@peac/mappings-ucp 0.15.1 → 0.15.2

package/dist/http-signature.js

@@ -0,0 +1,592 @@
+/**
+ * @peac/mappings-ucp - RFC 9421 HTTP Message Signature verification
+ *
+ * Verifies UCP request and webhook signatures using the current UCP signing
+ * model: RFC 9421 HTTP Message Signatures (`Signature-Input` / `Signature`)
+ * with an RFC 9530 `Content-Digest` computed over the raw body bytes.
+ *
+ * This is distinct from the legacy `Request-Signature` detached-JWS path in
+ * `verify.ts` (`verifyUcpWebhookSignature`). The two schemes do NOT silently
+ * fall back to each other: the caller selects which one to verify, and a
+ * failure for the selected scheme is surfaced, never quietly downgraded.
+ *
+ * This verifier covers request-shaped UCP signatures (method / authority / path
+ * / headers / body). UCP response signatures use `@status` instead of `@method`
+ * and are a separate component model, out of scope here.
+ *
+ * UCP specifics enforced here (per https://ucp.dev/specification/signatures/):
+ * - The algorithm is RESOLVED from the signing key's `crv` (P-256 -> ES256,
+ *   P-384 -> ES384). UCP does not include a JOSE/JWA `alg` in `Signature-Input`;
+ *   if a signer includes an `alg` parameter anyway it is treated as advisory and
+ *   accepted only when it is consistent with the key curve.
+ * - `created` is OPTIONAL (UCP handles replay at the business layer through
+ *   idempotency keys), so the signature is parsed leniently.
+ * - The required signed-component set is enforced (see UcpComponentPolicy):
+ *   `@method`, `@authority`, `@path`; `@query` when the URL has a query;
+ *   `ucp-agent` when that header is present; `idempotency-key` for
+ *   state-changing methods; `content-digest` + `content-type` when a body is
+ *   present.
+ * - Signatures are fixed-width raw `r||s` (IEEE P1363): 64 bytes for P-256, 96
+ *   for P-384. DER is rejected by an explicit length check.
+ *
+ * Implementation notes:
+ * - ECDSA verification uses WebCrypto (`crypto.subtle`), which expects raw
+ *   `r||s`, so no new external dependency is introduced for ES256/ES384.
+ * - RFC 9421 header parsing and signature-base construction are reused from
+ *   `@peac/http-signatures`. The signature base is built with
+ *   `preferSerializedParams: true` so the `@signature-params` line is the exact
+ *   serialized `Signature-Input` value that was signed (RFC 9421 Section 2.5),
+ *   not a reconstructed one. That package's Ed25519-only `verifySignature` is
+ *   intentionally not used.
+ * - `Content-Digest` is verified over the raw request body bytes with no JSON
+ *   canonicalization (UCP binds raw bytes). JCS is only relevant to the separate
+ *   AP2 mandate layer, which is out of scope here.
+ */
+import { parseSignature, buildSignatureBase, signatureBaseToBytes, HttpSignatureError, } from '@peac/http-signatures';
+import { ErrorCodes } from './errors.js';
+import { sha256Bytes } from './util.js';
+import { findSigningKey } from './verify.js';
+/**
+ * ECDSA parameters resolved from a signing key's curve. ES256 (P-256) is
+ * required by UCP; ES384 (P-384) is optional. No other curve is accepted.
+ */
+const CURVE_PARAMS = {
+    'P-256': { alg: 'ES256', hash: 'SHA-256', rawSignatureLength: 64 },
+    'P-384': { alg: 'ES384', hash: 'SHA-384', rawSignatureLength: 96 },
+};
+/**
+ * RFC 9421 ECDSA algorithm tokens mapped to the curve they imply. Used only for
+ * an optional consistency check when a signer redundantly includes `alg`.
+ */
+const ALG_TOKEN_CURVE = {
+    'ecdsa-p256-sha256': 'P-256',
+    'ecdsa-p384-sha384': 'P-384',
+};
+const STATE_CHANGING_METHODS = new Set(['POST', 'PUT', 'DELETE', 'PATCH']);
+/**
+ * Build a failing result with optional evidence fields.
+ */
+function fail(code, message, extra) {
+    return { valid: false, error_code: code, error_message: message, ...extra };
+}
+/**
+ * Case-insensitive header lookup.
