@decionis/agent-safe-pipeline 0.1.4 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +169 -10
- package/dist/Index.d.ts +8 -0
- package/dist/Index.d.ts.map +1 -1
- package/dist/Index.js +7 -0
- package/dist/Index.js.map +1 -1
- package/dist/audit/AuditRecorder.d.ts +1 -1
- package/dist/audit/AuditRecorder.d.ts.map +1 -1
- package/dist/audit/AuditRecorder.js.map +1 -1
- package/dist/decision/CreateGate.d.ts +123 -0
- package/dist/decision/CreateGate.d.ts.map +1 -0
- package/dist/decision/CreateGate.js +211 -0
- package/dist/decision/CreateGate.js.map +1 -0
- package/dist/decision/DecionisGate.d.ts +18 -1
- package/dist/decision/DecionisGate.d.ts.map +1 -1
- package/dist/decision/DecionisGate.js +31 -3
- package/dist/decision/DecionisGate.js.map +1 -1
- package/dist/decision/DecisionAuthority.d.ts +26 -0
- package/dist/decision/DecisionAuthority.d.ts.map +1 -1
- package/dist/decision/DecisionAuthority.js.map +1 -1
- package/dist/decision/ImmutableGateDecision.d.ts.map +1 -1
- package/dist/decision/ImmutableGateDecision.js +8 -0
- package/dist/decision/ImmutableGateDecision.js.map +1 -1
- package/dist/decision/Provision.d.ts +33 -0
- package/dist/decision/Provision.d.ts.map +1 -0
- package/dist/decision/Provision.js +116 -0
- package/dist/decision/Provision.js.map +1 -0
- package/dist/decision/ShadowGate.d.ts +31 -0
- package/dist/decision/ShadowGate.d.ts.map +1 -0
- package/dist/decision/ShadowGate.js +79 -0
- package/dist/decision/ShadowGate.js.map +1 -0
- package/dist/execution/ActionRegistry.d.ts +29 -0
- package/dist/execution/ActionRegistry.d.ts.map +1 -1
- package/dist/execution/ActionRegistry.js +36 -1
- package/dist/execution/ActionRegistry.js.map +1 -1
- package/dist/execution/AuthorizationVerifier.d.ts +120 -1
- package/dist/execution/AuthorizationVerifier.d.ts.map +1 -1
- package/dist/execution/AuthorizationVerifier.js +180 -6
- package/dist/execution/AuthorizationVerifier.js.map +1 -1
- package/dist/execution/SafeExecutor.d.ts +32 -2
- package/dist/execution/SafeExecutor.d.ts.map +1 -1
- package/dist/execution/SafeExecutor.js +36 -1
- package/dist/execution/SafeExecutor.js.map +1 -1
- package/dist/http/ClientIdentification.d.ts +22 -0
- package/dist/http/ClientIdentification.d.ts.map +1 -0
- package/dist/http/ClientIdentification.js +44 -0
- package/dist/http/ClientIdentification.js.map +1 -0
- package/dist/http/Credential.d.ts +17 -0
- package/dist/http/Credential.d.ts.map +1 -0
- package/dist/http/Credential.js +5 -0
- package/dist/http/Credential.js.map +1 -0
- package/dist/http/StoredCredentials.d.ts +34 -0
- package/dist/http/StoredCredentials.d.ts.map +1 -0
- package/dist/http/StoredCredentials.js +85 -0
- package/dist/http/StoredCredentials.js.map +1 -0
- package/dist/intent/CanonicalIntentHasher.d.ts.map +1 -1
- package/dist/intent/CanonicalIntentHasher.js +3 -0
- package/dist/intent/CanonicalIntentHasher.js.map +1 -1
- package/dist/intent/ExecutionIntent.d.ts +13 -1
- package/dist/intent/ExecutionIntent.d.ts.map +1 -1
- package/dist/intent/ExecutionIntent.js +4 -0
- package/dist/intent/ExecutionIntent.js.map +1 -1
- package/dist/intent/IntentCapture.d.ts.map +1 -1
- package/dist/intent/IntentCapture.js +3 -0
- package/dist/intent/IntentCapture.js.map +1 -1
- package/dist/report/DecisionReport.d.ts +22 -0
- package/dist/report/DecisionReport.d.ts.map +1 -0
- package/dist/report/DecisionReport.js +37 -0
- package/dist/report/DecisionReport.js.map +1 -0
