@proof-holdings/sdk 0.0.0-stage → 1.2.0

package/dist/cjs/jwks/keyset.js

@@ -0,0 +1,503 @@
+"use strict";
+/**
+ * LOCKSTEP COPY of `packages/delegation-verifier/src/keyset.ts` — the key-rotation rules, free of
+ * I/O. Everything below the imports must stay byte-identical to that file:
+ * `src/__tests__/drift/jwks-rotation-fixtures.test.ts` in the repository root fails otherwise, and
+ * `sdks/shared/fixtures/jwks_rotation/` pins the outcome of each rule across all five verifiers.
+ * Change a rule there, then copy it here; do not edit this file on its own.
+ *
+ * The persistence half (`serializeKeySetState` and friends) is carried along unused: this SDK keeps
+ * its key set in memory only, but trimming the copy would turn "identical" into "identical except".
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOMBSTONE_RETENTION_SECONDS = exports.CONFIRM_SPACING_MS = exports.KEY_WINDOW_SKEW_SECONDS = exports.KEY_FAMILIES = void 0;
+exports.emptyKeySetState = emptyKeySetState;
+exports.parseKeyRecord = parseKeyRecord;
+exports.isRegistryLive = isRegistryLive;
+exports.mergeFetchedDocument = mergeFetchedDocument;
+exports.selectKeys = selectKeys;
+exports.checkKeyPolicy = checkKeyPolicy;
+exports.withPersistedTombstones = withPersistedTombstones;
+exports.withConfirmedKeysOnly = withConfirmedKeysOnly;
+exports.withoutTombstones = withoutTombstones;
+exports.serializeKeySetState = serializeKeySetState;
+exports.deserializeKeySetState = deserializeKeySetState;
+const support_js_1 = require("./support.js");
+exports.KEY_FAMILIES = ['proof', 'delegation', 'status-list'];
+/** Clock skew tolerated on each edge of a key's `[not_before, not_after]` window. */
+exports.KEY_WINDOW_SKEW_SECONDS = 300;
+/** Minimum spacing between the two fetches that confirm a key, a narrowed window or a tombstone. */
+exports.CONFIRM_SPACING_MS = 5 * 60000;
+/** An applied tombstone is kept until `revoked_at` plus this. */
+exports.TOMBSTONE_RETENTION_SECONDS = 365 * 86400;
+function emptyKeySetState() {
+    return {
+        keys: new Map(),
+        anonymous: [],
+        pending: new Map(),
+        applied: new Map(),
+        fetchedAt: null,
+        fetchedAtUntrusted: false,
+    };
+}
+function isWholeNumber(value) {
+    return typeof value === 'number' && Number.isInteger(value);
+}
+function isKeyFamily(value) {
+    return typeof value === 'string' && exports.KEY_FAMILIES.includes(value);
+}
+const MATERIAL_MEMBERS = ['kty', 'crv', 'x', 'y', 'n', 'e'];
+function fingerprintOf(jwk) {
+    return JSON.stringify(MATERIAL_MEMBERS.map((member) => jwk[member] ?? null));
+}
+function usageOf(jwk) {
+    return JSON.stringify([jwk.alg ?? null, jwk.use ?? null, jwk.key_ops ?? null]);
+}
+function parseKeyRecord(jwk, firstSeen) {
+    const record = {
+        jwk,
+        fingerprint: fingerprintOf(jwk),
+        usage: usageOf(jwk),
+        hasPurposeMember: jwk.proof_purpose !== undefined,
+        legacy: jwk.proof_legacy === true,
+        vanished: false,
+        firstSeen,
+        confirmed: false,
+    };
+    if (typeof jwk.kid === 'string' && jwk.kid.length > 0)
+        record.kid = jwk.kid;
+    if (isKeyFamily(jwk.proof_purpose))
+        record.purpose = jwk.proof_purpose;
+    if (isWholeNumber(jwk.not_before))
+        record.notBefore = jwk.not_before;
+    if (isWholeNumber(jwk.not_after))
+        record.notAfter = jwk.not_after;
+    if (isWholeNumber(jwk.max_token_lifetime))
+        record.maxTokenLifetime = jwk.max_token_lifetime;
+    return record;
+}
+function hasWindow(record) {
+    return record.notBefore !== undefined && record.notAfter !== undefined && record.maxTokenLifetime !== undefined;
+}
+/**
+ * A key the issuer's registry describes — it carries `proof_purpose` or `proof_legacy` — AND that
+ * two fetches at least `CONFIRM_SPACING_MS` apart served unchanged. The ONE predicate behind every
+ * rule that outlives a fetch: material lock, no widening, pending narrowing, retained when it
+ * vanishes. Window members alone do not make a registry key: without a purpose such a key cannot
+ * verify anything once the registry is live, so it keeps tolerant semantics.
