@atlasauth/emulator-core 0.2.0 → 0.3.1

package/dist/handlers/emu4-trust-binding.js

@@ -0,0 +1,344 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionBindingClaims = exports.trustConfig = void 0;
+exports.enforceSessionBinding = enforceSessionBinding;
+exports.dbscRegistrationHeaders = dbscRegistrationHeaders;
+exports.emu4TrustBindingHandlers = emu4TrustBindingHandlers;
+const crypto_util_1 = require("../crypto-util");
+const errors_1 = require("../errors");
+const jws_1 = require("../jws");
+const store_1 = require("../store");
+const oauth_flows_1 = require("./oauth-flows");
+const sessions_1 = require("./sessions");
+const support_1 = require("./support");
+const emu4_trust_1 = require("./emu4-trust");
+const state = (0, support_1.engineState)((_e) => ({
+    config: { session_binding: { mode: 'off', require_attestation: false }, device_bound_sessions: false, app_attestation: false },
+    bindings: new Map(),
+    devices: new Map(),
+    /** Random per engine, so a bound cookie from another engine never verifies. */
+    hmac: crypto.subtle.importKey('raw', crypto.getRandomValues(new Uint8Array(32)), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']),
+}));
+const trustConfig = (e) => state(e).config;
+exports.trustConfig = trustConfig;
+const bindingMode = (e) => state(e).config.session_binding.mode;
+const refused = (message, reason) => new errors_1.EmulatorError('UNAUTHENTICATED', message, undefined, { meta: { reason } });
+const readCookie = (c, name) => {
+    for (const part of (c.request.headers.get('cookie') ?? '').split(';')) {
+        const [k, ...rest] = part.trim().split('=');
+        if (k === name)
+            return rest.join('=');
+    }
+    return undefined;
+};
+const refreshOf = (c) => {
+    const cookie = readCookie(c, '__atlas_rt');
+    return cookie ? decodeURIComponent(cookie) : (c.request.headers.get('x-refresh-token') ?? undefined);
+};
+/** `cnf.jkt` for the session JWT of a bound session; nothing for an unbound one. */
+const sessionBindingClaims = (e, sessionId) => {
+    const b = state(e).bindings.get(sessionId);
+    return b ? { cnf: { jkt: b.jkt } } : {};
+};
+exports.sessionBindingClaims = sessionBindingClaims;
+/** A proof from the request: `null` when there is no DPoP header, a refusal (401 `dpop_proof_invalid`) when it does not verify or was used before. */
+async function proofOf(c) {
+    const raw = c.request.headers.get('dpop');
+    if (raw === null)
+        return null;
+    try {
+        const r = await (0, jws_1.verifyDpopProof)({ proof: raw, htm: c.request.method, htu: c.request.url, nowMs: c.engine.clock.now() });
+        if (!(0, oauth_flows_1.claimDpopJti)(c.engine, r.jkt, r.jti, (jws_1.DPOP_IAT_WINDOW_S + 5) * 1000))
+            throw new Error('That DPoP proof was already used.');
+        return { jkt: r.jkt, alg: String((0, jws_1.decodeJwt)(raw)?.header.alg ?? '') };
+    }
+    catch (err) {
+        throw refused(err instanceof Error && err.message === 'That DPoP proof was already used.' ? err.message : 'The DPoP proof is not valid.', 'dpop_proof_invalid');
+    }
+}
+const hmac = async (e, msg) => (0, crypto_util_1.bytesToB64url)(new Uint8Array(await crypto.subtle.sign('HMAC', await state(e).hmac, new TextEncoder().encode(msg))));
+/** `<session id>.<exp seconds>.<mac>`: stateless, bound to the session, the kind and the expiry. */
+const signBound = async (e, kind, sid, exp) => `${sid}.${exp}.${await hmac(e, `${kind}.${sid}.${exp}`)}`;
+async function verifyBound(e, kind, token) {
+    const parts = (token ?? '').split('.');
+    if (parts.length < 3)
+        return null;
+    const sig = parts.pop();
+    const exp = Number(parts.pop());
+    const sid = parts.join('.');
+    if (!sid || !Number.isFinite(exp) || exp * 1000 <= e.clock.now())
+        return null;
+    // shortcut: plain string comparison, not constant time (an in-process test double has no timing channel to protect).
