@atlasauth/pca-ap2 0.3.0 → 0.4.0

package/dist/chain.js

@@ -0,0 +1,366 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TYP_INTERMEDIATE = exports.TYP_TERMINAL = void 0;
+exports.issueOpenPaymentMandate = issueOpenPaymentMandate;
+exports.issueOpenCheckoutMandate = issueOpenCheckoutMandate;
+exports.presentClosedPayment = presentClosedPayment;
+exports.presentClosedCheckout = presentClosedCheckout;
+exports.splitChain = splitChain;
+exports.verifyKbHop = verifyKbHop;
+exports.verifyDelegationChain = verifyDelegationChain;
+exports.verifyCheckoutChain = verifyCheckoutChain;
+exports.verifyPaymentChain = verifyPaymentChain;
+exports.verifyPurchase = verifyPurchase;
+const sdjwt_1 = require("./sdjwt");
+const mandates_1 = require("./mandates");
+const constraints_1 = require("./constraints");
+const ROOT_TYP = 'dc+sd-jwt';
+function signRoot(c, mandate, b) {
+    const element = b.element(mandate);
+    return (0, sdjwt_1.signSdJwt)({
+        header: { typ: c.typ ?? ROOT_TYP, ...(c.issuer.kid !== undefined ? { kid: c.issuer.kid } : {}), ...(c.issuer.x5c ? { x5c: c.issuer.x5c } : {}) },
+        payload: { delegate_payload: [element], _sd_alg: c.sdAlg ?? 'sha-256' },
+        disclosures: b.disclosures,
+        privateKey: c.issuer.privateKey,
+    });
+}
+function commonClaims(c) {
+    const jwk = (0, sdjwt_1.assertP256Jwk)(c.agentJwk, 'agentJwk');
+    if (!Number.isSafeInteger(c.iat) || !Number.isSafeInteger(c.exp) || c.exp <= c.iat)
+        throw new sdjwt_1.Ap2Error('open mandate: need integer iat < exp (epoch seconds)');
+    return {
+        cnf: { jwk: { crv: 'P-256', kty: 'EC', x: jwk.x, y: jwk.y } },
+        iat: c.iat,
+        exp: c.exp,
+        ...(c.pca ? { [mandates_1.PCA_CLAIM]: c.pca } : {}),
+    };
+}
+/** Wrap the selectively-disclosable arrays of a payment constraint (`allowed` payees / instruments). */
+function sdPaymentConstraint(c, b) {
+    if (c.type === 'payment.allowed_payees' || c.type === 'payment.allowed_payment_instruments') {
+        return { type: c.type, allowed: c.allowed.map((x) => b.element(x)) };
+    }
+    return c;
+}
+function sdCheckoutConstraint(c, b) {
+    if (c.type === 'checkout.allowed_merchants')
+        return { type: c.type, allowed: c.allowed.map((x) => b.element(x)) };
+    return {
+        type: c.type,
+        items: c.items.map((it) => ({ id: it.id, acceptable_items: it.acceptable_items.map((x) => b.element(x)), quantity: it.quantity })),
+    };
+}
+/** Issue an open Payment Mandate (`mandate.payment.open.1`) as a signed SD-JWT. */
+function issueOpenPaymentMandate(input) {
+    const b = (0, sdjwt_1.disclosureBuilder)(input.sdAlg ?? 'sha-256', input.salt);
+    const mandate = {
+        vct: mandates_1.VCT_PAYMENT_OPEN,
+        constraints: input.constraints.map((c) => sdPaymentConstraint(c, b)),
+        ...(input.payee ? { payee: input.payee } : {}),
+        ...(input.paymentAmount ? { payment_amount: input.paymentAmount } : {}),
+        ...(input.paymentInstrument ? { payment_instrument: input.paymentInstrument } : {}),
+        ...(input.pisp ? { pisp: input.pisp } : {}),
+        ...(input.executionDate !== undefined ? { execution_date: input.executionDate } : {}),
+        ...commonClaims(input),
+    };
+    assertWellFormed(mandate, mandates_1.openPaymentMandateProblems, 'open payment mandate', input.constraints);
+    return signRoot(input, mandate, b);
+}
+/** Issue an open Checkout Mandate (`mandate.checkout.open.1`) as a signed SD-JWT. */
+function issueOpenCheckoutMandate(input) {
+    const b = (0, sdjwt_1.disclosureBuilder)(input.sdAlg ?? 'sha-256', input.salt);
+    const mandate = { vct: mandates_1.VCT_CHECKOUT_OPEN, constraints: input.constraints.map((c) => sdCheckoutConstraint(c, b)), ...commonClaims(input) };
+    assertWellFormed(mandate, mandates_1.openCheckoutMandateProblems, 'open checkout mandate', input.constraints);
+    return signRoot(input, mandate, b);
+}
+/** Validate the *plain* claims (before selective-disclosure wrapping) so a bad input fails at issuance. */
+function assertWellFormed(wrapped, problems, what, plainConstraints) {
+    const plain = { ...wrapped, constraints: plainConstraints };
+    const p = problems(plain);
+    if (p.length > 0)
+        throw new sdjwt_1.Ap2Error(`${what}: ${p.join('; ')}`);
+}
+function presentHop(c, build) {
+    if (!c.aud || !c.nonce)
