@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/lib/register.js

@@ -0,0 +1,390 @@
+/**
+ * The register logic behind `POST /v1/collections/register` (routes/v1/collections.ts) AND the
+ * `registerCollection` runtime export (../runtime.ts) — one interface, two callers. The route is
+ * UCAN-guarded HTTP; a provider's own Workflow calls this directly when it registers a collection
+ * as the oracle's own principal (after minting its own evaluate grant), where there is no request
+ * to validate a body against and no `c.env` to read bindings off.
+ *
+ * The four gates (WHO/HIRED/PROTOCOL/PAID), the delegation resolution, the upsert and the
+ * paused→active notice are unchanged from the route's original body — see routes/v1/collections.ts'
+ * header comment for the enrollment rules this enforces. `RegisterCtx` is what either caller can
+ * assemble: the route from its request-scoped Hono context, the runtime from `env` via
+ * `cronContext`-style plumbing (cron/scan.ts).
+ */
+import { and, asc, eq, inArray, isNotNull, sql } from "drizzle-orm";
+import { apiSources, watchedCollections } from "../db/schema.js";
+import { effectivePricing, evaluationFeeFor, getOracle } from "../oracle.js";
+import { notifyCollectionResumed } from "../workflows/steps.js";
+import { hasUnlinkedActiveSource, linkCompanySources } from "./api-lane/linked.js";
+import { createEngineClient } from "./engine/client.js";
+import { EngineError } from "./engine/types.js";
+import { AppError } from "./errors.js";
+import { queryEvaluateGrant } from "./ixo/authz.js";
+import { getCollection, getEntityOwner } from "./ixo/blocksync/index.js";
+import { resolveIssuerKeys } from "./ixo/delegation-verify.js";
+import { requireEvaluationPayment } from "./ixo/payment.js";
+import { verifyOwnerDelegation } from "./ixo/ucan.js";
+import { fetchOwnerDelegation } from "./ixo/ucan-store.js";
+import { companyOf, creditsCover, PayerUnavailable, resolvePayer, reviewBillingActive, } from "./payments/review-billing.js";
+/**
+ * The chain owner or the current enroller of a watched row — who may redirect its notices
+ * (re-register, below) and pause or resume it (routes/v1/shared.ts `assertCanManage`). A plain grant
+ * holder is neither: a competing oracle hired on the same collection holds a grant by definition.
+ */
+export function isOwnerOrEnroller(row, did) {
+    return did === row.ownerDid || did === row.enrolledByDid;
+}
+/**
+ * Register (or re-register) a collection with this oracle — the four gates, the delegation
+ * resolution, the upsert and the paused→active notice, in that order. See
+ * routes/v1/collections.ts for the WHO/HIRED/PROTOCOL/PAID rules this enforces; behaviour here is
+ * byte-for-byte what the route did before this function existed.
+ */
+export async function registerCollection(ctx, input) {
+    const { config, trace, logger, metrics, db, env } = ctx;
+    const { collectionId, principal, delegationCar, contactEmail, cursor } = input;
+    // Confirm the collection actually exists on-chain (clean 404 rather than watching a typo). Its
+    // `entity` resolves the owner, its `admin` is the grant's granter, its `payments` the fee.
+    const collection = await getCollection({ config, trace }, collectionId);
+    if (!collection) {
+        throw refusal("NOT_FOUND", "collection_not_found", `Collection ${collectionId} not found on-chain`);
+    }
+    // The chain owner — the wallet that created the deed entity — pays the evaluation fees and is
+    // the delegation root the pull path reads. Resolved ALWAYS (a grant holder registering on the
+    // owner's behalf must never become that root), and it is the chain's answer, not the caller's.
+    if (!collection.entity) {
+        throw refusal("FORBIDDEN", "owner_unresolvable", `Collection ${collectionId} has no entity on-chain — its owner cannot be resolved`);
+    }
+    const ownerAddress = await getEntityOwner({ config, trace }, collection.entity);
+    if (!ownerAddress) {
+        throw refusal("FORBIDDEN", "owner_unresolvable", `Entity ${collection.entity} not found on-chain — its owner cannot be resolved`);
+    }
+    const ownerDid = `did:ixo:${ownerAddress}`;
+    // 1 · WHO. The UNCACHED grant read on purpose: the portal grants and registers in one flow, and
+    // `hasEvaluateGrant` would pin a negative for 5 minutes — a refusal that outlives the grant it
+    // contradicts. Register is rare; freshness is what matters here. No admin ⇒ no grant can exist.
+    const holdsGrant = (address) => collection.admin
+        ? queryEvaluateGrant(config, collection.admin, address, collectionId)
+        : Promise.resolve(false);
+    const callerIsOwner = principal.address === ownerAddress;
+    const callerIsOracle = principal.address === config.ORACLE_ADDRESS;
+    // The owner needs no grant. The oracle's OWN wallet always takes the read: its answer is also
+    // the hired check below, so the two gates collapse into one chain read for it.