+    return (await hmac(e, `${kind}.${sid}.${exp}`)) === sig ? sid : null;
+}
+const BOUND_COOKIE = '__atlas_dbsc';
+const BOUND_TTL_S = 600;
+const CHALLENGE_TTL_S = 300;
+async function boundCookie(e, sid) {
+    const attributes = 'Secure; HttpOnly; SameSite=Lax; Path=/';
+    const value = await signBound(e, 'cookie', sid, Math.floor(e.clock.now() / 1000) + BOUND_TTL_S);
+    return { header: `${BOUND_COOKIE}=${value}; ${attributes}; Max-Age=${BOUND_TTL_S}`, attributes };
+}
+const provenDevice = async (c) => {
+    const sid = await verifyBound(c.engine, 'cookie', readCookie(c, BOUND_COOKIE));
+    return sid ? state(c.engine).devices.get(sid)?.device_id : undefined;
+};
+/**
+ * The gate on the refresh route: a session bound to a key refreshes only with a fresh single-use proof from that key
+ * (401 `dpop_binding_required`); with mode `required` an unbound session cannot refresh (401 `session_binding_required`);
+ * a session bound to a device needs that device's bound cookie (401 `device_binding_required`).
+ */
+async function enforceSessionBinding(c, sessionId) {
+    const e = c.engine;
+    const s = e.db.sessions.get(sessionId);
+    if (!s || s.status !== 'active')
+        return;
+    const mode = bindingMode(e);
+    if (mode !== 'off') {
+        const binding = state(e).bindings.get(sessionId);
+        if (!binding) {
+            if (mode === 'required')
+                throw refused('This instance requires sessions to be bound to a key. Bind the session (POST /v1/client/session_binding) and retry.', 'session_binding_required');
+        }
+        else {
+            const proof = await proofOf(c);
+            if (!proof || proof.jkt !== binding.jkt)
+                throw refused('This session is bound to a key. Send a DPoP proof signed by that key.', 'dpop_binding_required');
+            binding.last_proof_at = e.clock.now();
+        }
+    }
+    if (state(e).config.device_bound_sessions) {
+        const device = state(e).devices.get(sessionId);
+        if (device && (await provenDevice(c)) !== device.device_id)
+            throw refused('This session is bound to a device. Renew the device credential and try again.', 'device_binding_required');
+    }
+}
+/** `Secure-Session-Registration` for a session handed out with a refresh cookie that is not bound to a device yet. */
+async function dbscRegistrationHeaders(e, sessionId) {
+    if (!state(e).config.device_bound_sessions || state(e).devices.has(sessionId))
+        return {};
+    const challenge = await signBound(e, 'reg', sessionId, Math.floor(e.clock.now() / 1000) + CHALLENGE_TTL_S);
+    return { 'secure-session-registration': `(ES256 RS256);path="/v1/client/dbsc/start";challenge="${challenge}"` };
+}
+/** Native app attestation evidence: base64url JSON `{ p: 'ios' | 'ios_dc' | 'android' }`; anything else is refused (the emulator does not run Apple or Google verifiers). */
+function attestationProvider(c) {
+    const raw = c.request.headers.get('atlas-attestation');
+    const bad = new errors_1.EmulatorError('APP_ATTESTATION_REQUIRED', raw ? 'The app attestation evidence is not valid.' : 'This request needs app attestation evidence.');
+    if (!raw)
+        throw bad;
+    try {
+        const p = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(raw.replace(/-/g, '+').replace(/_/g, '/')), (x) => x.charCodeAt(0)))).p;
+        if (p === 'ios' || p === 'ios_dc' || p === 'android')
+            return p;
+    }
+    catch {
+        /* falls through */
+    }
+    throw bad;
+}
+const bindingView = (b) => ({ object: 'session_binding', session_id: b.session_id, jkt: b.jkt, attested: b.attested, bound_at: b.bound_at });
+function emu4TrustBindingHandlers() {
+    return [
+        // ── the trust switches (the real instance keeps these in its auth config) ──
+        { method: 'GET', pattern: '/__emulator/trust/config', public: true, handler: (c) => ({ body: { object: 'trust_config', ...state(c.engine).config } }) },
+        {
+            method: 'PUT',
+            pattern: '/__emulator/trust/config',
+            public: true,
+            handler: (c) => {
+                const cfg = state(c.engine).config;
+                const b = c.body;
+                const sb = b.session_binding;
+                if (sb !== undefined) {
+                    if (sb === null || typeof sb !== 'object' || Array.isArray(sb))
+                        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'session_binding must be an object.', 'session_binding');
+                    if (sb.mode !== undefined && !['off', 'optional', 'required'].includes(sb.mode))
