@avow-finance/verifier 0.0.0-stage → 0.2.0

package/dist/accept.js

@@ -0,0 +1,268 @@
+import { acceptanceTypedData, approvalCaps, approvalDigest, approvalJson, approvalMandateProblem, approvalPartiesProblem, approvalTermsProblem, approvalTokenProblem, digestOf, isChainedTerms, isTermsV1, lockTerms, parseSigned, termsShapeProblem, } from '@avow-finance/spec';
+import { encodeFunctionData, isAddressEqual, isHex, size, zeroAddress, } from 'viem';
+import { checkAuthorization, plainTerms, same, } from './authorization.js';
+import { verifyDependencies, } from './dependency.js';
+import { acceptanceDisclosure } from './disclosure.js';
+import { issue } from './issued.js';
+import { randomNonce } from './nonce.js';
+import { signWithKey } from './signing.js';
+/** An acceptance stays valid for ten minutes at most, and never past the acceptance deadline. */
+export const ACCEPTANCE_VALIDITY = 600n;
+const sameTiming = (a, b) => a.minContestWindow === b.minContestWindow &&
+    a.confirmWindow === b.confirmWindow &&
+    a.rulingDelay === b.rulingDelay &&
+    a.rulingKeyEnd === b.rulingKeyEnd &&
+    a.day90 === b.day90;
+/**
+ * The supported way for a supplier to get an acceptance to sign. An acceptance binds the supplier
+ * to everything in Avow's approval, so this builds one only after every check passes, and refuses
+ * with the first reason that applies.
+ *
+ * 0. For version 3 terms, every booking they rely on passes `verifyDependencies` first, with the
+ *    account Avow's approval names as supplier as the one whose lock has to hold it. That holds
+ *    whoever the terms say checks for the buyer, since the supplier has the terms in full. Nothing
+ *    below reads them before, and the checks below confirm the lock holds exactly that approval.
+ * 1. Avow's authorization passes every check `verifySupplierAuthorization` makes, with the buyer's
+ *    signed mandate required, so a mandate that's forged, expired, revoked with its agent key, or
+ *    that doesn't allow this supplier, category, currency, token or amount refuses.
+ * 2. Avow's approval names the commitment the supplier agreed to, the supplier's own account,
+ *    signing key and payout, and the token, amount, deadlines, contest window, terms hash, charges,
+ *    day-90 share and arbiter of the supplier's own terms.
+ * 3. It names the mandate Avow's authorization names, that mandate's two caps, and a funding key
+ *    that's the mandate's agent key or the account's root key and that funded the reserve.
+ * 4. The lock stores the digest of exactly this approval and the same terms, and its token and
+ *    dispute timing are the ones the supplier's profile accepts.
+ *
+ * It records nothing, since the lock takes one acceptance per reserve. What it returns is frozen,
+ * and `signAcceptance` signs nothing else. The checks protect a supplier who signs only through
+ * these two calls. The lock checks the signature and the digest, so it takes a correctly signed
+ * acceptance however it was built.
+ *
+ * Throws when the setup is wrong or the chain can't be read, as `verifySupplierAuthorization` does.
+ */
+export async function prepareAcceptance(request, deps) {
+    const { config, chain } = deps;
+    const refuse = (reason) => ({ ok: false, reason });
+    const t = request.terms;
+    if (!isChainedTerms(t)) {
+        const shape = termsShapeProblem(t);
+        if (shape)
+            return refuse(shape);
+        // Version 1 terms written before the dispute block existed can't be checked against the
+        // approval.
+        if (isTermsV1(t) && !t.dispute)
+            return refuse('terms.incomplete');
+    }
+    if (request.mandate === undefined || request.mandate === null)
+        return refuse('mandate.missing');
+    // The buyer and its mandate come from the agreement the supplier signed, so they're required.
+    const { buyerBusinessId, mandateHash: agreedMandate } = request.agreed ?? {};
+    if (typeof buyerBusinessId !== 'string' || !isHex(agreedMandate) || size(agreedMandate) !== 32) {
+        return refuse('message.invalid');
+    }
+    // Version 3 terms go no further until every booking they rely on passes. The checked terms the
+    // check gives back are the only way they reach the checks below.
