@dharma-ai-labs/agent-fabric 0.2.109 → 0.2.111

package/dist/demoSigningTrust.js

@@ -0,0 +1,326 @@
+import { createHash, createPublicKey } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { canonicalize, verifyInitialServerSigningKeyset, verifyServerSigningKeysetUpdate, validateTrustedServerSigningKeysetContract } from '@dharma-ai-labs/agent-fabric-contracts';
+import { createSystemSecureStore } from '@dharma-ai-labs/agent-fabric-secure-store';
+let approvalValidator;
+function enrollmentApprovalValidator() {
+    return approvalValidator ??= (async () => {
+        const ajv = new Ajv2020({ allErrors: true, strict: true });
+        const addFormats = createRequire(import.meta.url)('ajv-formats').default;
+        addFormats(ajv);
+        return ajv.compile(JSON.parse(await readFile(new URL('./schemas/demo-enrollment-approval.schema.json', import.meta.url), 'utf8')));
+    })();
+}
+let updateValidator;
+function signingUpdateValidator() {
+    return updateValidator ??= (async () => {
+        const ajv = new Ajv2020({ allErrors: true, strict: true });
+        const addFormats = createRequire(import.meta.url)('ajv-formats').default;
+        addFormats(ajv);
+        for (const file of ['server-signing-keyset', 'demo-signing-update']) {
+            ajv.addSchema(JSON.parse(await readFile(new URL(`./schemas/${file}.schema.json`, import.meta.url), 'utf8')));
+        }
+        return ajv.getSchema('https://schemas.dharma-ai.io/demo-signing-update/v1');
+    })();
+}
+function failure(reason) {
+    throw new Error(`Demo signing trust rejected: ${reason}. Use browser-authorized re-enrollment if trust has expired.`);
+}
+function binding(config) {
+    return { schema: 'dharma.demo-signing-anchor/v1', hqUrl: config.hqUrl,
+        organizationId: config.organizationId, repositoryId: config.repositoryId,
+        normalizedRepository: config.normalizedRepository, installationId: config.installationId,
+        deviceId: config.deviceId, publicKeyEd25519: config.publicKeyEd25519,
+        enrolledAt: config.enrolledAt, serverPublicKeyEd25519: config.serverPublicKeyEd25519 };
+}
+function accountFor(config) {
+    return `demo-signing-${createHash('sha256').update(canonicalize({ hqUrl: config.hqUrl,
+        organizationId: config.organizationId, repositoryId: config.repositoryId,
+        installationId: config.installationId, deviceId: config.deviceId })).digest('hex').slice(0, 32)}`;
+}
+function checkKeyset(keyset, org, now, pin) {
+    if (!validateTrustedServerSigningKeysetContract(keyset).ok)
+        failure('schema_invalid');
+    const signer = keyset.keys.find(k => k.keyVersion === keyset.signedByKeyVersion);
+    if (!signer || signer.status !== 'active' || keyset.keys.filter(k => k.status === 'active').length !== 1
+        || new Set(keyset.keys.map(k => k.keyVersion)).size !== keyset.keys.length
+        || Date.parse(signer.notBefore) > now.getTime() || Date.parse(signer.notAfter) < Date.parse(keyset.expiresAt)) {
+        failure('signing_roles_or_lifetime_invalid');
+    }
+    // A self-signature is sufficient only after authority has come from the OS
+    // anchor or a verified predecessor. It never establishes a new enrollment pin.