+ */
+function isProtectedRecord(record) {
+    return record.confirmed && (record.hasPurposeMember || record.legacy);
+}
+/**
+ * Whether two records describe the same key: material, usage, purpose, legacy marker and window.
+ * Usage counts because the record kept is the one first seen: a poisoned first sighting marked
+ * `use: "enc"` must be replaced by the honest description, not confirmed by it.
+ */
+function describesSameKey(a, b) {
+    return (a.fingerprint === b.fingerprint &&
+        a.usage === b.usage &&
+        a.hasPurposeMember === b.hasPurposeMember &&
+        a.purpose === b.purpose &&
+        a.legacy === b.legacy &&
+        a.notBefore === b.notBefore &&
+        a.notAfter === b.notAfter &&
+        a.maxTokenLifetime === b.maxTokenLifetime);
+}
+function spacingElapsed(since, now) {
+    return now.monotonicMs - since.monotonicMs >= exports.CONFIRM_SPACING_MS;
+}
+function isRegistryLive(state) {
+    for (const record of state.keys.values())
+        if (record.hasPurposeMember)
+            return true;
+    return state.anonymous.some((record) => record.hasPurposeMember);
+}
+function wallSeconds(reading) {
+    return Math.floor(reading.wallMs / 1000);
+}
+/** Whether a kid may still be signing: legacy, window unknown, or not yet past `not_after`. */
+function isLiveKey(record, nowSeconds) {
+    if (record.legacy || !hasWindow(record))
+        return true;
+    return nowSeconds <= record.notAfter + exports.KEY_WINDOW_SKEW_SECONDS;
+}
+function parseTombstones(value) {
+    if (!Array.isArray(value))
+        return [];
+    const tombstones = [];
+    for (const entry of value) {
+        if (!(0, support_js_1.isRecord)(entry))
+            continue;
+        if (typeof entry.kid !== 'string' || entry.kid.length === 0)
+            continue;
+        if (!isWholeNumber(entry.revoked_at))
+            continue;
+        tombstones.push({ kid: entry.kid, revokedAt: entry.revoked_at });
+    }
+    return tombstones;
+}
+function cloneState(state) {
+    return {
+        keys: new Map([...state.keys].map(([kid, record]) => [kid, { ...record }])),
+        anonymous: state.anonymous.map((record) => ({ ...record })),
+        pending: new Map(state.pending),
+        applied: new Map(state.applied),
+        fetchedAt: state.fetchedAt,
+        fetchedAtUntrusted: state.fetchedAtUntrusted,
+    };
+}
+/**
+ * Merge one fetched JWKS body (already known to be an object with a `keys` array) into `state`.
+ * Pure: returns a new state and the events the caller should report.
+ */
+function mergeFetchedDocument(state, body, now) {
+    const nowSeconds = wallSeconds(now);
+    const candidates = Array.isArray(body.keys) ? body.keys.filter(support_js_1.isRecord) : [];
+    const served = new Map();
+    const anonymous = [];
+    for (const jwk of candidates) {
+        const record = parseKeyRecord(jwk, now);
+        if (record.kid)
+            served.set(record.kid, record);
+        else
+            anonymous.push(record);
+    }
+    // Widening is checked before anything is touched: such a document is refused whole.
