@interop/wallet-core 0.68.0 → 0.70.0

package/dist/request/classify.d.ts

@@ -1,226 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * Classification of incoming VC API messages: turns a raw CHAPI event (or a QR
- * / pasted payload) into a typed `IVPRequest` / `IVPOffer`, and provides the
- * helpers used to dispatch on what was actually asked for (VC sharing, DID
- * Authentication, capability delegation, or a combination).
- *
- * Ported from Freewallet's `src/lib/walletRequest/classify.ts` (the superset of
- * DCW's `app/lib/exchanges.ts` / `walletRequestApi.ts` dispatch helpers). The
- * shared classifier covers the three VPR-spec query types plus the App Connect
- * `AppConnectQuery` extension (`appConnectRequestOf`), whose `app` block is
- * validated here against the attested requesting origin.
- */
-import type { CHAPIStoreEvent, IAppConnectRequest, ICapabilityQueryDetail, ICredentialQuery, IQueryByExample, IVPOffer, IVPRequest, IVPRDetails, IVPRQuery, IVerifiableCredential, IVerifiablePresentation, WalletRequestProfile } from './types.js';
-import type { CHAPIGetEvent } from './types.js';
-import { isZcapQuery } from './queryPredicates.js';
-export { isZcapQuery };
-/**
- * The VC data model version a presentation carrying the given credentials must
- * use, so its `@context` stays coherent with what it carries: `2.0` when any
- * credential is a VC 2.0 one, else `1.0`. Shared by the bare-credential
- * wrapping below and by the unsigned branch of `composeVp` (the signed branch
- * takes its version from the negotiated cryptosuite instead).
- *
- * @param credentials {IVerifiableCredential[]}
- * @returns {number}
- */
-export declare function presentationVersionFor(credentials: IVerifiableCredential[]): number;
-/**
- * The Verifiable Credentials carried by a presentation, normalized to an array.
- *
- * @param presentation {IVerifiablePresentation}
- * @returns {IVerifiableCredential[]}
- */
-export declare function credentialsOf(presentation: IVerifiablePresentation): IVerifiableCredential[];
-/**
- * Wraps a CHAPI get event as an `IVPRequest`.
- *
- * @param event {CHAPIGetEvent}
- * @returns {IVPRequest}
- */
-export declare function classifyCHAPIGetEvent(event: CHAPIGetEvent): IVPRequest;
-/**
- * Wraps a CHAPI store event as an `IVPOffer`. A bare offered credential is
- * wrapped in an unsigned presentation, so downstream code always sees a VP.
- *
- * @param event {CHAPIStoreEvent}
- * @returns {IVPOffer}
- */
-export declare function classifyCHAPIStoreEvent(event: CHAPIStoreEvent): IVPOffer;
-/**
- * Returns true if the query set contains a `DIDAuthentication` query. Throws if
- * more than one is present -- a single DID-Auth proof answers the request.
- *
- * @param options {object}
- * @param options.queries {IVPRQuery[]}
- * @returns {boolean}
- */
-export declare function isDIDAuthRequested({ queries }: {
-    queries: IVPRQuery[];
-}): boolean;
-/**
- * Normalizes a VPR's `query` (which may be a single object or an array) to an
- * array, dropping anything that is not a typed query object. A VPR body can
- * legitimately carry no queries at all -- a CHAPI request that names a
- * `protocols` exchange sends an empty body -- so callers get an empty array
- * rather than an array holding `undefined`.
- *
- * @param request {IVPRDetails}
- * @returns {IVPRQuery[]}
- */
-export declare function queriesOf(request: IVPRDetails): IVPRQuery[];
-/**
- * Normalizes a `QueryByExample`'s `credentialQuery` (a single detail object or
- * an array of them) to an array.
- *
- * @param query {IQueryByExample}
- * @returns {ICredentialQuery[]}
- */
-export declare function credentialQueriesOf(query: IQueryByExample): ICredentialQuery[];
-/**
- * Collects the requested capabilities from a query set: filters the two zcap
- * query type strings (`AuthorizationCapabilityQuery` canonical, `ZcapQuery`
- * legacy alias), normalizes each `capabilityQuery` (object or array) to an
- * array, and flattens. A zcap query whose `capabilityQuery` is missing or not
- * an object is malformed -- there is nothing to ask consent for -- so it throws
- * rather than letting an `undefined` descriptor reach grant resolution;
- * classification-time callers surface the throw as a malformed-request state.
