@permission-protocol/mcp-guard 0.1.0 → 0.2.0

package/dist/src/proxy.js

@@ -1,25 +1,116 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.derivePreview = derivePreview;
+exports.buildEnrichment = buildEnrichment;
+exports.deriveScope = deriveScope;
 exports.startProxy = startProxy;
 const node_child_process_1 = require("node:child_process");
+const node_path_1 = require("node:path");
 const node_readline_1 = require("node:readline");
+const config_js_1 = require("./config.js");
 const engine_js_1 = require("./engine.js");
 const receipt_js_1 = require("./receipt.js");
+const receipt_verify_js_1 = require("./receipt-verify.js");
+const signer_js_1 = require("./signer.js");
+const verify_core_js_1 = require("./verify-core.js");
 const pending_js_1 = require("./pending.js");
 const approval_server_js_1 = require("./approval-server.js");
-function startProxy(config, agentId, serverCommand, approvalPort) {
+const frame_js_1 = require("./frame.js");
+/**
+ * Derive a one-line summary + the literal artifact preview from the tool name and args,
+ * so the console can render a human-readable card. For capped spends the amount shown is
+ * the argument the rule caps (`amountArg`), the same one the classifier read.
+ */
+function derivePreview(toolName, toolArgs, amountArg) {
+    const args = (toolArgs ?? {});
+    const str = (v) => (v === undefined || v === null ? '' : String(v));
+    switch (toolName) {
+        case 'send_email': {
+            const to = str(args.to ?? args.recipient);
+            const subject = str(args.subject);
+            const body = str(args.body ?? args.text ?? args.message);
+            const summary = `Send email${to ? ` to ${to}` : ''}${subject ? `: ${subject}` : ''}`.trim();
+            return { summary, args_preview: body || subject || JSON.stringify(args) };
+        }
+        case 'post_x':
+        case 'post_tweet': {
+            const text = str(args.text ?? args.body ?? args.message ?? args.content);
+            return { summary: 'Post to X', args_preview: text || JSON.stringify(args) };
+        }
+        case 'spend': {
+            const amount = amountArg ? args[amountArg] : (args.amount_usd ?? args.amount);
+            const payee = str(args.payee ?? args.to ?? args.recipient ?? args.vendor);
+            const amountStr = amount !== undefined ? `$${amount}` : '';
+            const preview = `${amountStr}${payee ? ` → ${payee}` : ''}`.trim();
+            return { summary: `Spend ${preview || JSON.stringify(args)}`, args_preview: preview || JSON.stringify(args) };
+        }
+        default:
+            return { summary: `Call ${toolName}`, args_preview: JSON.stringify(args) };
+    }
+}
+/** Build the enrichment record for the queue from a classified Decision + args. */
+function buildEnrichment(decision, toolName, toolArgs, rule) {
+    const { summary, args_preview } = derivePreview(toolName, toolArgs, rule?.amount_arg);
+    return {
+        lane: decision.lane ?? 'decide',
+        reversibility: decision.reversibility ?? 'irreversible',
+        ...(decision.countdown_seconds !== undefined ? { countdown_seconds: decision.countdown_seconds } : {}),
+        ...(decision.confidence !== undefined ? { confidence: decision.confidence } : {}),
+        summary,
+        args_preview,
+    };
+}
+/**
+ * Derive a receipt scope binding from the tool + args, for the code/infra tools the
+ * offline receipt gate verifies:
+ *   - merge_pr           -> `github:merge`, ref `refs/pull/<n>/merge`
+ *   - run_sql_migration  -> `sql:migrate:<env>`
+ *   - deploy             -> `deploy:<env>`
+ * Other tools carry no scope.
+ */
+function deriveScope(toolName, toolArgs) {
+    const args = (toolArgs ?? {});
+    const str = (v) => (v === undefined || v === null ? undefined : String(v));
+    switch (toolName) {
+        case 'merge_pr': {
+            const prNumber = str(args.pr_number ?? args.pr ?? args.number);
+            return {
+                scope: 'github:merge',
+                scope_ref: prNumber !== undefined ? `refs/pull/${prNumber}/merge` : undefined,
+                scope_sha: str(args.scope_sha ?? args.head_sha ?? args.sha),
+            };
+        }
+        case 'run_sql_migration':
+            return {
+                scope: `sql:migrate:${str(args.env ?? args.environment) ?? 'unknown'}`,
+                scope_ref: str(args.scope_ref ?? args.migration ?? args.migration_id),
+                scope_sha: str(args.scope_sha ?? args.sha),
+            };
+        case 'deploy':
+            return {
+                scope: `deploy:${str(args.env ?? args.environment) ?? 'unknown'}`,
+                scope_ref: str(args.scope_ref ?? args.ref),
+                scope_sha: str(args.scope_sha ?? args.sha),
+            };
+        default:
+            return undefined;
+    }
+}
+function startProxy(config, agentId, serverCommand, opts = {}) {
     if (serverCommand.length === 0) {
         process.stderr.write('[mcp-guard] Error: no server command provided after --\n');
         process.exit(1);
     }
-    const approvalEnabled = approvalPort !== undefined;
-    // Start approval server if enabled
-    if (approvalEnabled) {
-        (0, approval_server_js_1.startApprovalServer)(approvalPort);
-    }
-    const child = (0, node_child_process_1.spawn)(serverCommand[0], serverCommand.slice(1), {
-        stdio: ['pipe', 'pipe', 'inherit'],
-    });
+    // Load the signing key up front: a missing or exposed key stops the guard here
+    // instead of failing open later.
