@cello-protocol/protocol-types 0.0.2

package/dist/connection-package.js

@@ -0,0 +1,426 @@
+/**
+ * @cello-protocol/protocol-types — CELLO-CONNREQ-001
+ * Connection package wire types, CBOR encoding/decoding, and validation.
+ *
+ * ──── Phase P: Pseudocode ────
+ *
+ * Connection package structure (CBOR map):
+ *   {
+ *     pseudonym_binding: PseudonymBinding,
+ *     endorsements:      Endorsement[],
+ *     attestations:      Attestation[],
+ *   }
+ *
+ * PseudonymBinding construction:
+ *   1. Validate pseudonym_label ≤ 64 UTF-8 bytes
+ *   2. Fetch ml_dsa_pubkey from keyProvider.getPublicKey()
+ *   3. Build TBS positional array:
+ *      [pseudonym_label, k_local_pubkey, primary_pubkey, ml_dsa_pubkey, created_at]
+ *      canonical CBOR per RFC 8949 §4.2.1 (Encoder({tagUint8Array: false}))
+ *   4. ml_dsa_signature = await keyProvider.sign(TBS_bytes)  [ML-DSA, NIST FIPS 204]
+ *   5. Return PseudonymBinding with all six fields
+ *
+ * PseudonymBinding verification:
+ *   1. Rebuild TBS same as above (excluding ml_dsa_signature)
+ *   2. mlDsaVerify(ml_dsa_pubkey, TBS_bytes, ml_dsa_signature) → boolean
+ *
+ * Endorsement TBS = canonical CBOR of all fields except endorser_ml_dsa_signature:
+ *   [endorser_pubkey, endorser_ml_dsa_pubkey, target_pubkey, endorsement_type,
+ *    created_at, expires_at]
+ *
+ * Attestation TBS = canonical CBOR of all fields except attester_ml_dsa_signature:
+ *   [attester_pubkey, attester_ml_dsa_pubkey, attestation_type, attestation_data,
+ *    created_at, expires_at]
+ *
+ * Validation logic:
+ *   1. Verify pseudonym_binding signature → if invalid, return { valid: false, reason: 'pseudonym_binding_invalid' }
+ *   2. Validate pseudonym_label byte length → if > 64, return { valid: false, reason: 'pseudonym_label_too_long' }
+ *      NOTE: label length is checked at build time; but validation also checks in case
+ *      a tampered package is passed directly to validateConnectionPackage.
+ *   3. For each endorsement:
+ *      a. Verify endorser_ml_dsa_signature → if invalid, mark 'signature_invalid'
+ *      b. Else if expires_at <= current_timestamp_ms → mark 'expired'
+ *      c. Else if target_pubkey ≠ sender_k_local_pubkey → mark 'target_mismatch'
+ *      d. Else → mark 'valid'
+ *   4. For each attestation:
+ *      a. Verify attester_ml_dsa_signature → if invalid, mark 'signature_invalid'
+ *      b. Else if expires_at <= current_timestamp_ms → mark 'expired'
+ *      c. Else → mark 'valid'
+ *   5. Return { valid: true, pseudonym_binding, endorsements: [...], attestations: [...] }
+ *
+ * IMPORTANT: Items 3 and 4 are per-item — a bad endorsement does NOT reject the package.
+ *            Only a bad pseudonym_binding rejects the whole package.
+ *
+ * Canonical CBOR encoding (RFC 8949 §4.2.1):
+ *   - All byte arrays as CBOR major-type-2 byte strings (tagUint8Array: false)
+ *   - Integers use shortest encoding; BigInt for timestamps > 0xFFFFFFFF
+ *   - Map keys are text strings in deterministic order (cbor-x preserves insertion order)
+ *
+ * References:
+ *   RFC 8949 §4.2.1 — Core Deterministic Encoding Requirements
+ *   NIST FIPS 204 — Module-Lattice-Based Digital Signature Standard (ML-DSA)
+ */
+import { Encoder } from "cbor-x";
+import { decode as cborDecode } from "cbor-x";
+// ─── CBOR encoder ─────────────────────────────────────────────────────────────
+/**
+ * Canonical CBOR encoder per RFC 8949 §4.2.1.
+ * tagUint8Array: false — encode Uint8Array as CBOR byte strings (major type 2).
