@devorash/core 0.1.0

package/dist/security/signing.js

@@ -0,0 +1,297 @@
+/**
+ * Devora request signing, version 3.
+ *
+ * The signature covers the exact bytes on the wire: raw path, raw query and a
+ * SHA-256 of the raw body, plus the direction the request travels in. Every
+ * header has one accepted spelling. The canonical string joins fields with
+ * `\n`; each field's grammar excludes `\n`, so the encoding is injective.
+ *
+ * This module is pure (no hashing): runtimes supply SHA-256 and HMAC.
+ * Conformance vectors: packages/sdks/test/signing-v3-vectors.json.
+ *
+ * @module @devorash/core/security/signing
+ */
+import { SECURITY_HEADERS } from "../constants/index.js";
+export const SIGNING = {
+    VERSION: "3",
+    ALGORITHM: "DEVORA-HMAC-SHA256",
+    /** Devora backend -> customer backend (the SDK verifies). */
+    DEVORA_TO_CUSTOMER: "devora-to-customer",
+    /** Customer backend SDK -> Devora backend (Devora verifies). */
+    CUSTOMER_TO_DEVORA: "customer-to-devora",
+    /** SHA-256 of an empty body. */
+    EMPTY_BODY_SHA256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+};
+/** Exact header grammars. (?![\s\S]) requires the actual end of input;
+ * JavaScript's $ also accepts a position before a final newline. */
+export const SIGNED_HEADER_PATTERNS = {
+    signatureVersion: /^3(?![\s\S])/,
+    keyId: /^pk_server_live_[A-Za-z0-9_-]{32}(?![\s\S])/,
+    orgId: /^[A-Za-z0-9_-]{1,128}(?![\s\S])/,
+    sentAt: /^[1-9][0-9]{9}(?![\s\S])/,
+    requestId: /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}(?![\s\S])/,
+    signature: /^[0-9a-f]{64}(?![\s\S])/,
+    method: /^[A-Z]{3,7}(?![\s\S])/,
+    bodySha256: /^[0-9a-f]{64}(?![\s\S])/,
+    /** The full secret string; its ASCII bytes are the HMAC key. */
+    secretKey: /^sk_server_live_[A-Za-z0-9_-]{64}(?![\s\S])/,
+};
+const UNRESERVED = /[A-Za-z0-9\-_.~]/;
+const encoder = new TextEncoder();
+/** UTF-8 percent-encode every byte outside `A-Z a-z 0-9 - _ . ~`, with uppercase hex. */
+export function strictEncode(value) {
+    // TextEncoder silently replaces lone surrogates; Python rejects them. Never
+    // sign a different identifier from the string the caller supplied.
+    encodeURIComponent(value);
+    let out = "";
+    for (const byte of encoder.encode(value)) {
+        const char = String.fromCharCode(byte);
+        out += UNRESERVED.test(char) ? char : `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+    }
+    return out;
+}
+/**
+ * Encode one path parameter. `""`, `.` and `..` are refused: URL parsers
+ * remove dot segments (even `%2E%2E`), so they cannot be sent as signed.
+ */
+export function encodePathParam(value) {
+    if (value === "" || value === "." || value === "..")
+        throw new Error("Devora signing: unroutable path parameter");
+    return strictEncode(value);
+}
+/** Strict-encoded `key=value` pairs, in the given order (the order is signed). */
+export function buildStrictQuery(pairs) {
+    return pairs.map(([key, value]) => `${strictEncode(key)}=${strictEncode(value)}`).join("&");
+}
+/** Printable ASCII where every `%` starts an uppercase two-digit escape. */
+function isStrictAscii(value) {
+    return !/[^\x21-\x7E]/.test(value) && !/%(?![0-9A-F]{2})/.test(value);
+}
+/**
+ * A raw request path as signed: absolute, printable ASCII, uppercase escapes,
+ * and no empty or dot segments.