+    const pinnedKeys = { [(0, signer_js_1.currentKeyId)()]: (0, signer_js_1.getPublicKeyPem)() };
+    const replayCache = new verify_core_js_1.ReplayCache();
+    const targetServer = serverCommand.slice(0, 2).map((p) => (0, node_path_1.basename)(p)).join(' ');
+    const approvalEnabled = opts.approvalPort !== undefined;
+    // The server (and anything the agent can make it echo) never sees the guard's own
+    // secrets: approval token, webhook secret, receipt token, key location.
+    const childEnv = Object.fromEntries(Object.entries(process.env).filter(([k]) => !k.startsWith('PP_')));
+    const child = (0, node_child_process_1.spawn)(serverCommand[0], serverCommand.slice(1), { stdio: ['pipe', 'pipe', 'inherit'], env: childEnv });
     child.on('error', (err) => {
         process.stderr.write(`[mcp-guard] Failed to start server: ${err.message}\n`);
         process.exit(1);
@@ -28,119 +119,197 @@ function startProxy(config, agentId, serverCommand, approvalPort) {
         process.stderr.write(`[mcp-guard] Server exited with code ${code}\n`);
         process.exit(code ?? 1);
     });
-    // Track pending approval responses waiting for child stdout
-    const pendingChildResponses = new Map();
-    // Forward child stdout → our stdout (or to pending resolver)
-    const childOut = (0, node_readline_1.createInterface)({ input: child.stdout });
-    childOut.on('line', (line) => {
-        // Check if this is a response to a forwarded approval
-        try {
-            const parsed = JSON.parse(line);
-            const id = parsed.id;
-            if (id != null && pendingChildResponses.has(id)) {
-                const resolver = pendingChildResponses.get(id);
-                pendingChildResponses.delete(id);
-                resolver(line);
+    const toClient = (line) => { process.stdout.write(line + '\n'); };
+    const toServer = (msg) => { child.stdin.write(JSON.stringify(msg) + '\n'); };
+    // Server → client traffic is passed through unchanged.
+    (0, node_readline_1.createInterface)({ input: child.stdout }).on('line', toClient);
+    function record(method, tool, args, decision, approval, actor) {
+        const receipt = (0, receipt_js_1.issueReceipt)({
+            method,
+            tool,
+            args,
+            decision,
+            approval,
+            actor,
+            mode: config.mode,
+            policy_sha256: config.policy_sha256,
+            ttl_seconds: config.receipt_ttl_seconds,
+            target_server: targetServer,
+            scope: tool ? deriveScope(tool, args) : undefined,
+        });
+        (0, receipt_js_1.emitReceipt)(receipt);
+        if (approvalEnabled)
+            (0, approval_server_js_1.pushReceipt)(receipt);
+        return receipt;
+    }
+    /**
+     * The single release path for held requests (manual approve and countdown): issue the
+     * signed receipt, verify it against the pinned key, and only then forward.