+ */
+const CBOR_ENC = new Encoder({ tagUint8Array: false });
+/** Maximum pseudonym_label size in UTF-8 bytes (AC-007, AC-008). */
+export const MAX_PSEUDONYM_LABEL_BYTES = 64;
+/** Expected ML-DSA-44 public key size in bytes (NIST FIPS 204). */
+export const ML_DSA_PUBKEY_BYTES = 1312;
+/** Expected ML-DSA-44 signature size in bytes (NIST FIPS 204). */
+export const ML_DSA_SIGNATURE_BYTES = 2420;
+// ─── TBS (to-be-signed) encoders ─────────────────────────────────────────────
+/**
+ * Build the to-be-signed bytes for a PseudonymBinding.
+ *
+ * TBS: canonical CBOR of positional array:
+ *   [pseudonym_label, k_local_pubkey, primary_pubkey, ml_dsa_pubkey, created_at]
+ *
+ * RFC 8949 §4.2.1 — shortest integer encoding; BigInt for timestamps > 0xFFFFFFFF.
+ */
+function buildPseudonymBindingTbs(pseudonym_label, k_local_pubkey, primary_pubkey, ml_dsa_pubkey, created_at) {
+    const tsEncoded = created_at > 0xffffffff ? BigInt(created_at) : created_at;
+    return new Uint8Array(CBOR_ENC.encode([
+        pseudonym_label,
+        k_local_pubkey,
+        primary_pubkey,
+        ml_dsa_pubkey,
+        tsEncoded,
+    ]));
+}
+/**
+ * Build the to-be-signed bytes for an Endorsement.
+ *
+ * TBS: canonical CBOR of positional array (all fields except endorser_ml_dsa_signature):
+ *   [endorser_pubkey, endorser_ml_dsa_pubkey, target_pubkey, endorsement_type, created_at, expires_at]
+ *
+ * RFC 8949 §4.2.1 — shortest integer encoding.
+ */
+function buildEndorsementTbs(e) {
+    const createdEncoded = e.created_at > 0xffffffff ? BigInt(e.created_at) : e.created_at;
+    const expiresEncoded = e.expires_at > 0xffffffff ? BigInt(e.expires_at) : e.expires_at;
+    return new Uint8Array(CBOR_ENC.encode([
+        e.endorser_pubkey,
+        e.endorser_ml_dsa_pubkey,
+        e.target_pubkey,
+        e.endorsement_type,
+        createdEncoded,
+        expiresEncoded,
+    ]));
+}
+/**
+ * Build the to-be-signed bytes for an Attestation.
+ *
+ * TBS: canonical CBOR of positional array (all fields except attester_ml_dsa_signature):
+ *   [attester_pubkey, attester_ml_dsa_pubkey, attestation_type, attestation_data, created_at, expires_at]
+ *
+ * RFC 8949 §4.2.1 — shortest integer encoding.
+ */
+function buildAttestationTbs(a) {
+    const createdEncoded = a.created_at > 0xffffffff ? BigInt(a.created_at) : a.created_at;
+    const expiresEncoded = a.expires_at > 0xffffffff ? BigInt(a.expires_at) : a.expires_at;
+    return new Uint8Array(CBOR_ENC.encode([
+        a.attester_pubkey,
+        a.attester_ml_dsa_pubkey,
+        a.attestation_type,
+        a.attestation_data,
+        createdEncoded,
+        expiresEncoded,
+    ]));
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+/**
+ * Build a PseudonymBinding by signing with the MlDsaKeyProvider.
+ *
+ * SI-003 enforcement: callers supply a provider, not raw signature bytes.
+ * The type signature makes it impossible to inject a pre-computed signature.
+ *
+ * @param params - Binding fields (pseudonym_label, keys, created_at)
+ * @param mlDsaKeyProvider - ML-DSA key provider (private key never leaves the provider)
+ */
+export async function buildPseudonymBinding(params, mlDsaKeyProvider) {
+    const labelBytes = new TextEncoder().encode(params.pseudonym_label);
+    if (labelBytes.length > MAX_PSEUDONYM_LABEL_BYTES) {
+        return { ok: false, reason: "pseudonym_label_too_long" };
+    }
+    const tbs = buildPseudonymBindingTbs(params.pseudonym_label, params.k_local_pubkey, params.primary_pubkey, params.ml_dsa_pubkey, params.created_at);
+    const ml_dsa_signature = await mlDsaKeyProvider.sign(tbs);
+    return {
+        ok: true,
+        binding: {
+            pseudonym_label: params.pseudonym_label,
+            k_local_pubkey: params.k_local_pubkey,
+            primary_pubkey: params.primary_pubkey,
+            ml_dsa_pubkey: params.ml_dsa_pubkey,
+            created_at: params.created_at,
+            ml_dsa_signature,
+        },
+    };
+}
+/**
+ * Verify a PseudonymBinding signature standalone.
