;QACjB,GAAG,UAAU;QACb,GAAG,OAAO,CAAC,OAAO;KACnB,CAAC;IAEF,IAAI,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,EAAE;YAAE,GAAG,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,aAAa,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAE9B,mEAAmE;IACnE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,YAAY,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,oCAAoC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,wBAAwB,CAAC,OAAkC;IACzE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC;IAC5F,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CACnC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;YAC/D,MAAM;YACN,OAAO;YACP,WAAW,EAAE,IAAI,EAAE,WAAW;SAC/B,CAAC;QACJ,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAClC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;YAChE,IAAI;YACJ,OAAO;YACP,WAAW,EAAE,IAAI,EAAE,WAAW;SAC/B,CAAC;QACJ,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CACjC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;YAC/D,IAAI;YACJ,OAAO;YACP,WAAW,EAAE,IAAI,EAAE,WAAW;SAC/B,CAAC;QACJ,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAC9B,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;YAClE,OAAO;YACP,WAAW,EAAE,IAAI,EAAE,WAAW;SAC/B,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/lib/signing/agent-resolver/canonicalize.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Origin canonicalization for the brand_json_url verifier algorithm.
+ * `security.mdx` §"Quickstart: implement a `brand_json_url`-based verifier"
+ * step 3 mandates: ASCII-lowercase the host, then convert to IDNA-2008
+ * A-label (Punycode) form before byte-equality. A non-canonical comparison
+ * (raw `Example.COM` vs `example.com`, or U-label vs A-label) silently
+ * rejects legitimate traffic.
+ *
+ * Node's WHATWG URL parser already performs IDNA-2008 A-label conversion
+ * and ASCII-lowercases the host on construction (`new URL('https://Bücher.example/').hostname`
+ * returns `xn--bcher-kva.example`). We delegate to it rather than vendoring
+ * an IDNA implementation — the rule is "use the platform's IDNA-2008", not
+ * "ship our own".
+ */
+export declare class CanonicalizeError extends Error {
+    readonly meta: {
+        input: string;
+    };
+    constructor(message: string, meta: {
+        input: string;
+    });
+}
+/**
+ * Canonicalize a hostname (no scheme, no port, no path). Throws on inputs
+ * that the URL parser rejects.
+ */
+export declare function canonicalizeHost(host: string): string;
+/**
+ * Canonicalize the origin component (scheme + host) of a URL or origin string.
+ * Accepts either a full URL (`https://Example.COM/path`) or a bare origin
+ * (`https://Example.COM`). Output is `https://example.com` form — scheme +
+ * canonical host, no port when default, no path/query.
+ *
+ * Used for the step-7 `identity.key_origins` consistency check: the verifier
+ * compares the canonicalized host of the resolved `jwks_uri` against the
+ * canonicalized host of the declared `key_origins.{purpose}` value.
+ */
+export declare function canonicalizeOrigin(originOrUrl: string): string;
+/**
+ * Compare two origins (scheme + host + port) for byte-equality after
+ * canonicalization. Wrong scheme, wrong port, or wrong host all return false.
+ */
+export declare function originsEqual(a: string, b: string): boolean;
+//# sourceMappingURL=canonicalize.d.ts.map

package/dist/lib/signing/agent-resolver/canonicalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,qBAAa,iBAAkB,SAAQ,KAAK;IAGxC,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;gBADhC,OAAO,EAAE,MAAM,EACN,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;CAKnC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAe9D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAM1D"}

package/dist/lib/signing/agent-resolver/canonicalize.js

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * Origin canonicalization for the brand_json_url verifier algorithm.
+ * `security.mdx` §"Quickstart: implement a `brand_json_url`-based verifier"
+ * step 3 mandates: ASCII-lowercase the host, then convert to IDNA-2008
+ * A-label (Punycode) form before byte-equality. A non-canonical comparison
+ * (raw `Example.COM` vs `example.com`, or U-label vs A-label) silently
+ * rejects legitimate traffic.