+ */
+function getHeader(headers, name) {
+    const lower = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === lower) {
+            return value;
+        }
+    }
+    return undefined;
+}
+/**
+ * Whether the request URL carries a non-empty query string.
+ */
+function hasQueryString(url) {
+    try {
+        return new URL(url).search !== '';
+    }
+    catch {
+        const i = url.indexOf('?');
+        return i !== -1 && i < url.length - 1;
+    }
+}
+// Standard base64 alphabet (RFC 4648 Section 4), with optional terminal
+// padding only (not base64url). Used by the RFC 9530 Content-Digest value.
+const SF_BASE64_ALPHABET = /^[A-Za-z0-9+/]*={0,2}$/;
+const SF_BASE64_CANONICAL_PADDED = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+/**
+ * Validate a Structured Field Byte Sequence value (RFC 9651 Section 3.3.5).
+ *
+ * Uses the RFC 4648 Section 4 base64 alphabet, not base64url. Per RFC 9651
+ * parsing, absent padding may be synthesized on decode; characters outside the
+ * base64 alphabet remain invalid. Accepts valid unpadded standard base64;
+ * rejects base64url (`-`/`_`), misplaced/excess `=`, `length % 4 === 1`,
+ * whitespace, and the empty string. Keep separate from JOSE/JWS handling.
+ */
+function isValidSfBase64(value) {
+    if (value.length === 0)
+        return false;
+    if (!SF_BASE64_ALPHABET.test(value))
+        return false;
+    if (value.includes('=')) {
+        return SF_BASE64_CANONICAL_PADDED.test(value);
+    }
+    return value.length % 4 !== 1;
+}
+/**
+ * Decode an RFC 4648 Section 4 base64 string to bytes, synthesizing absent
+ * padding per RFC 9651 byte-sequence parsing. Returns null on failure. Callers
+ * validate the input with {@link isValidSfBase64} first; this does not accept
+ * base64url. Keep separate from JOSE/JWS handling.
+ */
+function base64ToBytes(b64) {
+    try {
+        const padded = b64.includes('=')
+            ? b64
+            : b64.padEnd(b64.length + ((4 - (b64.length % 4)) % 4), '=');
+        if (typeof Buffer !== 'undefined' && typeof Buffer.from === 'function') {
+            return new Uint8Array(Buffer.from(padded, 'base64'));
+        }
+        const binary = atob(padded);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Constant-time byte-array equality (defense in depth; digests are not secret).
+ */
+function bytesEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a[i] ^ b[i];
+    }
+    return diff === 0;
+}
+/**
+ * Strictly parse an RFC 9530 / RFC 8941 Content-Digest dictionary. Every member
+ * must be exactly `algorithm=:base64:`; a malformed member, a duplicate
+ * algorithm, or an empty value rejects the whole header rather than being
+ * silently ignored. Base64 byte-sequences contain no commas, so splitting the
+ * top-level dictionary on commas is safe.
+ */
+function parseContentDigestStrict(headerValue) {
+    const digests = new Map();
+    const members = headerValue.split(',');
+    for (const raw of members) {
+        const member = raw.trim();
+        if (!member) {
+            return {
+                ok: false,
+                code: ErrorCodes.CONTENT_DIGEST_MALFORMED,
+                message: 'Content-Digest contains an empty member',
+            };
+        }
+        // The value is a Structured Field Byte Sequence (RFC 9651 Section 3.3.5):
+        // RFC 4648 Section 4 standard base64; absent padding may be synthesized during parsing.
+        const match = member.match(/^([A-Za-z0-9-]+)=:([^:]*):$/);
+        if (!match || !isValidSfBase64(match[2])) {
+            return {
+                ok: false,
+                code: ErrorCodes.CONTENT_DIGEST_MALFORMED,
+                message: `Content-Digest member is malformed: ${member}`,
+            };
+        }
+        const algName = match[1].toLowerCase();
+        if (digests.has(algName)) {
+            return {
+                ok: false,
+                code: ErrorCodes.CONTENT_DIGEST_MALFORMED,
+                message: `Content-Digest has a duplicate algorithm: ${algName}`,
+            };
+        }
+        digests.set(algName, match[2]);
+    }
+    if (digests.size === 0) {
+        return {
+            ok: false,
+            code: ErrorCodes.CONTENT_DIGEST_MALFORMED,
+            message: 'Content-Digest header is empty',
+        };
+    }
+    return { ok: true, digests };
+}
+/**
+ * Verify a Content-Digest header against the raw request body bytes (sha-256).