+    let under;
+    let dependencies = [];
+    if (isChainedTerms(t)) {
+        // The owner comes from the approval, never from this supplier's own settings. The approval's
+        // envelope is read here and its lock and contents are checked below, so a check that passes
+        // here leads to an acceptance only once the lock is shown to hold this approval.
+        const named = parseSigned(request.approval, 'Approval', approvalJson, {
+            chainId: config.chainId,
+        });
+        if (!named.ok)
+            return named;
+        const relied = await verifyDependencies({
+            terms: t,
+            approval: named.value.message,
+            disclosed: request.disclosed ?? [],
+            now: request.now,
+        }, deps.dependencies ?? { readers: [] });
+        if (!relied.ok)
+            return relied;
+        under = { kind: 'chained', terms: relied.terms };
+        dependencies = relied.checked;
+    }
+    else {
+        under = { kind: 'plain', terms: t };
+    }
+    const checked = await checkAuthorization({
+        authorization: request.authorization,
+        agreed: request.agreed,
+        terms: under,
+        mandate: request.mandate,
+        now: request.now,
+    }, config, chain);
+    if (!checked.ok)
+        return checked;
+    const { authorization: auth, lock, domain: d, lockInfo, backing, token, mandate } = checked;
+    if (!mandate)
+        return refuse('mandate.missing');
+    const parsed = parseSigned(request.approval, 'Approval', approvalJson, {
+        chainId: config.chainId,
+        lock,
+    });
+    if (!parsed.ok)
+        return parsed;
+    const a = parsed.value.message;
+    // The approval against the supplier's own records.
+    if (!same(a.commitmentId, request.agreed.commitmentId)) {
+        return refuse('approval.commitment_mismatch');
+    }
+    const parties = approvalPartiesProblem(a, config);
+    if (parties)
+        return refuse(parties);
+    let enforced;
+    let caps;
+    try {
+        enforced = lockTerms(plainTerms(under), token.decimals);
+        caps = approvalCaps(mandate, token.decimals);
+    }
+    catch {
+        return refuse('authorization.token_not_accepted');
+    }
+    if (a.side !== 'buyer')
+        return refuse('approval.terms_mismatch');
+    const tokenProblem = approvalTokenProblem(a, token.token);
+    if (tokenProblem)
+        return refuse(tokenProblem);
+    // Every field the lock enforces has to be what the supplier's own terms map to, through the
+    // same mapping Avow's API signs with, under the terms hash the supplier agreed to.
+    const differs = approvalTermsProblem(a, {
+        lock: enforced,
+        termsHash: request.agreed.termsHash,
+    });
+    if (differs)
+        return refuse(differs);
+    // The approval against the buyer's mandate and Avow's authorization. The reserve may come from
+    // the mandate's agent key or the account's root key.
+    const mandateProblem = approvalMandateProblem(a, {
+        mandateHash: auth.mandateHash,
+        caps,
+        fundingKeys: [mandate.agentKey, zeroAddress],
+    });
+    if (mandateProblem)
+        return refuse(mandateProblem);
+    // And it has to name the key that funded the reserve.
+    if (!isAddressEqual(a.fundingKey, backing.fundingKey))
+        return refuse('approval.mandate_mismatch');
+    // The lock holds this exact approval, under settings the supplier accepts.
+    const approvalHash = approvalDigest(a, d);
+    if (!same(backing.approvalHash, approvalHash) || !holdsApproval(backing, a)) {
+        return refuse('chain.approval_mismatch');
+    }
+    if (!isAddressEqual(lockInfo.token, a.token) ||
+        !sameTiming(lockInfo.timing, config.profile.lockTiming)) {
+        return refuse('chain.lock_timing_unexpected');
+    }
+    const latest = request.now + ACCEPTANCE_VALIDITY;
+    const acceptance = {
+        commitmentId: a.commitmentId,
+        side: 'buyer',
+        approvalHash,
+        termsHash: a.termsHash,
+        amount: a.amount,
+        token: a.token,
+        acceptBy: a.acceptBy,
+        nonce: request.nonce ?? randomNonce(),
+        expiry: latest < a.acceptBy ? latest : a.acceptBy,
+    };
+    const digest = digestOf(acceptanceTypedData(acceptance, d));
+    return issue({
+        ok: true,
+        acceptance,
+        domain: d,
+        digest,
+        approvalDigest: approvalHash,
+        signingKey: config.signingKey,
+        disclosure: acceptanceDisclosure({
+            digest,
+            expiry: acceptance.expiry,
+            approval: a,
+            approvalDigest: approvalHash,
+            lock,
+            chainId: config.chainId,
+            account: lockInfo.account,
+            token,
+            timing: lockInfo.timing,
+        }),
+        dependencies,
+    });
+}
+/** Whether the lock's record names the approval's parties, terms hash and mandate hash. */
+function holdsApproval(b, a) {
+    // Its lock-enforced fields already match, since the record and the approval each match the terms.