+    const key = createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: pin ?? signer.publicKeyEd25519 }, format: 'jwk' });
+    const verification = verifyInitialServerSigningKeyset(keyset, key, org, now);
+    if (!verification.ok)
+        failure(verification.reason ?? 'invalid_keyset');
+}
+async function saveAnchor(config, store, nextKeyVersion) {
+    const serialized = canonicalize({ ...binding(config), serverSigningKeyset: config.serverSigningKeyset, nextKeyVersion });
+    const account = accountFor(config);
+    await store.put(account, serialized);
+    if (await readProtected(store, account) !== serialized)
+        failure('secure_store_write_not_confirmed');
+}
+function readProtected(store, account) {
+    return store.getFresh ? store.getFresh(account) : store.get(account);
+}
+function parseAnchor(serialized) {
+    let anchor;
+    try {
+        anchor = JSON.parse(serialized);
+    }
+    catch {
+        failure('protected_anchor_malformed');
+    }
+    if (!anchor || typeof anchor !== 'object' || !anchor.serverSigningKeyset
+        || !validateTrustedServerSigningKeysetContract(anchor.serverSigningKeyset).ok)
+        failure('protected_anchor_malformed');
+    return anchor;
+}
+function anchorBinding(anchor) {
+    const { serverSigningKeyset: _keyset, nextKeyVersion: _next, ...base } = anchor;
+    return base;
+}
+function checkDiskHead(config, keyset) {
+    if (!config.serverSigningKeyset || !validateTrustedServerSigningKeysetContract(config.serverSigningKeyset).ok
+        || config.serverSigningKeyset.generation > keyset.generation
+        || (config.serverSigningKeyset.generation === keyset.generation
+            && canonicalize(config.serverSigningKeyset) !== canonicalize(keyset)))
+        failure('protected_anchor_conflict');
+}
+function hashAnchor(serialized) { return createHash('sha256').update(serialized).digest('hex'); }
+async function parseRecovery(serialized) {
+    let recovery;
+    try {
+        recovery = JSON.parse(serialized);
+    }
+    catch {
+        failure('protected_recovery_malformed');
+    }
+    if (recovery?.schema !== 'dharma.demo-signing-recovery/v1'
+        || !/^[0-9a-f]{64}$/.test(recovery.previousAnchorHash)
+        || typeof recovery.previousWasProtected !== 'boolean'
+        || typeof recovery.replacementAnchor !== 'string'
+        || !(await enrollmentApprovalValidator())(recovery.approval))
+        failure('protected_recovery_malformed');
+    return recovery;
+}
+async function boundAnchor(config, serialized, store) {
+    const anchor = parseAnchor(serialized);
+    if (canonicalize(anchorBinding(anchor)) === canonicalize(binding(config))) {
+        checkDiskHead(config, anchor.serverSigningKeyset);
+        return { config, anchor };
+    }
+    // Only a confirmed OS-store journal may bridge an interrupted pin replacement.
+    // A disk intent or an expired self-signature cannot authorize that replacement.
+    const journal = await readProtected(store, `${accountFor(config)}-recovery`);
+    if (!journal)
+        failure('protected_anchor_binding_mismatch');
+    const recovery = await parseRecovery(journal);
+    const replacement = parseAnchor(recovery.replacementAnchor);
+    const previous = await readProtected(store, `${accountFor(config)}-history-${recovery.previousAnchorHash}`);
+    if (!previous || hashAnchor(previous) !== recovery.previousAnchorHash
+        || canonicalize(anchorBinding(parseAnchor(previous))) !== canonicalize(binding(config))
+        || canonicalize(anchorBinding(replacement)) !== canonicalize(anchorBinding(anchor)))
+        failure('protected_anchor_binding_mismatch');
+    checkDiskHead(config, parseAnchor(previous).serverSigningKeyset);
+    checkDiskHead({ ...config, serverSigningKeyset: replacement.serverSigningKeyset }, anchor.serverSigningKeyset);
+    return { config: { ...config, serverPublicKeyEd25519: replacement.serverPublicKeyEd25519,
+            serverSigningKeyset: replacement.serverSigningKeyset }, anchor };
+}
+export async function resolveDemoSigningTrust(config, deps = {}) {
+    const now = deps.now ?? new Date();
+    if (!Number.isFinite(now.getTime()) || !/^[A-Za-z0-9_-]{43}$/.test(config.serverPublicKeyEd25519 ?? '')
+        || !config.serverSigningKeyset)
+        failure('missing_enrollment_trust');
+    const store = deps.store ?? await createSystemSecureStore();
+    const serialized = await readProtected(store, accountFor(config));
+    if (!serialized) {
+        // Compatibility migration is allowed only while the originally pinned
+        // bootstrap is valid. An expired or already-rotated disk file cannot bootstrap.