- package/dist/report/DossierReport.d.ts +43 -0
- package/dist/report/DossierReport.d.ts.map +1 -0
- package/dist/report/DossierReport.js +130 -0
- package/dist/report/DossierReport.js.map +1 -0
- package/dist/report/HostedOutcome.d.ts +18 -0
- package/dist/report/HostedOutcome.d.ts.map +1 -0
- package/dist/report/HostedOutcome.js +24 -0
- package/dist/report/HostedOutcome.js.map +1 -0
- package/dist/testing/Index.d.ts +1 -1
- package/dist/testing/Index.d.ts.map +1 -1
- package/dist/testing/Index.js +1 -1
- package/dist/testing/Index.js.map +1 -1
- package/dist/testing/LocalAuthority.d.ts +89 -0
- package/dist/testing/LocalAuthority.d.ts.map +1 -1
- package/dist/testing/LocalAuthority.js +334 -9
- package/dist/testing/LocalAuthority.js.map +1 -1
- package/package.json +1 -1
package/dist/testing/Index.d.ts
CHANGED
|
@@ -8,5 +8,5 @@
|
|
|
8
8
|
export { FixtureAuthorizationVerifier, FixtureDecisionAuthority, createFixtureAuthorityPair, type FixtureAuthorityPair, type FixtureCommitRecord, type FixtureVerdictResolver, type UnsafeFixtureAuthorityOptions, } from "../decision/FixtureDecisionAuthority.js";
|
|
9
9
|
export { InMemoryReplayStore } from "../execution/ReplayStore.js";
|
|
10
10
|
export { LocalPresence, LOCAL_PRESENCE_API_KEY, readBody, type LocalAuthenticator, type LocalCeremonyResponse, type LocalPresenceOptions, type LocalPresenceRequestRecord, type LocalReceipt, type LocalReceiptBinding, type LocalReceiptVerification, type LocalVerificationRecord, type LocalVerificationStatus, } from "./LocalPresence.js";
|
|
11
|
-
export { AUTONOMOUS_LIMIT_MINOR, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, hashBinding, stableStringify, type LocalAuthorityOptions, type LocalAuthorityPolicy, type LocalAuthorityRequestRecord, type LocalGrantRecord, type LocalManagedEscalationRecord, type LocalRouteOverride, } from "./LocalAuthority.js";
|
|
11
|
+
export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, type LocalAuthorityOptions, type LocalClaimAttestationClaims, type LocalAuthorityPolicy, type LocalAuthorityRequestRecord, type LocalGrantRecord, type LocalManagedEscalationRecord, type LocalRouteOverride, } from "./LocalAuthority.js";
|
|
12
12
|
//# sourceMappingURL=Index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Index.d.ts","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,EACR,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC"}
|
|
1
|
+
{"version":3,"file":"Index.d.ts","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,EACR,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC"}
|
package/dist/testing/Index.js
CHANGED
|
@@ -8,5 +8,5 @@
|
|
|
8
8
|
export { FixtureAuthorizationVerifier, FixtureDecisionAuthority, createFixtureAuthorityPair, } from "../decision/FixtureDecisionAuthority.js";
|
|
9
9
|
export { InMemoryReplayStore } from "../execution/ReplayStore.js";
|
|
10
10
|
export { LocalPresence, LOCAL_PRESENCE_API_KEY, readBody, } from "./LocalPresence.js";
|
|
11
|
-
export { AUTONOMOUS_LIMIT_MINOR, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, hashBinding, stableStringify, } from "./LocalAuthority.js";
|
|
11
|
+
export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, } from "./LocalAuthority.js";
|
|
12
12
|
//# sourceMappingURL=Index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,GAK3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,GAUT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,eAAe,
|
|
1
|
+