+    return (isAddressEqual(b.payee, a.payee) &&
+        isAddressEqual(b.supplier, a.supplier) &&
+        isAddressEqual(b.supplierSigner, a.supplierSigner) &&
+        same(b.termsHash, a.termsHash) &&
+        same(b.mandateHash, a.mandateHash));
+}
+/**
+ * Signs an acceptance with the supplier's signing key, once the person has seen its disclosure. It
+ * signs only the object `prepareAcceptance` returned, which is frozen, so a copy or an edit of it
+ * throws. It also throws when the confirmation names another disclosure, or when the key isn't
+ * the signing key Avow's approval names.
+ */
+export function signAcceptance(prepared, key, confirmation) {
+    return signWithKey({
+        prepared,
+        typedData: acceptanceTypedData(prepared.acceptance, prepared.domain),
+        message: prepared.acceptance,
+        key,
+        confirmation,
+        names: {
+            message: 'acceptance',
+            prepare: 'prepareAcceptance',
+            signingKey: "the signing key Avow's approval names",
+        },
+    });
+}
+/**
+ * The lock's `accept`, as the testnet lock declares it. Anyone can send it, since the lock checks
+ * the supplier's signing key signed the acceptance, so a supplier can send it from any account
+ * that pays the fee.
+ */
+export const ACCEPT_ABI = [
+    {
+        type: 'function',
+        name: 'accept',
+        inputs: [
+            {
+                name: 'm',
+                type: 'tuple',
+                components: [
+                    { name: 'commitmentId', type: 'bytes32' },
+                    { name: 'side', type: 'uint8' },
+                    { name: 'approvalHash', type: 'bytes32' },
+                    { name: 'termsHash', type: 'bytes32' },
+                    { name: 'amount', type: 'uint256' },
+                    { name: 'token', type: 'address' },
+                    { name: 'acceptBy', type: 'uint64' },
+                    { name: 'nonce', type: 'uint256' },
+                    { name: 'expiry', type: 'uint64' },
+                ],
+            },
+            { name: 'signature', type: 'bytes' },
+        ],
+        outputs: [],
+        stateMutability: 'nonpayable',
+    },
+];
+/**
+ * The call that hands a signed acceptance to its lock, with the fields exactly as they were signed,
+ * so the lock checks the same digest the supplier's key signed.