+ */
+function verifyContentDigest(body, headerValue) {
+    if (!headerValue || !headerValue.trim()) {
+        return {
+            ok: false,
+            code: ErrorCodes.CONTENT_DIGEST_MISSING,
+            message: 'Missing Content-Digest header for a request with a body',
+        };
+    }
+    const parsed = parseContentDigestStrict(headerValue);
+    if (!parsed.ok) {
+        return parsed;
+    }
+    const provided = parsed.digests.get('sha-256');
+    if (!provided) {
+        return {
+            ok: false,
+            code: ErrorCodes.CONTENT_DIGEST_UNSUPPORTED,
+            message: `Content-Digest must include sha-256; got: ${[...parsed.digests.keys()].join(', ')}`,
+        };
+    }
+    const providedBytes = base64ToBytes(provided);
+    if (!providedBytes) {
+        return {
+            ok: false,
+            code: ErrorCodes.CONTENT_DIGEST_MALFORMED,
+            message: 'Content-Digest sha-256 value is not valid base64',
+        };
+    }
+    if (!bytesEqual(providedBytes, sha256Bytes(body))) {
+        return {
+            ok: false,
+            code: ErrorCodes.CONTENT_DIGEST_MISMATCH,
+            message: 'Content-Digest does not match the raw request body',
+        };
+    }
+    return { ok: true };
+}
+/**
+ * Components that must be in the signed set for a UCP request (the `ucp-request`
+ * policy; `signature-only` skips this). UCP defines no separate webhook set, so
+ * webhook deliveries use the same requirements, including idempotency-key.
+ */
+function requiredComponents(method, url, headers, hasBody) {
+    const required = ['@method', '@authority', '@path'];
+    if (hasQueryString(url)) {
+        required.push('@query');
+    }
+    if (getHeader(headers, 'ucp-agent') !== undefined) {
+        required.push('ucp-agent');
+    }
+    if (STATE_CHANGING_METHODS.has(method.toUpperCase())) {
+        required.push('idempotency-key');
+    }
+    if (hasBody) {
+        required.push('content-digest', 'content-type');
+    }
+    return required;
+}
+/** A bare RFC 8941 token / sf-key (sufficient for the UCP-Agent members we accept). */
+const SF_KEY = /^[a-z*][a-z0-9_\-.*]*$/;
+const SF_TOKEN = /^[A-Za-z0-9._-]+$/;
+/**
+ * Strictly parse a `UCP-Agent` header. UCP defines it as an RFC 8941 dictionary
+ * with a REQUIRED `profile` member whose value is a quoted HTTPS URL, e.g.
+ * `UCP-Agent: profile="https://platform.example/.well-known/ucp"`. This is a
+ * minimal UCP-scoped parser (not a general structured-field parser): it splits
+ * members (respecting quoted strings), requires each member to be `key=value`
+ * with a well-formed value (quoted string, token, integer, or boolean), requires
+ * exactly one `profile` whose value is a quoted non-empty HTTPS URL, and rejects
+ * duplicates, unquoted/empty/non-HTTPS profiles, and malformed members. It never
+ * fetches the URL.
+ */
+function parseUcpAgentProfile(header) {
+    // Split into dictionary members on commas that are not inside a quoted string.
