@atrib/verify 0.5.2 → 0.7.0

package/README.md

@@ -82,6 +82,8 @@ const result = await verifyRecord(record, {
   upstreamCandidate, // optional, for provenance_token resolution
   informedByCandidates: [], // optional, for informed_by[] resolution
   identityClaim, // optional, for capability_check (caller does directory lookup)
+  resolvedFacts, // optional, caller-resolved facts for capability_check
+  authorizationEvidence, // optional, OAuth/MCP auth evidence blocks
   ap2ViEvidence, // optional, transaction-only AP2 / VI evidence bundle
   ap2ViEvidenceOptions, // optional, passed to verifyAp2ViEvidenceAsync()
 })
@@ -92,6 +94,7 @@ const result = await verifyRecord(record, {
 //   provenance?:              { token, upstream_record_hash, upstream_resolved }
 //   informed_by_resolution?:  { resolved: string[], dangling: string[] }
 //   capability_check?:        { envelope, in_envelope, mismatches, unresolvable }
+//   evidence?:                EvidenceVerificationBlock[]
 //   ap2_vi_evidence?:         Ap2ViEvidenceVerification
 //   warnings: string[]
 // }
@@ -102,8 +105,9 @@ const result = await verifyRecord(record, {
 - `provenance`: `{ token, upstream_record_hash, upstream_resolved }` per session-genesis record carrying `provenance_token` ([D044](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d044-provenance_token-field-for-cross-session-causal-anchoring) / [§1.2.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#126-provenance_token)). The 16-byte token truncation is irreversible: `upstream_record_hash` populates only when the caller supplies a candidate whose canonical-form SHA-256[:16] matches the token.
 - `informed_by_resolution`: `{ resolved: string[], dangling: string[] }` per record carrying `informed_by` ([D041](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d041-informed_by-linking-primitive-and-informed_by-edge-type) / [§1.2.5](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#125-informed_by)). Dangling references are flagged but do not fail verification: they signal "the verifier has not seen upstream context," not "the record is invalid."
 - `posture`: `{ timestamp_granularity, timestamp_consistent, timestamp_granularity_explicit, args_commitment_form, result_commitment_form, tool_name_form }` ([D045](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d045-privacy-postures-normative-spec-section) / [D061](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d061-add-tool_name-args_hash-result_hash-fields-to-§121) / [§8.2](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#82-opaque-name-posture) / [§8.3](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#83-salted-commitment-posture) / [§8.4](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#84-coarsened-timing-posture)). Always populated. Surfaces (a) the declared timing granularity, whether the timestamp value structurally matches the spec's trailing-zero invariant, and whether the field was explicitly set vs defaulted; (b) the structurally-detected `args_hash` / `result_hash` commitment scheme: `'salted-sha256'` when `args_salt` / `result_salt` is present, `'plain-sha256'` otherwise (the `'hmac-sha256'` variant from [§8.3](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#83-salted-commitment-posture) is signaled out-of-band and is not structurally detectable); and (c) the [§8.2](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#82-opaque-name-posture) `tool_name_form`: `'hashed'` when `tool_name` matches `^sha256:[0-9a-f]{64}$`, `'plain'` for any other present value, `null` when the field is absent. Per [D061](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d061-add-tool_name-args_hash-result_hash-fields-to-121) the [§8.2](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#82-opaque-name-posture) verbatim-vs-opaque distinction is NOT structurally detectable, both surface as `'plain'`.