+                        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'session_binding.mode must be one of off, optional, required.', 'session_binding.mode');
+                    if (sb.require_attestation !== undefined && typeof sb.require_attestation !== 'boolean')
+                        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'session_binding.require_attestation must be true or false.', 'session_binding.require_attestation');
+                }
+                for (const f of ['device_bound_sessions', 'app_attestation'])
+                    if (b[f] !== undefined && typeof b[f] !== 'boolean')
+                        throw new errors_1.EmulatorError('VALIDATION_FAILED', `${f} must be true or false.`, f);
+                if (sb)
+                    cfg.session_binding = { ...cfg.session_binding, ...(sb.mode ? { mode: sb.mode } : {}), ...(sb.require_attestation !== undefined ? { require_attestation: sb.require_attestation } : {}) };
+                if (b.device_bound_sessions !== undefined)
+                    cfg.device_bound_sessions = b.device_bound_sessions;
+                if (b.app_attestation !== undefined)
+                    cfg.app_attestation = b.app_attestation;
+                return { body: { object: 'trust_config', ...cfg } };
+            },
+        },
+        // ── bind a session to a DPoP key (Frontend API) ──
+        {
+            method: 'POST',
+            pattern: '/v1/client/session_binding',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const policy = state(e).config.session_binding;
+                if (policy.mode === 'off')
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'Session binding is not enabled.');
+                const rt = refreshOf(c);
+                const sid = rt ? (0, sessions_1.sessionIdOfRefresh)(e, rt, true) : undefined;
+                const session = sid ? e.db.sessions.get(sid) : undefined;
+                if (!session || session.status !== 'active')
+                    throw new errors_1.EmulatorError('UNAUTHENTICATED', 'No active session to bind.');
+                const proof = await proofOf(c);
+                if (!proof)
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'Send a DPoP proof signed by the key to bind the session to.', 'dpop');
+                const sent = c.request.headers.get('atlas-attestation') !== null;
+                let provider = null;
+                if (policy.require_attestation || sent) {
+                    if (!state(e).config.app_attestation)
+                        throw Object.assign(new errors_1.EmulatorError('STRATEGY_DISABLED', 'App attestation is not enabled for this instance.'), { status: 422 });
+                    provider = attestationProvider(c);
+                }
+                const existing = state(e).bindings.get(session.id);
+                if (existing) {
+                    if (existing.jkt !== proof.jkt)
+                        throw new errors_1.EmulatorError('CONFLICT', 'This session is already bound to a different key.', undefined, { meta: { reason: 'already_bound' } });
+                    existing.last_proof_at = e.clock.now();
+                    return { status: 200, body: bindingView(existing) };
+                }
+                const b = { session_id: session.id, jkt: proof.jkt, alg: proof.alg, attested: provider !== null, attestation_provider: provider, bound_at: e.clock.now(), last_proof_at: null };
+                state(e).bindings.set(session.id, b);
+                (0, emu4_trust_1.recordAudit)(e, { actor_type: 'user', actor_id: session.user_id, action: 'session.bound', target_type: 'session', target_id: session.id, metadata: { jkt: b.jkt, alg: b.alg, attested: b.attested } });
+                e.webhooks.emit('session.bound', { object: 'session_binding', session_id: session.id, user_id: session.user_id, jkt: b.jkt, attested: b.attested });
+                return { status: 201, body: bindingView(b) };
+            },
+        },
+        // ── the binding of one session, from the backend key ──
+        {
+            method: 'GET',
+            pattern: '/v1/sessions/:id/binding',
+            scope: 'sessions:read',
+            handler: (c) => {
+                const e = c.engine;
+                if (!e.db.sessions.get(c.params.id))
+                    throw (0, errors_1.notFound)('Session');
+                const b = state(e).bindings.get(c.params.id);
+                if (!b)
+                    return { body: { object: 'session_binding', session_id: c.params.id, bound: false, jkt: null, alg: null, attested: false, attestation_provider: null, bound_at: null, last_proof_at: null } };
+                // The key itself is never returned, only its thumbprint.