+    for (const [kid, incoming] of served) {
+        const known = state.keys.get(kid);
+        if (!known || !isProtectedRecord(known) || !hasWindow(known) || !hasWindow(incoming))
+            continue;
+        if (incoming.notBefore < known.notBefore || incoming.notAfter > known.notAfter) {
+            return {
+                state,
+                accepted: false,
+                events: [
+                    {
+                        type: 'window_widening_rejected',
+                        kid,
+                        message: `JWKS refused: it widens the window of confirmed key "${kid}"`,
+                    },
+                ],
+            };
+        }
+    }
+    const next = cloneState(state);
+    const events = [];
+    const tombstones = parseTombstones(body.proof_tombstones);
+    const tombstonedNow = new Set(tombstones.map((tombstone) => tombstone.kid));
+    for (const [kid, incoming] of served) {
+        const known = next.keys.get(kid);
+        // Not protected yet: the latest document describes the key, exactly as before rotation
+        // existed. Serving the same description again, far enough apart, confirms it.
+        if (!known || !isProtectedRecord(known)) {
+            if (known && describesSameKey(known, incoming)) {
+                if (!known.confirmed && spacingElapsed(known.firstSeen, now))
+                    known.confirmed = true;
+            }
+            else {
+                next.keys.set(kid, incoming);
+            }
+            continue;
+        }
+        known.vanished = false;
+        if (known.fingerprint !== incoming.fingerprint) {
+            delete known.pendingWindow;
+            events.push({
+                type: 'key_material_changed',
+                kid,
+                message: `JWKS serves different key material for confirmed key "${kid}"; the first-seen key is kept`,
+            });
+            continue;
+        }
+        if (!hasWindow(known) || !hasWindow(incoming))
+            continue;
+        if (incoming.notBefore === known.notBefore && incoming.notAfter === known.notAfter) {
+            delete known.pendingWindow;
+            continue;
+        }
+        const pending = known.pendingWindow;
+        if (!pending || pending.notBefore !== incoming.notBefore || pending.notAfter !== incoming.notAfter) {
+            known.pendingWindow = { notBefore: incoming.notBefore, notAfter: incoming.notAfter, firstSeen: now };
+            events.push({
+                type: 'window_narrowing_pending',
+                kid,
+                message: `JWKS narrows the window of confirmed key "${kid}"; applied only if a fetch at least 5 minutes later serves the same window`,
+            });
+            continue;
+        }
+        if (!spacingElapsed(pending.firstSeen, now))
+            continue;
+        known.notBefore = pending.notBefore;
+        known.notAfter = pending.notAfter;
+        known.jwk = { ...known.jwk, not_before: pending.notBefore, not_after: pending.notAfter };
+        delete known.pendingWindow;
+        events.push({
+            type: 'window_narrowing_applied',
+            kid,
+            message: `narrowed window of key "${kid}" confirmed by a second fetch and applied`,
+        });
+    }
+    for (const [kid, known] of [...next.keys]) {
+        if (served.has(kid))
+            continue;
+        if (!isProtectedRecord(known)) {
+            next.keys.delete(kid);
+            continue;
+        }
+        if (hasWindow(known)) {
+            if (nowSeconds > known.notAfter + known.maxTokenLifetime + exports.KEY_WINDOW_SKEW_SECONDS) {
+                next.keys.delete(kid);
+                continue;
+            }
+        }
+        else if (!known.legacy) {
+            next.keys.delete(kid);
+            continue;
+        }
+        // A narrowing is confirmed by consecutive documents serving it; one that omits the kid breaks the run.