-- `capability_check`: `{ envelope, in_envelope, mismatches, unresolvable }` ([D051](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d051-capability-scoped-records-via-directory-published-envelopes) / [§6.7](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#67-capability-declarations)). Populated only when the caller passes a resolved `identityClaim` in options. Checks the record's `event_type` against the envelope's `event_types` allowlist and the record's `timestamp` against `expires_at`. `tool_names` (against tool_call records), `max_amount`, and `counterparties` (against transaction records) flag `unresolvable: true` because the constraints depend on data not yet on the standard record shape (`tool_name`) or out-of-band protocol events (payment amount + counterparty). Per [§6.7.3](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#673-out-of-envelope-records) out-of-envelope is a signal, not invalidation: mismatches do not flip `valid` to false. The caller is responsible for fetching the active envelope at the record's timestamp via `@atrib/directory`'s `lookup()` (or a cached equivalent); `@atrib/verify` intentionally has no `@atrib/directory` dependency.
+- `capability_check`: `{ envelope, in_envelope, mismatches, unresolvable }` ([D051](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d051-capability-scoped-records-via-directory-published-envelopes) / [§6.7](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#67-capability-declarations)). Populated only when the caller passes a resolved `identityClaim` in options. Checks the record's `event_type` against the envelope's `event_types` allowlist and the record's `timestamp` against `expires_at`. `tool_names`, `max_amount`, and `counterparties` are checked when the caller supplies `resolvedFacts` from the local body or protocol event. Missing facts flag `unresolvable: true` rather than passing silently. Per [§6.7.3](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#673-out-of-envelope-records) out-of-envelope is a signal, not invalidation: mismatches do not flip `valid` to false. The caller is responsible for fetching the active envelope at the record's timestamp via `@atrib/directory`'s `lookup()` (or a cached equivalent); `@atrib/verify` intentionally has no `@atrib/directory` dependency.
 - `cross_attestation`: `{ signers_count, signers_valid, missing }` ([D052](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d052-cross-attestation-requirement-for-transaction-records) / [§1.7.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#176-cross-attestation-requirement-for-transaction-records)). Populated only on transaction records (`event_type = transaction`). Each entry in `signers[]` is verified against the cross-attestation canonical bytes (JCS form with `signers: []` and the top-level `signature` field omitted, per [§1.7.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#176-cross-attestation-requirement-for-transaction-records)). `signatureOk` requires a valid signer entry whose `creator_key` matches the record's top-level `creator_key`; unrelated counterparty signers do not validate the record on behalf of its creator. `missing: true` when fewer than 2 distinct signer keys verify, atrib's normative minimum. Duplicate entries from one key do not inflate `signers_valid`. Per [§1.7.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#176-cross-attestation-requirement-for-transaction-records) missing is a signal, not invalidation: `valid` stays true if the underlying signature path holds. Agent-side Path 2 fallback records usually surface as `signers_count: 1, missing: true` until a counterparty signs the same bytes. Legacy single-signer transaction records (no `signers[]` array, only top-level `signature`) surface as `signers_count: 0, missing: true` so consumers can flag them while accepting the cryptographic validity.
+- `evidence`: generic tiered external authorization evidence blocks ([D109](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d109-mcpoauth-authorization-evidence-uses-generic-tiered-evidence-blocks) / [§5.5.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#556-generic-authorization-evidence-blocks)). Populated when the caller passes `authorizationEvidence` or when AP2 / VI evidence is mirrored into the generic shape. Each block has `{ valid, protocol, issuer, subject, scope, attenuation_ok, delegation_ok, constraints, errors, warnings }`. These blocks do not alter `valid`, `signatureOk`, or `capability_check`.
 - `ap2_vi_evidence`: the async AP2 / VI verifier result ([D094](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d094-ap2--vi-evidence-attaches-to-verifier-results-as-a-tiered-block) / [§5.5.4](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#554-ap2--verifiable-intent-evidence-checks)). Populated only when the caller passes `ap2ViEvidence` for a transaction record. It does not alter `valid`, `signatureOk`, or `cross_attestation`; consumers inspect `ap2_vi_evidence.valid` for AP2 authorization evidence.
 