+                return { body: { object: 'session_binding', session_id: b.session_id, bound: true, jkt: b.jkt, alg: b.alg, attested: b.attested, attestation_provider: b.attestation_provider, bound_at: b.bound_at, last_proof_at: b.last_proof_at } };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/sessions/:id/binding',
+            scope: 'sessions:write',
+            handler: (c) => {
+                const e = c.engine;
+                if (!e.db.sessions.get(c.params.id))
+                    throw (0, errors_1.notFound)('Session');
+                if (!state(e).bindings.delete(c.params.id))
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'This session is not bound.');
+                (0, emu4_trust_1.recordAudit)(e, { actor_type: 'api_key', actor_id: null, action: 'session.binding_removed', target_type: 'session', target_id: c.params.id, metadata: {} });
+                return { body: { object: 'session_binding', session_id: c.params.id, bound: false, deleted: true } };
+            },
+        },
+        // ── device-bound sessions (the browser DBSC protocol) ──
+        {
+            // The registration challenge a browser would read from `Secure-Session-Registration`: a test helper for clients that do not parse the header.
+            method: 'POST',
+            pattern: '/__emulator/dbsc/registration',
+            public: true,
+            handler: async (c) => {
+                const sid = String(c.body.session_id ?? '');
+                if (!c.engine.db.sessions.get(sid))
+                    throw (0, errors_1.notFound)('Session');
+                const challenge = await signBound(c.engine, 'reg', sid, Math.floor(c.engine.clock.now() / 1000) + CHALLENGE_TTL_S);
+                return { body: { object: 'dbsc_registration', session_id: sid, challenge, path: '/v1/client/dbsc/start' } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/client/dbsc/start',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                if (!state(e).config.device_bound_sessions)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'Device bound sessions are not enabled.');
+                const fail = (m) => new errors_1.EmulatorError('UNAUTHENTICATED', m);
+                const proof = await dbscProof(c, c.request.headers.get('secure-session-response'), '/dbsc/start');
+                const sid = proof && (await verifyBound(e, 'reg', proof.jti));
+                if (!proof || !sid)
+                    throw fail('The registration proof is not valid.');
+                const rt = readCookie(c, '__atlas_rt');
+                const rtSid = rt ? (0, sessions_1.sessionIdOfRefresh)(e, decodeURIComponent(rt), true) : undefined;
+                const session = rtSid ? e.db.sessions.get(rtSid) : undefined;
+                if (!session || session.id !== sid || session.status !== 'active')
+                    throw fail('No active session for this registration.');
+                // A browser that already proves a device (another account it holds) registers into that device.
+                const deviceId = (await provenDevice(c)) ?? crypto.randomUUID();
+                if (state(e).devices.has(sid))
+                    throw fail('This session is already bound to a device.');
+                state(e).devices.set(sid, { session_id: sid, device_id: deviceId, jwk: proof.jwk, alg: proof.alg, challenge: null, challenge_expires_at: null });
+                const cookie = await boundCookie(e, sid);
+                return {
+                    status: 200,
+                    headers: { 'set-cookie': cookie.header },
+                    body: {
+                        session_identifier: sid,
+                        refresh_url: '/v1/client/dbsc/refresh',
+                        scope: { origin: new URL(c.request.url).origin, include_site: false, scope_specification: [] },
+                        credentials: [{ type: 'cookie', name: BOUND_COOKIE, attributes: cookie.attributes }],
+                    },
+                };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/client/dbsc/refresh',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                if (!state(e).config.device_bound_sessions)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'Device bound sessions are not enabled.');
+                const fail = (m) => new errors_1.EmulatorError('UNAUTHENTICATED', m);
+                const sid = c.request.headers.get('sec-secure-session-id');
+                const binding = sid ? state(e).devices.get(sid) : undefined;
+                if (!sid || !binding)
+                    throw fail('Unknown device bound session.');
+                const session = e.db.sessions.get(sid);
+                if (!session || session.status !== 'active' || session.expires_at <= e.clock.now())
+                    throw fail('That session is no longer active.');
+                const jwt = c.request.headers.get('secure-session-response');
+                if (!jwt) {
+                    binding.challenge = (0, store_1.randomToken)(24);
+                    binding.challenge_expires_at = e.clock.now() + CHALLENGE_TTL_S * 1000;
+                    return { status: 403, headers: { 'secure-session-challenge': `"${binding.challenge}";id="${sid}"` } };
+                }
+                const proof = await dbscProof(c, jwt, '/dbsc/refresh', binding.jwk);
+                if (!proof || !binding.challenge || proof.jti !== binding.challenge || !binding.challenge_expires_at || binding.challenge_expires_at <= e.clock.now())
+                    throw fail('The refresh proof is not valid.');
+                // Each challenge works once.
