@interop/wallet-request 0.1.0

package/dist/classify.d.ts

@@ -0,0 +1,233 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Classification of incoming VC API messages: turns a raw CHAPI event (or a QR
+ * / pasted payload) into a typed `IVPRequest` / `IVPOffer`, and provides the
+ * helpers used to dispatch on what was actually asked for (VC sharing, DID
+ * Authentication, capability delegation, or a combination).
+ *
+ * Ported from Freewallet's `src/lib/walletRequest/classify.ts` (the superset of
+ * DCW's `app/lib/exchanges.ts` / `walletRequestApi.ts` dispatch helpers). The
+ * shared classifier covers the three VPR-spec query types plus the App Connect
+ * `AppConnectQuery` extension (`appConnectRequestOf`), whose `app` block is
+ * validated here against the attested requesting origin.
+ */
+import type { CHAPIStoreEvent, IAppConnectRequest, ICapabilityQueryDetail, ICredentialQuery, IQueryByExample, IVPOffer, IVPRequest, IVPRDetails, IVPRQuery, IVerifiableCredential, IVerifiablePresentation, WalletRequestProfile } from './types.js';
+import type { CHAPIGetEvent } from './types.js';
+import { isZcapQuery } from './queryPredicates.js';
+export { isZcapQuery };
+/**
+ * The VC data model version a presentation carrying the given credentials must
+ * use, so its `@context` stays coherent with what it carries: `2.0` when any
+ * credential is a VC 2.0 one, else `1.0`. Shared by the bare-credential
+ * wrapping below and by the unsigned branch of `composeVp` (the signed branch
+ * takes its version from the negotiated cryptosuite instead).
+ *
+ * @param credentials {IVerifiableCredential[]}
+ * @returns {number}
+ */
+export declare function presentationVersionFor(credentials: IVerifiableCredential[]): number;
+/**
+ * The Verifiable Credentials carried by a presentation, normalized to an array.
+ *
+ * @param presentation {IVerifiablePresentation}
+ * @returns {IVerifiableCredential[]}
+ */
+export declare function credentialsOf(presentation: IVerifiablePresentation): IVerifiableCredential[];
+/**
+ * Wraps a CHAPI get event as an `IVPRequest`.
+ *
+ * @param event {CHAPIGetEvent}
+ * @returns {IVPRequest}
+ */
+export declare function classifyCHAPIGetEvent(event: CHAPIGetEvent): IVPRequest;
+/**
+ * Wraps a CHAPI store event as an `IVPOffer`. A bare offered credential is
+ * wrapped in an unsigned presentation, so downstream code always sees a VP.
+ *
+ * @param event {CHAPIStoreEvent}
+ * @returns {IVPOffer}
+ */
+export declare function classifyCHAPIStoreEvent(event: CHAPIStoreEvent): IVPOffer;
+/**
+ * Returns true if the query set contains a `DIDAuthentication` query. Throws if
+ * more than one is present -- a single DID-Auth proof answers the request.
+ *
+ * @param options {object}
+ * @param options.queries {IVPRQuery[]}
+ * @returns {boolean}
+ */
+export declare function isDIDAuthRequested({ queries }: {
+    queries: IVPRQuery[];
+}): boolean;
+/**
+ * Normalizes a VPR's `query` (which may be a single object or an array) to an
+ * array, dropping anything that is not a typed query object. A VPR body can
+ * legitimately carry no queries at all -- a CHAPI request that names a
+ * `protocols` exchange sends an empty body -- so callers get an empty array
+ * rather than an array holding `undefined`.
+ *
+ * @param request {IVPRDetails}
+ * @returns {IVPRQuery[]}
+ */
+export declare function queriesOf(request: IVPRDetails): IVPRQuery[];
+/**
+ * Normalizes a `QueryByExample`'s `credentialQuery` (a single detail object or
+ * an array of them) to an array.
+ *
+ * @param query {IQueryByExample}
+ * @returns {ICredentialQuery[]}
+ */
+export declare function credentialQueriesOf(query: IQueryByExample): ICredentialQuery[];
+/**
+ * Collects the requested capabilities from a query set: filters the two zcap
+ * query type strings (`AuthorizationCapabilityQuery` canonical, `ZcapQuery`
+ * legacy alias), normalizes each `capabilityQuery` (object or array) to an
+ * array, and flattens. A zcap query whose `capabilityQuery` is missing or not
+ * an object is malformed -- there is nothing to ask consent for -- so it throws
+ * rather than letting an `undefined` descriptor reach grant resolution;
+ * classification-time callers surface the throw as a malformed-request state.
