@airprompter/agent-core 0.1.0

package/README.md

@@ -0,0 +1,28 @@
+# @airprompter/agent-core
+
+The pure half of the AirPrompter agent SDK: the wire types, canonical JSON
+and SHA-256, the trust chain (root metadata R1–R5, manifest M1–M14), arm
+assignment and the signed ramp plan walked on the host's clock, template
+rendering with trust-aware fencing, declared output checks, golden sets,
+the judge, `.apbundle` reading (HPKE), the telemetry row schemas, the
+control-plane HTTP client, and the port interfaces (`FsPort`, `ClockPort`,
+`FetchPort`) with their Node adapters. Nothing here opens a file, a socket
+or a timer at import time, and nothing here depends on a sibling package.
+
+```ts
+import { verifyManifest, trustedRootFromPinnedKey, assignArm, renderTemplate, BundleRelease } from "@airprompter/agent-core";
+import { FakeControlPlane, MemoryFs, FakeClock } from "@airprompter/agent-core/testing"; // the CI kit; never loaded by a runtime
+```
+
+`BundleRelease.load({ bundle, root, scope, now })` turns a bundle the
+customer loads into a `LoadedRelease` — the seam `@airprompter/agent-runtime`
+renders over — after the same chain as an over-the-air update: signatures,
+scope, expiry, every payload hash.
+
+One of five packages released in lockstep — `@airprompter/agent-core`, `-sync`,
+`-runtime`, `-telemetry` and the facade `@airprompter/agent-sdk` — one
+version, exact-pinned siblings. The direction is core → clients → sdk and is
+linted. The full README, the module map and the compatibility table are in
+[`sdk-typescript/README.md`](https://github.com/airprompter/airprompter-agent-sdk/tree/main/sdk-typescript);
+the protocol is in [`protocol/`](https://github.com/airprompter/airprompter-agent-sdk/tree/main/protocol).
+BSD-3-Clause.

package/dist/cjs/bundle/apbundle.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * `.apbundle` (`protocol/schemas/bundle.schema.json`): the OTA release,
+ * serialized — manifest, every payload, the root document(s), a `notAfter`.
+ * Encrypted to the target's X25519 distribution key by default; plaintext
+ * is a `dev` opt-in. `open` runs the identical verification the sync path
+ * runs, so a bundle is never a way around the trust chain.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BundleError = exports.APBUNDLE_INFO = void 0;
+exports.distributionKeyId = distributionKeyId;
+exports.createPlaintextBundle = createPlaintextBundle;
+exports.createEncryptedBundle = createEncryptedBundle;
+exports.openBundle = openBundle;
+exports.bundlePayloadBytes = bundlePayloadBytes;
+const node_crypto_1 = require("node:crypto");
+const canonicalJson_js_1 = require("../protocol/canonicalJson.js");
+const hpke_js_1 = require("./hpke.js");
+exports.APBUNDLE_INFO = "airprompter-apbundle-v1";
+/** RFC 7638 thumbprint of an OKP JWK: sha256 over canonical {crv, kty, x}, hex. */
+function distributionKeyId(publicRaw) {
+    return (0, node_crypto_1.createHash)("sha256").update((0, canonicalJson_js_1.canonicalJson)({ crv: "X25519", kty: "OKP", x: Buffer.from(publicRaw).toString("base64url") }), "utf8").digest("hex");
+}
+function bundleAad(contents) {
+    return Buffer.from(`${contents.manifest.payload.agentId}|${contents.manifest.payload.target}`, "utf8");
+}
+function createPlaintextBundle(contents) {
+    return { format: "apbundle", version: 1, protocol: contents.manifest.payload.protocol, encryption: { scheme: "none", contents } };
+}
+function createEncryptedBundle(contents, recipientPublicRaw) {
+    const sealed = (0, hpke_js_1.sealTo)(recipientPublicRaw, Buffer.from(exports.APBUNDLE_INFO, "utf8"), bundleAad(contents), Buffer.from((0, canonicalJson_js_1.canonicalJson)(contents), "utf8"), hpke_js_1.AEAD_AES_256_GCM);
+    return {
+        format: "apbundle",
+        version: 1,
+        protocol: contents.manifest.payload.protocol,
+        encryption: {
+            scheme: "hpke-x25519-hkdf-sha256-aes-256-gcm",
+            recipientKeyId: distributionKeyId(recipientPublicRaw),
+            enc: sealed.enc.toString("base64url"),
+            info: exports.APBUNDLE_INFO,
+            ciphertext: sealed.ciphertext.toString("base64url"),
+        },
+    };
+}
+class BundleError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "BundleError";
+    }
+}
+exports.BundleError = BundleError;
+/**
+ * Decrypts (when sealed) and returns the contents. The AAD binds the bundle
+ * to the agent and target the caller expects, so a bundle cannot be
+ * relabelled for another target; signature and hash verification is the
+ * caller's (the same path as OTA).
