@goodmeta/agent-verifier 0.2.0 → 0.5.0

package/dist/ap2/sd-jwt.js

@@ -0,0 +1,306 @@
+/**
+ * Root SD-JWT verification + disclosure resolution.
+ *
+ * Signatures: verified by jose, ES256-pinned, key supplied out-of-band — never
+ * by a disclosure library, never resolving a header `jwk`/`jku`/`x5u`/`kid`.
+ *
+ * Disclosure resolution mirrors AP2's actual reference behavior, which is a
+ * hybrid of THREE layers (AP2's golden vectors are minted by the Python
+ * `sd_jwt` lib + AP2's own post-passes, so we mirror that exact stack, not the
+ * unrelated TS `@sd-jwt` lib):
+ *
+ *   A. Standard RFC 9901 unpack — port of `sd_jwt` lib
+ *      `SDJWTVerifier._unpack_disclosed_claims`: resolve `{"...": digest}` array
+ *      elements ([salt, value]) and `_sd: [digest]` object members
+ *      ([salt, name, value]) against the token's disclosures; strip `_sd` /
+ *      `_sd_alg`; reject duplicate disclosure hashes, duplicate `_sd` digests,
+ *      and duplicate disclosed keys. Only sha-256 (the lib rejects others).
+ *   B. AP2 delegate-item resolution — port of `chain.py::_resolve_delegate_items`
+ *      + `_inline_sd_claims`: walk a resolved `delegate_payload` array; for dict
+ *      items, inline any remaining object-property `_sd` digests; decode any
+ *      bare-string items into their dict value.
+ *   C. CMWallet quirk — port of `kb_sd_jwt.py::_resolve_delegate_payload` +
+ *      `_try_resolve_digest`: `delegate_payload` items that are bare digest
+ *      STRINGS get replaced in place by the dict value of the matching
+ *      disclosure (used by KB hops in P3).
+ *
+ * Validated byte-exact against `test/fixtures/ap2-vectors.json`
+ * (`expectedPayloads`), minted from AP2's own SDK.
+ */
+import { Buffer } from "node:buffer";
+import { compactVerify } from "jose";
+import { computeDisclosureDigest } from "./hash.js";
+import { parseJwk } from "./jwk.js";
+const SD_DIGESTS_KEY = "_sd";
+const DIGEST_ALG_KEY = "_sd_alg";
+const SD_LIST_PREFIX = "...";
+const SUPPORTED_SD_ALG = "sha-256";
+const ARRAY_DISCLOSURE_LEN = 2; // [salt, value]
+const PROPERTY_DISCLOSURE_LEN = 3; // [salt, name, value]
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function decodeDisclosure(disclosure) {
+    let decoded;
+    try {
+        decoded = JSON.parse(Buffer.from(disclosure, "base64url").toString("utf8"));
+    }
+    catch (e) {
+        throw new Error(`Cannot decode disclosure: ${e.message}`);
+    }
+    if (!Array.isArray(decoded)) {
+        throw new Error("Disclosure must decode to a JSON array");
+    }
+    return decoded;
+}
+// ── Layer A: standard RFC 9901 unpack (sd_jwt lib) ───────────────────────────
+/**
+ * Map every disclosure to its decoded array, keyed by its digest. Mirrors
+ * `_create_hash_mappings`: a duplicate digest is an error.
+ */
+function buildDisclosureMap(disclosures, sdAlg) {
+    const map = new Map();
+    for (const d of disclosures) {
+        const digest = computeDisclosureDigest(d, sdAlg);
+        if (map.has(digest)) {
+            throw new Error(`Duplicate disclosure hash ${digest}`);
+        }
+        map.set(digest, decodeDisclosure(d));
+    }
+    return map;
+}
+/** `{"...": "<digest>"}` array-element form (RFC 9901 §4.2.4.1). */
+function arrayElementDigest(el) {
+    if (!isPlainObject(el))
+        return null;
+    const keys = Object.keys(el);
+    if (keys.length === 1 && keys[0] === SD_LIST_PREFIX && typeof el[SD_LIST_PREFIX] === "string") {
+        return el[SD_LIST_PREFIX];
+    }
+    return null;
+}
+/**
+ * Recursively replace disclosed digests with their values. Port of the
+ * `sd_jwt` lib `_unpack_disclosed_claims`. `dupCheck` tracks `_sd` digests
+ * across the whole payload so a reused digest is rejected.