+ *
+ * Node's WHATWG URL parser already performs IDNA-2008 A-label conversion
+ * and ASCII-lowercases the host on construction (`new URL('https://Bücher.example/').hostname`
+ * returns `xn--bcher-kva.example`). We delegate to it rather than vendoring
+ * an IDNA implementation — the rule is "use the platform's IDNA-2008", not
+ * "ship our own".
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CanonicalizeError = void 0;
+exports.canonicalizeHost = canonicalizeHost;
+exports.canonicalizeOrigin = canonicalizeOrigin;
+exports.originsEqual = originsEqual;
+class CanonicalizeError extends Error {
+    meta;
+    constructor(message, meta) {
+        super(message);
+        this.meta = meta;
+        this.name = 'CanonicalizeError';
+    }
+}
+exports.CanonicalizeError = CanonicalizeError;
+/**
+ * Canonicalize a hostname (no scheme, no port, no path). Throws on inputs
+ * that the URL parser rejects.
+ */
+function canonicalizeHost(host) {
+    if (typeof host !== 'string' || host.length === 0) {
+        throw new CanonicalizeError('Empty host', { input: host });
+    }
+    try {
+        const u = new URL(`https://${host}/`);
+        return u.hostname;
+    }
+    catch {
+        throw new CanonicalizeError(`Invalid host: ${host}`, { input: host });
+    }
+}
+/**
+ * Canonicalize the origin component (scheme + host) of a URL or origin string.
+ * Accepts either a full URL (`https://Example.COM/path`) or a bare origin
+ * (`https://Example.COM`). Output is `https://example.com` form — scheme +
+ * canonical host, no port when default, no path/query.
+ *
+ * Used for the step-7 `identity.key_origins` consistency check: the verifier
+ * compares the canonicalized host of the resolved `jwks_uri` against the
+ * canonicalized host of the declared `key_origins.{purpose}` value.
+ */
+function canonicalizeOrigin(originOrUrl) {
+    if (typeof originOrUrl !== 'string' || originOrUrl.length === 0) {
+        throw new CanonicalizeError('Empty origin', { input: originOrUrl });
+    }
+    let parsed;
+    try {
+        parsed = new URL(originOrUrl);
+    }
+    catch {
+        throw new CanonicalizeError(`Invalid origin: ${originOrUrl}`, { input: originOrUrl });
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new CanonicalizeError(`Unsupported scheme: ${parsed.protocol}`, { input: originOrUrl });
+    }
+    const port = parsed.port ? `:${parsed.port}` : '';
+    return `${parsed.protocol}//${parsed.hostname}${port}`;
+}
+/**
+ * Compare two origins (scheme + host + port) for byte-equality after
+ * canonicalization. Wrong scheme, wrong port, or wrong host all return false.
+ */
+function originsEqual(a, b) {
+    try {
+        return canonicalizeOrigin(a) === canonicalizeOrigin(b);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=canonicalize.js.map

package/dist/lib/signing/agent-resolver/canonicalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.js","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/canonicalize.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAgBH,4CAUC;AAYD,gDAeC;AAMD,oCAMC;AA/DD,MAAa,iBAAkB,SAAQ,KAAK;IAG/B;IAFX,YACE,OAAe,EACN,IAAuB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,SAAI,GAAJ,IAAI,CAAmB;QAGhC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AARD,8CAQC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,iBAAiB,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,WAAmB;IACpD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/lib/signing/agent-resolver/capabilities-types.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Forward-compat narrow access for `identity.brand_json_url` and the
+ * surrounding fields from a `get_adcp_capabilities` response. The field
+ * lands in the spec as a typed property in 3.1's additive minor (PR
+ * adcontextprotocol/adcp#3690); 3.0.5 already accepts it on the wire by
+ * relaxing `identity.additionalProperties` to `true`, but the generated
+ * TS surface won't include it until codegen runs against a release that
+ * declares it as a typed property. This file bridges the gap on both
+ * sides:
+ *
+ *   - **Verifier side**: `readBrandJsonUrl(caps)` peels the field out of
+ *     an unknown payload without forcing the caller into `as any`.