+    const members = [];
+    let current = '';
+    let inString = false;
+    for (let i = 0; i < header.length; i++) {
+        const ch = header[i];
+        if (ch === '"') {
+            inString = !inString;
+            current += ch;
+        }
+        else if (ch === ',' && !inString) {
+            members.push(current);
+            current = '';
+        }
+        else {
+            current += ch;
+        }
+    }
+    members.push(current);
+    if (inString) {
+        return { ok: false, reason: 'unterminated quoted string' };
+    }
+    let profileUrl;
+    let profileCount = 0;
+    for (const raw of members) {
+        const member = raw.trim();
+        if (member === '') {
+            return { ok: false, reason: 'empty dictionary member' };
+        }
+        const eq = member.indexOf('=');
+        if (eq === -1) {
+            return { ok: false, reason: `malformed member (expected key=value): ${member}` };
+        }
+        const key = member.slice(0, eq).trim();
+        const value = member.slice(eq + 1).trim();
+        if (!SF_KEY.test(key)) {
+            return { ok: false, reason: `malformed member key: ${key}` };
+        }
+        const isQuoted = value.length >= 2 && value.startsWith('"') && value.endsWith('"');
+        const valueOk = isQuoted || SF_TOKEN.test(value) || /^-?\d+$/.test(value) || value === '?0' || value === '?1';
+        if (!valueOk) {
+            return { ok: false, reason: `malformed member value for ${key}` };
+        }
+        if (key === 'profile') {
+            profileCount += 1;
+            if (profileCount > 1) {
+                return { ok: false, reason: 'duplicate profile member' };
+            }
+            if (!isQuoted) {
+                return { ok: false, reason: 'profile value must be a quoted string' };
+            }
+            profileUrl = value.slice(1, -1);
+        }
+    }
+    if (profileUrl === undefined) {
+        return { ok: false, reason: 'missing profile member' };
+    }
+    // Validate the profile URL by parsing it, not by prefix matching.
+    if (/\s/.test(profileUrl)) {
+        return { ok: false, reason: 'profile URL contains whitespace' };
+    }
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(profileUrl);
+    }
+    catch {
+        return { ok: false, reason: 'profile is not a valid URL' };
+    }
+    if (parsedUrl.protocol !== 'https:') {
+        return { ok: false, reason: 'profile must be an https URL' };
+    }
+    if (!parsedUrl.host) {
+        return { ok: false, reason: 'profile URL has no host' };
+    }
+    if (parsedUrl.username !== '' || parsedUrl.password !== '') {
+        return { ok: false, reason: 'profile URL must not contain credentials' };
+    }
+    return { ok: true, profileUrl };
+}
+/**
+ * Verify an ECDSA raw (r||s) signature with WebCrypto using a public JWK.
+ * Returns false on any import/verify failure (never throws for normal failures).
+ */
+async function verifyEcdsaRaw(publicJwk, namedCurve, hash, signature, data) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error('WebCrypto subtle is unavailable in this runtime');
+    }
+    try {
+        const key = await subtle.importKey('jwk', { kty: 'EC', crv: namedCurve, x: publicJwk.x, y: publicJwk.y }, { name: 'ECDSA', namedCurve }, false, ['verify']);
+        return await subtle.verify({ name: 'ECDSA', hash: { name: hash } }, key, signature, data);
+    }
+    catch {
+        // Malformed key material or verification error -> not verifiable.
+        return false;
+    }
+}
+/**
+ * Verify a UCP RFC 9421 HTTP Message Signature.
+ *
+ * Never falls back to the legacy `Request-Signature` / RFC 7797 path.
+ */
+export async function verifyUcpHttpSignature(options) {
+    const { signature_input, signature, method, url, headers, body_bytes, profile, label, component_policy = 'ucp-request', expected_profile_url, } = options;
+    // 1. Presence checks (explicit; distinct error codes).
+    if (!signature_input || !signature_input.trim()) {
+        return fail(ErrorCodes.HTTP_SIGNATURE_INPUT_MISSING, 'Missing Signature-Input header');
+    }
+    if (!signature || !signature.trim()) {
+        return fail(ErrorCodes.HTTP_SIGNATURE_MISSING, 'Missing Signature header');
+    }
+    // 2. Parse RFC 9421 headers. alg and created are optional for UCP; keyid is
+    //    still required by the parser.
+    let parsed;
+    try {
+        parsed = parseSignature(signature_input, signature, label, {
+            requireAlg: false,
+            requireCreated: false,
+        });
+    }
+    catch (err) {
+        const message = err instanceof HttpSignatureError || err instanceof Error
+            ? err.message
+            : 'Failed to parse HTTP signature';
+        return fail(ErrorCodes.HTTP_SIGNATURE_MALFORMED, message);
+    }
+    const params = parsed.params;
+    const covered = params.coveredComponents;
+    // 2a. Preflight the derived request inputs. RFC 9421 derived components must
+    //     reflect real values; an empty method/authority/path would bind nothing.
+    //     UCP is HTTPS-based, so the request URL must be an absolute https URL.