 **Pending per-record annotations** (tracked as a Pending decision in [DECISIONS.md P005](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#p005-reconcile-atribverify-readme-per-record-annotations-with-actual-code-surface)):
@@ -162,6 +166,99 @@ Checks performed:
 
 The library helper backs the `@atrib/verify-mcp` `atrib-verify` primitive promoted by [D106](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d106-verify-is-promoted-to-cognitive-primitive-7). The MCP wrapper handles agent-facing use; this package remains the verifier library.
 
+### `verifyOAuthAuthorizationEvidence(evidence): Promise<OAuthAuthorizationEvidenceVerification>`
+
+Verifier-side OAuth / MCP authorization evidence checking. This runs outside the record signature path and does not fetch tokens, mint credentials, call token-introspection endpoints, or contact authorization servers. Callers supply a compact access-token JWT plus trusted JWKS, caller-verified claims, or a caller-supplied OAuth token-introspection response from a path they control. Hosts that want a library helper for the live step can call `introspectOAuthToken()` first, then pass its result into `verifyRecord()`.
+
+```typescript
+import { verifyRecord } from '@atrib/verify'
+
+const result = await verifyRecord(record, {
+  authorizationEvidence: [
+    {
+      protocol: 'mcp_oauth',
+      accessTokenJwt,
+      jwks: [issuerJwk],
+      issuer: 'https://auth.example',
+      audience: 'https://mcp.example/mcp',
+      protectedResourceMetadata: {
+        resource: 'https://mcp.example/mcp',
+        authorization_servers: ['https://auth.example'],
+      },
+      requiredScopes: ['files:read'],
+      expectedClientId: 'https://client.example/client.json',
+    },
+  ],
+})
+```
+
+For opaque access tokens, keep live network policy at the host boundary:
+
+```typescript
+import {
+  introspectOAuthToken,
+  oauthEvidenceFromIntrospectionResult,
+  verifyRecord,
+} from '@atrib/verify'
+
+const introspection = await introspectOAuthToken({
+  endpoint: 'https://auth.example/oauth/introspect',
+  token: opaqueAccessToken,
+  clientAuthentication: {
+    method: 'basic',
+    clientId: process.env.OAUTH_CLIENT_ID ?? '',
+    clientSecret: process.env.OAUTH_CLIENT_SECRET ?? '',
+  },
+  expectedIssuer: 'https://auth.example',
+  expectedAudience: 'https://mcp.example/mcp',
+})
+
+const result = await verifyRecord(record, {
+  authorizationEvidence: [
+    oauthEvidenceFromIntrospectionResult(introspection, {
+      protocol: 'mcp_oauth',
+      requiredScopes: ['files:read'],
+    }),
+  ],
+})
+```
+
+Checks performed when evidence is present:
+
+- JWT signature, `iss`, `aud`, `exp`, `nbf`, and clock-skew checks when `accessTokenJwt` and `jwks` are supplied.
+- MCP protected-resource binding through `aud`, token `resource`, and protected-resource metadata.
+- Required OAuth scopes from `scope` or `scp`.
+- Optional RFC 9396-style `authorization_details` constraints by `type`, `actions`, and `locations`.
+- Optional `client_id`, subject, actor subject, and `cnf.jkt` checks.
+- Optional DPoP proof checks for `htm`, `htu`, `ath`, `jti`, `iat`, nonce when supplied, and `cnf.jkt` binding.
+
+The default signature policy is `require`. Missing trusted keys or unverified decoded claims make the evidence block invalid. Use `signaturePolicy: "best-effort"` only for advisory triage. DPoP replay state stays caller-owned: pass `seenJtis` for one-process checks, `MemoryDpopReplayCache` for one-process services, or `createFetchDpopReplayCache()` when a deployment exposes a shared atomic replay-cache endpoint.
+
+```typescript
+import { createFetchDpopReplayCache, verifyRecord } from '@atrib/verify'
+
+const dpopReplayCache = createFetchDpopReplayCache({
+  endpoint: 'https://replay-cache.example.com/v1/dpop/check',
+  headers: { Authorization: `Bearer ${process.env.REPLAY_CACHE_TOKEN}` },
+})
+
+const result = await verifyRecord(record, {
+  authorizationEvidence: [
+    {
+      protocol: 'mcp_oauth',
+      claims,
+      claimsVerified: true,
+      dpopProof,
+      dpopReplayCache,
+    },
+  ],
+})
+```
+
+The shared endpoint must atomically remember the posted key until `expires_at_seconds` and return `{ "accepted": true }` for a new proof or `{ "accepted": false }` for replay. The storage backend can be Redis, Durable Objects, Postgres, or another compare-and-set primitive owned by the host.
+
+Producer-side MCP capture lives in `@atrib/mcp` behind the opt-in `authorizationEvidence` option. The producer writes evidence into the local-only sidecar without storing raw bearer tokens by default. Verifiers can pass that sidecar's `authorizationEvidence` and `resolvedFacts` to `verifyRecord()`.
+
 ### `verifyAp2ViEvidence(...)` and `verifyAp2ViEvidenceAsync(...)`
 
