@agenticprimitives/agent-profile 1.0.0-alpha.4 → 1.0.0-alpha.40

package/dist/a2a/validation.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Pure validation of an A2A Agent Card (spec 347 §4.4) → `ProjectionDiagnosticV1[]`.
+ *
+ * Four families, all PURE (no network, no clock, no randomness):
+ *   structural  — required fields, one-of security schemes, absolute HTTPS URLs (production), MIME shape,
+ *                 unique skill ids, security refs resolve;
+ *   serialization — JCS reproducible (canonicalize twice, compare);
+ *   semantic    — ≥1 interface (first = preferred), `extendedAgentCard` only with a policy, push claims
+ *                 need runtime evidence (`CAPABILITY_UNVERIFIED`), version ≠ protocol version, catalog
+ *                 agreement without an `override` binding (`CATALOG_DIVERGENCE`, spec 347 §13(b));
+ *   security/privacy — secret-looking strings, loopback/private/link-local/metadata URLs, vault refs,
+ *                 PII patterns (warning).
+ * Runtime checks (reachability, handshake, TLS, digest-at-well-known) are a separate app-side port —
+ * deliberately NOT here.
+ */
+import type { ProjectionDiagnosticV1 } from '@agenticprimitives/types';
+import { type CardLike } from './canonical.js';
+import { type A2AAgentCardV1, type A2AAgentInterfaceV1, type CardEnvironment, type FieldBindingV1 } from './types.js';
+/** Stable diagnostic codes. Each is emitted by exactly one check; consumers key on these, not messages. */
+export declare const DIAGNOSTIC_CODES: {
+    readonly STRUCT_MISSING_FIELD: "STRUCT_MISSING_FIELD";
+    readonly STRUCT_INVALID_TYPE: "STRUCT_INVALID_TYPE";
+    readonly PROTOCOL_VERSION_MISMATCH: "PROTOCOL_VERSION_MISMATCH";
+    readonly URL_NOT_ABSOLUTE: "URL_NOT_ABSOLUTE";
+    readonly URL_NOT_HTTPS: "URL_NOT_HTTPS";
+    readonly MIME_TYPE_INVALID: "MIME_TYPE_INVALID";
+    readonly SKILL_ID_DUPLICATE: "SKILL_ID_DUPLICATE";
+    readonly SECURITY_SCHEME_INVALID: "SECURITY_SCHEME_INVALID";
+    readonly SECURITY_REF_UNRESOLVED: "SECURITY_REF_UNRESOLVED";
+    readonly EXTENSION_URI_INVALID: "EXTENSION_URI_INVALID";
+    readonly CANONICALIZATION_FAILED: "CANONICALIZATION_FAILED";
+    readonly JCS_NOT_REPRODUCIBLE: "JCS_NOT_REPRODUCIBLE";
+    readonly NO_INTERFACE: "NO_INTERFACE";
+    readonly INTERFACE_BINDING_UNKNOWN: "INTERFACE_BINDING_UNKNOWN";
+    readonly EXTENDED_CARD_WITHOUT_POLICY: "EXTENDED_CARD_WITHOUT_POLICY";
+    readonly CAPABILITY_UNVERIFIED: "CAPABILITY_UNVERIFIED";
+    readonly VERSION_EQUALS_PROTOCOL_VERSION: "VERSION_EQUALS_PROTOCOL_VERSION";
+    readonly PROVIDER_MISSING: "PROVIDER_MISSING";
+    readonly CATALOG_DIVERGENCE: "CATALOG_DIVERGENCE";
+    readonly SECRET_MATERIAL_DETECTED: "SECRET_MATERIAL_DETECTED";
+    readonly PRIVATE_URL_DETECTED: "PRIVATE_URL_DETECTED";
+    readonly VAULT_REFERENCE_DETECTED: "VAULT_REFERENCE_DETECTED";
+    readonly PII_SUSPECTED: "PII_SUSPECTED";
+    readonly UNKNOWN_FIELD: "UNKNOWN_FIELD";
+    readonly SIGNATURE_INVALID: "SIGNATURE_INVALID";
+    readonly SIGNATURE_UNVERIFIED: "SIGNATURE_UNVERIFIED";
+    readonly SOURCE_NOT_JSON: "SOURCE_NOT_JSON";
+};
+export type DiagnosticCode = (typeof DIAGNOSTIC_CODES)[keyof typeof DIAGNOSTIC_CODES];
+/** Structural view of `surface-catalog`'s `A2aCardSkillLike` — no package dependency (spec 347 §10.2 note). */
+export interface CatalogSkillLike {
+    id: string;
+    name?: string;
+    description?: string;
+}
+/** Runtime-declared capabilities — evidence for `capabilities.*` claims. */
+export interface RuntimeCapabilityEvidence {
+    streaming?: boolean;
+    pushNotifications?: boolean;
+    stateTransitionHistory?: boolean;
+    extendedAgentCard?: boolean;
+}
+export interface ValidateA2ACardOptions {
+    /** Pinned A2A version the card MUST declare. Default `'1.0'`. */
+    protocolVersion?: string;
+    environment: CardEnvironment;
+    /** Interfaces the surface catalog / deployment says are served. Disagreement without an override ⇒ error. */
+    surfaceInterfaces?: Pick<A2AAgentInterfaceV1, 'url' | 'protocolBinding'>[];
+    /** What the runtime actually implements. Absent ⇒ `pushNotifications:true` is unverifiable. */
+    runtimeCapabilities?: RuntimeCapabilityEvidence;
+    /** Skills the surface catalog serves (`toCardProjectionSet(...).public`). */
+    catalogSkills?: CatalogSkillLike[];
+    fieldBindings?: Record<string, FieldBindingV1>;
+    /** Whether ≥1 extended-card policy is configured (needed for `capabilities.extendedAgentCard`). */
+    extendedCardPolicyConfigured?: boolean;
+}
+export declare function hasErrors(diagnostics: readonly ProjectionDiagnosticV1[]): boolean;
+/** Validate a card. Returns diagnostics; never throws on card content. */
+export declare function validateA2ACard(card: A2AAgentCardV1 | CardLike, opts: ValidateA2ACardOptions): ProjectionDiagnosticV1[];
+export declare function isPrivateHost(hostname: string): boolean;
+//# sourceMappingURL=validation.d.ts.map

package/dist/a2a/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/a2a/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAqB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAElE,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,mBAAmB,EAExB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAEpB,2GAA2G;AAC3G,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCnB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEtF,+GAA+G;AAC/G,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,eAAe,CAAC;IAC7B,6GAA6G;IAC7G,iBAAiB,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,iBAAiB,CAAC,EAAE,CAAC;IAC3E,+FAA+F;IAC/F,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IAChD,6EAA6E;IAC7E,aAAa,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC/C,mGAAmG;IACnG,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAID,wBAAgB,SAAS,CAAC,WAAW,EAAE,SAAS,sBAAsB,EAAE,GAAG,OAAO,CAEjF;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,IAAI,EAAE,sBAAsB,GAAG,sBAAsB,EAAE,CAgSvH;AAsCD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAqBvD"}

package/dist/a2a/validation.js

@@ -0,0 +1,506 @@
+/**
+ * Pure validation of an A2A Agent Card (spec 347 §4.4) → `ProjectionDiagnosticV1[]`.
