@emilia-protocol/gate 0.10.0 → 0.13.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +91 -0
- package/README.md +272 -0
- package/action-control-manifest.js +3 -268
- package/action-escrow-custodian.js +4 -0
- package/action-escrow-evidence.js +4 -0
- package/action-escrow-package.js +4 -0
- package/action-escrow-postgres.js +4 -0
- package/action-escrow-state.js +4 -0
- package/action-escrow-verifiers.js +4 -0
- package/action-escrow.js +4 -0
- package/action-packs.js +3 -140
- package/adapters/_kit.js +3 -104
- package/adapters/aws.js +3 -108
- package/adapters/cloudflare.js +3 -54
- package/adapters/gcp.js +3 -70
- package/adapters/github.js +3 -109
- package/adapters/jira.js +3 -55
- package/adapters/k8s.js +3 -70
- package/adapters/linear.js +3 -55
- package/adapters/salesforce.js +3 -55
- package/adapters/stripe.js +3 -81
- package/adapters/supabase.js +3 -121
- package/adapters/terraform.js +3 -59
- package/adapters/vercel.js +3 -84
- package/aec-execution.js +3 -312
- package/breakglass.js +3 -582
- package/capability-receipt.js +4 -0
- package/cf1-conformance.js +3 -106
- package/challenge-store.js +3 -69
- package/control-plane.js +3 -340
- package/coverage.js +3 -721
- package/demo.mjs +1 -1
- package/deployment-attestation.js +3 -247
- package/dist/action-control-manifest.d.ts +82 -0
- package/dist/action-control-manifest.d.ts.map +1 -0
- package/dist/action-control-manifest.js +422 -0
- package/dist/action-control-manifest.js.map +1 -0
- package/dist/action-escrow-custodian.d.ts +74 -0
- package/dist/action-escrow-custodian.d.ts.map +1 -0
- package/dist/action-escrow-custodian.js +363 -0
- package/dist/action-escrow-custodian.js.map +1 -0
- package/dist/action-escrow-evidence.d.ts +130 -0
- package/dist/action-escrow-evidence.d.ts.map +1 -0
- package/dist/action-escrow-evidence.js +1012 -0
- package/dist/action-escrow-evidence.js.map +1 -0
- package/dist/action-escrow-package.d.ts +10 -0
- package/dist/action-escrow-package.d.ts.map +1 -0
- package/dist/action-escrow-package.js +1583 -0
- package/dist/action-escrow-package.js.map +1 -0
- package/dist/action-escrow-postgres.d.ts +62 -0
- package/dist/action-escrow-postgres.d.ts.map +1 -0
- package/dist/action-escrow-postgres.js +339 -0
- package/dist/action-escrow-postgres.js.map +1 -0
- package/dist/action-escrow-state.d.ts +141 -0
- package/dist/action-escrow-state.d.ts.map +1 -0
- package/dist/action-escrow-state.js +413 -0
- package/dist/action-escrow-state.js.map +1 -0
- package/dist/action-escrow-verifiers.d.ts +65 -0
- package/dist/action-escrow-verifiers.d.ts.map +1 -0
- package/dist/action-escrow-verifiers.js +421 -0
- package/dist/action-escrow-verifiers.js.map +1 -0
- package/dist/action-escrow.d.ts +112 -0
- package/dist/action-escrow.d.ts.map +1 -0
- package/dist/action-escrow.js +2661 -0
- package/dist/action-escrow.js.map +1 -0
- package/dist/action-packs.d.ts +54 -0
- package/dist/action-packs.d.ts.map +1 -0
- package/dist/action-packs.js +143 -0
- package/dist/action-packs.js.map +1 -0
- package/dist/adapters/_kit.d.ts +50 -0
- package/dist/adapters/_kit.d.ts.map +1 -0
- package/dist/adapters/_kit.js +98 -0
- package/dist/adapters/_kit.js.map +1 -0
- package/dist/adapters/aws.d.ts +158 -0
- package/dist/adapters/aws.d.ts.map +1 -0
- package/dist/adapters/aws.js +136 -0
- package/dist/adapters/aws.js.map +1 -0
- package/dist/adapters/cloudflare.d.ts +116 -0
- package/dist/adapters/cloudflare.d.ts.map +1 -0
- package/dist/adapters/cloudflare.js +75 -0
- package/dist/adapters/cloudflare.js.map +1 -0
- package/dist/adapters/gcp.d.ts +139 -0
- package/dist/adapters/gcp.d.ts.map +1 -0
- package/dist/adapters/gcp.js +69 -0
- package/dist/adapters/gcp.js.map +1 -0
- package/dist/adapters/github.d.ts +123 -0
- package/dist/adapters/github.d.ts.map +1 -0
- package/dist/adapters/github.js +105 -0
- package/dist/adapters/github.js.map +1 -0
- package/dist/adapters/jira.d.ts +109 -0
- package/dist/adapters/jira.d.ts.map +1 -0
- package/dist/adapters/jira.js +54 -0
- package/dist/adapters/jira.js.map +1 -0
- package/dist/adapters/k8s.d.ts +139 -0
- package/dist/adapters/k8s.d.ts.map +1 -0
- package/dist/adapters/k8s.js +69 -0
- package/dist/adapters/k8s.js.map +1 -0
- package/dist/adapters/linear.d.ts +109 -0
- package/dist/adapters/linear.d.ts.map +1 -0
- package/dist/adapters/linear.js +54 -0
- package/dist/adapters/linear.js.map +1 -0
- package/dist/adapters/salesforce.d.ts +109 -0
- package/dist/adapters/salesforce.d.ts.map +1 -0
- package/dist/adapters/salesforce.js +54 -0
- package/dist/adapters/salesforce.js.map +1 -0
- package/dist/adapters/stripe.d.ts +116 -0
- package/dist/adapters/stripe.d.ts.map +1 -0
- package/dist/adapters/stripe.js +77 -0
- package/dist/adapters/stripe.js.map +1 -0
- package/dist/adapters/supabase.d.ts +127 -0
- package/dist/adapters/supabase.d.ts.map +1 -0
- package/dist/adapters/supabase.js +112 -0
- package/dist/adapters/supabase.js.map +1 -0
- package/dist/adapters/terraform.d.ts +109 -0
- package/dist/adapters/terraform.d.ts.map +1 -0
- package/dist/adapters/terraform.js +58 -0
- package/dist/adapters/terraform.js.map +1 -0
- package/dist/adapters/vercel.d.ts +114 -0
- package/dist/adapters/vercel.d.ts.map +1 -0
- package/dist/adapters/vercel.js +81 -0
- package/dist/adapters/vercel.js.map +1 -0
- package/dist/aec-execution.d.ts +107 -0
- package/dist/aec-execution.d.ts.map +1 -0
- package/dist/aec-execution.js +334 -0
- package/dist/aec-execution.js.map +1 -0
- package/dist/breakglass.d.ts +205 -0
- package/dist/breakglass.d.ts.map +1 -0
- package/dist/breakglass.js +627 -0
- package/dist/breakglass.js.map +1 -0
- package/dist/capability-receipt.d.ts +601 -0
- package/dist/capability-receipt.d.ts.map +1 -0
- package/dist/capability-receipt.js +1177 -0
- package/dist/capability-receipt.js.map +1 -0
- package/dist/cf1-conformance.d.ts +83 -0
- package/dist/cf1-conformance.d.ts.map +1 -0
- package/dist/cf1-conformance.js +94 -0
- package/dist/cf1-conformance.js.map +1 -0
- package/dist/challenge-store.d.ts +20 -0
- package/dist/challenge-store.d.ts.map +1 -0
- package/dist/challenge-store.js +62 -0
- package/dist/challenge-store.js.map +1 -0
- package/dist/control-plane.d.ts +136 -0
- package/dist/control-plane.d.ts.map +1 -0
- package/dist/control-plane.js +349 -0
- package/dist/control-plane.js.map +1 -0
- package/dist/coverage.d.ts +156 -0
- package/dist/coverage.d.ts.map +1 -0
- package/dist/coverage.js +768 -0
- package/dist/coverage.js.map +1 -0
- package/dist/deployment-attestation.d.ts +93 -0
- package/dist/deployment-attestation.d.ts.map +1 -0
- package/dist/deployment-attestation.js +262 -0
- package/dist/deployment-attestation.js.map +1 -0
- package/dist/eg1-conformance.d.ts +286 -0
- package/dist/eg1-conformance.d.ts.map +1 -0
- package/dist/eg1-conformance.js +379 -0