+                binding.challenge = null;
+                binding.challenge_expires_at = null;
+                return { status: 200, headers: { 'set-cookie': (await boundCookie(e, sid)).header }, body: { session_identifier: sid } };
+            },
+        },
+    ];
+}
+/** Verify a `dbsc+jwt` proof: type, algorithm (ES256 or RS256), signature (the payload `key` at registration, the stored key at refresh), age of at most 5 minutes, audience suffix and a jti. */
+async function dbscProof(c, jwt, audSuffix, jwk) {
+    const d = jwt ? (0, jws_1.decodeJwt)(jwt) : null;
+    if (!d || d.header.typ !== 'dbsc+jwt' || !['ES256', 'RS256'].includes(d.header.alg))
+        return null;
+    const key = jwk ?? d.payload.key;
+    if (!key || typeof key !== 'object' || 'd' in key || !(await (0, jws_1.verifyJws)(d, key)))
+        return null;
+    const now = c.engine.clock.now() / 1000;
+    if (typeof d.payload.iat !== 'number' || now - d.payload.iat > 300)
+        return null;
+    if (typeof d.payload.exp === 'number' && d.payload.exp <= now)
+        return null;
+    const aud = Array.isArray(d.payload.aud) ? d.payload.aud[0] : d.payload.aud;
+    if (typeof aud !== 'string' || !aud.split('?')[0].endsWith(audSuffix))
+        return null;
+    if (typeof d.payload.jti !== 'string' || !d.payload.jti)
+        return null;
+    return { jwk: key, alg: d.header.alg, jti: d.payload.jti };
+}
+//# sourceMappingURL=emu4-trust-binding.js.map

package/dist/handlers/emu4-trust-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-trust-binding.js","sourceRoot":"","sources":["../../src/handlers/emu4-trust-binding.ts"],"names":[],"mappings":";;;AAoHA,sDAmBC;AAGD,0DAIC;AAkBD,4DAgKC;AA9TD,gDAA+C;AAC/C,sCAAoD;AACpD,gCAAkF;AAElF,oCAAuC;AACvC,+CAA6C;AAC7C,yCAAgD;AAChD,uCAAwC;AACxC,6CAA2C;AA+B3C,MAAM,KAAK,GAAG,IAAA,qBAAW,EAAC,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAiB;IAC7I,QAAQ,EAAE,IAAI,GAAG,EAAmB;IACpC,OAAO,EAAE,IAAI,GAAG,EAAyB;IACzC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;CACrI,CAAC,CAAC,CAAC;AAEG,MAAM,WAAW,GAAG,CAAC,CAAS,EAAe,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAA1D,QAAA,WAAW,eAA+C;AACvE,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC;AAExE,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,MAAc,EAAiB,EAAE,CAAC,IAAI,sBAAa,CAAC,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AACnJ,MAAM,UAAU,GAAG,CAAC,CAAe,EAAE,IAAY,EAAsB,EAAE;IACvE,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AACF,MAAM,SAAS,GAAG,CAAC,CAAe,EAAsB,EAAE;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,CAAC;AACvG,CAAC,CAAC;AAEF,oFAAoF;AAC7E,MAAM,oBAAoB,GAAG,CAAC,CAAS,EAAE,SAAiB,EAAO,EAAE;IACxE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC,CAAC;AAHW,QAAA,oBAAoB,wBAG/B;AAEF,sJAAsJ;AACtJ,KAAK,UAAU,OAAO,CAAC,CAAe;IACpC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,IAAA,qBAAe,EAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxH,IAAI,CAAC,IAAA,0BAAY,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,uBAAiB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAChI,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,IAAA,eAAS,EAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,mCAAmC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;IAClK,CAAC;AACH,CAAC;AAED,MAAM,IAAI,GAAG,KAAK,EAAE,CAAS,EAAE,GAAW,EAAmB,EAAE,CAAC,IAAA,2BAAa,EAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpL,oGAAoG;AACpG,MAAM,SAAS,GAAG,KAAK,EAAE,CAAS,EAAE,IAAsB,EAAE,GAAW,EAAE,GAAW,EAAmB,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,MAAM,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;AACpK,KAAK,UAAU,WAAW,CAAC,CAAS,EAAE,IAAsB,EAAE,KAAyB;IACrF,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9E,qHAAqH;IACrH,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AACD,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,KAAK,UAAU,WAAW,CAAC,CAAS,EAAE,GAAW;IAC/C,MAAM,UAAU,GAAG,wCAAwC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;IAChG,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,IAAI,KAAK,KAAK,UAAU,aAAa,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC;AACnG,CAAC;AACD,MAAM,YAAY,GAAG,KAAK,EAAE,CAAe,EAA+B,EAAE;IAC1E,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC,CAAC;AAEF;;;;GAIG;AACI,KAAK,UAAU,qBAAqB,CAAC,CAAe,EAAE,SAAiB;IAC5E,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,IAAI,KAAK,UAAU;gBAAE,MAAM,OAAO,CAAC,qHAAqH,EAAE,0BAA0B,CAAC,CAAC;QAC5L,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;gBAAE,MAAM,OAAO,CAAC,uEAAuE,EAAE,uBAAuB,CAAC,CAAC;YACzJ,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,MAAM,