- *
- * @param queries {IVPRQuery[]}
- * @returns {ICapabilityQueryDetail[]}
- */
-export declare function zcapQueriesOf(queries: IVPRQuery[]): ICapabilityQueryDetail[];
-/**
- * Validates an App Connect `app.appUrl` against the attested requesting origin
- * and returns its serialized form. The value must parse as an absolute URL,
- * must not carry a fragment, and its origin must equal the attested origin;
- * any violation throws (the query is malformed). All storage and comparison
- * downstream uses the returned serialization, so spellings differing only in
- * a default port, percent-encoding case, or dot-segments do not name distinct
- * applications.
- *
- * The fragment check reads the serialized URL rather than `url.hash`: a bare
- * trailing `#` sets an empty (non-null) fragment that `hash` reports as `''`,
- * and a percent-encoded `%23` never appears as `#` in the serialization.
- *
- * @param options {object}
- * @param options.appUrl {string} - The request's `app.appUrl`.
- * @param options.origin {string} - The attested requesting origin.
- * @returns {string} The parsed URL's serialization.
- */
-export declare function serializedAppUrl({ appUrl, origin }: {
-    appUrl: string;
-    origin: string;
-}): string;
-/**
- * Extracts the App Connect request from a query set, when one is present. An
- * `AppConnectQuery` is one mental model per popup: the request must not also
- * carry `QueryByExample` or standalone zcap queries, at most one
- * `AppConnectQuery` is allowed, and its `app` block must carry the display
- * `name` and the `appUrl` the wallet needs to match or mint the app-key
- * credential -- with the `appUrl` validated against the attested requesting
- * origin and rewritten to its serialized form ({@link serializedAppUrl}).
- * Violations throw; classification-time callers surface the throw as a
- * malformed-request state. The capability queries are normalized to an array
- * (absent means "no grants requested" -- a connect that only recovers the app
- * key is legal), and each entry is rebuilt from an allowlist of the declared
- * fields (`referenceId`, `allowedAction`, `invocationTarget`): the type-level
- * Omit does not bind an actual request body, so any other wire-level field --
- * a smuggled `reason`, an attacker-chosen `controller`, a future
- * display-bearing addition -- is made unrepresentable here, before the entries
- * reach the profile the consent screen and the delegation path read.
- *
- * @param options {object}
- * @param options.queries {IVPRQuery[]}
- * @param options.origin {string} - The attested requesting origin the
- *   `appUrl` is validated against.
- * @returns {IAppConnectRequest | null}
- */
-export declare function appConnectRequestOf({ queries, origin }: {
-    queries: IVPRQuery[];
-    origin: string;
-}): IAppConnectRequest | null;
-/**
- * The longest self-declared agent name a request may carry, after trimming.
- */
-export declare const AGENT_NAME_MAX_LENGTH = 64;
-/**
- * Normalizes a self-declared agent name to the form the consent surface and
- * the Login activity carry: trimmed, 1 to {@link AGENT_NAME_MAX_LENGTH}
- * characters, with no control characters (C0 or C1, line breaks included).
- * Any Unicode letter is fine -- names are not ASCII-only -- but a name that
- * could spoof layout or sneak past a one-line render is refused. Both the
- * requester side (`composeCapabilityRequest`) and the wallet side
- * (`requestingAgentOf`) run this, so a name the requester could compose is
- * one the wallet accepts.
- *
- * @param options {object}
- * @param options.name {unknown}   the raw `agent.name` value
- * @returns {string}   the trimmed name
- */
-export declare function normalizeAgentName({ name }: {
-    name: unknown;
-}): string;
-/**
- * Reads the requester's self-declared identity off a VPR body, when present:
- * the root `agent` member, whose `name` is validated and trimmed by
- * {@link normalizeAgentName}. An absent member is fine (the wallet shows the
- * grantee key alone); a present one that is not an object or whose name fails
- * the limits is malformed and throws, so classification-time callers surface
- * it as a malformed-request state rather than rendering an unbounded string.