+     */
+    function release(action, approval) {
+        const tool = action.method === config_js_1.TOOLS_CALL ? action.tool_name : null;
+        const decision = {
+            decision: 'allowed',
+            rule_id: action.rule_id,
+            reason: `Released by ${approval.kind} "${approval.id}" (${approval.via})`,
+        };
+        const receipt = record(action.method, tool, action.tool_args, decision, approval, action.agent_id);
+        const check = (0, receipt_verify_js_1.verifyReceipt)(receipt, pinnedKeys, { replayCache, allowPolicyApproval: true });
+        if (!check.valid) {
+            action.resolve((0, frame_js_1.errorLine)(action.jsonrpcId, frame_js_1.RELEASE_FAILED, `Release refused: ${check.reasons.join(' ')}`));
+            throw new Error(`release refused for ${action.id}: ${check.reasons.join(' ')}`);
+        }
+        action.receipt_id = receipt.envelope.receipt_id;
+        child.stdin.write(action.forwardLine + '\n');
+        return receipt;
+    }
+    if (approvalEnabled) {
+        const server = (0, approval_server_js_1.startApprovalServer)({
+            port: opts.approvalPort,
+            operator: opts.operator,
+            hooks: { release },
+            receiptTtlSeconds: config.receipt_ttl_seconds,
+            policySha256: config.policy_sha256,
+        });
+        server.ready.catch((err) => {
+            process.stderr.write(`[mcp-guard] Approval server failed to start: ${err.message}\n`);
+            process.exit(1);
+        });
+        (0, pending_js_1.setAutoReleaseHandler)((action) => {
+            process.stderr.write(`[mcp-guard] Auto-released (countdown) "${action.tool_name}" (${action.id})\n`);
+            try {
+                release(action, { kind: 'policy', id: action.rule_id ?? 'default_action', via: 'countdown' });
+            }
+            catch (err) {
+                process.stderr.write(`[mcp-guard] ${err.message}\n`);
+            }
+            (0, approval_server_js_1.notifyQueueChange)();
+        });
+        (0, pending_js_1.setExpireHandler)((action) => {
+            process.stderr.write(`[mcp-guard] Expired without a decision: "${action.tool_name}" (${action.id})\n`);
+            if (action.kind === 'held')
+                action.resolve((0, frame_js_1.errorLine)(action.jsonrpcId, frame_js_1.EXPIRED, 'Approval request expired without a decision'));
+            (0, approval_server_js_1.notifyQueueChange)();
+        });
+    }
+    function gate(msg, isRequest) {
+        const id = msg.id ?? null;
+        const reply = (line) => { if (isRequest)
+            toClient(line); };
+        let tool = null;
+        let args;
+        if (msg.method === config_js_1.TOOLS_CALL) {
+            const target = (0, frame_js_1.toolCallTarget)(msg.params);
+            if ('error' in target) {
+                reply((0, frame_js_1.errorLine)(id, frame_js_1.INVALID_PARAMS, target.error));
                 return;
             }
+            tool = target.name;
+            args = target.args;
         }
-        catch {
-            // not JSON, pass through
+        const decision = (0, engine_js_1.evaluate)(tool, args, config, msg.method);
+        const rule = decision.rule_id ? config.rules.find((r) => r.id === decision.rule_id) ?? null : null;
+        const forward = (0, frame_js_1.stripAgentMetadata)(msg);
+        // What the server will act on: tool arguments for tools/call, the params otherwise.
+        // This is what the approver sees and what the receipt hashes.
+        const forwardArgs = tool
+            ? forward.params.arguments
+            : forward.params === undefined ? undefined
+                : Array.isArray(forward.params) ? { params: forward.params }
+                    : forward.params;
+        const label = tool ?? msg.method;
+        const policyApproval = decision.decision === 'allowed'
+            ? { kind: 'policy', id: decision.rule_id ?? 'default_action', via: decision.lane === 'verify' ? 'standing_rule' : 'rule' }
+            : null;
+        const receipt = record(msg.method, tool, forwardArgs, decision, policyApproval, agentId);
+        if (!isRequest) {
+            // A notification gets no response, so it can neither be held nor told it was blocked.
+            if (decision.decision === 'allowed' || config.mode === 'observe')
+                toServer(forward);
+            else
+                process.stderr.write(`[mcp-guard] Dropped ${decision.decision} notification "${label}"\n`);
+            return;
         }
-        process.stdout.write(line + '\n');
-    });
-    // Set up approval callback — when UI approves, forward original request to child
-    if (approvalEnabled) {
-        (0, approval_server_js_1.setOnApprove)((actionId) => {
-            const action = (0, pending_js_1.getAction)(actionId);
-            if (!action)
-                return;
-            // Register a listener for the child's response
-            if (action.jsonrpcId != null) {
-                pendingChildResponses.set(action.jsonrpcId, (responseLine) => {
-                    action.resolve(responseLine);
+        if (config.mode === 'observe') {
+            if (decision.decision !== 'allowed') {
+                process.stderr.write(`[mcp-guard] OBSERVE: would ${decision.decision === 'blocked' ? 'block' : 'hold'} "${label}" but forwarding (observe mode)\n`);
+            }
+            toServer(forward);
+            return;
+        }
+        if (decision.decision === 'allowed') {
+            toServer(forward);
+            if (approvalEnabled && decision.lane === 'verify') {