{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,GAK3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,GAUT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,GAQhB,MAAM,qBAAqB,CAAC"}
|
|
@@ -3,6 +3,11 @@ import { type LocalPresence } from "./LocalPresence.js";
|
|
|
3
3
|
export declare const LOCAL_AUTHORITY_API_KEY = "test-key";
|
|
4
4
|
export declare const AUTONOMOUS_LIMIT_MINOR = 10000;
|
|
5
5
|
export declare const HUMAN_LIMIT_MINOR = 100000;
|
|
6
|
+
/** The issuer the fixture's grants and attestations name; a provider double checks it. */
|
|
7
|
+
export declare const LOCAL_AUTHORITY_ISSUER = "synthetic-authority";
|
|
8
|
+
/** Where the fixture publishes its attestation key, at the path Decionis documents. */
|
|
9
|
+
export declare const LOCAL_AUTHORITY_JWKS_PATH = "/.well-known/decionis-execution-grant-jwks.json";
|
|
10
|
+
export declare const CLAIM_ATTESTATION_TYPE = "decionis-claim-attestation+jwt";
|
|
6
11
|
/** `ExecutionAuthorityRequest`: the binding plus hash, mode, evidence, and managed constraints. */
|
|
7
12
|
declare const AuthorityRequestSchema: z.ZodObject<{
|
|
8
13
|
intent_hash: z.ZodString;
|
|
@@ -57,6 +62,7 @@ declare const AuthorityRequestSchema: z.ZodObject<{
|
|
|
57
62
|
operation: z.ZodString;
|
|
58
63
|
endpoint: z.ZodOptional<z.ZodString>;
|
|
59
64
|
}, z.core.$strict>;
|
|
65
|
+
expected_effect_digest: z.ZodOptional<z.ZodString>;
|
|
60
66
|
}, z.core.$strict>;
|
|
61
67
|
export type LocalAuthorityRequest = z.infer<typeof AuthorityRequestSchema>;
|
|
62
68
|
type Verdict = "ALLOW" | "ESCALATE" | "BLOCK";
|
|
@@ -102,6 +108,10 @@ export interface LocalGrantRecord {
|
|
|
102
108
|
readonly expiresAt: number;
|
|
103
109
|
readonly nonce: string;
|
|
104
110
|
readonly bindingDigest: string;
|
|
111
|
+
/** The digest the authority bound over the canonical action parameters. */
|
|
112
|
+
readonly payloadDigest: string;
|
|
113
|
+
/** The expected-effect digest committed at enforce-and-bind; null when none was bound. */
|
|
114
|
+
readonly expectedEffectDigest: string | null;
|
|
105
115
|
/** Present for direct grants issued on client-supplied evidence; null for managed grants. */
|
|
106
116
|
readonly receiptDossierId: string | null;
|
|
107
117
|
claimed: boolean;
|
|
@@ -135,7 +145,46 @@ export interface LocalAuthorityOptions {
|
|
|
135
145
|
readonly policy?: LocalAuthorityPolicy;
|
|
136
146
|
/** Subject routed to for a managed escalation without an approver principal. */
|
|
137
147
|
readonly managedApproverId?: string;
|
|
148
|
+
/**
|
|
149
|
+
* API-key identities this deployment accepts as effect observers, mirroring
|
|
150
|
+
* `DECIONIS_TRUSTED_EFFECT_OBSERVER_API_KEY_IDS`. Empty by default, exactly as
|
|
151
|
+
* the hosted authority is by default, so `CONFIRMED` evidence is refused
|
|
152
|
+
* unless a test opts in. As in the hosted route, the allowlist is intersected
|
|
153
|
+
* with the caller's own authenticated identity — this double's `apiKey` — so
|
|
154
|
+
* naming any other id confirms nothing.
|
|
155
|
+
*/
|
|
156
|
+
readonly trustedEffectObserverIds?: readonly string[];
|
|
138
157
|
readonly clock?: () => number;
|
|
158
|
+
/**
|
|
159
|
+
* Attach a verification envelope to every decision, as the hosted
|
|
160
|
+
* `evaluate-decision` does and `enforce-and-bind` may: a page URL under
|
|
161
|
+
* this double's own origin, so a test can see the link travel end to end.