+    const callerHolds = callerIsOwner && !callerIsOracle ? true : await holdsGrant(principal.address);
+    if (!callerIsOwner && !callerHolds) {
+        throw refusal("FORBIDDEN", "not_owner_or_grantee", `Only the owner of collection ${collectionId} or a holder of an active EvaluateClaimAuthorization for it may register it`);
+    }
+    // 2 · HIRED. Without this grant the oracle can never sign `MsgEvaluateClaim` — a watched row
+    // would only ever produce decisions the chain refuses.
+    const hired = callerIsOracle ? callerHolds : await holdsGrant(config.ORACLE_ADDRESS);
+    if (!hired) {
+        throw refusal("CONFLICT", "not_hired", `Grant EvaluateClaimAuthorization to ${config.ORACLE_ADDRESS} first`);
+    }
+    // 3 · PROTOCOL. Reuses `collection.protocol` resolved above — no second chain/Blocksync fetch.
+    // Empty `supportedProtocols` ⇒ no restriction (today's unconfigured default: evaluate whatever
+    // passes the money/grant gates, whatever protocol it's for). Checked before PAID: a
+    // wrong-protocol collection should
+    // hear "this oracle won't serve you" first, not be sent off to fix a payment that would never
+    // have mattered.
+    const { supportedProtocols, pricing } = getOracle().config;
+    if (supportedProtocols.length > 0 && !supportedProtocols.includes(collection.protocol ?? "")) {
+        throw refusal("CONFLICT", "unsupported_protocol", `This oracle does not support protocol ${collection.protocol ?? "(none)"} — supported: ${supportedProtocols.join(", ")}`);
+    }
+    // 4 · PAID. On EVERY (re-)register and before anything is written: a collection whose admin
+    // zeroed or re-denominated `Payments.evaluation` since the last register must not keep being
+    // evaluated for free. Live off blocksync, never a stored copy. `pricing.byProtocol` lets a
+    // specific protocol override the default fee (e.g. `minAmount: "0"` for a protocol whose income
+    // isn't the evaluation split) — resolved by the collection's own protocol first, falling back to
+    // `pricing.evaluation` for everything else.
+    // `effectivePricing`: the per-network EVALUATION_DENOM / EVALUATION_MIN_AMOUNT vars, when set,
+    // replace `pricing.evaluation` (config.ts; required on mainnet, so it is never a stand-in coin).
+    // The escrow gate below charges by it; per-review billing charges the published `pricing.api`.
+    const fee = evaluationFeeFor(effectivePricing(pricing, config), collection.protocol ?? "");
+    // Per-review billing (active by IXO's plan for the oracle, owner 2026-10-14): a collection whose company
+    // holds a live review-billing delegation is paid per review over x402 from the owner's credits —
+    // its evaluation leg may be empty (never escrowed, never billed twice). Who pays comes from the
+    // ENGINE's company answer: its blip or a `disputed` company is a 503 to retry, never a guess. With
+    // a payer, the register fails unless its credits cover one review now (402
+    // `insufficient_credits`); with none, the escrow gate stands — and a collection it refuses hears
+    // both ways in (402 `no_review_billing`).
+    const perReview = await reviewBillingActive({ config, trace, logger, cache: env.CACHE_KV });
+    const company = perReview
+        ? await companyOf({ config, trace, logger, cache: env.CACHE_KV }, collectionId)
+        : undefined;
+    let billingSourceId = null;
+    let evaluation;
+    if (company !== undefined) {
+        const billingDeps = { config, trace, logger, cache: env.CACHE_KV, db };
+        const payer = await resolvePayer(billingDeps, company, collection.protocol ?? "");
+        if (!payer.ok && payer.why === "disputed") {
+            throw new PayerUnavailable("company_unavailable", `The decision engine names no single organisation for collection ${collectionId} (disputed), so who pays for its reviews is unknown; retry once it is settled.`);
+        }
+        if (payer.ok) {
+            if (!(await creditsCover(billingDeps, payer))) {
+                throw refusal("PAYMENT_REQUIRED", "insufficient_credits", `The organisation's credits do not cover one review (${payer.price.amount} upay). Top them up in the Decision Console, then register again.`, { price: payer.price, ...fundingUrl(config) });
+            }
+            billingSourceId = payer.source.sourceId;
+            // What the leg offers in the fee's denom (usually nothing): recorded, never required.