+                const surfaced = (0, pending_js_1.surfaceActed)({
+                    method: msg.method,
+                    toolName: label,
+                    toolArgs: forwardArgs,
+                    agentId,
+                    ruleId: decision.rule_id,
+                    enrichment: buildEnrichment(decision, label, forwardArgs, rule),
+                    receiptId: receipt.envelope.receipt_id,
+                    ttlSeconds: config.approval_ttl_seconds,
                 });
+                (0, approval_server_js_1.notifyQueueChange)();
+                process.stderr.write(`[mcp-guard] Surfaced acted "${label}" in Verify (${surfaced.id})\n`);
             }
-            // Forward the original request to the child server
-            child.stdin.write(action.originalLine + '\n');
+            return;
+        }
+        if (decision.decision === 'blocked') {
+            toClient((0, frame_js_1.errorLine)(id, frame_js_1.BLOCKED, `Blocked: ${decision.reason}`));
+            return;
+        }
+        // held_for_approval
+        if (!approvalEnabled) {
+            toClient((0, frame_js_1.errorLine)(id, frame_js_1.HELD, `Held for approval: ${decision.reason}`));
+            return;
+        }
+        const pending = (0, pending_js_1.addPending)({
+            method: msg.method,
+            toolName: label,
+            toolArgs: forwardArgs,
+            agentId,
+            ruleId: decision.rule_id,
+            forwardLine: JSON.stringify(forward),
+            jsonrpcId: id,
+            resolve: toClient,
+            enrichment: buildEnrichment(decision, label, forwardArgs, rule),
+            ttlSeconds: config.approval_ttl_seconds,
+            ...(tool ? deriveScope(tool, forwardArgs) : {}),
         });
+        (0, approval_server_js_1.notifyQueueChange)();
+        process.stderr.write(`[mcp-guard] Held "${label}" for approval (${pending.id})\n`);
     }
-    // Read our stdin, inspect, and forward or reject
+    // Client → server: parse, gate, and forward only what was evaluated.
     const stdinRL = (0, node_readline_1.createInterface)({ input: process.stdin });
     stdinRL.on('line', (line) => {
         if (!line.trim())
             return;
-        let msg;
-        try {
-            msg = JSON.parse(line);
-        }
-        catch {
-            // Not valid JSON — forward as-is
-            child.stdin.write(line + '\n');
-            return;
-        }
-        if (msg.method === 'tools/call') {
-            const toolName = msg.params?.name ?? 'unknown';
-            const toolArgs = msg.params?.arguments;
-            const decision = (0, engine_js_1.evaluate)(toolName, toolArgs, config);
-            const serverName = serverCommand.join(' ');
-            const receipt = (0, receipt_js_1.createReceipt)(agentId, toolName, decision, msg.params, serverName, config.mode);
-            (0, receipt_js_1.emitReceipt)(receipt);
-            if (approvalEnabled)
-                (0, approval_server_js_1.pushReceipt)(receipt);
-            // In observe mode, always forward (log only, don't block)
-            if (config.mode === 'observe') {
-                if (decision.decision !== 'allowed') {
-                    process.stderr.write(`[mcp-guard] OBSERVE: would ${decision.decision === 'blocked' ? 'block' : 'hold'} "${toolName}" but forwarding (observe mode)\n`);
-                }
-                child.stdin.write(line + '\n');
-            }
-            else if (decision.decision === 'allowed') {
-                child.stdin.write(line + '\n');
-            }
-            else if (decision.decision === 'blocked') {
-                const errResp = {
-                    jsonrpc: '2.0',
-                    id: msg.id ?? null,
-                    error: {
-                        code: -32001,
-                        message: `Blocked: ${decision.reason}`,
-                    },
-                };
-                process.stdout.write(JSON.stringify(errResp) + '\n');
-            }
-            else {
-                // held_for_approval
-                if (approvalEnabled) {
-                    // Hold the response — add to pending queue
-                    const pending = (0, pending_js_1.addPending)(toolName, toolArgs, agentId, decision.rule_id ?? 'unknown', line, msg.id ?? null, (responseLine) => {
-                        process.stdout.write(responseLine + '\n');
-                    });
-                    process.stderr.write(`[mcp-guard] Held "${toolName}" for approval (${pending.id}) — approve at UI\n`);
-                }
-                else {
-                    // No approval server — return error immediately (original behavior)
-                    const errResp = {
-                        jsonrpc: '2.0',
-                        id: msg.id ?? null,
-                        error: {
-                            code: -32002,
-                            message: `Held for approval: ${decision.reason}`,
-                        },
-                    };
-                    process.stdout.write(JSON.stringify(errResp) + '\n');
-                }
-            }
-        }
-        else {
-            // Pass through all non-tools/call methods
-            child.stdin.write(line + '\n');
+        const frame = (0, frame_js_1.parseFrame)(line);
+        switch (frame.kind) {
+            case 'invalid':
+                toClient((0, frame_js_1.errorLine)(frame.id, frame.code, frame.message));
+                return;
+            case 'response':
+                toServer(frame.msg);