|
|
162
|
+
*/
|
|
163
|
+
readonly verificationLinks?: boolean;
|
|
164
|
+
}
|
|
165
|
+
/** The organization a provisioned synthetic workspace belongs to. */
|
|
166
|
+
export declare const LOCAL_AUTHORITY_PROVISIONAL_ORG_ID = "00000000-0000-4000-8000-000000000008";
|
|
167
|
+
/** What one claim attestation says, as the fixture signs it and a provider double reads it. */
|
|
168
|
+
export interface LocalClaimAttestationClaims {
|
|
169
|
+
readonly iss: string;
|
|
170
|
+
readonly sub: string;
|
|
171
|
+
readonly org_id: string;
|
|
172
|
+
readonly dossier_id: string;
|
|
173
|
+
readonly decision_id: string;
|
|
174
|
+
readonly binding: {
|
|
175
|
+
readonly intent_hash: string;
|
|
176
|
+
readonly execution_payload_digest: string;
|
|
177
|
+
readonly execution_payload_canonicalization_profile: string;
|
|
178
|
+
readonly expected_effect_digest?: string;
|
|
179
|
+
readonly execution_nonce: string;
|
|
180
|
+
readonly execution_correlation_id: string;
|
|
181
|
+
};
|
|
182
|
+
readonly claim_token_digest: string;
|
|
183
|
+
readonly claim_validated_at: string;
|
|
184
|
+
readonly jti: string;
|
|
185
|
+
readonly iat: number;
|
|
186
|
+
readonly nbf: number;
|
|
187
|
+
readonly exp: number;
|
|
139
188
|
}
|
|
140
189
|
/**
|
|
141
190
|
* Independent canonicalization: keys sorted by UTF-16 code unit, values encoded
|
|
@@ -156,14 +205,38 @@ export declare class LocalAuthority {
|
|
|
156
205
|
private readonly legacyVerifyReceipt;
|
|
157
206
|
private readonly policy;
|
|
158
207
|
private readonly managedApproverId;
|
|
208
|
+
private readonly trustedEffectObserverIds;
|
|
159
209
|
private readonly clock;
|
|
210
|
+
private readonly attestationKey;
|
|
211
|
+
/** The `kid` the fixture's attestations name; a provider double looks it up in the JWKS. */
|
|
212
|
+
readonly attestationKeyId = "synthetic-exec-grant-1";
|
|
213
|
+
/**
|
|
214
|
+
* A drill knob: when set, the next claim binds a digest over parameters
|
|
215
|
+
* other than the ones captured, which is what a tampered or mismatched
|
|
216
|
+
* authority looks like from the executor's side, and what BEAP-L3-BND-01
|
|
217
|
+
* says the executor must refuse.
|
|
218
|
+
*/
|
|
219
|
+
misbindNextPayloadDigest: boolean;
|
|
160
220
|
private readonly overrides;
|
|
161
221
|
private readonly managedByIntent;
|
|
162
222
|
private nextManagedLifecycle;
|
|
163
223
|
private decisions;
|
|
224
|
+
/** Every decision minted, by dossier id, for `GET /v1/protocol/dossiers/{id}`. */
|
|
225
|
+
private readonly dossiers;
|
|
226
|
+
private readonly verificationLinks;
|
|
164
227
|
private server;
|
|
165
228
|
private port;
|
|
166
229
|
constructor(options?: LocalAuthorityOptions);
|
|
230
|
+
/** The fixture's JWKS, as `GET /.well-known/decionis-execution-grant-jwks.json` serves it. */
|
|
231
|
+
get jwks(): {
|
|
232
|
+
readonly keys: readonly Record<string, unknown>[];
|
|
233
|
+
};
|
|
234
|
+
/**
|
|
235
|
+
* A compact JWS over the claim, signed the way Decionis signs one: EdDSA,
|
|
236
|
+
* the grant key, the attestation type in the protected header. Built with
|
|
237
|
+
* `node:crypto` alone so the fixture stays an independent implementation.
|
|
238
|
+
*/
|
|
239
|
+
private attest;
|
|
167
240
|
get baseUrl(): string;
|
|
168
241
|
start(): Promise<void>;
|
|
169
242
|
stop(): Promise<void>;
|
|
@@ -177,6 +250,15 @@ export declare class LocalAuthority {
|
|
|
177
250
|
scriptNextManagedLifecycle(statuses: readonly LifecycleEntry[]): void;
|
|
178
251
|
private handle;
|
|
179
252
|
private enforceAndBind;
|
|
253
|
+
/** Keeps a minted decision for its dossier route, with the envelope when links are on. */
|
|
254
|
+
private remember;
|
|
255
|
+
/**
|
|
256
|
+
* The persisted record, shaped as `GET /v1/protocol/dossiers/{id}` returns
|
|
257
|
+
* it: a payload with the routing decision, the inputs and a proof bundle
|
|
258
|
+
* naming this double's key. The artifacts are not signed; the record says
|
|
259
|
+
* so in its issuer tier, and nothing here claims otherwise.