+            evaluation = requireEvaluationPayment({ denom: fee.denom, minAmount: "0" }, collection.payments);
+        }
+        else {
+            try {
+                evaluation = requireEvaluationPayment(fee, collection.payments);
+            }
+            catch (err) {
+                if (!(err instanceof AppError) || err.code !== "PAYMENT_REQUIRED")
+                    throw err;
+                logger.info("register.no-review-billing", { collectionId, detail: payer.detail });
+                throw refusal("PAYMENT_REQUIRED", "no_review_billing", `${err.message}. Or have the organisation's owner set up review billing on its Decision API source in the Decision Console (per-review billing from its credits), then register again.`, { ...err.details, ...fundingUrl(config) });
+            }
+        }
+    }
+    else {
+        evaluation = requireEvaluationPayment(fee, collection.payments);
+    }
+    // Read BEFORE the upsert — the only way to tell "just registered a paused collection back to
+    // active" from "registered an already-active one again" (a notice fires only on a REAL
+    // paused→active flip), and who may change what on a re-register (below).
+    const prior = await db.query.watchedCollections.findFirst({
+        where: (t, { eq: eqOp }) => eqOp(t.collectionId, collectionId),
+        columns: { status: true, enrolledByDid: true, contactEmail: true },
+    });
+    // Any grant holder passes gate 1, and a competing oracle hired on the same collection holds a
+    // grant by definition. So on a RE-register only the chain owner or the current enroller may
+    // redirect the notices (`contactEmail`, and `enrolledByDid` — who may change it next) or lift a
+    // pause (an owner's, an operator's, `rubric-unusable`, `admin-unfunded`): were the enroller to
+    // move with every re-register, a stranger would become it on the first and redirect the notices
+    // on the second. Anyone else's re-register still refreshes the fee and delegation columns and
+    // leaves the enroller alone; asking for either change is a plain 403, never a silent ignore. A
+    // first registration sets both freely — that is the portal flow, and there is nothing to redirect.
+    // A non-owner enroller keeps these rights only while it still holds a live grant: here that is
+    // already proven, since gate 1 above refused any non-owner without one (uncached).
+    const mayChangeContact = !prior ||
+        callerIsOwner ||
+        isOwnerOrEnroller({ ownerDid, enrolledByDid: prior.enrolledByDid }, principal.did);
+    if (prior && !mayChangeContact) {
+        if (contactEmail !== undefined && (contactEmail || null) !== prior.contactEmail) {
+            throw refusal("FORBIDDEN", "contact_change_forbidden", `Only the owner of collection ${collectionId} or whoever registered it may change its contact email`);
+        }
+        if (prior.status === "paused") {
+            throw refusal("FORBIDDEN", "resume_forbidden", `Collection ${collectionId} is paused — only its owner or whoever registered it may resume it`);
+        }
+    }
+    // The collection's COMPANY, as the engine derives it — asked ONCE and serving two things: with no
+    // contact sent and none on the row, the contact of the company's own Decision API source (so the
+    // chain-lane notices — pause / resume, `admin-unfunded`, review requests — reach someone), and
+    // the company links below. Asked only when one of them could use it: an explicit or stored
+    // contact is never touched, and a link is possible only while an active source is not yet linked.
+    const wantContact = contactEmail === undefined && !prior?.contactEmail;
+    // Per-review billing already asked (above): the same answer, never a second read.
+    const companyRead = company !== undefined
+        ? company
+        : wantContact || (await hasUnlinkedActiveSource(db, collectionId))
+            ? await readCompany(ctx, collectionId)
+            : undefined;
+    const orgContact = wantContact && companyRead ? await companyContact(db, companyRead) : null;
+    // Resolve the delegation to persist. A CAR in the body must PROVE it belongs here: issued by the
+    // OWNER (the delegation root — never the enroller), addressed to this oracle, scoped to the claim
+    // bot, unexpired — else 400. Without one we try the owner's store inbox (deposited moments ago in
+    // the same portal flow); a miss is non-fatal — registration stands, and the pull path refreshes
+    // from the store on demand, failing closed with a clear re-register error if nothing is ever
+    // deposited (lib/ixo/index.ts).
+    let stored = null;
+    if (delegationCar) {
+        stored = await verifyOwnerDelegation(config, delegationCar, ownerDid, () => resolveIssuerKeys(config, ownerDid, trace));
+    }
+    else {
+        const found = await fetchOwnerDelegation({ config, trace, cache: env.CACHE_KV, logger }, ownerDid).catch(() => null);
+        if (found) {
+            stored = {
+                car: found.car,
+                expiresAt: found.expiresAt ? new Date(found.expiresAt * 1000) : null,
+            };
+        }
+        else {
+            logger.warn("collection.registered-without-delegation", { collectionId, ownerDid });
+        }
+    }
+    // NB: `rubricId` is deliberately NOT written here — the pin may only come from a VERIFIED
+    // resolution, which is the workflow's evaluate step (claim-ingest.ts), never the register.
+    const watched = {
+        ownerDid,
+        // Moves only with a caller who may change the contact (above); a first insert always sets it.
+        ...(mayChangeContact ? { enrolledByDid: principal.did } : {}),
+        protocolDid: collection.protocol ?? null,
+        // What the collection pays per evaluation, as just verified — the dashboard shows it.
+        evaluationDenom: evaluation.denom,
+        evaluationAmount: evaluation.amount,
+        // Who pays per review (null: the evaluation leg does) — decided by every register afresh.