+                return;
+            case 'notification':
+                if ((0, frame_js_1.isPassthrough)(frame.msg.method))
+                    toServer(frame.msg);
+                else
+                    gate(frame.msg, false);
+                return;
+            case 'request':
+                if ((0, frame_js_1.isPassthrough)(frame.msg.method))
+                    toServer(frame.msg);
+                else
+                    gate(frame.msg, true);
+                return;
         }
     });
     stdinRL.on('close', () => {
         child.stdin.end();
     });
-    // Handle signals gracefully
     process.on('SIGINT', () => child.kill('SIGINT'));
     process.on('SIGTERM', () => child.kill('SIGTERM'));
 }

package/dist/src/proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":";;AAwBA,gCAoJC;AA5KD,2DAA8D;AAC9D,iDAAgD;AAEhD,2CAAuC;AACvC,6CAA0D;AAC1D,6CAAqD;AACrD,6DAAsF;AAkBtF,SAAgB,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,aAAuB,EAAE,YAAqB;IACxG,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,eAAe,GAAG,YAAY,KAAK,SAAS,CAAC;IAEnD,mCAAmC;IACnC,IAAI,eAAe,EAAE,CAAC;QACpB,IAAA,wCAAmB,EAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,KAAK,GAAiB,IAAA,0BAAK,EAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAC1E,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;KACnC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,IAAI,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,MAAM,qBAAqB,GAAiD,IAAI,GAAG,EAAE,CAAC;IAEtF,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAA,+BAAe,EAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAO,EAAE,CAAC,CAAC;IAC3D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3B,sDAAsD;QACtD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;YACrB,IAAI,EAAE,IAAI,IAAI,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;gBAChD,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,IAAI,eAAe,EAAE,CAAC;QACpB,IAAA,iCAAY,EAAC,CAAC,QAAgB,EAAE,EAAE;YAChC,MAAM,MAAM,GAAG,IAAA,sBAAS,EAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,+CAA+C;YAC/C,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC7B,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,YAAoB,EAAE,EAAE;oBACnE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC/B,CAAC,CAAC,CAAC;YACL,CAAC;YACD,mDAAmD;YACnD,KAAK,CAAC,KAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,MAAM,OAAO,GAAG,IAAA,+BAAe,EAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO;QAEzB,IAAI,GAAmB,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;YACjC,KAAK,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAW,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,SAAS,CAAC;YACvD,MAAM,QAAQ,GAAwC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC;YAC5E,MAAM,QAAQ,GAAG,IAAA,oBAAQ,EAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAChG,IAAA,wBAAW,EAAC,OAAO,CAAC,CAAC;YACrB,IAAI,eAAe;gBAAE,IAAA,gCAAW,EAAC,OAAO,CAAC,CAAC;YAE1C,0DAA0D;YAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,mCAAmC,CAAC,CAAC;gBACzJ,CAAC;gBACD,KAAK,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAClC,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3C,KAAK,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAClC,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAiB;oBAC5B,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI;oBAClB,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,YAAY,QAAQ,CAAC,MAAM,EAAE;qBACvC;iBACF,CAAC;gBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,oBAAoB;gBACpB,IAAI,eAAe,EAAE,CAAC;oBACpB,2CAA2C;oBAC3C,MAAM,OAAO,GAAG,IAAA,uBAAU,EACxB,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,QAAQ,CAAC,OAAO,IAAI,SAAS,EAC7B,IAAI,EACJ,GAAG,CAAC,EAAE,IAAI,IAAI,EACd,CAAC,YAAoB,EAAE,EAAE;wBACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;oBAC5C,CAAC,CACF,CAAC;oBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,QAAQ,mBAAmB,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC;gBACxG,CAAC;qBAAM,CAAC;oBACN,oEAAoE;oBACpE,MAAM,OAAO,GAAiB;wBAC5B,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI;wBAClB,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EAAE,sBAAsB,QAAQ,CAAC,MAAM,EAAE;yBACjD;qBACF,CAAC;oBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,KAAK,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACvB,KAAK,CAAC,KAAM,CAAC,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,4BAA4B;IAC5B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":";;AAqCA,sCA+BC;AAGD,0CAeC;AAUD,kCA4BC;AAOD,gCAsOC;AAzWD,2DAA8D;AAC9D,yCAAqC;AACrC,iDAAgD;AAChD,2CAAiE;AACjE,2CAAsD;AACtD,6CAAyG;AACzG,2DAAoD;AACpD,2CAA4D;AAC5D,qDAAgE;AAChE,6CAOsB;AACtB,6DAA2F;AAC3F,yCAYoB;AAEpB;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,QAAgB,EAChB,QAA6C,EAC7C,SAAkB;IAElB,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAwB,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAErF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAC5F,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,CAAC;QACD,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1E,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,GAAG,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,SAAS,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAChH,CAAC;QACD;YACE,OAAO,EAAE,OAAO,EAAE,QAAQ,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAgB,eAAe,CAC7B,QAAkB,EAClB,QAAgB,EAChB,QAA6C,EAC7C,IAAkB;IAElB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACtF,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ;QAC/B,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,cAAc;QACvD,GAAG,CAAC,QAAQ,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,OAAO;QACP,