+ */
+export function isValidSignedPath(path) {
+    if (!path.startsWith("/") || !isStrictAscii(path) || path.length > 8192 || /[?#\\]/.test(path))
+        return false;
+    try {
+        decodeURIComponent(path);
+    }
+    catch {
+        return false;
+    }
+    if (path === "/")
+        return true;
+    return path
+        .slice(1)
+        .split("/")
+        .every((segment) => {
+        const dots = segment.replace(/%2E/g, ".");
+        return dots !== "" && dots !== "." && dots !== "..";
+    });
+}
+/** A raw query as signed: printable ASCII, no fragment, uppercase escapes. */
+export function isValidSignedQuery(query) {
+    if (query.includes("#") || !isStrictAscii(query) || query.length > 8192)
+        return false;
+    try {
+        decodeURIComponent(query);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Build the canonical string. Throws if any field is outside its grammar. */
+export function buildCanonicalString(fields) {
+    const checks = [
+        [
+            fields.direction === SIGNING.DEVORA_TO_CUSTOMER ||
+                fields.direction === SIGNING.CUSTOMER_TO_DEVORA,
+            "direction",
+        ],
+        [SIGNED_HEADER_PATTERNS.keyId.test(fields.keyId), "key id"],
+        [SIGNED_HEADER_PATTERNS.orgId.test(fields.orgId), "org id"],
+        [SIGNED_HEADER_PATTERNS.sentAt.test(fields.sentAt), "sent-at"],
+        [SIGNED_HEADER_PATTERNS.requestId.test(fields.requestId), "request id"],
+        [SIGNED_HEADER_PATTERNS.method.test(fields.method), "method"],
+        [isValidSignedPath(fields.path), "path"],
+        [isValidSignedQuery(fields.query), "query"],
+        [SIGNED_HEADER_PATTERNS.bodySha256.test(fields.bodySha256), "body digest"],
+    ];
+    const invalid = checks.find(([ok]) => !ok);
+    if (invalid)
+        throw new Error(`Devora signing: invalid ${invalid[1]}`);
+    return [
+        SIGNING.ALGORITHM,
+        SIGNING.VERSION,
+        fields.direction,
+        fields.keyId,
+        fields.orgId,
+        fields.sentAt,
+        fields.requestId,
+        fields.method,
+        fields.path,
+        fields.query,
+        fields.bodySha256,
+    ].join("\n");
+}
+/**
+ * The single value of a header, or `null` when it is present more than once
+ * (an array, or a comma-joined value that the grammar then rejects).
+ */
+export function getSingleHeader(headers, name) {
+    const values = [];
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() !== name || value === undefined)
+            continue;
+        values.push(...(Array.isArray(value) ? value : [value]));
+    }
+    if (values.length > 1)
+        return null;
+    return values[0];
+}
+/** Parse and validate the signature headers. Never first-wins, never trims. */
+export function parseSignatureHeaders(headers) {
+    const read = (name) => getSingleHeader(headers, name);
+    const version = read(SECURITY_HEADERS.SIGNATURE_VERSION);
+    const values = {
+        keyId: read(SECURITY_HEADERS.KEY_ID),
+        orgId: read(SECURITY_HEADERS.ORG_ID),
+        sentAt: read(SECURITY_HEADERS.SENT_AT),
+        requestId: read(SECURITY_HEADERS.REQUEST_ID),
+        signature: read(SECURITY_HEADERS.SIGNATURE),
+    };
+    if (typeof version === "string" && version !== SIGNING.VERSION && /^\d+(?![\s\S])/.test(version))
+        return {
+            valid: false,
+            errorCode: "UNSUPPORTED_SIGNATURE_VERSION",
+            error: "Unsupported signature version",
+        };
+    const ok = typeof version === "string" &&
+        SIGNED_HEADER_PATTERNS.signatureVersion.test(version) &&
+        Object.keys(values).every((key) => {
+            const value = values[key];
+            return typeof value === "string" && SIGNED_HEADER_PATTERNS[key].test(value);
+        });
+    if (!ok)
+        return {
+            valid: false,
+            errorCode: "INVALID_SIGNATURE_HEADERS",
+            error: "Missing, duplicate or malformed signature headers",
+        };
+    return { valid: true, headers: values };
+}
+/** Accept only an absent or `identity` Content-Encoding (the body digest is over wire bytes). */
+export function hasIdentityContentEncoding(headers) {
+    const value = getSingleHeader(headers, "content-encoding");
+    return value === undefined || value === "identity";
+}
+/** Replay-store namespace: version, direction and key. */
+export function replayNamespace(direction, keyId) {
+    return `v${SIGNING.VERSION}:${direction}:${keyId}`;
+}
+/**
+ * Nonce lifetime covering the whole acceptance window: the floor second of the
+ * timestamp check plus one second of clock jitter.
