@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/pdpp/declaration.js

@@ -0,0 +1,549 @@
+/**
+ * Bounded SourceDeclaration retrieval (§5 declaration acceptance, §10
+ * declaration retrieval hygiene).
+ *
+ * An AS that fetches a client-supplied URL is an SSRF engine unless it is
+ * fenced. The rules here are the fence: HTTPS only, no private or loopback or
+ * link-local address literals, a bounded redirect chain that is re-checked at
+ * every hop, a response size cap, and a timeout. Each redirect is validated
+ * again because a public hostname resolving to a public IP can redirect to
+ * `http://169.254.169.254/` and a one-shot check at the start would miss it.
+ *
+ * What this module deliberately does NOT do is decide whether a declaration is
+ * *trusted*. That is deployment policy (`DeclarationTrustPolicy`), applied
+ * explicitly by the caller, because "we fetched it safely" and "we accept its
+ * authority over this source" are different questions.
+ */
+import { createHash } from "node:crypto";
+import { isIP } from "node:net";
+export const MAX_DECLARATION_BYTES = 256 * 1024;
+export const MAX_REDIRECTS = 3;
+export const DECLARATION_FETCH_TIMEOUT_MS = 5_000;
+/**
+ * Private, loopback, link-local, and unique-local ranges. Checked against
+ * address *literals* in the URL. A hostname that resolves into these ranges is
+ * a DNS-rebinding concern the fetch layer must also handle; we reject the
+ * literal form here and keep the redirect chain bounded so a rebind has a much
+ * smaller window to work in.
+ */
+function isPrivateAddressLiteral(host) {
+    const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+    const version = isIP(bare);
+    if (version === 4) {
+        const parts = bare.split(".").map(Number);
+        const [a, b] = parts;
+        if (a === 10 || a === 127 || a === 0)
+            return true;
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        // 169.254.0.0/16 — link-local, and the cloud metadata endpoint.
+        if (a === 169 && b === 254)
+            return true;
+        return false;
+    }
+    if (version === 6) {
+        const lower = bare.toLowerCase();
+        if (lower === "::1" || lower === "::")
+            return true;
+        // fc00::/7 unique-local, fe80::/10 link-local.
+        if (lower.startsWith("fc") || lower.startsWith("fd"))
+            return true;
+        if (lower.startsWith("fe8") || lower.startsWith("fe9"))
+            return true;
+        if (lower.startsWith("fea") || lower.startsWith("feb"))
+            return true;
+        return false;
+    }
+    // Not a literal. Hostname forms that always mean "this machine".
+    const lowerHost = bare.toLowerCase();
+    return lowerHost === "localhost" || lowerHost.endsWith(".localhost");
+}
+/** Validate one URL in the chain. Applied to the origin URL and every hop. */
+export function checkDeclarationUrl(raw, policy) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return {
+            code: "fetch_failed",
+            message: `malformed declaration URL: ${raw}`,
+        };
+    }
+    if (url.protocol !== "https:" && !policy.allowInsecureForTesting) {
+        return {
+            code: "insecure_scheme",
+            message: `declaration URL must use https, got ${url.protocol}`,
+        };
+    }
+    if (isPrivateAddressLiteral(url.hostname) &&
+        !policy.allowInsecureForTesting) {
+        return {
+            code: "private_address",
+            message: `declaration URL resolves to a private or loopback address: ${url.hostname}`,
+        };
+    }
+    if (!policy.allowAnyHttpsHost) {
+        const trusted = policy.trustedHosts ?? [];
+        if (!trusted.includes(url.hostname)) {
+            return {
+                code: "untrusted_source",
+                message: `declaration host '${url.hostname}' is not in this deployment's declaration trust policy`,
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Project a normative §5 `SourceDeclaration` onto the internal snapshot shape.
+ *
+ * Returns the document unchanged when it is already in the internal shape, so
+ * existing private fixtures keep working — this is a compatibility adapter,
+ * not a redefinition of either format.
+ *
+ * The projection is deliberately narrow:
+ *   - `source.id` / `source.kind` → `source_id` / `source_kind`
+ *   - `declaration_version`       → `version`
+ *   - per stream, `schema.properties` keys → `fields`, and `schema.required`
+ *     → `required_fields`
+ *
+ * Deriving fields from the JSON Schema is the substantive part. The internal
+ * model wants a flat allowlist because §6 field selection and §8 projection
+ * operate on top-level names; the normative model carries a real schema
+ * because a declaration must describe record shape, not just name it. Reading
+ * `properties` keys is the honest projection of one onto the other, and
+ * `required` is exactly the per-stream consent floor §6 already calls for.