+        delete known.pendingWindow;
+        if (!known.vanished && !tombstonedNow.has(kid)) {
+            known.vanished = true;
+            events.push({
+                type: 'kid_vanished',
+                kid,
+                message: `key "${kid}" is no longer served before its retention ended; its last-known state is kept`,
+            });
+        }
+    }
+    next.anonymous = anonymous;
+    for (const [kid] of next.pending) {
+        if (!tombstonedNow.has(kid))
+            next.pending.delete(kid);
+    }
+    for (const tombstone of tombstones) {
+        if (next.applied.has(tombstone.kid))
+            continue;
+        const pending = next.pending.get(tombstone.kid);
+        if (pending) {
+            if (spacingElapsed(pending.firstSeen, now)) {
+                next.pending.delete(tombstone.kid);
+                next.applied.set(tombstone.kid, { kid: tombstone.kid, revokedAt: pending.revokedAt });
+                events.push({
+                    type: 'tombstone_applied',
+                    kid: tombstone.kid,
+                    message: `tombstone for key "${tombstone.kid}" confirmed by a second fetch and applied`,
+                });
+            }
+            continue;
+        }
+        next.pending.set(tombstone.kid, { kid: tombstone.kid, revokedAt: tombstone.revokedAt, firstSeen: now });
+        events.push({
+            type: 'tombstone_pending',
+            kid: tombstone.kid,
+            message: `tombstone for key "${tombstone.kid}" seen; applied only if a fetch at least 5 minutes later still carries it`,
+        });
+        // "Last seen live" is read from what the verifier knew BEFORE this document, which may itself
+        // have dropped the key.
+        const known = state.keys.get(tombstone.kid);
+        if (known && isLiveKey(known, nowSeconds)) {
+            events.push({
+                type: 'tombstone_for_live_key',
+                kid: tombstone.kid,
+                message: `ANOMALY: tombstone names key "${tombstone.kid}", which was last seen live`,
+            });
+        }
+    }
+    for (const [kid, applied] of [...next.applied]) {
+        if (nowSeconds > applied.revokedAt + exports.TOMBSTONE_RETENTION_SECONDS)
+            next.applied.delete(kid);
+    }
+    next.fetchedAt = now;
+    next.fetchedAtUntrusted = false;
+    return { state: next, events, accepted: true };
+}
+/**
+ * Which keys may verify a token of `family` carrying `kid`. Checks the applied tombstone and the
+ * key's purpose; the signature and the window are the caller's next steps, in that order.
+ */
+function selectKeys(state, kid, family) {
+    const registryLive = isRegistryLive(state);
+    if (kid !== undefined) {
+        if (state.applied.has(kid))
+            return { kind: 'revoked', kid };
+        const record = state.keys.get(kid);
+        if (!record)
+            return { kind: 'unknown' };
+        if (record.legacy || !registryLive)
+            return { kind: 'candidates', records: [record] };
+        if (record.purpose !== family)
+            return { kind: 'wrong_purpose', kid };
+        return { kind: 'candidates', records: [record] };
+    }
+    // No `kid`: once the registry is live only a key marked legacy may answer — trying every key
+    // would let a token borrow any family's key and skip the purpose check.
+    const all = [...state.anonymous, ...state.keys.values()].filter((record) => !(record.kid && state.applied.has(record.kid)));
+    const records = registryLive ? all.filter((record) => record.legacy) : all;
+    return records.length > 0 ? { kind: 'candidates', records } : { kind: 'unknown' };
+}
+/** The window and lifetime rules for a key whose signature has verified. */
+function checkKeyPolicy(record, token, registryLive) {
+    if (!registryLive || record.legacy)
+        return null;
+    if (!hasWindow(record))
+        return 'outside_key_window';
+    if (!isWholeNumber(token.iat))
+        return 'outside_key_window';
+    if (token.iat < record.notBefore - exports.KEY_WINDOW_SKEW_SECONDS)
+        return 'outside_key_window';
+    if (token.iat > record.notAfter + exports.KEY_WINDOW_SKEW_SECONDS)
+        return 'outside_key_window';
+    if (typeof token.exp !== 'number' || token.exp > token.iat + record.maxTokenLifetime) {
+        return 'token_lifetime_exceeded';
+    }
+    return null;
+}
+/**
+ * Fold the tombstones of a persisted state into a set this process has already fetched. The
+ * fetched keys are newer than disk, but a tombstone is not something a later fetch can restore:
+ * dropping the persisted one would silently un-revoke a key until two more fetches agreed again.
