@enbox/dwn-sdk-js 0.0.1

package/dist/esm/src/core/protocol-authorization.js

@@ -0,0 +1,608 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import Ajv from 'ajv/dist/2020.js';
+import { FilterUtility } from '../utils/filter.js';
+import { PermissionsProtocol } from '../protocols/permissions.js';
+import { Records } from '../utils/records.js';
+import { RecordsWrite } from '../interfaces/records-write.js';
+import { DwnError, DwnErrorCode } from './dwn-error.js';
+import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
+import { ProtocolAction, ProtocolActor } from '../types/protocols-types.js';
+export class ProtocolAuthorization {
+    /**
+     * Performs validation on the structure of RecordsWrite messages that use a protocol.
+     * @throws {Error} if validation fails.
+     */
+    static validateReferentialIntegrity(tenant, incomingMessage, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // fetch the protocol definition
+            const protocolDefinition = yield ProtocolAuthorization.fetchProtocolDefinition(tenant, incomingMessage.message.descriptor.protocol, messageStore);
+            // verify declared protocol type exists in protocol and that it conforms to type specification
+            ProtocolAuthorization.verifyType(incomingMessage.message, protocolDefinition.types);
+            // validate `protocolPath`
+            yield ProtocolAuthorization.verifyProtocolPathAndContextId(tenant, incomingMessage, messageStore);
+            // get the rule set for the inbound message
+            const ruleSet = ProtocolAuthorization.getRuleSet(incomingMessage.message.descriptor.protocolPath, protocolDefinition);
+            // Validate as a role record if the incoming message is writing a role record
+            yield ProtocolAuthorization.verifyAsRoleRecordIfNeeded(tenant, incomingMessage, ruleSet, messageStore);
+            // Verify size limit
+            ProtocolAuthorization.verifySizeLimit(incomingMessage, ruleSet);
+            // Verify protocol tags
+            ProtocolAuthorization.verifyTagsIfNeeded(incomingMessage, ruleSet);
+        });
+    }
+    /**
+     * Performs protocol-based authorization against the incoming RecordsWrite message.
+     * @throws {Error} if authorization fails.
+     */
+    static authorizeWrite(tenant, incomingMessage, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const existingInitialWrite = yield ProtocolAuthorization.fetchInitialWrite(tenant, incomingMessage.message.recordId, messageStore);
+            let recordChain;
+            if (existingInitialWrite === undefined) {
+                // NOTE: we can assume this message is an initial write because an existing initial write does not exist.
+                // Additionally, we check further down in the `RecordsWriteHandler` if the incoming message is an initialWrite,
+                // so we don't check explicitly here to avoid an unnecessary duplicate check.
+                recordChain = yield ProtocolAuthorization.constructRecordChain(tenant, incomingMessage.message.descriptor.parentId, messageStore);
+            }
+            else {
+                recordChain = yield ProtocolAuthorization.constructRecordChain(tenant, incomingMessage.message.recordId, messageStore);
+            }
+            // fetch the protocol definition
+            const protocolDefinition = yield ProtocolAuthorization.fetchProtocolDefinition(tenant, incomingMessage.message.descriptor.protocol, messageStore);
+            // get the rule set for the inbound message
+            const ruleSet = ProtocolAuthorization.getRuleSet(incomingMessage.message.descriptor.protocolPath, protocolDefinition);
+            // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
+            yield ProtocolAuthorization.verifyInvokedRole(tenant, incomingMessage, incomingMessage.message.descriptor.protocol, incomingMessage.message.contextId, protocolDefinition, messageStore);
+            // verify method invoked against the allowed actions in the rule set
+            yield ProtocolAuthorization.authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, recordChain, messageStore);
+        });
+    }
+    /**
+     * Performs protocol-based authorization against the incoming `RecordsRead` message.
+     * @param newestRecordsWrite The latest RecordsWrite associated with the recordId being read.
+     * @throws {Error} if authorization fails.
+     */
+    static authorizeRead(tenant, incomingMessage, newestRecordsWrite, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // fetch record chain
+            const recordChain = yield ProtocolAuthorization.constructRecordChain(tenant, newestRecordsWrite.message.recordId, messageStore);
+            // fetch the protocol definition
+            const protocolDefinition = yield ProtocolAuthorization.fetchProtocolDefinition(tenant, newestRecordsWrite.message.descriptor.protocol, messageStore);
+            // get the rule set for the inbound message
+            const ruleSet = ProtocolAuthorization.getRuleSet(newestRecordsWrite.message.descriptor.protocolPath, protocolDefinition);
+            // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
+            yield ProtocolAuthorization.verifyInvokedRole(tenant, incomingMessage, newestRecordsWrite.message.descriptor.protocol, newestRecordsWrite.message.contextId, protocolDefinition, messageStore);
+            // verify method invoked against the allowed actions in the rule set
+            yield ProtocolAuthorization.authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, recordChain, messageStore);
+        });
+    }
+    static authorizeQueryOrSubscribe(tenant, incomingMessage, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { protocol, protocolPath, contextId } = incomingMessage.message.descriptor.filter;
+            // fetch the protocol definition
+            const protocolDefinition = yield ProtocolAuthorization.fetchProtocolDefinition(tenant, protocol, // `authorizeQueryOrSubscribe` is only called if `protocol` is present
+            messageStore);
+            // get the rule set for the inbound message
+            const ruleSet = ProtocolAuthorization.getRuleSet(protocolPath, // presence of `protocolPath` is verified in `parse()`
+            protocolDefinition);
+            // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
+            yield ProtocolAuthorization.verifyInvokedRole(tenant, incomingMessage, protocol, contextId, protocolDefinition, messageStore);
+            // verify method invoked against the allowed actions in the rule set
+            yield ProtocolAuthorization.authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, [], // record chain is not relevant to queries or subscriptions
+            messageStore);
+        });
+    }
+    /**
+     * Performs protocol-based authorization against the incoming `RecordsDelete` message.
+     * @param recordsWrite A `RecordsWrite` of the record being deleted.
+     */
+    static authorizeDelete(tenant, incomingMessage, recordsWrite, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // fetch record chain
+            const recordChain = yield ProtocolAuthorization.constructRecordChain(tenant, incomingMessage.message.descriptor.recordId, messageStore);
+            // fetch the protocol definition
+            const protocolDefinition = yield ProtocolAuthorization.fetchProtocolDefinition(tenant, recordsWrite.message.descriptor.protocol, messageStore);
+            // get the rule set for the inbound message
+            const ruleSet = ProtocolAuthorization.getRuleSet(recordsWrite.message.descriptor.protocolPath, protocolDefinition);
+            // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
+            yield ProtocolAuthorization.verifyInvokedRole(tenant, incomingMessage, recordsWrite.message.descriptor.protocol, recordsWrite.message.contextId, protocolDefinition, messageStore);
+            // verify method invoked against the allowed actions in the rule set
+            yield ProtocolAuthorization.authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, recordChain, messageStore);
+        });
+    }
+    /**
+     * Fetches the protocol definition based on the protocol specified in the given message.