+ *
+ * Nothing here validates the normative document beyond what the projection
+ * needs — the checks that follow do that, and they run on the projected form
+ * so one code path enforces both.
+ */
+/**
+ * The source id a declaration document claims, in either shape.
+ *
+ * A caller that needs the id *before* parsing — a deployment loader keying
+ * retention by source, say — would otherwise have to reach into the document
+ * itself and pick a field. That is how the boot path came to accept only the
+ * internal flat `source_id` and silently skip every normative document, which
+ * left the AS unmounted with nothing but a warning to say why.
+ *
+ * Reading the shape is this module's job, so the question is answered here
+ * once. Returns null when neither shape carries a usable id; `parseDeclaration`
+ * remains the authority on whether the document is actually valid.
+ */
+export function declaredSourceId(body) {
+    let doc;
+    try {
+        doc = JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+    if (typeof doc !== "object" || doc === null)
+        return null;
+    // Normative §5: `source.id`. Internal/flat: `source_id`.
+    const nested = doc.source?.id;
+    const flat = doc.source_id;
+    const id = typeof nested === "string" && nested.length > 0 ? nested : flat;
+    return typeof id === "string" && id.length > 0 ? id : null;
+}
+function normalizeNormativeDeclaration(doc) {
+    const source = doc.source;
+    if (typeof source !== "object" || source === null)
+        return doc;
+    const { id, kind } = source;
+    const declarationVersion = doc
+        .declaration_version;
+    const streams = Array.isArray(doc.streams)
+        ? doc.streams.map((raw) => {
+            const stream = raw;
+            // Already internal-shaped: leave it alone rather than guessing.
+            if (Array.isArray(stream.fields))
+                return stream;
+            const schema = stream.schema;
+            if (!schema || typeof schema !== "object")
+                return stream;
+            return {
+                ...stream,
+                fields: Object.keys(schema.properties ?? {}),
+                required_fields: Array.isArray(schema.required)
+                    ? schema.required
+                    : [],
+            };
+        })
+        : doc.streams;
+    return {
+        ...doc,
+        ...(typeof id === "string" && { source_id: id }),
+        ...(typeof kind === "string" && { source_kind: kind }),
+        ...(typeof declarationVersion === "string" && {
+            version: declarationVersion,
+        }),
+        streams,
+    };
+}
+export function computeDeclarationDigest(body) {
+    return createHash("sha256").update(body, "utf8").digest("hex");
+}
+/**
+ * Parse and structurally validate a declaration document.
+ *
+ * Validates the embedded stream schemas enough that resolution can rely on
+ * them: every stream needs a name, a field list, and a primary key, and its
+ * `required_fields` must be a subset of its declared fields — otherwise the
+ * per-stream consent floor would name fields the schema does not have.
+ */
+export function parseDeclaration(body, expectedSourceId, expectedDigest) {
+    const digest = computeDeclarationDigest(body);
+    if (expectedDigest !== undefined && digest !== expectedDigest) {
+        return {
+            ok: false,
+            failure: {
+                code: "digest_mismatch",
+                message: "declaration digest does not match the expected value",
+            },
+        };
+    }
+    let doc;
+    try {
+        doc = JSON.parse(body);
+    }
+    catch {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "declaration is not valid JSON",
+            },
+        };
+    }
+    // Accept the NORMATIVE §5 SourceDeclaration and project it onto this
+    // module's internal snapshot shape.
+    //
+    // PS historically parsed a private shape (`source_id`, `source_kind`,
+    // `version`, flat `fields[]`/`required_fields[]`). That shape is not the
+    // protocol: the published schema
+    // (`https://pdpp.dev/schemas/source-declaration/0.1.0`, `reference-contract`)
+    // requires `protocol_version`, nested `source {kind,id}`,
+    // `declaration_version`, `publisher`, `display`, and a real JSON-Schema
+    // `schema` per stream — and sets `additionalProperties: false`, so the
+    // private shape is affirmatively INVALID, not merely different.