+ */
+function openBundle(bundle, expected, distributionKey) {
+    if (bundle.format !== "apbundle" || bundle.version !== 1)
+        throw new BundleError("malformed", "not an apbundle v1");
+    if (bundle.encryption.scheme === "none") {
+        const contents = bundle.encryption.contents;
+        if (contents.manifest.payload.agentId !== expected.agentId || contents.manifest.payload.target !== expected.target) {
+            throw new BundleError("relabelled", "bundle is for another agent or target");
+        }
+        return contents;
+    }
+    if (!distributionKey)
+        throw new BundleError("wrong_recipient", "an encrypted bundle needs the target's distribution key");
+    if (bundle.encryption.recipientKeyId !== distributionKeyId(distributionKey.publicRaw))
+        throw new BundleError("wrong_recipient", "bundle was sealed to another distribution key");
+    let plaintext;
+    try {
+        plaintext = (0, hpke_js_1.openFrom)({
+            enc: Buffer.from(bundle.encryption.enc, "base64url"),
+            recipientPrivateKey: distributionKey.privateKey,
+            recipientPublicRaw: distributionKey.publicRaw,
+            info: Buffer.from(bundle.encryption.info ?? exports.APBUNDLE_INFO, "utf8"),
+            aad: Buffer.from(`${expected.agentId}|${expected.target}`, "utf8"),
+            ciphertext: Buffer.from(bundle.encryption.ciphertext, "base64url"),
+        });
+    }
+    catch {
+        // A wrong AAD and a tampered ciphertext are indistinguishable by design; both mean "not for this target as sealed".
+        throw new BundleError("decrypt_failed", "bundle does not open for this agent and target");
+    }
+    const contents = JSON.parse(plaintext.toString("utf8"));
+    if (contents.manifest.payload.agentId !== expected.agentId || contents.manifest.payload.target !== expected.target) {
+        throw new BundleError("relabelled", "bundle is for another agent or target");
+    }
+    return contents;
+}
+function bundlePayloadBytes(contents) {
+    return new Map(contents.payloads.map((entry) => [entry.contentHash, Buffer.from(entry.bytes, "base64url")]));
+}
+//# sourceMappingURL=apbundle.js.map

package/dist/cjs/bundle/apbundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apbundle.js","sourceRoot":"","sources":["../../../src/bundle/apbundle.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAWH,8CAEC;AAMD,sDAEC;AAED,sDAcC;AAuBD,gCA8BC;AAED,gDAEC;AA5FD,6CAAyD;AAEzD,mEAA6D;AAE7D,uCAA+D;AAElD,QAAA,aAAa,GAAG,yBAAyB,CAAC;AAEvD,mFAAmF;AACnF,SAAgB,iBAAiB,CAAC,SAAqB;IACrD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAA,gCAAa,EAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1J,CAAC;AAED,SAAS,SAAS,CAAC,QAAwB;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;AACzG,CAAC;AAED,SAAgB,qBAAqB,CAAC,QAAwB;IAC5D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;AACpI,CAAC;AAED,SAAgB,qBAAqB,CAAC,QAAwB,EAAE,kBAA8B;IAC5F,MAAM,MAAM,GAAG,IAAA,gBAAM,EAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAa,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAA,gCAAa,EAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,0BAAgB,CAAC,CAAC;IACnK,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ;QAC5C,UAAU,EAAE;YACV,MAAM,EAAE,qCAAqC;YAC7C,cAAc,EAAE,iBAAiB,CAAC,kBAAkB,CAAC;YACrD,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrC,IAAI,EAAE,qBAAa;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED,MAAa,WAAY,SAAQ,KAAK;IAEzB;IADX,YACW,IAAuE,EAChF,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAmE;QAIhF,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AARD,kCAQC;AAOD;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,MAAc,EAAE,QAA6C,EAAE,eAAiC;IACzH,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IACnH,