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,OAAO,CAAC,+EAA+E,EAAE,yBAAyB,CAAC,CAAC;IACxL,CAAC;AACH,CAAC;AAED,sHAAsH;AAC/G,KAAK,UAAU,uBAAuB,CAAC,CAAS,EAAE,SAAiB;IACxE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACzF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;IAC3G,OAAO,EAAE,6BAA6B,EAAE,yDAAyD,SAAS,GAAG,EAAE,CAAC;AAClH,CAAC;AAED,6KAA6K;AAC7K,SAAS,mBAAmB,CAAC,CAAe;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,sBAAa,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC;IAC/J,IAAI,CAAC,GAAG;QAAE,MAAM,GAAG,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3I,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAU,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAE3J,SAAgB,wBAAwB;IACtC,OAAO;QACL,8EAA8E;QAC9E,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;QACvJ;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC;gBAC7B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;oBACrB,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;wBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,iBAAiB,CAAC,CAAC;oBACtK,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC;wBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,8DAA8D,EAAE,sBAAsB,CAAC,CAAC;oBACtN,IAAI,EAAE,CAAC,mBAAmB,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,mBAAmB,KAAK,SAAS;wBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,4DAA4D,EAAE,qCAAqC,CAAC,CAAC;gBAC7O,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,iBAAiB,CAAU;oBAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;wBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;gBAC3M,IAAI,EAAE;oBAAE,GAAG,CAAC,eAAe,GAAG,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClM,IAAI,CAAC,CAAC,qBAAqB,KAAK,SAAS;oBAAE,GAAG,CAAC,qBAAqB,GAAG,CAAC,CAAC,qBAAqB,CAAC;gBAC/F,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS;oBAAE,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;gBAC7E,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC;YACtD,CAAC;SACF;QAED,oDAAoD;QACpD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4BAA4B;YACrC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;gBAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;gBACnG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACxB,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAA,6BAAkB,EAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;oBAAE,MAAM,IAAI,sBAAa,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;gBACtH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,6DAA6D,EAAE,MAAM,CAAC,CAAC;gBAChI,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC;gBACjE,IAAI,QAAQ,GAAkB,IAAI,CAAC;gBACnC,IAAI,MAAM,CAAC,mBAAmB,IAAI,IAAI,EAAE,CAAC;oBACvC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe;wBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,sBAAa,CAAC,mBAAmB,EAAE,mDAAmD,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;oBACxK,QAAQ,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBACpC,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;wBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,mDAAmD,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;oBAC3K,QAAQ,CAAC,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;oBACvC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtD,CAAC;gBACD,MAAM,CAAC,GAAY,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,KAAK,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;gBACzL,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBACrC,IAAA,wBAAW,EAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACtM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpJ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,CAAC;SACF;QAED,yDAAyD;QACzD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAG,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,SAAS,CAAC,CAAC;gBAChE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAG,CAAC,CAAC;gBAC9C,IAAI,CAAC,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;gBACtM,yDAAyD;gBACzD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;YAC1O,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAG,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,SAAS,CAAC,CAAC;gBAChE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAG,CAAC;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;gBAChH,IAAA,wBAAW,EAAC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC5J,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACvG,CAAC;SACF;QAED,0DAA0D;QAC1D;YACE,8IAA8I;YAC9I,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+BAA+B;YACxC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBAC5C,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