+    //
+    // Normalizing here rather than loosening the checks below keeps the
+    // protocol boundary honest: a normative document is validated as normative,
+    // and the internal snapshot stays an internal detail. The raw bytes and
+    // their digest are untouched — `digest` above is computed over `body`
+    // exactly as retrieved, which is the property that proves a producer read
+    // the same bytes the owner consented against.
+    doc = normalizeNormativeDeclaration(doc);
+    if (typeof doc.source_id !== "string" || doc.source_id.length === 0) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "declaration is missing source_id",
+            },
+        };
+    }
+    // The declaration must claim the source we asked about. Without this check a
+    // trusted host could serve an authority for a source it does not own.
+    if (doc.source_id !== expectedSourceId) {
+        return {
+            ok: false,
+            failure: {
+                code: "source_id_mismatch",
+                message: `declaration declares source_id '${doc.source_id}' but was retrieved for '${expectedSourceId}'`,
+            },
+        };
+    }
+    if (doc.source_kind !== "connector" &&
+        doc.source_kind !== "provider_native") {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "declaration source_kind must be connector or provider_native",
+            },
+        };
+    }
+    if (typeof doc.version !== "string" || doc.version.length === 0) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "declaration is missing version",
+            },
+        };
+    }
+    if (!Array.isArray(doc.streams) || doc.streams.length === 0) {
+        return {
+            ok: false,
+            failure: {
+                code: "invalid_document",
+                message: "declaration declares no streams",
+            },
+        };
+    }
+    const streams = [];
+    const seenStreams = new Set();
+    for (const raw of doc.streams) {
+        const s = raw;
+        if (typeof s.name !== "string" || s.name.length === 0) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_document",
+                    message: "a declared stream is missing name",
+                },
+            };
+        }
+        if (seenStreams.has(s.name)) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_document",
+                    message: `stream '${s.name}' is declared more than once`,
+                },
+            };
+        }
+        seenStreams.add(s.name);
+        if (!Array.isArray(s.fields) || s.fields.length === 0) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_document",
+                    message: `stream '${s.name}' declares no fields`,
+                },
+            };
+        }
+        const fields = s.fields;
+        const requiredFields = Array.isArray(s.required_fields)
+            ? s.required_fields
+            : [];
+        const missing = requiredFields.filter((f) => !fields.includes(f));
+        if (missing.length > 0) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_document",
+                    message: `stream '${s.name}' marks fields required that its schema does not declare: ${missing.join(", ")}`,
+                },
+            };
+        }
+        if (!Array.isArray(s.primary_key) || s.primary_key.length === 0) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_document",
+                    message: `stream '${s.name}' declares no primary_key`,
+                },
+            };
+        }
+        // §5 stream semantics. An unrecognized value is a rejection rather than a
+        // silent fallback: coercing an unknown semantics to `mutable_state` would
+        // upsert records a declaration may have meant to be immutable.
+        if (s.semantics !== undefined &&
+            s.semantics !== "mutable_state" &&
+            s.semantics !== "append_only") {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_document",
+                    message: `stream '${s.name}' declares unsupported semantics '${String(s.semantics)}'`,
+                },
+            };
+        }
+        streams.push({
+            name: s.name,
+            fields,
+            required_fields: requiredFields,
+            ...(typeof s.semantics === "string" && {
+                semantics: s.semantics,
+            }),
+            ...(typeof s.consent_time_field === "string" && {
+                consent_time_field: s.consent_time_field,
+            }),
+            primary_key: s.primary_key,
+            // Carried verbatim from the normative declaration so §8 metadata can
+            // report record shape and selection capability without a second lookup.
+            ...(typeof s.schema === "object" && s.schema !== null
+                ? { schema: s.schema }
+                : {}),
+            ...(typeof s.selection === "object" && s.selection !== null
+                ? { selection: s.selection }
+                : {}),
+        });
+    }
+    // §6: a preset naming the same stream twice makes the declaration invalid.
+    // That is a declaration-acceptance failure, not deferred to issuance.