- *
- * @param request {IVPRDetails}
- * @returns {{ name: string } | undefined}
- */
-export declare function requestingAgentOf(request: IVPRDetails): {
-    name: string;
-} | undefined;
-/**
- * Classifies a VPR body onto the independent axes the consent screen and
- * response assembly work from: whether DID Authentication is requested, and
- * separately the credential (`QueryByExample`) and capability
- * (`AuthorizationCapabilityQuery` / `ZcapQuery`) content asked for, plus the
- * requester's self-declared `agent` name when the body carries one. Any
- * combination is valid, including zcap-only.
- *
- * @param request {IVPRDetails}
- * @returns {WalletRequestProfile}
- */
-export declare function classifyRequest(request: IVPRDetails): WalletRequestProfile;
-/**
- * Whether a classified request is DID-Authentication *only*: it asks the wallet
- * to prove control of its DID and nothing else (no credential queries, no
- * capability requests). Derived from the profile so a popup's restore fast-path
- * and its render both dispatch on the one predicate.
- *
- * @param profile {WalletRequestProfile}
- * @returns {boolean}
- */
-export declare function isDidAuthOnly(profile: WalletRequestProfile): boolean;
-/**
- * The DID methods a caller can present a holder for, by bare method name, as
- * `acceptedMethods` states them (`key`, `web`, `webvh`). The default is the
- * one every wallet holds: a session with no promoted account presents its
- * did:key and nothing else.
- */
-export declare const DEFAULT_PRESENTABLE_DID_METHODS: readonly ["key"];
-/**
- * Returns true if the caller can satisfy the DID method a `DIDAuthentication`
- * query constrains to. `presentableMethods` names the bare DID method names
- * this session can present a holder for; a request that omits
- * `acceptedMethods` entirely, or lists it empty, imposes no constraint and is
- * satisfiable whatever the session holds. A malformed `acceptedMethods` (not
- * an array, or holding non-object entries) is read for the entries it does
- * have rather than dereferenced blindly: an `acceptedMethods` that is not a
- * list of constraints at all imposes none.
- *
- * @param queries {IVPRQuery[]}
- * @param [presentableMethods] {readonly string[]}   default
- *   {@link DEFAULT_PRESENTABLE_DID_METHODS}
- * @returns {boolean}
- */
-export declare function didAuthMethodSupported(queries: IVPRQuery[], presentableMethods?: readonly string[]): boolean;
-//# sourceMappingURL=classify.d.ts.map

package/dist/request/classify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,eAAe,EAGf,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAEhB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAGL,WAAW,EAGZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,CAAA;AAmBtB;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,qBAAqB,EAAE,GACnC,MAAM,CAOR;AA0DD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,uBAAuB,GACpC,qBAAqB,EAAE,CAQzB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAYtE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;CACrB,GAAG,OAAO,CAQV;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,EAAE,CAS3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,GACrB,gBAAgB,EAAE,CAMpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAc5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAmBT;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACP,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,kBAAkB,GAAG,IAAI,CA2C5B;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAoBtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAS9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,oBAAoB,CAW1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAMpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,kBAAmB,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,EAAE,EACpB,kBAAkB,GAAE,SAAS,MAAM,EAAoC,GACtE,OAAO,CAWT"}

package/dist/request/classify.js

@@ -1,416 +0,0 @@
-import { typeArray } from '@interop/data-integrity-core/guards';
-import { isAppConnectQuery, isWalletOnboardingQuery, isZcapQuery, parsedAbsoluteUrl, singletonQueryOf } from './queryPredicates.js';
-export { isZcapQuery };
-const VC_1_CONTEXT_URL = 'https://www.w3.org/2018/credentials/v1';
-const VC_2_CONTEXT_URL = 'https://www.w3.org/ns/credentials/v2';
-/**
- * Narrows an untrusted value to a string-keyed record, or `undefined` when it
- * is not an object.