+        billingSourceId,
+        // Only written when the caller sent the field; a sent empty string clears it.
+        ...(contactEmail !== undefined ? { contactEmail: contactEmail || null } : {}),
+        // …or, with nothing sent and nothing stored, the org source's contact (above).
+        ...(orgContact ? { contactEmail: orgContact } : {}),
+        // Only touch the delegation columns when we actually have one — never clobber a stored CAR.
+        ...(stored ? { delegationCar: stored.car, delegationExpiresAt: stored.expiresAt } : {}),
+    };
+    // Cursor seeded on FIRST registration only (it's not in the conflict `set`, so a re-register can
+    // never rewind one the cron has advanced): absent ⇒ "now" (today's behaviour — a NULL cursor
+    // scans the collection from claim zero, blocksync CLAIMS_FROM_START, judging every claim that
+    // predates the hire); `null` explicitly ⇒ that same claim-zero scan; a caller-supplied string ⇒
+    // that watermark verbatim. The first real page rewrites it in blocksync's own timestamp format.
+    const seedCursor = cursor === undefined ? new Date().toISOString() : cursor;
+    // `status` / `pausedReason` are never in the conflict `set`: the `prior` read above is a snapshot,
+    // and the network steps since (the delegation, the store) leave a window in which an owner's
+    // `/pause`, `admin-unfunded`, `rubric-unusable` or `engine-credits` can land — a blanket
+    // `status: "active"` here would wipe it, for any grant holder looping re-register.
+    let [row] = await db
+        .insert(watchedCollections)
+        .values({ collectionId, cursor: seedCursor, enrolledByDid: principal.did, ...watched })
+        .onConflictDoUpdate({ target: watchedCollections.collectionId, set: watched })
+        .returning();
+    if (!row)
+        throw AppError.internal("Register upsert returned no row");
+    // Re-registering is the "change my mind" path: the owner's or the enroller's also resumes a
+    // paused collection (anyone else's never does) — a fresh register that passed the gates is the
+    // clearest "resume" there is (and, having just re-proven the oracle's grant, clears an engine
+    // `no-grant` pause; a credits pause is the operator's to lift, but resuming one collection early
+    // costs one retried claim, no more). Decided by the row AS IT IS NOW, in the one statement: a
+    // returned row is a REAL paused→active flip, which is what the notice below needs.
+    let resumed = false;
+    if (prior && mayChangeContact) {
+        const [flipped] = await db
+            .update(watchedCollections)
+            .set({ status: "active", pausedReason: null })
+            .where(and(eq(watchedCollections.collectionId, collectionId), eq(watchedCollections.status, "paused")))
+            .returning();
+        if (flipped) {
+            row = flipped;
+            resumed = true;
+        }
+    }
+    // Link the collection to its company's active sources, so the org's reviewers see its chain
+    // claims in the console without a member linking it by hand (lib/api-lane/linked.ts). Only the
+    // engine's `ok` links; idempotent, so a re-register adds only what is missing.
+    const linkedSources = companyRead && collection.protocol
+        ? await linkCompanySources(db, collectionId, collection.protocol, companyRead)
+        : [];
+    metrics.count("collection.registered");
+    logger.info("collection.registered", {
+        collectionId,
+        ownerDid,
+        enrolledByDid: row.enrolledByDid,
+        registeredByDid: principal.did,
+        evaluation,
+        delegationStored: !!stored,
+        reviewBilling: billingSourceId !== null,
+        contactFromOrgSource: !!orgContact,
+        linkedSources: linkedSources.length,
+    });
+    // A notice fires only on a REAL recovery (above). Fail-soft: a notice failure must never fail
+    // the register response.
+    if (resumed) {
+        await notifyCollectionResumed(db, { logger, metrics, config, trace, cache: env.CACHE_KV, email: env.EMAIL }, collectionId).catch((err) => logger.warn("collection.notice.failed", { collectionId, detail: String(err) }));
+    }
+    return row;
+}
+/**
+ * A register refusal with its stable machine code (`details.reason`), so a caller never matches a
+ * message: `collection_not_found` · `owner_unresolvable` · `not_owner_or_grantee` · `not_hired` ·
+ * `unsupported_protocol` · `evaluation_underpaid` (lib/ixo/payment.ts) · `no_review_billing` ·
+ * `insufficient_credits` · `contact_change_forbidden` · `resume_forbidden`, and the 503s
+ * `company_unavailable` / `credits_unavailable` (payments/review-billing.ts `PayerUnavailable`).
