@oneshot-agent/sdk 0.34.0 → 0.36.0

package/dist/receipt.d.ts

@@ -0,0 +1,104 @@
+export declare const RECEIPT_SIGNATURE_ALG: "Ed25519";
+/**
+ * Fields covered by a receipt signature. Every one of them is public: the
+ * canonical payload contains nothing the public receipt projection omits, so
+ * whoever holds the receipt can recompute the exact signed bytes.
+ */
+export interface SignableReceipt {
+    receiptId: string;
+    agentId: string;
+    soulAgentId?: string | null;
+    jobId?: string | null;
+    goalId?: string | null;
+    category: string;
+    subcategory: string;
+    amountUsdc: string;
+    serviceFee?: string | null;
+    status: string;
+    executionStatus: string;
+    settlementTx?: string | null;
+    createdAt: Date | string;
+    settledAt?: Date | string | null;
+    /**
+     * Signing-time revision counter. Bound into the signed bytes, so two signed
+     * copies of the same `receipt_id` order from the bytes alone — no database
+     * lookup required. Defaults to 1; every re-sign persists one more.
+     */
+    revision?: number;
+    /**
+     * Free-form receipt metadata (`memo`, `decisionContext`, etc. — see
+     * `apps/api-service/src/services/receipts.ts`'s `createReceipt`). The
+     * metadata VALUE is never placed in the signed bytes — it is free-form and
+     * unbounded — only its digest is (see `computeMetadataDigest`), so a memo
+     * or decision-context edit invalidates the signature until the receipt is
+     * re-signed. `null` and absent digest identically.
+     */
+    metadata?: unknown;
+}
+/**
+ * SHA-256 hex digest of a receipt's `metadata`, key-order-independent.
+ *
+ * `metadata: null` (and `metadata: undefined`, treated identically —
+ * `receipts.metadata` is a nullable jsonb column, and the two never carry
+ * different meaning here) canonicalize to the literal 4-byte string `null`,
+ * exactly like every other nested `null`/absent value, rather than a special
+ * case — this is the stable, documented digest for a metadata-less receipt.
+ */
+export declare function computeMetadataDigest(metadata: unknown): string;
+/** The signature fields signReceipt() attaches to a SignableReceipt. */
+export interface ReceiptSignatureFields {
+    signature: string;
+    digest: string;
+    keyId: string;
+    alg?: string;
+}
+/**
+ * Deterministic JSON payload signed for every terminal receipt. Object
+ * insertion order is intentional and is part of the wire format. Amounts are
+ * strings, timestamps are UTC ISO-8601, absent optionals are `null`.
+ */
+export declare function canonicalizeReceipt(receipt: SignableReceipt): string;
+/** One entry from the published JWKS (`/.well-known/oneshot-receipts.json`). */
+export interface ReceiptJwk {
+    kty: string;
+    crv: string;
+    x: string;
+    kid: string;
+    alg?: string;
+    use?: string;
+}
+export interface ReceiptJwks {
+    keys: ReceiptJwk[];
+}
+/** Reasons a receipt can fail verification — distinguishable, not a generic false. */
+export type ReceiptVerificationFailureReason = 'malformed_receipt' | 'key_not_found' | 'digest_mismatch' | 'signature_invalid';
+export type ReceiptVerificationResult = {
+    valid: true;
+    keyId: string;
+} | {
+    valid: false;
+    reason: ReceiptVerificationFailureReason;
+    keyId?: string;
+    message: string;
+};
+/**
+ * Verify a signed receipt offline against a JWKS.
+ *
+ * Recomputes the canonical payload via `canonicalizeReceipt` (including the
+ * metadata digest, so the receipt's `metadata` must be the value that was
+ * signed), matches the receipt's `keyId` against the JWKS `kid`s (so a
+ * rotated-out key still verifies as long as the JWKS retains it), checks the
+ * SHA-256 digest, and checks the Ed25519 signature. A `key_id` that matches
+ * no key in the JWKS fails with `reason: 'key_not_found'` rather than a
+ * generic false.