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,QAAgB,EAAE,QAA6C;IACzF,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAwB,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAExG,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/D,OAAO;gBACL,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,QAAQ,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC7E,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC;aAC5D,CAAC;QACJ,CAAC;QACD,KAAK,mBAAmB;YACtB,OAAO;gBACL,KAAK,EAAE,eAAe,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,SAAS,EAAE;gBACtE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC;gBACrE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC;aAC3C,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO;gBACL,KAAK,EAAE,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,SAAS,EAAE;gBACjE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC;gBAC1C,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC;aAC3C,CAAC;QACJ;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAOD,SAAgB,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,aAAuB,EAAE,OAAqB,EAAE;IAC1G,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,+EAA+E;IAC/E,iCAAiC;IACjC,MAAM,UAAU,GAAe,EAAE,CAAC,IAAA,wBAAY,GAAE,CAAC,EAAE,IAAA,2BAAe,GAAE,EAAE,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,4BAAW,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAQ,EAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;IAExD,kFAAkF;IAClF,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,KAAK,GAAiB,IAAA,0BAAK,EAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnI,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,IAAI,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,CAAC,GAAmB,EAAQ,EAAE,GAAG,KAAK,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpG,uDAAuD;IACvD,IAAA,+BAAe,EAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAO,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/D,SAAS,MAAM,CACb,MAAc,EACd,IAAmB,EACnB,IAAyC,EACzC,QAAkB,EAClB,QAAyB,EACzB,KAAa;QAEb,MAAM,OAAO,GAAG,IAAA,yBAAY,EAAC;YAC3B,MAAM;YACN,IAAI;YACJ,IAAI;YACJ,QAAQ;YACR,QAAQ;YACR,KAAK;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,mBAAmB;YACvC,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;QACH,IAAA,wBAAW,EAAC,OAAO,CAAC,CAAC;QACrB,IAAI,eAAe;YAAE,IAAA,gCAAW,EAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,SAAS,OAAO,CAAC,MAAqB,EAAE,QAAkB;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,sBAAU,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,MAAM,QAAQ,GAAa;YACzB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,eAAe,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,GAAG,GAAG;SAC1E,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,IAAA,iCAAa,EAAC,OAAO,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,CAAC,IAAA,oBAAS,EAAC,MAAM,CAAC,SAAS,EAAE,yBAAc,EAAE,oBAAoB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3G,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChD,KAAK,CAAC,KAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC;YACjC,IAAI,EAAE,IAAI,CAAC,YAAa;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,EAAE,OAAO,EAAE;YAClB,iBAAiB,EAAE,MAAM,CAAC,mBAAmB;YAC7C,YAAY,EAAE,MAAM,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,IAAA,kCAAqB,EAAC,CAAC,MAAM,EAAE,EAAE;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,MAAM,CAAC,SAAS,MAAM,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACrG,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACvD,CAAC;YACD,IAAA,sCAAiB,GAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAA,6BAAgB,EAAC,CAAC,MAAM,EAAE,EAAE;YAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,MAAM,CAAC,SAAS,MAAM,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACvG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;gBAAE,MAAM,CAAC,OAAO,CAAC,IAAA,oBAAS,EAAC,MAAM,CAAC,SAAS,EAAE,kBAAO,EAAE,6CAA6C,CAAC,CAAC,CAAC;YAChI,IAAA,sCAAiB,GAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,IAAI,CAAC,GAAwC,EAAE,SAAkB;QACxE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE,GAAG,IAAI,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzE,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,IAAI,IAAyC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,sBAAU,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAA,yBAAc,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAA,oBAAS,EAAC,EAAE,EAAE,yBAAc,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACtF,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACnB,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,oBAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACnG,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,GAAG,CAAC,CAAC;QACxC,oFAAoF;QACpF,8DAA8D;QAC9D,MAAM,WAAW,GAAwC,IAAI;YAC3D,CAAC,CAAE,OAAO,CAAC,MAAkD,CAAC,SAAS;YACvE,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;gBAC1C,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;oBAC5D,CAAC,CAAE,OAAO,CAAC,MAAkC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;QACjC,MAAM,cAAc,GAClB,QAAQ,CAAC,QAAQ,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,IAAI,gBAAgB,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE;YAC1H,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QAEzF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,sFAAsF;YACtF,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;;gBAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,QAAQ,CAAC,QAAQ,kBAAkB,KAAK,KAAK,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,mCAAmC,CAAC,CAAC;YACtJ,CAAC;YACD,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClB,IAAI,eAAe,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,QAAQ,GAAG,IAAA,yBAAY,EAAC;oBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,WAAW;oBACrB,OAAO;oBACP,MAAM,EAAE,QAAQ,CAAC,OAAO;oBACxB,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC;oBAC/D,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU;oBACtC,UAAU,EAAE,MAAM,CAAC,oBAAoB;iBACxC,CAAC,CAAC;gBACH,IAAA,sCAAiB,GAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,gBAAgB,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAA,oBAAS,EAAC,EAAE,EAAE,kBAAO,EAAE,YAAY,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAA,oBAAS,EAAC,EAAE,EAAE,eAAI,EAAE,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,uBAAU,EAAC;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,WAAW;YACrB,OAAO;YACP,MAAM,EAAE,QAAQ,CAAC,OAAO;YACxB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,QAAQ;YACjB,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC;YAC/D,UAAU,EAAE,MAAM,CAAC,oBAAoB;YACvC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,IAAA,sCAAiB,GAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,mBAAmB,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACrF,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAA,+BAAe,EAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO;QACzB,MAAM,KAAK,GAAG,IAAA,qBAAU,EAAC,IAAI,CAAC,CAAC;QAC/B,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,SAAS;gBACZ,QAAQ,CAAC,IAAA,oBAAS,EAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzD,OAAO;YACT,KAAK,UAAU;gBACb,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpB,OAAO;YACT,KAAK,cAAc;gBACjB,IAAI,IAAA,wBAAa,EAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;;oBACpD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC5B,OAAO;YACT,KAAK,SAAS;gBACZ,IAAI,IAAA,wBAAa,EAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;;oBACpD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC3B,OAAO;QACX,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACvB,KAAK,CAAC,KAAM,CAAC,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/src/receipt-verify.d.ts

@@ -0,0 +1,36 @@
+import { type Receipt } from './receipt.js';
+import { type PinnedKeys, type ReplayCache } from './verify-core.js';
+/**
+ * OFFLINE receipt verifier — the deploy-gate side of "the receipt is the bridge".
+ *
+ * Given a receipt and the PINNED public keys, decide with no network whether the
+ * receipt authorizes an action. Checks:
+ *   1. receipt v2 with a well-formed envelope,
+ *   2. Ed25519 signature over the canonical envelope, by a pinned key,
+ *   3. decision is `allowed` with a recorded approval,
+ *   4. not expired (expires_at is required),
+ *   5. a scoped receipt was approved by a human (unless the caller allows policy approval),
+ *   6. (optional) scope / scope_ref / scope_sha exactly match the gate's expectation,
+ *   7. (optional) its nonce has not been used before.
+ *
+ * Fail-closed: any failed check yields `valid: false` with reasons. Only the envelope is
+ * read; the unsigned `display` block is ignored.
+ */
+export interface ExpectedScope {
+    scope?: string;
+    scope_ref?: string;
+    scope_sha?: string;
+}
+export interface VerifyOptions {
+    expected?: ExpectedScope;
+    now?: Date;
+    /** Accept policy approvals (countdown, standing rule) on scoped receipts. Default false. */
+    allowPolicyApproval?: boolean;
+    /** When given, the receipt's nonce is consumed; a second use fails. */
+    replayCache?: ReplayCache;
+}
+export interface VerifyResult {
+    valid: boolean;
+    reasons: string[];
+}
+export declare function verifyReceipt(receipt: Receipt, keys: PinnedKeys, opts?: VerifyOptions): VerifyResult;

package/dist/src/receipt-verify.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyReceipt = verifyReceipt;
+const receipt_js_1 = require("./receipt.js");
+const verify_core_js_1 = require("./verify-core.js");
+const STRING_FIELDS = [
+    'receipt_id', 'method', 'args_sha256', 'decision', 'actor', 'policy_sha256', 'mode', 'issued_at', 'expires_at', 'nonce', 'key_id',
+];
+function envelopeShapeErrors(e) {
+    const errs = [];
+    if (!e || typeof e !== 'object' || Array.isArray(e))
+        return ['envelope missing'];
+    for (const f of STRING_FIELDS)
+        if (typeof e[f] !== 'string' || !e[f])
+            errs.push(`${f} missing`);
+    if (e.tool !== null && typeof e.tool !== 'string')
+        errs.push('tool invalid');
+    if (e.rule_id !== null && typeof e.rule_id !== 'string')
+        errs.push('rule_id invalid');
+    if (e.scope !== null) {
+        const s = e.scope;
+        if (!s || typeof s !== 'object' || typeof s.scope !== 'string'
+            || (s.ref !== null && typeof s.ref !== 'string') || (s.sha !== null && typeof s.sha !== 'string')) {
+            errs.push('scope invalid');
+        }
+    }
+    if (e.approval !== null) {
+        const a = e.approval;
+        if (!a || typeof a !== 'object' || (a.kind !== 'human' && a.kind !== 'policy') || typeof a.id !== 'string' || typeof a.via !== 'string') {
+            errs.push('approval invalid');
+        }
+    }
+    return errs;
+}
+function verifyReceipt(receipt, keys, opts = {}) {
+    const reasons = [];
+    const now = opts.now ?? new Date();
+    const e = receipt?.envelope;
+    if (!e || e.v !== receipt_js_1.RECEIPT_VERSION) {
+        return { valid: false, reasons: [`PP_UNSUPPORTED_VERSION: expected receipt v${receipt_js_1.RECEIPT_VERSION}.`] };
+    }
+    const shape = envelopeShapeErrors(e);
+    if (shape.length) {
+        return { valid: false, reasons: [`PP_MALFORMED_RECEIPT: ${shape.join(', ')}.`] };
+    }
+    // Signature over the canonical envelope, by a pinned key that the envelope also names.