+ *
+ * @param queries {IVPRQuery[]}
+ * @returns {ICapabilityQueryDetail[]}
+ */
+export declare function zcapQueriesOf(queries: IVPRQuery[]): ICapabilityQueryDetail[];
+/**
+ * Validates an App Connect `app.appUrl` against the attested requesting origin
+ * and returns its serialized form. The value must parse as an absolute URL,
+ * must not carry a fragment, and its origin must equal the attested origin;
+ * any violation throws (the query is malformed). All storage and comparison
+ * downstream uses the returned serialization, so spellings differing only in
+ * a default port, percent-encoding case, or dot-segments do not name distinct
+ * applications.
+ *
+ * The rule is the origin's, with no scheme constraint of its own: an `appUrl`
+ * under any scheme is accepted when its origin equals the attested one, which
+ * is what the App Connect spec asks. The one consequence of that is the
+ * opaque-origin refusal. A URL under a non-special scheme (`chrome-extension:`,
+ * `file:`, a custom scheme) has an opaque origin, which serializes as the
+ * string `"null"` and is same-origin only with itself, so two such strings
+ * being equal proves nothing; such an `appUrl` is refused as not same-origin
+ * rather than compared. The wallet-onboarding `host` validator is the
+ * mirror: it checks the scheme and no origin, since an exchange attests
+ * none.
+ *
+ * @param options {object}
+ * @param options.appUrl {string} - The request's `app.appUrl`.
+ * @param options.origin {string} - The attested requesting origin.
+ * @returns {string} The parsed URL's serialization.
+ */
+export declare function serializedAppUrl({ appUrl, origin }: {
+    appUrl: string;
+    origin: string;
+}): string;
+/**
+ * Extracts the App Connect request from a query set, when one is present. An
+ * `AppConnectQuery` is one mental model per popup: the request must not also
+ * carry `QueryByExample` or standalone zcap queries, at most one
+ * `AppConnectQuery` is allowed, and its `app` block must carry the display
+ * `name` and the `appUrl` the wallet needs to match or mint the app-key
+ * credential -- with the `appUrl` validated against the attested requesting
+ * origin and rewritten to its serialized form ({@link serializedAppUrl}).
+ * Violations throw; classification-time callers surface the throw as a
+ * malformed-request state. The capability queries are normalized to an array
+ * (absent means "no grants requested" -- a connect that only recovers the app
+ * key is legal), and each entry is rebuilt from an allowlist of the declared
+ * fields (`referenceId`, `allowedAction`, `invocationTarget`): the type-level
+ * Omit does not bind an actual request body, so any other wire-level field --
+ * a smuggled `reason`, an attacker-chosen `controller`, a future
+ * display-bearing addition -- is made unrepresentable here, before the entries
+ * reach the profile the consent screen and the delegation path read.
+ *
+ * @param options {object}
+ * @param options.queries {IVPRQuery[]}
+ * @param options.origin {string} - The attested requesting origin the
+ *   `appUrl` is validated against.
+ * @returns {IAppConnectRequest | null}
+ */
+export declare function appConnectRequestOf({ queries, origin }: {
+    queries: IVPRQuery[];
+    origin: string;
+}): IAppConnectRequest | null;
+/**
+ * The longest self-declared agent name a request may carry, after trimming.
+ */
+export declare const AGENT_NAME_MAX_LENGTH = 64;
+/**
+ * Normalizes a self-declared agent name to the form the consent surface and
+ * the Login activity carry: trimmed, 1 to {@link AGENT_NAME_MAX_LENGTH}
+ * characters, with no control characters (C0 or C1, line breaks included).
+ * Any Unicode letter is fine -- names are not ASCII-only -- but a name that
+ * could spoof layout or sneak past a one-line render is refused. Both the
+ * requester side (`composeCapabilityRequest`) and the wallet side
+ * (`requestingAgentOf`) run this, so a name the requester could compose is
+ * one the wallet accepts.