+ */
+function withPersistedTombstones(state, persisted) {
+    const next = cloneState(state);
+    for (const [kid, applied] of persisted.applied) {
+        if (!next.applied.has(kid))
+            next.applied.set(kid, applied);
+    }
+    for (const [kid, pending] of persisted.pending) {
+        if (!next.applied.has(kid) && !next.pending.has(kid))
+            next.pending.set(kid, pending);
+    }
+    return next;
+}
+/**
+ * The part of a cached set that may answer after a refetch FAILED: confirmed keys only. An
+ * unconfirmed key is trusted until the next document, and a failing fetch must not stretch that to
+ * `maxJwksAgeMs` — otherwise one poisoned response followed by an outage would keep its key, and
+ * the registry mode it switched on, for a day.
+ */
+function withConfirmedKeysOnly(state) {
+    const next = cloneState(state);
+    for (const [kid, record] of [...next.keys]) {
+        if (!record.confirmed)
+            next.keys.delete(kid);
+    }
+    next.anonymous = [];
+    return next;
+}
+/** Drop every applied and pending tombstone — the documented manual reset. */
+function withoutTombstones(state) {
+    const next = cloneState(state);
+    next.applied.clear();
+    next.pending.clear();
+    return next;
+}
+const PERSISTED_VERSION = 1;
+/**
+ * Persisted form. Every timestamp is wall-clock milliseconds: a monotonic reading means nothing
+ * to another process.
+ */
+function serializeKeySetState(state) {
+    return JSON.stringify({
+        v: PERSISTED_VERSION,
+        fetched_at_wall_ms: state.fetchedAt && !state.fetchedAtUntrusted ? state.fetchedAt.wallMs : null,
+        keys: [...state.keys.values()].map((record) => ({
+            jwk: record.jwk,
+            vanished: record.vanished,
+            confirmed: record.confirmed,
+            first_seen_wall_ms: record.firstSeen.wallMs,
+            ...(record.pendingWindow
+                ? {
+                    pending_window: {
+                        not_before: record.pendingWindow.notBefore,
+                        not_after: record.pendingWindow.notAfter,
+                        first_seen_wall_ms: record.pendingWindow.firstSeen.wallMs,
+                    },
+                }
+                : {}),
+        })),
+        anonymous: state.anonymous.map((record) => record.jwk),
+        pending: [...state.pending.values()].map((pending) => ({
+            kid: pending.kid,
+            revoked_at: pending.revokedAt,
+            first_seen_wall_ms: pending.firstSeen.wallMs,
+        })),
+        applied: [...state.applied.values()].map((applied) => ({ kid: applied.kid, revoked_at: applied.revokedAt })),
+    });
+}
+function fromWall(wallMs, now) {
+    return { wallMs, monotonicMs: now.monotonicMs - (now.wallMs - wallMs) };
+}
+/**
+ * Rebuild a persisted state, or null when the blob is not one. A `fetched_at` in the future marks
+ * the set stale; a pending tombstone first seen in the future is dropped.
+ */
+function deserializeKeySetState(raw, now) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!(0, support_js_1.isRecord)(parsed) || parsed.v !== PERSISTED_VERSION)
+        return null;
+    const state = emptyKeySetState();
+    if (Array.isArray(parsed.keys)) {
+        for (const entry of parsed.keys) {
+            if (!(0, support_js_1.isRecord)(entry) || !(0, support_js_1.isRecord)(entry.jwk))
+                continue;
+            // A first sighting persisted in the future cannot be timed: the key starts over as unconfirmed.