 AP2 / Verifiable Intent evidence checking for merchants and auditors. This runs outside the transaction detector path. It does not alter the graph, the settlement calculation, or record validity. It answers a narrower question: did the AP2 receipts and VI mandate chain form a coherent evidence bundle?
@@ -253,6 +350,12 @@ For advanced use (custom calculators, alternative signing flows), the package al
 - `evaluateAp2ViConstraints(input, disclosures?)`: decoded AP2 open-mandate constraint checking
 - `verifyAp2ViEvidence(bundle, options?)`: decoded AP2 / VI receipt and mandate-chain evidence checking
 - `verifyAp2ViEvidenceAsync(bundle, options?)`: compact AP2 receipt JWT verification, async VI SD-JWT / VC conformance, plus decoded evidence checks. `verifyRecord()` and `AtribVerifier.verify()` call this when supplied with `ap2ViEvidence`
+- `verifyAuthorizationEvidence(evidence)`: generic external authorization evidence dispatch for `verifyRecord()` evidence blocks
+- `verifyOAuthAuthorizationEvidence(evidence)`: OAuth / MCP authorization evidence checks for access-token JWTs or caller-verified claims
+- `introspectOAuthToken(options)`: host-owned OAuth token introspection helper for opaque-token evidence
+- `oauthEvidenceFromIntrospectionResult(result, base?)`: adapter from host-owned introspection result to OAuth evidence input
+- `createFetchDpopReplayCache(options)`: HTTP-backed DPoP replay-cache adapter for fleet-shared replay checks
+- `MemoryDpopReplayCache`: in-process implementation of the `DpopReplayCache` contract for tests and single-worker deployments
 - `verifyHandoffClaims(claims, options?)`: Pattern 3 handoff claim acceptance before a receiving agent signs an `informed_by` follow-up
 - `recommendationSigningInput(doc)`: the canonical bytes that get signed
 - `distributionsMatch(a, b)`: float-tolerant equality (within `1e-9` per recipient)

package/dist/authorization-evidence.d.ts

@@ -0,0 +1,155 @@
+import type { JWK, JSONWebKeySet, JWTPayload } from 'jose';
+import type { DpopReplayCache } from './dpop-replay-cache.js';
+export type EvidenceCheckStatus = 'passed' | 'failed' | 'unresolved' | 'not_checked';
+export type OAuthSignaturePolicy = 'require' | 'best-effort' | 'off';
+export type OAuthEvidenceProtocol = 'oauth2' | 'mcp_oauth';
+export interface EvidenceConstraintCheck {
+    type: string;
+    status: EvidenceCheckStatus;
+    expected?: unknown;
+    actual?: unknown;
+    reason?: string;
+}
+export interface EvidenceVerificationBlock<TDetails = unknown> {
+    protocol: string;
+    valid: boolean;
+    issuer: string | null;
+    subject: string | null;
+    scope: string[];
+    attenuation_ok: boolean | null;
+    delegation_ok: boolean | null;
+    constraints: EvidenceConstraintCheck[];
+    errors: string[];
+    warnings: string[];
+    details?: TDetails;
+}
+export interface OAuthAuthorizationDetailConstraint {
+    type: string;
+    actions?: string[];
+    locations?: string[];
+}
+export interface OAuthProtectedResourceMetadata {
+    resource?: string;
+    authorization_servers?: string[];
+    scopes_supported?: string[];
+}
+export interface OAuthAccessTokenClaims extends JWTPayload {
+    client_id?: string;
+    scope?: string;
+    scp?: string | string[];
+    resource?: string | string[];
+    authorization_details?: unknown;
+    cnf?: {
+        jkt?: string;
+        jwk?: JWK;
+        [key: string]: unknown;
+    };
+    act?: {
+        sub?: string;
+        [key: string]: unknown;
+    };
+    may_act?: {
+        sub?: string;
+        [key: string]: unknown;
+    };
+}
+export interface OAuthTokenIntrospectionResponse {
+    active: boolean;
+    scope?: string;
+    client_id?: string;
+    username?: string;
+    token_type?: string;
+    exp?: number;
+    iat?: number;
+    nbf?: number;
+    sub?: string;
+    aud?: string | string[];
+    iss?: string;
+    jti?: string;
+    resource?: string | string[];
+    authorization_details?: unknown;
+    cnf?: {
+        jkt?: string;
+        jwk?: JWK;
+        [key: string]: unknown;
+    };
+    act?: {
+        sub?: string;
+        [key: string]: unknown;
+    };
+    may_act?: {
+        sub?: string;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface OAuthDpopProofInput {
+    proofJwt: string;
+    method: string;
+    url: string;
+    accessToken?: string;
+    expectedAth?: string;
+    expectedNonce?: string;
+    seenJtis?: string[];
+    maxAgeSeconds?: number;
+    nowSeconds?: number;
+    clockSkewSeconds?: number;
+}
+export interface OAuthAuthorizationEvidenceInput {
+    protocol?: OAuthEvidenceProtocol;
+    accessTokenJwt?: string;
+    claims?: OAuthAccessTokenClaims;
+    claimsVerified?: boolean;
+    introspection?: OAuthTokenIntrospectionResponse;
+    introspectionVerified?: boolean;
+    dpopProof?: OAuthDpopProofInput;
+    jwks?: JWK[] | JSONWebKeySet;
+    issuer?: string;
+    audience?: string | string[];
+    resource?: string;
+    protectedResourceMetadata?: OAuthProtectedResourceMetadata;
+    requiredScopes?: string[];
+    requiredAuthorizationDetails?: OAuthAuthorizationDetailConstraint[];
+    expectedSubject?: string;
+    expectedClientId?: string;
+    expectedActorSubject?: string;
+    requiredCnfJkt?: string;
+    requireCnf?: boolean;
+    signaturePolicy?: OAuthSignaturePolicy;
+    dpopReplayCache?: DpopReplayCache;
+    nowSeconds?: number;
+    clockSkewSeconds?: number;
+}
+export interface OAuthTokenCheck {
+    jwt_present: boolean;
+    introspection_present: boolean;
+    verified: boolean | null;
+    alg: string | null;
+    kid: string | null;
+    claims_verified: boolean;
+}
+export interface OAuthAuthorizationEvidenceVerification extends EvidenceVerificationBlock<{
+    token: OAuthTokenCheck;
+    dpop: OAuthDpopCheck | null;
+    audience: string[];
+    resource: string[];
+    client_id: string | null;
+}> {
+    protocol: OAuthEvidenceProtocol;
+}
+export interface OAuthDpopCheck {
+    jwt_present: boolean;
+    verified: boolean;
+    alg: string | null;
+    jkt: string | null;
+    jti: string | null;
+    htm: string | null;
+    htu: string | null;
+}
+export declare function verifyOAuthAuthorizationEvidence(input: OAuthAuthorizationEvidenceInput): Promise<OAuthAuthorizationEvidenceVerification>;
+export type AuthorizationEvidenceInput = {
+    protocol?: OAuthEvidenceProtocol;
+    oauth: OAuthAuthorizationEvidenceInput;
+} | OAuthAuthorizationEvidenceInput;
+export declare function verifyAuthorizationEvidence(evidence: AuthorizationEvidenceInput): Promise<EvidenceVerificationBlock>;
+//# sourceMappingURL=authorization-evidence.d.ts.map