+ */
+function unpack(claims, map, dupCheck) {
+    if (Array.isArray(claims)) {
+        const output = [];
+        for (const element of claims) {
+            const digest = arrayElementDigest(element);
+            if (digest !== null) {
+                const decoded = map.get(digest);
+                if (decoded !== undefined) {
+                    if (decoded.length !== ARRAY_DISCLOSURE_LEN) {
+                        throw new Error(`Array-element disclosure must be [salt, value], got length ${decoded.length}`);
+                    }
+                    output.push(unpack(decoded[1], map, dupCheck));
+                }
+                // undisclosed / decoy digest → element is omitted
+            }
+            else {
+                output.push(unpack(element, map, dupCheck));
+            }
+        }
+        return output;
+    }
+    if (isPlainObject(claims)) {
+        const preOutput = {};
+        for (const [k, v] of Object.entries(claims)) {
+            if (k !== SD_DIGESTS_KEY && k !== DIGEST_ALG_KEY) {
+                preOutput[k] = unpack(v, map, dupCheck);
+            }
+        }
+        const sd = claims[SD_DIGESTS_KEY];
+        if (Array.isArray(sd)) {
+            for (const digest of sd) {
+                // Mirror the Python lib: every `_sd` entry is duplicate-tracked before
+                // the map lookup (even a non-string one), so a repeated digest is
+                // rejected regardless of type. Only string digests can match a real
+                // disclosure; others fall through (map.get returns undefined).
+                if (dupCheck.has(digest)) {
+                    throw new Error(`Duplicate hash found in SD-JWT: ${String(digest)}`);
+                }
+                dupCheck.add(digest);
+                const decoded = typeof digest === "string" ? map.get(digest) : undefined;
+                if (decoded !== undefined) {
+                    if (decoded.length !== PROPERTY_DISCLOSURE_LEN) {
+                        throw new Error(`Object-property disclosure must be [salt, name, value], got length ${decoded.length}`);
+                    }
+                    const key = decoded[1];
+                    if (key in preOutput) {
+                        throw new Error(`Duplicate key found when unpacking disclosed claim: '${key}'`);
+                    }
+                    preOutput[key] = unpack(decoded[2], map, dupCheck);
+                }
+            }
+        }
+        return preOutput;
+    }
+    return claims;
+}
+/**
+ * Resolve all disclosures in an issuer-verified payload (Layer A). Mirrors
+ * `_extract_sd_claims`: rejects a non-sha-256 `_sd_alg` (the lib supports only
+ * sha-256), then unpacks.
+ */
+export function resolveDisclosures(payload, disclosures, sdAlg) {
+    if (sdAlg !== undefined && sdAlg !== SUPPORTED_SD_ALG) {
+        throw new Error(`Invalid hash algorithm: ${sdAlg} (only ${SUPPORTED_SD_ALG} supported)`);
+    }
+    const map = buildDisclosureMap(disclosures, sdAlg);
+    return unpack(payload, map, new Set());
+}
+// ── Layer C: CMWallet bare-digest-string resolution (kb_sd_jwt.py) ───────────
+/** First disclosure whose digest equals `digest`, returned as its dict value. */
+function tryResolveDigest(digest, disclosures, sdAlg) {
+    for (const disc of disclosures) {
+        if (computeDisclosureDigest(disc, sdAlg) !== digest)
+            continue;
+        let arr;
+        try {
+            arr = JSON.parse(Buffer.from(disc, "base64url").toString("utf8"));
+        }
+        catch {
+            continue;
+        }
+        if (!Array.isArray(arr))
+            continue;
+        const val = arr.length === ARRAY_DISCLOSURE_LEN ? arr[1] : arr.length === PROPERTY_DISCLOSURE_LEN ? arr[2] : null;
+        if (isPlainObject(val))
+            return val;
+    }
+    return null;
+}
+/**
+ * Resolve bare digest-string items inside `delegate_payload` in place. Port of
+ * `kb_sd_jwt.py::_resolve_delegate_payload`: dict items are left unchanged;
+ * string items are replaced by the matching disclosure's dict value (or kept
+ * as-is when no disclosure matches).