+    // The method must be a valid HTTP token with no surrounding or internal
+    // whitespace (RFC 7230); `@method` binds it verbatim into the signature base.
+    if (!method || method.trim() !== method || !/^[A-Za-z!#$%&'*+.^_`|~-]+$/.test(method)) {
+        return fail(ErrorCodes.HTTP_SIGNATURE_MALFORMED, 'Request method is empty or not a valid token', {
+            keyid: params.keyid,
+        });
+    }
+    let requestUrl;
+    try {
+        requestUrl = new URL(url);
+    }
+    catch {
+        return fail(ErrorCodes.HTTP_SIGNATURE_MALFORMED, 'Request URL must be an absolute URL', {
+            keyid: params.keyid,
+        });
+    }
+    if (requestUrl.protocol !== 'https:') {
+        return fail(ErrorCodes.HTTP_SIGNATURE_MALFORMED, 'Request URL must use https', {
+            keyid: params.keyid,
+        });
+    }
+    if (!requestUrl.host) {
+        return fail(ErrorCodes.HTTP_SIGNATURE_MALFORMED, 'Request URL has no authority', {
+            keyid: params.keyid,
+        });
+    }
+    if (!requestUrl.pathname.startsWith('/')) {
+        return fail(ErrorCodes.HTTP_SIGNATURE_MALFORMED, 'Request path must begin with /', {
+            keyid: params.keyid,
+        });
+    }
+    // 3. Resolve the signing key by keyid -> signing_keys[].kid.
+    const key = findSigningKey(profile, params.keyid);
+    if (!key) {
+        return fail(ErrorCodes.KEY_NOT_FOUND, `Key not found in profile: ${params.keyid}`, {
+            keyid: params.keyid,
+            covered_components: covered,
+        });
+    }
+    // 4. Key must be a public EC key.
+    if (key.kty !== 'EC') {
+        return fail(ErrorCodes.KEY_ALGORITHM_MISMATCH, `Expected EC key, got ${key.kty}`, {
+            keyid: params.keyid,
+        });
+    }
+    if (!key.x || !key.y) {
+        return fail(ErrorCodes.KEY_ALGORITHM_MISMATCH, 'Signing key is missing x/y coordinates', {
+            keyid: params.keyid,
+        });
+    }
+    if (key.d !== undefined) {
+        return fail(ErrorCodes.KEY_ALGORITHM_MISMATCH, 'Signing key must be a public key (private "d" present)', { keyid: params.keyid });
+    }
+    // 5. Resolve the algorithm from the key's curve (UCP does not send alg).
+    const curveParams = CURVE_PARAMS[key.crv];
+    if (!curveParams) {
+        return fail(ErrorCodes.KEY_CURVE_MISMATCH, `Unsupported key curve: ${key.crv} (UCP requires P-256, optionally P-384)`, { keyid: params.keyid });
+    }
+    // 6. If the signer redundantly included alg, it must be consistent with the key.
+    if (params.alg !== undefined) {
+        const expectedCurve = ALG_TOKEN_CURVE[params.alg.toLowerCase()];
+        if (expectedCurve === undefined || expectedCurve !== key.crv) {
+            return fail(ErrorCodes.SIGNATURE_ALGORITHM_UNSUPPORTED, `Signature-Input alg "${params.alg}" is not consistent with key curve ${key.crv}`, { keyid: params.keyid, covered_components: covered });
+        }
+    }
+    // 7. Signature must be fixed-width raw (r||s); DER is rejected by length.
+    if (parsed.signatureBytes.length !== curveParams.rawSignatureLength) {
+        return fail(ErrorCodes.SIGNATURE_MALFORMED, `Expected a ${curveParams.rawSignatureLength}-byte raw (r||s) ${curveParams.alg} signature, ` +
+            `got ${parsed.signatureBytes.length} bytes (DER encoding is not accepted)`, { keyid: params.keyid });
+    }
+    // 8. Enforce the required signed-component policy.
+    const hasBody = body_bytes !== undefined && body_bytes.length > 0;
+    if (component_policy !== 'signature-only') {
+        const required = requiredComponents(method, url, headers, hasBody);
+        // 8a. Each required component must be in the signed set.