|
|
260
|
+
*/
|
|
261
|
+
private dossierRecord;
|
|
180
262
|
/** Policy plus evidence handling: a valid receipt turns an escalation into an allow. */
|
|
181
263
|
private evaluate;
|
|
182
264
|
private verifyEvidence;
|
|
@@ -193,6 +275,13 @@ export declare class LocalAuthority {
|
|
|
193
275
|
private cancelManaged;
|
|
194
276
|
private claim;
|
|
195
277
|
private finalize;
|
|
278
|
+
/**
|
|
279
|
+
* The hosted route never trusts the allowlist alone: it returns at most the
|
|
280
|
+
* caller's own authenticated API-key identity, so a confirmed observation
|
|
281
|
+
* must name the identity that presented the credential. This double has one
|
|
282
|
+
* credential, so that credential is its identity.
|
|
283
|
+
*/
|
|
284
|
+
private effectObserverIds;
|
|
196
285
|
/** Recomputes the hash independently and applies the contract's time rules. */
|
|
197
286
|
private assertBinding;
|
|
198
287
|
private respond;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"LocalAuthority.d.ts","sourceRoot":"","sources":["../../src/testing/LocalAuthority.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"LocalAuthority.d.ts","sourceRoot":"","sources":["../../src/testing/LocalAuthority.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAClD,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAQzC,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAC5D,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAC3F,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AA2HvE,mGAAmG;AACnG,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AA2BH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,KAAK,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAC9C,KAAK,aAAa,GACd,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,SAAS,GACT,UAAU,GACV,SAAS,GACT,WAAW,GACX,QAAQ,CAAC;AACb,KAAK,cAAc,GAAG,aAAa,GAAG;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AACxF,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOxC,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,WAAW,GAAG,QAAQ,GAAG,eAAe,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gGAAgG;IAChG,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAC3E,UAAU,EAAE,MAAM,KACf,OAAO,CAAC;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,qEAAqE;AACrE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAEzF,+FAA+F;AAC/F,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;QAC1C,QAAQ,CAAC,0CAA0C,EAAE,MAAM,CAAC;QAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QACzC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAStD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAyBD,qBAAa,cAAc;IACzB,oFAAoF;IACpF,SAAgB,QAAQ,EAAE,2BAA2B,EAAE,CAAM;IAC7D,8CAA8C;IAC9C,SAAgB,MAAM,gCAAuC;IAC7D,4DAA4D;IAC5D,SAAgB,WAAW,4CAAmD;IAC9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyC;IAC7E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAoB;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG7B;IACF,4FAA4F;IAC5F,SAAgB,gBAAgB,4BAA4B;IAC5D;;;;;OAKG;IACI,wBAAwB,UAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAKxB;IACF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmD;IACnF,OAAO,CAAC,oBAAoB,CAAiC;IAC7D,OAAO,CAAC,SAAS,CAAK;IACtB,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGrB;IACJ,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;IAC5C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;gBAEE,OAAO,GAAE,qBAA0B;IAiBtD,8FAA8F;IAC9F,IAAW,IAAI,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAMvE;IAED;;;;OAIG;IACH,OAAO,CAAC,MAAM;IA+Cd,IAAW,OAAO,IAAI,MAAM,CAE3B;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQlC;;;;OAIG;IACI,UAAU,CAAC,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAIjF,6FAA6F;IACtF,0BAA0B,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;YAI9D,MAAM;IAuFpB,OAAO,CAAC,cAAc;IA2BtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ;IAkBhB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA0CrB,wFAAwF;IACxF,OAAO,CAAC,QAAQ;IA6BhB,OAAO,CAAC,cAAc;IAgBtB,OAAO,CAAC,YAAY;IA+BpB,OAAO,CAAC,aAAa;IA+CrB,qGAAqG;IACrG,OAAO,CAAC,WAAW;IAgDnB,iGAAiG;IACjG,OAAO,CAAC,eAAe;IAiDvB,OAAO,CAAC,aAAa;IA8CrB,OAAO,CAAC,QAAQ;IA8BhB,qFAAqF;IACrF,OAAO,CAAC,OAAO;IAqDf,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,KAAK;IA+Fb,OAAO,CAAC,QAAQ;IAiEhB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAIzB,+EAA+E;IAC/E,OAAO,CAAC,aAAa;YAiBP,OAAO;IAmCrB,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,MAAM,CAAC,UAAU;CAU1B"}
|