+    const presets = Array.isArray(doc.selection_presets)
+        ? doc.selection_presets
+        : undefined;
+    if (presets) {
+        for (const preset of presets) {
+            const seen = new Set();
+            for (const stream of preset.streams ?? []) {
+                if (seen.has(stream.name)) {
+                    return {
+                        ok: false,
+                        failure: {
+                            code: "invalid_document",
+                            message: `selection preset '${preset.name}' names stream '${stream.name}' more than once`,
+                        },
+                    };
+                }
+                seen.add(stream.name);
+            }
+        }
+    }
+    return {
+        ok: true,
+        snapshot: {
+            source_id: doc.source_id,
+            source_kind: doc.source_kind,
+            version: doc.version,
+            digest,
+            streams,
+            ...(Array.isArray(doc.views) && {
+                views: doc.views,
+            }),
+            ...(presets && {
+                selection_presets: presets,
+            }),
+        },
+    };
+}
+/**
+ * Read a response body, giving up as soon as it exceeds `limit` bytes.
+ *
+ * Returns null when the cap is passed. The stream is cancelled at that point,
+ * so a hostile or misconfigured host cannot make us hold more than the cap in
+ * memory however it frames the response. Falls back to a buffered read only
+ * when the runtime gives no readable stream, and still checks the size.
+ */
+async function readCapped(response, limit) {
+    const stream = response.body;
+    if (!stream) {
+        const buffered = await response.text();
+        return Buffer.byteLength(buffered, "utf8") > limit ? null : buffered;
+    }
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > limit) {
+                await reader.cancel();
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks.map((c) => Buffer.from(c))).toString("utf8");
+}
+/**
+ * Retrieve one declaration under the bounded rules, then parse and digest it.
+ *
+ * Redirects are followed manually so each hop can be re-validated. This is the
+ * difference between a fence and a formality: `fetch`'s automatic redirect
+ * following would validate only the URL we started with.
+ */
+export async function retrieveDeclaration(url, expectedSourceId, policy, options = {}) {
+    const fetcher = options.fetcher ?? ((u, init) => fetch(u, init));
+    let current = url;
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
+        const problem = checkDeclarationUrl(current, policy);
+        if (problem)
+            return { ok: false, failure: problem };
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), DECLARATION_FETCH_TIMEOUT_MS);
+        let response;
+        try {
+            response = await fetcher(current, {
+                redirect: "manual",
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            return {
+                ok: false,
+                failure: {
+                    code: "fetch_failed",
+                    message: `declaration retrieval failed: ${err.message}`,
+                },
+            };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (response.status >= 300 && response.status < 400) {
+            const location = response.headers.get("location");
+            if (!location) {
+                return {
+                    ok: false,
+                    failure: {
+                        code: "fetch_failed",
+                        message: "redirect response carried no Location header",
+                    },
+                };
+            }
+            // Resolve relative redirects against the current URL, then re-check.
+            current = new URL(location, current).toString();
+            continue;
+        }
+        if (!response.ok) {
+            return {
+                ok: false,
+                failure: {
+                    code: "fetch_failed",
+                    message: `declaration retrieval returned HTTP ${response.status}`,
+                },
+            };
+        }
+        const declaredLength = response.headers.get("content-length");
+        if (declaredLength && Number(declaredLength) > MAX_DECLARATION_BYTES) {
+            return {
+                ok: false,
+                failure: {
+                    code: "too_large",
+                    message: `declaration exceeds ${MAX_DECLARATION_BYTES} bytes`,
+                },
+            };
+        }
+        // Read incrementally and abort the moment the cap is passed. `text()`
+        // would buffer the whole response first, so a host that omits or lies
+        // about Content-Length could make us allocate an unbounded body and only
+        // then be told it was too large — the cap has to bound the allocation, not
+        // just the outcome.