+ */
+export function replayExpiresAtMs(sentAt, nowSeconds, toleranceSeconds) {
+    return (Math.max(nowSeconds, sentAt) + toleranceSeconds + 2) * 1000;
+}
+/**
+ * Parse a verified raw query into a null-prototype map. Repeated keys become
+ * arrays in wire order; `__proto__` and `constructor` are ordinary keys.
+ */
+export function parseVerifiedQuery(query) {
+    const result = Object.create(null);
+    for (const [key, value] of new URLSearchParams(query)) {
+        const existing = result[key];
+        if (existing === undefined)
+            result[key] = value;
+        else if (Array.isArray(existing))
+            existing.push(value);
+        else
+            result[key] = [existing, value];
+    }
+    return result;
+}
+/**
+ * Decode a verified body: empty means `undefined`; otherwise it must be JSON
+ * (declared `application/json`) and strictly valid UTF-8.
+ */
+export function parseVerifiedJsonBody(bytes, contentType) {
+    if (bytes.byteLength === 0)
+        return { ok: true, value: undefined };
+    if (!contentType || !/^application\/json(\s*;.*)?(?![\s\S])/i.test(contentType.trim()))
+        return { ok: false, error: "Signed request bodies must be application/json" };
+    try {
+        const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+        const value = JSON.parse(text, (_key, item) => {
+            if (typeof item === "number" && !Number.isFinite(item))
+                throw new Error("Non-finite number");
+            if (item !== null && typeof item === "object" && !Array.isArray(item))
+                Object.setPrototypeOf(item, null);
+            return item;
+        });
+        if (hasDuplicateJsonKeys(text))
+            return { ok: false, error: "Duplicate JSON key" };
+        return { ok: true, value };
+    }
+    catch {
+        return { ok: false, error: "Invalid JSON body" };
+    }
+}
+/** Scan valid JSON, comparing decoded keys separately in each object. */
+function hasDuplicateJsonKeys(text) {
+    const stack = [];
+    let expectKey = false;
+    for (let index = 0; index < text.length; index++) {
+        const char = text[index];
+        if (char === "{") {
+            stack.push(new Set());
+            expectKey = true;
+        }
+        else if (char === "[") {
+            stack.push(null);
+            expectKey = false;
+        }
+        else if (char === "}" || char === "]") {
+            stack.pop();
+            expectKey = false;
+        }
+        else if (char === ",")
+            expectKey = stack[stack.length - 1] != null;
+        else if (char === ":")
+            expectKey = false;
+        else if (char === '"') {
+            let end = index + 1;
+            while (text[end] !== '"')
+                end += text[end] === "\\" ? 2 : 1;
+            if (expectKey) {
+                const keys = stack[stack.length - 1];
+                const key = JSON.parse(text.slice(index, end + 1));
+                if (keys.has(key))
+                    return true;
+                keys.add(key);
+                expectKey = false;
+            }
+            index = end;
+        }
+    }
+    return false;
+}
+/**
+ * Last `count` segments of a raw path, i.e. the path relative to a mount whose
+ * route template has `count` segments. `null` when the path is shorter.
+ */
+export function routeRelativePath(rawPath, routeTemplate) {
+    const count = routeTemplate.split("/").filter(Boolean).length;
+    if (count === 0)
+        return "/";
+    const segments = rawPath.split("/");
+    // segments[0] is "" for an absolute path; the tail must be `count` segments.