+ *
+ * Exported so endorsement stripping tests (SI-002 pattern) can verify items
+ * outside of a full package.
+ */
+export function verifyPseudonymBinding(binding, mlDsaVerify) {
+    const tbs = buildPseudonymBindingTbs(binding.pseudonym_label, binding.k_local_pubkey, binding.primary_pubkey, binding.ml_dsa_pubkey, binding.created_at);
+    return mlDsaVerify(binding.ml_dsa_pubkey, tbs, binding.ml_dsa_signature);
+}
+/**
+ * Verify an Endorsement signature standalone.
+ *
+ * SI-002: each item independently verifiable outside of a package.
+ */
+export function verifyEndorsement(endorsement, mlDsaVerify) {
+    const tbs = buildEndorsementTbs(endorsement);
+    return mlDsaVerify(endorsement.endorser_ml_dsa_pubkey, tbs, endorsement.endorser_ml_dsa_signature);
+}
+/**
+ * Verify an Attestation signature standalone.
+ *
+ * SI-002: each item independently verifiable outside of a package.
+ */
+export function verifyAttestation(attestation, mlDsaVerify) {
+    const tbs = buildAttestationTbs(attestation);
+    return mlDsaVerify(attestation.attester_ml_dsa_pubkey, tbs, attestation.attester_ml_dsa_signature);
+}
+/**
+ * Validate a ConnectionPackage.
+ *
+ * Validation rules:
+ *   - Invalid pseudonym binding → whole package rejected, reason: 'pseudonym_binding_invalid'
+ *   - Label > 64 UTF-8 bytes → whole package rejected, reason: 'pseudonym_label_too_long'
+ *   - Per-endorsement: signature_invalid | expired | target_mismatch | valid
+ *   - Per-attestation: signature_invalid | expired | valid
+ *
+ * SI-001: invalid pseudonym binding always rejects the package,
+ *         regardless of endorsement/attestation validity.
+ *
+ * @param pkg - The connection package to validate
+ * @param sender_k_local_pubkey - Sender's K_local pubkey (for endorsement target check)
+ * @param current_timestamp_ms - Current time (for expiry checks)
+ * @param mlDsaVerify - ML-DSA verify function (injected to avoid circular deps)
+ */
+export function validateConnectionPackage(pkg, sender_k_local_pubkey, current_timestamp_ms, mlDsaVerify) {
+    // Check label byte length (validate even if building was bypassed)
+    const labelBytes = new TextEncoder().encode(pkg.pseudonym_binding.pseudonym_label);
+    if (labelBytes.length > MAX_PSEUDONYM_LABEL_BYTES) {
+        return { valid: false, reason: "pseudonym_label_too_long" };
+    }
+    // SI-001: pseudonym binding must pass — checked before items
+    const bindingOk = verifyPseudonymBinding(pkg.pseudonym_binding, mlDsaVerify);
+    if (!bindingOk) {
+        return { valid: false, reason: "pseudonym_binding_invalid" };
+    }
+    // Per-endorsement validation (annotate, do not reject)
+    const validatedEndorsements = pkg.endorsements.map((e) => {
+        const sigOk = verifyEndorsement(e, mlDsaVerify);
+        if (!sigOk) {
+            return { ...e, validation_status: "signature_invalid" };
+        }
+        if (e.expires_at <= current_timestamp_ms) {
+            return { ...e, validation_status: "expired" };
+        }
+        if (!bytesEqual(e.target_pubkey, sender_k_local_pubkey)) {
+            return { ...e, validation_status: "target_mismatch" };
+        }
+        return { ...e, validation_status: "valid" };
+    });
+    // Per-attestation validation (annotate, do not reject)
+    const validatedAttestations = pkg.attestations.map((a) => {
+        const sigOk = verifyAttestation(a, mlDsaVerify);
+        if (!sigOk) {
+            return { ...a, validation_status: "signature_invalid" };
+        }
+        if (a.expires_at <= current_timestamp_ms) {
+            return { ...a, validation_status: "expired" };
+        }
+        return { ...a, validation_status: "valid" };
+    });
+    return {
+        valid: true,
+        pseudonym_binding: pkg.pseudonym_binding,
+        endorsements: validatedEndorsements,
+        attestations: validatedAttestations,
+    };
+}
+// ─── CBOR encode/decode ───────────────────────────────────────────────────────
+/**
+ * Encode a ConnectionPackage to canonical CBOR bytes.