- package/dist/eg1-conformance.js.map +1 -0
- package/dist/enterprise.d.ts +88 -0
- package/dist/enterprise.d.ts.map +1 -0
- package/dist/enterprise.js +194 -0
- package/dist/enterprise.js.map +1 -0
- package/dist/evidence-postgres.d.ts +123 -0
- package/dist/evidence-postgres.d.ts.map +1 -0
- package/dist/evidence-postgres.js +343 -0
- package/dist/evidence-postgres.js.map +1 -0
- package/dist/evidence.d.ts +113 -0
- package/dist/evidence.d.ts.map +1 -0
- package/dist/evidence.js +369 -0
- package/dist/evidence.js.map +1 -0
- package/dist/execution-binding.d.ts +49 -0
- package/dist/execution-binding.d.ts.map +1 -0
- package/dist/execution-binding.js +243 -0
- package/dist/execution-binding.js.map +1 -0
- package/dist/formal-runtime-map.d.ts +42 -0
- package/dist/formal-runtime-map.d.ts.map +1 -0
- package/dist/formal-runtime-map.js +23 -0
- package/dist/formal-runtime-map.js.map +1 -0
- package/dist/index.d.ts +1002 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +1736 -0
- package/dist/index.js.map +1 -0
- package/dist/key-registry.d.ts +60 -0
- package/dist/key-registry.d.ts.map +1 -0
- package/dist/key-registry.js +144 -0
- package/dist/key-registry.js.map +1 -0
- package/dist/mcp.d.ts +53 -0
- package/dist/mcp.d.ts.map +1 -0
- package/dist/mcp.js +112 -0
- package/dist/mcp.js.map +1 -0
- package/dist/metering.d.ts +80 -0
- package/dist/metering.d.ts.map +1 -0
- package/dist/metering.js +227 -0
- package/dist/metering.js.map +1 -0
- package/dist/metrics.d.ts +68 -0
- package/dist/metrics.d.ts.map +1 -0
- package/dist/metrics.js +242 -0
- package/dist/metrics.js.map +1 -0
- package/dist/network-witness.d.ts +167 -0
- package/dist/network-witness.d.ts.map +1 -0
- package/dist/network-witness.js +520 -0
- package/dist/network-witness.js.map +1 -0
- package/dist/protocol-state.d.ts +141 -0
- package/dist/protocol-state.d.ts.map +1 -0
- package/dist/protocol-state.js +106 -0
- package/dist/protocol-state.js.map +1 -0
- package/dist/receipt-program.d.ts +59 -0
- package/dist/receipt-program.d.ts.map +1 -0
- package/dist/receipt-program.js +1053 -0
- package/dist/receipt-program.js.map +1 -0
- package/dist/reliance-kernel.d.ts +66 -0
- package/dist/reliance-kernel.d.ts.map +1 -0
- package/dist/reliance-kernel.js +103 -0
- package/dist/reliance-kernel.js.map +1 -0
- package/dist/reliance-packet.d.ts +67 -0
- package/dist/reliance-packet.d.ts.map +1 -0
- package/dist/reliance-packet.js +176 -0
- package/dist/reliance-packet.js.map +1 -0
- package/dist/remedy-program-postgres.d.ts +37 -0
- package/dist/remedy-program-postgres.d.ts.map +1 -0
- package/dist/remedy-program-postgres.js +291 -0
- package/dist/remedy-program-postgres.js.map +1 -0
- package/dist/remedy-program-receipt.d.ts +97 -0
- package/dist/remedy-program-receipt.d.ts.map +1 -0
- package/dist/remedy-program-receipt.js +817 -0
- package/dist/remedy-program-receipt.js.map +1 -0
- package/dist/remedy-program.d.ts +76 -0
- package/dist/remedy-program.d.ts.map +1 -0
- package/dist/remedy-program.js +1346 -0
- package/dist/remedy-program.js.map +1 -0
- package/dist/reports/art14.d.ts +101 -0
- package/dist/reports/art14.d.ts.map +1 -0
- package/dist/reports/art14.js +340 -0
- package/dist/reports/art14.js.map +1 -0
- package/dist/reports/assurance-package.d.ts +197 -0
- package/dist/reports/assurance-package.d.ts.map +1 -0
- package/dist/reports/assurance-package.js +313 -0
- package/dist/reports/assurance-package.js.map +1 -0
- package/dist/reports/auditor-workpaper.d.ts +194 -0
- package/dist/reports/auditor-workpaper.d.ts.map +1 -0
- package/dist/reports/auditor-workpaper.js +545 -0
- package/dist/reports/auditor-workpaper.js.map +1 -0
- package/dist/reports/external-verification.d.ts +76 -0
- package/dist/reports/external-verification.d.ts.map +1 -0
- package/dist/reports/external-verification.js +209 -0
- package/dist/reports/external-verification.js.map +1 -0
- package/dist/reports/reperform.d.ts +122 -0
- package/dist/reports/reperform.d.ts.map +1 -0
- package/dist/reports/reperform.js +432 -0
- package/dist/reports/reperform.js.map +1 -0
- package/dist/reports/underwriter.d.ts +127 -0
- package/dist/reports/underwriter.d.ts.map +1 -0
- package/dist/reports/underwriter.js +348 -0
- package/dist/reports/underwriter.js.map +1 -0
- package/dist/retention.d.ts +88 -0
- package/dist/retention.d.ts.map +1 -0
- package/dist/retention.js +90 -0
- package/dist/retention.js.map +1 -0
- package/dist/roster.d.ts +113 -0
- package/dist/roster.d.ts.map +1 -0
- package/dist/roster.js +261 -0
- package/dist/roster.js.map +1 -0
- package/dist/runtime-monitor.d.ts +132 -0
- package/dist/runtime-monitor.d.ts.map +1 -0
- package/dist/runtime-monitor.js +197 -0
- package/dist/runtime-monitor.js.map +1 -0
- package/dist/settlement.d.ts +68 -0
- package/dist/settlement.d.ts.map +1 -0
- package/dist/settlement.js +306 -0
- package/dist/settlement.js.map +1 -0
- package/dist/siem.d.ts +261 -0
- package/dist/siem.d.ts.map +1 -0
- package/dist/siem.js +247 -0
- package/dist/siem.js.map +1 -0
- package/dist/store-postgres.d.ts +107 -0
- package/dist/store-postgres.d.ts.map +1 -0
- package/dist/store-postgres.js +152 -0
- package/dist/store-postgres.js.map +1 -0
- package/dist/store.d.ts +95 -0
- package/dist/store.d.ts.map +1 -0
- package/dist/store.js +202 -0
- package/dist/store.js.map +1 -0
- package/dist/strict-json.d.ts +14 -0
- package/dist/strict-json.d.ts.map +1 -0
- package/dist/strict-json.js +132 -0
- package/dist/strict-json.js.map +1 -0
- package/dist/trust-program-adapters.d.ts +122 -0
- package/dist/trust-program-adapters.d.ts.map +1 -0
- package/dist/trust-program-adapters.js +802 -0
- package/dist/trust-program-adapters.js.map +1 -0
- package/dist/trust-program-postgres.d.ts +41 -0
- package/dist/trust-program-postgres.d.ts.map +1 -0
- package/dist/trust-program-postgres.js +346 -0
- package/dist/trust-program-postgres.js.map +1 -0
- package/dist/trust-program-revocation.d.ts +206 -0
- package/dist/trust-program-revocation.d.ts.map +1 -0
- package/dist/trust-program-revocation.js +600 -0
- package/dist/trust-program-revocation.js.map +1 -0
- package/dist/trust-program.d.ts +197 -0
- package/dist/trust-program.d.ts.map +1 -0
- package/dist/trust-program.js +1351 -0
- package/dist/trust-program.js.map +1 -0
- package/dist/witness-postgres.d.ts +43 -0
- package/dist/witness-postgres.d.ts.map +1 -0
- package/dist/witness-postgres.js +92 -0
- package/dist/witness-postgres.js.map +1 -0
- package/dist/zk-range-proof.d.ts +78 -0
- package/dist/zk-range-proof.d.ts.map +1 -0
- package/dist/zk-range-proof.js +228 -0
- package/dist/zk-range-proof.js.map +1 -0
- package/eg1-conformance.js +3 -404
- package/enterprise.js +3 -180
- package/ep-assure.mjs +1 -0
- package/evidence-postgres.js +3 -356
- package/evidence.js +4 -360