- *
- * @param value {unknown}
- * @returns {Record<string, unknown> | undefined}
- */
-function asRecord(value) {
-    if (!value || typeof value !== 'object') {
-        return undefined;
-    }
-    return value;
-}
-/**
- * The VC data model version a presentation carrying the given credentials must
- * use, so its `@context` stays coherent with what it carries: `2.0` when any
- * credential is a VC 2.0 one, else `1.0`. Shared by the bare-credential
- * wrapping below and by the unsigned branch of `composeVp` (the signed branch
- * takes its version from the negotiated cryptosuite instead).
- *
- * @param credentials {IVerifiableCredential[]}
- * @returns {number}
- */
-export function presentationVersionFor(credentials) {
-    const isV2 = credentials.some(credential => {
-        const contexts = credential?.['@context'];
-        const contextArray = Array.isArray(contexts) ? contexts : [contexts];
-        return contextArray.includes(VC_2_CONTEXT_URL);
-    });
-    return isV2 ? 2.0 : 1.0;
-}
-/**
- * Wraps a bare Verifiable Credential in an unsigned Verifiable Presentation,
- * matching the credential's VC data model version so the presentation's
- * `@context` stays coherent with the credential it carries.
- *
- * @param credential {IVerifiableCredential}
- * @returns {IVerifiablePresentation}
- */
-function presentationWrapping(credential) {
-    const isV2 = presentationVersionFor([credential]) === 2.0;
-    return {
-        '@context': [isV2 ? VC_2_CONTEXT_URL : VC_1_CONTEXT_URL],
-        type: ['VerifiablePresentation'],
-        verifiableCredential: [credential]
-    };
-}
-/**
- * The offered payload as a Verifiable Presentation: passed through when the
- * issuer already offered one, and wrapped when it offered a bare Verifiable
- * Credential. A `data` payload that is not an object at all is unrecognized,
- * and reported with the same descriptive error as an unrecognized object.
- *
- * @param credential {CHAPIStoreEvent['credential']}
- * @returns {IVerifiablePresentation}
- */
-function offeredPresentation({ dataType, data }) {
-    const payload = asRecord(data);
-    const types = typeArray(payload?.type);
-    const isPresentation = !!payload &&
-        (dataType === 'VerifiablePresentation' ||
-            types.includes('VerifiablePresentation') ||
-            'verifiableCredential' in payload);
-    if (isPresentation) {
-        return data;
-    }
-    if (payload &&
-        (dataType === 'VerifiableCredential' ||
-            types.includes('VerifiableCredential'))) {
-        return presentationWrapping(data);
-    }
-    throw new Error(`CHAPI store event offered an unrecognized payload (dataType: ${dataType ?? 'undefined'}, type: ${JSON.stringify(types)}).`);
-}
-/**
- * The Verifiable Credentials carried by a presentation, normalized to an array.
- *
- * @param presentation {IVerifiablePresentation}
- * @returns {IVerifiableCredential[]}
- */
-export function credentialsOf(presentation) {
-    const { verifiableCredential } = presentation;
-    if (!verifiableCredential) {
-        return [];
-    }
-    return Array.isArray(verifiableCredential)
-        ? verifiableCredential
-        : [verifiableCredential];
-}
-/**
- * Wraps a CHAPI get event as an `IVPRequest`.
- *
- * @param event {CHAPIGetEvent}
- * @returns {IVPRequest}
- */
-export function classifyCHAPIGetEvent(event) {
-    const verifiablePresentationRequest = event.credentialRequestOptions?.web?.VerifiablePresentation;
-    if (!verifiablePresentationRequest) {
-        throw new Error('CHAPI get event is missing a VerifiablePresentation request.');
-    }
-    return {
-        verifiablePresentationRequest,
-        credentialRequestOrigin: event.credentialRequestOrigin
-    };
-}
-/**
- * Wraps a CHAPI store event as an `IVPOffer`. A bare offered credential is
- * wrapped in an unsigned presentation, so downstream code always sees a VP.
- *
- * @param event {CHAPIStoreEvent}
- * @returns {IVPOffer}
- */
-export function classifyCHAPIStoreEvent(event) {
-    return {
-        verifiablePresentation: offeredPresentation(event.credential),
-        credentialRequestOrigin: event.credentialRequestOrigin
-    };
-}
-/**
- * Returns true if the query set contains a `DIDAuthentication` query. Throws if
- * more than one is present -- a single DID-Auth proof answers the request.