+        const uncovered = required.filter((c) => !covered.includes(c));
+        if (uncovered.length > 0) {
+            return fail(ErrorCodes.HTTP_SIGNATURE_COMPONENT_MISSING, `Required signed components missing: ${uncovered.join(', ')}`, { keyid: params.keyid, covered_components: covered });
+        }
+        // 8b. A required header component must also be present and non-empty:
+        //     buildSignatureBase yields '' for a missing header, so signing the name
+        //     alone is not equivalent to signing a real value. content-digest is
+        //     handled in step 9 (so a missing one reports a digest-specific error).
+        const emptyHeaders = required.filter((c) => {
+            if (c.startsWith('@') || c === 'content-digest') {
+                return false;
+            }
+            const value = getHeader(headers, c);
+            return value === undefined || value.trim() === '';
+        });
+        if (emptyHeaders.length > 0) {
+            return fail(ErrorCodes.HTTP_SIGNATURE_COMPONENT_MISSING, `Required signed header(s) absent or empty: ${emptyHeaders.join(', ')}`, { keyid: params.keyid, covered_components: covered });
+        }
+    }
+    // 9. Content-Digest verification over the raw body bytes.
+    const digestHeader = getHeader(headers, 'content-digest');
+    let contentDigestVerified = false;
+    if (hasBody) {
+        const skipForSignatureOnly = component_policy === 'signature-only' &&
+            !(covered.includes('content-digest') && digestHeader);
+        if (!skipForSignatureOnly) {
+            const outcome = verifyContentDigest(body_bytes, digestHeader);
+            if (!outcome.ok) {
+                return fail(outcome.code, outcome.message, {
+                    keyid: params.keyid,
+                    covered_components: covered,
+                });
+            }
+            contentDigestVerified = true;
+        }
+    }
+    else if (component_policy !== 'signature-only' &&
+        (covered.includes('content-digest') || digestHeader !== undefined)) {
+        // A signature covers (or the request carries) a Content-Digest, but no body
+        // was supplied to verify it against. Fail closed.
+        return fail(ErrorCodes.BODY_REQUIRED, 'content-digest is signed or present but no request body was provided to verify it', { keyid: params.keyid, covered_components: covered });
+    }
+    // 10. Build the signature base (exact serialized params) and verify ECDSA.
+    //     buildSignatureBase throws on a duplicate covered component (RFC 9421
+    //     Section 2.5); surface that as a clean malformed result, never a throw.
+    const request = { method, url, headers };
+    let baseBytes;
+    try {
+        const base = buildSignatureBase(request, params, { preferSerializedParams: true });
+        baseBytes = signatureBaseToBytes(base);
+    }
+    catch (err) {
+        return fail(ErrorCodes.HTTP_SIGNATURE_MALFORMED, err instanceof Error ? err.message : 'Invalid signature base', { keyid: params.keyid, covered_components: covered });
+    }
+    let signatureValid;
+    try {
+        signatureValid = await verifyEcdsaRaw({ crv: key.crv, x: key.x, y: key.y }, key.crv, curveParams.hash, parsed.signatureBytes, baseBytes);
+    }
+    catch (err) {
+        return fail(ErrorCodes.VERIFICATION_FAILED, `Signature verification error: ${err instanceof Error ? err.message : String(err)}`, { keyid: params.keyid, covered_components: covered });
+    }
+    if (!signatureValid) {
+        return fail(ErrorCodes.SIGNATURE_INVALID, 'HTTP Message Signature verification failed', {
+            keyid: params.keyid,
+            covered_components: covered,
+            alg: curveParams.alg,
+        });
+    }
+    // 11. Signer-profile handling. UCP-Agent is a signed identity-binding component.
+    //     Under the strict request policy it is validated whenever the header is
+    //     present (not only when a profile is expected); a binding is also enforced
+    //     when expected_profile_url is supplied. Only a SIGNED ucp-agent is trusted.