+     */
+    static fetchProtocolDefinition(tenant, protocolUri, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // if first-class protocol, return the definition from const object directly without going to data store
+            if (protocolUri === PermissionsProtocol.uri) {
+                return PermissionsProtocol.definition;
+            }
+            // fetch the corresponding protocol definition
+            const query = {
+                interface: DwnInterfaceName.Protocols,
+                method: DwnMethodName.Configure,
+                protocol: protocolUri
+            };
+            const { messages: protocols } = yield messageStore.query(tenant, [query]);
+            if (protocols.length === 0) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationProtocolNotFound, `unable to find protocol definition for ${protocolUri}`);
+            }
+            const protocolMessage = protocols[0];
+            return protocolMessage.descriptor.definition;
+        });
+    }
+    /**
+     * Constructs the chain of EXISTING records in the datastore where the first record is the root initial `RecordsWrite` of the record chain
+     * and last record is the initial `RecordsWrite` of the descendant record specified.
+     * @param descendantRecordId The ID of the descendent record to start constructing the record chain from by repeatedly looking up the parent.
+     * @returns the record chain where each record is represented by its initial `RecordsWrite`;
+     *          returns empty array if `descendantRecordId` is `undefined`.
+     * @throws {DwnError} if `descendantRecordId` is defined but any initial `RecordsWrite` is not found in the chain of records.
+     */
+    static constructRecordChain(tenant, descendantRecordId, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (descendantRecordId === undefined) {
+                return [];
+            }
+            const recordChain = [];
+            // keep walking up the chain from the inbound message's parent, until there is no more parent
+            let currentRecordId = descendantRecordId;
+            while (currentRecordId !== undefined) {
+                const initialWrite = yield ProtocolAuthorization.fetchInitialWrite(tenant, currentRecordId, messageStore);
+                // RecordsWrite needed should be available since we perform necessary checks at the time of writes,
+                // eg. check the immediate parent in `verifyProtocolPathAndContextId` at the time of writing,
+                // so if this condition is triggered, it means there is an unexpected bug that caused an incomplete chain.
+                // We add additional defensive check here because returning an unexpected/incorrect record chain could lead to security vulnerabilities.
+                if (initialWrite === undefined) {
+                    throw new DwnError(DwnErrorCode.ProtocolAuthorizationParentNotFoundConstructingRecordChain, `Unexpected error that should never trigger: no parent found with ID ${currentRecordId} when constructing record chain.`);
+                }
+                recordChain.push(initialWrite);
+                currentRecordId = initialWrite.descriptor.parentId;
+            }
+            return recordChain.reverse(); // root record first
+        });
+    }
+    /**
+     * Fetches the initial RecordsWrite message associated with the given (tenant + recordId).
+     */
+    static fetchInitialWrite(tenant, recordId, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const query = {
+                interface: DwnInterfaceName.Records,
+                method: DwnMethodName.Write,
+                recordId: recordId
+            };
+            const { messages } = yield messageStore.query(tenant, [query]);
+            if (messages.length === 0) {
+                return undefined;
+            }
+            const initialWrite = yield RecordsWrite.getInitialWrite(messages);
+            return initialWrite;
+        });
+    }
+    /**
+     * Gets the rule set corresponding to the given protocolPath.
+     */
+    static getRuleSet(protocolPath, protocolDefinition) {
+        const ruleSet = ProtocolAuthorization.getRuleSetAtProtocolPath(protocolPath, protocolDefinition);
+        if (ruleSet === undefined) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationMissingRuleSet, `No rule set defined for protocolPath ${protocolPath}`);
+        }
+        return ruleSet;
+    }
+    /**
+     * Verifies the `protocolPath` declared in the given message (if it is a RecordsWrite) matches the path of actual record chain.
+     * @throws {DwnError} if fails verification.
+     */
+    static verifyProtocolPathAndContextId(tenant, inboundMessage, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const declaredProtocolPath = inboundMessage.message.descriptor.protocolPath;
+            const declaredTypeName = ProtocolAuthorization.getTypeName(declaredProtocolPath);
+            const parentId = inboundMessage.message.descriptor.parentId;
+            if (parentId === undefined) {
+                if (declaredProtocolPath !== declaredTypeName) {
+                    throw new DwnError(DwnErrorCode.ProtocolAuthorizationParentlessIncorrectProtocolPath, `Declared protocol path '${declaredProtocolPath}' is not valid for records with no parent'.`);
+                }
+                return;
+            }
+            // Else `parentId` is defined, so we need to verify both protocolPath and contextId
+            // fetch the parent message
+            const protocol = inboundMessage.message.descriptor.protocol;
+            const query = {
+                isLatestBaseState: true, // NOTE: this filter is critical, to ensure are are not returning a deleted parent
+                interface: DwnInterfaceName.Records,
+                method: DwnMethodName.Write,
+                protocol,
+                recordId: parentId
+            };
+            const { messages: parentMessages } = yield messageStore.query(tenant, [query]);
+            const parentMessage = parentMessages[0];
+            // verifying protocolPath of incoming message is a child of the parent message's protocolPath
+            const parentProtocolPath = (_a = parentMessage === null || parentMessage === void 0 ? void 0 : parentMessage.descriptor) === null || _a === void 0 ? void 0 : _a.protocolPath;
+            const expectedProtocolPath = `${parentProtocolPath}/${declaredTypeName}`;
+            if (expectedProtocolPath !== declaredProtocolPath) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationIncorrectProtocolPath, `Could not find matching parent record to verify declared protocol path '${declaredProtocolPath}'.`);
+            }
+            // verifying contextId of incoming message is a child of the parent message's contextId
+            const expectedContextId = `${parentMessage.contextId}/${inboundMessage.message.recordId}`;
+            const actualContextId = inboundMessage.message.contextId;
+            if (actualContextId !== expectedContextId) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationIncorrectContextId, `Declared contextId '${actualContextId}' is not the same as expected: '${expectedContextId}'.`);
+            }
+        });
+    }
+    /**
+     * Verifies the `dataFormat` and `schema` declared in the given message (if it is a RecordsWrite) matches dataFormat
+     * and schema of the type in the given protocol.
+     * @throws {DwnError} if fails verification.