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC5C,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACnH,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,uCAAuC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;IAC1H,IAAI,MAAM,CAAC,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,eAAe,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IACjL,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,IAAA,kBAAQ,EAAC;YACnB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC;YACpD,mBAAmB,EAAE,eAAe,CAAC,UAAU;YAC/C,kBAAkB,EAAE,eAAe,CAAC,SAAS;YAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,qBAAa,EAAE,MAAM,CAAC;YAClE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC;YAClE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,oHAAoH;QACpH,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAmB,CAAC;IAC1E,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnH,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,uCAAuC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,kBAAkB,CAAC,QAAwB;IACzD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/G,CAAC"}

package/dist/cjs/bundle/hpke.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * HPKE base mode (RFC 9180) with DHKEM(X25519, HKDF-SHA256), HKDF-SHA256 and
+ * AES-GCM, on node:crypto alone. The offline bundle (`.apbundle`) is sealed
+ * to the target's X25519 distribution key with AES-256-GCM; AES-128-GCM is
+ * here only so the implementation can be checked against RFC 9180's A.1
+ * test vector, which uses that AEAD with the same KEM and KDF.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AEAD_AES_256_GCM = exports.AEAD_AES_128_GCM = void 0;
+exports.x25519PublicKeyFromRaw = x25519PublicKeyFromRaw;
+exports.x25519PrivateKeyFromRaw = x25519PrivateKeyFromRaw;
+exports.generateX25519KeyPair = generateX25519KeyPair;
+exports.encap = encap;
+exports.decap = decap;
+exports.keySchedule = keySchedule;
+exports.seal = seal;
+exports.open = open;
+exports.sealTo = sealTo;
+exports.openFrom = openFrom;
+const node_crypto_1 = require("node:crypto");
+const KEM_X25519 = 0x0020;
+const KDF_HKDF_SHA256 = 0x0001;
+exports.AEAD_AES_128_GCM = 0x0001;
+exports.AEAD_AES_256_GCM = 0x0002;
+const NSECRET = 32;
+const NN = 12;
+const utf8 = (text) => Buffer.from(text, "utf8");
+const i2osp2 = (value) => Buffer.from([(value >> 8) & 0xff, value & 0xff]);
+const kemSuiteId = Buffer.concat([utf8("KEM"), i2osp2(KEM_X25519)]);
+const hpkeSuiteId = (aead) => Buffer.concat([utf8("HPKE"), i2osp2(KEM_X25519), i2osp2(KDF_HKDF_SHA256), i2osp2(aead)]);
+function hkdfExtract(salt, ikm) {
+    return (0, node_crypto_1.createHmac)("sha256", salt.length ? salt : Buffer.alloc(32)).update(ikm).digest();
+}
+function hkdfExpand(prk, info, length) {
+    const blocks = [];
+    let previous = Buffer.alloc(0);
+    for (let counter = 1; Buffer.concat(blocks).length < length; counter += 1) {
+        previous = (0, node_crypto_1.createHmac)("sha256", prk).update(Buffer.concat([previous, info, Buffer.from([counter])])).digest();
+        blocks.push(previous);
+    }
+    return Buffer.concat(blocks).subarray(0, length);
+}
+function labeledExtract(suiteId, salt, label, ikm) {
+    return hkdfExtract(salt, Buffer.concat([utf8("HPKE-v1"), suiteId, utf8(label), ikm]));
+}
+function labeledExpand(suiteId, prk, label, info, length) {
+    return hkdfExpand(prk, Buffer.concat([i2osp2(length), utf8("HPKE-v1"), suiteId, utf8(label), info]), length);
+}
+function rawPublic(key) {
+    return Buffer.from(key.export({ format: "jwk" }).x, "base64url");
+}
+function x25519PublicKeyFromRaw(raw) {
+    return (0, node_crypto_1.createPublicKey)({ key: { kty: "OKP", crv: "X25519", x: Buffer.from(raw).toString("base64url") }, format: "jwk" });