+    let signerProfileUrl;
+    const agentHeader = getHeader(headers, 'ucp-agent');
+    const mustValidateAgent = expected_profile_url !== undefined ||
+        (component_policy === 'ucp-request' && agentHeader !== undefined);
+    if (mustValidateAgent) {
+        if (!covered.includes('ucp-agent')) {
+            return fail(ErrorCodes.AGENT_MISMATCH, 'UCP-Agent must be a signed component to bind the signer profile', { keyid: params.keyid, covered_components: covered });
+        }
+        if (!agentHeader || !agentHeader.trim()) {
+            return fail(ErrorCodes.AGENT_MISMATCH, 'UCP-Agent header is absent or empty', {
+                keyid: params.keyid,
+            });
+        }
+        const parsedAgent = parseUcpAgentProfile(agentHeader);
+        if (!parsedAgent.ok) {
+            return fail(ErrorCodes.AGENT_MISMATCH, `Invalid UCP-Agent: ${parsedAgent.reason}`, {
+                keyid: params.keyid,
+            });
+        }
+        signerProfileUrl = parsedAgent.profileUrl;
+        if (expected_profile_url !== undefined && signerProfileUrl !== expected_profile_url) {
+            return fail(ErrorCodes.AGENT_MISMATCH, 'UCP-Agent profile does not match the expected profile URL', { keyid: params.keyid });
+        }
+    }
+    return {
+        valid: true,
+        alg: curveParams.alg,
+        keyid: params.keyid,
+        covered_components: covered,
+        content_digest_verified: contentDigestVerified,
+        ...(signerProfileUrl !== undefined ? { signer_profile_url: signerProfileUrl } : {}),
+    };
+}
+//# sourceMappingURL=http-signature.js.map

package/dist/http-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-signature.js","sourceRoot":"","sources":["../src/http-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GAGnB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;;GAGG;AACH,MAAM,YAAY,GAQd;IACF,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,EAAE;IAClE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,EAAE;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,eAAe,GAAsC;IACzD,mBAAmB,EAAE,OAAO;IAC5B,mBAAmB,EAAE,OAAO;CAC7B,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E;;GAEG;AACH,SAAS,IAAI,CACX,IAAe,EACf,OAAe,EACf,KAA6C;IAE7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,OAA+B,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AACpD,MAAM,0BAA0B,GAC9B,kEAAkE,CAAC;AAErE;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC9B,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAMD;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,WAAmB;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEvC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,UAAU,CAAC,wBAAwB;gBACzC,OAAO,EAAE,yCAAyC;aACnD,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,wFAAwF;QACxF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,UAAU,CAAC,wBAAwB;gBACzC,OAAO,EAAE,uCAAuC,MAAM,EAAE;aACzD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,UAAU,CAAC,wBAAwB;gBACzC,OAAO,EAAE,6CAA6C,OAAO,EAAE;aAChE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU,CAAC,wBAAwB;YACzC,OAAO,EAAE,gCAAgC;SAC1C,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAID;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAAgB,EAAE,WAA+B;IAC5E,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU,CAAC,sBAAsB;YACvC,OAAO,EAAE,yDAAyD;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU,CAAC,0BAA0B;YAC3C,OAAO,EAAE,6CAA6C,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC9F,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU,CAAC,wBAAwB;YACzC,OAAO,EAAE,kDAAkD;SAC5D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU,CAAC,uBAAuB;YACxC,OAAO,EAAE,oDAAoD;SAC9D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,MAAc,EACd,GAAW,EACX,OAA+B,EAC/B,OAAgB;IAEhB,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAID,uFAAuF;AACvF,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAErC;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,+EAA+E;IAC/E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,MAAM,EAAE,EAAE,CAAC;QACnF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,EAAE,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnF,MAAM,OAAO,GACX,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC;QAChG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,YAAY,IAAI,CAAC,CAAC;YAClB,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;YAC3D,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;YACxE,CAAC;YACD,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzD,CAAC;IACD,kEAAkE;IAClE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,SAA2D,EAC3D,UAA6B,EAC7B,IAA2B,EAC3B,SAAqB,EACrB,IAAgB;IAEhB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,KAAK,EACL,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,EAC9D,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAC7B,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAsC;IAEtC,MAAM,EACJ,eAAe,EACf,SAAS,EACT,MAAM,EACN,GAAG,EACH,OAAO,EACP,UAAU,EACV,OAAO,EACP,KAAK,EACL,gBAAgB,GAAG,aAAa,EAChC,oBAAoB,GACrB,GAAG,OAAO,CAAC;IAEZ,uDAAuD;IACvD,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,UAAU,CAAC,4BAA4B,EAAE