+ *
+ * @param options {object}
+ * @param options.name {unknown}   the raw `agent.name` value
+ * @returns {string}   the trimmed name
+ */
+export declare function normalizeAgentName({ name }: {
+    name: unknown;
+}): string;
+/**
+ * Reads the requester's self-declared identity off a VPR body, when present:
+ * the root `agent` member, whose `name` is validated and trimmed by
+ * {@link normalizeAgentName}. An absent member is fine (the wallet shows the
+ * grantee key alone); a present one that is not an object or whose name fails
+ * the limits is malformed and throws, so classification-time callers surface
+ * it as a malformed-request state rather than rendering an unbounded string.
+ *
+ * @param request {IVPRDetails}
+ * @returns {{ name: string } | undefined}
+ */
+export declare function requestingAgentOf(request: IVPRDetails): {
+    name: string;
+} | undefined;
+/**
+ * Classifies a VPR body onto the independent axes the consent screen and
+ * response assembly work from: whether DID Authentication is requested, and
+ * separately the credential (`QueryByExample`) and capability
+ * (`AuthorizationCapabilityQuery` / `ZcapQuery`) content asked for, plus the
+ * requester's self-declared `agent` name when the body carries one. Any
+ * combination is valid, including zcap-only.
+ *
+ * @param request {IVPRDetails}
+ * @returns {WalletRequestProfile}
+ */
+export declare function classifyRequest(request: IVPRDetails): WalletRequestProfile;
+/**
+ * Whether a classified request is DID-Authentication *only*: it asks the wallet
+ * to prove control of its DID and nothing else (no credential queries, no
+ * capability requests). Derived from the profile so a popup's restore fast-path
+ * and its render both dispatch on the one predicate.
+ *
+ * @param profile {WalletRequestProfile}
+ * @returns {boolean}
+ */
+export declare function isDidAuthOnly(profile: WalletRequestProfile): boolean;
+/**
+ * The DID methods a caller can present a holder for, by bare method name, as
+ * `acceptedMethods` states them (`key`, `web`, `webvh`). The default is the
+ * one every wallet holds: a session with no promoted account presents its
+ * did:key and nothing else.
+ */
+export declare const DEFAULT_PRESENTABLE_DID_METHODS: readonly ["key"];
+/**
+ * Returns true if the caller can satisfy the DID method a `DIDAuthentication`
+ * query constrains to. `presentableMethods` names the bare DID method names
+ * this session can present a holder for; a request that omits
+ * `acceptedMethods` entirely, or lists it empty, imposes no constraint and is
+ * satisfiable whatever the session holds. A malformed `acceptedMethods` (not
+ * an array, or holding non-object entries) is read for the entries it does
+ * have rather than dereferenced blindly: an `acceptedMethods` that is not a
+ * list of constraints at all imposes none.
+ *
+ * @param queries {IVPRQuery[]}
+ * @param [presentableMethods] {readonly string[]}   default
+ *   {@link DEFAULT_PRESENTABLE_DID_METHODS}
+ * @returns {boolean}
+ */
+export declare function didAuthMethodSupported(queries: IVPRQuery[], presentableMethods?: readonly string[]): boolean;
+//# sourceMappingURL=classify.d.ts.map

package/dist/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../src/classify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,eAAe,EAGf,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAEhB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAEL,WAAW,EAEZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,CAAA;AAmBtB;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,qBAAqB,EAAE,GACnC,MAAM,CAOR;AA0DD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,uBAAuB,GACpC,qBAAqB,EAAE,CAQzB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAYtE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;CACrB,GAAG,OAAO,CAQV;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,EAAE,CAS3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,GACrB,gBAAgB,EAAE,CAMpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAc5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAqBT;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACP,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,kBAAkB,GAAG,IAAI,CAmC5B;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAoBtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAS9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,oBAAoB,CAW1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAMpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,kBAAmB,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,EAAE,EACpB,kBAAkB,GAAE,SAAS,MAAM,EAAoC,GACtE,OAAO,CAYT"}

package/dist/classify.js

@@ -0,0 +1,419 @@
+import { typeArray } from '@interop/data-integrity-core/guards';
+import { exclusiveQueryOf, isZcapQuery, parsedAbsoluteUrl } from './queryPredicates.js';
+export { isZcapQuery };
+const VC_1_CONTEXT_URL = 'https://www.w3.org/2018/credentials/v1';
+const VC_2_CONTEXT_URL = 'https://www.w3.org/ns/credentials/v2';
+/**
+ * Narrows an untrusted value to a string-keyed record, or `undefined` when it
+ * is not an object.