+        throw new sdjwt_1.Ap2Error('closed mandate: aud and nonce are required');
+    if (!Number.isSafeInteger(c.iat))
+        throw new sdjwt_1.Ap2Error('closed mandate: iat must be an integer');
+    const prev = (0, sdjwt_1.parseSdJwtHop)(c.open);
+    const b = (0, sdjwt_1.disclosureBuilder)(prev.sdAlg, c.salt);
+    const mandate = build(b);
+    const element = b.element(mandate);
+    const mode = c.hashMode ?? 'sd_hash';
+    const hop = (0, sdjwt_1.signSdJwt)({
+        header: { typ: 'kb+sd-jwt' },
+        payload: {
+            delegate_payload: [element],
+            iat: c.iat,
+            aud: c.aud,
+            nonce: c.nonce,
+            [mode]: mode === 'sd_hash' ? (0, sdjwt_1.sdHashOf)(prev) : (0, sdjwt_1.issuerJwtHashOf)(prev),
+            _sd_alg: prev.sdAlg,
+        },
+        disclosures: b.disclosures,
+        privateKey: c.agentKey.privateKey,
+    });
+    // Hops are joined by "~~": the preceding token's own trailing "~" plus one separator "~".
+    return `${c.open}~${hop}`;
+}
+/** Present a closed Payment Mandate (`mandate.payment.1`) on top of an open payment mandate. */
+function presentClosedPayment(input) {
+    return presentHop(input, () => {
+        const mandate = {
+            vct: mandates_1.VCT_PAYMENT,
+            transaction_id: input.transactionId,
+            payee: input.payee,
+            payment_amount: input.paymentAmount,
+            payment_instrument: input.paymentInstrument,
+            ...(input.pisp ? { pisp: input.pisp } : {}),
+            ...(input.executionDate !== undefined ? { execution_date: input.executionDate } : {}),
+            ...(input.riskData ? { risk_data: input.riskData } : {}),
+            ...(input.exp !== undefined ? { exp: input.exp } : {}),
+            ...(input.pca ? { [mandates_1.PCA_CLAIM]: input.pca } : {}),
+        };
+        const p = (0, mandates_1.paymentMandateProblems)(mandate);
+        if (p.length > 0)
+            throw new sdjwt_1.Ap2Error(`closed payment mandate: ${p.join('; ')}`);
+        return mandate;
+    });
+}
+/** Present a closed Checkout Mandate (`mandate.checkout.1`) on top of an open checkout mandate. */
+function presentClosedCheckout(input) {
+    return presentHop(input, (b) => {
+        const prevAlg = (0, sdjwt_1.parseSdJwtHop)(input.open).sdAlg;
+        const mandate = {
+            _sd: [b.property('checkout_jwt', input.checkoutJwt)],
+            vct: mandates_1.VCT_CHECKOUT,
+            checkout_hash: (0, sdjwt_1.sdDigest)(input.checkoutJwt, prevAlg),
+            ...(input.exp !== undefined ? { exp: input.exp } : {}),
+            ...(input.pca ? { [mandates_1.PCA_CLAIM]: input.pca } : {}),
+        };
+        const p = (0, mandates_1.checkoutMandateProblems)({ ...mandate, checkout_jwt: input.checkoutJwt });
+        if (p.length > 0)
+            throw new sdjwt_1.Ap2Error(`closed checkout mandate: ${p.join('; ')}`);
+        return mandate;
+    });
+}
+// ---------------------------------------------------------------------------------------------
+// verifying a delegation chain
+// ---------------------------------------------------------------------------------------------
+exports.TYP_TERMINAL = ['kb+sd-jwt', 'kb-sd-jwt'];
+exports.TYP_INTERMEDIATE = ['kb+sd-jwt+kb', 'kb-sd-jwt+kb'];
+const MAX_HOPS = 8;
+/** Split a `~~`-joined chain into hops, each restored to `<jwt>~<d>...~`. */
+function splitChain(token) {
+    if (typeof token !== 'string' || token.length === 0)
+        throw new sdjwt_1.Ap2Error('chain: empty');
+    const parts = token.split('~~');
+    if (parts.length > MAX_HOPS)
+        throw new sdjwt_1.Ap2Error(`chain: more than ${MAX_HOPS} hops`);
+    return parts.map((p, i) => (i === parts.length - 1 ? p : `${p}~`));
+}
+function checkTimes(label, o, now, skew) {
+    const { exp, iat } = o;
+    if (exp !== undefined) {
+        if (!Number.isSafeInteger(exp))
+            throw new sdjwt_1.Ap2Error(`${label}: exp must be an integer`);
+        if (now > exp + skew)
+            throw new sdjwt_1.Ap2Error(`${label}: expired at ${String(exp)}`);
+    }
+    if (iat !== undefined) {
+        if (!Number.isSafeInteger(iat))
+            throw new sdjwt_1.Ap2Error(`${label}: iat must be an integer`);
+        if (iat > now + skew)
+            throw new sdjwt_1.Ap2Error(`${label}: iat is in the future`);