- *
- * @param options {object}
- * @param options.queries {IVPRQuery[]}
- * @returns {boolean}
- */
-export function isDIDAuthRequested({ queries }) {
-    const didAuthRequests = queries.filter(query => query.type === 'DIDAuthentication');
-    if (didAuthRequests.length > 1) {
-        throw new Error('More than one DIDAuthentication request found, exiting.');
-    }
-    return didAuthRequests.length === 1;
-}
-/**
- * Normalizes a VPR's `query` (which may be a single object or an array) to an
- * array, dropping anything that is not a typed query object. A VPR body can
- * legitimately carry no queries at all -- a CHAPI request that names a
- * `protocols` exchange sends an empty body -- so callers get an empty array
- * rather than an array holding `undefined`.
- *
- * @param request {IVPRDetails}
- * @returns {IVPRQuery[]}
- */
-export function queriesOf(request) {
-    const { query } = request;
-    const queries = Array.isArray(query) ? query : [query];
-    return queries.filter((entry) => !!entry &&
-        typeof entry === 'object' &&
-        typeof entry.type === 'string');
-}
-/**
- * Normalizes a `QueryByExample`'s `credentialQuery` (a single detail object or
- * an array of them) to an array.
- *
- * @param query {IQueryByExample}
- * @returns {ICredentialQuery[]}
- */
-export function credentialQueriesOf(query) {
-    const { credentialQuery } = query;
-    if (!credentialQuery) {
-        return [];
-    }
-    return Array.isArray(credentialQuery) ? credentialQuery : [credentialQuery];
-}
-/**
- * Collects the requested capabilities from a query set: filters the two zcap
- * query type strings (`AuthorizationCapabilityQuery` canonical, `ZcapQuery`
- * legacy alias), normalizes each `capabilityQuery` (object or array) to an
- * array, and flattens. A zcap query whose `capabilityQuery` is missing or not
- * an object is malformed -- there is nothing to ask consent for -- so it throws
- * rather than letting an `undefined` descriptor reach grant resolution;
- * classification-time callers surface the throw as a malformed-request state.
- *
- * @param queries {IVPRQuery[]}
- * @returns {ICapabilityQueryDetail[]}
- */
-export function zcapQueriesOf(queries) {
-    return queries.filter(isZcapQuery).flatMap(({ type, capabilityQuery }) => {
-        const detailEntries = Array.isArray(capabilityQuery)
-            ? capabilityQuery
-            : [capabilityQuery];
-        for (const detail of detailEntries) {
-            if (!detail || typeof detail !== 'object') {
-                throw new Error(`A "${type}" query is missing its capabilityQuery detail.`);
-            }
-        }
-        return detailEntries;
-    });
-}
-/**
- * Validates an App Connect `app.appUrl` against the attested requesting origin
- * and returns its serialized form. The value must parse as an absolute URL,
- * must not carry a fragment, and its origin must equal the attested origin;
- * any violation throws (the query is malformed). All storage and comparison
- * downstream uses the returned serialization, so spellings differing only in
- * a default port, percent-encoding case, or dot-segments do not name distinct
- * applications.
- *
- * The fragment check reads the serialized URL rather than `url.hash`: a bare
- * trailing `#` sets an empty (non-null) fragment that `hash` reports as `''`,
- * and a percent-encoded `%23` never appears as `#` in the serialization.
- *
- * @param options {object}
- * @param options.appUrl {string} - The request's `app.appUrl`.
- * @param options.origin {string} - The attested requesting origin.
- * @returns {string} The parsed URL's serialization.