+            const firstSeenWall = entry.first_seen_wall_ms;
+            const firstSeen = isWholeNumber(firstSeenWall) && firstSeenWall <= now.wallMs ? fromWall(firstSeenWall, now) : null;
+            const record = parseKeyRecord(entry.jwk, firstSeen ?? now);
+            if (!record.kid)
+                continue;
+            record.vanished = entry.vanished === true;
+            record.confirmed = firstSeen !== null && entry.confirmed === true;
+            const pendingWindow = entry.pending_window;
+            if ((0, support_js_1.isRecord)(pendingWindow) &&
+                isWholeNumber(pendingWindow.not_before) &&
+                isWholeNumber(pendingWindow.not_after) &&
+                isWholeNumber(pendingWindow.first_seen_wall_ms) &&
+                pendingWindow.first_seen_wall_ms <= now.wallMs) {
+                record.pendingWindow = {
+                    notBefore: pendingWindow.not_before,
+                    notAfter: pendingWindow.not_after,
+                    firstSeen: fromWall(pendingWindow.first_seen_wall_ms, now),
+                };
+            }
+            state.keys.set(record.kid, record);
+        }
+    }
+    if (Array.isArray(parsed.anonymous)) {
+        state.anonymous = parsed.anonymous.filter(support_js_1.isRecord).map((jwk) => parseKeyRecord(jwk, now));
+    }
+    for (const applied of parseTombstones(parsed.applied))
+        state.applied.set(applied.kid, applied);
+    if (Array.isArray(parsed.pending)) {
+        for (const entry of parsed.pending) {
+            if (!(0, support_js_1.isRecord)(entry) || typeof entry.kid !== 'string' || !isWholeNumber(entry.revoked_at))
+                continue;
+            if (!isWholeNumber(entry.first_seen_wall_ms) || entry.first_seen_wall_ms > now.wallMs)
+                continue;
+            state.pending.set(entry.kid, {
+                kid: entry.kid,
+                revokedAt: entry.revoked_at,
+                firstSeen: fromWall(entry.first_seen_wall_ms, now),
+            });
+        }
+    }
+    const fetchedAtWall = parsed.fetched_at_wall_ms;
+    if (isWholeNumber(fetchedAtWall)) {
+        if (fetchedAtWall > now.wallMs) {
+            state.fetchedAt = now;
+            state.fetchedAtUntrusted = true;
+        }
+        else {
+            state.fetchedAt = fromWall(fetchedAtWall, now);
+        }
+    }
+    return state;
+}
+//# sourceMappingURL=keyset.js.map

package/dist/cjs/jwks/keyset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyset.js","sourceRoot":"","sources":["../../../src/jwks/keyset.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AA+FH,4CASC;AAoBD,wCAiBC;AAuCD,wCAGC;AAuCD,oDAgKC;AAMD,gCAkBC;AAGD,wCAcC;AAOD,0DASC;AAQD,sDAOC;AAGD,8CAKC;AAQD,oDA2BC;AAUD,wDA+DC;AAxjBD,6CAAwC;AAG3B,QAAA,YAAY,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,CAAU,CAAC;AAG5E,qFAAqF;AACxE,QAAA,uBAAuB,GAAG,GAAG,CAAC;AAC3C,oGAAoG;AACvF,QAAA,kBAAkB,GAAG,CAAC,GAAG,KAAM,CAAC;AAC7C,iEAAiE;AACpD,QAAA,2BAA2B,GAAG,GAAG,GAAG,KAAM,CAAC;AAkFxD,SAAgB,gBAAgB;IAC9B,OAAO;QACL,IAAI,EAAE,IAAI,GAAG,EAAE;QACf,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,IAAI,GAAG,EAAE;QAClB,OAAO,EAAE,IAAI,GAAG,EAAE;QAClB,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,KAAK;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,oBAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;AAErE,SAAS,aAAa,CAAC,GAA4B;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,OAAO,CAAC,GAA4B;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAgB,cAAc,CAAC,GAA4B,EAAE,SAA6B;IACxF,MAAM,MAAM,GAAc;QACxB,GAAG;QACH,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC;QAC/B,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC;QACnB,gBAAgB,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS;QACjD,MAAM,EAAE,GAAG,CAAC,YAAY,KAAK,IAAI;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS;QACT,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IAC5E,IAAI,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC;IACvE,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC;IACrE,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;IAClE,IAAI,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAAE,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAC5F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,MAAiB;IAClC,OAAO,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC;AAClH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,MAAiB;IAC1C,OAAO,