+ */
+export function resolveDelegatePayload(payload, token) {
+    const dp = payload["delegate_payload"];
+    if (!Array.isArray(dp) || token.disclosures.length === 0)
+        return;
+    payload["delegate_payload"] = dp.map((item) => {
+        if (isPlainObject(item))
+            return item;
+        if (typeof item === "string") {
+            const decoded = tryResolveDigest(item, token.disclosures, token.sdAlg);
+            return decoded ?? item;
+        }
+        return item;
+    });
+}
+// ── Layer B: AP2 delegate-item resolution (chain.py) ─────────────────────────
+/** Inline object-property `_sd` digests into a delegate item in place. */
+function inlineSdClaims(item, token) {
+    const sdDigests = item[SD_DIGESTS_KEY];
+    if (!Array.isArray(sdDigests) || sdDigests.length === 0 || token.disclosures.length === 0)
+        return;
+    for (const digest of sdDigests) {
+        for (const d of token.disclosures) {
+            if (computeDisclosureDigest(d, token.sdAlg) === digest) {
+                const decoded = decodeDisclosure(d);
+                if (decoded.length === PROPERTY_DISCLOSURE_LEN) {
+                    item[decoded[1]] = decoded[2];
+                }
+                break;
+            }
+        }
+    }
+}
+/** Decode a bare disclosure string into its dict value, if it has one. */
+function decodeDisclosureDict(disclosure) {
+    let arr;
+    try {
+        arr = JSON.parse(Buffer.from(disclosure, "base64url").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(arr))
+        return null;
+    const val = arr.length === PROPERTY_DISCLOSURE_LEN ? arr[2] : arr.length === ARRAY_DISCLOSURE_LEN ? arr[1] : null;
+    return isPlainObject(val) ? val : null;
+}
+/**
+ * Resolve the effective delegate items from a verified payload's
+ * `delegate_payload`. Port of `chain.py::_resolve_delegate_items`.
+ */
+export function resolveDelegateItems(delegatePayload, token) {
+    if (!Array.isArray(delegatePayload))
+        return [];
+    const items = [];
+    for (const item of delegatePayload) {
+        if (isPlainObject(item)) {
+            inlineSdClaims(item, token);
+            items.push(item);
+        }
+        else if (typeof item === "string") {
+            const decoded = decodeDisclosureDict(item);
+            if (decoded !== null)
+                items.push(decoded);
+        }
+    }
+    return items;
+}
+/** Verify one ES256 compact JWS signature; throws on any failure. Key is supplied
+ * out-of-band — a header `jwk`/`jku`/`x5u`/`kid` is NEVER trusted to pick it. */
+export async function verifyEs256(issuerJwt, key) {
+    await compactVerify(issuerJwt, key, { algorithms: ["ES256"] });
+}
+/**
+ * Verify the root issuer JWT signature (ES256, pinned) and resolve its
+ * disclosures. `key` is the issuer's public key, supplied out-of-band (x5c/kid
+ * trust is resolved by the caller in P4).
+ */
+export async function verifyRootSdJwt(token, key) {
+    await verifyEs256(token.issuerJwt, key);
+    const verifiedPayload = resolveDisclosures(token.payload, token.disclosures, token.sdAlg);
+    const delegateItems = resolveDelegateItems(verifiedPayload["delegate_payload"], token);
+    return { token, verifiedPayload, delegateItems };
+}
+// ── cnf.jwk resolution (3-tier `_find_cnf`, + single-cnf hardening H3) ────────
+function cnfDict(value) {
+    return isPlainObject(value) && isPlainObject(value["jwk"]) ? value : null;
+}
+function firstCnfInList(list) {
+    if (!Array.isArray(list))
+        return null;
+    for (const item of list) {
+        if (isPlainObject(item)) {
+            const c = cnfDict(item["cnf"]);
+            if (c)
+                return c;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the `cnf.jwk` that the NEXT hop must be signed under. Port of AP2's
+ * `common.py::_find_cnf` (3-tier: delegate_items[*].cnf → verified
+ * delegate_payload[*].cnf → top-level cnf), returned as a strict EC-P256 JWK.
+ *
+ * Hardening H3 (stricter than AP2's first-match): reject if MORE THAN ONE
+ * delegate item carries a `cnf` — a disclosure-injected second `cnf` must not be
+ * able to silently win. (The signed-`_sd` binding refinement is pending a
+ * crafted ambiguous-cnf vector.)