+ */
+export function acceptCall(acceptance) {
+    const d = { chainId: acceptance.chainId, verifyingContract: acceptance.lock };
+    return {
+        to: acceptance.lock,
+        data: encodeFunctionData({
+            abi: ACCEPT_ABI,
+            functionName: 'accept',
+            args: [acceptanceTypedData(acceptance.message, d).message, acceptance.signature],
+        }),
+    };
+}
+//# sourceMappingURL=accept.js.map

package/dist/accept.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accept.js","sourceRoot":"","sources":["../src/accept.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EAEpB,QAAQ,EAER,cAAc,EACd,SAAS,EAGT,SAAS,EACT,WAAW,EAGX,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAEL,kBAAkB,EAElB,cAAc,EACd,KAAK,EACL,IAAI,EACJ,WAAW,GACZ,MAAM,MAAM,CAAA;AACb,OAAO,EAEL,kBAAkB,EAClB,UAAU,EACV,IAAI,GAEL,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAIL,kBAAkB,GACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAmB,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAG1C,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AA4EvC,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,CAAa,EAAE,EAAE,CAClD,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB;IACzC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;IACnC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;IAC/B,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;IACjC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA0B,EAC1B,IAAoB;IAEpB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAC9B,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAClF,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAA;IACvB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;QAClC,IAAI,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/B,wFAAwF;QACxF,YAAY;QACZ,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAE,CAA2B,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAC/F,8FAA8F;IAC9F,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IAC5E,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/F,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAClC,CAAC;IAED,+FAA+F;IAC/F,iEAAiE;IACjE,IAAI,KAAsB,CAAA;IAC1B,IAAI,YAAY,GAAiC,EAAE,CAAA;IACnD,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,6FAA6F;QAC7F,4FAA4F;QAC5F,iFAAiF;QACjF,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE;YACpE,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAA;QAC3B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC;YACE,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;YAC7B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;YAClC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,EACD,IAAI,CAAC,YAAY,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CACrC,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAA;QAC7B,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QAChD,YAAY,GAAG,MAAM,CAAC,OAAO,CAAA;IAC/B,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IACrC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC;QACE,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,EACD,MAAM,EACN,KAAK,CACN,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAA;IAC/B,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3F,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAE9C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE;QACrE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;KACL,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAA;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAA;IAE9B,mDAAmD;IACnD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,8BAA8B,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACjD,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACnC,IAAI,QAAmB,CAAA;IACvB,IAAI,IAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QACvD,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAA;IAChE,MAAM,YAAY,GAAG,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IACzD,IAAI,YAAY;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAA;IAC7C,4FAA4F;IAC5F,mFAAmF;IACnF,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,EAAE;QACtC,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;KACpC,CAAC,CAAA;IACF,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IAEnC,+FAA+F;IAC/F,qDAAqD;IACrD,MAAM,cAAc,GAAG,sBAAsB,CAAC,CAAC,EAAE;QAC/C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI;QACJ,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC7C,CAAC,CAAA;IACF,IAAI,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAA;IACjD,sDAAsD;IACtD,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC,2BAA2B,CAAC,CAAA;IAEjG,2EAA2E;IAC3E,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAA;IAC1C,CAAC;IACD,IACE,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QACxC,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EACvD,CAAC;QACD,OAAO,MAAM,CAAC,8BAA8B,CAAC,CAAA;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,mBAAmB,CAAA;IAChD,MAAM,UAAU,GAAe;QAC7B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,IAAI,EAAE,OAAO;QACb,YAAY;QACZ,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE;QACrC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;KAClD,CAAA;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,mBAAmB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3D,OAAO,KAAK,CAAC;QACX,EAAE,EAAE,IAAI;QACR,UAAU;QACV,MAAM,EAAE,CAAC;QACT,MAAM;QACN,cAAc,EAAE,YAAY;QAC5B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,oBAAoB,CAAC;YAC/B,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,CAAC;YACX,cAAc,EAAE,YAAY;YAC5B,IAAI;YACJ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;QACF,YAAY;KACb,CAAC,CAAA;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,CAAgB,EAAE,CAAW;IAClD,kGAAkG;IAClG,OAAO,CACL,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAChC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC;QACtC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CACnC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAyB,EACzB,GAAe,EACf,YAAmC;IAEnC,OAAO,WAAW,CAAC;QACjB,QAAQ;QACR,SAAS,EAAE,mBAAmB,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC;QACpE,OAAO,EAAE,QAAQ,CAAC,UAAU;QAC5B,GAAG;QACH,YAAY;QACZ,KAAK,EAAE;YACL,OAAO,EAAE,YAAY;YACrB,OAAO,EAAE,mBAAmB;YAC5B,UAAU,EAAE,uCAAuC;SACpD;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;oBACzC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;oBAC/B,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;oBACzC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;oBACnC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;oBAClC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACpC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;oBAClC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACnC;aACF;YACD,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;SACrC;QACD,OAAO,EAAE,EAAE;QACX,eAAe,EAAE,YAAY;KAC9B;CACO,CAAA;AAEV;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,UAA8B;IACvD,MAAM,CAAC,GAAe,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,EAAE,UAAU,CAAC,IAAI,EAAE,CAAA;IACzF,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,IAAI;QACnB,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,UAAU;YACf,YAAY,EAAE,QAAQ;YACtB,IAAI,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC;SACjF,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/authorization.d.ts

@@ -0,0 +1,65 @@
+import { type AnyTerms, type AvowDomain, type Mandate, type RailToken, type ReasonCode, type SupplierAuthorization } from '@avow-finance/spec';
+import { type Address, type Hex } from 'viem';
+import type { ChainReader, LockedBacking, LockInfo } from './chain.js';
+import type { CheckedChainedTerms } from './dependency.js';
+import type { VerifierConfig } from './verify.js';
+/** Avow signs a supplier authorization for five minutes. */
+export declare const AUTHORIZATION_VALIDITY = 300n;
+/** What the supplier agreed to, from the terms agreement it signed. */
+export interface Agreed {
+    commitmentId: Hex;
+    termsHash: Hex;
+    category: string;
+    /** The buyer the agreement names. Checked when given. */
+    buyerBusinessId?: string;
+    /** The buyer's mandate the agreement names, which also names the buyer's lock. Checked when given. */
+    mandateHash?: Hex;
+}
+/**
+ * The supplier's own terms, as an authorization is checked against them. Plain terms are version
+ * 2, or version 1 for a commitment made under it. Chained terms are version 3 terms every booking
+ * of which passed `verifyDependencies`, which only that check gives.