+ *
+ * Four families, all PURE (no network, no clock, no randomness):
+ *   structural  — required fields, one-of security schemes, absolute HTTPS URLs (production), MIME shape,
+ *                 unique skill ids, security refs resolve;
+ *   serialization — JCS reproducible (canonicalize twice, compare);
+ *   semantic    — ≥1 interface (first = preferred), `extendedAgentCard` only with a policy, push claims
+ *                 need runtime evidence (`CAPABILITY_UNVERIFIED`), version ≠ protocol version, catalog
+ *                 agreement without an `override` binding (`CATALOG_DIVERGENCE`, spec 347 §13(b));
+ *   security/privacy — secret-looking strings, loopback/private/link-local/metadata URLs, vault refs,
+ *                 PII patterns (warning).
+ * Runtime checks (reachability, handshake, TLS, digest-at-well-known) are a separate app-side port —
+ * deliberately NOT here.
+ */
+import { canonicalCardJson } from './canonical.js';
+import { joinPointer } from './pointer.js';
+import { A2A_PROTO_SECURITY_SCHEME_KEYS, A2A_SECURITY_SCHEME_TYPES, } from './types.js';
+/** Stable diagnostic codes. Each is emitted by exactly one check; consumers key on these, not messages. */
+export const DIAGNOSTIC_CODES = {
+    // structural
+    STRUCT_MISSING_FIELD: 'STRUCT_MISSING_FIELD',
+    STRUCT_INVALID_TYPE: 'STRUCT_INVALID_TYPE',
+    PROTOCOL_VERSION_MISMATCH: 'PROTOCOL_VERSION_MISMATCH',
+    URL_NOT_ABSOLUTE: 'URL_NOT_ABSOLUTE',
+    URL_NOT_HTTPS: 'URL_NOT_HTTPS',
+    MIME_TYPE_INVALID: 'MIME_TYPE_INVALID',
+    SKILL_ID_DUPLICATE: 'SKILL_ID_DUPLICATE',
+    SECURITY_SCHEME_INVALID: 'SECURITY_SCHEME_INVALID',
+    SECURITY_REF_UNRESOLVED: 'SECURITY_REF_UNRESOLVED',
+    EXTENSION_URI_INVALID: 'EXTENSION_URI_INVALID',
+    // serialization
+    CANONICALIZATION_FAILED: 'CANONICALIZATION_FAILED',
+    JCS_NOT_REPRODUCIBLE: 'JCS_NOT_REPRODUCIBLE',
+    // semantic
+    NO_INTERFACE: 'NO_INTERFACE',
+    INTERFACE_BINDING_UNKNOWN: 'INTERFACE_BINDING_UNKNOWN',
+    EXTENDED_CARD_WITHOUT_POLICY: 'EXTENDED_CARD_WITHOUT_POLICY',
+    CAPABILITY_UNVERIFIED: 'CAPABILITY_UNVERIFIED',
+    VERSION_EQUALS_PROTOCOL_VERSION: 'VERSION_EQUALS_PROTOCOL_VERSION',
+    PROVIDER_MISSING: 'PROVIDER_MISSING',
+    CATALOG_DIVERGENCE: 'CATALOG_DIVERGENCE',
+    // security / privacy
+    SECRET_MATERIAL_DETECTED: 'SECRET_MATERIAL_DETECTED',
+    PRIVATE_URL_DETECTED: 'PRIVATE_URL_DETECTED',
+    VAULT_REFERENCE_DETECTED: 'VAULT_REFERENCE_DETECTED',
+    PII_SUSPECTED: 'PII_SUSPECTED',
+    // import (emitted by `import.ts`)
+    UNKNOWN_FIELD: 'UNKNOWN_FIELD',
+    SIGNATURE_INVALID: 'SIGNATURE_INVALID',
+    SIGNATURE_UNVERIFIED: 'SIGNATURE_UNVERIFIED',
+    SOURCE_NOT_JSON: 'SOURCE_NOT_JSON',
+};
+export function hasErrors(diagnostics) {
+    return diagnostics.some((d) => d.severity === 'error');
+}
+/** Validate a card. Returns diagnostics; never throws on card content. */
+export function validateA2ACard(card, opts) {
+    const out = [];
+    const c = card;
+    const prod = opts.environment === 'production';
+    const err = (code, sourcePointer, message, explanation) => {
+        out.push({ code, severity: 'error', sourcePointer, message, ...(explanation ? { explanation } : {}) });
+    };
+    const warn = (code, sourcePointer, message, explanation) => {
+        out.push({ code, severity: 'warning', sourcePointer, message, ...(explanation ? { explanation } : {}) });
+    };
+    // ── structural ──────────────────────────────────────────────────────────────────────────────────
+    const reqString = (k) => {
+        const v = c[k];
+        if (v === undefined || v === null)
+            err(DIAGNOSTIC_CODES.STRUCT_MISSING_FIELD, `/${k}`, `"${k}" is required`);
+        else if (typeof v !== 'string' || v.length === 0)
+            err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, `/${k}`, `"${k}" must be a non-empty string`);
+    };
+    reqString('protocolVersion');
+    reqString('name');
+    reqString('description');
+    reqString('version');
+    const reqStringArray = (k) => {
+        const v = c[k];
+        if (v === undefined)
+            return void err(DIAGNOSTIC_CODES.STRUCT_MISSING_FIELD, `/${k}`, `"${k}" is required`);
+        if (!Array.isArray(v) || v.some((x) => typeof x !== 'string')) {
+            return void err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, `/${k}`, `"${k}" must be an array of MIME types`);
+        }
+        v.forEach((m, i) => {
+            if (!MIME_RE.test(m))
+                err(DIAGNOSTIC_CODES.MIME_TYPE_INVALID, joinPointer(k, i), `"${m}" is not a MIME type`);
+        });
+    };
+    reqStringArray('defaultInputModes');
+    reqStringArray('defaultOutputModes');
+    const pinned = opts.protocolVersion ?? '1.0';
+    if (typeof c.protocolVersion === 'string' && c.protocolVersion !== pinned) {
+        err(DIAGNOSTIC_CODES.PROTOCOL_VERSION_MISMATCH, '/protocolVersion', `protocolVersion "${c.protocolVersion}" ≠ pinned "${pinned}"`);
+    }
+    if (typeof c.version === 'string' && typeof c.protocolVersion === 'string' && c.version === c.protocolVersion) {
+        err(DIAGNOSTIC_CODES.VERSION_EQUALS_PROTOCOL_VERSION, '/version', '"version" is the AGENT IMPLEMENTATION version and equals the protocol version', 'A2A `version` describes the agent, not the protocol. A card whose version is "1.0" because the protocol is 1.0 is almost always a copy-paste error.');
+    }