- package/execution-binding.js +3 -212
- package/formal-runtime-map.js +4 -0
- package/index.js +4 -1249
- package/key-registry.js +3 -134
- package/mcp.js +3 -109
- package/metering.js +3 -226
- package/metrics.js +3 -231
- package/network-witness.js +3 -499
- package/package.json +47 -4
- package/receipt-program.js +4 -0
- package/reliance-kernel.js +3 -112
- package/reliance-packet.js +3 -175
- package/remedy-program-postgres.js +4 -0
- package/remedy-program-receipt.js +4 -0
- package/remedy-program.js +4 -0
- package/reports/art14.js +0 -0
- package/reports/assurance-package.js +2 -312
- package/reports/auditor-workpaper.js +3 -537
- package/reports/external-verification.js +3 -222
- package/reports/reperform.js +3 -424
- package/reports/underwriter.js +3 -339
- package/retention.js +3 -84
- package/roster.js +3 -264
- package/runtime-monitor.js +4 -0
- package/settlement.js +3 -299
- package/siem.js +3 -235
- package/src/action-control-manifest.ts +424 -0
- package/src/action-escrow-custodian.ts +427 -0
- package/src/action-escrow-evidence.ts +1178 -0
- package/src/action-escrow-package.ts +1821 -0
- package/src/action-escrow-postgres.ts +366 -0
- package/src/action-escrow-state.ts +498 -0
- package/src/action-escrow-verifiers.ts +484 -0
- package/src/action-escrow.ts +3039 -0
- package/src/action-packs.ts +170 -0
- package/src/adapters/_kit.ts +117 -0
- package/src/adapters/aws.ts +142 -0
- package/src/adapters/cloudflare.ts +78 -0
- package/src/adapters/gcp.ts +71 -0
- package/src/adapters/github.ts +110 -0
- package/src/adapters/jira.ts +56 -0
- package/src/adapters/k8s.ts +71 -0
- package/src/adapters/linear.ts +56 -0
- package/src/adapters/salesforce.ts +56 -0
- package/src/adapters/stripe.ts +82 -0
- package/src/adapters/supabase.ts +122 -0
- package/src/adapters/terraform.ts +60 -0
- package/src/adapters/vercel.ts +85 -0
- package/src/aec-execution.ts +354 -0
- package/src/breakglass.ts +647 -0
- package/src/capability-receipt.ts +1258 -0
- package/src/cf1-conformance.ts +120 -0
- package/src/challenge-store.ts +70 -0
- package/src/control-plane.ts +374 -0
- package/src/coverage.ts +832 -0
- package/src/deployment-attestation.ts +259 -0
- package/src/eg1-conformance.ts +471 -0
- package/src/enterprise.ts +195 -0
- package/src/evidence-postgres.ts +374 -0
- package/src/evidence.ts +367 -0
- package/src/execution-binding.ts +236 -0
- package/src/formal-runtime-map.ts +24 -0
- package/src/index.ts +2122 -0
- package/src/key-registry.ts +150 -0
- package/src/mcp.ts +120 -0
- package/src/metering.ts +237 -0
- package/src/metrics.ts +232 -0
- package/src/network-witness.ts +585 -0
- package/src/protocol-state.ts +143 -0
- package/src/protocol-state.typecheck.ts +94 -0
- package/src/receipt-program.ts +1105 -0
- package/src/reliance-kernel.ts +119 -0
- package/src/reliance-packet.ts +206 -0
- package/src/remedy-program-postgres.ts +367 -0
- package/src/remedy-program-receipt.ts +891 -0
- package/src/remedy-program.ts +1388 -0
- package/src/reports/art14.ts +361 -0
- package/src/reports/assurance-package.ts +330 -0
- package/src/reports/auditor-workpaper.ts +558 -0
- package/src/reports/external-verification.ts +232 -0
- package/src/reports/reperform.ts +441 -0
- package/src/reports/underwriter.ts +356 -0
- package/src/retention.ts +100 -0
- package/src/roster.ts +273 -0
- package/src/runtime-monitor.ts +217 -0
- package/src/settlement.ts +313 -0
- package/src/siem.ts +247 -0
- package/src/store-postgres.ts +167 -0
- package/src/store.ts +214 -0
- package/src/strict-json.ts +115 -0
- package/src/trust-program-adapters.ts +847 -0
- package/src/trust-program-postgres.ts +429 -0
- package/src/trust-program-revocation.ts +751 -0
- package/src/trust-program.ts +1460 -0
- package/src/witness-postgres.ts +106 -0
- package/src/zk-range-proof.ts +250 -0
- package/store-postgres.js +3 -161
- package/store.js +4 -198
- package/strict-json.js +3 -85
- package/trust-program-adapters.js +4 -0
- package/trust-program-postgres.js +4 -0
- package/trust-program-revocation.js +4 -0
- package/trust-program.js +4 -0
- package/witness-postgres.js +3 -96
- package/zk-range-proof.js +4 -0
|
@@ -0,0 +1,363 @@
|
|
|
1
|
+
// @ts-nocheck
|
|
2
|
+
// SPDX-License-Identifier: Apache-2.0
|
|
3
|
+
/**
|
|
4
|
+
* Typed bridge between the Action Escrow kernel and an authenticated external
|
|
5
|
+
* custodian adapter. Provider observations are signed by the deployment
|
|
6
|
+
* operator because TLS API responses are not portable offline evidence.
|
|
7
|
+
*/
|
|
8
|
+
import crypto from 'node:crypto';
|
|
9
|
+
import { canonicalize, hashCanonical } from './execution-binding.js';
|
|
10
|
+
import { ACTION_ESCROW_CONTRACTOR_TEMPLATE_VERSION, validateActionEscrowReleaseTemplate, } from './action-escrow-verifiers.js';
|
|
11
|
+
export const ACTION_ESCROW_CUSTODIAN_OBSERVATION_VERSION = 'EP-ACTION-ESCROW-CUSTODIAN-OBSERVATION-v1';
|
|
12
|
+
const DOMAIN = `${ACTION_ESCROW_CUSTODIAN_OBSERVATION_VERSION}\0`;
|
|
13
|
+
const HASH = /^sha256:[0-9a-f]{64}$/;
|
|
14
|
+
function isRecord(value) {
|
|
15
|
+
if (value === null || typeof value !== 'object' || Array.isArray(value))
|
|
16
|
+
return false;
|
|
17
|
+
const prototype = Object.getPrototypeOf(value);
|
|
18
|
+
return prototype === Object.prototype || prototype === null;
|
|
19
|
+
}
|
|
20
|
+
function canonicalCopy(value) {
|
|
21
|
+
return JSON.parse(canonicalize(value));
|
|
22
|
+
}
|
|
23
|
+
function canonicalDigest(value) {
|
|
24
|
+
return `sha256:${hashCanonical(value)}`;
|
|
25
|
+
}
|
|
26
|
+
function validString(value, max = 512) {
|
|
27
|
+
return typeof value === 'string'
|
|
28
|
+
&& value.length > 0
|
|
29
|
+
&& value.length <= max
|
|
30
|
+
&& !/[\u0000-\u001f\u007f]/.test(value);
|
|
31
|
+
}
|
|
32
|
+
function strictInstant(value) {
|
|
33
|
+
if (typeof value !== 'string')
|
|
34
|
+
return false;
|
|
35
|
+
const parsed = Date.parse(value);
|
|
36
|
+
return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
|
|
37
|
+
}
|
|
38
|
+
function deepFreeze(value) {
|
|
39
|
+
if (!value || typeof value !== 'object' || Object.isFrozen(value))
|
|
40
|
+
return value;
|
|
41
|
+
Object.freeze(value);
|
|
42
|
+
for (const child of Object.values(value))
|
|
43
|
+
deepFreeze(child);
|
|
44
|
+
return value;
|
|
45
|
+
}
|
|
46
|
+
function signingBytes(payload) {
|
|
47
|
+
return Buffer.concat([
|
|
48
|
+
Buffer.from(DOMAIN, 'utf8'),
|
|
49
|
+
Buffer.from(canonicalize(payload), 'utf8'),
|
|
50
|
+
]);
|
|
51
|
+
}
|
|
52
|
+
function requestScope(request) {
|
|
53
|
+
const { request_digest: _digest, ...scope } = request;
|
|
54
|
+
// The digest identifies the reserved mutation. GET is only a reconciliation
|
|
55
|
+
// transport for that same POST and must not create a second request identity.