+ *
+ * @param value {unknown}
+ * @returns {Record<string, unknown> | undefined}
+ */
+function asRecord(value) {
+    if (!value || typeof value !== 'object') {
+        return undefined;
+    }
+    return value;
+}
+/**
+ * The VC data model version a presentation carrying the given credentials must
+ * use, so its `@context` stays coherent with what it carries: `2.0` when any
+ * credential is a VC 2.0 one, else `1.0`. Shared by the bare-credential
+ * wrapping below and by the unsigned branch of `composeVp` (the signed branch
+ * takes its version from the negotiated cryptosuite instead).
+ *
+ * @param credentials {IVerifiableCredential[]}
+ * @returns {number}
+ */
+export function presentationVersionFor(credentials) {
+    const isV2 = credentials.some(credential => {
+        const contexts = credential?.['@context'];
+        const contextArray = Array.isArray(contexts) ? contexts : [contexts];
+        return contextArray.includes(VC_2_CONTEXT_URL);
+    });
+    return isV2 ? 2.0 : 1.0;
+}
+/**
+ * Wraps a bare Verifiable Credential in an unsigned Verifiable Presentation,
+ * matching the credential's VC data model version so the presentation's
+ * `@context` stays coherent with the credential it carries.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {IVerifiablePresentation}
+ */
+function presentationWrapping(credential) {
+    const isV2 = presentationVersionFor([credential]) === 2.0;
+    return {
+        '@context': [isV2 ? VC_2_CONTEXT_URL : VC_1_CONTEXT_URL],
+        type: ['VerifiablePresentation'],
+        verifiableCredential: [credential]
+    };
+}
+/**
+ * The offered payload as a Verifiable Presentation: passed through when the
+ * issuer already offered one, and wrapped when it offered a bare Verifiable
+ * Credential. A `data` payload that is not an object at all is unrecognized,
+ * and reported with the same descriptive error as an unrecognized object.
+ *
+ * @param credential {CHAPIStoreEvent['credential']}
+ * @returns {IVerifiablePresentation}
+ */
+function offeredPresentation({ dataType, data }) {
+    const payload = asRecord(data);
+    const types = typeArray(payload?.type);
+    const isPresentation = !!payload &&
+        (dataType === 'VerifiablePresentation' ||
+            types.includes('VerifiablePresentation') ||
+            'verifiableCredential' in payload);
+    if (isPresentation) {
+        return data;
+    }
+    if (payload &&
+        (dataType === 'VerifiableCredential' ||
+            types.includes('VerifiableCredential'))) {
+        return presentationWrapping(data);
+    }
+    throw new Error(`CHAPI store event offered an unrecognized payload (dataType: ${dataType ?? 'undefined'}, type: ${JSON.stringify(types)}).`);
+}
+/**
+ * The Verifiable Credentials carried by a presentation, normalized to an array.
+ *
+ * @param presentation {IVerifiablePresentation}
+ * @returns {IVerifiableCredential[]}
+ */
+export function credentialsOf(presentation) {
+    const { verifiableCredential } = presentation;
+    if (!verifiableCredential) {
+        return [];
+    }
+    return Array.isArray(verifiableCredential)
+        ? verifiableCredential
+        : [verifiableCredential];
+}
+/**
+ * Wraps a CHAPI get event as an `IVPRequest`.
+ *
+ * @param event {CHAPIGetEvent}
+ * @returns {IVPRequest}
+ */
+export function classifyCHAPIGetEvent(event) {
+    const verifiablePresentationRequest = event.credentialRequestOptions?.web?.VerifiablePresentation;
+    if (!verifiablePresentationRequest) {
+        throw new Error('CHAPI get event is missing a VerifiablePresentation request.');
+    }
+    return {
+        verifiablePresentationRequest,
+        credentialRequestOrigin: event.credentialRequestOrigin
+    };
+}
+/**
+ * Wraps a CHAPI store event as an `IVPOffer`. A bare offered credential is
+ * wrapped in an unsigned presentation, so downstream code always sees a VP.