- */
-export function serializedAppUrl({ appUrl, origin }) {
-    const url = parsedAbsoluteUrl({
-        value: appUrl,
-        notAbsoluteMessage: `An AppConnectQuery "appUrl" must be an absolute URL (got "${appUrl}").`,
-        fragmentMessage: `An AppConnectQuery "appUrl" must not carry a fragment (got "${appUrl}").`
-    });
-    let attestedOrigin;
-    try {
-        attestedOrigin = new URL(origin).origin;
-    }
-    catch {
-        attestedOrigin = origin;
-    }
-    if (url.origin !== attestedOrigin) {
-        throw new Error(`An AppConnectQuery "appUrl" must be same-origin with the requesting ` +
-            `origin "${origin}" (got "${appUrl}").`);
-    }
-    return url.href;
-}
-/**
- * Extracts the App Connect request from a query set, when one is present. An
- * `AppConnectQuery` is one mental model per popup: the request must not also
- * carry `QueryByExample` or standalone zcap queries, at most one
- * `AppConnectQuery` is allowed, and its `app` block must carry the display
- * `name` and the `appUrl` the wallet needs to match or mint the app-key
- * credential -- with the `appUrl` validated against the attested requesting
- * origin and rewritten to its serialized form ({@link serializedAppUrl}).
- * Violations throw; classification-time callers surface the throw as a
- * malformed-request state. The capability queries are normalized to an array
- * (absent means "no grants requested" -- a connect that only recovers the app
- * key is legal), and each entry is rebuilt from an allowlist of the declared
- * fields (`referenceId`, `allowedAction`, `invocationTarget`): the type-level
- * Omit does not bind an actual request body, so any other wire-level field --
- * a smuggled `reason`, an attacker-chosen `controller`, a future
- * display-bearing addition -- is made unrepresentable here, before the entries
- * reach the profile the consent screen and the delegation path read.
- *
- * @param options {object}
- * @param options.queries {IVPRQuery[]}
- * @param options.origin {string} - The attested requesting origin the
- *   `appUrl` is validated against.
- * @returns {IAppConnectRequest | null}
- */
-export function appConnectRequestOf({ queries, origin }) {
-    const appConnectQuery = singletonQueryOf({
-        queries,
-        isSingleton: isAppConnectQuery,
-        isExcluded: query => query.type === 'QueryByExample' ||
-            isZcapQuery(query) ||
-            isWalletOnboardingQuery(query),
-        typeName: 'AppConnectQuery',
-        mixedMessage: 'An AppConnectQuery cannot be combined with QueryByExample, ' +
-            'standalone capability queries, or a WalletOnboardingQuery.'
-    });
-    if (appConnectQuery === null) {
-        return null;
-    }
-    const { app, capabilityQuery } = appConnectQuery;
-    if (!app || typeof app.name !== 'string' || typeof app.appUrl !== 'string') {
-        throw new Error('An AppConnectQuery is missing its app name / appUrl.');
-    }
-    const appUrl = serializedAppUrl({ appUrl: app.appUrl, origin });
-    const rawQueries = capabilityQuery === undefined
-        ? []
-        : Array.isArray(capabilityQuery)
-            ? capabilityQuery
-            : [capabilityQuery];
-    const capabilityQueries = rawQueries.map(detail => {
-        if (!detail || typeof detail !== 'object') {
-            throw new Error('An AppConnectQuery carries a malformed capabilityQuery entry.');
-        }
-        const { referenceId, allowedAction, invocationTarget } = detail;
-        return {
-            ...(referenceId !== undefined && { referenceId }),
-            ...(allowedAction !== undefined && { allowedAction }),
-            invocationTarget
-        };
-    });
-    return { app: { name: app.name, appUrl }, capabilityQueries };
-}
-/**
- * The longest self-declared agent name a request may carry, after trimming.
- */
-export const AGENT_NAME_MAX_LENGTH = 64;
-/**
- * Normalizes a self-declared agent name to the form the consent surface and
- * the Login activity carry: trimmed, 1 to {@link AGENT_NAME_MAX_LENGTH}
- * characters, with no control characters (C0 or C1, line breaks included).
- * Any Unicode letter is fine -- names are not ASCII-only -- but a name that
- * could spoof layout or sneak past a one-line render is refused. Both the
- * requester side (`composeCapabilityRequest`) and the wallet side
- * (`requestingAgentOf`) run this, so a name the requester could compose is
- * one the wallet accepts.