+ */
+export type TermsUnderCheck = {
+    kind: 'plain';
+    terms: AnyTerms;
+} | {
+    kind: 'chained';
+    terms: CheckedChainedTerms;
+};
+/**
+ * The terms the rules, the mandate and the lock read. Version 3 terms make the plain booking
+ * `plainTermsOf` gives, since the lock enforces nothing in their dependencies section.
+ */
+export declare function plainTerms(under: TermsUnderCheck): AnyTerms;
+export interface AuthorizationInput {
+    authorization: unknown;
+    agreed: Agreed;
+    terms: TermsUnderCheck;
+    mandate?: unknown;
+    now: bigint;
+}
+export type AuthorizationCheck = {
+    ok: true;
+    authorization: SupplierAuthorization;
+    lock: Address;
+    domain: AvowDomain;
+    lockInfo: LockInfo;
+    backing: LockedBacking;
+    token: RailToken;
+    /** The buyer's mandate, when the caller passed it and it passed. */
+    mandate: Mandate | null;
+    signer: Address;
+} | {
+    ok: false;
+    reason: ReasonCode;
+};
+/** Equal hex values in any letter case. Anything that isn't a string is never equal. */
+export declare const same: (a: Hex, b: Hex) => boolean;
+/**
+ * Every check of a supplier authorization except the record that it passed, which only
+ * `verifySupplierAuthorization` makes. `prepareAcceptance` runs the same checks again with the
+ * buyer's mandate required.
+ */
+export declare function checkAuthorization(input: AuthorizationInput, config: VerifierConfig, chain: ChainReader): Promise<AuthorizationCheck>;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EAEb,KAAK,UAAU,EASf,KAAK,OAAO,EAMZ,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,qBAAqB,EAO3B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAA+C,MAAM,MAAM,CAAA;AAC1F,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB,OAAO,CAAA;AAI1C,uEAAuE;AACvE,MAAM,WAAW,MAAM;IACrB,YAAY,EAAE,GAAG,CAAA;IACjB,SAAS,EAAE,GAAG,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,sGAAsG;IACtG,WAAW,CAAC,EAAE,GAAG,CAAA;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAEnD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,QAAQ,CAE3D;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,OAAO,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,eAAe,CAAA;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACE,EAAE,EAAE,IAAI,CAAA;IACR,aAAa,EAAE,qBAAqB,CAAA;IACpC,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,QAAQ,CAAA;IAClB,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,SAAS,CAAA;IAChB,oEAAoE;IACpE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,OAAO,CAAA;CAChB,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAAA;AAErC,wFAAwF;AACxF,eAAO,MAAM,IAAI,MAAO,GAAG,KAAK,GAAG,YACoD,CAAA;AAEvF;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,kBAAkB,CAAC,CA8K7B"}

package/dist/authorization.js

@@ -0,0 +1,192 @@
+import { AUTHORIZATION_TERMS_FIELDS, assertTestSettingsOnTestnet, checkMandate, digestOf, enforceableTerms, lockRecordDifferences, lockTerms, lockTermsDifferences, mandateHash, mandateJson, mandateTypedData, parseSigned, plainTermsOf, supplierAuthorizationJson, supplierAuthorizationTypedData, termsHash, termsShapeProblem, validateChainedTerms, validateTerms, } from '@avow-finance/spec';
+import { isAddressEqual, recoverAddress, zeroAddress } from 'viem';
+/** Avow signs a supplier authorization for five minutes. */
+export const AUTHORIZATION_VALIDITY = 300n;
+/** Room for the supplier's clock to run behind Avow's. */
+const CLOCK_ALLOWANCE = 60n;
+/**
+ * The terms the rules, the mandate and the lock read. Version 3 terms make the plain booking
+ * `plainTermsOf` gives, since the lock enforces nothing in their dependencies section.