+ *
+ * @param event {CHAPIStoreEvent}
+ * @returns {IVPOffer}
+ */
+export function classifyCHAPIStoreEvent(event) {
+    return {
+        verifiablePresentation: offeredPresentation(event.credential),
+        credentialRequestOrigin: event.credentialRequestOrigin
+    };
+}
+/**
+ * Returns true if the query set contains a `DIDAuthentication` query. Throws if
+ * more than one is present -- a single DID-Auth proof answers the request.
+ *
+ * @param options {object}
+ * @param options.queries {IVPRQuery[]}
+ * @returns {boolean}
+ */
+export function isDIDAuthRequested({ queries }) {
+    const didAuthRequests = queries.filter(query => query.type === 'DIDAuthentication');
+    if (didAuthRequests.length > 1) {
+        throw new Error('More than one DIDAuthentication request found, exiting.');
+    }
+    return didAuthRequests.length === 1;
+}
+/**
+ * Normalizes a VPR's `query` (which may be a single object or an array) to an
+ * array, dropping anything that is not a typed query object. A VPR body can
+ * legitimately carry no queries at all -- a CHAPI request that names a
+ * `protocols` exchange sends an empty body -- so callers get an empty array
+ * rather than an array holding `undefined`.
+ *
+ * @param request {IVPRDetails}
+ * @returns {IVPRQuery[]}
+ */
+export function queriesOf(request) {
+    const { query } = request;
+    const queries = Array.isArray(query) ? query : [query];
+    return queries.filter((entry) => !!entry &&
+        typeof entry === 'object' &&
+        typeof entry.type === 'string');
+}
+/**
+ * Normalizes a `QueryByExample`'s `credentialQuery` (a single detail object or
+ * an array of them) to an array.
+ *
+ * @param query {IQueryByExample}
+ * @returns {ICredentialQuery[]}
+ */
+export function credentialQueriesOf(query) {
+    const { credentialQuery } = query;
+    if (!credentialQuery) {
+        return [];
+    }
+    return Array.isArray(credentialQuery) ? credentialQuery : [credentialQuery];
+}
+/**
+ * Collects the requested capabilities from a query set: filters the two zcap
+ * query type strings (`AuthorizationCapabilityQuery` canonical, `ZcapQuery`
+ * legacy alias), normalizes each `capabilityQuery` (object or array) to an
+ * array, and flattens. A zcap query whose `capabilityQuery` is missing or not
+ * an object is malformed -- there is nothing to ask consent for -- so it throws
+ * rather than letting an `undefined` descriptor reach grant resolution;
+ * classification-time callers surface the throw as a malformed-request state.
+ *
+ * @param queries {IVPRQuery[]}
+ * @returns {ICapabilityQueryDetail[]}
+ */
+export function zcapQueriesOf(queries) {
+    return queries.filter(isZcapQuery).flatMap(({ type, capabilityQuery }) => {
+        const detailEntries = Array.isArray(capabilityQuery)
+            ? capabilityQuery
+            : [capabilityQuery];
+        for (const detail of detailEntries) {
+            if (!detail || typeof detail !== 'object') {
+                throw new Error(`A "${type}" query is missing its capabilityQuery detail.`);
+            }
+        }
+        return detailEntries;
+    });
+}
+/**
+ * Validates an App Connect `app.appUrl` against the attested requesting origin
+ * and returns its serialized form. The value must parse as an absolute URL,
+ * must not carry a fragment, and its origin must equal the attested origin;
+ * any violation throws (the query is malformed). All storage and comparison
+ * downstream uses the returned serialization, so spellings differing only in
+ * a default port, percent-encoding case, or dot-segments do not name distinct
+ * applications.
+ *
+ * The rule is the origin's, with no scheme constraint of its own: an `appUrl`
+ * under any scheme is accepted when its origin equals the attested one, which
+ * is what the App Connect spec asks. The one consequence of that is the
+ * opaque-origin refusal. A URL under a non-special scheme (`chrome-extension:`,
+ * `file:`, a custom scheme) has an opaque origin, which serializes as the
+ * string `"null"` and is same-origin only with itself, so two such strings
+ * being equal proves nothing; such an `appUrl` is refused as not same-origin
+ * rather than compared. The wallet-onboarding `host` validator is the
+ * mirror: it checks the scheme and no origin, since an exchange attests
+ * none.