+    }
+}
+function delegateMandate(claims, label) {
+    const dp = claims.delegate_payload;
+    if (!Array.isArray(dp))
+        throw new sdjwt_1.Ap2Error(`${label}: delegate_payload missing`);
+    if (dp.length !== 1 || !(0, sdjwt_1.isObject)(dp[0]))
+        throw new sdjwt_1.Ap2Error(`${label}: delegate_payload must disclose exactly one mandate (got ${dp.length})`);
+    return dp[0];
+}
+function cnfJwk(mandate, label) {
+    const cnf = mandate.cnf;
+    if (!(0, sdjwt_1.isObject)(cnf) || !(0, sdjwt_1.isObject)(cnf.jwk))
+        throw new sdjwt_1.Ap2Error(`${label}: no cnf.jwk to delegate to`);
+    return (0, sdjwt_1.assertP256Jwk)(cnf.jwk, `${label} cnf.jwk`);
+}
+/** Verify one key-binding hop against its predecessor (signature, typ, binding hash, times, aud/nonce). */
+function verifyKbHop(hop, prev, o, label) {
+    const typ = hop.header.typ;
+    const allowed = o.terminal ? exports.TYP_TERMINAL : exports.TYP_INTERMEDIATE;
+    if (typeof typ !== 'string' || !allowed.includes(typ))
+        throw new sdjwt_1.Ap2Error(`${label}: typ must be one of ${allowed.join(', ')}`);
+    if (hop.header.crit !== undefined)
+        throw new sdjwt_1.Ap2Error(`${label}: crit headers are not supported`);
+    const key = cnfJwk(prev.mandate, 'preceding mandate');
+    if (!(0, sdjwt_1.verifyHopSignature)(hop, key))
+        throw new sdjwt_1.Ap2Error(`${label}: signature does not verify under the preceding mandate's cnf.jwk`);
+    const claims = (0, sdjwt_1.processDisclosures)(hop.payload, hop.disclosures, hop.sdAlg);
+    const hasSd = 'sd_hash' in claims;
+    const hasIss = 'issuer_jwt_hash' in claims;
+    if (hasSd === hasIss)
+        throw new sdjwt_1.Ap2Error(`${label}: exactly one of sd_hash / issuer_jwt_hash is required`);
+    const expected = hasSd ? (0, sdjwt_1.sdHashOf)(prev.hop) : (0, sdjwt_1.issuerJwtHashOf)(prev.hop);
+    const actual = hasSd ? claims.sd_hash : claims.issuer_jwt_hash;
+    if (actual !== expected)
+        throw new sdjwt_1.Ap2Error(`${label}: ${hasSd ? 'sd_hash' : 'issuer_jwt_hash'} does not match the preceding hop`);
+    if (claims.iat === undefined)
+        throw new sdjwt_1.Ap2Error(`${label}: iat is required`);
+    checkTimes(label, claims, o.now, o.skew);
+    const mandate = delegateMandate(claims, label);
+    checkTimes(`${label} mandate`, mandate, o.now, o.skew);
+    const hasCnf = (0, sdjwt_1.isObject)(mandate.cnf);
+    if (o.terminal && hasCnf)
+        throw new sdjwt_1.Ap2Error(`${label}: a terminal hop must not carry cnf`);
+    if (!o.terminal && !hasCnf)
+        throw new sdjwt_1.Ap2Error(`${label}: an intermediate hop requires cnf`);
+    if (o.terminal) {
+        if (o.expectedAudience === undefined || claims.aud !== o.expectedAudience)
+            throw new sdjwt_1.Ap2Error(`${label}: aud mismatch`);
+        if (o.expectedNonce === undefined || claims.nonce !== o.expectedNonce)
+            throw new sdjwt_1.Ap2Error(`${label}: nonce mismatch`);
+    }
+    return { index: -1, kind: o.terminal ? 'terminal' : 'intermediate', hop, claims, mandate };
+}
+/** Verify a whole chain: root signature, then every hop in order. Never throws; reports the reason. */
+function verifyDelegationChain(token, o) {
+    try {
+        if (!o.expectedAudience || !o.expectedNonce)
+            throw new sdjwt_1.Ap2Error('verify: expectedAudience and expectedNonce are required');
+        const now = o.now ?? Math.floor(Date.now() / 1000);
+        const skew = o.clockSkewSeconds ?? 60;
+        const segments = splitChain(token).map(sdjwt_1.parseSdJwtHop);
+        const root = segments[0];
+        if (root.header.crit !== undefined)
+            throw new sdjwt_1.Ap2Error('root: crit headers are not supported');
+        const issuerKey = o.resolveIssuerKey(root.header);
+        if (!issuerKey)
+            throw new sdjwt_1.Ap2Error('root: no issuer key for this header');
+        if (!(0, sdjwt_1.verifyHopSignature)(root, issuerKey))
+            throw new sdjwt_1.Ap2Error('root: signature does not verify under the issuer key');
+        const rootClaims = (0, sdjwt_1.processDisclosures)(root.payload, root.disclosures, root.sdAlg);
+        checkTimes('root', rootClaims, now, skew);
+        const rootMandate = delegateMandate(rootClaims, 'root');
+        checkTimes('root mandate', rootMandate, now, skew);