,gCAAgC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,CAAC;IAC7E,CAAC;IAED,4EAA4E;IAC5E,mCAAmC;IACnC,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE;YACzD,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GACX,GAAG,YAAY,kBAAkB,IAAI,GAAG,YAAY,KAAK;YACvD,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,gCAAgC,CAAC;QACvC,OAAO,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAEzC,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CACT,UAAU,CAAC,wBAAwB,EACnC,8CAA8C,EAC9C;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAe,CAAC;IACpB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,qCAAqC,EAAE;YACtF,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,4BAA4B,EAAE;YAC7E,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,8BAA8B,EAAE;YAC/E,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,gCAAgC,EAAE;YACjF,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,6BAA6B,MAAM,CAAC,KAAK,EAAE,EAAE;YACjF,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,kBAAkB,EAAE,OAAO;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,wBAAwB,GAAG,CAAC,GAAG,EAAE,EAAE;YAChF,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,wCAAwC,EAAE;YACvF,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAK,GAAuB,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,IAAI,CACT,UAAU,CAAC,sBAAsB,EACjC,wDAAwD,EACxD,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CACT,UAAU,CAAC,kBAAkB,EAC7B,0BAA0B,GAAG,CAAC,GAAG,yCAAyC,EAC1E,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAChE,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YAC7D,OAAO,IAAI,CACT,UAAU,CAAC,+BAA+B,EAC1C,wBAAwB,MAAM,CAAC,GAAG,sCAAsC,GAAG,CAAC,GAAG,EAAE,EACjF,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;QACpE,OAAO,IAAI,CACT,UAAU,CAAC,mBAAmB,EAC9B,cAAc,WAAW,CAAC,kBAAkB,oBAAoB,WAAW,CAAC,GAAG,cAAc;YAC3F,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,uCAAuC,EAC5E,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IAClE,IAAI,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAEnE,yDAAyD;QACzD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CACT,UAAU,CAAC,gCAAgC,EAC3C,uCAAuC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC7D,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CACrD,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,6EAA6E;QAC7E,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACzC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;QACH,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CACT,UAAU,CAAC,gCAAgC,EAC3C,8CAA8C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACvE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC1D,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,oBAAoB,GACxB,gBAAgB,KAAK,gBAAgB;YACrC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAwB,EAAE,YAAY,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;oBACzC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,kBAAkB,EAAE,OAAO;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,qBAAqB,GAAG,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC;SAAM,IACL,gBAAgB,KAAK,gBAAgB;QACrC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,YAAY,KAAK,SAAS,CAAC,EAClE,CAAC;QACD,4EAA4E;QAC5E,kDAAkD;QAClD,OAAO,IAAI,CACT,UAAU,CAAC,aAAa,EACxB,mFAAmF,EACnF,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CACrD,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,OAAO,GAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC3D,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,UAAU,CAAC,wBAAwB,EACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAC7D,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,cAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,cAAc,CACnC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAwB,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EACzD,GAAG,CAAC,GAAwB,EAC5B,WAAW,CAAC,IAAI,EAChB,MAAM,CAAC,cAAc,EACrB,SAAS,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CACT,UAAU,CAAC,mBAAmB,EAC9B,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACnF,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,4CAA4C,EAAE;YACtF,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,kBAAkB,EAAE,OAAO;YAC3B,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,IAAI,gBAAoC,CAAC;IACzC,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,iBAAiB,GACrB,oBAAoB,KAAK,SAAS;QAClC,CAAC,gBAAgB,KAAK,aAAa,IAAI,WAAW,KAAK,SAAS,CAAC,CAAC;IAEpE,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CACT,UAAU,CAAC,cAAc,EACzB,iEAAiE,EACjE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CACrD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,qCAAqC,EAAE;gBAC5E,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,sBAAsB,WAAW,CAAC,MAAM,EAAE,EAAE;gBACjF,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QACD,gBAAgB,GAAG,WAAW,CAAC,UAAU,CAAC;QAC1C,IAAI,oBAAoB,KAAK,SAAS,IAAI,gBAAgB,KAAK,oBAAoB,EAAE,CAAC;YACpF,OAAO,IAAI,CACT,UAAU,CAAC,cAAc,EACzB,2DAA2D,EAC3D,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,WAAW,CAAC,GAAG;QACpB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,kBAAkB,EAAE,OAAO;QAC3B,uBAAuB,EAAE,qBAAqB;QAC9C,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC"}