+     */
+    static verifyType(inboundMessage, protocolTypes) {
+        const typeNames = Object.keys(protocolTypes);
+        const declaredProtocolPath = inboundMessage.descriptor.protocolPath;
+        const declaredTypeName = ProtocolAuthorization.getTypeName(declaredProtocolPath);
+        if (!typeNames.includes(declaredTypeName)) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationInvalidType, `record with type ${declaredTypeName} not allowed in protocol`);
+        }
+        const protocolPath = inboundMessage.descriptor.protocolPath;
+        // existence of `protocolType` has already been verified
+        const typeName = ProtocolAuthorization.getTypeName(protocolPath);
+        const protocolType = protocolTypes[typeName];
+        // no `schema` specified in protocol definition means that any schema is allowed
+        const { schema } = inboundMessage.descriptor;
+        if (protocolType.schema !== undefined && protocolType.schema !== schema) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationInvalidSchema, `type '${typeName}' must have schema '${protocolType.schema}', \
+        instead has '${schema}'`);
+        }
+        // no `dataFormats` specified in protocol definition means that all dataFormats are allowed
+        const { dataFormat } = inboundMessage.descriptor;
+        if (protocolType.dataFormats !== undefined && !protocolType.dataFormats.includes(dataFormat)) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationIncorrectDataFormat, `type '${typeName}' must have data format in (${protocolType.dataFormats}), \
+        instead has '${dataFormat}'`);
+        }
+    }
+    /**
+     * Check if the incoming message is invoking a role. If so, validate the invoked role.
+     */
+    static verifyInvokedRole(tenant, incomingMessage, protocolUri, contextId, protocolDefinition, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const protocolRole = (_a = incomingMessage.signaturePayload) === null || _a === void 0 ? void 0 : _a.protocolRole;
+            // Only verify role if there is a role being invoked
+            if (protocolRole === undefined) {
+                return;
+            }
+            const roleRuleSet = ProtocolAuthorization.getRuleSetAtProtocolPath(protocolRole, protocolDefinition);
+            if (roleRuleSet === undefined || !roleRuleSet.$role) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationNotARole, `Protocol path ${protocolRole} does not match role record type.`);
+            }
+            // Construct a filter to fetch the invoked role record
+            const roleRecordFilter = {
+                interface: DwnInterfaceName.Records,
+                method: DwnMethodName.Write,
+                protocol: protocolUri,
+                protocolPath: protocolRole,
+                recipient: incomingMessage.author,
+                isLatestBaseState: true,
+            };
+            const ancestorSegmentCountOfRolePath = protocolRole.split('/').length - 1;
+            if (contextId === undefined && ancestorSegmentCountOfRolePath > 0) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationMissingContextId, 'Could not verify role because contextId is missing.');
+            }
+            // Compute `contextId` prefix filter for fetching the invoked role record if the role path is not at the root level.
+            // e.g. if invoked role path is `Thread/Participant`, and the `contextId` of the message is `threadX/messageY/attachmentZ`,
+            // then we need to add a prefix filter as `threadX` for the `contextId`
+            // because the `contextId` of the Participant record would be in the form of be `threadX/participantA`
+            if (ancestorSegmentCountOfRolePath > 0) {
+                const contextIdSegments = contextId.split('/'); // NOTE: currently contextId segment count is never shorter than the role path count.
+                const contextIdPrefix = contextIdSegments.slice(0, ancestorSegmentCountOfRolePath).join('/');
+                const contextIdPrefixFilter = FilterUtility.constructPrefixFilterAsRangeFilter(contextIdPrefix);
+                roleRecordFilter.contextId = contextIdPrefixFilter;
+            }
+            const { messages: matchingMessages } = yield messageStore.query(tenant, [roleRecordFilter]);
+            if (matchingMessages.length === 0) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationMatchingRoleRecordNotFound, `No matching role record found for protocol path ${protocolRole}`);
+            }
+        });
+    }
+    /**
+     * Returns all the ProtocolActions that would authorized the incoming message
+     * (but we still need to later verify if there is a rule defined that matches one of the actions).
+     * NOTE: the reason why there could be multiple actions is because:
+     * - In case of an initial RecordsWrite, the RecordsWrite can be authorized by an allow `create` or `write` rule.
+     * - In case of a non-initial RecordsWrite by the original record author, the RecordsWrite can be authorized by a `write` or `co-update` rule.
+     *
+     * It is important to recognize that the `write` access that allowed the original record author to create the record maybe revoked
+     * (e.g. by role revocation) by the time a "non-initial" write by the same author is attempted.
+     */
+    static getActionsSeekingARuleMatch(tenant, incomingMessage, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            switch (incomingMessage.message.descriptor.method) {
+                case DwnMethodName.Delete:
+                    const recordsDelete = incomingMessage;
+                    const recordId = recordsDelete.message.descriptor.recordId;
+                    const initialWrite = yield RecordsWrite.fetchInitialRecordsWrite(messageStore, tenant, recordId);
+                    // if there is no initial write, then no action rule can authorize the incoming message, because we won't know who the original author is
+                    // NOTE: purely defensive programming: currently not reachable
+                    // because RecordsDelete handler already have an existence check prior to this method being called.
+                    if (initialWrite === undefined) {
+                        return [];
+                    }
+                    const actionsThatWouldAuthorizeDelete = [];
+                    const prune = recordsDelete.message.descriptor.prune;
+                    if (prune) {
+                        actionsThatWouldAuthorizeDelete.push(ProtocolAction.CoPrune);
+                        // A prune by the original record author can also be authorized by a 'prune' rule.
+                        if (incomingMessage.author === initialWrite.author) {
+                            actionsThatWouldAuthorizeDelete.push(ProtocolAction.Prune);
+                        }
+                    }
+                    else {
+                        actionsThatWouldAuthorizeDelete.push(ProtocolAction.CoDelete);
+                        // A delete by the original record author can also be authorized by a 'delete' rule.
+                        if (incomingMessage.author === initialWrite.author) {
+                            actionsThatWouldAuthorizeDelete.push(ProtocolAction.Delete);
+                        }
+                    }
+                    return actionsThatWouldAuthorizeDelete;
+                case DwnMethodName.Query:
+                    return [ProtocolAction.Query];
+                case DwnMethodName.Read:
+                    return [ProtocolAction.Read];
+                case DwnMethodName.Subscribe:
+                    return [ProtocolAction.Subscribe];
+                case DwnMethodName.Write:
+                    const incomingRecordsWrite = incomingMessage;
+                    if (yield incomingRecordsWrite.isInitialWrite()) {
+                        return [ProtocolAction.Create];
+                    }
+                    else {
+                        // else incoming RecordsWrite not an initial write
+                        const recordId = incomingMessage.message.recordId;
+                        const initialWrite = yield RecordsWrite.fetchInitialRecordsWrite(messageStore, tenant, recordId);
+                        // if there is no initial write to update from, then no action rule can authorize the incoming message
+                        if (initialWrite === undefined) {
+                            return [];
+                        }
+                        if (incomingMessage.author === initialWrite.author) {
+                            // 'update' or 'co-update' action authorizes the incoming message
+                            return [ProtocolAction.CoUpdate, ProtocolAction.Update];
+                        }
+                        else {
+                            // An update by someone who is not the record author can only be authorized by a 'co-update' rule.