+        const hops = [{ index: 0, kind: 'root', hop: root, claims: rootClaims, mandate: rootMandate }];
+        for (let i = 1; i < segments.length; i++) {
+            const prev = hops[i - 1];
+            const v = verifyKbHop(segments[i], prev, { terminal: i === segments.length - 1, expectedAudience: o.expectedAudience, expectedNonce: o.expectedNonce, now, skew }, `hop ${i}`);
+            hops.push({ ...v, index: i });
+        }
+        return { ok: true, hops };
+    }
+    catch (e) {
+        return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+    }
+}
+// ---------------------------------------------------------------------------------------------
+// typed chains
+// ---------------------------------------------------------------------------------------------
+const pair = (r) => {
+    if (r.hops.length !== 2)
+        throw new sdjwt_1.Ap2Error(`expected an open mandate followed by one closed mandate, got ${r.hops.length} hop(s)`);
+    return [r.hops[0], r.hops[1]];
+};
+function requireOpenExpiry(m, label) {
+    if (!Number.isSafeInteger(m.exp))
+        throw new sdjwt_1.Ap2Error(`${label}: an open mandate must carry exp`);
+}
+/** Verify an open+closed checkout chain, the merchant-signed checkout, its hash, and the open constraints. */
+function verifyCheckoutChain(token, o) {
+    const r = verifyDelegationChain(token, o);
+    if (!r.ok)
+        return r;
+    try {
+        const [openHop, closedHop] = pair(r);
+        const open = openHop.mandate;
+        const closed = closedHop.mandate;
+        const op = (0, mandates_1.openCheckoutMandateProblems)(open);
+        if (op.length)
+            throw new sdjwt_1.Ap2Error(`open checkout mandate: ${op.join('; ')}`);
+        requireOpenExpiry(open, 'open checkout mandate');
+        const cp = (0, mandates_1.checkoutMandateProblems)(closed);
+        if (cp.length)
+            throw new sdjwt_1.Ap2Error(`closed checkout mandate: ${cp.join('; ')}`);
+        const alg = closedHop.hop.sdAlg;
+        if ((0, sdjwt_1.sdDigest)(closed.checkout_jwt, alg) !== closed.checkout_hash)
+            throw new sdjwt_1.Ap2Error('checkout_hash does not match checkout_jwt');
+        const jwt = (0, sdjwt_1.parseJwt)(closed.checkout_jwt, 'checkout_jwt');
+        const key = o.resolveMerchantKey(jwt.header);
+        if (!key)
+            throw new sdjwt_1.Ap2Error('checkout_jwt: no merchant key for this header');
+        if (!(0, sdjwt_1.verifyJwtEs256)(jwt, key))
+            throw new sdjwt_1.Ap2Error('checkout_jwt: merchant signature does not verify');
+        const checkout = (0, constraints_1.projectCheckout)(jwt.payload);
+        const violations = (0, constraints_1.checkCheckoutConstraints)(open, checkout);
+        if (violations.length)
+            return { ok: false, reason: `open checkout constraints violated: ${violations.join('; ')}`, violations };
+        return { ok: true, open, closed, checkoutJwt: closed.checkout_jwt, checkout, openHash: (0, sdjwt_1.sdHashOf)(openHop.hop), hops: r.hops };
+    }
+    catch (e) {
+        return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+    }
+}
+/** Verify an open+closed payment chain and every open payment constraint. */
+function verifyPaymentChain(token, o) {
+    const r = verifyDelegationChain(token, o);
+    if (!r.ok)
+        return r;
+    try {
+        const [openHop, closedHop] = pair(r);
+        const open = openHop.mandate;
+        const closed = closedHop.mandate;
+        const op = (0, mandates_1.openPaymentMandateProblems)(open);
+        if (op.length)
+            throw new sdjwt_1.Ap2Error(`open payment mandate: ${op.join('; ')}`);
+        requireOpenExpiry(open, 'open payment mandate');
+        const cp = (0, mandates_1.paymentMandateProblems)(closed);
+        if (cp.length)
+            throw new sdjwt_1.Ap2Error(`closed payment mandate: ${cp.join('; ')}`);
+        if (o.expectedTransactionId !== undefined && closed.transaction_id !== o.expectedTransactionId)
+            throw new sdjwt_1.Ap2Error('transaction_id does not match the checkout being settled');
+        const violations = (0, constraints_1.checkPaymentConstraints)(open, closed, { openCheckoutHash: o.openCheckoutHash, ...(o.context ? { context: o.context } : {}), now: o.now ?? Math.floor(Date.now() / 1000) });
+        if (violations.length)