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,CAAY,EAAE,CAAY;IAClD,OAAO,CACL,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAC/B,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QACnB,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB;QACzC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QACvB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAC3B,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,GAAuB;IACxE,OAAO,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,0BAAkB,CAAC;AACnE,CAAC;AAED,SAAgB,cAAc,CAAC,KAAkB;IAC/C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,IAAI,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;IACnF,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,OAA2B;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,SAAS,SAAS,CAAC,MAAiB,EAAE,UAAkB;IACtD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,IAAI,MAAM,CAAC,QAAQ,GAAG,+BAAuB,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAA,qBAAQ,EAAC,KAAK,CAAC;YAAE,SAAS;QAC/B,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,SAAS;QAC/C,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,KAAkB;IACpC,OAAO;QACL,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3E,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/B,OAAO,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,KAAkB,EAClB,IAA6B,EAC7B,GAAuB;IAEvB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;;YAC1C,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,oFAAoF;IACpF,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC/F,IAAI,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC/E,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,0BAA0B;wBAChC,GAAG;wBACH,OAAO,EAAE,wDAAwD,GAAG,GAAG;qBACxE;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5E,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,uFAAuF;QACvF,8EAA8E;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,IAAI,KAAK,IAAI,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;oBAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC/B,CAAC;YACD,SAAS;QACX,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;QACvB,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,aAAa,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,sBAAsB;gBAC5B,GAAG;gBACH,OAAO,EAAE,yDAAyD,GAAG,+BAA+B;aACrG,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,SAAS;QACxD,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnF,OAAO,KAAK,CAAC,aAAa,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACnG,KAAK,CAAC,aAAa,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;YACrG,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,0BAA0B;gBAChC,GAAG;gBACH,OAAO,EAAE,6CAA6C,GAAG,4EAA4E;aACtI,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;YAAE,SAAS;QACtD,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,KAAK,CAAC,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC,aAAa,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,GAAG;YACH,OAAO,EAAE,2BAA2B,GAAG,2CAA2C;SACnF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,UAAU,GAAG,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,gBAAgB,GAAG,+BAAuB,EAAE,CAAC;gBACnF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,uGAAuG;QACvG,OAAO,KAAK,CAAC,aAAa,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,GAAG;gBACH,OAAO,EAAE,QAAQ,GAAG,gFAAgF;aACrG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAE3B,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;gBACtF,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,mBAAmB;oBACzB,GAAG,EAAE,SAAS,CAAC,GAAG;oBAClB,OAAO,EAAE,sBAAsB,SAAS,CAAC,GAAG,2CAA2C;iBACxF,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACxG,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mBAAmB;YACzB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,OAAO,EAAE,sBAAsB,SAAS,CAAC,GAAG,2EAA2E;SACxH,CAAC,CAAC;QACH,8FAA8F;QAC9F,wBAAwB;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,KAAK,IAAI,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,OAAO,EAAE,iCAAiC,SAAS,CAAC,GAAG,6BAA6B;aACrF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,IAAI,UAAU,GAAG,OAAO,CAAC,SAAS,GAAG,mCAA2B;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IACrB,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAChC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,KAAkB,EAAE,GAAuB,EAAE,MAAiB;IACvF,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,6FAA6F;IAC7F,wEAAwE;IACxE,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAC3D,CAAC;IACF,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