- *
- * @param options {object}
- * @param options.name {unknown}   the raw `agent.name` value
- * @returns {string}   the trimmed name
- */
-export function normalizeAgentName({ name }) {
-    if (typeof name !== 'string') {
-        throw new Error('A request\'s "agent.name" must be a string.');
-    }
-    const trimmed = name.trim();
-    if (trimmed.length === 0) {
-        throw new Error('A request\'s "agent.name" must not be empty.');
-    }
-    if (trimmed.length > AGENT_NAME_MAX_LENGTH) {
-        throw new Error(`A request's "agent.name" must be at most ${AGENT_NAME_MAX_LENGTH} ` +
-            `characters (got ${trimmed.length}).`);
-    }
-    if (/\p{Cc}/u.test(trimmed)) {
-        throw new Error('A request\'s "agent.name" must not contain control characters.');
-    }
-    return trimmed;
-}
-/**
- * Reads the requester's self-declared identity off a VPR body, when present:
- * the root `agent` member, whose `name` is validated and trimmed by
- * {@link normalizeAgentName}. An absent member is fine (the wallet shows the
- * grantee key alone); a present one that is not an object or whose name fails
- * the limits is malformed and throws, so classification-time callers surface
- * it as a malformed-request state rather than rendering an unbounded string.
- *
- * @param request {IVPRDetails}
- * @returns {{ name: string } | undefined}
- */
-export function requestingAgentOf(request) {
-    const { agent } = request;
-    if (agent === undefined) {
-        return undefined;
-    }
-    if (!agent || typeof agent !== 'object' || Array.isArray(agent)) {
-        throw new Error('A request\'s "agent" member must be an object.');
-    }
-    return { name: normalizeAgentName({ name: agent.name }) };
-}
-/**
- * Classifies a VPR body onto the independent axes the consent screen and
- * response assembly work from: whether DID Authentication is requested, and
- * separately the credential (`QueryByExample`) and capability
- * (`AuthorizationCapabilityQuery` / `ZcapQuery`) content asked for, plus the
- * requester's self-declared `agent` name when the body carries one. Any
- * combination is valid, including zcap-only.
- *
- * @param request {IVPRDetails}
- * @returns {WalletRequestProfile}
- */
-export function classifyRequest(request) {
-    const queries = queriesOf(request);
-    const agent = requestingAgentOf(request);
-    return {
-        didAuth: isDIDAuthRequested({ queries }),
-        vcQueries: queries.filter((query) => query.type === 'QueryByExample'),
-        zcapRequests: zcapQueriesOf(queries),
-        ...(agent !== undefined && { agent })
-    };
-}
-/**
- * Whether a classified request is DID-Authentication *only*: it asks the wallet
- * to prove control of its DID and nothing else (no credential queries, no
- * capability requests). Derived from the profile so a popup's restore fast-path
- * and its render both dispatch on the one predicate.
- *
- * @param profile {WalletRequestProfile}
- * @returns {boolean}
- */
-export function isDidAuthOnly(profile) {
-    return (profile.didAuth &&
-        profile.vcQueries.length === 0 &&
-        profile.zcapRequests.length === 0);
-}
-/**
- * The DID methods a caller can present a holder for, by bare method name, as
- * `acceptedMethods` states them (`key`, `web`, `webvh`). The default is the
- * one every wallet holds: a session with no promoted account presents its
- * did:key and nothing else.
- */
-export const DEFAULT_PRESENTABLE_DID_METHODS = ['key'];
-/**
- * Returns true if the caller can satisfy the DID method a `DIDAuthentication`
- * query constrains to. `presentableMethods` names the bare DID method names
- * this session can present a holder for; a request that omits
- * `acceptedMethods` entirely, or lists it empty, imposes no constraint and is
- * satisfiable whatever the session holds. A malformed `acceptedMethods` (not
- * an array, or holding non-object entries) is read for the entries it does
- * have rather than dereferenced blindly: an `acceptedMethods` that is not a
- * list of constraints at all imposes none.