+            return { ok: false, reason: `open payment constraints violated: ${violations.join('; ')}`, violations };
+        return { ok: true, open, closed, openHash: (0, sdjwt_1.sdHashOf)(openHop.hop), hops: r.hops };
+    }
+    catch (e) {
+        return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+    }
+}
+/**
+ * Verify a complete purchase: the checkout chain, then the payment chain bound to it (the payment's
+ * `payment.reference` is the open checkout hash; its `transaction_id` is the closed checkout's
+ * `checkout_hash`), and that the payment settles what the merchant quoted (payee, currency, total).
+ */
+function verifyPurchase(checkoutToken, paymentToken, o) {
+    const base = {
+        resolveIssuerKey: o.resolveIssuerKey,
+        ...(o.now !== undefined ? { now: o.now } : {}),
+        ...(o.clockSkewSeconds !== undefined ? { clockSkewSeconds: o.clockSkewSeconds } : {}),
+    };
+    const co = verifyCheckoutChain(checkoutToken, { ...base, ...o.checkout, resolveMerchantKey: o.resolveMerchantKey });
+    if (!co.ok)
+        return { ok: false, reason: `checkout: ${co.reason}` };
+    const pay = verifyPaymentChain(paymentToken, { ...base, ...o.payment, openCheckoutHash: co.openHash, expectedTransactionId: co.closed.checkout_hash, ...(o.context ? { context: o.context } : {}) });
+    if (!pay.ok)
+        return { ok: false, reason: `payment: ${pay.reason}` };
+    const total = (0, constraints_1.checkoutTotal)(co.checkout);
+    if (total === undefined)
+        return { ok: false, reason: 'checkout: needs exactly one total entry' };
+    const amt = pay.closed.payment_amount;
+    if (amt.currency !== co.checkout.currency)
+        return { ok: false, reason: 'payment currency differs from the checkout currency' };
+    if (amt.amount !== total)
+        return { ok: false, reason: `payment amount ${amt.amount} differs from the checkout total ${total}` };
+    if (!co.checkout.merchant)
+        return { ok: false, reason: 'checkout: no merchant to compare the payee with' };
+    if (co.checkout.merchant.id !== pay.closed.payee.id)
+        return { ok: false, reason: 'payee differs from the checkout merchant' };
+    return { ok: true, checkout: co, payment: pay };
+}
+//# sourceMappingURL=chain.js.map

package/dist/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":";;;AA6IA,0DAcC;AAOD,4DAKC;AAqED,oDAkBC;AAQD,sDAcC;AAoCD,gCAKC;AA4BD,kCA+BC;AAGD,sDAyBC;AAkCD,kDAyBC;AAgBD,gDAmBC;AAqBD,wCAkBC;AA9gBD,mCAqBiB;AACjB,yCAmBoB;AACpB,+CAOuB;AAgCvB,MAAM,QAAQ,GAAG,WAAW,CAAC;AAE7B,SAAS,QAAQ,CAAC,CAAoB,EAAE,OAAmB,EAAE,CAAoB;IAC/E,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,IAAA,iBAAS,EAAC;QACf,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAChJ,OAAO,EAAE,EAAE,gBAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS,EAAE;QACvE,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU;KAChC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,CAAoB;IACxC,MAAM,GAAG,GAAG,IAAA,qBAAa,EAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG;QAAE,MAAM,IAAI,gBAAQ,CAAC,sDAAsD,CAAC,CAAC;IAC/J,OAAO;QACL,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE;QAC7D,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAS,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,mBAAmB,CAAC,CAAoB,EAAE,CAAoB;IACrE,IAAI,CAAC,CAAC,IAAI,KAAK,wBAAwB,IAAI,CAAC,CAAC,IAAI,KAAK,qCAAqC,EAAE,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAG,CAAC,CAAC,OAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,CAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAqB,EAAE,CAAoB;IACvE,IAAI,CAAC,CAAC,IAAI,KAAK,4BAA4B;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAG,CAAC,CAAC,OAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzI,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,gBAAgB,EAAG,EAAE,CAAC,gBAAsC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;KAC1J,CAAC;AACJ,CAAC;AAWD,mFAAmF;AACnF,SAAgB,uBAAuB,CAAC,KAA8B;IACpE,MAAM,CAAC,GAAG,IAAA,yBAAiB,EAAC,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,OAAO,GAAe;QAC1B,GAAG,EAAE,2BAAgB;QACrB,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,iBAAoC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,YAAY,CAAC,KAAK,CAAC;KACvB,CAAC;IACF,gBAAgB,CAAC,OAAO,EAAE,qCAA0B,EAAE,sBAAsB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACjG,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC;AAMD,qFAAqF;AACrF,SAAgB,wBAAwB,CAAC,KAA+B