|
|
56
|
+
return { ...scope, method: 'POST' };
|
|
57
|
+
}
|
|
58
|
+
function normalizeKernelRequest(value, adapter) {
|
|
59
|
+
try {
|
|
60
|
+
if (!isRecord(value)
|
|
61
|
+
|| (value.method !== 'POST' && value.method !== 'GET')
|
|
62
|
+
|| value.provider_id !== adapter.provider
|
|
63
|
+
|| value.profile?.provider_id !== adapter.provider
|
|
64
|
+
|| !HASH.test(value.agreement_digest)
|
|
65
|
+
|| !HASH.test(value.document_action_binding_digest)
|
|
66
|
+
|| !HASH.test(value.release_action_digest)
|
|
67
|
+
|| !HASH.test(value.parties_digest)
|
|
68
|
+
|| !HASH.test(value.profile_digest)
|
|
69
|
+
|| !HASH.test(value.document_digest)
|
|
70
|
+
|| !HASH.test(value.request_digest)
|
|
71
|
+
|| !validString(value.milestone_id, 256)
|
|
72
|
+
|| !validString(value.idempotency_key, 256)
|
|
73
|
+
|| !isRecord(value.release_action_template)) {
|
|
74
|
+
return null;
|
|
75
|
+
}
|
|
76
|
+
// `validateActionEscrowReleaseTemplate` (action-escrow-verifiers.ts,
|
|
77
|
+
// outside this file's scope) still infers its options parameter type
|
|
78
|
+
// from only the one destructured property that carries a default value,
|
|
79
|
+
// so a fresh object literal here trips the excess-property check.
|
|
80
|
+
// Routing through a locally typed variable avoids that without changing
|
|
81
|
+
// what gets passed at runtime.
|
|
82
|
+
const releaseTemplateOptions = {
|
|
83
|
+
profileDigest: value.profile_digest,
|
|
84
|
+
agreementId: value.agreement_id,
|
|
85
|
+
agreementDigest: value.agreement_digest,
|
|
86
|
+
milestoneId: value.milestone_id,
|
|
87
|
+
documentDigest: value.document_digest,
|
|
88
|
+
contractorProjectSource: value.release_action_template.action_escrow_template_profile
|
|
89
|
+
=== ACTION_ESCROW_CONTRACTOR_TEMPLATE_VERSION,
|
|
90
|
+
};
|
|
91
|
+
const template = validateActionEscrowReleaseTemplate(value.release_action_template, releaseTemplateOptions);
|
|
92
|
+
if (!template
|
|
93
|
+
|| template.custodian_provider !== adapter.provider
|
|
94
|
+
|| template.custodian_environment !== adapter.environment
|
|
95
|
+
|| canonicalDigest({
|
|
96
|
+
'@version': 'EP-ACTION-ESCROW-PROVIDER-REQUEST-v1',
|
|
97
|
+
...requestScope(value),
|
|
98
|
+
}) !== value.request_digest) {
|
|
99
|
+
return null;
|
|
100
|
+
}
|
|
101
|
+
return canonicalCopy(value);
|
|
102
|
+
}
|
|
103
|
+
catch {
|
|
104
|
+
return null;
|
|
105
|
+
}
|
|
106
|
+
}
|
|
107
|
+
function transactionMatches(transaction, request) {
|
|
108
|
+
if (!isRecord(transaction)
|
|
109
|
+
|| transaction.transaction_id
|
|
110
|
+
!== request.release_action_template.custodian_transaction_id
|
|
111
|
+
|| transaction.currency !== request.release_action_template.currency
|
|
112
|
+
|| !Array.isArray(transaction.milestones)) {
|
|
113
|
+
return false;
|
|
114
|
+
}
|
|
115
|
+
const milestone = transaction.milestones.find((entry) => entry.provider_item_id
|
|
116
|
+
=== request.release_action_template.custodian_milestone_id);
|
|
117
|
+
if (!milestone || !Array.isArray(milestone.schedules) || milestone.schedules.length !== 1) {
|
|
118
|
+
return false;
|
|
119
|
+
}
|
|
120
|
+
const schedule = milestone.schedules[0];
|
|
121
|
+
return schedule.amount === request.release_action_template.amount
|
|
122
|
+
&& schedule.beneficiary_customer === request.release_action_template.destination_id;
|
|
123
|
+
}
|
|
124
|
+
function providerResultMatches(result, request, adapter, operation) {
|
|
125
|
+
return isRecord(result)
|
|
126
|
+
&& result.provider === adapter.provider
|
|
127
|
+
&& result.environment === adapter.environment
|
|
128
|
+
&& result.operation === operation
|
|
129
|
+
&& result.transaction_id
|
|
130
|
+
=== request.release_action_template.custodian_transaction_id
|
|
131
|
+
&& (operation === 'reconcile_transaction'
|
|
132
|
+
|| (result.milestone_id
|
|
133
|
+
=== request.release_action_template.custodian_milestone_id
|
|
134
|
+
&& result.effect_reference === request.idempotency_key));
|
|
135
|
+
}
|
|
136
|
+
function transactionFromResult(result) {
|
|
137
|
+
return isRecord(result?.transaction) ? result.transaction : null;
|
|
138
|
+
}
|
|
139
|
+
function observationStatus(result) {
|
|
140
|
+
if (result.kind === 'released')
|
|
141
|
+
return 'released';
|
|
142
|
+
if (result.kind !== 'provider_action_required')
|
|
143
|
+
return null;
|
|
144
|
+
if (result.provider_phase === 'not_accepted')
|
|
145
|
+
return 'not_released';
|
|
146
|
+
if (result.provider_phase === 'accepted_pending_disbursement')
|
|
147
|
+
return 'pending';
|
|
148
|
+
return null;
|
|
149
|
+
}
|
|
150
|
+
function normalizePrivateKey(value) {
|
|
151
|
+
const key = value instanceof crypto.KeyObject ? value : crypto.createPrivateKey(value);
|
|
152
|
+
if (key.asymmetricKeyType !== 'ed25519') {
|
|
153
|
+
throw new TypeError('custodian observation signer must use Ed25519');
|
|
154
|
+
}
|
|
155
|
+
return key;
|
|
156
|
+
}
|
|
157
|
+
/**
|
|
158
|
+
* The bridge implements the kernel's release/getRelease contract. It never
|
|
159
|
+
* claims that EMILIA holds funds or that the external provider is licensed.
|
|
160
|
+
*/
|
|
161
|
+
export function createActionEscrowCustodianBridge({ adapter, observationSigner, now = () => new Date().toISOString(), } = {}) {
|
|
162
|
+
if (!isRecord(adapter)
|
|
163
|
+
|| adapter.kind !== 'external_custodian'
|
|
164
|
+
|| !validString(adapter.provider, 128)
|
|
165
|
+
|| !['sandbox', 'production'].includes(adapter.environment)
|
|
166
|
+
|| typeof adapter.reconcileTransaction !== 'function'
|
|
167
|
+
|| typeof adapter.releaseMilestone !== 'function'
|
|
168
|
+
|| typeof adapter.requestMilestoneDisbursement !== 'function'
|
|
169
|
+
|| !isRecord(observationSigner)
|
|
170
|
+
|| !validString(observationSigner.key_id, 256)
|
|
171
|
+
|| typeof now !== 'function') {
|
|
172
|
+
throw new TypeError('external custodian adapter and observation signer are required');
|
|
173
|
+
}
|
|
174
|
+
const privateKey = normalizePrivateKey(observationSigner.privateKey);
|
|
175
|
+
async function preflight(request) {
|
|
176
|
+
// adapter is validated above; the guard's narrowing does not carry into
|
|
177
|
+
// this hoisted function declaration's closure.