+        checkKeyset(config.serverSigningKeyset, config.organizationId, now, config.serverPublicKeyEd25519);
+        await saveAnchor(config, store, null);
+        return config;
+    }
+    const bound = await boundAnchor(config, serialized, store);
+    const { serverSigningKeyset, nextKeyVersion } = bound.anchor;
+    if (nextKeyVersion !== null && (typeof nextKeyVersion !== 'string'
+        || !serverSigningKeyset.keys.some(k => k.keyVersion === nextKeyVersion && k.status === 'overlap')))
+        failure('protected_preload_invalid');
+    checkKeyset(serverSigningKeyset, config.organizationId, now);
+    return { ...bound.config, serverSigningKeyset };
+}
+// Call only from a successful poll of the browser-approved enrollment, under the
+// device operation lock. The receipt is not a grant and cannot approve a device.
+export async function recoverDemoSigningEnrollment(config, trust, value, deps = {}) {
+    const validate = await enrollmentApprovalValidator();
+    if (!validate(value))
+        failure('fresh_approval_required');
+    const now = deps.now ?? new Date();
+    const approved = Date.parse(value.approvedAt), expiry = Date.parse(value.expiresAt);
+    if (!Number.isFinite(now.getTime()) || value.organizationId !== config.organizationId
+        || value.repositoryId !== config.repositoryId || value.deviceId !== config.deviceId
+        || value.publicKeyEd25519 !== config.publicKeyEd25519 || approved > now.getTime() + 30_000
+        || expiry <= now.getTime() || expiry <= approved || expiry - approved > 15 * 60_000)
+        failure('approval_scope_or_expiry_invalid');
+    const store = deps.store ?? await createSystemSecureStore();
+    const account = accountFor(config);
+    const priorJournal = await readProtected(store, `${account}-recovery`);
+    const prior = priorJournal === null ? null : await parseRecovery(priorJournal);
+    let existing = await readProtected(store, account);
+    // Windows PasswordVault removes an existing credential before adding its
+    // replacement. Resume that interrupted write only from the confirmed journal.
+    if (existing === null && prior?.previousWasProtected) {
+        const sameApproval = canonicalize(prior.approval) === canonicalize(value);
+        const replacesExpiredApproval = prior.approval.enrollmentId !== value.enrollmentId
+            && Date.parse(prior.approval.expiresAt) <= now.getTime()
+            && approved > Date.parse(prior.approval.expiresAt)
+            && ['organizationId', 'repositoryId', 'participantId', 'deviceId', 'publicKeyEd25519']
+                .every(field => prior.approval[field] === value[field]);
+        if ((!sameApproval && !replacesExpiredApproval)
+            || await readProtected(store, `${account}-approval-${prior.approval.enrollmentId}`) !== canonicalize(prior)) {
+            failure('approval_replayed_or_conflicting');
+        }
+        const previous = await readProtected(store, `${account}-history-${prior.previousAnchorHash}`);
+        if (!previous || hashAnchor(previous) !== prior.previousAnchorHash
+            || canonicalize(anchorBinding(parseAnchor(previous))) !== canonicalize(binding(config))) {
+            failure('protected_anchor_binding_mismatch');
+        }
+        if (replacesExpiredApproval) {
+            const pending = parseAnchor(prior.replacementAnchor);
+            if (!trust.serverSigningKeyset || canonicalize({ ...anchorBinding(pending),
+                serverPublicKeyEd25519: config.serverPublicKeyEd25519 }) !== canonicalize(binding(config))) {
+                failure('protected_anchor_binding_mismatch');
+            }
+            checkDiskHead({ ...config, serverSigningKeyset: pending.serverSigningKeyset }, trust.serverSigningKeyset);
