@enbox/dwn-sdk-js 0.0.6 → 0.0.7

package/dist/esm/src/core/protocol-authorization-validation.js

@@ -0,0 +1,254 @@
+import Ajv from 'ajv/dist/2020.js';
+import { FilterUtility } from '../utils/filter.js';
+import { Records } from '../utils/records.js';
+import { DwnError, DwnErrorCode } from './dwn-error.js';
+import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
+import { getTypeName, parseCrossProtocolRef } from '../utils/protocols.js';
+/**
+ * Verifies the `protocolPath` declared in the given message matches the path of actual record chain.
+ * For cross-protocol composition, the parent record may belong to a different protocol (resolved via `$ref` in the composing protocol).
+ * @throws {DwnError} if fails verification.
+ */
+export async function verifyProtocolPathAndContextId(tenant, inboundMessage, messageStore, fetchProtocolDefinition, governingTimestamp) {
+    const declaredProtocolPath = inboundMessage.message.descriptor.protocolPath;
+    const declaredTypeName = getTypeName(declaredProtocolPath);
+    const parentId = inboundMessage.message.descriptor.parentId;
+    if (parentId === undefined) {
+        if (declaredProtocolPath !== declaredTypeName) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationParentlessIncorrectProtocolPath, `Declared protocol path '${declaredProtocolPath}' is not valid for records with no parent'.`);
+        }
+        return;
+    }
+    // Else `parentId` is defined, so we need to verify both protocolPath and contextId
+    // Determine the protocol URI for the parent query.
+    // If the parent path segment has a `$ref` in the composing protocol, the parent lives in a different protocol.
+    const childProtocol = inboundMessage.message.descriptor.protocol;
+    const parentProtocolUri = await resolveParentProtocolUri(tenant, childProtocol, declaredProtocolPath, messageStore, fetchProtocolDefinition, governingTimestamp);
+    // fetch the parent message
+    const query = {
+        isLatestBaseState: true, // NOTE: this filter is critical, to ensure are are not returning a deleted parent
+        interface: DwnInterfaceName.Records,
+        method: DwnMethodName.Write,
+        protocol: parentProtocolUri,
+        recordId: parentId
+    };
+    const { messages: parentMessages } = await messageStore.query(tenant, [query]);
+    const parentMessage = parentMessages[0];
+    if (parentMessage === undefined) {
+        // if this is a cross-protocol composition lookup, use a more descriptive error
+        if (parentProtocolUri !== childProtocol) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationCrossProtocolParentNotFound, `Could not find parent record '${parentId}' in protocol '${parentProtocolUri}' ` +
+                `for cross-protocol child at path '${declaredProtocolPath}'.`);
+        }
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationIncorrectProtocolPath, `Could not find matching parent record to verify declared protocol path '${declaredProtocolPath}'.`);
+    }
+    // verifying protocolPath of incoming message is a child of the parent message's protocolPath
+    const parentProtocolPath = parentMessage.descriptor.protocolPath;
+    const expectedProtocolPath = `${parentProtocolPath}/${declaredTypeName}`;
+    if (expectedProtocolPath !== declaredProtocolPath) {
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationIncorrectProtocolPath, `Could not find matching parent record to verify declared protocol path '${declaredProtocolPath}'.`);
+    }
+    // verifying contextId of incoming message is a child of the parent message's contextId
+    const expectedContextId = `${parentMessage.contextId}/${inboundMessage.message.recordId}`;
+    const actualContextId = inboundMessage.message.contextId;
+    if (actualContextId !== expectedContextId) {
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationIncorrectContextId, `Declared contextId '${actualContextId}' is not the same as expected: '${expectedContextId}'.`);
+    }
+}
+/**
+ * Resolves the protocol URI that should be used when querying for the parent record.
+ * For standard (non-composed) records, this is the same as the child's protocol.
+ * For cross-protocol composition, the parent may live in a different protocol
+ * (resolved via `$ref` in the composing protocol's definition).
+ *
+ * Logic: Given a child at protocolPath `a/b/c`, the parent is at `a/b`.
+ * Walk up the composing protocol's structure from root to `a/b`.
+ * If any segment along the way has a `$ref`, the parent (and its ancestors up to the `$ref` boundary)
+ * live in the referenced protocol. Specifically, the `$ref` at the topmost ancestor tells us
+ * the parent's protocol URI.