+ */
+export function plainTerms(under) {
+    return under.kind === 'plain' ? under.terms : plainTermsOf(under.terms);
+}
+/** Equal hex values in any letter case. Anything that isn't a string is never equal. */
+export const same = (a, b) => typeof a === 'string' && typeof b === 'string' && a.toLowerCase() === b.toLowerCase();
+/**
+ * Every check of a supplier authorization except the record that it passed, which only
+ * `verifySupplierAuthorization` makes. `prepareAcceptance` runs the same checks again with the
+ * buyer's mandate required.
+ */
+export async function checkAuthorization(input, config, chain) {
+    if (chain.chainId !== config.chainId) {
+        throw new Error(`The chain reader is for chain ${chain.chainId}, not ${config.chainId}`);
+    }
+    assertTestSettingsOnTestnet({
+        chainId: config.chainId,
+        testData: config.acceptTestData,
+        profile: config.profile,
+    });
+    const refuse = (reason) => ({ ok: false, reason });
+    // The envelope, the signature and the validity window.
+    const parsed = parseSigned(input.authorization, 'SupplierAuthorization', supplierAuthorizationJson, { chainId: config.chainId });
+    if (!parsed.ok)
+        return parsed;
+    const { message: auth, lock, signature } = parsed.value;
+    if (auth.expiry <= input.now)
+        return refuse('message.expired');
+    const maxValidity = config.maxValidity ?? AUTHORIZATION_VALIDITY;
+    if (auth.expiry > input.now + maxValidity + CLOCK_ALLOWANCE) {
+        return refuse('message.validity_too_long');
+    }
+    const d = { chainId: config.chainId, verifyingContract: lock };
+    let signer;
+    try {
+        signer = await recoverAddress({
+            hash: digestOf(supplierAuthorizationTypedData(auth, d)),
+            signature,
+        });
+    }
+    catch {
+        return refuse('message.signature_invalid');
+    }
+    if (!config.avowKeys.some((k) => isAddressEqual(k, signer))) {
+        return refuse('message.signer_unknown');
+    }
+    // The commitment the supplier agreed to, and nothing else.
+    if (!same(auth.commitmentId, input.agreed.commitmentId)) {
+        return refuse('authorization.commitment_mismatch');
+    }
+    if (!same(auth.termsHash, input.agreed.termsHash))
+        return refuse('terms.hash_mismatch');
+    const { buyerBusinessId, mandateHash: agreedMandate } = input.agreed;
+    if (buyerBusinessId !== undefined && auth.buyerBusinessId !== buyerBusinessId) {
+        return refuse('authorization.buyer_mismatch');
+    }
+    if (agreedMandate !== undefined && !same(auth.mandateHash, agreedMandate)) {
+        return refuse('authorization.mandate_mismatch');
+    }
+    if (auth.kybTestData && !config.acceptTestData)
+        return refuse('business.test_data');
+    // The supplier's terms against the ones Avow signed, once they have a shape the hash covers.
+    const under = input.terms;
+    // Checked version 3 terms passed their shape check in `verifyDependencies`.
+    if (under.kind === 'plain') {
+        const shape = termsShapeProblem(under.terms);
+        if (shape)
+            return refuse(shape);
+    }
+    if (!same(termsHash(under.terms, auth.salt), auth.termsHash))
+        return refuse('terms.hash_mismatch');
+    const termsProblem = under.kind === 'plain'
+        ? validateTerms(under.terms, config.profile)
+        : validateChainedTerms(under.terms, config.profile);
+    if (termsProblem)
+        return refuse(termsProblem);
+    const t = plainTerms(under);
+    // What the lock enforces, read from the supplier's terms the way Avow's API reads them.