|
|
178
|
+
const reconciled = await adapter.reconcileTransaction({
|
|
179
|
+
transactionId: request.release_action_template.custodian_transaction_id,
|
|
180
|
+
});
|
|
181
|
+
if (!providerResultMatches(reconciled, request, adapter, 'reconcile_transaction')
|
|
182
|
+
|| reconciled.kind !== 'reconciled'
|
|
183
|
+
|| !transactionMatches(reconciled.transaction, request)) {
|
|
184
|
+
throw new Error('custodian transaction does not match the signed release action');
|
|
185
|
+
}
|
|
186
|
+
return reconciled.transaction;
|
|
187
|
+
}
|
|
188
|
+
// observationSigner is validated above; the guard's narrowing does not
|
|
189
|
+
// carry into this hoisted function declaration's closure.
|
|
190
|
+
function signObservation(request, status, result) {
|
|
191
|
+
const observedAt = now();
|
|
192
|
+
if (!strictInstant(observedAt))
|
|
193
|
+
throw new Error('invalid custodian observation clock');
|
|
194
|
+
const transaction = transactionFromResult(result);
|
|
195
|
+
const payload = {
|
|
196
|
+
'@version': ACTION_ESCROW_CUSTODIAN_OBSERVATION_VERSION,
|
|
197
|
+
provider_id: result.provider,
|
|
198
|
+
environment: result.environment,
|
|
199
|
+
statement_type: 'release',
|
|
200
|
+
status,
|
|
201
|
+
agreement_digest: request.agreement_digest,
|
|
202
|
+
document_action_binding_digest: request.document_action_binding_digest,
|
|
203
|
+
milestone_id: request.milestone_id,
|
|
204
|
+
release_action_digest: request.release_action_digest,
|
|
205
|
+
parties_digest: request.parties_digest,
|
|
206
|
+
profile_digest: request.profile_digest,
|
|
207
|
+
provider_idempotency_key: request.idempotency_key,
|
|
208
|
+
provider_request_digest: request.request_digest,
|
|
209
|
+
provider_effect_reference: result.effect_reference,
|
|
210
|
+
provider_transaction_id: result.transaction_id,
|
|
211
|
+
provider_milestone_id: result.milestone_id,
|
|
212
|
+
amount: request.release_action_template.amount,
|
|
213
|
+
currency: request.release_action_template.currency,
|
|
214
|
+
destination_id: request.release_action_template.destination_id,
|
|
215
|
+
provider_snapshot_digest: canonicalDigest(transaction),
|
|
216
|
+
observed_at: observedAt,
|
|
217
|
+
};
|
|
218
|
+
const signature = crypto.sign(null, signingBytes(payload), privateKey);
|
|
219
|
+
return deepFreeze({
|
|
220
|
+
payload,
|
|
221
|
+
signature: {
|
|
222
|
+
algorithm: 'Ed25519',
|
|
223
|
+
key_id: observationSigner.key_id,
|
|
224
|
+
value: signature.toString('base64url'),
|
|
225
|
+
},
|
|
226
|
+
});
|
|
227
|
+
}
|
|
228
|
+
return Object.freeze({
|
|
229
|
+
provider: adapter.provider,
|
|
230
|
+
environment: adapter.environment,
|
|
231
|
+
async release(untrustedRequest) {
|
|
232
|
+
const request = normalizeKernelRequest(untrustedRequest, adapter);
|
|
233
|
+
if (!request || request.method !== 'POST') {
|
|
234
|
+
throw new Error('invalid kernel release request');
|
|
235
|
+
}
|
|
236
|
+
await preflight(request);
|
|
237
|
+
const result = await adapter.releaseMilestone({
|
|
238
|
+
effectReference: request.idempotency_key,
|
|
239
|
+
transactionId: request.release_action_template.custodian_transaction_id,
|
|
240
|
+
milestoneId: request.release_action_template.custodian_milestone_id,
|
|
241
|
+
});
|
|
242
|
+
if (!providerResultMatches(result, request, adapter, 'release_milestone')
|
|
243
|
+
|| !['released', 'release_submitted', 'provider_action_required'].includes(result.kind)
|
|
244
|
+
|| (['released', 'release_submitted'].includes(result.kind)
|
|
245
|
+
&& !transactionMatches(transactionFromResult(result), request))) {
|
|
246
|
+
throw new Error('custodian release outcome is not authoritative');
|
|
247
|
+
}
|
|
248
|
+
return { accepted: true };
|
|
249
|
+
},
|
|
250
|
+
async getRelease(untrustedRequest) {
|
|
251
|
+
const request = normalizeKernelRequest(untrustedRequest, adapter);
|
|
252
|
+
if (!request || request.method !== 'GET') {
|
|
253
|
+
throw new Error('invalid kernel reconciliation request');
|
|
254
|
+
}
|
|
255
|
+
await preflight(request);
|
|
256
|
+
const result = await adapter.requestMilestoneDisbursement({
|
|
257
|
+
effectReference: request.idempotency_key,
|
|
258
|
+
transactionId: request.release_action_template.custodian_transaction_id,
|
|
259
|
+
milestoneId: request.release_action_template.custodian_milestone_id,
|
|
260
|
+
});
|
|
261
|
+
const status = observationStatus(result);
|
|
262
|
+
const transaction = transactionFromResult(result);
|
|
263
|
+
if (!providerResultMatches(result, request, adapter, 'request_milestone_disbursement')
|
|
264
|
+
|| !status
|
|
265
|
+
|| !transaction
|
|
266
|
+
|| !transactionMatches(transaction, request)) {
|
|
267
|
+
throw new Error('custodian release state is indeterminate');
|
|
268
|
+
}
|
|
269
|
+
return {
|
|
270
|
+
authenticated: true,
|
|
271
|
+
statement: signObservation(request, status, result),
|
|
272
|
+
};
|
|
273
|
+
},
|
|
274
|
+
});
|
|
275
|
+
}
|
|
276
|
+
export function createActionEscrowCustodianStatementVerifier({ operatorKeys, providerId, environment, } = {}) {
|
|
277
|
+
if (!isRecord(operatorKeys)
|
|
278
|
+
|| !validString(providerId, 128)
|
|
279
|
+
|| !(environment === 'sandbox' || environment === 'production')) {
|
|
280
|
+
throw new TypeError('pinned operator keys and provider identity are required');
|
|
281
|
+
}
|
|
282
|
+
const pins = canonicalCopy(operatorKeys);
|
|
283
|
+
return async function verifyStatement(statement, expected) {
|
|
284
|
+
try {
|
|
285
|
+
if (!isRecord(statement)
|
|
286
|
+
|| !isRecord(statement.payload)
|
|
287
|
+
|| !isRecord(statement.signature)
|
|
288
|
+
|| statement.signature.algorithm !== 'Ed25519'
|
|
289
|
+
|| !validString(statement.signature.key_id, 256)
|
|
290
|
+
|| !validString(statement.signature.value, 1024)) {
|
|
291
|
+
return { valid: false, reason: 'malformed_custodian_observation' };
|
|
292
|
+
}
|
|
293
|
+
const pin = pins[statement.signature.key_id];
|
|
294
|
+
if (!isRecord(pin) || typeof pin.public_key !== 'string') {
|
|
295
|
+
return { valid: false, reason: 'custodian_operator_key_not_pinned' };
|
|
296
|
+
}
|
|
297
|
+
const publicKey = crypto.createPublicKey({
|
|
298
|
+
key: Buffer.from(pin.public_key, 'base64url'),
|
|
299
|
+
type: 'spki',
|
|
300
|
+
format: 'der',
|
|
301
|
+
});
|
|
302
|
+
if (publicKey.asymmetricKeyType !== 'ed25519'
|
|
303
|
+
|| !crypto.verify(null, signingBytes(statement.payload), publicKey, Buffer.from(statement.signature.value, 'base64url'))) {
|
|
304
|
+
return { valid: false, reason: 'custodian_observation_signature_invalid' };
|
|
305
|
+
}
|
|
306
|
+
const payload = statement.payload;
|
|
307
|
+
const exact = payload['@version'] === ACTION_ESCROW_CUSTODIAN_OBSERVATION_VERSION
|
|
308
|
+
&& payload.provider_id === providerId
|
|
309
|
+
&& payload.environment === environment
|
|
310
|
+
&& payload.statement_type === expected.statement_type
|
|
311
|
+
&& payload.agreement_digest === expected.agreement_digest
|
|
312
|
+
&& payload.document_action_binding_digest
|
|
313
|
+
=== expected.document_action_binding_digest
|
|
314
|
+
&& payload.milestone_id === expected.milestone_id
|
|
315
|
+
&& payload.release_action_digest === expected.release_action_digest
|
|
316
|
+
&& payload.parties_digest === expected.parties_digest
|
|
317
|
+
&& payload.profile_digest === expected.profile_digest
|
|
318
|
+
&& payload.provider_idempotency_key === expected.provider_idempotency_key
|
|
319
|
+
&& payload.provider_request_digest === expected.provider_request_digest
|
|
320
|
+
&& payload.provider_effect_reference === expected.provider_idempotency_key
|
|
321
|
+