+ */
+export declare function verifyReceipt(receipt: SignableReceipt & Partial<ReceiptSignatureFields>, jwks: ReceiptJwks): ReceiptVerificationResult;
+/**
+ * Adapt the wire-format (snake_case) JSON a caller gets from the API — e.g.
+ * `GET /v1/analytics/receipts` or a receipt JSON file — into the shape
+ * `verifyReceipt` expects. The audit export (`GET /v1/audit/receipts`) names
+ * the attestation fields `receipt_*` because its plain `signature` is the
+ * on-chain settlement transaction; both shapes are accepted.
+ */
+export declare function receiptFromWire(input: object): SignableReceipt & Partial<ReceiptSignatureFields>;
+//# sourceMappingURL=receipt.d.ts.map

package/dist/receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,qBAAqB,EAAG,SAAkB,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAG/D;AAED,wEAAwE;AACxE,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAOD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAmBpE;AAED,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,UAAU,EAAE,CAAC;CACpB;AAED,sFAAsF;AACtF,MAAM,MAAM,gCAAgC,GACxC,mBAAmB,GACnB,eAAe,GACf,iBAAiB,GACjB,mBAAmB,CAAC;AAExB,MAAM,MAAM,yBAAyB,GACjC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gCAAgC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,EAC1D,IAAI,EAAE,WAAW,GAChB,yBAAyB,CAuE3B;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA+BhG"}

package/dist/receipt.js

@@ -0,0 +1,243 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECEIPT_SIGNATURE_ALG = void 0;
+exports.computeMetadataDigest = computeMetadataDigest;
+exports.canonicalizeReceipt = canonicalizeReceipt;
+exports.verifyReceipt = verifyReceipt;
+exports.receiptFromWire = receiptFromWire;
+/**
+ * Receipt canonicalization + offline verification.
+ *
+ * The api-service signs every terminal receipt with Ed25519
+ * (`apps/api-service/src/services/receipt-signing.ts`) and publishes the
+ * verification keys at `/.well-known/oneshot-receipts.json`. Anyone holding a
+ * receipt from `GET /v1/analytics/receipts` (or the audit export) can verify
+ * it offline with `verifyReceipt` below, or with the `oneshot-verify-receipt`
+ * CLI.
+ *
+ * `canonicalizeReceipt` here is the ONE canonical implementation. The
+ * api-service signer imports it from this file (see
+ * `apps/api-service/src/services/receipt-signing.ts`) rather than keeping
+ * its own copy, so signer and verifier can never drift apart — see
+ * `tests/unit/receipt-verify.test.ts`'s "shared canonicalizer" guard.
+ *
+ * There is exactly ONE payload format, and it carries no version field. The
+ * signing key is ours and every receipt is an attestation by us, so when the
+ * payload has to change we change this function and re-sign every stored
+ * receipt (`scripts/resign-receipts.ts`, bumping `revision`) instead of
+ * forking a numbered format and carrying verification code for old ones.
+ *
+ * This lives in `libs/agent-sdk` (not `libs/shared-types`) because
+ * `libs/agent-sdk` is the package that ships to npm as a standalone SDK
+ * with no other workspace dependencies (see package.json — only `ethers`).
+ * `libs/shared-types` is never published, so a published SDK cannot import
+ * from it without breaking for every external consumer. api-service is not
+ * published, so it can and does import straight from this file's source
+ * (the same pattern `apps/api-service/src/mcp/agent.ts` already uses for
+ * `OneShot` itself).
+ */
+const node_crypto_1 = require("node:crypto");
+exports.RECEIPT_SIGNATURE_ALG = 'Ed25519';
+/**
+ * Deterministic JSON serialization used ONLY to derive `metadata_digest` — it
+ * is never itself part of the signed bytes. Object keys are sorted
+ * recursively (arrays keep their order) so two semantically equal metadata
+ * objects with differently-ordered keys hash identically, at any nesting
+ * depth. `undefined` values inside objects are dropped (mirrors
+ * `JSON.stringify`'s own behavior for object properties) so an
+ * explicitly-`undefined` key and an absent key digest the same way.