+}
+function x25519PrivateKeyFromRaw(raw, publicRaw) {
+    return (0, node_crypto_1.createPrivateKey)({ key: { kty: "OKP", crv: "X25519", x: Buffer.from(publicRaw).toString("base64url"), d: Buffer.from(raw).toString("base64url") }, format: "jwk" });
+}
+function generateX25519KeyPair() {
+    const pair = (0, node_crypto_1.generateKeyPairSync)("x25519");
+    return { privateKey: pair.privateKey, publicKey: pair.publicKey, publicRaw: rawPublic(pair.publicKey) };
+}
+function extractAndExpand(dh, kemContext) {
+    const eaePrk = labeledExtract(kemSuiteId, Buffer.alloc(0), "eae_prk", dh);
+    return labeledExpand(kemSuiteId, eaePrk, "shared_secret", kemContext, NSECRET);
+}
+function encap(recipientPublicRaw, ephemeral) {
+    const e = ephemeral ?? generateX25519KeyPair();
+    const dh = (0, node_crypto_1.diffieHellman)({ privateKey: e.privateKey, publicKey: x25519PublicKeyFromRaw(recipientPublicRaw) });
+    const enc = e.publicRaw;
+    return { sharedSecret: extractAndExpand(dh, Buffer.concat([enc, Buffer.from(recipientPublicRaw)])), enc };
+}
+function decap(enc, recipientPrivateKey, recipientPublicRaw) {
+    const dh = (0, node_crypto_1.diffieHellman)({ privateKey: recipientPrivateKey, publicKey: x25519PublicKeyFromRaw(enc) });
+    return extractAndExpand(dh, Buffer.concat([Buffer.from(enc), Buffer.from(recipientPublicRaw)]));
+}
+function keySchedule(sharedSecret, info, aead) {
+    const suite = hpkeSuiteId(aead);
+    const pskIdHash = labeledExtract(suite, Buffer.alloc(0), "psk_id_hash", Buffer.alloc(0));
+    const infoHash = labeledExtract(suite, Buffer.alloc(0), "info_hash", info);
+    const context = Buffer.concat([Buffer.from([0x00]), pskIdHash, infoHash]);
+    const secret = labeledExtract(suite, sharedSecret, "secret", Buffer.alloc(0));
+    const nk = aead === exports.AEAD_AES_256_GCM ? 32 : 16;
+    return { key: labeledExpand(suite, secret, "key", context, nk), baseNonce: labeledExpand(suite, secret, "base_nonce", context, NN), aead };
+}
+function nonceFor(context, seq) {
+    const nonce = Buffer.from(context.baseNonce);
+    // XOR the sequence number into the low-order bytes (big-endian).
+    let remaining = seq;
+    for (let index = nonce.length - 1; index >= 0 && remaining > 0; index -= 1) {
+        nonce[index] = nonce[index] ^ (remaining & 0xff);
+        remaining = Math.floor(remaining / 256);
+    }
+    return nonce;
+}
+/** ct ‖ tag(16), as HPKE's AEAD.Seal returns it. */
+function seal(context, aad, plaintext, seq = 0) {
+    const algorithm = context.aead === exports.AEAD_AES_256_GCM ? "aes-256-gcm" : "aes-128-gcm";
+    const cipher = (0, node_crypto_1.createCipheriv)(algorithm, context.key, nonceFor(context, seq));
+    cipher.setAAD(aad);
+    return Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
+}
+function open(context, aad, ciphertext, seq = 0) {
+    const algorithm = context.aead === exports.AEAD_AES_256_GCM ? "aes-256-gcm" : "aes-128-gcm";
+    const buffer = Buffer.from(ciphertext);
+    const decipher = (0, node_crypto_1.createDecipheriv)(algorithm, context.key, nonceFor(context, seq));
+    decipher.setAAD(aad);
+    decipher.setAuthTag(buffer.subarray(buffer.length - 16));
+    return Buffer.concat([decipher.update(buffer.subarray(0, buffer.length - 16)), decipher.final()]);
+}
+/** Single-shot base-mode seal: returns `enc` and the ciphertext. */
+function sealTo(recipientPublicRaw, info, aad, plaintext, aead = exports.AEAD_AES_256_GCM) {
+    const { sharedSecret, enc } = encap(recipientPublicRaw);
+    return { enc, ciphertext: seal(keySchedule(sharedSecret, Buffer.from(info), aead), aad, plaintext) };
+}
+function openFrom(input) {
+    const sharedSecret = decap(input.enc, input.recipientPrivateKey, input.recipientPublicRaw);