+ */
+export function cnfJwk(resolved) {
+    const itemsWithCnf = resolved.delegateItems.filter((it) => cnfDict(it["cnf"]) !== null);
+    if (itemsWithCnf.length > 1) {
+        throw new Error("Ambiguous cnf: more than one delegate item carries a cnf claim");
+    }
+    const cnf = (itemsWithCnf[0] ? cnfDict(itemsWithCnf[0]["cnf"]) : null) ??
+        firstCnfInList(resolved.verifiedPayload["delegate_payload"]) ??
+        cnfDict(resolved.verifiedPayload["cnf"]);
+    if (!cnf)
+        throw new Error("Previous token missing cnf.jwk");
+    const jwk = parseJwk(cnf["jwk"]);
+    if (!jwk)
+        throw new Error("cnf.jwk is not a valid EC P-256 JWK");
+    return jwk;
+}
+//# sourceMappingURL=sd-jwt.js.map

package/dist/ap2/sd-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sd-jwt.js","sourceRoot":"","sources":["../../src/ap2/sd-jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,aAAa,EAAuD,MAAM,MAAM,CAAC;AAE1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAY,MAAM,UAAU,CAAC;AAK9C,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAEnC,MAAM,oBAAoB,GAAG,CAAC,CAAC,CAAC,gBAAgB;AAChD,MAAM,uBAAuB,GAAG,CAAC,CAAC,CAAC,sBAAsB;AAIzD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6BAA8B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,kBAAkB,CAAC,WAAqB,EAAE,KAAyB;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,EAAW;IACrC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,IAAI,OAAO,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9F,OAAO,EAAE,CAAC,cAAc,CAAW,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,MAAe,EAAE,GAA2B,EAAE,QAAsB;IAClF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;wBAC5C,MAAM,IAAI,KAAK,CAAC,8DAA8D,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;oBAClG,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACjD,CAAC;gBACD,kDAAkD;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAS,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;gBACjD,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,KAAK,MAAM,MAAM,IAAI,EAAE,EAAE,CAAC;gBACxB,uEAAuE;gBACvE,kEAAkE;gBAClE,oEAAoE;gBACpE,+DAA+D;gBAC/D,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACrB,MAAM,OAAO,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;wBAC/C,MAAM,IAAI,KAAK,CAAC,sEAAsE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC1G,CAAC;oBACD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAW,CAAC;oBACjC,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;wBACrB,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,GAAG,CAAC,CAAC;oBAClF,CAAC;oBACD,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAa,EAAE,WAAqB,EAAE,KAAyB;IAChG,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,UAAU,gBAAgB,aAAa,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,EAAW,CAAS,CAAC;AAC1D,CAAC;AAED,gFAAgF;AAEhF,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,MAAc,EAAE,WAAqB,EAAE,KAAyB;IACxF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,MAAM;YAAE,SAAS;QAC9D,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,MAAM,GAAG,GACP,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxG,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAa,EAAE,KAAkB;IACtE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjE,OAAO,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5C,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,OAAO,IAAI,IAAI,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF,0EAA0E;AAC1E,SAAS,cAAc,CAAC,IAAU,EAAE,KAAkB;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClG,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAClC,IAAI,uBAAuB,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAI,OAAO,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;oBAC/C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAW,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1C,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GACP,GAAG,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxG,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,eAAwB,EAAE,KAAkB;IAC/E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,OAAO,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAaD;iFACiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAiB,EAAE,GAAoB;IACvE,MAAM,aAAa,CAAC,SAAS,EAAE,GAA0C,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAkB,EAAE,GAAoB;IAC5E,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,oBAAoB,CAAC,eAAe,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;AACnD,CAAC;AAED,iFAAiF;AAEjF,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAC,QAAuB;IAC5C,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACxF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GACP,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,cAAc,CAAC,QAAQ,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;QAC5D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/ap2/types.d.ts

@@ -0,0 +1,270 @@
+/**
+ * Typed AP2 payment-mandate schemas (zod), mirroring AP2's generated models at
+ * commit e1ea56d (`generated/open_payment_mandate.py`, `payment_mandate.py`,
+ * `types/{amount,merchant,payment_instrument,pisp}.py`).
+ *
+ * `vct` is pinned to the EXACT version-suffixed literal (AUTH-1 / SPEC-16: a
+ * verifier MUST match the full `vct` string), so a wrong/loose `vct` fails to
+ * parse. Objects are non-strict (unknown keys stripped) to match pydantic's
+ * default `extra='ignore'` and tolerate `iat`/`exp`/`risk_data`/future fields.