package/dist/authorization-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-evidence.d.ts","sourceRoot":"","sources":["../src/authorization-evidence.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,EAAoB,MAAM,MAAM,CAAA;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,wBAAwB,CAAA;AAEjF,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAA;AACpF,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,aAAa,GAAG,KAAK,CAAA;AACpE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,WAAW,CAAA;AAE1D,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,mBAAmB,CAAA;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,yBAAyB,CAAC,QAAQ,GAAG,OAAO;IAC3D,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,cAAc,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,WAAW,EAAE,uBAAuB,EAAE,CAAA;IACtC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,CAAC,EAAE,QAAQ,CAAA;CACnB;AAED,MAAM,WAAW,kCAAkC;IACjD,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,GAAG,CAAC,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,GAAG,CAAC,EAAE,GAAG,CAAA;QACT,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IAC9C,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;CACnD;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,GAAG,CAAC,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,GAAG,CAAC,EAAE,GAAG,CAAA;QACT,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IAC9C,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IAClD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,sBAAsB,CAAA;IAC/B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,aAAa,CAAC,EAAE,+BAA+B,CAAA;IAC/C,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,SAAS,CAAC,EAAE,mBAAmB,CAAA;IAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,aAAa,CAAA;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,yBAAyB,CAAC,EAAE,8BAA8B,CAAA;IAC1D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,4BAA4B,CAAC,EAAE,kCAAkC,EAAE,CAAA;IACnE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,eAAe,CAAC,EAAE,oBAAoB,CAAA;IACtC,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAA;IACpB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,sCAAuC,SAAQ,yBAAyB,CAAC;IACxF,KAAK,EAAE,eAAe,CAAA;IACtB,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAC;IACA,QAAQ,EAAE,qBAAqB,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,OAAO,CAAA;IACpB,QAAQ,EAAE,OAAO,CAAA;IACjB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AA2gBD,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,sCAAsC,CAAC,CA+FjD;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,KAAK,EAAE,+BAA+B,CAAA;CACvC,GACD,+BAA+B,CAAA;AAEnC,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAAC,yBAAyB,CAAC,CAQpC"}