+ */
+function refusal(code, reason, message, details = {}) {
+    return new AppError(message, { code, details: { ...details, reason } });
+}
+/** Where a payer tops up: the Console's credits page. */
+const fundingUrl = (config) => config.CONSOLE_URL ? { fundingUrl: `${config.CONSOLE_URL}/credits` } : {};
+/**
+ * The collection's company, as the ENGINE derives it (contract "Company authority" → "Read it"):
+ * on a poster's deed it is the org linked to the deed both ways, not `collection.entity`, and only
+ * the engine resolves that. Null for a collection the engine does not know (404). `undefined` for
+ * any other engine trouble (its 503 while Blocksync is down, the network, a refusal) — never a
+ * failed hire: nothing is filled or linked, and a later register (or the backfill) does it.
+ */
+async function readCompany(ctx, collectionId) {
+    const { config, trace, logger, env } = ctx;
+    try {
+        return await createEngineClient({
+            config,
+            trace,
+            logger,
+            cache: env.CACHE_KV,
+        }).getCollectionCompany(collectionId);
+    }
+    catch (err) {
+        const { status, code } = err instanceof AppError || err instanceof EngineError ? err : {};
+        logger.warn("register.company-unavailable", { collectionId, status, code });
+        return undefined;
+    }
+}
+/**
+ * The contact of the company's oldest active Decision API source. A `disputed` company has none.
+ * Oldest activation wins, so a re-run picks the same source; none (or API_LANE off — the table is
+ * empty) leaves it empty.
+ */
+async function companyContact(db, company) {
+    if (company.state !== "ok")
+        return null;
+    const [source] = await db
+        .select({ contactEmail: apiSources.contactEmail })
+        .from(apiSources)
+        .where(and(eq(apiSources.companyEntityDid, company.entityDid), eq(apiSources.status, "active"), isNotNull(apiSources.contactEmail)))
+        .orderBy(asc(sql `coalesce(${apiSources.activatedAt}, ${apiSources.createdAt})`), asc(apiSources.sourceId))
+        .limit(1);
+    return source?.contactEmail || null;
+}
+/** Collections one backfill call visits when it names none. */
+export const RELINK_CAP = 100;
+/**
+ * The backfill of register's company links for collections watched before it linked them
+ * (`POST /v1/admin/collections/relink`): per collection, the SAME engine read and the SAME
+ * `linkCompanySources` register runs, so a re-run is a no-op. `collectionIds` names them (an id
+ * this oracle does not watch is `not-watched`); absent ⇒ every watched collection, lowest id first,
+ * up to `RELINK_CAP` (`truncated` says more exist — name them). A collection with no unlinked
+ * active source is `unchanged` without an engine call.
+ */
+export async function relinkCollections(ctx, collectionIds) {
+    const { db } = ctx;
+    const rows = await db
+        .select({
+        collectionId: watchedCollections.collectionId,
+        protocolDid: watchedCollections.protocolDid,
+    })
+        .from(watchedCollections)
+        .where(collectionIds ? inArray(watchedCollections.collectionId, collectionIds) : undefined)
+        .orderBy(asc(watchedCollections.collectionId))
+        .limit(collectionIds ? collectionIds.length : RELINK_CAP + 1);
+    const truncated = !collectionIds && rows.length > RELINK_CAP;
+    const watched = new Map(rows.slice(0, RELINK_CAP).map((r) => [r.collectionId, r.protocolDid]));
+    const items = [];
+    for (const collectionId of collectionIds ?? [...watched.keys()]) {
+        const protocolDid = watched.get(collectionId);
+        const item = (outcome, linkedSources = []) => items.push({ collectionId, outcome, linkedSources });
+        if (protocolDid === undefined)
+            item("not-watched");
+        else if (!protocolDid || !(await hasUnlinkedActiveSource(db, collectionId)))
+            item("unchanged");
+        else {
+            const company = await readCompany(ctx, collectionId);
+            if (company === undefined)
+                item("unavailable");
+            else if (company === null)
+                item("no-company");
+            else if (company.state !== "ok")
+                item("disputed");
+            else {
+                const linked = await linkCompanySources(db, collectionId, protocolDid, company);
+                item(linked.length > 0 ? "linked" : "unchanged", linked);
+            }
+        }
+    }
+    ctx.logger.info("collection.relinked", {
+        visited: items.length,
+        linked: items.filter((i) => i.outcome === "linked").length,
+        truncated,
+    });
+    return { items, truncated };
+}
+//# sourceMappingURL=register.js.map