+ *   - **Publisher side**: TS sellers constructing their capabilities
+ *     response in 3.0.5+ can spread `IdentityPosture` over the generated
+ *     `identity` shape to set `brand_json_url` without losing types on
+ *     the rest of the block:
+ *
+ *       ```ts
+ *       import type { IdentityPosture } from '@adcp/sdk/signing/server';
+ *       const identity: IdentityPosture = {
+ *         per_principal_key_isolation: true,
+ *         key_origins: { request_signing: 'https://keys.example.com' },
+ *         brand_json_url: 'https://example.com/.well-known/brand.json',
+ *       };
+ *       return { adcp: {...}, identity, ... };
+ *       ```
+ *
+ * This file goes away — replaced by the generated type — when the SDK's
+ * schema pin moves to a release that includes the field as a typed
+ * property.
+ */
+import type { GetAdCPCapabilitiesResponse } from '../../types/tools.generated';
+export type IdentityKeyOriginPurpose = 'governance_signing' | 'request_signing' | 'webhook_signing' | 'tmp_signing';
+export interface IdentityKeyOrigins {
+    governance_signing?: string;
+    request_signing?: string;
+    webhook_signing?: string;
+    tmp_signing?: string;
+}
+export interface IdentityPosture {
+    per_principal_key_isolation?: boolean;
+    key_origins?: IdentityKeyOrigins;
+    compromise_notification?: {
+        emits?: boolean;
+        accepts?: boolean;
+    };
+    brand_json_url?: string;
+}
+export type CapabilitiesWithBrandJsonUrl = GetAdCPCapabilitiesResponse & {
+    identity?: IdentityPosture;
+};
+export declare function readIdentityPosture(caps: unknown): IdentityPosture | undefined;
+export declare function readBrandJsonUrl(caps: unknown): string | undefined;
+//# sourceMappingURL=capabilities-types.d.ts.map

package/dist/lib/signing/agent-resolver/capabilities-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities-types.d.ts","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/capabilities-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAE/E,MAAM,MAAM,wBAAwB,GAAG,oBAAoB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAEpH,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,uBAAuB,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,4BAA4B,GAAG,2BAA2B,GAAG;IACvE,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAK9E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIlE"}

package/dist/lib/signing/agent-resolver/capabilities-types.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * Forward-compat narrow access for `identity.brand_json_url` and the
+ * surrounding fields from a `get_adcp_capabilities` response. The field
+ * lands in the spec as a typed property in 3.1's additive minor (PR
+ * adcontextprotocol/adcp#3690); 3.0.5 already accepts it on the wire by
+ * relaxing `identity.additionalProperties` to `true`, but the generated
+ * TS surface won't include it until codegen runs against a release that
+ * declares it as a typed property. This file bridges the gap on both
+ * sides:
+ *
+ *   - **Verifier side**: `readBrandJsonUrl(caps)` peels the field out of
+ *     an unknown payload without forcing the caller into `as any`.
+ *   - **Publisher side**: TS sellers constructing their capabilities
+ *     response in 3.0.5+ can spread `IdentityPosture` over the generated
+ *     `identity` shape to set `brand_json_url` without losing types on
+ *     the rest of the block:
+ *
+ *       ```ts
+ *       import type { IdentityPosture } from '@adcp/sdk/signing/server';
+ *       const identity: IdentityPosture = {
+ *         per_principal_key_isolation: true,
+ *         key_origins: { request_signing: 'https://keys.example.com' },
+ *         brand_json_url: 'https://example.com/.well-known/brand.json',
+ *       };
+ *       return { adcp: {...}, identity, ... };
+ *       ```
+ *
+ * This file goes away — replaced by the generated type — when the SDK's
+ * schema pin moves to a release that includes the field as a typed
+ * property.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readIdentityPosture = readIdentityPosture;
+exports.readBrandJsonUrl = readBrandJsonUrl;
+function readIdentityPosture(caps) {
+    if (!caps || typeof caps !== 'object')
+        return undefined;
+    const identity = caps.identity;
+    if (!identity || typeof identity !== 'object')
+        return undefined;
+    return identity;
+}
+function readBrandJsonUrl(caps) {
+    const identity = readIdentityPosture(caps);
+    const value = identity?.brand_json_url;
+    return typeof value === 'string' ? value : undefined;
+}
+//# sourceMappingURL=capabilities-types.js.map

package/dist/lib/signing/agent-resolver/capabilities-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities-types.js","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/capabilities-types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;AAwBH,kDAKC;AAED,4CAIC;AAXD,SAAgB,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,QAAQ,GAAI,IAA+B,CAAC,QAAQ,CAAC;IAC3D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,QAA2B,CAAC;AACrC,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAa;IAC5C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,EAAE,cAAc,CAAC;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/dist/lib/signing/agent-resolver/consistency.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Step 7 of the brand_json_url discovery algorithm — `identity.key_origins`
+ * consistency check (security.mdx §"Discovering an agent's signing keys via
+ * `brand_json_url`" step 7). Two distinct rejections:
+ *
+ *   `request_signature_key_origin_mismatch` — the resolved `jwks_uri` host
+ *     does not match the operator's declared `identity.key_origins.{purpose}`
+ *     value. Skipped only for the specific (agent, purpose, role) tuple
+ *     whose JWKS source was a publisher `adagents.json signing_keys` pin —
+ *     operator-side use of the same purpose is still checked.