+ */
+export async function resolveParentProtocolUri(tenant, childProtocolUri, childProtocolPath, messageStore, fetchProtocolDefinition, governingTimestamp) {
+    const segments = childProtocolPath.split('/');
+    // A root-level record (no `/` in path) has no parent or uses the same protocol
+    if (segments.length <= 1) {
+        return childProtocolUri;
+    }
+    // Fetch the composing protocol's definition at the governing timestamp
+    const composingDefinition = await fetchProtocolDefinition(tenant, childProtocolUri, messageStore, governingTimestamp);
+    // Walk the structure to find the parent's path segment
+    // The parent's position in the structure is at segments[0..n-2]
+    // We check if the first segment has a `$ref`, which means the parent is in a different protocol
+    const firstSegmentRuleSet = composingDefinition.structure[segments[0]];
+    if (firstSegmentRuleSet?.$ref !== undefined) {
+        const parsed = parseCrossProtocolRef(firstSegmentRuleSet.$ref);
+        if (parsed !== undefined && composingDefinition.uses !== undefined) {
+            const resolvedUri = composingDefinition.uses[parsed.alias];
+            if (resolvedUri !== undefined) {
+                // The parent path is within the `$ref` boundary — check if the parent IS the `$ref` node
+                // or is a descendant of it (which would still be in the composing protocol).
+                // If segments.length === 2, parent is at segments[0] which IS the $ref node → parent's protocol is the referenced one.
+                // If segments.length > 2, parent is at segments[0..n-2]. If segments[0] is $ref, the parent could be:
+                //   - Still the $ref node itself (segments.length === 2) → referenced protocol
+                //   - A child of the $ref node defined in the composing protocol (segments.length > 2) → composing protocol
+                if (segments.length === 2) {
+                    // Parent is the $ref node itself (e.g., child is "thread/comment", parent is "thread")
+                    return resolvedUri;
+                }
+                // else: parent is a deeper child defined in the composing protocol
+                return childProtocolUri;
+            }
+        }
+    }
+    return childProtocolUri;
+}
+/**
+ * Verifies the `dataFormat` and `schema` declared in the given message matches the type in the protocol.
+ * For cross-protocol composition, if the type is at a `$ref` position in the structure,
+ * the type definition is looked up in the referenced protocol's `types` map instead.
+ */
+export async function verifyTypeWithComposition(tenant, inboundMessage, protocolDefinition, messageStore, fetchProtocolDefinition, governingTimestamp) {
+    const declaredProtocolPath = inboundMessage.descriptor.protocolPath;
+    const declaredTypeName = getTypeName(declaredProtocolPath);
+    // Resolve which protocol types map to use.
+    // If the first path segment has `$ref`, this record's type might be defined in a referenced protocol.
+    const protocolTypes = await resolveProtocolTypesForPath(tenant, declaredProtocolPath, protocolDefinition, messageStore, fetchProtocolDefinition, governingTimestamp);
+    verifyType(inboundMessage, protocolTypes, declaredTypeName);
+}
+/**
+ * Resolves the `ProtocolTypes` map that contains the type definition for the given protocol path.
+ * For non-composed records, this is the protocol definition's own `types` map.
+ * For records at a `$ref` position, this is the referenced protocol's `types` map.
+ */
+export async function resolveProtocolTypesForPath(tenant, protocolPath, protocolDefinition, messageStore, fetchProtocolDefinition, governingTimestamp) {
+    const segments = protocolPath.split('/');
+    // Check if the first segment has a `$ref`
+    const firstSegmentRuleSet = protocolDefinition.structure[segments[0]];
+    if (firstSegmentRuleSet?.$ref !== undefined && segments.length === 1) {
+        // This record IS the $ref node itself — its type is defined in the referenced protocol
+        const parsed = parseCrossProtocolRef(firstSegmentRuleSet.$ref);
+        if (parsed !== undefined && protocolDefinition.uses !== undefined) {
+            const refProtocolUri = protocolDefinition.uses[parsed.alias];
+            if (refProtocolUri !== undefined) {
+                const refDefinition = await fetchProtocolDefinition(tenant, refProtocolUri, messageStore, governingTimestamp);
+                return refDefinition.types;
+            }
+        }
+    }
+    // Default: use the composing protocol's own types
+    return protocolDefinition.types;
+}
+/**
+ * Verifies the `dataFormat` and `schema` declared in the given message (if it is a RecordsWrite) matches dataFormat
+ * and schema of the type in the given protocol.
+ * @throws {DwnError} if fails verification.