+ */
+function canonicalizeMetadataValue(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalizeMetadataValue);
+    if (value && typeof value === 'object' && !(value instanceof Date)) {
+        // A plain `{}` accumulator is unsafe here: `Object.prototype` defines
+        // `__proto__` as an ACCESSOR, so `sorted['__proto__'] = x` on an
+        // ordinary object sets the object's prototype instead of creating an
+        // own data property — and JSON.stringify only serializes own
+        // properties, so the assigned value would silently vanish from the
+        // digest input. `JSON.parse` itself creates a genuine own `__proto__`
+        // property (via CreateDataProperty, not the setter), so a caller
+        // sending `decisionContext: { "__proto__": {...} }` in a JSON request
+        // body reaches this function with a real own key — a null-prototype
+        // accumulator has no inherited `__proto__` accessor to intercept the
+        // assignment, so it is preserved as an ordinary own property instead.
+        const sorted = Object.create(null);
+        for (const key of Object.keys(value).sort()) {
+            const entry = value[key];
+            if (entry === undefined)
+                continue;
+            sorted[key] = canonicalizeMetadataValue(entry);
+        }
+        return sorted;
+    }
+    return value;
+}
+/**
+ * SHA-256 hex digest of a receipt's `metadata`, key-order-independent.
+ *
+ * `metadata: null` (and `metadata: undefined`, treated identically —
+ * `receipts.metadata` is a nullable jsonb column, and the two never carry
+ * different meaning here) canonicalize to the literal 4-byte string `null`,
+ * exactly like every other nested `null`/absent value, rather than a special
+ * case — this is the stable, documented digest for a metadata-less receipt.
+ */
+function computeMetadataDigest(metadata) {
+    const canonical = JSON.stringify(canonicalizeMetadataValue(metadata ?? null));
+    return (0, node_crypto_1.createHash)('sha256').update(canonical, 'utf8').digest('hex');
+}
+function receiptTimestamp(value) {
+    if (value == null)
+        return null;
+    return (value instanceof Date ? value : new Date(value)).toISOString();
+}
+/**
+ * Deterministic JSON payload signed for every terminal receipt. Object
+ * insertion order is intentional and is part of the wire format. Amounts are
+ * strings, timestamps are UTC ISO-8601, absent optionals are `null`.
+ */
+function canonicalizeReceipt(receipt) {
+    return JSON.stringify({
+        receipt_id: receipt.receiptId,
+        agent_id: receipt.agentId,
+        soul_agent_id: receipt.soulAgentId ?? null,
+        job_id: receipt.jobId ?? null,
+        goal_id: receipt.goalId ?? null,
+        category: receipt.category,
+        subcategory: receipt.subcategory,
+        amount_usdc: String(receipt.amountUsdc),
+        service_fee: String(receipt.serviceFee ?? '0'),
+        status: receipt.status,
+        execution_status: receipt.executionStatus,
+        settlement_tx: receipt.settlementTx ?? null,
+        created_at: receiptTimestamp(receipt.createdAt),
+        settled_at: receiptTimestamp(receipt.settledAt),
+        revision: receipt.revision === undefined ? 1 : receipt.revision,
+        metadata_digest: computeMetadataDigest(receipt.metadata),
+    });
+}
+/**
+ * Verify a signed receipt offline against a JWKS.
+ *
+ * Recomputes the canonical payload via `canonicalizeReceipt` (including the
+ * metadata digest, so the receipt's `metadata` must be the value that was
+ * signed), matches the receipt's `keyId` against the JWKS `kid`s (so a
+ * rotated-out key still verifies as long as the JWKS retains it), checks the
+ * SHA-256 digest, and checks the Ed25519 signature. A `key_id` that matches
+ * no key in the JWKS fails with `reason: 'key_not_found'` rather than a
+ * generic false.