+    const sig = receipt.signature;
+    if (!sig || sig.alg !== 'ed25519' || sig.key_id !== e.key_id) {
+        reasons.push('PP_INVALID_SIGNATURE: signature block missing, not Ed25519, or key_id differs from the envelope.');
+    }
+    else {
+        const err = (0, verify_core_js_1.verifyDetached)((0, receipt_js_1.signingBytes)(e), sig.value, e.key_id, keys);
+        if (err)
+            reasons.push(`PP_INVALID_SIGNATURE: ${err}.`);
+    }
+    if (e.decision !== 'allowed' || !e.approval) {
+        reasons.push(`PP_NOT_AUTHORIZED: decision is "${e.decision}"${e.approval ? '' : ' with no approval'}.`);
+    }
+    const issued = Date.parse(e.issued_at);
+    const expires = Date.parse(e.expires_at);
+    if (Number.isNaN(issued) || Number.isNaN(expires) || expires <= issued) {
+        reasons.push('PP_EXPIRED: issued_at / expires_at invalid.');
+    }
+    else if (expires <= now.getTime()) {
+        reasons.push(`PP_EXPIRED: receipt expired at ${new Date(expires).toISOString()} (now ${now.toISOString()}).`);
+    }
+    if (e.scope && e.approval && e.approval.kind !== 'human' && !opts.allowPolicyApproval) {
+        reasons.push(`PP_APPROVAL_NOT_HUMAN: scoped action was authorized by ${e.approval.kind} "${e.approval.id}" (${e.approval.via}), not a human.`);
+    }
+    if (opts.expected) {
+        const actual = {
+            scope: e.scope?.scope ?? null,
+            scope_ref: e.scope?.ref ?? null,
+            scope_sha: e.scope?.sha ?? null,
+        };
+        for (const field of ['scope', 'scope_ref', 'scope_sha']) {
+            const want = opts.expected[field];
+            if (want !== undefined && actual[field] !== want) {
+                reasons.push(`PP_SCOPE_MISMATCH: expected ${field}="${want}" but receipt has ${field}="${actual[field] ?? ''}".`);
+            }
+        }
+    }
+    if (reasons.length === 0 && opts.replayCache && !opts.replayCache.use(`${e.receipt_id}:${e.nonce}`)) {
+        reasons.push('PP_REPLAYED: this receipt has already been used.');
+    }
+    return { valid: reasons.length === 0, reasons };
+}
+//# sourceMappingURL=receipt-verify.js.map

package/dist/src/receipt-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-verify.js","sourceRoot":"","sources":["../../src/receipt-verify.ts"],"names":[],"mappings":";;AAkEA,sCAyDC;AA3HD,6CAAiG;AACjG,qDAAqF;AAuCrF,MAAM,aAAa,GAAG;IACpB,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ;CACzH,CAAC;AAEX,SAAS,mBAAmB,CAAC,CAAM;IACjC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,aAAa;QAAE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChG,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAClB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;eACzD,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YACpG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACxI,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,aAAa,CAAC,OAAgB,EAAE,IAAgB,EAAE,OAAsB,EAAE;IACxF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,CAAC,GAAI,OAAe,EAAE,QAAuC,CAAC;IAEpE,IAAI,CAAC,CAAC,IAAK,CAAS,CAAC,CAAC,KAAK,4BAAe,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,6CAA6C,4BAAe,GAAG,CAAC,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,yBAAyB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,CAAC;IAED,uFAAuF;IACvF,MAAM,GAAG,GAAI,OAAe,CAAC,SAAS,CAAC;IACvC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;IACnH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,IAAA,+BAAc,EAAC,IAAA,yBAAY,EAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvE,IAAI,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,kCAAkC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,SAAS,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACtF,OAAO,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,CAAC;IACjJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAA+C;YACzD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI;YAC7B,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI;YAC/B,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI;SAChC,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAU,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,KAAK,IAAI,qBAAqB,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC"}