+    if (c.capabilities === undefined)
+        err(DIAGNOSTIC_CODES.STRUCT_MISSING_FIELD, '/capabilities', '"capabilities" is required');
+    else if (c.capabilities === null || typeof c.capabilities !== 'object' || Array.isArray(c.capabilities)) {
+        err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, '/capabilities', '"capabilities" must be an object');
+    }
+    // URLs
+    const urlCheck = (pointer, v, required) => {
+        if (v === undefined) {
+            if (required)
+                err(DIAGNOSTIC_CODES.STRUCT_MISSING_FIELD, pointer, 'url is required');
+            return;
+        }
+        if (typeof v !== 'string')
+            return void err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, pointer, 'url must be a string');
+        let u;
+        try {
+            u = new URL(v);
+        }
+        catch {
+            return void err(DIAGNOSTIC_CODES.URL_NOT_ABSOLUTE, pointer, `"${v}" is not an absolute URL`);
+        }
+        if (u.protocol !== 'https:') {
+            const msg = `"${v}" is not https`;
+            if (prod)
+                err(DIAGNOSTIC_CODES.URL_NOT_HTTPS, pointer, msg, 'Production cards MUST advertise HTTPS endpoints (ADR-0057).');
+            else
+                warn(DIAGNOSTIC_CODES.URL_NOT_HTTPS, pointer, msg);
+        }
+        if (isPrivateHost(u.hostname)) {
+            const msg = `"${v}" points at a loopback / private / link-local / metadata host`;
+            if (prod)
+                err(DIAGNOSTIC_CODES.PRIVATE_URL_DETECTED, pointer, msg);
+            else
+                warn(DIAGNOSTIC_CODES.PRIVATE_URL_DETECTED, pointer, msg);
+        }
+    };
+    // interfaces
+    const ifaces = c.supportedInterfaces;
+    if (ifaces === undefined)
+        err(DIAGNOSTIC_CODES.STRUCT_MISSING_FIELD, '/supportedInterfaces', '"supportedInterfaces" is required');
+    else if (!Array.isArray(ifaces))
+        err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, '/supportedInterfaces', '"supportedInterfaces" must be an array');
+    else if (ifaces.length === 0) {
+        err(DIAGNOSTIC_CODES.NO_INTERFACE, '/supportedInterfaces', 'a card MUST list at least one interface (the first is preferred)');
+    }
+    else {
+        ifaces.forEach((i, idx) => {
+            const p = joinPointer('supportedInterfaces', idx);
+            if (!i || typeof i !== 'object')
+                return void err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, p, 'interface must be an object');
+            urlCheck(`${p}/url`, i.url, true);
+            const pb = i.protocolBinding;
+            if (typeof pb !== 'string' || pb.length === 0)
+                err(DIAGNOSTIC_CODES.STRUCT_MISSING_FIELD, `${p}/protocolBinding`, 'protocolBinding is required');
+            else if (!KNOWN_BINDINGS.has(pb))
+                warn(DIAGNOSTIC_CODES.INTERFACE_BINDING_UNKNOWN, `${p}/protocolBinding`, `protocolBinding "${pb}" is not a standard A2A binding`);
+        });
+    }
+    if (c.provider !== undefined) {
+        if (!c.provider || typeof c.provider !== 'object')
+            err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, '/provider', 'provider must be an object');
+        else {
+            if (typeof c.provider.organization !== 'string' || !c.provider.organization)
+                err(DIAGNOSTIC_CODES.STRUCT_MISSING_FIELD, '/provider/organization', 'provider.organization is required');
+            urlCheck('/provider/url', c.provider.url, true);
+        }
+    }
+    else {
+        warn(DIAGNOSTIC_CODES.PROVIDER_MISSING, '/provider', 'no provider declared — peers cannot tell who operates this agent');
+    }
+    urlCheck('/documentationUrl', c.documentationUrl, false);
+    urlCheck('/iconUrl', c.iconUrl, false);
+    // capabilities
+    const caps = (c.capabilities && typeof c.capabilities === 'object' ? c.capabilities : {});
+    for (const [k, v] of Object.entries(caps)) {
+        if (k === 'extensions') {
+            if (v !== undefined && !Array.isArray(v))
+                err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, '/capabilities/extensions', 'extensions must be an array');
+            else
+                v?.forEach((e, i) => {
+                    const p = joinPointer('capabilities', 'extensions', i);
+                    const uri = e?.uri;
+                    if (typeof uri !== 'string' || !isAbsoluteUri(uri))
+                        err(DIAGNOSTIC_CODES.EXTENSION_URI_INVALID, `${p}/uri`, 'extension uri must be an absolute URI');
+                });
+        }
+        else if (v !== undefined && typeof v !== 'boolean') {
+            err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, `/capabilities/${k}`, `capabilities.${k} must be a boolean`);
+        }
+    }
+    if (caps.extendedAgentCard === true && !opts.extendedCardPolicyConfigured) {
+        err(DIAGNOSTIC_CODES.EXTENDED_CARD_WITHOUT_POLICY, '/capabilities/extendedAgentCard', 'extendedAgentCard is true but no extended-card policy is configured');
+    }
+    if (caps.pushNotifications === true && opts.runtimeCapabilities?.pushNotifications !== true) {
+        out.push({
+            code: DIAGNOSTIC_CODES.CAPABILITY_UNVERIFIED,
+            severity: 'evidenceNeeded',
+            sourcePointer: '/capabilities/pushNotifications',
+            message: 'pushNotifications is claimed without runtime evidence',