- *
- * @param queries {IVPRQuery[]}
- * @param [presentableMethods] {readonly string[]}   default
- *   {@link DEFAULT_PRESENTABLE_DID_METHODS}
- * @returns {boolean}
- */
-export function didAuthMethodSupported(queries, presentableMethods = DEFAULT_PRESENTABLE_DID_METHODS) {
-    const didAuth = queries.find(query => query.type === 'DIDAuthentication');
-    const acceptedMethods = didAuth?.acceptedMethods;
-    if (!Array.isArray(acceptedMethods) || acceptedMethods.length === 0) {
-        return true;
-    }
-    return acceptedMethods.some(entry => {
-        const method = asRecord(entry)?.method;
-        return typeof method === 'string' && presentableMethods.includes(method);
-    });
-}
-//# sourceMappingURL=classify.js.map

package/dist/request/classify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,CAAA;AAEtB,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AACjE,MAAM,gBAAgB,GAAG,sCAAsC,CAAA;AAE/D;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAoC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACzC,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACpE,OAAO,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,UAAiC;IAEjC,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,CAAA;IACzD,OAAO;QACL,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxD,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,CAAC,UAAU,CAAC;KACR,CAAA;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,IAAI,EAC0B;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,cAAc,GAClB,CAAC,CAAC,OAAO;QACT,CAAC,QAAQ,KAAK,wBAAwB;YACpC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACxC,sBAAsB,IAAI,OAAO,CAAC,CAAA;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAA+B,CAAA;IACxC,CAAC;IACD,IACE,OAAO;QACP,CAAC,QAAQ,KAAK,sBAAsB;YAClC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,oBAAoB,CAAC,IAA6B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gEACE,QAAQ,IAAI,WACd,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CACrC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAqC;IAErC,MAAM,EAAE,oBAAoB,EAAE,GAAG,YAAY,CAAA;IAC7C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACxC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,MAAM,6BAA6B,GACjC,KAAK,CAAC,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,CAAA;IAC7D,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,6BAA6B;QAC7B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,OAAO;QACL,sBAAsB,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EAGR;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAC5C,CAAA;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,KAAK,EAAsB,EAAE,CAC5B,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CACzD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAsB;IAEtB,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAA;IACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE;QACvE,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;QACrB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,MAAM,IAAI,gDAAgD,CAC3D,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,MAAM,EACN,MAAM,EAIP;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,KAAK,EAAE,MAAM;QACb,kBAAkB,EAAE,6DAA6D,MAAM,KAAK;QAC5F,eAAe,EAAE,+DAA+D,MAAM,KAAK;KAC5F,CAAC,CAAA;IACF,IAAI,cAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,GAAG,MAAM,CAAA;IACzB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,WAAW,MAAM,WAAW,MAAM,KAAK,CAC1C,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EAIP;IACC,MAAM,eAAe,GAAG,gBAAgB,CAAC;QACvC,OAAO;QACP,WAAW,EAAE,iBAAiB;QAC9B,UAAU,EAAE,KAAK,CAAC,EAAE,CAClB,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAC/B,WAAW,CAAC,KAAK,CAAC;YAClB,uBAAuB,CAAC,KAAK,CAAC;QAChC,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EACV,6DAA6D;YAC7D,4DAA4D;KAC/D,CAAuC,CAAA;IACxC,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,eAAe,CAAA;IAChD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/D,MAAM,UAAU,GACd,eAAe,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAC9B,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IACzB,MAAM,iBAAiB,GAAiC,UAAU,CAAC,GAAG,CACpE,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAA;QACH,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAA;QAC/D,OAAO;YACL,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;YACjD,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,CAAC;YACrD,gBAAgB;SACjB,CAAA;IACH,CAAC,CACF,CAAA;IACD,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAA;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAqB;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,4CAA4C,qBAAqB,GAAG;YAClE,mBAAmB,OAAO,CAAC,MAAM,IAAI,CACxC,CAAA;IACH,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoB;IAEpB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,SAAS,EAAE,OAAO,CAAC,MAAM,CACvB,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CACrE;QACD,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC;QACpC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;KACtC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,OAAO,CACL,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAClC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,KAAK,CAAU,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAoB,EACpB,qBAAwC,+BAA+B;IAEvE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CACnC,CAAA;IACrC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;QACtC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;AACJ,CAAC"}