&& payload.provider_transaction_id === expected.provider_transaction_id
|
|
322
|
+
&& payload.provider_milestone_id === expected.provider_milestone_id
|
|
323
|
+
&& payload.amount === expected.amount
|
|
324
|
+
&& payload.currency === expected.currency
|
|
325
|
+
&& payload.destination_id === expected.destination_id
|
|
326
|
+
&& ['released', 'not_released', 'pending'].includes(payload.status)
|
|
327
|
+
&& HASH.test(payload.provider_snapshot_digest)
|
|
328
|
+
&& strictInstant(payload.observed_at);
|
|
329
|
+
if (!exact)
|
|
330
|
+
return { valid: false, reason: 'custodian_observation_binding_mismatch' };
|
|
331
|
+
return {
|
|
332
|
+
valid: true,
|
|
333
|
+
authenticated: true,
|
|
334
|
+
statement_type: payload.statement_type,
|
|
335
|
+
status: payload.status,
|
|
336
|
+
statement_digest: canonicalDigest(statement),
|
|
337
|
+
provider_id: payload.provider_id,
|
|
338
|
+
agreement_digest: payload.agreement_digest,
|
|
339
|
+
document_action_binding_digest: payload.document_action_binding_digest,
|
|
340
|
+
milestone_id: payload.milestone_id,
|
|
341
|
+
release_action_digest: payload.release_action_digest,
|
|
342
|
+
parties_digest: payload.parties_digest,
|
|
343
|
+
profile_digest: payload.profile_digest,
|
|
344
|
+
provider_idempotency_key: payload.provider_idempotency_key,
|
|
345
|
+
provider_request_digest: payload.provider_request_digest,
|
|
346
|
+
provider_transaction_id: payload.provider_transaction_id,
|
|
347
|
+
provider_milestone_id: payload.provider_milestone_id,
|
|
348
|
+
amount: payload.amount,
|
|
349
|
+
currency: payload.currency,
|
|
350
|
+
destination_id: payload.destination_id,
|
|
351
|
+
};
|
|
352
|
+
}
|
|
353
|
+
catch {
|
|
354
|
+
return { valid: false, reason: 'malformed_custodian_observation' };
|
|
355
|
+
}
|
|
356
|
+
};
|
|
357
|
+
}
|
|
358
|
+
export default Object.freeze({
|
|
359
|
+
ACTION_ESCROW_CUSTODIAN_OBSERVATION_VERSION,
|
|
360
|
+
createActionEscrowCustodianBridge,
|
|
361
|
+
createActionEscrowCustodianStatementVerifier,
|
|
362
|
+
});
|
|
363
|
+
//# sourceMappingURL=action-escrow-custodian.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"action-escrow-custodian.js","sourceRoot":"","sources":["../src/action-escrow-custodian.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;GAIG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EACL,yCAAyC,EACzC,mCAAmC,GACpC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,MAAM,2CAA2C,GACtD,2CAA2C,CAAC;AAC9C,MAAM,MAAM,GAAG,GAAG,2CAA2C,IAAI,CAAC;AAClE,MAAM,IAAI,GAAG,uBAAuB,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAK;IACrB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,KAAK;IAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,KAAK;IAC5B,OAAO,UAAU,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,CAAC,MAAM,GAAG,CAAC;WAChB,KAAK,CAAC,MAAM,IAAI,GAAG;WACnB,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,KAAK;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;AAC7E,CAAC;AAED,SAAS,UAAU,CAAC,KAAK;IACvB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,OAAO;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,OAAO;IAC3B,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IACtD,4EAA4E;IAC5E,8EAA8E;IAC9E,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAK,EAAE,OAAO;IAC5C,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;eACf,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC;eACnD,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ;eACtC,KAAK,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ;eAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;eAClC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC;eAChD,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC;eACvC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;eAChC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;eAChC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;eACjC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;eAChC,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC;eACrC,CAAC,WAAW,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC;eACxC,CAAC,QAAQ,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,kEAAkE;QAClE,wEAAwE;QACxE,+BAA+B;QAC/B,MAAM,sBAAsB,GAOxB;YACF,aAAa,EAAE,KAAK,CAAC,cAAc;YACnC,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,eAAe,EAAE,KAAK,CAAC,gBAAgB;YACvC,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,cAAc,EAAE,KAAK,CAAC,eAAe;YACrC,uBAAuB,EACrB,KAAK,CAAC,uBAAuB,CAAC,8BAA8B;oBACtD,yCAAyC;SAClD,CAAC;QACF,MAAM,QAAQ,GAAG,mCAAmC,CAClD,KAAK,CAAC,uBAAuB,EAC7B,sBAAsB,CACvB,CAAC;QACF,IAAI,CAAC,QAAQ;eACR,QAAQ,CAAC,kBAAkB,KAAK,OAAO,CAAC,QAAQ;eAChD,QAAQ,CAAC,qBAAqB,KAAK,OAAO,CAAC,WAAW;eACtD,eAAe,CAAC;gBACjB,UAAU,EAAE,sCAAsC;gBAClD,GAAG,YAAY,CAAC,KAAK,CAAC;aACvB,CAAC,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAW,EAAE,OAAO;IAC9C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;WACrB,WAAW,CAAC,cAAc;gBACvB,OAAO,CAAC,uBAAuB,CAAC,wBAAwB;WAC3D,WAAW,CAAC,QAAQ,KAAK,OAAO,CAAC,uBAAuB,CAAC,QAAQ;WACjE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB;YAC3B,OAAO,CAAC,uBAAuB,CAAC,sBAAsB,CAC7D,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,MAAM;WAC5D,QAAQ,CAAC,oBAAoB,KAAK,OAAO,CAAC,uBAAuB,CAAC,cAAc,CAAC;AACxF,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS;IAChE,OAAO,QAAQ,CAAC,MAAM,CAAC;WAClB,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;WACpC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;WAC1C,MAAM,CAAC,SAAS,KAAK,SAAS;WAC9B,MAAM,CAAC,cAAc;gBAClB,OAAO,CAAC,uBAAuB,CAAC,wBAAwB;WAC3D,CAAC,SAAS,KAAK,uBAAuB;eACpC,CACD,MAAM,CAAC,YAAY;oBACb,OAAO,CAAC,uBAAuB,CAAC,sBAAsB;mBACzD,MAAM,CAAC,gBAAgB,KAAK,OAAO,CAAC,eAAe,CACvD,CAAC,CAAC;AACT,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAM;IACnC,OAAO,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAM;IAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,0BAA0B;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IACpE,IAAI,MAAM,CAAC,cAAc,KAAK,+BAA+B;QAAE,OAAO,SAAS,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAK;IAChC,MAAM,GAAG,GAAG,KAAK,YAAY,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvF,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAAC,EAChD,OAAO,EACP,iBAAiB,EACjB,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,MAKlC,EAAE;IACJ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;WACjB,OAAO,CAAC,IAAI,KAAK,oBAAoB;WACrC,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;WACnC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;WACxD,OAAO,OAAO,CAAC,oBAAoB,KAAK,UAAU;WAClD,OAAO,OAAO,CAAC,gBAAgB,KAAK,UAAU;WAC9C,OAAO,OAAO,CAAC,4BAA4B,KAAK,UAAU;WAC1D,CAAC,QAAQ,CAAC,iBAAiB,CAAC;WAC5B,CAAC,WAAW,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC;WAC3C,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAErE,KAAK,UAAU,SAAS,CAAC,OAAO;QAC9B,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,UAAU,GAAG,MAAM,OAAQ,CAAC,oBAAoB,CAAC;YACrD,aAAa,EAAE,OAAO,CAAC,uBAAuB,CAAC,wBAAwB;SACxE,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,CACxB,UAAU,EACV,OAAO,EACP,OAAO,EACP,uBAAuB,CACxB;eACI,UAAU,CAAC,IAAI,KAAK,YAAY;eAChC,CAAC,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,UAAU,CAAC,WAAW,CAAC;IAChC,CAAC;IAED,uEAAuE;IACvE,0DAA0D;IAC1D,SAAS,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM;QAC9C,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvF,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG;YACd,UAAU,EAAE,2CAA2C;YACvD,WAAW,EAAE,MAAM,CAAC,QAAQ;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,cAAc,EAAE,SAAS;YACzB,MAAM;YACN,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,8BAA8B,EAAE,OAAO,CAAC,8BAA8B;YACtE,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;YACpD,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