+            explanation: 'pushNotifications is DERIVED by the runtime. A card may only claim it when the runtime declares a wired push sender (spec 347 §4.3).',
+        });
+    }
+    if (caps.streaming === true && opts.runtimeCapabilities && opts.runtimeCapabilities.streaming !== true) {
+        out.push({
+            code: DIAGNOSTIC_CODES.CAPABILITY_UNVERIFIED,
+            severity: 'evidenceNeeded',
+            sourcePointer: '/capabilities/streaming',
+            message: 'streaming is claimed but the runtime does not declare it',
+        });
+    }
+    // security schemes / requirements
+    const schemeNames = new Set();
+    if (c.securitySchemes !== undefined) {
+        if (!c.securitySchemes || typeof c.securitySchemes !== 'object' || Array.isArray(c.securitySchemes)) {
+            err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, '/securitySchemes', 'securitySchemes must be an object');
+        }
+        else {
+            for (const [name, s] of Object.entries(c.securitySchemes)) {
+                schemeNames.add(name);
+                validateScheme(joinPointer('securitySchemes', name), s, err, urlCheck);
+            }
+        }
+    }
+    const reqCheck = (pointer, reqs) => {
+        if (reqs === undefined)
+            return;
+        if (!Array.isArray(reqs))
+            return void err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, pointer, 'securityRequirements must be an array');
+        reqs.forEach((r, i) => {
+            if (!r || typeof r !== 'object' || Array.isArray(r))
+                return void err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, `${pointer}/${i}`, 'requirement must be an object');
+            // PROTO-JSON: `{ schemes: { <name>: { list: [scope…] } } }`, because proto has no map-to-array and no bare
+            // repeated field inside a map value. The names and scopes mean the same thing; only the shape differs, so
+            // both are read here and neither is rewritten.
+            const outer = r;
+            const proto = outer.schemes;
+            const entries = proto && typeof proto === 'object' && !Array.isArray(proto)
+                ? Object.entries(proto).map(([name, v]) => [name, v?.list])
+                : Object.entries(outer);
+            const base = proto && typeof proto === 'object' && !Array.isArray(proto) ? [i, 'schemes'] : [i];
+            for (const [name, scopes] of entries) {
+                const p = joinPointer(...pointer.split('/').filter(Boolean), ...base, name);
+                if (!schemeNames.has(name))
+                    err(DIAGNOSTIC_CODES.SECURITY_REF_UNRESOLVED, p, `security requirement "${name}" names no declared scheme`);
+                if (!Array.isArray(scopes) || scopes.some((x) => typeof x !== 'string'))
+                    err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, p, 'scopes must be an array of strings');
+            }
+        });
+    };
+    reqCheck('/securityRequirements', c.securityRequirements);
+    // skills
+    const skills = c.skills;
+    if (skills === undefined)
+        err(DIAGNOSTIC_CODES.STRUCT_MISSING_FIELD, '/skills', '"skills" is required');
+    else if (!Array.isArray(skills))
+        err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, '/skills', '"skills" must be an array');
+    else {
+        const seen = new Set();
+        skills.forEach((s, i) => {
+            const p = joinPointer('skills', i);
+            if (!s || typeof s !== 'object')
+                return void err(DIAGNOSTIC_CODES.STRUCT_INVALID_TYPE, p, 'skill must be an object');
+            const sk = s;
+            for (const k of ['id', 'name', 'description']) {
+                if (typeof sk[k] !== 'string' || sk[k].length === 0)
+                    err(DIAGNOSTIC_CODES.STRUCT_MISSING_FIELD, `${p}/${k}`, `skill.${k} is required`);
+            }
+            if (!Array.isArray(sk.tags) || sk.tags.some((t) => typeof t !== 'string'))
+                err(DIAGNOSTIC_CODES.STRUCT_MISSING_FIELD, `${p}/tags`, 'skill.tags must be an array of strings');
+            if (typeof sk.id === 'string') {
+                if (seen.has(sk.id))
+                    err(DIAGNOSTIC_CODES.SKILL_ID_DUPLICATE, `${p}/id`, `duplicate skill id "${sk.id}"`);
+                seen.add(sk.id);
+            }
+            for (const k of ['inputModes', 'outputModes']) {
+                sk[k]?.forEach((m, j) => {
+                    if (typeof m !== 'string' || !MIME_RE.test(m))
+                        err(DIAGNOSTIC_CODES.MIME_TYPE_INVALID, joinPointer('skills', i, k, j), `"${String(m)}" is not a MIME type`);
+                });
+            }
+            reqCheck(`${p}/securityRequirements`, sk.securityRequirements);
+        });
+    }
+    // ── serialization ───────────────────────────────────────────────────────────────────────────────
+    try {
+        const a = canonicalCardJson(card);
+        const b = canonicalCardJson(JSON.parse(a));
+        if (a !== b)
+            err(DIAGNOSTIC_CODES.JCS_NOT_REPRODUCIBLE, '', 'JCS canonicalization is not reproducible for this card');
+    }
+    catch (e) {
+        err(DIAGNOSTIC_CODES.CANONICALIZATION_FAILED, '', `card cannot be canonicalized: ${e.message}`);
+    }
+    // ── semantic: catalog agreement (spec 347 §13(b)) ───────────────────────────────────────────────
+    const bindingAt = (pointer) => opts.fieldBindings?.[pointer];
+    const isOverridden = (pointer, parent) => bindingAt(pointer)?.mode === 'override' || bindingAt(parent)?.mode === 'override';