+    const e = enforceableTerms(t);
+    const token = config.acceptedTokens.find((a) => a.chainId === config.chainId &&
+        isAddressEqual(a.token, auth.token) &&
+        a.currency === e.currency);
+    if (!token)
+        return refuse('authorization.token_not_accepted');
+    // Every value the lock enforces, in the token's base units.
+    let expected;
+    try {
+        expected = lockTerms(t, token.decimals);
+    }
+    catch {
+        return refuse('authorization.token_not_accepted');
+    }
+    if (lockTermsDifferences(auth, expected, AUTHORIZATION_TERMS_FIELDS).length > 0) {
+        return refuse('authorization.terms_mismatch');
+    }
+    if (!isAddressEqual(auth.payee, config.payee))
+        return refuse('authorization.payee_mismatch');
+    if (auth.acceptBy <= input.now)
+        return refuse('authorization.accept_by_passed');
+    // The chain, read directly.
+    const lockInfo = await chain.lock(lock);
+    if (!lockInfo?.fromFactory)
+        return refuse('chain.lock_unknown');
+    const backing = await chain.backing(lock, auth.commitmentId, 'buyer');
+    if (backing?.state === 'accepted')
+        return refuse('chain.reserve_accepted');
+    if (backing?.state !== 'reserved')
+        return refuse('chain.reserve_missing');
+    const fundedByAgentOrRoot = isAddressEqual(backing.fundingKey, auth.agentKey) ||
+        isAddressEqual(backing.fundingKey, zeroAddress);
+    // The lock's record has to hold Avow's authorization and enforce exactly what the terms map to,
+    // in every field it stores.
+    if (!isAddressEqual(backing.token, auth.token) ||
+        !isAddressEqual(backing.payee, auth.payee) ||
+        !same(backing.termsHash, auth.termsHash) ||
+        !fundedByAgentOrRoot ||
+        lockRecordDifferences(backing, expected).length > 0) {
+        return refuse('chain.reserve_mismatch');
+    }
+    const key = await chain.agentKey(lockInfo.account, auth.agentKey, auth.agentKeyAuthorizedIn);
+    if (!key?.active)
+        return refuse('chain.agent_key_inactive');
+    // The key has to last until nothing more can happen to the commitment.
+    if (key.expiry !== null && key.expiry < e.releaseDate)
+        return refuse('chain.agent_key_inactive');
+    if (key.witness === null || !same(key.witness, auth.mandateHash)) {
+        return refuse('chain.mandate_mismatch');
+    }
+    // The buyer's mandate, when the supplier has it: its hash, its signer and its limits.
+    let mandate = null;
+    if (input.mandate !== undefined) {
+        const m = parseSigned(input.mandate, 'Mandate', mandateJson, {
+            chainId: config.chainId,
+            lock,
+        });
+        if (!m.ok)
+            return m;
+        mandate = m.value.message;
+        if (!same(mandateHash(mandate, d), auth.mandateHash) ||
+            mandate.businessId !== auth.buyerBusinessId ||
+            !isAddressEqual(mandate.account, lockInfo.account) ||
+            !isAddressEqual(mandate.agentKey, auth.agentKey)) {
+            return refuse('authorization.mandate_mismatch');
+        }
+        const signed = await chain.isAccountSignature(lockInfo.account, digestOf(mandateTypedData(mandate, d)), m.value.signature);
+        if (!signed)
+            return refuse('mandate.signature_invalid');
+        // The parts a supplier can check. Open reserves and revocation live with the lock and the
+        // key, which the checks above read, and Avow's signature stands for any human approval.
+        const limits = checkMandate({
+            mandate,
+            request: {
+                commitmentId: auth.commitmentId,
+                agentKey: auth.agentKey,
+                supplier: config.businessId,
+                payee: auth.payee,
+                category: input.agreed.category,
+                // Checked version 3 terms go in whole. Their plain booking alone would fail a template
+                // that commits only on a booking it relies on, as a job does.