+        }
+        existing = previous;
+    }
+    const bound = existing ? await boundAnchor(config, existing, store) : null;
+    const head = bound?.anchor.serverSigningKeyset ?? config.serverSigningKeyset;
+    if (!head || !trust.serverSigningKeyset || !trust.serverPublicKeyEd25519)
+        failure('missing_enrollment_trust');
+    const expiredAt = Date.parse(head.expiresAt);
+    if (!Number.isFinite(expiredAt) || expiredAt > now.getTime() || approved <= expiredAt)
+        failure('approval_must_follow_trust_expiry');
+    checkKeyset(head, config.organizationId, new Date(expiredAt - 1), existing ? undefined : config.serverPublicKeyEd25519);
+    checkKeyset(trust.serverSigningKeyset, config.organizationId, now, trust.serverPublicKeyEd25519);
+    for (const old of head.keys) {
+        const retained = trust.serverSigningKeyset.keys.find(key => key.keyVersion === old.keyVersion);
+        if (retained && (retained.publicKeyEd25519 !== old.publicKeyEd25519
+            || retained.notBefore !== old.notBefore || retained.notAfter !== old.notAfter))
+            failure('retained_window_changed');
+    }
+    if (trust.serverSigningKeyset.generation <= head.generation
+        || Date.parse(trust.serverSigningKeyset.expiresAt) <= now.getTime() + 600_000
+        || Date.parse(trust.serverSigningKeyset.expiresAt) - Date.parse(trust.serverSigningKeyset.issuedAt) > 29 * 86_400_000)
+        failure('reenrollment_generation_or_lifetime_invalid');
+    const updated = { ...(bound?.config ?? config), ...trust };
+    const replacementAnchor = canonicalize({ ...binding(updated), serverSigningKeyset: updated.serverSigningKeyset, nextKeyVersion: null });
+    // Legacy clients without an OS signing anchor retain a labelled historical
+    // snapshot; only the new recipient approval establishes its replacement trust.
+    const previous = existing ?? canonicalize({ ...binding(config), serverSigningKeyset: head, nextKeyVersion: null });
+    const previousAnchorHash = hashAnchor(previous);
+    const recovery = { schema: 'dharma.demo-signing-recovery/v1', previousAnchorHash, previousWasProtected: existing !== null,
+        replacementAnchor, approval: structuredClone(value) };
+    if (prior) {
+        if (prior.approval.participantId !== value.participantId
+            || (prior.approval.enrollmentId === value.enrollmentId
+                && canonicalize(prior) !== canonicalize(recovery)))
+            failure('approval_replayed_or_conflicting');
+    }
+    const archive = `${account}-history-${previousAnchorHash}`;
+    const archived = await readProtected(store, archive);
+    if (archived !== null && archived !== previous)
+        failure('protected_history_conflict');
+    const approvalAccount = `${account}-approval-${value.enrollmentId}`;
+    const recoveryRecord = canonicalize(recovery);
+    const seen = await readProtected(store, approvalAccount);
+    if (seen !== null && seen !== recoveryRecord)
+        failure('approval_replayed_or_conflicting');
+    const confirm = async (key, contents) => {
+        await store.put(key, contents);
+        if (await readProtected(store, key) !== contents)
+            failure('secure_store_write_not_confirmed');
+    };
+    if (archived === null)
+        await confirm(archive, previous);
+    if (seen === null)
+        await confirm(approvalAccount, recoveryRecord);
+    await confirm(`${account}-recovery`, recoveryRecord);
+    await confirm(account, replacementAnchor);
+    return updated;
+}
+// Callers hold the existing per-device operation lock. The protected anchor is
+// the write-ahead record; a restart repairs an older disk config from this record.