+ *
+ * @param options {object}
+ * @param options.appUrl {string} - The request's `app.appUrl`.
+ * @param options.origin {string} - The attested requesting origin.
+ * @returns {string} The parsed URL's serialization.
+ */
+export function serializedAppUrl({ appUrl, origin }) {
+    const url = parsedAbsoluteUrl({
+        value: appUrl,
+        notAbsoluteMessage: `An AppConnectQuery "appUrl" must be an absolute URL (got "${appUrl}").`,
+        fragmentMessage: `An AppConnectQuery "appUrl" must not carry a fragment (got "${appUrl}").`
+    });
+    let attestedOrigin;
+    try {
+        attestedOrigin = new URL(origin).origin;
+    }
+    catch {
+        attestedOrigin = origin;
+    }
+    // An opaque origin serializes as the string "null" and is same-origin with
+    // nothing but itself, so an equal pair of "null" strings proves nothing.
+    if (url.origin === 'null' || url.origin !== attestedOrigin) {
+        throw new Error(`An AppConnectQuery "appUrl" must be same-origin with the requesting ` +
+            `origin "${origin}" (got "${appUrl}").`);
+    }
+    return url.href;
+}
+/**
+ * Extracts the App Connect request from a query set, when one is present. An
+ * `AppConnectQuery` is one mental model per popup: the request must not also
+ * carry `QueryByExample` or standalone zcap queries, at most one
+ * `AppConnectQuery` is allowed, and its `app` block must carry the display
+ * `name` and the `appUrl` the wallet needs to match or mint the app-key
+ * credential -- with the `appUrl` validated against the attested requesting
+ * origin and rewritten to its serialized form ({@link serializedAppUrl}).
+ * Violations throw; classification-time callers surface the throw as a
+ * malformed-request state. The capability queries are normalized to an array
+ * (absent means "no grants requested" -- a connect that only recovers the app
+ * key is legal), and each entry is rebuilt from an allowlist of the declared
+ * fields (`referenceId`, `allowedAction`, `invocationTarget`): the type-level
+ * Omit does not bind an actual request body, so any other wire-level field --
+ * a smuggled `reason`, an attacker-chosen `controller`, a future
+ * display-bearing addition -- is made unrepresentable here, before the entries
+ * reach the profile the consent screen and the delegation path read.
+ *
+ * @param options {object}
+ * @param options.queries {IVPRQuery[]}
+ * @param options.origin {string} - The attested requesting origin the
+ *   `appUrl` is validated against.
+ * @returns {IAppConnectRequest | null}
+ */
+export function appConnectRequestOf({ queries, origin }) {
+    const appConnectQuery = exclusiveQueryOf({
+        queries,
+        typeName: 'AppConnectQuery'
+    });
+    if (appConnectQuery === null) {
+        return null;
+    }
+    const { app, capabilityQuery } = appConnectQuery;
+    if (!app || typeof app.name !== 'string' || typeof app.appUrl !== 'string') {
+        throw new Error('An AppConnectQuery is missing its app name / appUrl.');
+    }
+    const appUrl = serializedAppUrl({ appUrl: app.appUrl, origin });
+    const rawQueries = capabilityQuery === undefined
+        ? []
+        : Array.isArray(capabilityQuery)
+            ? capabilityQuery
+            : [capabilityQuery];
+    const capabilityQueries = rawQueries.map(detail => {
+        if (!detail || typeof detail !== 'object') {
+            throw new Error('An AppConnectQuery carries a malformed capabilityQuery entry.');
+        }
+        const { referenceId, allowedAction, invocationTarget } = detail;
+        return {
+            ...(referenceId !== undefined && { referenceId }),
+            ...(allowedAction !== undefined && { allowedAction }),
+            invocationTarget
+        };
+    });
+    return { app: { name: app.name, appUrl }, capabilityQueries };
+}
+/**
+ * The longest self-declared agent name a request may carry, after trimming.
+ */
+export const AGENT_NAME_MAX_LENGTH = 64;
+/**
+ * Normalizes a self-declared agent name to the form the consent surface and
+ * the Login activity carry: trimmed, 1 to {@link AGENT_NAME_MAX_LENGTH}
+ * characters, with no control characters (C0 or C1, line breaks included).