;IACtE,MAAM,CAAC,GAAG,IAAA,yBAAiB,EAAC,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,OAAO,GAAe,EAAE,GAAG,EAAE,4BAAiB,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACtJ,gBAAgB,CAAC,OAAO,EAAE,sCAA2B,EAAE,uBAAuB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACnG,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,2GAA2G;AAC3G,SAAS,gBAAgB,CAAC,OAAmB,EAAE,QAAkC,EAAE,IAAY,EAAE,gBAA2B;IAC1H,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC5D,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAyBD,SAAS,UAAU,CAAC,CAAkB,EAAE,KAA2C;IACjF,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAQ,CAAC,4CAA4C,CAAC,CAAC;IACzF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAQ,CAAC,wCAAwC,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,IAAA,qBAAa,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC;IACrC,MAAM,GAAG,GAAG,IAAA,iBAAS,EAAC;QACpB,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;QAC5B,OAAO,EAAE;YACP,gBAAgB,EAAE,CAAC,OAAO,CAAC;YAC3B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,uBAAe,EAAC,IAAI,CAAC;YACnE,OAAO,EAAE,IAAI,CAAC,KAAK;SACpB;QACD,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU;KAClC,CAAC,CAAC;IACH,0FAA0F;IAC1F,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;AAC5B,CAAC;AAaD,gGAAgG;AAChG,SAAgB,oBAAoB,CAAC,KAAyB;IAC5D,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE;QAC5B,MAAM,OAAO,GAAe;YAC1B,GAAG,EAAE,sBAAW;YAChB,cAAc,EAAE,KAAK,CAAC,aAAa;YACnC,KAAK,EAAE,KAAK,CAAC,KAAwB;YACrC,cAAc,EAAE,KAAK,CAAC,aAAa;YACnC,kBAAkB,EAAE,KAAK,CAAC,iBAAoC;YAC9D,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAS,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC;QACF,MAAM,CAAC,GAAG,IAAA,iCAAsB,EAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAQ,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChF,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,mGAAmG;AACnG,SAAgB,qBAAqB,CAAC,KAA0B;IAC9D,OAAO,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,IAAA,qBAAa,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;QAChD,MAAM,OAAO,GAAe;YAC1B,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YACpD,GAAG,EAAE,uBAAY;YACjB,aAAa,EAAE,IAAA,gBAAQ,EAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;YACnD,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAS,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC;QACF,MAAM,CAAC,GAAG,IAAA,kCAAuB,EAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAQ,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,+BAA+B;AAC/B,gGAAgG;AAEnF,QAAA,YAAY,GAAsB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAC7D,QAAA,gBAAgB,GAAsB,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,QAAQ,GAAG,CAAC,CAAC;AA2BnB,6EAA6E;AAC7E,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAQ,CAAC,cAAc,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ;QAAE,MAAM,IAAI,gBAAQ,CAAC,oBAAoB,QAAQ,OAAO,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,CAAa,EAAE,GAAW,EAAE,IAAY;IACzE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;QACvF,IAAI,GAAG,GAAI,GAAc,GAAG,IAAI;YAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,gBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;QACvF,IAAK,GAAc,GAAG,GAAG,GAAG,IAAI;YAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAkB,EAAE,KAAa;IACxD,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACjF,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAA,gBAAQ,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,6DAA6D,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/I,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,OAAmB,EAAE,KAAa;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,CAAC,IAAA,gBAAQ,EAAC,GAAG,CAAC,IAAI,CAAC,IAAA,gBAAQ,EAAC,GAAG,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACpG,OAAO,IAAA,qBAAa,EAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;AACpD,CAAC;AAED,2GAA2G;AAC3G,SAAgB,WAAW,CACzB,GAAa,EACb,IAA4C,EAC5C,CAAsG,EACtG,KAAa;IAEb,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;IAC3B,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAY,CAAC,CAAC,CAAC,wBAAgB,CAAC;IAC7D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACtD,IAAI,CAAC,IAAA,0BAAkB,EAAC,GAAG,EAAE,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,mEAAmE,CAAC,CAAC;IACnI,MAAM,MAAM,GAAG,IAAA,0BAAkB,EAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,SAAS,IAAI,MAAM,CAAC;IAClC,MAAM,MAAM,GAAG,iBAAiB,IAAI,MAAM,CAAC;IAC3C,IAAI,KAAK,KAAK,MAAM;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,wDAAwD,CAAC,CAAC;IAC3G,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,gBAAQ,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,uBAAe,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IAC/D,IAAI,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,mCAAmC,CAAC,CAAC;IACnI,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,UAAU,CAAC,GAAG,KAAK,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAA,gBAAQ,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IAC5F,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAC7F,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,gBAAgB;YAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC;QACxH,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,aAAa;YAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,uGAAuG;AACvG,SAAgB,qBAAqB,CAAC,KAAa,EAAE,CAAqB;IACxE,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,aAAa;YAAE,MAAM,IAAI,gBAAQ,CAAC,yDAAyD,CAAC,CAAC;QAC3H,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,qBAAa,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAa,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAQ,CAAC,sCAAsC,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,gBAAQ,CAAC,qCAAqC,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAA,0BAAkB,EAAC,IAAI,EAAE,SAAS,CAAC;YAAE,MAAM,IAAI,gBAAQ,CAAC,sDAAsD,CAAC,CAAC;QACrH,MAAM,UAAU,GAAG,IAAA,0BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACxD,UAAU,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,GAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9G,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAgB,CAAC;YACxC,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAa,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3L,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,eAAe;AACf,gGAAgG;AAEhG,MAAM,IAAI,GAAG,CAAC,CAAqC,EAA8B,EAAE;IACjF,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAQ,CAAC,gEAAgE,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC;IACpI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAgB,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,SAAS,iBAAiB,CAAC,CAAa,EAAE,KAAa;IACrD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAQ,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;AACnG,CAAC;AAoBD,8GAA8G;AAC9G,SAAgB,mBAAmB,CAAC,KAAa,EAAE,CAAwB;IACzE,MAAM,CAAC,GAAG,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,OAA+C,CAAC;QACrE,MAAM,MAAM,GAAG,SAAS,CAAC,OAA2C,CAAC;QACrE,MAAM,EAAE,GAAG,IAAA,sCAA2B,EAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAQ,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7E,iBAAiB,CAAC,IAA6B,EAAE,uBAAuB,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAQ,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;QAChC,IAAI,IAAA,gBAAQ,EAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC,aAAa;YAAE,MAAM,IAAI,gBAAQ,CAAC,2CAA2C,CAAC,CAAC;QACjI,MAAM,GAAG,GAAG,IAAA,gBAAQ,EAAC,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAQ,CAAC,+CAA+C,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAA,sBAAc,EAAC,GAAG,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAQ,CAAC,kDAAkD,CAAC,CAAC;QACtG,MAAM,QAAQ,GAAG,IAAA,6BAAe,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAA,sCAAwB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,UAAU,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;QAChI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAA,gBAAQ,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/H,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAeD,6EAA6E;AAC7E,SAAgB,kBAAkB,CAAC,KAAa,EAAE,CAAuB;IACvE,MAAM,CAAC,GAAG,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,OAA8C,CAAC;QACpE,MAAM,MAAM,GAAG,SAAS,CAAC,OAA0C,CAAC;QACpE,MAAM,EAAE,GAAG,IAAA,qCAA0B,EAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,iBAAiB,CAAC,IAA6B,EAAE,sBAAsB,CAAC,CAAC;QACzE,MAAM,EAAE,GAAG,IAAA,iCAAsB,EAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,EAAE,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAQ,CAAC,2BAA2B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,qBAAqB,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,KAAK,CAAC,CAAC,qBAAqB;YAAE,MAAM,IAAI,gBAAQ,CAAC,0DAA0D,CAAC,CAAC;QAC/K,MAAM,UAAU,GAAG,IAAA,qCAAuB,EAAC,IAAI,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9L,IAAI,UAAU,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;QAC/H