+export async function acceptDemoSigningKeysets(config, chain, deps = {}) {
+    if (!Array.isArray(chain) || chain.length > 20)
+        failure('chain_limit');
+    const now = deps.now ?? new Date();
+    const store = deps.store ?? await createSystemSecureStore();
+    let updated = await resolveDemoSigningTrust(config, { ...deps, store, now });
+    let nextKeyVersion = JSON.parse((await readProtected(store, accountFor(config)))).nextKeyVersion;
+    for (const candidate of chain) {
+        const current = updated.serverSigningKeyset;
+        if (canonicalize(current) === canonicalize(candidate))
+            continue;
+        if (!validateTrustedServerSigningKeysetContract(candidate).ok
+            || candidate.generation !== current.generation + 1)
+            failure('generation_conflict');
+        const verification = verifyServerSigningKeysetUpdate(current, candidate, now);
+        if (!verification.ok)
+            failure(verification.reason ?? 'transition_invalid');
+        checkKeyset(candidate, config.organizationId, now);
+        if (Date.parse(candidate.expiresAt) <= now.getTime() + 600_000
+            || Date.parse(candidate.expiresAt) - Date.parse(candidate.issuedAt) > 29 * 86_400_000)
+            failure('transition_lifetime_invalid');
+        for (const old of current.keys) {
+            const retained = candidate.keys.find(k => k.keyVersion === old.keyVersion);
+            if (!retained || retained.publicKeyEd25519 !== old.publicKeyEd25519
+                || retained.notBefore !== old.notBefore || retained.notAfter !== old.notAfter)
+                failure('retained_window_changed');
+        }
+        const active = candidate.keys.find(k => k.status === 'active');
+        const previousActive = current.keys.find(k => k.status === 'active');
+        const introduced = candidate.keys.filter(k => !current.keys.some(old => old.keyVersion === k.keyVersion));
+        if (active.keyVersion === previousActive.keyVersion) {
+            if (nextKeyVersion !== null || introduced.length !== 1 || introduced[0].status !== 'overlap'
+                || Date.parse(introduced[0].notBefore) > now.getTime()
+                || Date.parse(introduced[0].notAfter) <= now.getTime() + 600_000
+                || candidate.keys.length !== current.keys.length + 1
+                || current.keys.some(old => candidate.keys.find(k => k.keyVersion === old.keyVersion).status !== old.status)) {
+                failure('preload_invalid');
+            }
+            nextKeyVersion = introduced[0].keyVersion;
+        }
+        else {
+            if (active.keyVersion !== nextKeyVersion || introduced.length !== 0
+                || current.keys.find(k => k.keyVersion === active.keyVersion)?.status !== 'overlap'
+                || candidate.keys.length !== current.keys.length
+                || current.keys.some(old => candidate.keys.find(k => k.keyVersion === old.keyVersion).status
+                    !== (old.keyVersion === active.keyVersion ? 'active' : old.keyVersion === previousActive.keyVersion ? 'overlap' : old.status))) {
+                failure('activation_without_preload');
+            }
+            nextKeyVersion = null;
+        }
+        updated = { ...updated, serverSigningKeyset: structuredClone(candidate) };
+    }
+    if (canonicalize(updated.serverSigningKeyset) !== canonicalize(config.serverSigningKeyset))
+        await saveAnchor(updated, store, nextKeyVersion);
+    return updated;
+}
+export async function acceptDemoSigningUpdate(config, value, deps = {}) {
+    const validate = await signingUpdateValidator();
+    if (!validate(value))
+        failure('update_schema_invalid');
+    const now = deps.now ?? new Date();
+    const issued = Date.parse(value.issuedAt), expiry = Date.parse(value.expiresAt);
+    if (value.organizationId !== config.organizationId || value.repositoryId !== config.repositoryId
+        || value.deviceId !== config.deviceId || issued > now.getTime() + 30_000
+        || expiry <= now.getTime() || expiry <= issued || expiry - issued > 5 * 60_000)
+        failure('update_scope_or_expiry_invalid');
+    return acceptDemoSigningKeysets(config, value.keysets, deps);
+}
+//# sourceMappingURL=demoSigningTrust.js.map

package/dist/demoSigningTrust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoSigningTrust.js","sourceRoot":"","sources":["../src/demoSigningTrust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAyB,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,gCAAgC,EAAE,+BAA+B,EACtF,0CAA0C,EAAmC,MAAM,wCAAwC,CAAC;AAE9H,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAuBpF,IAAI,iBAA4E,CAAC;AACjF,SAAS,2BAA2B;IAClC,OAAO,iBAAiB,KAAK,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,OAAwB,CAAC;QAC1F,UAAU,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,GAAG,CAAC,OAAO,CAAqB,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAC9D,IAAI,GAAG,CAAC,gDAAgD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AACD,IAAI,eAAyE,CAAC;AAC9E,SAAS,sBAAsB;IAC7B,OAAO,eAAe,KAAK,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,OAAwB,CAAC;QAC1F,UAAU,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,CAAC,uBAAuB,EAAE,qBAAqB,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,aAAa,IAAI,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,GAAG,CAAC,SAAS,CAAoB,qDAAqD,CAAE,CAAC;IAClG,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,8DAA8D,CAAC,CAAC;AACxH,CAAC;AACD,SAAS,OAAO,CAAC,MAAyB;IACxC,OAAO,EAAE,MAAM,EAAE,+BAAwC