+                terms: under.terms,
+            },
+            token,
+            openReserves: 0n,
+            revoked: false,
+            now: input.now,
+            profile: config.profile,
+        });
+        if (limits.result === 'denied')
+            return refuse(limits.reason);
+    }
+    return {
+        ok: true,
+        authorization: auth,
+        lock,
+        domain: d,
+        lockInfo,
+        backing,
+        token,
+        mandate,
+        signer,
+    };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0BAA0B,EAE1B,2BAA2B,EAC3B,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAEhB,qBAAqB,EACrB,SAAS,EACT,oBAAoB,EAEpB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,YAAY,EAIZ,yBAAyB,EACzB,8BAA8B,EAC9B,SAAS,EACT,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAA0B,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,MAAM,CAAA;AAK1F,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAA;AAC1C,0DAA0D;AAC1D,MAAM,eAAe,GAAG,GAAG,CAAA;AAsB3B;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACzE,CAAC;AAyBD,wFAAwF;AACxF,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAM,EAAE,CAAM,EAAE,EAAE,CACrC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;AAEvF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAyB,EACzB,MAAsB,EACtB,KAAkB;IAElB,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1F,CAAC;IACD,2BAA2B,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,cAAc;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAElF,uDAAuD;IACvD,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,CAAC,aAAa,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAC5B,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAA;IAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,KAAK,CAAA;IACvD,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,sBAAsB,CAAA;IAChE,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,GAAG,WAAW,GAAG,eAAe,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,2BAA2B,CAAC,CAAA;IAC5C,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAA;IAC9D,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,cAAc,CAAC;YAC5B,IAAI,EAAE,QAAQ,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACvD,SAAS;SACV,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,2BAA2B,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAA;IACzC,CAAC;IAED,2DAA2D;IAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,mCAAmC,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAA;IACvF,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,MAAM,CAAA;IACpE,IAAI,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;QAC9E,OAAO,MAAM,CAAC,8BAA8B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAA;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAEnF,6FAA6F;IAC7F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,4EAA4E;IAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5C,IAAI,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAA;IAClG,MAAM,YAAY,GAChB,KAAK,CAAC,IAAI,KAAK,OAAO;QACpB,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QAC5C,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,YAAY;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAA;IAC7C,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;IAC3B,wFAAwF;IACxF,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC5B,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAC5B,CAAA;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAA;IAC7D,4DAA4D;IAC5D,IAAI,QAAmB,CAAA;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,0BAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChF,OAAO,MAAM,CAAC,8BAA8B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,8BAA8B,CAAC,CAAA;IAC5F,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAA;IAE/E,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,CAAC,QAAQ,EAAE,WAAW;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACrE,IAAI,OAAO,EAAE,KAAK,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAA;IAC1E,IAAI,OAAO,EAAE,KAAK,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAA;IACzE,MAAM,mBAAmB,GACvB,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;QACjD,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACjD,gGAAgG;IAChG,4BAA4B;IAC5B,IACE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QAC1C,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QAC1C,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;QACxC,CAAC,mBAAmB;QACpB,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EACnD,CAAC;QACD,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAA;IACzC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAC5F,IAAI,CAAC,GAAG,EAAE,MAAM;QAAE,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAA;IAC3D,uEAAuE;IACvE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAA;IAChG,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAA;IACzC,CAAC;IAED,sFAAsF;IACtF,IAAI,OAAO,GAAmB,IAAI,CAAA;IAClC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE;YAC3D,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI;SACL,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,CAAC,CAAA;QACnB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;QACzB,IACE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC;YAChD,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,eAAe;YAC3C,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;YAClD,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAChD,CAAC;YACD,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAA;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAC3C,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EACtC,CAAC,CAAC,KAAK,CAAC,SAAS,CAClB,CAAA;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,2BAA2B,CAAC,CAAA;QACvD,0FAA0F;QAC1F,wFAAwF;QACxF,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO;YACP,OAAO,EAAE;gBACP,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,MAAM,CAAC,UAAU;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;gBAC/B,uFAAuF;gBACvF,8DAA8D;gBAC9D,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB;YACD,KAAK;YACL,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,aAAa,EAAE,IAAI;QACnB,IAAI;QACJ,MAAM,EAAE,CAAC;QACT,QAAQ;QACR,OAAO;QACP,KAAK;QACL,OAAO;QACP,MAAM;KACP,CAAA;AACH,CAAC"}