+ *
+ * Wire format: CBOR map with keys: pseudonym_binding, endorsements, attestations.
+ * Each PseudonymBinding/Endorsement/Attestation is also a CBOR map.
+ * Timestamps use minimal encoding per RFC 8949 §4.2.1.
+ */
+export function encodeConnectionPackage(pkg) {
+    return CBOR_ENC.encode({
+        pseudonym_binding: encodePseudonymBindingMap(pkg.pseudonym_binding),
+        endorsements: pkg.endorsements.map(encodeEndorsementMap),
+        attestations: pkg.attestations.map(encodeAttestationMap),
+    });
+}
+function encodeTimestamp(ts) {
+    return ts > 0xffffffff ? BigInt(ts) : ts;
+}
+function encodePseudonymBindingMap(b) {
+    return {
+        pseudonym_label: b.pseudonym_label,
+        k_local_pubkey: b.k_local_pubkey,
+        primary_pubkey: b.primary_pubkey,
+        ml_dsa_pubkey: b.ml_dsa_pubkey,
+        created_at: encodeTimestamp(b.created_at),
+        ml_dsa_signature: b.ml_dsa_signature,
+    };
+}
+function encodeEndorsementMap(e) {
+    return {
+        endorser_pubkey: e.endorser_pubkey,
+        endorser_ml_dsa_pubkey: e.endorser_ml_dsa_pubkey,
+        target_pubkey: e.target_pubkey,
+        endorsement_type: e.endorsement_type,
+        created_at: encodeTimestamp(e.created_at),
+        expires_at: encodeTimestamp(e.expires_at),
+        endorser_ml_dsa_signature: e.endorser_ml_dsa_signature,
+    };
+}
+function encodeAttestationMap(a) {
+    return {
+        attester_pubkey: a.attester_pubkey,
+        attester_ml_dsa_pubkey: a.attester_ml_dsa_pubkey,
+        attestation_type: a.attestation_type,
+        attestation_data: a.attestation_data,
+        created_at: encodeTimestamp(a.created_at),
+        expires_at: encodeTimestamp(a.expires_at),
+        attester_ml_dsa_signature: a.attester_ml_dsa_signature,
+    };
+}
+/**
+ * Decode a ConnectionPackage from CBOR bytes.
+ *
+ * Performs structural validation (field presence, types, sizes).
+ * Does NOT verify signatures — call validateConnectionPackage for that.
+ *
+ * @throws Error if the bytes cannot be decoded or are structurally invalid.
+ */
+export function decodeConnectionPackage(bytes) {
+    const raw = cborDecode(bytes);
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error("decodeConnectionPackage: expected a CBOR map at top level");
+    }
+    const obj = raw;
+    const pseudonym_binding = decodePseudonymBindingMap(requireField(obj, "pseudonym_binding", "decodeConnectionPackage"));
+    const endorsementsRaw = requireField(obj, "endorsements", "decodeConnectionPackage");
+    if (!Array.isArray(endorsementsRaw)) {
+        throw new Error("decodeConnectionPackage: endorsements must be a CBOR array");
+    }
+    const endorsements = endorsementsRaw.map((e, i) => decodeEndorsementMap(e, `endorsements[${i}]`));
+    const attestationsRaw = requireField(obj, "attestations", "decodeConnectionPackage");
+    if (!Array.isArray(attestationsRaw)) {
+        throw new Error("decodeConnectionPackage: attestations must be a CBOR array");
+    }
+    const attestations = attestationsRaw.map((a, i) => decodeAttestationMap(a, `attestations[${i}]`));
+    return { pseudonym_binding, endorsements, attestations };
+}
+// ─── Internal decode helpers ──────────────────────────────────────────────────
+function requireField(obj, key, ctx) {
+    if (!(key in obj))
+        throw new Error(`${ctx}: missing required field '${key}'`);
+    return obj[key];
+}
+function requireBytes(obj, key, ctx) {
+    const v = requireField(obj, key, ctx);
+    const b = toUint8Array(v);
+    if (!b)
+        throw new Error(`${ctx}: field '${key}' must be bytes, got ${typeof v}`);
+    return b;
+}
+function requireString(obj, key, ctx) {
+    const v = requireField(obj, key, ctx);
+    if (typeof v !== "string")
+        throw new Error(`${ctx}: field '${key}' must be a string`);
+    return v;
+}
+function requireTimestamp(obj, key, ctx) {
+    const v = requireField(obj, key, ctx);
+    const n = typeof v === "bigint" ? Number(v) : typeof v === "number" ? v : NaN;
+    if (!Number.isInteger(n) || n < 0) {
+        throw new Error(`${ctx}: field '${key}' must be a non-negative integer, got ${v}`);
+    }
+    return n;
+}
+function decodePseudonymBindingMap(raw) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error("decodePseudonymBindingMap: expected a CBOR map");
+    }
+    const obj = raw;
+    const ctx = "PseudonymBinding";
+    return {
+        pseudonym_label: requireString(obj, "pseudonym_label", ctx),
+        k_local_pubkey: requireBytes(obj, "k_local_pubkey", ctx),
+        primary_pubkey: requireBytes(obj, "primary_pubkey", ctx),
+        ml_dsa_pubkey: requireBytes(obj, "ml_dsa_pubkey", ctx),
+        created_at: requireTimestamp(obj, "created_at", ctx),
+        ml_dsa_signature: requireBytes(obj, "ml_dsa_signature", ctx),
+    };
+}