+        const body = await readCapped(response, MAX_DECLARATION_BYTES);
+        if (body === null) {
+            return {
+                ok: false,
+                failure: {
+                    code: "too_large",
+                    message: `declaration exceeds ${MAX_DECLARATION_BYTES} bytes`,
+                },
+            };
+        }
+        return parseDeclaration(body, expectedSourceId, options.expectedDigest);
+    }
+    return {
+        ok: false,
+        failure: {
+            code: "too_many_redirects",
+            message: `declaration retrieval exceeded ${MAX_REDIRECTS} redirects`,
+        },
+    };
+}
+//# sourceMappingURL=declaration.js.map

package/dist/pdpp/declaration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaration.js","sourceRoot":"","sources":["../../src/pdpp/declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGhC,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AA2ClD;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,IAAI,GACR,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,gEAAgE;QAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACnD,+CAA+C;QAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,MAA8B;IAE9B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,8BAA8B,GAAG,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,uCAAuC,GAAG,CAAC,QAAQ,EAAE;SAC/D,CAAC;IACJ,CAAC;IAED,IACE,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,CAAC,MAAM,CAAC,uBAAuB,EAC/B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,8DAA8D,GAAG,CAAC,QAAQ,EAAE;SACtF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,qBAAqB,GAAG,CAAC,QAAQ,wDAAwD;aACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEzD,yDAAyD;IACzD,MAAM,MAAM,GAAI,GAAqC,CAAC,MAAM,EAAE,EAAE,CAAC;IACjE,MAAM,IAAI,GAAI,GAA+B,CAAC,SAAS,CAAC;IACxD,MAAM,EAAE,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,6BAA6B,CACpC,GAA2B;IAE3B,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAE9D,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAA0C,CAAC;IAChE,MAAM,kBAAkB,GAAI,GAAyC;SAClE,mBAAmB,CAAC;IAEvB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,GAA8B,CAAC;YAC9C,gEAAgE;YAChE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YAEhD,MAAM,MAAM,GAAG,MAAM,CAAC,MAET,CAAC;YACd,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;YAEzD,OAAO;gBACL,GAAG,MAAM;gBACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;gBAC5C,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAC7C,CAAC,CAAE,MAAM,CAAC,QAAqB;oBAC/B,CAAC,CAAC,EAAE;aACP,CAAC;QACJ,CAAC,CAAC;QACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAEhB,OAAO;QACL,GAAG,GAAG;QACN,GAAG,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAChD,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACtD,GAAG,CAAC,OAAO,kBAAkB,KAAK,QAAQ,IAAI;YAC5C,OAAO,EAAE,kBAAkB;SAC5B,CAAC;QACF,OAAO;KACkB,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,gBAAwB,EACxB,cAAuB;IAEvB,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,cAAc,KAAK,SAAS,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,sDAAsD;aAChE;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAA2B,CAAC;IAChC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,+BAA+B;aACzC;SACF,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,oCAAoC;IACpC,EAAE;IACF,sEAAsE;IACtE,yEAAyE;IACzE,iCAAiC;IACjC,8EAA8E;IAC9E,0DAA0D;IAC1D,wEAAwE;IACxE,uEAAuE;IACvE,gEAAgE;IAChE,EAAE;IACF,oEAAoE;IACpE,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,0EAA0E;IAC1E,8CAA8C;IAC9C,GAAG,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;IAEzC,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,kCAAkC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,GAAG,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,mCAAmC,GAAG,CAAC,SAAS,4BAA4B,gBAAgB,GAAG;aACzG;SACF,CAAC;IACJ,CAAC;IAED,IACE,GAAG,CAAC,WAAW,KAAK,WAAW;QAC/B,GAAG,CAAC,WAAW,KAAK,iBAAiB,EACrC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,8DAA8D;aACxE;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,gCAAgC;aAC1C;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,iCAAiC;aAC3C;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,mCAAmC;iBAC7C;aACF,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,8BAA8B;iBACzD;aACF,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAExB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,sBAAsB;iBACjD;aACF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAkB,CAAC;QACpC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrD,CAAC,CAAE,CAAC,CAAC,eAA4B;YACjC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,6DAA6D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC5G;aACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,2BAA2B;iBACtD;aACF,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,+DAA+D;QAC/D,IACE,CAAC,CAAC,SAAS,KAAK,SAAS;YACzB,CAAC,CAAC,SAAS,KAAK,eAAe;YAC/B,CAAC,CAAC,SAAS,KAAK,aAAa,EAC7B,