+                            return [ProtocolAction.CoUpdate];
+                        }
+                    }
+            }
+            // purely defensive programming: should not be reachable
+            // setting to empty array will prevent any message from being authorized
+            return [];
+        });
+    }
+    /**
+     * Verifies the given message is authorized by one of the action rules in the given protocol rule set.
+     * @throws {Error} if action not allowed.
+     */
+    static authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, recordChain, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const incomingMessageMethod = incomingMessage.message.descriptor.method;
+            const actionsSeekingARuleMatch = yield ProtocolAuthorization.getActionsSeekingARuleMatch(tenant, incomingMessage, messageStore);
+            const author = incomingMessage.author;
+            const actionRules = ruleSet.$actions;
+            // NOTE: We have already checked that the message is not from tenant, owner, or permission grant authorized prior to this method being called.
+            if (actionRules === undefined) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationActionRulesNotFound, `no action rule defined for Records${incomingMessageMethod}, ${author} is unauthorized`);
+            }
+            const invokedRole = (_a = incomingMessage.signaturePayload) === null || _a === void 0 ? void 0 : _a.protocolRole;
+            // Iterate through the action rules to find a rule that authorizes the incoming message.
+            for (const actionRule of actionRules) {
+                // If the action rule does not have an allowed action that matches an action that can authorize the message, skip to evaluate next action rule.
+                const ruleHasAMatchingAllowedAction = actionRule.can.some(allowedAction => actionsSeekingARuleMatch.includes(allowedAction));
+                if (!ruleHasAMatchingAllowedAction) {
+                    continue;
+                }
+                // Code reaches here means this action rule has an allowed action that matches the action of the message.
+                // The remaining code checks the actor/author of the incoming message.
+                // If the action rule allows `anyone`, then no further checks are needed.
+                if (actionRule.who === ProtocolActor.Anyone) {
+                    return;
+                }
+                // Since not `anyone` is allowed in this action rule, we will need to check the author of the incoming message,
+                // if the author of incoming message is not defined, this action rule cannot authorize the incoming message.
+                if (author === undefined) {
+                    continue;
+                }
+                // go through role validation path if a role is invoked by the incoming message
+                if (invokedRole !== undefined) {
+                    // When a protocol role is being invoked, we require that there is a matching `role` rule.
+                    if (actionRule.role === invokedRole) {
+                        // role is successfully invoked
+                        return;
+                    }
+                    else {
+                        continue;
+                    }
+                }
+                // else we go through the actor (`who`) validation
+                // If `of` is not set, handle it as a special case
+                // NOTE: `of` is always set if `who` is set to `author` (we do this check in `validateRuleSetRecursively()`)
+                if (actionRule.who === ProtocolActor.Recipient && actionRule.of === undefined) {
+                    // If the action rule specifies a recipient without `of` and the incoming message is authenticated:
+                    // Author must be recipient of the record being accessed
+                    let recordsWriteMessage;
+                    if (incomingMessage.message.descriptor.method === DwnMethodName.Write) {
+                        recordsWriteMessage = incomingMessage.message;
+                    }
+                    else {
+                        // else the incoming message must be a `RecordsDelete` because only `co-update`, `co-delete`, `co-prune` are allowed recipient actions,
+                        // (we do this check in `validateRuleSetRecursively()`)
+                        // and we have already checked that the incoming message is not a `RecordsWrite` above which covers `co-update` path.
+                        recordsWriteMessage = recordChain[recordChain.length - 1];
+                    }
+                    if (recordsWriteMessage.descriptor.recipient === author) {
+                        return;
+                    }
+                    else {
+                        continue;
+                    }
+                }
+                // validate the actor is allowed by the current action rule
+                const ancestorRuleSuccess = yield ProtocolAuthorization.checkActor(author, actionRule, recordChain);
+                if (ancestorRuleSuccess) {
+                    return;
+                }
+            }
+            // No action rules were satisfied, message is not authorized
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationActionNotAllowed, `Inbound message action Records${incomingMessageMethod} by author ${incomingMessage.author} not allowed.`);
+        });
+    }
+    /**
+     * Verifies that writes adhere to the $size constraints if provided
+     * @throws {Error} if size is exceeded.
+     */
+    static verifySizeLimit(incomingMessage, ruleSet) {
+        const { min = 0, max } = ruleSet.$size || {};
+        const dataSize = incomingMessage.message.descriptor.dataSize;
+        if (dataSize < min) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationMinSizeInvalid, `data size ${dataSize} is less than allowed ${min}`);
+        }
+        if (max === undefined) {
+            return;
+        }
+        if (dataSize > max) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationMaxSizeInvalid, `data size ${dataSize} is more than allowed ${max}`);
+        }
+    }
+    static verifyTagsIfNeeded(incomingMessage, ruleSet) {
+        if (ruleSet.$tags !== undefined) {
+            const { tags = {}, protocol, protocolPath } = incomingMessage.message.descriptor;
+            const _a = ruleSet.$tags, { $allowUndefinedTags, $requiredTags } = _a, properties = __rest(_a, ["$allowUndefinedTags", "$requiredTags"]);
+            // if $allowUndefinedTags is set to false and there are properties not defined in the schema, an error is thrown
+            const additionalProperties = $allowUndefinedTags || false;
+            // if $requiredTags is set, all required tags must be present
+            const required = $requiredTags || [];
+            const ajv = new Ajv.default();
+            const compiledTags = ajv.compile({
+                type: 'object',
+                properties,
+                required,
+                additionalProperties,
+            });
+            const validSchema = compiledTags(tags);
+            if (!validSchema) {
+                // the `dataVar` is used to add a qualifier to the error message.
+                // For example. If the error is related to a tag `status` in a protocol `https://example.protocol` with the protocolPath `example/path`
+                // the error would be described as `https://example.protocol/example/path/$tags/status'
+                // without this decorator it would show up as `data/status` which may be confusing.
+                const schemaError = ajv.errorsText(compiledTags.errors, { dataVar: `${protocol}/${protocolPath}/$tags` });
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationTagsInvalidSchema, `tags schema validation error: ${schemaError}`);
+            }
+        }
+    }
+    /**
+     * If the given RecordsWrite is not a role record, this method does nothing and succeeds immediately.
+     *
+     * Else it verifies the validity of the given `RecordsWrite` as a role record, including:
+     * 1. The same role has not been assigned to the same entity/recipient.