,wBAAwB,EAAE,OAAO,CAAC,eAAe;YACjD,uBAAuB,EAAE,OAAO,CAAC,cAAc;YAC/C,yBAAyB,EAAE,MAAM,CAAC,gBAAgB;YAClD,uBAAuB,EAAE,MAAM,CAAC,cAAc;YAC9C,qBAAqB,EAAE,MAAM,CAAC,YAAY;YAC1C,MAAM,EAAE,OAAO,CAAC,uBAAuB,CAAC,MAAM;YAC9C,QAAQ,EAAE,OAAO,CAAC,uBAAuB,CAAC,QAAQ;YAClD,cAAc,EAAE,OAAO,CAAC,uBAAuB,CAAC,cAAc;YAC9D,wBAAwB,EAAE,eAAe,CAAC,WAAW,CAAC;YACtD,WAAW,EAAE,UAAU;SACxB,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;QACvE,OAAO,UAAU,CAAC;YAChB,OAAO;YACP,SAAS,EAAE;gBACT,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,iBAAkB,CAAC,MAAM;gBACjC,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;aACvC;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,CAAC,OAAO,CAAC,gBAAgB;YAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC;gBAC5C,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,aAAa,EAAE,OAAO,CAAC,uBAAuB,CAAC,wBAAwB;gBACvE,WAAW,EAAE,OAAO,CAAC,uBAAuB,CAAC,sBAAsB;aACpE,CAAC,CAAC;YACH,IAAI,CAAC,qBAAqB,CACxB,MAAM,EACN,OAAO,EACP,OAAO,EACP,mBAAmB,CACpB;mBACI,CAAC,CAAC,UAAU,EAAE,mBAAmB,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;mBACpF,CACD,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;uBACpD,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAC/D,EAAE,CAAC;gBACJ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,gBAAgB;YAC/B,MAAM,OAAO,GAAG,sBAAsB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,4BAA4B,CAAC;gBACxD,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,aAAa,EAAE,OAAO,CAAC,uBAAuB,CAAC,wBAAwB;gBACvE,WAAW,EAAE,OAAO,CAAC,uBAAuB,CAAC,sBAAsB;aACpE,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,qBAAqB,CACxB,MAAM,EACN,OAAO,EACP,OAAO,EACP,gCAAgC,CACjC;mBACI,CAAC,MAAM;mBACP,CAAC,WAAW;mBACZ,CAAC,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO;gBACL,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;aACpD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4CAA4C,CAAC,EAC3D,YAAY,EACZ,UAAU,EACV,WAAW,MAKT,EAAE;IACJ,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;WACtB,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC;WAC7B,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,YAAY,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,KAAK,UAAU,eAAe,CAAC,SAAS,EAAE,QAAQ;QACvD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;mBACnB,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;mBAC5B,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;mBAC9B,SAAS,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS;mBAC3C,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC;mBAC7C,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;gBACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;YACrE,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;YACvE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;gBACvC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC;gBAC7C,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS;mBACxC,CAAC,MAAM,CAAC,MAAM,CACf,IAAI,EACJ,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,EAC/B,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CACpD,EAAE,CAAC;gBACJ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;YAC7E,CAAC;YACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YAClC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,2CAA2C;mBAC5E,OAAO,CAAC,WAAW,KAAK,UAAU;mBAClC,OAAO,CAAC,WAAW,KAAK,WAAW;mBACnC,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;mBAClD,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;mBACtD,OAAO,CAAC,8BAA8B;wBACnC,QAAQ,CAAC,8BAA8B;mBAC1C,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;mBAC9C,OAAO,CAAC,qBAAqB,KAAK,QAAQ,CAAC,qBAAqB;mBAChE,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;mBAClD,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;mBAClD,OAAO,CAAC,wBAAwB,KAAK,QAAQ,CAAC,wBAAwB;mBACtE,OAAO,CAAC,uBAAuB,KAAK,QAAQ,CAAC,uBAAuB;mBACpE,OAAO,CAAC,yBAAyB,KAAK,QAAQ,CAAC,wBAAwB;mBACvE,OAAO,CAAC,uBAAuB,KAAK,QAAQ,CAAC,uBAAuB;mBACpE,OAAO,CAAC,qBAAqB,KAAK,QAAQ,CAAC,qBAAqB;mBAChE,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;mBAClC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;mBACtC,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;mBAClD,CAAC,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;mBAChE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;mBAC3C,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;YACtF,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,gBAAgB,EAAE,eAAe,CAAC,SAAS,CAAC;gBAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,8BAA8B,EAAE,OAAO,CAAC,8BAA8B;gBACtE,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;gBACpD,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;gBAC1D,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;gBACxD,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;gBACxD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;gBACpD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACrE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,MAAM,CAAC,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,iCAAiC;IACjC,4CAA4C;CAC7C,CAAC,CAAC"}
|
|
@@ -0,0 +1,130 @@
|
|
|
1
|
+
export declare const ACTION_ESCROW_EVIDENCE_PACKAGE_VERSION = "EP-ACTION-ESCROW-EVIDENCE-PACKAGE-v1";
|
|
2
|
+
export declare const ACTION_ESCROW_CONTRACTOR_EVIDENCE_PACKAGE_VERSION = "EP-ACTION-ESCROW-CONTRACTOR-EVIDENCE-PACKAGE-v1";
|
|
3
|
+
export declare const ACTION_ESCROW_EVIDENCE_STAGES: readonly string[];
|
|
4
|
+
/**
|
|
5
|
+
* Strict raw parser for security-bearing package transport.
|
|
6
|
+
* @param {*} raw
|
|
7
|
+
* @param {{ maxBytes?: number }} [options]
|
|
8
|
+
*/
|
|
9
|
+
export declare function parseActionEscrowEvidencePackage(raw: any, { maxBytes, }?: {
|
|
10
|
+
maxBytes?: number | undefined;
|
|
11
|
+
}): {
|
|
12
|
+
ok: boolean;
|
|
13
|
+
reason: string | undefined;
|
|
14
|
+
value: null;
|
|
15
|
+
} | {
|
|
16
|
+
ok: boolean;
|
|
17
|
+
reason: string;
|
|
18
|
+
value: any;
|
|
19
|
+
};
|
|
20
|
+
/**
|
|
21
|
+
* Build a portable evidence manifest. The final document bytes are hashed but
|
|
22
|
+
* not embedded; transport them beside the JSON manifest.
|
|
23
|
+
*
|
|
24
|
+
* @param {{ now?: number, maxDocumentBytes?: number, maxProjectRecordBytes?: number }} [limits]
|
|
25
|
+
*/
|
|
26
|
+
export declare function buildActionEscrowEvidencePackage({ agreementId, stage, binding, documentBytes: rawDocumentBytes, documentFileName, documentExecution, agreementAcceptances, releaseApprovals, fundingStatement, milestones, release, stateRecord, amendments, verificationProfile, projectRecordBytes: rawProjectRecordBytes, projectRecordFileName, projectRecordProvider, projectRecordSnapshotDigest, }?: {
|
|
27
|
+
agreementId?: string;
|
|
28
|
+
stage?: string;
|
|
29
|
+
binding?: unknown;
|
|
30
|
+
documentBytes?: unknown;
|
|
31
|
+
documentFileName?: string | null;
|
|
32
|
+
documentExecution?: unknown;
|
|
33
|
+
agreementAcceptances?: any[];
|
|
34
|
+
releaseApprovals?: any[];
|
|
35
|
+
fundingStatement?: unknown;
|
|
36
|
+
milestones?: any[];
|
|
37
|
+
release?: unknown;
|
|
38
|
+
stateRecord?: unknown;
|
|
39
|
+
amendments?: any[];
|
|
40
|
+
verificationProfile?: unknown;
|
|
41
|
+
projectRecordBytes?: unknown;
|
|
42
|
+
projectRecordFileName?: string | null;
|
|
43
|
+
projectRecordProvider?: string | null;
|
|
44
|
+
projectRecordSnapshotDigest?: string | null;
|
|
45
|
+
}, { now, maxDocumentBytes, maxProjectRecordBytes, }?: {
|
|
46
|
+
now?: number;
|
|
47
|
+
maxDocumentBytes?: number;
|
|
48
|
+
maxProjectRecordBytes?: number;
|
|
49
|
+
}): any;
|
|
50
|
+
/**
|
|
51
|
+
* Shape of every pluggable relying-party-owned component verifier accepted
|
|
52
|
+
* below: caller-supplied, arbitrary in signature beyond (value, context).