+    if (opts.surfaceInterfaces && Array.isArray(ifaces)) {
+        const key = (i) => `${i.protocolBinding}${i.url}`;
+        const catalog = new Set(opts.surfaceInterfaces.map(key));
+        const onCard = new Set(ifaces.filter((i) => i && typeof i === 'object').map(key));
+        ifaces.forEach((i, idx) => {
+            if (i && typeof i === 'object' && !catalog.has(key(i)) && !isOverridden(joinPointer('supportedInterfaces', idx), '/supportedInterfaces')) {
+                err(DIAGNOSTIC_CODES.CATALOG_DIVERGENCE, joinPointer('supportedInterfaces', idx), `interface ${i.protocolBinding} ${i.url} is not served per the surface catalog and carries no override binding`, 'surface-catalog is the only generator of inherited interface fields; a hand-edit must be a recorded override (ADR-0062).');
+            }
+        });
+        for (const s of opts.surfaceInterfaces) {
+            if (!onCard.has(key(s)) && !isOverridden('/supportedInterfaces', '/supportedInterfaces')) {
+                err(DIAGNOSTIC_CODES.CATALOG_DIVERGENCE, '/supportedInterfaces', `catalog interface ${s.protocolBinding} ${s.url} is missing from the card without an override binding`);
+            }
+        }
+    }
+    if (opts.catalogSkills && Array.isArray(skills)) {
+        const catalogIds = new Set(opts.catalogSkills.map((s) => s.id));
+        const cardIds = new Set();
+        skills.forEach((s, idx) => {
+            if (!s || typeof s.id !== 'string')
+                return;
+            cardIds.add(s.id);
+            if (catalogIds.has(s.id))
+                return;
+            const b = bindingAt(joinPointer('skills', idx)) ?? bindingAt('/skills');
+            const legit = b?.mode === 'override' || b?.source.kind === 'capability-claims';
+            if (!legit) {
+                err(DIAGNOSTIC_CODES.CATALOG_DIVERGENCE, joinPointer('skills', idx), `skill "${s.id}" is not in the surface catalog and carries no override / capability-claims binding`, 'Skills are inherited from surface-catalog (runtime-served) or public capability claims; anything else is an unrecorded hand-edit (ADR-0062).');
+            }
+        });
+        for (const id of catalogIds) {
+            if (!cardIds.has(id) && bindingAt('/skills')?.mode !== 'override') {
+                err(DIAGNOSTIC_CODES.CATALOG_DIVERGENCE, '/skills', `catalog skill "${id}" is missing from the card without an override binding`);
+            }
+        }
+    }
+    // ── security / privacy scan over every string (signatures excluded) ─────────────────────────────
+    walkStrings(stripSignatures(c), '', (value, pointer) => {
+        if (SECRET_PATTERNS.some((re) => re.test(value))) {
+            err(DIAGNOSTIC_CODES.SECRET_MATERIAL_DETECTED, pointer, 'string looks like key / token / secret material');
+        }
+        if (VAULT_REF_RE.test(value)) {
+            err(DIAGNOSTIC_CODES.VAULT_REFERENCE_DETECTED, pointer, 'vault reference in a public card', 'Vault records are private (ADR-0055); a card must never point into one.');
+        }
+        if (isProseField(pointer) && PII_PATTERNS.some((re) => re.test(value))) {
+            warn(DIAGNOSTIC_CODES.PII_SUSPECTED, pointer, 'possible personal data (email / phone / national id pattern) in descriptive text');
+        }
+        // URLs embedded in strings outside the explicitly checked URL fields (examples, descriptions, params).
+        if (!CHECKED_URL_POINTER.test(pointer)) {
+            for (const m of value.matchAll(EMBEDDED_URL_RE)) {
+                try {
+                    if (isPrivateHost(new URL(m[0]).hostname))
+                        warn(DIAGNOSTIC_CODES.PRIVATE_URL_DETECTED, pointer, `"${m[0]}" points at a private / loopback host`);
+                }
+                catch {
+                    /* not a URL */
+                }
+            }
+        }
+    });
+    return out;
+}
+// ─── helpers ─────────────────────────────────────────────────────────────────────────────────────────
+const KNOWN_BINDINGS = new Set(['JSONRPC', 'GRPC', 'HTTP+JSON']);
+const MIME_RE = /^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+(?:\s*;.*)?$/i;
+const EMBEDDED_URL_RE = /https?:\/\/[^\s"'<>)\]]+/gi;
+const CHECKED_URL_POINTER = /^\/(supportedInterfaces\/\d+\/url|provider\/url|documentationUrl|iconUrl|securitySchemes\/[^/]+\/(openIdConnectUrl|oauth2MetadataUrl|flows\/.*Url))$/;
+const SECRET_PATTERNS = [
+    /\b0x[0-9a-fA-F]{64}\b/, // 32-byte hex — a raw private key (or a digest; flagged either way in prose)
+    /-----BEGIN [A-Z ]*(PRIVATE KEY|CERTIFICATE)-----/,
+    /\bsk[-_](?:live|test|proj)?[-_]?[A-Za-z0-9]{8,}/, // vendor secret keys
+    /\bBearer\s+[A-Za-z0-9\-._~+/]{20,}=*/i,
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/, // JWT
+    /\bAKIA[0-9A-Z]{16}\b/, // AWS access key id
+    /\bghp_[A-Za-z0-9]{20,}\b/,
+];
+// A REFERENCE, not the English word. The tail was `[^\s"']*` — zero or more — so a bare `vault:` matched, and the
+// sentence "a Bible knowledge-graph vault: resolves passages…" was reported as a vault reference in a public card
+// (found 2026-10-14 on a passage-resolving service card, where it read as a disclosure and was prose). A reference has a
+// path after the colon; requiring one still catches `vault:records/abc` and `urn:ap:vault:person/pii`, and stops
+// a validator from crying wolf — which is how a card validator gets ignored.