package/dist/lib/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/lib/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,EAAE,UAAU,EAA0B,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEtF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAA0B,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAkB,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGxD,OAAO,EACL,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAGnC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA0D,EAC1D,GAAW;IAEX,OAAO,GAAG,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,KAAK,GAAG,CAAC,aAAa,CAAC;AAC3D,CAAC;AA0BD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAgB,EAChB,KAAoB;IAEpB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IACxD,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAE/E,+FAA+F;IAC/F,2FAA2F;IAC3F,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,YAAY,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,CACX,WAAW,EACX,sBAAsB,EACtB,cAAc,YAAY,qBAAqB,CAChD,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,8FAA8F;IAC9F,+FAA+F;IAC/F,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,CACX,WAAW,EACX,oBAAoB,EACpB,cAAc,YAAY,wDAAwD,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAChF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,OAAO,CACX,WAAW,EACX,oBAAoB,EACpB,UAAU,UAAU,CAAC,MAAM,oDAAoD,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,YAAY,EAAE,CAAC;IAE3C,gGAAgG;IAChG,+FAA+F;IAC/F,gGAAgG;IAChG,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE,CACrC,UAAU,CAAC,KAAK;QACd,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,KAAK,YAAY,CAAC;IACzD,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,KAAK,MAAM,CAAC,cAAc,CAAC;IACnE,8FAA8F;IAC9F,+EAA+E;IAC/E,MAAM,WAAW,GAAG,aAAa,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAClG,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,OAAO,CACX,WAAW,EACX,sBAAsB,EACtB,gCAAgC,YAAY,6EAA6E,CAC1H,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,uDAAuD;IACvD,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,OAAO,CACX,UAAU,EACV,WAAW,EACX,uCAAuC,MAAM,CAAC,cAAc,QAAQ,CACrE,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,+FAA+F;IAC/F,oFAAoF;IACpF,mCAAmC;IACnC,8FAA8F;IAC9F,iBAAiB;IACjB,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC;IAC3D,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7F,MAAM,OAAO,CACX,UAAU,EACV,sBAAsB,EACtB,yCAAyC,UAAU,CAAC,QAAQ,IAAI,QAAQ,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzH,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,gGAAgG;IAChG,iGAAiG;IACjG,4CAA4C;IAC5C,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,MAAM,GAAG,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC3F,yGAAyG;IACzG,iGAAiG;IACjG,gGAAgG;IAChG,mGAAmG;IACnG,2EAA2E;IAC3E,iGAAiG;IACjG,0CAA0C;IAC1C,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC;QAC/E,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,UAA6C,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,gBAAgB,CACxB,qBAAqB,EACrB,mEAAmE,YAAY,gFAAgF,CAChK,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC9C,MAAM,OAAO,CACX,kBAAkB,EAClB,sBAAsB,EACtB,uDAAuD,KAAK,CAAC,KAAK,CAAC,MAAM,mEAAmE,EAC5I,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAC9C,CAAC;YACJ,CAAC;YACD,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;YACxC,sFAAsF;YACtF,UAAU,GAAG,wBAAwB,CACnC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EACpC,UAAU,CAAC,QAAQ,CACpB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,UAAU,GAAG,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;oBAAE,MAAM,GAAG,CAAC;gBAC7E,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClF,MAAM,OAAO,CACX,kBAAkB,EAClB,mBAAmB,EACnB,GAAG,GAAG,CAAC,OAAO,yKAAyK,EACvL,EAAE,GAAI,GAAG,CAAC,OAAkB,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CACtD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;IAED,6FAA6F;IAC7F,uFAAuF;IACvF,yEAAyE;IACzE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC;QACxD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC;QAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;KACnE,CAAC,CAAC;IACH,8FAA8F;IAC9F,4FAA4F;IAC5F,gGAAgG;IAChG,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,+FAA+F;IAC/F,mGAAmG;IACnG,+FAA+F;IAC/F,mFAAmF;IACnF,MAAM,gBAAgB,GACpB,CAAC,KAAK;QACN,aAAa;QACb,iBAAiB,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/B,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAChF,MAAM,OAAO,CACX,WAAW,EACX,0BAA0B,EAC1B,gCAAgC,YAAY,wDAAwD,CACrG,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,CACX,WAAW,EACX,kBAAkB,EAClB,cAAc,YAAY,oEAAoE,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,2FAA2F;IAC3F,kGAAkG;IAClG,MAAM,WAAW,GAAG,YAAY,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC;IACvE,kFAAkF;IAClF,MAAM,WAAW,GACf,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,uBAAuB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YAChE,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC;YACtC,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,UAAU,GAAG,WAAW,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7F,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,gGAAgG;IAChG,6FAA6F;IAC7F,gCAAgC;IAChC,IAAI,MAAM,GAAmD,IAAI,CAAC;IAClE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CACzE,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAC3C,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,EAC9C,QAAQ,CACT,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG;gBACP,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;aACrE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,2FAA2F;IAC3F,MAAM,OAAO,GAAG;QACd,QAAQ;QACR,8FAA8F;QAC9F,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,WAAW,EAAE,UAAU,CAAC,QAAQ,IAAI,IAAI;QACxC,sFAAsF;QACtF,eAAe,EAAE,UAAU,CAAC,KAAK;QACjC,gBAAgB,EAAE,UAAU,CAAC,MAAM;QACnC,0FAA0F;QAC1F,eAAe;QACf,8EAA8E;QAC9E,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,+EAA+E;QAC/E,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