+ *
+ *   `request_signature_key_origin_missing` — the agent's capabilities
+ *     declare a signing posture for a purpose (e.g. `request_signing.supported_for`
+ *     non-empty, `webhook_signing.supported === true`) but the corresponding
+ *     `identity.key_origins.{purpose}` entry is absent.
+ *
+ * Both checks are pure: the caller supplies the inputs (which purposes are
+ * declared, the declared origins, the resolved jwksUri, whether the resolution
+ * came from a publisher pin), the function returns a typed result. No I/O.
+ */
+import type { IdentityKeyOrigins, IdentityKeyOriginPurpose } from './capabilities-types';
+export type ConsistencyErrorCode = 'key_origin_mismatch' | 'key_origin_missing';
+export interface KeyOriginMismatch {
+    ok: false;
+    code: 'key_origin_mismatch';
+    purpose: IdentityKeyOriginPurpose;
+    expected_origin: string;
+    actual_origin: string;
+}
+export interface KeyOriginMissing {
+    ok: false;
+    code: 'key_origin_missing';
+    purpose: IdentityKeyOriginPurpose;
+    posture: 'request_signing' | 'webhook_signing' | 'governance_signing' | 'tmp_signing';
+}
+export type ConsistencyResult = {
+    ok: true;
+} | KeyOriginMismatch | KeyOriginMissing;
+/**
+ * Inputs for the per-purpose origin check. The caller is responsible for
+ * deciding whether `publisherPinned` is true — the carve-out applies only
+ * to (agent, webhook-signing, sell-side) tuples whose JWKS came from an
+ * `adagents.json signing_keys` pin. For request-signing, governance-signing,
+ * TMP-signing, and buyer-side webhook receivers, `publisherPinned` MUST
+ * always be false.
+ */
+export interface OriginCheckInput {
+    purpose: IdentityKeyOriginPurpose;
+    declaredOrigin: string | undefined;
+    resolvedJwksUri: string;
+    publisherPinned: boolean;
+}
+/**
+ * Check origin consistency for a single (purpose, jwksUri) pair against the
+ * declared `identity.key_origins.{purpose}` value. Returns `{ ok: true }`
+ * when the check passes or is skipped (publisher pin); a typed mismatch
+ * result on failure. `key_origin_missing` is NOT raised here — that is a
+ * separate check (`checkRequiredOrigins`) because it depends on which
+ * purposes the agent has declared signing for.
+ */
+export declare function checkOriginConsistency(input: OriginCheckInput): ConsistencyResult;
+/**
+ * Determine which signing purposes the capabilities response declares.
+ * Any of the following signal a declared purpose, per security.mdx
+ * §"Discovering an agent's signing keys via `brand_json_url`" step 2:
+ *
+ *   - `request_signing.supported_for` non-empty            → `request_signing`
+ *   - `request_signing.required_for` non-empty             → `request_signing`
+ *   - `webhook_signing.supported === true`                 → `webhook_signing`
+ *   - any field present under `identity.key_origins`       → that purpose
+ *
+ * Governance-signing and TMP-signing declarations are agent-protocol-specific
+ * and not reliably detectable from a generic capabilities walk; callers may
+ * pass `extraDeclaredPurposes` for purposes they have detected externally.