+ * Constraints are kept loosely typed at the mandate level so an UNKNOWN
+ * constraint type does not crash parsing — it is surfaced as a violation during
+ * evaluation (AUTH-15: unknown constraints MUST fail evaluation), not silently
+ * dropped.
+ */
+import { z } from "zod";
+export declare const AmountSchema: z.ZodObject<{
+    amount: z.ZodNumber;
+    currency: z.ZodString;
+}, z.core.$strip>;
+export declare const MerchantSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const PaymentInstrumentSchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const PispSchema: z.ZodObject<{
+    legal_name: z.ZodString;
+    brand_name: z.ZodString;
+    domain_name: z.ZodString;
+}, z.core.$strip>;
+export type Amount = z.infer<typeof AmountSchema>;
+export type Merchant = z.infer<typeof MerchantSchema>;
+export type PaymentInstrument = z.infer<typeof PaymentInstrumentSchema>;
+export type Pisp = z.infer<typeof PispSchema>;
+export declare const AmountRangeSchema: z.ZodObject<{
+    type: z.ZodLiteral<"payment.amount_range">;
+    currency: z.ZodString;
+    max: z.ZodNumber;
+    min: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>;
+export declare const BudgetSchema: z.ZodObject<{
+    type: z.ZodLiteral<"payment.budget">;
+    max: z.ZodNumber;
+    currency: z.ZodString;
+}, z.core.$strip>;
+export declare const AgentRecurrenceSchema: z.ZodObject<{
+    type: z.ZodLiteral<"payment.agent_recurrence">;
+    frequency: z.ZodString;
+    max_occurrences: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>;
+export declare const AllowedPayeesSchema: z.ZodObject<{
+    type: z.ZodLiteral<"payment.allowed_payees">;
+    allowed: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const AllowedPaymentInstrumentsSchema: z.ZodObject<{
+    type: z.ZodLiteral<"payment.allowed_payment_instruments">;
+    allowed: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodString;
+        description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const AllowedPispsSchema: z.ZodObject<{
+    type: z.ZodLiteral<"payment.allowed_pisps">;
+    allowed: z.ZodArray<z.ZodObject<{
+        legal_name: z.ZodString;
+        brand_name: z.ZodString;
+        domain_name: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const ExecutionDateSchema: z.ZodObject<{
+    type: z.ZodLiteral<"payment.execution_date">;
+    not_before: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    not_after: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const PaymentReferenceSchema: z.ZodObject<{
+    type: z.ZodLiteral<"payment.reference">;
+    conditional_transaction_id: z.ZodString;
+}, z.core.$strip>;
+/** Strongly-typed union of the known payment constraints (for the evaluator). */
+export declare const KnownPaymentConstraintSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"payment.amount_range">;
+    currency: z.ZodString;
+    max: z.ZodNumber;
+    min: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"payment.budget">;
+    max: z.ZodNumber;
+    currency: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"payment.agent_recurrence">;
+    frequency: z.ZodString;
+    max_occurrences: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"payment.allowed_payees">;
+    allowed: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"payment.allowed_payment_instruments">;
+    allowed: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodString;
+        description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"payment.allowed_pisps">;
+    allowed: z.ZodArray<z.ZodObject<{
+        legal_name: z.ZodString;
+        brand_name: z.ZodString;
+        domain_name: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"payment.execution_date">;
+    not_before: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    not_after: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"payment.reference">;
+    conditional_transaction_id: z.ZodString;
+}, z.core.$strip>], "type">;
+export type KnownPaymentConstraint = z.infer<typeof KnownPaymentConstraintSchema>;
+export declare const OpenPaymentMandateSchema: z.ZodObject<{
+    vct: z.ZodLiteral<"mandate.payment.open.1">;
+    constraints: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+    }, z.core.$loose>>;
+    cnf: z.ZodOptional<z.ZodUnknown>;
+    payee: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    payment_amount: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        amount: z.ZodNumber;
+        currency: z.ZodString;
+    }, z.core.$strip>>>;
+    payment_instrument: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodString;
+        description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    pisp: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        legal_name: z.ZodString;
+        brand_name: z.ZodString;
+        domain_name: z.ZodString;
+    }, z.core.$strip>>>;
+    execution_date: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const PaymentMandateSchema: z.ZodObject<{
+    vct: z.ZodLiteral<"mandate.payment.1">;
+    transaction_id: z.ZodString;
+    payee: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>;