,SAAS,CAAC,CAAC;gBAC9D,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;gBACnH,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,CAAC;YAC9G,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;gBAC3H,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;gBACpE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,aAAa,CAAC,CAAC;gBAClG,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,CAAC,sCAAsC,CAAC,CAAC;gBACvE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,IAAA,6BAAkB,EAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;oBAAE,MAAM,IAAI,CAAC,0CAA0C,CAAC,CAAC;gBAC1H,gGAAgG;gBAChG,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAChE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBACxF,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjJ,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACzC,OAAO;oBACL,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE;oBACxC,IAAI,EAAE;wBACJ,kBAAkB,EAAE,GAAG;wBACvB,WAAW,EAAE,yBAAyB;wBACtC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE;wBAC9F,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;qBACrF;iBACF,CAAC;YACJ,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,yBAAyB;YAClC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;gBAC3H,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;gBACpE,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;gBAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC5D,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,CAAC,+BAA+B,CAAC,CAAC;gBAClE,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBAAE,MAAM,IAAI,CAAC,mCAAmC,CAAC,CAAC;gBACpI,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;gBAC7D,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,OAAO,CAAC,SAAS,GAAG,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC;oBACpC,OAAO,CAAC,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC;oBACtE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,IAAI,OAAO,CAAC,SAAS,SAAS,GAAG,GAAG,EAA4B,EAAE,CAAC;gBAClI,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpE,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBAAE,MAAM,IAAI,CAAC,iCAAiC,CAAC,CAAC;gBACrM,6BAA6B;gBAC7B,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;gBACpC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,EAA4B,EAAE,IAAI,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,EAAE,CAAC;YACrJ,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,kMAAkM;AAClM,KAAK,UAAU,SAAS,CAAC,CAAe,EAAE,GAAkB,EAAE,SAAiB,EAAE,GAAS;IACxF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,eAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,MAAM,GAAG,GAAoB,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,IAAA,eAAS,EAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7F,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACxC,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC5E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AAC7D,CAAC"}

package/dist/handlers/emu4-trust.d.ts

@@ -0,0 +1,35 @@
+import { type ChainedAuditRow } from '@atlasauth/backend';
+import type { Engine, KeyInfo, RouteDef } from '../engine';
+import type { Obj } from '../openapi';
+export interface AuditInput {
+    actor_type: string;
+    actor_id: string | null;
+    action: string;
+    target_type: string | null;
+    target_id: string | null;
+    metadata?: Obj;
+    ip?: string | null;
+    user_agent?: string | null;
+}
+/** Append one audit row (what the real service writes for every mutation); the oldest rows fall off at 20000, like retention. */
+export declare function recordAudit(e: Engine, a: AuditInput): ChainedAuditRow;
+/** Called by the engine after every successful write: leaves the audit row the real service would (names like `user.created`, `session.revoked`). */
+export declare function auditMutation(e: Engine, w: {
+    method: string;
+    path: string;
+    params: Record<string, string>;
+    key: KeyInfo | null;
+    body: unknown;
+}): void;
+/**
+ * One pass of the real worker: link the settled rows, then (when the checkpoint interval passed) verify what was added since
+ * the last checkpoint and sign a new one. Nothing is signed over a chain that does not verify: `audit_chain.tamper_detected`
+ * is raised instead. `settle: false` links every row now (the test helper); the routes call it with the real 60 s delay.
+ */
+export declare function sweepChain(e: Engine, settle?: boolean): Promise<{
+    appended: number;
+    checkpoint: boolean;
+    tampered: boolean;
+    head_seq: number;
+}>;
+export declare function emu4TrustHandlers(): RouteDef[];