+const VAULT_REF_RE = /\b(?:urn:ap:vault:|vault:)[A-Za-z0-9._*-]+(?:[/:][A-Za-z0-9._*-]+)*/i;
+const PII_PATTERNS = [
+    /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i, // email
+    /\b\d{3}-\d{2}-\d{4}\b/, // US SSN shape
+    /(?:\+|00)\d{1,3}[\s-]?\(?\d{2,4}\)?[\s-]?\d{3,4}[\s-]?\d{3,4}\b/, // international phone
+];
+function isProseField(pointer) {
+    return /\/(description|examples\/\d+|name)$/.test(pointer);
+}
+function isAbsoluteUri(s) {
+    return /^[a-z][a-z0-9+.-]*:/i.test(s);
+}
+export function isPrivateHost(hostname) {
+    const h = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.internal'))
+        return true;
+    if (h === '0.0.0.0' || h === '::1' || h === '::')
+        return true;
+    if (h === 'metadata.google.internal' || h === 'metadata')
+        return true;
+    const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
+    if (v4) {
+        const [a, b] = [Number(v4[1]), Number(v4[2])];
+        if (a === 127 || a === 10 || a === 0)
+            return true;
+        if (a === 169 && b === 254)
+            return true; // link-local + cloud metadata (169.254.169.254)
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // CGNAT
+        return false;
+    }
+    if (h.includes(':')) {
+        if (/^fe[89ab]/.test(h))
+            return true; // link-local
+        if (/^f[cd]/.test(h))
+            return true; // unique-local
+        if (h.startsWith('::ffff:'))
+            return isPrivateHost(h.slice(7));
+    }
+    return false;
+}
+function stripSignatures(c) {
+    const { signatures: _s, ...rest } = c;
+    return rest;
+}
+function walkStrings(node, pointer, visit) {
+    if (typeof node === 'string')
+        return visit(node, pointer);
+    if (Array.isArray(node))
+        return node.forEach((v, i) => walkStrings(v, `${pointer}/${i}`, visit));
+    if (node && typeof node === 'object') {
+        for (const [k, v] of Object.entries(node))
+            walkStrings(v, `${pointer}${joinPointer(k)}`, visit);
+    }
+}
+function validateScheme(pointer, s, err, urlCheck) {
+    if (!s || typeof s !== 'object' || Array.isArray(s))
+        return void err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, pointer, 'scheme must be an object');
+    const o = s;
+    // A2A 1.0's PROTO-JSON form: the `oneof` as a wrapper object, which is what the official TCK validates and what
+    // this substrate's own wire emits. Exactly one wrapper key, and nothing else alongside it — a second key is the
+    // same ambiguity the `type` form's foreign-member check refuses.
+    const wrappers = A2A_PROTO_SECURITY_SCHEME_KEYS.filter((k) => o[k] !== undefined);
+    if (wrappers.length > 0) {
+        if (wrappers.length > 1)
+            err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, pointer, `exactly one scheme kind per entry; found ${wrappers.join(' + ')}`);
+        const extra = Object.keys(o).filter((k) => !A2A_PROTO_SECURITY_SCHEME_KEYS.includes(k));
+        if (extra.length > 0)
+            err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, pointer, `a proto-JSON scheme carries only its wrapper key; found also ${extra.join(', ')}`);
+        const inner = o[wrappers[0]];
+        if (!inner || typeof inner !== 'object' || Array.isArray(inner))
+            err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, `${pointer}/${wrappers[0]}`, 'the wrapper must hold an object');
+        return;
+    }
+    const t = o.type;
+    if (typeof t !== 'string' || !A2A_SECURITY_SCHEME_TYPES.includes(t)) {
+        return void err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, `${pointer}/type`, `scheme type must be exactly one of ${A2A_SECURITY_SCHEME_TYPES.join(' | ')}`);
+    }
+    // Exactly ONE kind: members of another kind present ⇒ ambiguous ⇒ invalid.
+    const foreign = {
+        apiKey: ['scheme', 'bearerFormat', 'flows', 'oauth2MetadataUrl', 'openIdConnectUrl'],
+        http: ['name', 'in', 'flows', 'oauth2MetadataUrl', 'openIdConnectUrl'],
+        oauth2: ['name', 'in', 'scheme', 'bearerFormat', 'openIdConnectUrl'],
+        openIdConnect: ['name', 'in', 'scheme', 'bearerFormat', 'flows', 'oauth2MetadataUrl'],
+        mutualTLS: ['name', 'in', 'scheme', 'bearerFormat', 'flows', 'oauth2MetadataUrl', 'openIdConnectUrl'],
+    };
+    for (const k of foreign[t] ?? []) {
+        if (o[k] !== undefined)
+            err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, `${pointer}/${k}`, `"${k}" does not belong to a ${t} scheme (exactly one scheme kind per entry)`);
+    }
+    switch (t) {
+        case 'apiKey':
+            if (typeof o.name !== 'string' || !o.name)
+                err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, `${pointer}/name`, 'apiKey scheme requires name');
+            if (o.in !== 'header' && o.in !== 'query' && o.in !== 'cookie')
+                err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, `${pointer}/in`, 'apiKey scheme requires in ∈ header|query|cookie');
+            break;
+        case 'http':
+            if (typeof o.scheme !== 'string' || !o.scheme)
+                err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, `${pointer}/scheme`, 'http scheme requires scheme');
+            break;
+        case 'oauth2': {
+            const flows = o.flows;
+            if (!flows || typeof flows !== 'object' || Object.keys(flows).length === 0) {
+                err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, `${pointer}/flows`, 'oauth2 scheme requires ≥1 flow');
+            }
+            else {
+                for (const [fk, fv] of Object.entries(flows)) {
+                    for (const uk of ['authorizationUrl', 'tokenUrl', 'refreshUrl'])
+                        urlCheck(`${pointer}/flows/${fk}/${uk}`, fv?.[uk], false);
+                    if (!fv?.scopes || typeof fv.scopes !== 'object')
+                        err(DIAGNOSTIC_CODES.SECURITY_SCHEME_INVALID, `${pointer}/flows/${fk}/scopes`, 'flow requires scopes');
+                }
+            }
+            urlCheck(`${pointer}/oauth2MetadataUrl`, o.oauth2MetadataUrl, false);
+            break;
+        }
+        case 'openIdConnect':
+            urlCheck(`${pointer}/openIdConnectUrl`, o.openIdConnectUrl, true);
+            break;
+        default:
+            break;