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,qCAAqC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG;iBACtF;aACF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM;YACN,eAAe,EAAE,cAAc;YAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI;gBACrC,SAAS,EAAE,CAAC,CAAC,SAA4C;aAC1D,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ,IAAI;gBAC9C,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;aACzC,CAAC;YACF,WAAW,EAAE,CAAC,CAAC,WAAuB;YACtC,qEAAqE;YACrE,wEAAwE;YACxE,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;gBACnD,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAiC,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;gBACzD,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAoC,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAClD,CAAC,CAAE,GAAG,CAAC,iBAGF;QACL,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,OAAO,EAAE;4BACP,IAAI,EAAE,kBAAkB;4BACxB,OAAO,EAAE,qBAAqB,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,IAAI,kBAAkB;yBAC1F;qBACF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE;YACR,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAyB;YAC1C,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM;YACN,OAAO;YACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI;gBAC9B,KAAK,EAAE,GAAG,CAAC,KAAqC;aACjD,CAAC;YACF,GAAG,CAAC,OAAO,IAAI;gBACb,iBAAiB,EAAE,OAAmD;aACvE,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CACvB,QAAkB,EAClB,KAAa;IAEb,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3E,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAW,EACX,gBAAwB,EACxB,MAA8B,EAC9B,UAAqE,EAAE;IAEvE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAEjE,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAEpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,4BAA4B,CAC7B,CAAC;QAEF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE;gBAChC,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,iCAAkC,GAAa,CAAC,OAAO,EAAE;iBACnE;aACF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE;wBACP,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,8CAA8C;qBACxD;iBACF,CAAC;YACJ,CAAC;YACD,qEAAqE;YACrE,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,uCAAuC,QAAQ,CAAC,MAAM,EAAE;iBAClE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,qBAAqB,EAAE,CAAC;YACrE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,uBAAuB,qBAAqB,QAAQ;iBAC9D;aACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,2EAA2E;QAC3E,oBAAoB;QACpB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,uBAAuB,qBAAqB,QAAQ;iBAC9D;aACF,CAAC;QACJ,CAAC;QAED,OAAO,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE;YACP,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,kCAAkC,aAAa,YAAY;SACrE;KACF,CAAC;AACJ,CAAC"}

package/dist/pdpp/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * PDPP Core v0.1.0 Authorization Server.
+ *
+ * Public seam for the PDPP AS: selection validation, axis resolution, consent
+ * review, grant issuance, grant-bound tokens, introspection, and revocation.
+ * The Resource Server consumes `PdppTokenService.resolveToken` (co-located) or
+ * `introspect` (separated) and enforces only from that result.
+ */
+export { PDPP_DATA_ACCESS_TYPE, PDPP_GRANT_VERSION, PDPP_API_VERSION, AI_TRAINING_PURPOSE, } from "./types.js";
+export type { AccessMode, ClientClaims, ClientDisplay, DeclarationSnapshot, DeclaredPreset, DeclaredStream, DeclaredView, Grant, GrantStatus, InactiveReason, PdppAuthorizationDetail, PdppIntrospectionResponse, PdppTokenContext, PdppTokenKind, Retention, SelectionRequest, SourceKind, StreamGrant, StreamRequest, TimeConstraint, TimeRange, } from "./types.js";
+export { validateSelectionRequest } from "./selection.js";
+export type { SelectionFailure, SelectionFailureCode, SelectionValidation, } from "./selection.js";
+export { resolveSelection } from "./resolve.js";
+export type { InstanceInventory, ResolutionFailure, ResolutionFailureCode, ResolutionResult, } from "./resolve.js";
+export { buildConsentReview, computeReviewDigest, isRegisteredPurposeCode, normalizeClientClaims, } from "./review.js";
+export type { BuildReviewInput, ConsentReviewModel, RequesterIdentity, ReviewStream, } from "./review.js";
+export { issueGrant } from "./issuance.js";
+export type { ConsentEvidence, IssuanceFailure, IssuanceFailureCode, IssuanceResult, IssueGrantInput, } from "./issuance.js";
+export { AUTHORIZATION_CODE_TTL_SECONDS, DEFAULT_ACCESS_TOKEN_TTL_SECONDS, mayIssueRefreshToken, PdppTokenService, toAuthorizationDetail, } from "./tokens.js";
+export type { TokenFailure, TokenFailureCode, TokenIssuanceResult, TokenResult, PdppTokenServiceOptions, } from "./tokens.js";
+export { approveAuthorization, AuthorizationSessionStore, denyAuthorization, fetchReview, REVIEW_SESSION_TTL_SECONDS, } from "./approval.js";
+export type { ApprovalFailure, ApprovalFailureCode, ApprovalResult, AuthorizationSession, InstanceChoice, ReviewFetchResult, SessionState, } from "./approval.js";