+ */
+export function verifyType(inboundMessage, protocolTypes, typeName) {
+    const declaredTypeName = typeName ?? getTypeName(inboundMessage.descriptor.protocolPath);
+    const typeNames = Object.keys(protocolTypes);
+    if (!typeNames.includes(declaredTypeName)) {
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationInvalidType, `record with type ${declaredTypeName} not allowed in protocol`);
+    }
+    const protocolType = protocolTypes[declaredTypeName];
+    // no `schema` specified in protocol definition means that any schema is allowed
+    const { schema } = inboundMessage.descriptor;
+    if (protocolType.schema !== undefined && protocolType.schema !== schema) {
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationInvalidSchema, `type '${declaredTypeName}' must have schema '${protocolType.schema}', \
+      instead has '${schema}'`);
+    }
+    // no `dataFormats` specified in protocol definition means that all dataFormats are allowed
+    const { dataFormat } = inboundMessage.descriptor;
+    if (protocolType.dataFormats !== undefined && !protocolType.dataFormats.includes(dataFormat)) {
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationIncorrectDataFormat, `type '${declaredTypeName}' must have data format in (${protocolType.dataFormats}), \
+      instead has '${dataFormat}'`);
+    }
+    // enforce encryption when the protocol type requires it
+    if (protocolType.encryptionRequired === true && inboundMessage.encryption === undefined) {
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationEncryptionRequired, `type '${declaredTypeName}' requires encryption but message has no encryption metadata`);
+    }
+}
+/**
+ * Verifies that writes adhere to the $size constraints if provided
+ * @throws {Error} if size is exceeded.
+ */
+export function verifySizeLimit(incomingMessage, ruleSet) {
+    const { min = 0, max } = ruleSet.$size || {};
+    const dataSize = incomingMessage.message.descriptor.dataSize;
+    if (dataSize < min) {
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationMinSizeInvalid, `data size ${dataSize} is less than allowed ${min}`);
+    }
+    if (max === undefined) {
+        return;
+    }
+    if (dataSize > max) {
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationMaxSizeInvalid, `data size ${dataSize} is more than allowed ${max}`);
+    }
+}
+/**
+ * Verifies record tags against the `$tags` schema in the rule set using JSON Schema (Ajv).
+ * Checks required tags, additional properties, and schema conformance.
+ */
+export function verifyTagsIfNeeded(incomingMessage, ruleSet) {
+    if (ruleSet.$tags !== undefined) {
+        const { tags = {}, protocol, protocolPath } = incomingMessage.message.descriptor;
+        const { $allowUndefinedTags, $requiredTags, ...properties } = ruleSet.$tags;
+        // if $allowUndefinedTags is set to false and there are properties not defined in the schema, an error is thrown
+        const additionalProperties = $allowUndefinedTags || false;
+        // if $requiredTags is set, all required tags must be present
+        const required = $requiredTags || [];
+        const ajv = new Ajv.default();
+        const compiledTags = ajv.compile({
+            type: 'object',
+            properties,
+            required,
+            additionalProperties,
+        });
+        const validSchema = compiledTags(tags);
+        if (!validSchema) {
+            // the `dataVar` is used to add a qualifier to the error message.
+            // For example. If the error is related to a tag `status` in a protocol `https://example.protocol` with the protocolPath `example/path`
+            // the error would be described as `https://example.protocol/example/path/$tags/status'
+            // without this decorator it would show up as `data/status` which may be confusing.
+            const schemaError = ajv.errorsText(compiledTags.errors, { dataVar: `${protocol}/${protocolPath}/$tags` });
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationTagsInvalidSchema, `tags schema validation error: ${schemaError}`);
+        }
+    }
+}
+/**
+ * If the given RecordsWrite is not a role record, this method does nothing and succeeds immediately.
+ *
+ * Else it verifies the validity of the given `RecordsWrite` as a role record, including:
+ * 1. The same role has not been assigned to the same entity/recipient.