+ */
+export declare function declaredSigningPurposes(capabilities: unknown, extraDeclaredPurposes?: readonly IdentityKeyOriginPurpose[]): Set<IdentityKeyOriginPurpose>;
+/**
+ * For every purpose the agent has declared signing for, confirm an
+ * `identity.key_origins.{purpose}` entry is present. Returns the set of
+ * missing purposes; the caller maps each onto `request_signature_key_origin_missing`
+ * with `posture` set to the corresponding signing field name.
+ */
+export declare function checkRequiredOrigins(declaredPurposes: ReadonlySet<IdentityKeyOriginPurpose>, keyOrigins: IdentityKeyOrigins | undefined): KeyOriginMissing[];
+//# sourceMappingURL=consistency.d.ts.map

package/dist/lib/signing/agent-resolver/consistency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consistency.d.ts","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/consistency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAmB,MAAM,sBAAsB,CAAC;AAE1G,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,wBAAwB,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,aAAa,CAAC;CACvF;AAED,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,wBAAwB,CAAC;IAClC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,iBAAiB,CA2BjF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,OAAO,EACrB,qBAAqB,GAAE,SAAS,wBAAwB,EAAO,GAC9D,GAAG,CAAC,wBAAwB,CAAC,CAsB/B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,WAAW,CAAC,wBAAwB,CAAC,EACvD,UAAU,EAAE,kBAAkB,GAAG,SAAS,GACzC,gBAAgB,EAAE,CASpB"}

package/dist/lib/signing/agent-resolver/consistency.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Step 7 of the brand_json_url discovery algorithm — `identity.key_origins`
+ * consistency check (security.mdx §"Discovering an agent's signing keys via
+ * `brand_json_url`" step 7). Two distinct rejections:
+ *
+ *   `request_signature_key_origin_mismatch` — the resolved `jwks_uri` host
+ *     does not match the operator's declared `identity.key_origins.{purpose}`
+ *     value. Skipped only for the specific (agent, purpose, role) tuple
+ *     whose JWKS source was a publisher `adagents.json signing_keys` pin —
+ *     operator-side use of the same purpose is still checked.
+ *
+ *   `request_signature_key_origin_missing` — the agent's capabilities
+ *     declare a signing posture for a purpose (e.g. `request_signing.supported_for`
+ *     non-empty, `webhook_signing.supported === true`) but the corresponding
+ *     `identity.key_origins.{purpose}` entry is absent.
+ *
+ * Both checks are pure: the caller supplies the inputs (which purposes are
+ * declared, the declared origins, the resolved jwksUri, whether the resolution
+ * came from a publisher pin), the function returns a typed result. No I/O.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkOriginConsistency = checkOriginConsistency;
+exports.declaredSigningPurposes = declaredSigningPurposes;
+exports.checkRequiredOrigins = checkRequiredOrigins;
+const canonicalize_1 = require("./canonicalize");
+/**
+ * Check origin consistency for a single (purpose, jwksUri) pair against the
+ * declared `identity.key_origins.{purpose}` value. Returns `{ ok: true }`
+ * when the check passes or is skipped (publisher pin); a typed mismatch
+ * result on failure. `key_origin_missing` is NOT raised here — that is a
+ * separate check (`checkRequiredOrigins`) because it depends on which
+ * purposes the agent has declared signing for.
+ */
+function checkOriginConsistency(input) {
+    if (input.publisherPinned)
+        return { ok: true };
+    if (!input.declaredOrigin)
+        return { ok: true };
+    let expected;
+    let actual;
+    try {
+        expected = (0, canonicalize_1.canonicalizeOrigin)(input.declaredOrigin);
+        actual = (0, canonicalize_1.canonicalizeOrigin)(input.resolvedJwksUri);
+    }
+    catch {
+        return {
+            ok: false,
+            code: 'key_origin_mismatch',
+            purpose: input.purpose,
+            expected_origin: input.declaredOrigin,
+            actual_origin: input.resolvedJwksUri,
+        };
+    }
+    if (expected !== actual) {
+        return {
+            ok: false,
+            code: 'key_origin_mismatch',
+            purpose: input.purpose,
+            expected_origin: expected,
+            actual_origin: actual,
+        };
+    }
+    return { ok: true };
+}
+/**
+ * Determine which signing purposes the capabilities response declares.