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/a2a/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/a2a/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,iBAAiB,EAAiB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAM1B,MAAM,YAAY,CAAC;AAEpB,2GAA2G;AAC3G,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,aAAa;IACb,oBAAoB,EAAE,sBAAsB;IAC5C,mBAAmB,EAAE,qBAAqB;IAC1C,yBAAyB,EAAE,2BAA2B;IACtD,gBAAgB,EAAE,kBAAkB;IACpC,aAAa,EAAE,eAAe;IAC9B,iBAAiB,EAAE,mBAAmB;IACtC,kBAAkB,EAAE,oBAAoB;IACxC,uBAAuB,EAAE,yBAAyB;IAClD,uBAAuB,EAAE,yBAAyB;IAClD,qBAAqB,EAAE,uBAAuB;IAC9C,gBAAgB;IAChB,uBAAuB,EAAE,yBAAyB;IAClD,oBAAoB,EAAE,sBAAsB;IAC5C,WAAW;IACX,YAAY,EAAE,cAAc;IAC5B,yBAAyB,EAAE,2BAA2B;IACtD,4BAA4B,EAAE,8BAA8B;IAC5D,qBAAqB,EAAE,uBAAuB;IAC9C,+BAA+B,EAAE,iCAAiC;IAClE,gBAAgB,EAAE,kBAAkB;IACpC,kBAAkB,EAAE,oBAAoB;IACxC,qBAAqB;IACrB,wBAAwB,EAAE,0BAA0B;IACpD,oBAAoB,EAAE,sBAAsB;IAC5C,wBAAwB,EAAE,0BAA0B;IACpD,aAAa,EAAE,eAAe;IAC9B,kCAAkC;IAClC,aAAa,EAAE,eAAe;IAC9B,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAoCX,MAAM,UAAU,SAAS,CAAC,WAA8C;IACtE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,IAA+B,EAAE,IAA4B;IAC3F,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,MAAM,CAAC,GAAG,IAAyD,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,KAAK,YAAY,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,IAAoB,EAAE,aAAqB,EAAE,OAAe,EAAE,WAAoB,EAAQ,EAAE;QACvG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,aAAqB,EAAE,OAAe,EAAE,WAAoB,EAAQ,EAAE;QACxG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC,CAAC;IAEF,mGAAmG;IACnG,MAAM,SAAS,GAAG,CAAC,CAAyD,EAAQ,EAAE;QACpF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;aACxG,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC5I,CAAC,CAAC;IACF,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC7B,SAAS,CAAC,MAAM,CAAC,CAAC;IAClB,SAAS,CAAC,aAAa,CAAC,CAAC;IACzB,SAAS,CAAC,SAAS,CAAC,CAAC;IACrB,MAAM,cAAc,GAAG,CAAC,CAA6C,EAAQ,EAAE;QAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC1G,CAAC;QACD,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAW,CAAC;gBAAE,GAAG,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC1H,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,cAAc,CAAC,mBAAmB,CAAC,CAAC;IACpC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;QAC1E,GAAG,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC,eAAe,eAAe,MAAM,GAAG,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;QAC9G,GAAG,CACD,gBAAgB,CAAC,+BAA+B,EAChD,UAAU,EACV,+EAA+E,EAC/E,qJAAqJ,CACtJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;QAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;SACvH,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QACxG,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACjG,CAAC;IAED,OAAO;IACP,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,CAAU,EAAE,QAAiB,EAAQ,EAAE;QACxE,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,QAAQ;gBAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAClH,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,GAAG,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC;YAClC,IAAI,IAAI;gBAAE,GAAG,CAAC,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,6DAA6D,CAAC,CAAC;;gBACtH,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,+DAA+D,CAAC;YACjF,IAAI,IAAI;gBAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;;gBAC9D,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC;IAEF,aAAa;IACb,MAAM,MAAM,GAAG,CAAC,CAAC,mBAAmB,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,mCAAmC,CAAC,CAAC;SAC7H,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,wCAAwC,CAAC,CAAC;SACxI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,gBAAgB,CAAC,YAAY,EAAE,sBAAsB,EAAE,kEAAkE,CAAC,CAAC;IACjI,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,GAAG,WAAW,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,KAAK,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,CAAC,EAAE,6BAA6B,CAAC,CAAC;YACzH,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAG,CAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3D,MAAM,EAAE,GAAI,CAAyB,CAAC,eAAe,CAAC;YACtD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,GAAG,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;iBAC5I,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,iCAAiC,CAAC,CAAC;QACtK,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,WAAW,EAAE,4BAA4B,CAAC,CAAC;aACnI,CAAC;YACJ,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY;gBAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,wBAAwB,EAAE,mCAAmC,CAAC,CAAC;YACvL,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,WAAW,EAAE,kEAAkE,CAAC,CAAC;IAC3H,CAAC;IACD,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACzD,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC,eAAe;IACf,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAmC,CAAC;IAC5H,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,6BAA6B,CAAC,CAAC;;gBACzI,CAA2B,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;oBAClD,MAAM,CAAC,GAAG,WAAW,CAAC,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;oBACvD,MAAM,GAAG,GAAI,CAA8B,EAAE,GAAG,CAAC;oBACjD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;wBAAE,GAAG,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;gBACvJ,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAC1E,GAAG,CACD,gBAAgB,CAAC,4BAA4B,EAC7C,iCAAiC,EACjC,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,IAAI,CAAC,mBAAmB,EAAE,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC5F,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,gBAAgB,CAAC,qBAAqB;YAC5C,QAAQ,EAAE,gBAAgB;YAC1B,aAAa,EAAE,iCAAiC;YAChD,OAAO,EAAE,uDAAuD;YAChE,WAAW,EAAE,sIAAsI;SACpJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,mBAAmB,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACvG,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,gBAAgB,CAAC,qBAAqB;YAC5C,QAAQ,EAAE,gBAAgB;YAC1B,aAAa,EAAE,yBAAyB;YACxC,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;YACpG,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1D,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtB,cAAc,CAAC,WAAW,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,IAAa,EAAQ,EAAE;QACxD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,OAAO,EAAE,uCAAuC,CAAC,CAAC;QAClI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACpB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;YAC/J,2GAA2G;YAC3G,0GAA0G;YAC1G,+CAA+C;YAC/C,MAAM,KAAK,GAAG,CAA4B,CAAC;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC;YAC5B,MAAM,OAAO,GAA6B,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACnG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAG,CAA+B,EAAE,IAAI,CAAC,CAAC;gBACrH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChG,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC5E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC,EAAE,yBAAyB,IAAI,4BAA4B,CAAC,CAAC;gBACxI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBAAE,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,CAAC,EAAE,oCAAoC,CAAC,CAAC;YAC9J,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,QAAQ,CAAC,uBAAuB,EAAE,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAE1D,SAAS;IACT,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;SACnG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC;SAC9G,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACtB,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,KAAK,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;YACrH,MAAM,EAAE,GAAG,CAA6B,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAU,EAAE,CAAC;gBACvD,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,CAAC;oBAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;YAC1I,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,EAAE,wCAAwC,CAAC,CAAC;YAC7K,IAAI,OAAO,EAAE,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAAE,GAAG,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,GAAG,CAAC,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC1G,