+     */
+    static verifyAsRoleRecordIfNeeded(tenant, incomingMessage, ruleSet, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!ruleSet.$role) {
+                return;
+            }
+            // else this is a role record
+            const incomingRecordsWrite = incomingMessage;
+            const recipient = incomingRecordsWrite.message.descriptor.recipient;
+            if (recipient === undefined) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationRoleMissingRecipient, 'Role records must have a recipient');
+            }
+            const protocolPath = incomingRecordsWrite.message.descriptor.protocolPath;
+            const filter = {
+                interface: DwnInterfaceName.Records,
+                method: DwnMethodName.Write,
+                isLatestBaseState: true,
+                protocol: incomingRecordsWrite.message.descriptor.protocol,
+                protocolPath,
+                recipient,
+            };
+            const parentContextId = Records.getParentContextFromOfContextId(incomingRecordsWrite.message.contextId);
+            // if this is not the root record, add a prefix filter to the query
+            if (parentContextId !== '') {
+                const prefixFilter = FilterUtility.constructPrefixFilterAsRangeFilter(parentContextId);
+                filter.contextId = prefixFilter;
+            }
+            const { messages: matchingMessages } = yield messageStore.query(tenant, [filter]);
+            const matchingRecords = matchingMessages;
+            const matchingRecordsExceptIncomingRecordId = matchingRecords.filter((recordsWriteMessage) => recordsWriteMessage.recordId !== incomingRecordsWrite.message.recordId);
+            if (matchingRecordsExceptIncomingRecordId.length > 0) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationDuplicateRoleRecipient, `DID '${recipient}' is already recipient of a role record at protocol path '${protocolPath} under the parent context ${parentContextId}.`);
+            }
+        });
+    }
+    static getRuleSetAtProtocolPath(protocolPath, protocolDefinition) {
+        const protocolPathArray = protocolPath.split('/');
+        let currentRuleSet = protocolDefinition.structure;
+        let i = 0;
+        while (i < protocolPathArray.length) {
+            const currentTypeName = protocolPathArray[i];
+            const nextRuleSet = currentRuleSet[currentTypeName];
+            if (nextRuleSet === undefined) {
+                return undefined;
+            }
+            currentRuleSet = nextRuleSet;
+            i++;
+        }
+        return currentRuleSet;
+    }
+    /**
+     * Checks if the `who: 'author' | 'recipient'` action rule has a matching record in the record chain.
+     * @returns `true` if the action rule is satisfied; `false` otherwise.
+     */
+    static checkActor(author, actionRule, recordChain) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // find a message with matching protocolPath
+            const ancestorRecordsWrite = recordChain.find((recordsWriteMessage) => recordsWriteMessage.descriptor.protocolPath === actionRule.of);
+            if (ancestorRecordsWrite === undefined) {
+                // If this is reached, there is likely an issue with the protocol definition.
+                // The protocolPath to the actionRule should start with actionRule.of
+                // consider moving this check to ProtocolsConfigure message ingestion
+                return false;
+            }
+            if (actionRule.who === ProtocolActor.Recipient) {
+                // author of the incoming message must be the recipient of the ancestor message
+                return author === ancestorRecordsWrite.descriptor.recipient;
+            }
+            else { // actionRule.who === ProtocolActor.Author
+                // author of the incoming message must be the author of the ancestor message
+                const ancestorAuthor = (yield RecordsWrite.parse(ancestorRecordsWrite)).author;
+                return author === ancestorAuthor;
+            }
+        });
+    }
+    static getTypeName(protocolPath) {
+        return protocolPath.split('/').slice(-1)[0];
+    }
+}
+//# sourceMappingURL=protocol-authorization.js.map

package/dist/esm/src/core/protocol-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-authorization.js","sourceRoot":"","sources":["../../../../src/core/protocol-authorization.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AASA,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5E,MAAM,OAAO,qBAAqB;IAEhC;;;OAGG;IACI,MAAM,CAAO,4BAA4B,CAC9C,MAAc,EACd,eAA6B,EAC7B,YAA0B;;YAE1B,gCAAgC;YAChC,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS,EAC5C,YAAY,CACb,CAAC;YAEF,8FAA8F;YAC9F,qBAAqB,CAAC,UAAU,CAC9B,eAAe,CAAC,OAAO,EACvB,kBAAkB,CAAC,KAAK,CACzB,CAAC;YAEF,0BAA0B;YAC1B,MAAM,qBAAqB,CAAC,8BAA8B,CACxD,MAAM,EACN,eAAe,EACf,YAAY,CACb,CAAC;YAEF,2CAA2C;YAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAa,EAChD,kBAAkB,CACnB,CAAC;YAEF,6EAA6E;YAC7E,MAAM,qBAAqB,CAAC,0BAA0B,CACpD,MAAM,EACN,eAAe,EACf,OAAO,EACP,YAAY,CACb,CAAC;YAEF,oBAAoB;YACpB,qBAAqB,CAAC,eAAe,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAEhE,uBAAuB;YACvB,qBAAqB,CAAC,kBAAkB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,cAAc,CAChC,MAAc,EACd,eAA6B,EAC7B,YAA0B;;YAE1B,MAAM,oBAAoB,GAAG,MAAM,qBAAqB,CAAC,iBAAiB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAEnI,IAAI,WAAW,CAAC;YAChB,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,yGAAyG;gBACzG,+GAA+G;gBAC/G,6EAA6E;gBAC7E,WAAW,GAAG,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACpI,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACzH,CAAC;YAED,gCAAgC;YAChC,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS,EAC5C,YAAY,CACb,CAAC;YAEF,2CAA2C;YAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAa,EAChD,kBAAkB,CACnB,CAAC;YAEF,0FAA0F;YAC1F,MAAM,qBAAqB,CAAC,iBAAiB,CAC3C,MAAM,EACN,eAAe,EACf,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS,EAC5C,eAAe,CAAC,OAAO,CAAC,SAAU,EAClC,kBAAkB,EAClB,YAAY,CACb,CAAC;YAEF,oEAAoE;YACpE,MAAM,qBAAqB,CAAC,8BAA8B,CACxD,MAAM,EACN,eAAe,EACf,OAAO,EACP,WAAW,EACX,YAAY,CACb,CAAC;QACJ,CAAC;KAAA;IAED;;;;OAIG;IACI,MAAM,CAAO,aAAa,CAC/B,MAAc,EACd,eAA4B,EAC5B,kBAAgC,EAChC,YAA0B;;YAE1B,qBAAqB;YACrB,MAAM,WAAW,GACf,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAE9G,gCAAgC;YAChC,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS,EAC/C,YAAY,CACb,CAAC;YAEF,2CAA2C;YAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,YAAa,EACnD,kBAAkB,CACnB,CAAC;YAEF,0FAA0F;YAC1F,MAAM,qBAAqB,CAAC,iBAAiB,CAC3C,MAAM,EACN,eAAe,EACf,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS,EAC/C,kBAAkB,CAAC,OAAO,CAAC,SAAU,EACrC,kBAAkB,EAClB,YAAY,CACb,CAAC;YAEF,oEAAoE;YACpE,MAAM,qBAAqB,CAAC,8BAA8B,CACxD,MAAM,EACN,eAAe,EACf,OAAO,EACP,WAAW,EACX,YAAY,CACb,CAAC;QACJ,CAAC;KAAA;IAEM,MAAM,CAAO,yBAAyB,CAC3C,MAAc,EACd,eAAgD,EAChD,YAA0B;;YAE1B,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAExF,gCAAgC;YAChC,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,QAAS,EAAE,sEAAsE;YACjF,YAAY,CACb,CAAC;YAEF,2CAA2C;YAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,YAAa,EAAE,sDAAsD;YACrE,kBAAkB,CACnB,CAAC;YAEF,0FAA0F;YAC1F,MAAM,qBAAqB,CAAC,iBAAiB,CAC3C,MAAM,EACN,eAAe,EACf,QAAS,EACT,SAAS,EACT,kBAAkB,EAClB,YAAY,CACb,CAAC;YAEF,oEAAoE;YACpE,MAAM,qBAAqB,CAAC,8BAA8B,CACxD,MAAM,EACN,eAAe,EACf,OAAO,EACP,EAAE,EAAE,2DAA2D;YAC/D,YAAY,CACb,CAAC;QACJ,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,eAAe,CACjC,MAAc,EACd,eAA8B,EAC9B,YAA0B,EAC1B,YAA0B;;YAG1B,qBAAqB;YACrB,MAAM,WAAW,GACf,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAEtH,gCAAgC;YAChC,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS,EACzC,YAAY,CACb,CAAC;YAEF,2CAA2C;YAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,YAAa,EAC7C,kBAAkB,CACnB,CAAC;YAEF,0FAA0F;YAC1F,MAAM,qBAAqB,CAAC,iBAAiB,CAC3C,MAAM,EACN,eAAe,EACf,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS,EACzC,YAAY,CAAC,OAAO,CAAC,SAAU,EAC/B,kBAAkB,EAClB,YAAY,CACb,CAAC;YAEF,oEAAoE;YACpE,MAAM,qBAAqB,CAAC,8BAA8B,CACxD,MAAM,EACN,eAAe,EACf,OAAO,EACP,WAAW,EACX,YAAY,CACb,CAAC;QACJ,CAAC;KAAA;IAED;;OAEG;IACK,MAAM,CAAO,uBAAuB,CAC1C,MAAc,EACd,WAAmB,EACnB,YAA0B;;YAE1B,wGAAwG;YACxG,IAAI,WAAW,KAAK,mBAAmB,CAAC,GAAG,EAAE,CAAC;gBAC5C,OAAO,mBAAmB,CAAC,UAAU,CAAC;YACxC,CAAC;YAED,8CAA8C;YAC9C,MAAM,KAAK,GAAW;gBACpB,SAAS,EAAG,gBAAgB,CAAC,SAAS;gBACtC,MAAM,EAAM,aAAa,CAAC,SAAS;gBACnC,QAAQ,EAAI,WAAW;aACxB,CAAC;YACF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAE1E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,qCAAqC,EAAE,0CAA0C,WAAW,EAAE,CAAC,CAAC;YAClI,CAAC;YAED,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAA8B,CAAC;YAClE,OAAO,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/C,CAAC;KAAA;IAED;;;;;;;OAOG;IACK,MAAM,CAAO,oBAAoB,CACvC,MAAc,EACd,kBAAsC,EACtC,YAA0B;;YAG1B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,WAAW,GAA0B,EAAE,CAAC;YAE9C,6FAA6F;YAC7F,IAAI,eAAe,GAAuB,kBAAkB,CAAC;YAC7D,OAAO,eAAe,KAAK,SAAS,EAAE,CAAC;gBAErC,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;gBAE1G,mGAAmG;gBACnG,6FAA6F;gBAC7F,0GAA0G;gBAC1G,wIAAwI;gBACxI,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0DAA0D,EACvE,uEAAuE,eAAe,kCAAkC,CACzH,CAAC;gBACJ,CAAC;gBAED,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC/B,eAAe,GAAG,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrD,CAAC;YAED,OAAO,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,oBAAoB;QACpD,CAAC;KAAA;IAED;;OAEG;IACK,MAAM,CAAO,iBAAiB,CACpC,MAAc,EACd,QAAgB,EAChB,YAA0B;;YAG1B,MAAM,KAAK,GAAW;gBACpB,SAAS,EAAG,gBAAgB,CAAC,OAAO;gBACpC,MAAM,EAAM,aAAa,CAAC,KAAK;gBAC/B,QAAQ,EAAI,QAAQ;aACrB,CAAC;YACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAE/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAClE,OAAO,YAAY,CAAC;QACtB,CAAC;KAAA;IAED;;OAEG;IACK,MAAM,CAAC,UAAU,CACvB,YAAoB,EACpB,kBAAsC;QAEtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,wBAAwB,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACjG,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EACjE,wCAAwC,YAAY,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAO,8BAA8B,CACjD,MAAc,EACd,cAA4B,EAC5B,YAA0B;;;YAE1B,MAAM,oBAAoB,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,YAAa,CAAC;YAC7E,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;YAEjF,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC5D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,oBAAoB,KAAK,gBAAgB,EAAE,CAAC;oBAC9C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,oDAAoD,EACjE,2BAA2B,oBAAoB,6CAA6C,CAC7F,CAAC;gBACJ,CAAC;gBAED,OAAO;YACT,CAAC;YAED,mFAAmF;YAEnF,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS,CAAC;YAC7D,MAAM,KAAK,GAAW;gBACpB,iBAAiB,EAAG,IAAI,EAAE,kFAAkF;gBAC5G,SAAS,EAAW,gBAAgB,CAAC,OAAO;gBAC5C,MAAM,EAAc,aAAa,CAAC,KAAK;gBACvC,QAAQ;gBACR,QAAQ,EAAY,QAAQ;aAC7B,CAAC;YACF,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/E,MAAM,aAAa,GAAI,cAAwC,CAAC,CAAC,CAAC,CAAC;YAEnE,6FAA6F;YAC7F,MAAM,kBAAkB,GAAG,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,UAAU,0CAAE,YAAY,CAAC;YACnE,MAAM,oBAAoB,GAAG,GAAG,kBAAkB,IAAI,gBAAgB,EAAE,CAAC;YACzE,IAAI,oBAAoB,KAAK,oBAAoB,EAAE,CAAC;gBAClD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0CAA0C,EACvD,2EAA2E,oBAAoB,IAAI,CACpG,CAAC;YACJ,CAAC;YAED,uFAAuF;YACvF,MAAM,iBAAiB,GAAG,GAAG,aAAa,CAAC,SAAS,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1F,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;YACzD,IAAI,eAAe,KAAK,iBAAiB,EAAE,CAAC;gBAC1C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uCAAuC,EACpD,uBAAuB,eAAe,mCAAmC,iBAAiB,IAAI,CAC/F,CAAC;YACJ,CAAC;QAEH,CAAC;KAAA;IAED;;;;OAIG;IACK,MAAM,CAAC,UAAU,CACvB,cAAmC,EACnC,aAA4B;QAG5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,oBAAoB,GAAG,cAAc,CAAC,UAAU,CAAC,YAAa,CAAC;QACrE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,gCAAgC,EAC9D,oBAAoB,gBAAgB,0BAA0B,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,YAAY,GAAG,cAAc,CAAC,UAAU,CAAC,YAAa,CAAC;QAC7D,wDAAwD;QACxD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACjE,MAAM,YAAY,GAAiB,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE3D,gFAAgF;QAChF,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;QAC7C,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxE,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,kCAAkC,EAC/C,SAAS,QAAQ,uBAAuB,YAAY,CAAC,MAAM;uBAC5C,MAAM,GAAG,CACzB,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,MAAM,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;QACjD,IAAI,YAAY,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,wCAAwC,EACrD,SAAS,QAAQ,+BAA+B,YAAY,CAAC,WAAW;uBACzD,UAAU,GAAG,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,MAAM,CAAO,iBAAiB,CACpC,MAAc,EACd,eAA6F,EAC7F,WAAmB,EACnB,SAA6B,EAC7B,kBAAsC,EACtC,YAA0B;;;YAE1B,MAAM,YAAY,GAAG,MAAA,eAAe,CAAC,gBAAgB,0CAAE,YAAY,CAAC;YAEpE,oDAAoD;YACpD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,wBAAwB,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;YACrG,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACpD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,6BAA6B,EAC1C,iBAAiB,YAAY,mCAAmC,CACjE,CAAC;YACJ,CAAC;YAED,sDAAsD;YACtD,MAAM,gBAAgB,GAAW;gBAC/B,SAAS,EAAW,gBAAgB,CAAC,OAAO;gBAC5C,MAAM,EAAc,aAAa,CAAC,KAAK;gBACvC,QAAQ,EAAY,WAAW;gBAC/B,YAAY,EAAQ,YAAY;gBAChC,SAAS,EAAW,eAAe,CAAC,MAAO;gBAC3C,iBAAiB,EAAG,IAAI;aACzB,CAAC;YAEF,MAAM,8BAA8B,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC1E,IAAI,SAAS,KAAK,SAAS,IAAI,8BAA8B,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,qCAAqC,EAClD,qDAAqD,CACtD,CAAC;YACJ,CAAC;YAED,oHAAoH;YACpH,2HAA2H;YAC3H,uEAAuE;YACvE,sGAAsG;YACtG,IAAI,8BAA8B,GAAG,CAAC,EAAE,CAAC;gBACvC,MAAM,iBAAiB,GAAG,SAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,qFAAqF;gBACtI,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7F,MAAM,qBAAqB,GAAG,aAAa,CAAC,kCAAkC,CAAC,eAAe,CAAC,CAAC;gBAEhG,gBAAgB,CAAC,SAAS,GAAG,qBAAqB,CAAC;YACrD,CAAC;YAGD,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAE5F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,+CAA+C,EAC5D,mDAAmD,YAAY,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAED;;;;;;;;;OASG;IACK,MAAM,CAAO,2BAA2B,CAC9C,MAAc,EACd,eAA6F,EAC7F,YAA0B;;YAG1B,QAAQ,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACpD,KAAK,aAAa,CAAC,MAAM;oBACvB,MAAM,aAAa,GAAG,eAAgC,CAAC;oBACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAC3D,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAEjG,yIAAyI;oBACzI,8DAA8D;oBAC9D,mGAAmG;oBACnG,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;wBAC/B,OAAO,EAAE,CAAC;oBACZ,CAAC;oBAED,MAAM,+BAA+B,GAAG,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;oBACrD,IAAI,KAAK,EAAE,CAAC;wBACV,+BAA+B,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;wBAE7D,kFAAkF;wBAClF,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;4BACnD,+BAA+B,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;wBAC7D,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,+BAA+B,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;wBAE9D,oFAAoF;wBACpF,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;4BACnD,+BAA+B,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;wBAC9D,CAAC;oBACH,CAAC;oBAED,OAAO,+BAA+B,CAAC;gBAEzC,KAAK,aAAa,CAAC,KAAK;oBACtB,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBAEhC,KAAK,aAAa,CAAC,IAAI;oBACrB,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAE/B,KAAK,aAAa,CAAC,SAAS;oBAC1B,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;gBAEpC,KAAK,aAAa,CAAC,KAAK;oBACtB,MAAM,oBAAoB,GAAG,eAA+B,CAAC;oBAE7D,IAAI,MAAM,oBAAoB,CAAC,cAAc,EAAE,EAAE,CAAC;wBAChD,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;oBACjC,CAAC;yBAAM,CAAC;wBACN,kDAAkD;wBAElD,MAAM,QAAQ,GAAI,eAAgC,CAAC,OAAO,CAAC,QAAQ,CAAC;wBACpE,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;wBAEjG,sGAAsG;wBACtG,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;4BAC/B,OAAO,EAAE,CAAC;wBACZ,CAAC;wBAED,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;4BACrD,iEAAiE;4BAC/D,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;wBAC1D,CAAC;6BAAM,CAAC;4BACN,kGAAkG;4BAClG,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;wBACnC,CAAC;oBACH,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,wEAAwE;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;KAAA;IAED;;;OAGG;IACK,MAAM,CAAO,8BAA8B,CACjD,MAAc,EACd,eAA6F,EAC7F,OAAwB,EACxB,WAAkC,EAClC,YAA0B;;;YAE1B,MAAM,qBAAqB,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YACxE,MAAM,wBAAwB,GAAG,MAAM,qBAAqB,CAAC,2BAA2B,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;YAChI,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;YACtC,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