+ * Any Unicode letter is fine -- names are not ASCII-only -- but a name that
+ * could spoof layout or sneak past a one-line render is refused. Both the
+ * requester side (`composeCapabilityRequest`) and the wallet side
+ * (`requestingAgentOf`) run this, so a name the requester could compose is
+ * one the wallet accepts.
+ *
+ * @param options {object}
+ * @param options.name {unknown}   the raw `agent.name` value
+ * @returns {string}   the trimmed name
+ */
+export function normalizeAgentName({ name }) {
+    if (typeof name !== 'string') {
+        throw new Error('A request\'s "agent.name" must be a string.');
+    }
+    const trimmed = name.trim();
+    if (trimmed.length === 0) {
+        throw new Error('A request\'s "agent.name" must not be empty.');
+    }
+    if (trimmed.length > AGENT_NAME_MAX_LENGTH) {
+        throw new Error(`A request's "agent.name" must be at most ${AGENT_NAME_MAX_LENGTH} ` +
+            `characters (got ${trimmed.length}).`);
+    }
+    if (/\p{Cc}/u.test(trimmed)) {
+        throw new Error('A request\'s "agent.name" must not contain control characters.');
+    }
+    return trimmed;
+}
+/**
+ * Reads the requester's self-declared identity off a VPR body, when present:
+ * the root `agent` member, whose `name` is validated and trimmed by
+ * {@link normalizeAgentName}. An absent member is fine (the wallet shows the
+ * grantee key alone); a present one that is not an object or whose name fails
+ * the limits is malformed and throws, so classification-time callers surface
+ * it as a malformed-request state rather than rendering an unbounded string.
+ *
+ * @param request {IVPRDetails}
+ * @returns {{ name: string } | undefined}
+ */
+export function requestingAgentOf(request) {
+    const { agent } = request;
+    if (agent === undefined) {
+        return undefined;
+    }
+    if (!agent || typeof agent !== 'object' || Array.isArray(agent)) {
+        throw new Error('A request\'s "agent" member must be an object.');
+    }
+    return { name: normalizeAgentName({ name: agent.name }) };
+}
+/**
+ * Classifies a VPR body onto the independent axes the consent screen and
+ * response assembly work from: whether DID Authentication is requested, and
+ * separately the credential (`QueryByExample`) and capability
+ * (`AuthorizationCapabilityQuery` / `ZcapQuery`) content asked for, plus the
+ * requester's self-declared `agent` name when the body carries one. Any
+ * combination is valid, including zcap-only.
+ *
+ * @param request {IVPRDetails}
+ * @returns {WalletRequestProfile}
+ */
+export function classifyRequest(request) {
+    const queries = queriesOf(request);
+    const agent = requestingAgentOf(request);
+    return {
+        didAuth: isDIDAuthRequested({ queries }),
+        vcQueries: queries.filter((query) => query.type === 'QueryByExample'),
+        zcapRequests: zcapQueriesOf(queries),
+        ...(agent !== undefined && { agent })
+    };
+}
+/**
+ * Whether a classified request is DID-Authentication *only*: it asks the wallet
+ * to prove control of its DID and nothing else (no credential queries, no
+ * capability requests). Derived from the profile so a popup's restore fast-path
+ * and its render both dispatch on the one predicate.
+ *
+ * @param profile {WalletRequestProfile}
+ * @returns {boolean}
+ */
+export function isDidAuthOnly(profile) {
+    return (profile.didAuth &&
+        profile.vcQueries.length === 0 &&
+        profile.zcapRequests.length === 0);
+}
+/**
+ * The DID methods a caller can present a holder for, by bare method name, as
+ * `acceptedMethods` states them (`key`, `web`, `webvh`). The default is the
+ * one every wallet holds: a session with no promoted account presents its
+ * did:key and nothing else.
+ */
+export const DEFAULT_PRESENTABLE_DID_METHODS = ['key'];
+/**
+ * Returns true if the caller can satisfy the DID method a `DIDAuthentication`
+ * query constrains to. `presentableMethods` names the bare DID method names
+ * this session can present a holder for; a request that omits
+ * `acceptedMethods` entirely, or lists it empty, imposes no constraint and is
+ * satisfiable whatever the session holds. A malformed `acceptedMethods` (not
+ * an array, or holding non-object entries) is read for the entries it does
+ * have rather than dereferenced blindly: an `acceptedMethods` that is not a
+ * list of constraints at all imposes none.