+export { REDIRECT_FAILURES_ARE_NEVER_REDIRECTED, validateRedirectUri, } from "./redirect.js";
+export type { RedirectFailure, RedirectFailureCode, RegisteredRedirectPolicy, } from "./redirect.js";
+export { computeS256Challenge, PKCE_METHOD_S256, validateCodeChallenge, verifyCodeVerifier, } from "./pkce.js";
+export type { PkceFailure, PkceFailureCode } from "./pkce.js";
+export { hashToken, newOpaqueToken, openPdppAuthStore, PdppAuthStore, PDPP_AUTH_STATE_VERSION, UnsupportedAuthStateError, } from "./store.js";
+export type { AccessTokenRecord, AuthCodeRecord, StoredGrant, } from "./store.js";
+export { checkDeclarationUrl, computeDeclarationDigest, declaredSourceId, DECLARATION_FETCH_TIMEOUT_MS, MAX_DECLARATION_BYTES, MAX_REDIRECTS, parseDeclaration, retrieveDeclaration, } from "./declaration.js";
+export type { DeclarationFailure, DeclarationFailureCode, DeclarationFetcher, DeclarationResult, DeclarationTrustPolicy, } from "./declaration.js";
+export { MAX_CLIENT_DOCUMENT_BYTES, resolveUrlHostedClientIdentity, } from "./client-identity.js";
+export type { ClientDocumentFetcher, ClientIdentityFailure, ClientIdentityFailureCode, ClientIdentityResult, } from "./client-identity.js";
+export { mayRenderRemoteLogo, resolveRequesterIdentity, verifyClientIdDocument, } from "./client-metadata.js";
+export type { ClientIdMetadataDocument, RegisteredClientMetadata, ResolveRequesterInput, } from "./client-metadata.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/pdpp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pdpp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,UAAU,EACV,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,KAAK,EACL,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,aAAa,EACb,cAAc,EACd,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EACV,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sCAAsC,EACtC,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE9D,OAAO,EACL,SAAS,EACT,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,EAC5B,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC"}

package/dist/pdpp/index.js

@@ -0,0 +1,22 @@
+/**
+ * PDPP Core v0.1.0 Authorization Server.
+ *
+ * Public seam for the PDPP AS: selection validation, axis resolution, consent
+ * review, grant issuance, grant-bound tokens, introspection, and revocation.
+ * The Resource Server consumes `PdppTokenService.resolveToken` (co-located) or
+ * `introspect` (separated) and enforces only from that result.
+ */
+export { PDPP_DATA_ACCESS_TYPE, PDPP_GRANT_VERSION, PDPP_API_VERSION, AI_TRAINING_PURPOSE, } from "./types.js";
+export { validateSelectionRequest } from "./selection.js";
+export { resolveSelection } from "./resolve.js";
+export { buildConsentReview, computeReviewDigest, isRegisteredPurposeCode, normalizeClientClaims, } from "./review.js";
+export { issueGrant } from "./issuance.js";
+export { AUTHORIZATION_CODE_TTL_SECONDS, DEFAULT_ACCESS_TOKEN_TTL_SECONDS, mayIssueRefreshToken, PdppTokenService, toAuthorizationDetail, } from "./tokens.js";
+export { approveAuthorization, AuthorizationSessionStore, denyAuthorization, fetchReview, REVIEW_SESSION_TTL_SECONDS, } from "./approval.js";
+export { REDIRECT_FAILURES_ARE_NEVER_REDIRECTED, validateRedirectUri, } from "./redirect.js";
+export { computeS256Challenge, PKCE_METHOD_S256, validateCodeChallenge, verifyCodeVerifier, } from "./pkce.js";
+export { hashToken, newOpaqueToken, openPdppAuthStore, PdppAuthStore, PDPP_AUTH_STATE_VERSION, UnsupportedAuthStateError, } from "./store.js";
+export { checkDeclarationUrl, computeDeclarationDigest, declaredSourceId, DECLARATION_FETCH_TIMEOUT_MS, MAX_DECLARATION_BYTES, MAX_REDIRECTS, parseDeclaration, retrieveDeclaration, } from "./declaration.js";
+export { MAX_CLIENT_DOCUMENT_BYTES, resolveUrlHostedClientIdentity, } from "./client-identity.js";
+export { mayRenderRemoteLogo, resolveRequesterIdentity, verifyClientIdDocument, } from "./client-metadata.js";
+//# sourceMappingURL=index.js.map

package/dist/pdpp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pdpp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAyBpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAO1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQhD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAQrB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAS3C,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AASrB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAWvB,OAAO,EACL,sCAAsC,EACtC,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAOvB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,SAAS,EACT,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAOpB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,EAC5B,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC"}