;YAErC,8IAA8I;YAE9I,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,wCAAwC,EACrD,qCAAqC,qBAAqB,KAAK,MAAM,kBAAkB,CACxF,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAA,eAAe,CAAC,gBAAgB,0CAAE,YAAY,CAAC;YAEnE,wFAAwF;YACxF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,+IAA+I;gBAC/I,MAAM,6BAA6B,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,aAA+B,CAAC,CAAC,CAAC;gBAC/I,IAAI,CAAC,6BAA6B,EAAE,CAAC;oBACnC,SAAS;gBACX,CAAC;gBAED,yGAAyG;gBACzG,sEAAsE;gBAEtE,yEAAyE;gBACzE,IAAI,UAAU,CAAC,GAAG,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;oBAC5C,OAAO;gBACT,CAAC;gBAED,+GAA+G;gBAC/G,4GAA4G;gBAC5G,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,SAAS;gBACX,CAAC;gBAED,+EAA+E;gBAC/E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,0FAA0F;oBAC1F,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;wBACpC,+BAA+B;wBAC/B,OAAO;oBACT,CAAC;yBAAM,CAAC;wBACN,SAAS;oBACX,CAAC;gBACH,CAAC;gBAED,kDAAkD;gBAElD,kDAAkD;gBAClD,4GAA4G;gBAC5G,IAAI,UAAU,CAAC,GAAG,KAAK,aAAa,CAAC,SAAS,IAAI,UAAU,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;oBAC9E,mGAAmG;oBAEnG,wDAAwD;oBACxD,IAAI,mBAAwC,CAAC;oBAC7C,IAAI,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,KAAK,EAAE,CAAC;wBACtE,mBAAmB,GAAG,eAAe,CAAC,OAA8B,CAAC;oBACvE,CAAC;yBAAM,CAAC;wBACN,uIAAuI;wBACvI,uDAAuD;wBACvD,qHAAqH;wBACrH,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC5D,CAAC;oBAED,IAAI,mBAAmB,CAAC,UAAU,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;wBACxD,OAAO;oBACT,CAAC;yBAAM,CAAC;wBACN,SAAS;oBACX,CAAC;gBACH,CAAC;gBAED,2DAA2D;gBAC3D,MAAM,mBAAmB,GAAY,MAAM,qBAAqB,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;gBAC7G,IAAI,mBAAmB,EAAE,CAAC;oBACxB,OAAO;gBACT,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,qCAAqC,EAClD,iCAAiC,qBAAqB,cAAc,eAAe,CAAC,MAAM,eAAe,CAC1G,CAAC;QACJ,CAAC;KAAA;IAED;;;OAGG;IACK,MAAM,CAAC,eAAe,CAC5B,eAA6B,EAC7B,OAAwB;QAExB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAE7C,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAE7D,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EAAE,aAAa,QAAQ,yBAAyB,GAAG,EAAE,CAAC,CAAC;QAC5H,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EAAE,aAAa,QAAQ,yBAAyB,GAAG,EAAE,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAC/B,eAA6B,EAC7B,OAAwB;QAExB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;YAEjF,MAAM,KAAwD,OAAO,CAAC,KAAK,EAArE,EAAE,mBAAmB,EAAE,aAAa,OAAiC,EAA5B,UAAU,cAAnD,wCAAqD,CAAgB,CAAC;YAE5E,gHAAgH;YAChH,MAAM,oBAAoB,GAAG,mBAAmB,IAAI,KAAK,CAAC;YAE1D,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,aAAa,IAAI,EAAE,CAAC;YAErC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC;gBAC/B,IAAI,EAAE,QAAQ;gBACd,UAAU;gBACV,QAAQ;gBACR,oBAAoB;aACrB,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,iEAAiE;gBACjE,uIAAuI;gBACvI,uFAAuF;gBACvF,mFAAmF;gBACnF,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,YAAY,QAAQ,EAAE,CAAC,CAAC;gBAC1G,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,sCAAsC,EAAE,iCAAiC,WAAW,EAAE,CAAC,CAAC;YAC1H,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAO,0BAA0B,CAC7C,MAAc,EACd,eAA6B,EAC7B,OAAwB,EACxB,YAA0B;;YAE1B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YAED,6BAA6B;YAE7B,MAAM,oBAAoB,GAAG,eAAe,CAAC;YAC7C,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;YACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,yCAAyC,EACtD,oCAAoC,CACrC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,YAAa,CAAC;YAC3E,MAAM,MAAM,GAAW;gBACrB,SAAS,EAAW,gBAAgB,CAAC,OAAO;gBAC5C,MAAM,EAAc,aAAa,CAAC,KAAK;gBACvC,iBAAiB,EAAG,IAAI;gBACxB,QAAQ,EAAY,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS;gBACrE,YAAY;gBACZ,SAAS;aACV,CAAC;YAEF,MAAM,eAAe,GAAG,OAAO,CAAC,+BAA+B,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAE,CAAC;YAEzG,mEAAmE;YACnE,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,aAAa,CAAC,kCAAkC,CAAC,eAAe,CAAC,CAAC;gBACvF,MAAM,CAAC,SAAS,GAAG,YAAY,CAAC;YAClC,CAAC;YAED,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAClF,MAAM,eAAe,GAAG,gBAAyC,CAAC;YAClE,MAAM,qCAAqC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,EAAE,CAC3F,mBAAmB,CAAC,QAAQ,KAAK,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CACvE,CAAC;YACF,IAAI,qCAAqC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,2CAA2C,EACxD,QAAQ,SAAS,6DAA6D,YAAY,6BAA6B,eAAe,GAAG,CAC1I,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;IAEO,MAAM,CAAC,wBAAwB,CAAC,YAAoB,EAAE,kBAAsC;QAClG,MAAM,iBAAiB,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,cAAc,GAAoB,kBAAkB,CAAC,SAAS,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC7C,MAAM,WAAW,GAAgC,cAAc,CAAC,eAAe,CAAC,CAAC;YAEjF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,cAAc,GAAG,WAAW,CAAC;YAC7B,CAAC,EAAE,CAAC;QACN,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAO,UAAU,CAC7B,MAAc,EACd,UAA8B,EAC9B,WAAkC;;YAElC,4CAA4C;YAC5C,MAAM,oBAAoB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,EAAE,CACpE,mBAAmB,CAAC,UAAU,CAAC,YAAY,KAAK,UAAU,CAAC,EAAG,CAC/D,CAAC;YAEF,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,6EAA6E;gBAC7E,qEAAqE;gBACrE,qEAAqE;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,UAAU,CAAC,GAAG,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC;gBAC/C,+EAA+E;gBAC/E,OAAO,MAAM,KAAK,oBAAoB,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9D,CAAC;iBAAM,CAAC,CAAC,0CAA0C;gBACjD,4EAA4E;gBAC5E,MAAM,cAAc,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC/E,OAAO,MAAM,KAAK,cAAc,CAAC;YACnC,CAAC;QACH,CAAC;KAAA;IAEO,MAAM,CAAC,WAAW,CAAC,YAAoB;QAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;CACF"}