+ *
+ * @param queries {IVPRQuery[]}
+ * @param [presentableMethods] {readonly string[]}   default
+ *   {@link DEFAULT_PRESENTABLE_DID_METHODS}
+ * @returns {boolean}
+ */
+export function didAuthMethodSupported(queries, presentableMethods = DEFAULT_PRESENTABLE_DID_METHODS) {
+    const didAuth = queries.find(query => query.type === 'DIDAuthentication');
+    const acceptedMethods = didAuth?.acceptedMethods;
+    if (!Array.isArray(acceptedMethods) || acceptedMethods.length === 0) {
+        return true;
+    }
+    return acceptedMethods.some(entry => {
+        const method = asRecord(entry)?.method;
+        return typeof method === 'string' && presentableMethods.includes(method);
+    });
+}
+//# sourceMappingURL=classify.js.map

package/dist/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../src/classify.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EAClB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,CAAA;AAEtB,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AACjE,MAAM,gBAAgB,GAAG,sCAAsC,CAAA;AAE/D;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAoC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACzC,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACpE,OAAO,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,UAAiC;IAEjC,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,CAAA;IACzD,OAAO;QACL,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxD,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,CAAC,UAAU,CAAC;KACR,CAAA;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,IAAI,EAC0B;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,cAAc,GAClB,CAAC,CAAC,OAAO;QACT,CAAC,QAAQ,KAAK,wBAAwB;YACpC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACxC,sBAAsB,IAAI,OAAO,CAAC,CAAA;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAA+B,CAAA;IACxC,CAAC;IACD,IACE,OAAO;QACP,CAAC,QAAQ,KAAK,sBAAsB;YAClC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,oBAAoB,CAAC,IAA6B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gEACE,QAAQ,IAAI,WACd,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CACrC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAqC;IAErC,MAAM,EAAE,oBAAoB,EAAE,GAAG,YAAY,CAAA;IAC7C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACxC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,MAAM,6BAA6B,GACjC,KAAK,CAAC,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,CAAA;IAC7D,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,6BAA6B;QAC7B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,OAAO;QACL,sBAAsB,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EAGR;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAC5C,CAAA;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,KAAK,EAAsB,EAAE,CAC5B,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CACzD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAsB;IAEtB,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAA;IACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE;QACvE,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;QACrB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,MAAM,IAAI,gDAAgD,CAC3D,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,MAAM,EACN,MAAM,EAIP;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,KAAK,EAAE,MAAM;QACb,kBAAkB,EAAE,6DAA6D,MAAM,KAAK;QAC5F,eAAe,EAAE,+DAA+D,MAAM,KAAK;KAC5F,CAAC,CAAA;IACF,IAAI,cAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,GAAG,MAAM,CAAA;IACzB,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,WAAW,MAAM,WAAW,MAAM,KAAK,CAC1C,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EAIP;IACC,MAAM,eAAe,GAAG,gBAAgB,CAAC;QACvC,OAAO;QACP,QAAQ,EAAE,iBAAiB;KAC5B,CAAuC,CAAA;IACxC,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,eAAe,CAAA;IAChD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/D,MAAM,UAAU,GACd,eAAe,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAC9B,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IACzB,MAAM,iBAAiB,GAAiC,UAAU,CAAC,GAAG,CACpE,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAA;QACH,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAA;QAC/D,OAAO;YACL,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;YACjD,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,CAAC;YACrD,gBAAgB;SACjB,CAAA;IACH,CAAC,CACF,CAAA;IACD,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAA;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAqB;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,4CAA4C,qBAAqB,GAAG;YAClE,mBAAmB,OAAO,CAAC,MAAM,IAAI,CACxC,CAAA;IACH,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoB;IAEpB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,SAAS,EAAE,OAAO,CAAC,MAAM,CACvB,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CACrE;QACD,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC;QACpC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;KACtC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,OAAO,CACL,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAClC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,KAAK,CAAU,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAoB,EACpB,qBAAwC,+BAA+B;IAEvE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAE3D,CAAA;IACb,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;QACtC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;AACJ,CAAC"}