+function decodeEndorsementMap(raw, ctx) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`decodeEndorsementMap[${ctx}]: expected a CBOR map`);
+    }
+    const obj = raw;
+    return {
+        endorser_pubkey: requireBytes(obj, "endorser_pubkey", ctx),
+        endorser_ml_dsa_pubkey: requireBytes(obj, "endorser_ml_dsa_pubkey", ctx),
+        target_pubkey: requireBytes(obj, "target_pubkey", ctx),
+        endorsement_type: requireString(obj, "endorsement_type", ctx),
+        created_at: requireTimestamp(obj, "created_at", ctx),
+        expires_at: requireTimestamp(obj, "expires_at", ctx),
+        endorser_ml_dsa_signature: requireBytes(obj, "endorser_ml_dsa_signature", ctx),
+    };
+}
+function decodeAttestationMap(raw, ctx) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`decodeAttestationMap[${ctx}]: expected a CBOR map`);
+    }
+    const obj = raw;
+    return {
+        attester_pubkey: requireBytes(obj, "attester_pubkey", ctx),
+        attester_ml_dsa_pubkey: requireBytes(obj, "attester_ml_dsa_pubkey", ctx),
+        attestation_type: requireString(obj, "attestation_type", ctx),
+        attestation_data: requireBytes(obj, "attestation_data", ctx),
+        created_at: requireTimestamp(obj, "created_at", ctx),
+        expires_at: requireTimestamp(obj, "expires_at", ctx),
+        attester_ml_dsa_signature: requireBytes(obj, "attester_ml_dsa_signature", ctx),
+    };
+}
+// ─── Internal utility ─────────────────────────────────────────────────────────
+/**
+ * Constant-time byte comparison.
+ */
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a[i] ^ b[i];
+    }
+    return diff === 0;
+}
+/**
+ * Coerce a CBOR-decoded value to Uint8Array.
+ * cbor-x with tagUint8Array:false returns Buffer (a Node.js Buffer is a Uint8Array subclass).
+ */
+function toUint8Array(v) {
+    if (v instanceof Uint8Array)
+        return v;
+    if (Buffer.isBuffer(v))
+        return new Uint8Array(v.buffer, v.byteOffset, v.byteLength);
+    return null;
+}
+//# sourceMappingURL=connection-package.js.map

package/dist/connection-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-package.js","sourceRoot":"","sources":["../src/connection-package.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AA+N9C,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;AAEvD,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC,kEAAkE;AAClE,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAE3C,gFAAgF;AAEhF;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,eAAuB,EACvB,cAA0B,EAC1B,cAA0B,EAC1B,aAAyB,EACzB,UAAkB;IAElB,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5E,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpC,eAAe;QACf,cAAc;QACd,cAAc;QACd,aAAa;QACb,SAAS;KACV,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,CAAiD;IAC5E,MAAM,cAAc,GAAG,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACvF,MAAM,cAAc,GAAG,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACvF,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,gBAAgB;QAClB,cAAc;QACd,cAAc;KACf,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,CAAiD;IAC5E,MAAM,cAAc,GAAG,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACvF,MAAM,cAAc,GAAG,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACvF,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,gBAAgB;QAClB,cAAc;QACd,cAAc;KACf,CAAC,CAAC,CAAC;AACN,CAAC;AAuBD,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAMC,EACD,gBAAkC;IAElC,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,UAAU,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAAG,wBAAwB,CAClC,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,UAAU,CAClB,CAAC;IAEF,MAAM,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE1D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE;YACP,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,gBAAgB;SACjB;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAyB,EACzB,WAA0B;IAE1B,MAAM,GAAG,GAAG,wBAAwB,CAClC,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,UAAU,CACnB,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAAwB,EACxB,WAA0B;IAE1B,MAAM,GAAG,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC7C,OAAO,WAAW,CAChB,WAAW,CAAC,sBAAsB,EAClC,GAAG,EACH,WAAW,CAAC,yBAAyB,CACtC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAAwB,EACxB,WAA0B;IAE1B,MAAM,GAAG,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC7C,OAAO,WAAW,CAChB,WAAW,CAAC,sBAAsB,EAClC,GAAG,EACH,WAAW,CAAC,yBAAyB,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAsB,EACtB,qBAAiC,EACjC,oBAA4B,EAC5B,WAA0B;IAE1B,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,UAAU,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IAED,6DAA6D;IAC7D,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC/D,CAAC;IAED,uDAAuD;IACvD,MAAM,qBAAqB,GAA2B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,mBAA4B,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