+    if (segments.length - 1 < count)
+        return null;
+    return `/${segments.slice(segments.length - count).join("/")}`;
+}
+//# sourceMappingURL=signing.js.map

package/dist/security/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/security/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,OAAO,GAAG;IACtB,OAAO,EAAE,GAAG;IACZ,SAAS,EAAE,oBAAoB;IAC/B,6DAA6D;IAC7D,kBAAkB,EAAE,oBAAoB;IACxC,gEAAgE;IAChE,kBAAkB,EAAE,oBAAoB;IACxC,gCAAgC;IAChC,iBAAiB,EAAE,kEAAkE;CAC5E,CAAA;AAIV;oEACoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,gBAAgB,EAAE,cAAc;IAChC,KAAK,EAAE,6CAA6C;IACpD,KAAK,EAAE,iCAAiC;IACxC,MAAM,EAAE,0BAA0B;IAClC,SAAS,EAAE,gFAAgF;IAC3F,SAAS,EAAE,yBAAyB;IACpC,MAAM,EAAE,uBAAuB;IAC/B,UAAU,EAAE,yBAAyB;IACrC,gEAAgE;IAChE,SAAS,EAAE,6CAA6C;CAC/C,CAAA;AA2CV,MAAM,UAAU,GAAG,kBAAkB,CAAA;AACrC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,KAAa;IACzC,4EAA4E;IAC5E,mEAAmE;IACnE,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACzB,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACtC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;IAC7F,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC5C,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI;QAClD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC7D,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,KAA+C;IAC/E,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC5F,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7F,OAAO,KAAK,CAAA;IACb,IAAI,CAAC;QACJ,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;IACD,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC7B,OAAO,IAAI;SACT,KAAK,CAAC,CAAC,CAAC;SACR,KAAK,CAAC,GAAG,CAAC;SACV,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;QAClB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACzC,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAA;IACrF,IAAI,CAAC;QACJ,kBAAkB,CAAC,KAAK,CAAC,CAAA;QACzB,OAAO,IAAI,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC3D,MAAM,MAAM,GAA6B;QACxC;YACC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,kBAAkB;gBAC9C,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,kBAAkB;YAChD,WAAW;SACX;QACD,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;QAC3D,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;QAC3D,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;QAC9D,CAAC,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC;QACvE,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;QAC7D,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACxC,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAC3C,CAAC,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;KAC1E,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;IAC1C,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACrE,OAAO;QACN,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,OAAO;QACf,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,KAAK;QACZ,MAAM,CAAC,KAAK;QACZ,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,KAAK;QACZ,MAAM,CAAC,UAAU;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAkB,EAAE,IAAY;IAC/D,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CAAC,OAAkB;IACvD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG;QACd,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACpC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;QACtC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;KAC3C,CAAA;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/F,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,+BAA+B;YAC1C,KAAK,EAAE,+BAA+B;SACtC,CAAA;IACF,MAAM,EAAE,GACP,OAAO,OAAO,KAAK,QAAQ;QAC3B,sBAAsB,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAgC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;IACH,IAAI,CAAC,EAAE;QACN,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,2BAA2B;YACtC,KAAK,EAAE,mDAAmD;SAC1D,CAAA;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAA0B,EAAE,CAAA;AAC5D,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,0BAA0B,CAAC,OAAkB;IAC5D,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IAC1D,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,UAAU,CAAA;AACnD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,SAA2B,EAAE,KAAa;IACzE,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,SAAS,IAAI,KAAK,EAAE,CAAA;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAChC,MAAc,EACd,UAAkB,EAClB,gBAAwB;IAExB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAA;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;aAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;;YACjD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACpC,KAAiB,EACjB,WAAsC;IAEtC,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACjE,IAAI,CAAC,WAAW,IAAI,CAAC,wCAAwC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAA;IAC9E,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACrF,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAa,EAAE,EAAE;YAC/D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;YAC5F,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACpE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAClC,OAAO,IAAI,CAAA;QACZ,CAAC,CAAC,CAAA;QACF,IAAI,oBAAoB,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAA;QACjF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACjD,CAAC;AACF,CAAC;AAED,yEAAyE;AACzE,SAAS,oBAAoB,CAAC,IAAY;IACzC,MAAM,KAAK,GAA8B,EAAE,CAAA;IAC3C,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACxB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAA;YACrB,SAAS,GAAG,IAAI,CAAA;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChB,SAAS,GAAG,KAAK,CAAA;QAClB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzC,KAAK,CAAC,GAAG,EAAE,CAAA;YACX,SAAS,GAAG,KAAK,CAAA;QAClB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAA;aAC/D,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS,GAAG,KAAK,CAAA;aACnC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC,CAAA;YACnB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG;gBAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;gBACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAW,CAAA;gBAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAA;gBAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACb,SAAS,GAAG,KAAK,CAAA;YAClB,CAAC;YACD,KAAK,GAAG,GAAG,CAAA;QACZ,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,aAAqB;IACvE,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;IAC7D,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,GAAG,CAAA;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnC,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK;QAAE,OAAO,IAAI,CAAA;IAC5C,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AAC/D,CAAC"}