,4FAA4F;QAC5F,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxF,CAAC;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,mGAAmG;IACnG,6FAA6F;IAC7F,yFAAyF;IACzF,mFAAmF;IACnF,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACjB,MAAM,CAAC,kBAAkB,CAAC;SAC1B,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;SACtF,kBAAkB,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SAC7E,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,GAAG;QAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;IAErE,4FAA4F;IAC5F,+FAA+F;IAC/F,8FAA8F;IAC9F,iGAAiG;IACjG,8FAA8F;IAC9F,mFAAmF;IACnF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,IAAI,gBAAgB,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;aAC7C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,YAAY,EAAE,YAAY,CAAC,EACjD,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACxC,CACF;aACA,SAAS,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,GAAG,OAAO,CAAC;YACd,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,+FAA+F;IAC/F,+EAA+E;IAC/E,MAAM,aAAa,GACjB,WAAW,IAAI,UAAU,CAAC,QAAQ;QAChC,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC9E,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;QACnC,YAAY;QACZ,QAAQ;QACR,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,eAAe,EAAE,SAAS,CAAC,GAAG;QAC9B,UAAU;QACV,gBAAgB,EAAE,CAAC,CAAC,MAAM;QAC1B,aAAa,EAAE,eAAe,KAAK,IAAI;QACvC,oBAAoB,EAAE,CAAC,CAAC,UAAU;QAClC,aAAa,EAAE,aAAa,CAAC,MAAM;KACpC,CAAC,CAAC;IAEH,8FAA8F;IAC9F,yBAAyB;IACzB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,uBAAuB,CAC3B,EAAE,EACF,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EACzE,YAAY,CACb,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACd,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CACd,IAAe,EACf,MAAc,EACd,OAAe,EACf,OAAO,GAA4B,EAAE;IAErC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,GAAG,CAAC,MAAmC,EAAE,EAAE,CACzD,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAO5E;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CACxB,GAAe,EACf,YAAoB;IAEpB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,kBAAkB,CAAC;YAC9B,MAAM;YACN,KAAK;YACL,MAAM;YACN,KAAK,EAAE,GAAG,CAAC,QAAQ;SACpB,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,YAAY,QAAQ,IAAI,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,EAAY,EAAE,OAA0B;IACpE,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;SACjD,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,EAClD,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC/B,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CACnC,CACF;SACA,OAAO,CACN,GAAG,CAAC,GAAG,CAAA,YAAY,UAAU,CAAC,WAAW,KAAK,UAAU,CAAC,SAAS,GAAG,CAAC,EACtE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CACzB;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC;AAU9B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAkC,EAClC,aAAwB;IAKxB,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,YAAY,EAAE,kBAAkB,CAAC,YAAY;QAC7C,WAAW,EAAE,kBAAkB,CAAC,WAAW;KAC5C,CAAC;SACD,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAC1F,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;SAC7C,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/F,MAAM,KAAK,GAAgF,EAAE,CAAC;IAC9F,KAAK,MAAM,YAAY,IAAI,aAAa,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,CAAC,OAAsB,EAAE,aAAa,GAAa,EAAE,EAAE,EAAE,CACpE,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QACvD,IAAI,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,CAAC,CAAC;aAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,uBAAuB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YAAE,IAAI,CAAC,WAAW,CAAC,CAAC;aAC1F,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACrD,IAAI,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,aAAa,CAAC,CAAC;iBAC1C,IAAI,OAAO,KAAK,IAAI;gBAAE,IAAI,CAAC,YAAY,CAAC,CAAC;iBACzC,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;gBAAE,IAAI,CAAC,UAAU,CAAC,CAAC;iBAC7C,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;gBAChF,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;QACrC,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAM;QAC1D,SAAS;KACV,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC"}

package/dist/lib/review/attestation.d.ts

@@ -0,0 +1,92 @@
+/**
+ * The reviewer's signed review attestation (design §B.3) — a small Verifiable Credential the
+ * REVIEWER issues with their own Ed25519 key (the same PIN-unlocked key their UCAN invocations are
+ * signed with), saying in their own name: "I, <did>, answered claim <claimId> at oracle
+ * <oracleDid> against evaluation <resultDigest> with these answers."
+ *
+ * A DELIBERATE MIRROR of the engine's `src/lib/receipt/attestation.ts`. There is no shared package
+ * between this kit and the engine — same posture as the rubric format — so the two copies are kept
+ * in lock-step by hand, and BOTH verify: the kit because it is the only party that sees the
+ * reviewer's UCAN invocation, the engine because it trusts nothing this kit asserts about the
+ * reviewer (§B.5). A change here needs the matching change there.
+ *
+ * Fail closed, at the first miss: every refusal carries its own code and nothing half-verified ever
+ * passes. The keys come from the SAME composite DID resolver `middleware/ucan-auth.ts` authenticates
+ * with, so an attestation can never verify against a key the UCAN layer would have rejected.