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAA,gBAAQ,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAgBD;;;;GAIG;AACH,SAAgB,cAAc,CAAC,aAAqB,EAAE,YAAoB,EAAE,CAAwB;IAClG,MAAM,IAAI,GAAG;QACX,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC;IACF,MAAM,EAAE,GAAG,mBAAmB,CAAC,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpH,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,QAAQ,EAAE,qBAAqB,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrM,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,IAAA,2BAAa,EAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IACjG,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;IACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IAC/H,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,GAAG,CAAC,MAAM,oCAAoC,KAAK,EAAE,EAAE,CAAC;IAChI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC3G,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC9H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC"}

package/dist/constraints.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Evaluation of AP2 open-mandate constraints against a closed mandate / checkout.
+ *
+ * This follows the AP2 documentation's evaluation rules and cross-checks against the official Python
+ * SDK (`ap2.sdk.constraints`). It is deliberately *stricter* than that SDK in four places, each a
+ * fail-closed choice (and each covered by a test):
+ *   - a line-item requirement whose `acceptable_items` is empty (for instance because the holder
+ *     withheld every disclosure) matches nothing, where the SDK treats it as a wildcard;
+ *   - the documentation requires the maximal flow to equal both the required and the carted
+ *     quantity; the SDK only rejects surplus items, never a cart with too few;
+ *   - a closed payment without `execution_date` is "immediate", i.e. evaluated at the verification
+ *     time, so a not-yet-open execution window refuses it (the SDK returns no violation);
+ *   - `execution_date` bounds are compared as instants, not as strings.
+ */
+import type { Merchant, OpenCheckoutMandateClaims, OpenPaymentMandateClaims, PaymentMandateClaims } from './mandates';
+import { type JsonObject } from './sdjwt';
+/** Usage state a verifier tracks for an open mandate (budget and recurrence need it). */
+export interface MandateContext {
+    /** Sum of the minor-unit amounts of previously closed payments under this open mandate. */
+    totalAmount: number;
+    /** Number of previous closed payments under this open mandate. */
+    totalUses: number;
+    /** Epoch seconds of the most recent previous use, if any. */
+    lastUsedDate?: number;
+}
+export declare function merchantMatches(candidate: Merchant, target: Merchant): boolean;
+export interface PaymentCheckOptions {
+    /** `sd_hash` of the open checkout mandate this payment is chained to (for `payment.reference`). */
+    openCheckoutHash?: string;
+    /** Usage state; required to evaluate `payment.budget` and recurrence limits / frequency. */
+    context?: MandateContext;
+    /** Verification time, epoch seconds. */
+    now: number;
+}
+/** Violations of the open payment mandate's constraints and pre-set claims by `closed` (empty = satisfied). */
+export declare function checkPaymentConstraints(open: OpenPaymentMandateClaims, closed: PaymentMandateClaims, o: PaymentCheckOptions): string[];
+/** The slice of the UCP Checkout object (`checkout_jwt` payload) the constraints read. */
+export interface UcpCheckout {
+    id: string;
+    merchant?: Merchant;
+    currency: string;
+    line_items: {
+        id: string;
+        item: {
+            id: string;
+            title: string;
+            price: number;
+        };
+        quantity: number;
+    }[];
+    totals: {
+        type: string;
+        amount: number;
+    }[];
+}
+/** Validate and project the checkout payload; throws a descriptive message when malformed. */
+export declare function projectCheckout(payload: JsonObject): UcpCheckout;
+/** The checkout's single `total` entry in minor units, or undefined if absent / ambiguous. */
+export declare function checkoutTotal(c: UcpCheckout): number | undefined;
+/** Violations of the open checkout mandate's constraints by `checkout` (empty = satisfied). */
+export declare function checkCheckoutConstraints(open: OpenCheckoutMandateClaims, checkout: UcpCheckout): string[];