+ */
+export async function verifyAsRoleRecordIfNeeded(tenant, incomingMessage, ruleSet, messageStore) {
+    if (!ruleSet.$role) {
+        return;
+    }
+    // else this is a role record
+    const incomingRecordsWrite = incomingMessage;
+    const recipient = incomingRecordsWrite.message.descriptor.recipient;
+    if (recipient === undefined) {
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationRoleMissingRecipient, 'Role records must have a recipient');
+    }
+    const protocolPath = incomingRecordsWrite.message.descriptor.protocolPath;
+    const filter = {
+        interface: DwnInterfaceName.Records,
+        method: DwnMethodName.Write,
+        isLatestBaseState: true,
+        protocol: incomingRecordsWrite.message.descriptor.protocol,
+        protocolPath,
+        recipient,
+    };
+    const parentContextId = Records.getParentContextFromOfContextId(incomingRecordsWrite.message.contextId);
+    // if this is not the root record, add a prefix filter to the query
+    if (parentContextId !== '') {
+        const prefixFilter = FilterUtility.constructPrefixFilterAsRangeFilter(parentContextId);
+        filter.contextId = prefixFilter;
+    }
+    const { messages: matchingMessages } = await messageStore.query(tenant, [filter]);
+    const matchingRecords = matchingMessages;
+    const matchingRecordsExceptIncomingRecordId = matchingRecords.filter((recordsWriteMessage) => recordsWriteMessage.recordId !== incomingRecordsWrite.message.recordId);
+    if (matchingRecordsExceptIncomingRecordId.length > 0) {
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationDuplicateRoleRecipient, `DID '${recipient}' is already recipient of a role record at protocol path '${protocolPath} under the parent context ${parentContextId}.`);
+    }
+}
+//# sourceMappingURL=protocol-authorization-validation.js.map

package/dist/esm/src/core/protocol-authorization-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-authorization-validation.js","sourceRoot":"","sources":["../../../../src/core/protocol-authorization-validation.ts"],"names":[],"mappings":"AAOA,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI3E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAc,EACd,cAA4B,EAC5B,YAA0B,EAC1B,uBAAkD,EAClD,kBAA2B;IAE3B,MAAM,oBAAoB,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,YAAa,CAAC;IAC7E,MAAM,gBAAgB,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IAC5D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,oBAAoB,KAAK,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,oDAAoD,EACjE,2BAA2B,oBAAoB,6CAA6C,CAC7F,CAAC;QACJ,CAAC;QAED,OAAO;IACT,CAAC;IAED,mFAAmF;IAEnF,mDAAmD;IACnD,+GAA+G;IAC/G,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS,CAAC;IAClE,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CACtD,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,CACvG,CAAC;IAEF,2BAA2B;IAC3B,MAAM,KAAK,GAAW;QACpB,iBAAiB,EAAG,IAAI,EAAE,kFAAkF;QAC5G,SAAS,EAAW,gBAAgB,CAAC,OAAO;QAC5C,MAAM,EAAc,aAAa,CAAC,KAAK;QACvC,QAAQ,EAAY,iBAAiB;QACrC,QAAQ,EAAY,QAAQ;KAC7B,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAI,cAAwC,CAAC,CAAC,CAAC,CAAC;IAEnE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,+EAA+E;QAC/E,IAAI,iBAAiB,KAAK,aAAa,EAAE,CAAC;YACxC,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gDAAgD,EAC7D,iCAAiC,QAAQ,kBAAkB,iBAAiB,IAAI;gBAChF,qCAAqC,oBAAoB,IAAI,CAC9D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0CAA0C,EACvD,2EAA2E,oBAAoB,IAAI,CACpG,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,MAAM,kBAAkB,GAAG,aAAa,CAAC,UAAU,CAAC,YAAY,CAAC;IACjE,MAAM,oBAAoB,GAAG,GAAG,kBAAkB,IAAI,gBAAgB,EAAE,CAAC;IACzE,IAAI,oBAAoB,KAAK,oBAAoB,EAAE,CAAC;QAClD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0CAA0C,EACvD,2EAA2E,oBAAoB,IAAI,CACpG,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,MAAM,iBAAiB,GAAG,GAAG,aAAa,CAAC,SAAS,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1F,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;IACzD,IAAI,eAAe,KAAK,iBAAiB,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uCAAuC,EACpD,uBAAuB,eAAe,mCAAmC,iBAAiB,IAAI,CAC/F,CAAC;IACJ,CAAC;AAEH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,gBAAwB,EACxB,iBAAyB,EACzB,YAA0B,EAC1B,uBAAkD,EAClD,kBAA2B;IAE3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE9C,+EAA+E;IAC/E,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,MAAM,uBAAuB,CACvD,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,CAC3D,CAAC;IAEF,uDAAuD;IACvD,gEAAgE;IAChE,gGAAgG;IAChG,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,mBAAmB,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