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK;QAC5E,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY;QACxE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc;QACxF,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACpE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC;AAC3F,CAAC;AACD,SAAS,UAAU,CAAC,MAAyB;IAC3C,OAAO,gBAAgB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK;QACnF,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY;QACxE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACtG,CAAC;AACD,SAAS,WAAW,CAAC,MAAkC,EAAE,GAAW,EAAE,GAAS,EAAE,GAAY;IAC3F,IAAI,CAAC,0CAA0C,CAAC,MAAM,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;WACnG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM;WACvE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAChH,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAC/C,CAAC;IACD,2EAA2E;IAC3E,+EAA+E;IAC/E,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,IAAI,MAAM,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvH,MAAM,YAAY,GAAG,gCAAgC,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;AACzE,CAAC;AACD,KAAK,UAAU,UAAU,CAAC,MAAyB,EAAE,KAAwB,EAAE,cAA6B;IAC1G,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,cAAc,EAAE,CAAC,CAAC;IACzH,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrC,IAAI,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,UAAU;QAAE,OAAO,CAAC,kCAAkC,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB,EAAE,OAAe;IAC9D,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IACxC,MAAM,CAAC;QAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAAC,CAAC;IAChD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,mBAAmB;WACnE,CAAC,0CAA0C,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACvH,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,MAAkC;IAClF,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,0CAA0C,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,EAAE;WACxG,MAAM,CAAC,mBAAmB,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU;WACzD,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;eAC1D,YAAY,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAClH,CAAC;AACD,SAAS,UAAU,CAAC,UAAkB,IAAI,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzG,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAC1C,MAAM,CAAC;QAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAAC,CAAC;IAClD,IAAI,QAAQ,EAAE,MAAM,KAAK,iCAAiC;WACrD,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;WACnD,OAAO,QAAQ,CAAC,oBAAoB,KAAK,SAAS;WAClD,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ;WAC9C,CAAC,CAAC,MAAM,2BAA2B,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACxG,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,KAAK,UAAU,WAAW,CAA8B,MAAS,EAAE,UAAkB,EAAE,KAAwB;IAC7G,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC1E,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAClD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IACD,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5G,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,kBAAkB;WAChE,YAAY,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;WACpF,YAAY,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,CAAC,mCAAmC,CAAC,CAAC;IACpI,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACjE,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC/G,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;YACtF,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAA8B,MAAS,EAClF,OAAgC,EAAE;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC;WAClG,CAAC,MAAM,CAAC,mBAAmB;QAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,uBAAuB,EAAE,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,sEAAsE;QACtE,gFAAgF;QAChF,WAAW,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACnG,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7D,IAAI,cAAc,KAAK,IAAI,IAAI,CAAC,OAAO,cAAc,KAAK,QAAQ;WAC7D,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3I,WAAW,CAAC,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAA8B,MAAS,EACvF,KAAgF,EAChF,KAAc,EAAE,OAAgC,EAAE;IAClD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,EAAE,CAAC;IACrD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;WAChF,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WAChF,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,IAAI,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM;WACvF,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,GAAG,QAAQ,GAAG,EAAE,GAAG,MAAM;QAAE,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACnI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,uBAAuB,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,OAAO,WAAW,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;IAC/E,IAAI,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,yEAAyE;IACzE,8EAA8E;IAC9E,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACrD,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,uBAAuB,GAAG,KAAK,CAAC,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;eAC7E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE;eACrD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;eAC9C,CAAC,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,kBAAkB,CAAW;iBAC9F,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,uBAAuB,CAAC;eAC1C,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,OAAO,aAAa,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9G,OAAO,CAAC,kCAAkC,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,OAAO,YAAY,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,kBAAkB;eAC7D,YAAY,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,mCAAmC,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,uBAAuB,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC,mBAAmB,IAAI,YAAY,CAAC,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC;gBACxE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC7F,OAAO,CAAC,mCAAmC,CAAC,CAAC;YAC/C,CAAC;YACD,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC5G,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,IAAI,GAAG,KAAK,EAAE,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,CAAC;IAC7E,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,CAAC,sBAAsB;QAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC9G,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,IAAI,SAAS;QAAE,OAAO,CAAC,mCAAmC,CAAC,CAAC;IACpI,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxH,WAAW,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACjG,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/F,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,gBAAgB,KAAK,GAAG,CAAC,gBAAgB;eAC9D,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU;WACtD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO;WAC1E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,UAAU;QAAE,OAAO,CAAC,6CAA6C,CAAC,CAAC;IAChL,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;IAC3D,MAAM,iBAAiB,GAAG,YAAY,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACxI,2EAA2E;IAC3E,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,QAAQ,IAAI,YAAY,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACnH,MAAM,kBAAkB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAa,EAAE,MAAM,EAAE,iCAAiC,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,QAAQ,KAAK,IAAI;QACjI,iBAAiB,EAAE,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;eACnD,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;mBACjD,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,OAAO,YAAY,kBAAkB,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,GAAG,OAAO,aAAa,KAAK,CAAC,YAAY,EAAE,CAAC;IACpE,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAAE,QAAgB,EAAE,EAAE;QACtD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/B,IAAI,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAChG,CAAC,CAAC;IACF,IAAI,QAAQ,KAAK,IAAI;QAAE,MAAM,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IAClE,MAAM,OAAO,CAAC,GAAG,OAAO,WAAW,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAA8B,MAAS,EACnF,KAAmC,EAAE,OAAgC,EAAE;IACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,uBAAuB,EAAE,CAAC;IAC5D,IAAI,OAAO,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,IAAI,cAAc,GAAI,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAE,CAAuC,CAAC,cAAc,CAAC;IACzI,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,mBAAoB,CAAC;QAC7C,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,SAAS,CAAC;YAAE,SAAS;QAChE,IAAI,CAAC,0CAA0C,CAAC,SAAS,CAAC,CAAC,EAAE;eACxD,SAAS,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,GAAG,CAAC;YAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACrF,MAAM,YAAY,GAAG,+BAA+B,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC;QAC3E,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO;eACzD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,UAAU;YAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAChI,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,KAAK,GAAG,CAAC,gBAAgB;mBAC9D,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;gBAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACtH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAE,CAAC;QAChE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAE,CAAC;QACtE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1G,IAAI,MAAM,CAAC,UAAU,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;YACpD,IAAI,cAAc,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,SAAS;mBACxF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE;mBACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO;mBAC9D,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;mBACjD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,CAAE,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChH,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC7B,CAAC;YACD,cAAc,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,CAAC,UAAU,KAAK,cAAc,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;mBAC9D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,KAAK,SAAS;mBAChF,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;mBAC7C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,CAAE,CAAC,MAAM;wBACvF,CAAC,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACnI,OAAO,CAAC,4BAA4B,CAAC,CAAC;YACxC,CAAC;YACD,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,mBAAmB,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,YAAY,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAAE,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAC7I,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAA8B,MAAS,EAClF,KAAc,EAAE,OAAgC,EAAE;IAClD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;WAC3F,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM;WACrE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,MAAM;QAAE,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAC5H,OAAO,wBAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC"}

package/dist/demoSigningTrust.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=demoSigningTrust.test.d.ts.map

package/dist/demoSigningTrust.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoSigningTrust.test.d.ts","sourceRoot":"","sources":["../src/demoSigningTrust.test.ts"],"names":[],"mappings":""}