+ * Any of the following signal a declared purpose, per security.mdx
+ * §"Discovering an agent's signing keys via `brand_json_url`" step 2:
+ *
+ *   - `request_signing.supported_for` non-empty            → `request_signing`
+ *   - `request_signing.required_for` non-empty             → `request_signing`
+ *   - `webhook_signing.supported === true`                 → `webhook_signing`
+ *   - any field present under `identity.key_origins`       → that purpose
+ *
+ * Governance-signing and TMP-signing declarations are agent-protocol-specific
+ * and not reliably detectable from a generic capabilities walk; callers may
+ * pass `extraDeclaredPurposes` for purposes they have detected externally.
+ */
+function declaredSigningPurposes(capabilities, extraDeclaredPurposes = []) {
+    const out = new Set(extraDeclaredPurposes);
+    if (!capabilities || typeof capabilities !== 'object')
+        return out;
+    const caps = capabilities;
+    const requestSigning = caps.request_signing;
+    if (Array.isArray(requestSigning?.supported_for) && requestSigning.supported_for.length > 0) {
+        out.add('request_signing');
+    }
+    if (Array.isArray(requestSigning?.required_for) && requestSigning.required_for.length > 0) {
+        out.add('request_signing');
+    }
+    const webhookSigning = caps.webhook_signing;
+    if (webhookSigning?.supported === true) {
+        out.add('webhook_signing');
+    }
+    const identity = caps.identity;
+    if (identity?.key_origins) {
+        for (const purpose of Object.keys(identity.key_origins)) {
+            if (identity.key_origins[purpose] !== undefined)
+                out.add(purpose);
+        }
+    }
+    return out;
+}
+/**
+ * For every purpose the agent has declared signing for, confirm an
+ * `identity.key_origins.{purpose}` entry is present. Returns the set of
+ * missing purposes; the caller maps each onto `request_signature_key_origin_missing`
+ * with `posture` set to the corresponding signing field name.
+ */
+function checkRequiredOrigins(declaredPurposes, keyOrigins) {
+    const missing = [];
+    for (const purpose of declaredPurposes) {
+        const value = keyOrigins?.[purpose];
+        if (typeof value !== 'string' || value.length === 0) {
+            missing.push({ ok: false, code: 'key_origin_missing', purpose, posture: purpose });
+        }
+    }
+    return missing;
+}
+//# sourceMappingURL=consistency.js.map

package/dist/lib/signing/agent-resolver/consistency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consistency.js","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/consistency.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AA+CH,wDA2BC;AAgBD,0DAyBC;AAQD,oDAYC;AArID,iDAAoD;AAqCpD;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CAAC,KAAuB;IAC5D,IAAI,KAAK,CAAC,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,QAAgB,CAAC;IACrB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,iCAAkB,EAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,IAAA,iCAAkB,EAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,cAAc;YACrC,aAAa,EAAE,KAAK,CAAC,eAAe;SACrC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,QAAQ;YACzB,aAAa,EAAE,MAAM;SACtB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,uBAAuB,CACrC,YAAqB,EACrB,wBAA6D,EAAE;IAE/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAA2B,qBAAqB,CAAC,CAAC;IACrE,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAClE,MAAM,IAAI,GAAG,YAAuC,CAAC;IACrD,MAAM,cAAc,GAAG,IAAI,CAAC,eAAkF,CAAC;IAC/G,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,cAAc,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,IAAI,cAAc,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,eAAsD,CAAC;IACnF,IAAI,cAAc,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAuC,CAAC;IAC9D,IAAI,QAAQ,EAAE,WAAW,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAA+B,EAAE,CAAC;YACtF,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,gBAAuD,EACvD,UAA0C;IAE1C,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}