+ */
+function verifyReceipt(receipt, jwks) {
+    if (!receipt || typeof receipt !== 'object' || Array.isArray(receipt) ||
+        !jwks || typeof jwks !== 'object' || !Array.isArray(jwks.keys) ||
+        !jwks.keys.every(k => k && typeof k === 'object' && typeof k.kid === 'string')) {
+        return { valid: false, reason: 'malformed_receipt', message: 'Expected a receipt object and a JWKS keys array' };
+    }
+    const { signature, digest, keyId } = receipt;
+    if (typeof signature !== 'string' || !signature || typeof digest !== 'string' || !digest || typeof keyId !== 'string' || !keyId ||
+        (receipt.alg !== undefined && receipt.alg !== exports.RECEIPT_SIGNATURE_ALG)) {
+        return {
+            valid: false,
+            reason: 'malformed_receipt',
+            message: 'Receipt is missing signature, digest, or keyId',
+        };
+    }
+    const key = jwks.keys.find((candidate) => candidate.kid === keyId);
+    if (!key) {
+        return {
+            valid: false,
+            reason: 'key_not_found',
+            keyId,
+            message: `No key with kid "${keyId}" was found in the supplied JWKS`,
+        };
+    }
+    let payload;
+    try {
+        payload = Buffer.from(canonicalizeReceipt(receipt), 'utf8');
+    }
+    catch {
+        return { valid: false, reason: 'malformed_receipt', keyId, message: 'Receipt contains invalid signed fields or timestamps' };
+    }
+    const expectedDigest = (0, node_crypto_1.createHash)('sha256').update(payload).digest('hex');
+    if (expectedDigest !== digest) {
+        return {
+            valid: false,
+            reason: 'digest_mismatch',
+            keyId,
+            message: 'SHA-256 digest does not match the recomputed canonical payload',
+        };
+    }
+    let publicKey;
+    try {
+        if (key.kty !== 'OKP' || key.crv !== 'Ed25519' || (key.use !== undefined && key.use !== 'sig') ||
+            (key.alg !== undefined && !['Ed25519', 'EdDSA'].includes(key.alg)))
+            throw new Error('Expected an Ed25519 signing key');
+        publicKey = (0, node_crypto_1.createPublicKey)({ key: { kty: key.kty, crv: key.crv, x: key.x }, format: 'jwk' });
+    }
+    catch (err) {
+        return {
+            valid: false,
+            reason: 'malformed_receipt',
+            keyId,
+            message: `Could not construct a public key from JWKS entry "${keyId}": ${err.message}`,
+        };
+    }
+    let signatureValid = false;
+    try {
+        signatureValid = (0, node_crypto_1.verify)(null, payload, publicKey, Buffer.from(signature, 'base64url'));
+    }
+    catch {
+        signatureValid = false;
+    }
+    if (!signatureValid) {
+        return {
+            valid: false,
+            reason: 'signature_invalid',
+            keyId,
+            message: 'Ed25519 signature does not match the recomputed canonical payload',
+        };
+    }
+    return { valid: true, keyId };
+}
+/**
+ * Adapt the wire-format (snake_case) JSON a caller gets from the API — e.g.
+ * `GET /v1/analytics/receipts` or a receipt JSON file — into the shape
+ * `verifyReceipt` expects. The audit export (`GET /v1/audit/receipts`) names
+ * the attestation fields `receipt_*` because its plain `signature` is the
+ * on-chain settlement transaction; both shapes are accepted.