+    pisp: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        legal_name: z.ZodString;
+        brand_name: z.ZodString;
+        domain_name: z.ZodString;
+    }, z.core.$strip>>>;
+    payment_amount: z.ZodObject<{
+        amount: z.ZodNumber;
+        currency: z.ZodString;
+    }, z.core.$strip>;
+    payment_instrument: z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodString;
+        description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>;
+    execution_date: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type OpenPaymentMandate = z.infer<typeof OpenPaymentMandateSchema>;
+export type PaymentMandate = z.infer<typeof PaymentMandateSchema>;
+/** Aggregated usage context (port of `constraints.py::MandateContext`). */
+export interface MandateContext {
+    total_amount: number;
+    total_uses: number;
+    last_used_date?: number | null;
+}
+export declare const AllowedMerchantsSchema: z.ZodObject<{
+    type: z.ZodLiteral<"checkout.allowed_merchants">;
+    allowed: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+declare const LineItemRequirementsSchema: z.ZodObject<{
+    id: z.ZodString;
+    acceptable_items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+    }, z.core.$strip>>;
+    quantity: z.ZodNumber;
+}, z.core.$strip>;
+export declare const LineItemsSchema: z.ZodObject<{
+    type: z.ZodLiteral<"checkout.line_items">;
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        acceptable_items: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            title: z.ZodString;
+        }, z.core.$strip>>;
+        quantity: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const KnownCheckoutConstraintSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"checkout.allowed_merchants">;
+    allowed: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"checkout.line_items">;
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        acceptable_items: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            title: z.ZodString;
+        }, z.core.$strip>>;
+        quantity: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>], "type">;
+export type LineItemRequirement = z.infer<typeof LineItemRequirementsSchema>;
+export declare const OpenCheckoutMandateSchema: z.ZodObject<{
+    vct: z.ZodLiteral<"mandate.checkout.open.1">;
+    constraints: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+    }, z.core.$loose>>;
+    cnf: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+export type OpenCheckoutMandate = z.infer<typeof OpenCheckoutMandateSchema>;
+/** Closed checkout mandate (mirror `generated/checkout_mandate.py`). */
+export declare const CheckoutMandateSchema: z.ZodObject<{
+    vct: z.ZodLiteral<"mandate.checkout.1">;
+    checkout_jwt: z.ZodString;
+    checkout_hash: z.ZodString;
+}, z.core.$strip>;
+export type CheckoutMandate = z.infer<typeof CheckoutMandateSchema>;
+/** Minimal UCP Checkout — only the fields the constraint evaluators read
+ * (`merchant`, `line_items[].item.id`, `line_items[].quantity`). `extra='allow'`
+ * in AP2, so unknown keys pass through. */
+export declare const CheckoutSchema: z.ZodObject<{
+    merchant: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    line_items: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        item: z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$loose>;
+        quantity: z.ZodNumber;
+    }, z.core.$loose>>>>;
+}, z.core.$loose>;
+export type Checkout = z.infer<typeof CheckoutSchema>;
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/ap2/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ap2/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,YAAY;;;iBAA+D,CAAC;AACzF,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AACH,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,eAAO,MAAM,UAAU;;;;iBAIrB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAClD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAG9C,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAC;AACH,eAAO,MAAM,YAAY;;;;iBAIvB,CAAC;AACH,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAC;AACH,eAAO,MAAM,mBAAmB;;;;;;;iBAG9B,CAAC;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,eAAO,MAAM,kBAAkB;;;;;;;iBAG7B,CAAC;AACH,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AACH,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BASvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMlF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;iBASnC,CAAC;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;iBAQ/B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAGD,eAAO,MAAM,sBAAsB;;;;;;;iBAGjC,CAAC;AACH,QAAA,MAAM,0BAA0B;;;;;;;iBAI9B,CAAC;AACH,eAAO,MAAM,eAAe;;;;;;;;;;iBAG1B,CAAC;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;2BAA0E,CAAC;AACrH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE7E,eAAO,MAAM,yBAAyB;;;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,wEAAwE;AACxE,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;2CAE2C;AAC3C,eAAO,MAAM,cAAc;;;;;;;;;;;;iBAOX,CAAC;AACjB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}