|
|
53
|
+
*/
|
|
54
|
+
type EvidenceVerifierFn = (value: any, context: any) => any;
|
|
55
|
+
/**
|
|
56
|
+
* Re-perform every package join using relying-party-owned component verifiers.
|
|
57
|
+
*
|
|
58
|
+
* Component verifiers are configuration, never read from the package. Their
|
|
59
|
+
* returned binding fields are checked again here so a valid artifact for one
|
|
60
|
+
* agreement, document, party, or action cannot be relabeled into another slot.
|
|
61
|
+
*
|
|
62
|
+
* @param {*} pkg
|
|
63
|
+
*/
|
|
64
|
+
export declare function verifyActionEscrowEvidencePackage(pkg: any, { documentBytes: rawDocumentBytes, projectRecordBytes: rawProjectRecordBytes, verifyBinding, verifyProjectRecord, verifyProfile, verifyDocumentExecution, verifyAgreementAcceptance, verifyReleaseApproval, verifyFunding, verifyMilestone, verifyRelease, verifyAmendment, verifyState, expectedAgreementId, now, maxDocumentBytes, maxProjectRecordBytes, }?: {
|
|
65
|
+
documentBytes?: unknown;
|
|
66
|
+
projectRecordBytes?: unknown;
|
|
67
|
+
verifyBinding?: EvidenceVerifierFn;
|
|
68
|
+
verifyProjectRecord?: EvidenceVerifierFn;
|
|
69
|
+
verifyProfile?: EvidenceVerifierFn;
|
|
70
|
+
verifyDocumentExecution?: EvidenceVerifierFn;
|
|
71
|
+
verifyAgreementAcceptance?: EvidenceVerifierFn;
|
|
72
|
+
verifyReleaseApproval?: EvidenceVerifierFn;
|
|
73
|
+
verifyFunding?: EvidenceVerifierFn;
|
|
74
|
+
verifyMilestone?: EvidenceVerifierFn;
|
|
75
|
+
verifyRelease?: EvidenceVerifierFn;
|
|
76
|
+
verifyAmendment?: EvidenceVerifierFn;
|
|
77
|
+
verifyState?: EvidenceVerifierFn;
|
|
78
|
+
expectedAgreementId?: string;
|
|
79
|
+
now?: Date | number | string;
|
|
80
|
+
maxDocumentBytes?: number;
|
|
81
|
+
maxProjectRecordBytes?: number;
|
|
82
|
+
}): Promise<{
|
|
83
|
+
valid: boolean;
|
|
84
|
+
reason: any;
|
|
85
|
+
checks: any;
|
|
86
|
+
} | {
|
|
87
|
+
valid: boolean;
|
|
88
|
+
reason: string;
|
|
89
|
+
checks: {
|
|
90
|
+
structure: boolean;
|
|
91
|
+
package_digest: boolean;
|
|
92
|
+
time: boolean;
|
|
93
|
+
document: boolean;
|
|
94
|
+
project_record: boolean;
|
|
95
|
+
binding: boolean;
|
|
96
|
+
profile: boolean;
|
|
97
|
+
document_execution: boolean;
|
|
98
|
+
agreement_acceptances: boolean;
|
|
99
|
+
amendments: boolean;
|
|
100
|
+
state: boolean;
|
|
101
|
+
release_approvals: boolean;
|
|
102
|
+
funding: boolean;
|
|
103
|
+
milestones: boolean;
|
|
104
|
+
release: boolean;
|
|
105
|
+
};
|
|
106
|
+
package_digest: any;
|
|
107
|
+
agreement_id: any;
|
|
108
|
+
binding_digest: any;
|
|
109
|
+
action_digest: any;
|
|
110
|
+
profile_digest: any;
|
|
111
|
+
project_record_snapshot_digest: any;
|
|
112
|
+
required_parties: {
|
|
113
|
+
party_id: string;
|
|
114
|
+
role: string | null;
|
|
115
|
+
}[] | null;
|
|
116
|
+
required_release_parties: {
|
|
117
|
+
party_id: string;
|
|
118
|
+
role: string | null;
|
|
119
|
+
}[] | null;
|
|
120
|
+
}>;
|
|
121
|
+
declare const _default: {
|
|
122
|
+
ACTION_ESCROW_CONTRACTOR_EVIDENCE_PACKAGE_VERSION: string;
|
|
123
|
+
ACTION_ESCROW_EVIDENCE_PACKAGE_VERSION: string;
|
|
124
|
+
ACTION_ESCROW_EVIDENCE_STAGES: readonly string[];
|
|
125
|
+
parseActionEscrowEvidencePackage: typeof parseActionEscrowEvidencePackage;
|
|
126
|
+
buildActionEscrowEvidencePackage: typeof buildActionEscrowEvidencePackage;
|
|
127
|
+
verifyActionEscrowEvidencePackage: typeof verifyActionEscrowEvidencePackage;
|
|
128
|
+
};
|
|
129
|
+
export default _default;
|
|
130
|
+
//# sourceMappingURL=action-escrow-evidence.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"action-escrow-evidence.d.ts","sourceRoot":"","sources":["../src/action-escrow-evidence.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,sCAAsC,yCAAyC,CAAC;AAC7F,eAAO,MAAM,iDAAiD,oDACX,CAAC;AACpD,eAAO,MAAM,6BAA6B,mBAcxC,CAAC;AAsOH;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,KAAA,EAAE,EACpD,QAAoC,GACrC;;CAAK;;;;;;;;EAiBL;AA8ID;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,EAC/C,WAAW,EACX,KAAK,EACL,OAAO,EACP,aAAa,EAAE,gBAAgB,EAC/B,gBAAuB,EACvB,iBAAwB,EACxB,oBAAyB,EACzB,gBAAqB,EACrB,gBAAuB,EACvB,UAAe,EACf,OAAc,EACd,WAAW,EACX,UAAe,EACf,mBAAmB,EACnB,kBAAkB,EAAE,qBAA4B,EAChD,qBAA4B,EAC5B,qBAA4B,EAC5B,2BAAkC,GACnC,GAAE;IACD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC;IAC7B,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,EAAE,EACN,GAAO,EACP,gBAA6C,EAC7C,qBAAwD,GACzD,GAAE;IACD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC3B,OA4FL;AAqBD;;;GAGG;AACH,KAAK,kBAAkB,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,GAAG,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,GAAG,KAAA,EAAE,EAC3D,aAAa,EAAE,gBAAgB,EAC/B,kBAAkB,EAAE,qBAAqB,EACzC,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,aAAa,EACb,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,GAAG,EACH,gBAA6C,EAC7C,qBAAwD,GACzD,GAAE;IACD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IACzC,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,uBAAuB,CAAC,EAAE,kBAAkB,CAAC;IAC7C,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAC/C,qBAAqB,CAAC,EAAE,kBAAkB,CAAC;IAC3C,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,eAAe,CAAC,EAAE,kBAAkB,CAAC;IACrC,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,eAAe,CAAC,EAAE,kBAAkB,CAAC;IACrC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA/V4B,MAAM;cAAQ,MAAM,GAAG,IAAI;;;kBAA3B,MAAM;cAAQ,MAAM,GAAG,IAAI;;GA42B5D;;;;;;;;;AAED,wBAOE"}
|