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAU,EAAE,CAAC;gBACvD,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;oBACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;wBAAE,GAAG,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;gBAC9J,CAAC,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mGAAmG;IACnG,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAgB,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAa,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,wDAAwD,CAAC,CAAC;IACxH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,EAAE,EAAE,iCAAkC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,mGAAmG;IACnG,MAAM,SAAS,GAAG,CAAC,OAAe,EAA8B,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,MAAc,EAAW,EAAE,CAChE,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC;IACpF,IAAI,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,CAAC,CAAuD,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACzG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAE,MAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5G,MAAgC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACnD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,qBAAqB,EAAE,GAAG,CAAC,EAAE,sBAAsB,CAAC,EAAE,CAAC;gBACzI,GAAG,CACD,gBAAgB,CAAC,kBAAkB,EACnC,WAAW,CAAC,qBAAqB,EAAE,GAAG,CAAC,EACvC,aAAa,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,wEAAwE,EAC/G,0HAA0H,CAC3H,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,EAAE,CAAC;gBACzF,GAAG,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,qBAAqB,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,uDAAuD,CAAC,CAAC;YAC3K,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAC/C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAO;YAC3C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClB,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,OAAO;YACjC,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,mBAAmB,CAAC;YAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CACD,gBAAgB,CAAC,kBAAkB,EACnC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,EAC1B,UAAU,CAAC,CAAC,EAAE,qFAAqF,EACnG,8IAA8I,CAC/I,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;gBAClE,GAAG,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,SAAS,EAAE,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;YACpI,CAAC;QACH,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACrD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,OAAO,EAAE,iDAAiD,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,OAAO,EAAE,kCAAkC,EAAE,yEAAyE,CAAC,CAAC;QACzK,CAAC;QACD,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,kFAAkF,CAAC,CAAC;QACpI,CAAC;QACD,uGAAuG;QACvG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC;oBACH,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;wBAAE,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC;gBACnJ,CAAC;gBAAC,MAAM,CAAC;oBACP,eAAe;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wGAAwG;AAExG,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,sDAAsD,CAAC;AACvE,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,mBAAmB,GAAG,sJAAsJ,CAAC;AAEnL,MAAM,eAAe,GAAa;IAChC,uBAAuB,EAAE,6EAA6E;IACtG,kDAAkD;IAClD,iDAAiD,EAAE,qBAAqB;IACxE,uCAAuC;IACvC,gEAAgE,EAAE,MAAM;IACxE,sBAAsB,EAAE,oBAAoB;IAC5C,0BAA0B;CAC3B,CAAC;AACF,kHAAkH;AAClH,kHAAkH;AAClH,yHAAyH;AACzH,iHAAiH;AACjH,6EAA6E;AAC7E,MAAM,YAAY,GAAG,sEAAsE,CAAC;AAC5F,MAAM,YAAY,GAAa;IAC7B,wCAAwC,EAAE,QAAQ;IAClD,uBAAuB,EAAE,eAAe;IACxC,iEAAiE,EAAE,sBAAsB;CAC1F,CAAC;AAEF,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAClH,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,CAAC,KAAK,0BAA0B,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,EAAE,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,gDAAgD;QACzF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,QAAQ;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,aAAa;QACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,eAAe;QAClD,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,CAA0B;IACjD,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAa,EAAE,OAAe,EAAE,KAA+C;IAClG,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACjG,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC;YAAE,WAAW,CAAC,CAAC,EAAE,GAAG,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7H,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,OAAe,EACf,CAAU,EACV,GAAqE,EACrE,QAA4D;IAE5D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACpJ,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,gHAAgH;IAChH,gHAAgH;IAChH,iEAAiE;IACjE,MAAM,QAAQ,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,OAAO,EAAE,4CAA4C,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpJ,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,8BAAoD,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,OAAO,EAAE,gEAAgE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjK,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAE,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAChL,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAE,yBAA+C,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,KAAK,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,OAAO,OAAO,EAAE,sCAAsC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9J,CAAC;IACD,2EAA2E;IAC3E,MAAM,OAAO,GAA6B;QACxC,MAAM,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACpF,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACtE,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,CAAC;QACpE,aAAa,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,CAAC;QACrF,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;KACtG,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,0BAA0B,CAAC,6CAA6C,CAAC,CAAC;IAC1K,CAAC;IACD,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,QAAQ;YACX,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,OAAO,OAAO,EAAE,6BAA6B,CAAC,CAAC;YAC3I,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;gBAAE,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,OAAO,KAAK,EAAE,iDAAiD,CAAC,CAAC;YAClL,MAAM;QACR,KAAK,MAAM;YACT,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM;gBAAE,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,OAAO,SAAS,EAAE,6BAA6B,CAAC,CAAC;YACjJ,MAAM;QACR,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACtB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrF,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,OAAO,QAAQ,EAAE,gCAAgC,CAAC,CAAC;YACtG,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgD,CAAC,EAAE,CAAC;oBACxF,KAAK,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,EAAE,YAAY,CAAC;wBAAE,QAAQ,CAAC,GAAG,OAAO,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;oBAC3H,IAAI,CAAC,EAAE,EAAE,MAAM,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ;wBAAE,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,OAAO,UAAU,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;gBAC3J,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,GAAG,OAAO,oBAAoB,EAAE,CAAC,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YACrE,MAAM;QACR,CAAC;QACD,KAAK,eAAe;YAClB,QAAQ,CAAC,GAAG,OAAO,mBAAmB,EAAE,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAClE,MAAM;QACR;YACE,MAAM;IACV,CAAC;AACH,CAAC"}