+ */
+function receiptFromWire(input) {
+    if (!input || Array.isArray(input) || typeof input !== 'object')
+        throw new Error('Receipt must be a JSON object');
+    const wire = { ...input };
+    const own = (key) => Object.prototype.hasOwnProperty.call(wire, key);
+    const audit = own('receipt_signature');
+    const algKey = audit ? 'receipt_alg' : 'alg';
+    if (own(algKey) && wire[algKey] !== 'Ed25519')
+        throw new Error('Unsupported receipt signature algorithm');
+    const str = (value) => (typeof value === 'string' ? value : undefined);
+    const num = (value) => (typeof value === 'number' ? value : undefined);
+    return {
+        receiptId: str(wire.receipt_id) ?? str(wire.receiptId) ?? '',
+        agentId: str(wire.agent_id) ?? str(wire.agentId) ?? '',
+        soulAgentId: str(wire.soul_agent_id) ?? str(wire.soulAgentId) ?? null,
+        jobId: str(wire.job_id) ?? str(wire.jobId) ?? null,
+        goalId: str(wire.goal_id) ?? str(wire.goalId) ?? null,
+        category: str(wire.category) ?? '',
+        subcategory: str(wire.subcategory) ?? '',
+        amountUsdc: str(wire.amount_usdc) ?? str(wire.amountUsdc) ?? '0',
+        serviceFee: str(wire.service_fee) ?? str(wire.serviceFee) ?? null,
+        status: str(wire.status) ?? '',
+        executionStatus: str(wire.execution_status) ?? str(wire.executionStatus) ?? '',
+        settlementTx: str(wire.settlement_tx) ?? str(wire.settlementTx) ?? (audit ? str(wire.signature) : null) ?? null,
+        createdAt: str(wire.created_at) ?? str(wire.createdAt) ?? new Date(0).toISOString(),
+        settledAt: str(wire.settled_at) ?? str(wire.settledAt) ?? null,
+        revision: audit ? num(wire.receipt_revision) : num(wire.revision),
+        metadata: wire.metadata,
+        signature: str(audit ? wire.receipt_signature : wire.signature),
+        digest: str(audit ? wire.receipt_digest : wire.digest),
+        keyId: audit ? str(wire.receipt_key_id) : str(wire.key_id) ?? str(wire.keyId),
+        alg: str(audit ? wire.receipt_alg : wire.alg),
+    };
+}
+//# sourceMappingURL=receipt.js.map

package/dist/receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":";;;AAmHA,sDAGC;AAoBD,kDAmBC;AAsCD,sCA0EC;AASD,0CA+BC;AArTD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,6CAAmF;AAEtE,QAAA,qBAAqB,GAAG,SAAkB,CAAC;AAuCxD;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACtE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,EAAE,CAAC;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,qEAAqE;QACrE,6DAA6D;QAC7D,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,sEAAsE;QACtE,oEAAoE;QACpE,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,MAAM,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,KAAK,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,QAAiB;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAUD,SAAS,gBAAgB,CAAC,KAAuC;IAC/D,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,OAAwB;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,aAAa,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QAC1C,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC7B,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,eAAe;QACzC,aAAa,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC3C,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC;QAC/C,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC;QAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ;QAC/D,eAAe,EAAE,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC;KACzD,CAAC,CAAC;AACL,CAAC;AA2BD;;;;;;;;;;GAUG;AACH,SAAgB,aAAa,CAC3B,OAA0D,EAC1D,IAAiB;IAEjB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACjE,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IACnH,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC7C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAC3H,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,6BAAqB,CAAC,EAAE,CAAC;QACzE,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,gDAAgD;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,eAAe;YACvB,KAAK;YACL,OAAO,EAAE,oBAAoB,KAAK,kCAAkC;SACrE,CAAC;IACJ,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACpE,MAAM,CAAC;QAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;IAAC,CAAC;IAEvI,MAAM,cAAc,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,iBAAiB;YACzB,KAAK;YACL,OAAO,EAAE,gEAAgE;SAC1E,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC;YAC1F,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC3H,SAAS,GAAG,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,mBAAmB;YAC3B,KAAK;YACL,OAAO,EAAE,qDAAqD,KAAK,MAAO,GAAa,CAAC,OAAO,EAAE;SAClG,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,cAAc,GAAG,IAAA,oBAAa,EAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,mBAAmB;YAC3B,KAAK;YACL,OAAO,EAAE,mEAAmE;SAC7E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,EAA6B,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;QAC5D,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QACtD,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI;QACrE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI;QAClD,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI;QACrD,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QAClC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;QACxC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG;QAChE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI;QACjE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAC9B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE;QAC9E,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI;QAC/G,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACnF,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI;QAC9D,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjE,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACtD,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7E,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KAC9C,CAAC;AACJ,CAAC"}