+    return open(keySchedule(sharedSecret, Buffer.from(input.info), input.aead ?? exports.AEAD_AES_256_GCM), input.aad, input.ciphertext);
+}
+//# sourceMappingURL=hpke.js.map

package/dist/cjs/bundle/hpke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hpke.js","sourceRoot":"","sources":["../../../src/bundle/hpke.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AA0CH,wDAEC;AAED,0DAEC;AAED,sDAGC;AAOD,sBAKC;AAED,sBAGC;AAQD,kCAQC;AAcD,oBAKC;AAED,oBAOC;AAGD,wBAGC;AAED,4BAGC;AA3HD,6CAAkK;AAElK,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,eAAe,GAAG,MAAM,CAAC;AAClB,QAAA,gBAAgB,GAAG,MAAM,CAAC;AAC1B,QAAA,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,EAAE,GAAG,EAAE,CAAC;AAEd,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACzD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;AACnF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACpE,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE/H,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY,EAAE,MAAc;IAC3D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC1E,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9G,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,IAAY,EAAE,KAAa,EAAE,GAAW;IAC/E,OAAO,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,GAAW,EAAE,KAAa,EAAE,IAAY,EAAE,MAAc;IAC9F,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,SAAS,CAAC,GAAc;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,SAAgB,sBAAsB,CAAC,GAAe;IACpD,OAAO,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED,SAAgB,uBAAuB,CAAC,GAAe,EAAE,SAAqB;IAC5E,OAAO,IAAA,8BAAgB,EAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7K,CAAC;AAED,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,IAAA,iCAAmB,EAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAC1G,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAU,EAAE,UAAkB;IACtD,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACjF,CAAC;AAED,SAAgB,KAAK,CAAC,kBAA8B,EAAE,SAAwD;IAC5G,MAAM,CAAC,GAAG,SAAS,IAAI,qBAAqB,EAAE,CAAC;IAC/C,MAAM,EAAE,GAAG,IAAA,2BAAa,EAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC;IACxB,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;AAC5G,CAAC;AAED,SAAgB,KAAK,CAAC,GAAe,EAAE,mBAA8B,EAAE,kBAA8B;IACnG,MAAM,EAAE,GAAG,IAAA,2BAAa,EAAC,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtG,OAAO,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAQD,SAAgB,WAAW,CAAC,YAAoB,EAAE,IAAY,EAAE,IAAY;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,EAAE,GAAG,IAAI,KAAK,wBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;AAC7I,CAAC;AAED,SAAS,QAAQ,CAAC,OAAoB,EAAE,GAAW;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,iEAAiE;IACjE,IAAI,SAAS,GAAG,GAAG,CAAC;IACpB,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3E,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QAClD,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oDAAoD;AACpD,SAAgB,IAAI,CAAC,OAAoB,EAAE,GAAe,EAAE,SAAqB,EAAE,GAAG,GAAG,CAAC;IACxF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,wBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;IACpF,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAgB,IAAI,CAAC,OAAoB,EAAE,GAAe,EAAE,UAAsB,EAAE,GAAG,GAAG,CAAC;IACzF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,wBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;IACpF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAClF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,oEAAoE;AACpE,SAAgB,MAAM,CAAC,kBAA8B,EAAE,IAAgB,EAAE,GAAe,EAAE,SAAqB,EAAE,IAAI,GAAG,wBAAgB;IACtI,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;AACvG,CAAC;AAED,SAAgB,QAAQ,CAAC,KAAoK;IAC3L,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,wBAAgB,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;AAC/H,CAAC"}