+ */
+import { z } from "zod";
+import type { Config } from "../../config.js";
+/**
+ * The attestation's JSON-LD context — a fixed CONSTANT on the namespace IXO operates, not a
+ * per-oracle URL: the same statement signed by two reviewers at two oracles must be the same
+ * vocabulary. Published as content in `ixofoundation/ns`; this kit never serves or resolves it.
+ */
+export declare const REVIEW_ATTESTATION_CONTEXT = "https://w3id.org/ixo/credentials/review-attestation/v1";
+/** The compact JWS protected header. `kid` is the `did:key` FORM of the signing key (§B.2) — not a
+ *  DID-document fragment — so the verifier's job is exactly one assertion: the chain publishes it. */
+export declare const ReviewAttestationHeaderSchema: z.ZodObject<{
+    alg: z.ZodLiteral<"EdDSA">;
+    typ: z.ZodLiteral<"vc+jwt">;
+    cty: z.ZodLiteral<"vc">;
+    kid: z.ZodString;
+}, z.core.$strict>;
+export declare const ReviewAttestationSchema: z.ZodObject<{
+    "@context": z.ZodTuple<[z.ZodLiteral<"https://www.w3.org/ns/credentials/v2">, z.ZodString], null>;
+    id: z.ZodString;
+    type: z.ZodTuple<[z.ZodLiteral<"VerifiableCredential">, z.ZodLiteral<"ClaimReviewAttestation">], null>;
+    issuer: z.ZodString;
+    validFrom: z.ZodISODateTime;
+    credentialSubject: z.ZodObject<{
+        id: z.ZodString;
+        claimId: z.ZodString;
+        oracleDid: z.ZodString;
+        answeredAgainst: z.ZodString;
+        answers: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ReviewAttestation = z.infer<typeof ReviewAttestationSchema>;
+/** The five refusal codes, identical on the engine (docs/ENGINE-CONTRACT.md "Human review"). */
+export type AttestationErrorCode = "ATTESTATION_INVALID" | "ATTESTATION_KEY_UNKNOWN" | "ATTESTATION_ISSUER_MISMATCH" | "ATTESTATION_MISMATCH" | "ATTESTATION_UNRESOLVABLE";
+/** What the attestation must be bound to for this request — the replay bindings of §B.5. */
+export interface ExpectedAttestation {
+    /** The authenticated reviewer: `principal.did`, never anything the body carries. */
+    issuer: string;
+    /** This oracle's own did:web — the UCAN audience the reviewer addressed. */
+    oracleDid: string;
+    claimId: string;
+    /** The `resultDigest` of the `pending_review` decision being answered. */
+    answeredAgainst: string;
+    answers: Record<string, boolean | string>;
+}
+export type VerifyAttestationResult = 
+/** `kid`: the did:key that signed — on the issuer's document (an API-lane root's self-grant must
+ *  be signed by it too, lib/review/reviewer-grant.ts `parseSelfReviewGrant`). */
+{
+    ok: true;
+    attestation: ReviewAttestation;
+    cid: string;
+    kid: string;
+} | {
+    ok: false;
+    code: AttestationErrorCode;
+    failures: string[];
+};
+export declare const b64urlToText: (part: string) => string;
+/** The raw 32-byte Ed25519 key inside a `did:key`, or null if it is not one (§B.4 step 2). */
+export declare function ed25519KeyOf(kid: string): Uint8Array | null;
+/**
+ * Does the compact JWS's signature verify under the raw Ed25519 key? A malformed JWS or key does
+ * not. Shared with the Decision API's reviewer-key proof (`routes/v1/api/members.ts`), whose
+ * payload is not an attestation but whose signature is checked the same way.
+ */
+export declare function ed25519JwsVerifies(publicKeyRaw: Uint8Array, jws: string): Promise<boolean>;
+/**
+ * Verify one attestation against what this request binds it to. Order is the fail-closed order of
+ * §B.5 — shape, then the issuer we already know, then key, then signature, then the remaining
+ * bindings — so a refusal always names the FIRST thing that is wrong rather than the most
+ * convenient one, and a refusal we can make with no network costs no network.
+ */
+export declare function verifyReviewAttestation(deps: {
+    config: Config;
+}, jws: string, expected: ExpectedAttestation): Promise<VerifyAttestationResult>;
+//# sourceMappingURL=attestation.d.ts.map

package/dist/lib/review/attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../../../src/lib/review/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,2DAA2D,CAAC;AAEnG;sGACsG;AACtG,eAAO,MAAM,6BAA6B;;;;;kBAKxC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;kBAkBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,gGAAgG;AAChG,MAAM,MAAM,oBAAoB,GAC5B,qBAAqB,GACrB,yBAAyB,GACzB,6BAA6B,GAC7B,sBAAsB,GACtB,0BAA0B,CAAC;AAE/B,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,uBAAuB;AACjC;iFACiF;AAC/E;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,iBAAiB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAmFlE,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,MAAuD,CAAC;AAEpG,8FAA8F;AAC9F,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAS3D;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBhG;AAaD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACxB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAsFlC"}