,yFAAyF;gBACzF,6EAA6E;gBAC7E,uHAAuH;gBACvH,sGAAsG;gBACtG,+EAA+E;gBAC/E,4GAA4G;gBAC5G,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1B,uFAAuF;oBACvF,OAAO,WAAW,CAAC;gBACrB,CAAC;gBACD,mEAAmE;gBACnE,OAAO,gBAAgB,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,cAAmC,EACnC,kBAAsC,EACtC,YAA0B,EAC1B,uBAAkD,EAClD,kBAA2B;IAE3B,MAAM,oBAAoB,GAAG,cAAc,CAAC,UAAU,CAAC,YAAa,CAAC;IACrE,MAAM,gBAAgB,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAE3D,2CAA2C;IAC3C,sGAAsG;IACtG,MAAM,aAAa,GAAG,MAAM,2BAA2B,CACrD,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,CAC5G,CAAC;IAEF,UAAU,CAAC,cAAc,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc,EACd,YAAoB,EACpB,kBAAsC,EACtC,YAA0B,EAC1B,uBAAkD,EAClD,kBAA2B;IAE3B,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEzC,0CAA0C;IAC1C,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,mBAAmB,EAAE,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,uFAAuF;QACvF,MAAM,MAAM,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,CACzD,CAAC;gBACF,OAAO,aAAa,CAAC,KAAK,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,OAAO,kBAAkB,CAAC,KAAK,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,cAAmC,EACnC,aAA4B,EAC5B,QAAiB;IAEjB,MAAM,gBAAgB,GAAG,QAAQ,IAAI,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,YAAa,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE7C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,gCAAgC,EAC9D,oBAAoB,gBAAgB,0BAA0B,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,YAAY,GAAiB,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAEnE,gFAAgF;IAChF,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;IAC7C,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxE,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,kCAAkC,EAC/C,SAAS,gBAAgB,uBAAuB,YAAY,CAAC,MAAM;qBACpD,MAAM,GAAG,CACzB,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,MAAM,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;IACjD,IAAI,YAAY,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,wCAAwC,EACrD,SAAS,gBAAgB,+BAA+B,YAAY,CAAC,WAAW;qBACjE,UAAU,GAAG,CAC7B,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,IAAI,YAAY,CAAC,kBAAkB,KAAK,IAAI,IAAI,cAAc,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uCAAuC,EACpD,SAAS,gBAAgB,8DAA8D,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,eAA6B,EAC7B,OAAwB;IAExB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAE7C,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IAE7D,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EAAE,aAAa,QAAQ,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EAAE,aAAa,QAAQ,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC5H,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,eAA6B,EAC7B,OAAwB;IAExB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;QAEjF,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5E,gHAAgH;QAChH,MAAM,oBAAoB,GAAG,mBAAmB,IAAI,KAAK,CAAC;QAE1D,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,aAAa,IAAI,EAAE,CAAC;QAErC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC;YAC/B,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ;YACR,oBAAoB;SACrB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,iEAAiE;YACjE,uIAAuI;YACvI,uFAAuF;YACvF,mFAAmF;YACnF,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,YAAY,QAAQ,EAAE,CAAC,CAAC;YAC1G,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,sCAAsC,EAAE,iCAAiC,WAAW,EAAE,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,eAA6B,EAC7B,OAAwB,EACxB,YAA0B;IAE1B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,6BAA6B;IAE7B,MAAM,oBAAoB,GAAG,eAAe,CAAC;IAC7C,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,yCAAyC,EACtD,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,YAAa,CAAC;IAC3E,MAAM,MAAM,GAAW;QACrB,SAAS,EAAW,gBAAgB,CAAC,OAAO;QAC5C,MAAM,EAAc,aAAa,CAAC,KAAK;QACvC,iBAAiB,EAAG,IAAI;QACxB,QAAQ,EAAY,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,QAAS;QACrE,YAAY;QACZ,SAAS;KACV,CAAC;IAEF,MAAM,eAAe,GAAG,OAAO,CAAC,+BAA+B,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAE,CAAC;IAEzG,mEAAmE;IACnE,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,aAAa,CAAC,kCAAkC,CAAC,eAAe,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,GAAG,YAAY,CAAC;IAClC,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,gBAAyC,CAAC;IAClE,MAAM,qCAAqC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,mBAAwC,EAAW,EAAE,CACzH,mBAAmB,CAAC,QAAQ,KAAK,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CACvE,CAAC;IACF,IAAI,qCAAqC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,2CAA2C,EACxD,QAAQ,SAAS,6DAA6D,YAAY,6BAA6B,eAAe,GAAG,CAC1I,CAAC;IACJ,CAAC;AACH,CAAC"}