,IAAI,oBAAoB,EAAE,CAAC;YACzC,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,SAAkB,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,iBAA0B,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,OAAgB,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,MAAM,qBAAqB,GAA2B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,mBAA4B,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,IAAI,oBAAoB,EAAE,CAAC;YACzC,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,SAAkB,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,OAAgB,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,IAAI;QACX,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,YAAY,EAAE,qBAAqB;QACnC,YAAY,EAAE,qBAAqB;KACpC,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAsB;IAC5D,OAAO,QAAQ,CAAC,MAAM,CAAC;QACrB,iBAAiB,EAAE,yBAAyB,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACnE,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACxD,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC;KACzD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,EAAU;IACjC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAmB;IACpD,OAAO;QACL,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QACzC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAc;IAC1C,OAAO;QACL,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,sBAAsB,EAAE,CAAC,CAAC,sBAAsB;QAChD,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QACzC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QACzC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAc;IAC1C,OAAO;QACL,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,sBAAsB,EAAE,CAAC,CAAC,sBAAsB;QAChD,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QACzC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QACzC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAiB;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAY,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE,yBAAyB,CAAC,CAClE,CAAC;IAEF,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,yBAAyB,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAChD,oBAAoB,CAAC,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAC9C,CAAC;IAEF,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,yBAAyB,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAChD,oBAAoB,CAAC,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAC9C,CAAC;IAEF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED,iFAAiF;AAEjF,SAAS,YAAY,CAAC,GAA4B,EAAE,GAAW,EAAE,GAAW;IAC1E,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,6BAA6B,GAAG,GAAG,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B,EAAE,GAAW,EAAE,GAAW;IAC1E,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,YAAY,GAAG,wBAAwB,OAAO,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,GAAW,EAAE,GAAW;IAC3E,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,YAAY,GAAG,oBAAoB,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA4B,EAAE,GAAW,EAAE,GAAW;IAC9E,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,YAAY,GAAG,yCAAyC,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,GAAG,GAAG,kBAAkB,CAAC;IAC/B,OAAO;QACL,eAAe,EAAE,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,CAAC;QAC3D,cAAc,EAAE,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC;QACxD,cAAc,EAAE,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC;QACxD,aAAa,EAAE,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC;QACtD,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY,EAAE,GAAW;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,wBAAwB,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,OAAO;QACL,eAAe,EAAE,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,CAAC;QAC1D,sBAAsB,EAAE,YAAY,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,CAAC;QACxE,aAAa,EAAE,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC;QACtD,gBAAgB,EAAE,aAAa,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC;QAC7D,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC;QACpD,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC;QACpD,yBAAyB,EAAE,YAAY,CAAC,GAAG,EAAE,2BAA2B,EAAE,GAAG,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY,EAAE,GAAW;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,wBAAwB,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,OAAO;QACL,eAAe,EAAE,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,CAAC;QAC1D,sBAAsB,EAAE,YAAY,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,CAAC;QACxE,gBAAgB,EAAE,aAAa,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC;QAC7D,gBAAgB,EAAE,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC;QAC5D,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC;QACpD,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC;QACpD,yBAAyB,EAAE,YAAY,CAAC,GAAG,EAAE,2BAA2B,EAAE,GAAG,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;GAEG;AACH,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC"}