3E,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACpF,CAAC;AAED,4EAA4E;AAC5E,SAAgB,cAAc,CAC5B,MAAiB,EACjB,KAAqC,EACrC,YAAqB;IAErB,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACpD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAC3D,IAAI,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,+BAAuB;QAAE,OAAO,oBAAoB,CAAC;IACxF,IAAI,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,+BAAuB;QAAE,OAAO,oBAAoB,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACrF,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,KAAkB,EAAE,SAAsB;IAChF,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,KAAkB;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,SAAgB,iBAAiB,CAAC,KAAkB;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACrB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,KAAkB;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC,EAAE,iBAAiB;QACpB,kBAAkB,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChG,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,kBAAkB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;YAC3C,GAAG,CAAC,MAAM,CAAC,aAAa;gBACtB,CAAC,CAAC;oBACE,cAAc,EAAE;wBACd,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,SAAS;wBAC1C,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ;wBACxC,kBAAkB,EAAE,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM;qBAC1D;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;QACtD,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,kBAAkB,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;KAC7G,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,GAAuB;IACvD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,GAAW,EAAE,GAAuB;IACzE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAA,qBAAQ,EAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,IAAA,qBAAQ,EAAC,KAAK,CAAC,IAAI,CAAC,IAAA,qBAAQ,EAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvD,gGAAgG;YAChG,MAAM,aAAa,GAAG,KAAK,CAAC,kBAAkB,CAAC;YAC/C,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpH,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAC1B,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;YAC1C,MAAM,CAAC,SAAS,GAAG,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC;YAClE,MAAM,aAAa,GAAG,KAAK,CAAC,cAAc,CAAC;YAC3C,IACE,IAAA,qBAAQ,EAAC,aAAa,CAAC;gBACvB,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC;gBACvC,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC;gBACtC,aAAa,CAAC,aAAa,CAAC,kBAAkB,CAAC;gBAC/C,aAAa,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAC9C,CAAC;gBACD,MAAM,CAAC,aAAa,GAAG;oBACrB,SAAS,EAAE,aAAa,CAAC,UAAU;oBACnC,QAAQ,EAAE,aAAa,CAAC,SAAS;oBACjC,SAAS,EAAE,QAAQ,CAAC,aAAa,CAAC,kBAAkB,EAAE,GAAG,CAAC;iBAC3D,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,qBAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,IAAA,qBAAQ,EAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;gBAAE,SAAS;YACpG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,GAAG,CAAC,MAAM;gBAAE,SAAS;YAChG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,CAAC;IAChD,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,IAAI,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;YACtB,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cjs/jwks/support.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The two helpers `keyset.ts` imports. They live here, not in `types.ts`, because `keyset.ts` is a
+ * lockstep copy of `packages/delegation-verifier/src/keyset.ts` and imports them under the same
+ * names that package gives them.
+ */
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/** What a key-set merge can report. `store_error` belongs to the verifier's persistence, which this SDK has none of. */
+export type JwksEventType = 'tombstone_pending' | 'tombstone_applied' | 'tombstone_for_live_key' | 'window_narrowing_pending' | 'window_narrowing_applied' | 'window_widening_rejected' | 'key_material_changed' | 'kid_vanished' | 'store_error';
+//# sourceMappingURL=support.d.ts.map

package/dist/cjs/jwks/support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"support.d.ts","sourceRoot":"","sources":["../../../src/jwks/support.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wHAAwH;AACxH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,cAAc,GACd,aAAa,CAAC"}

package/dist/cjs/jwks/support.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * The two helpers `keyset.ts` imports. They live here, not in `types.ts`, because `keyset.ts` is a
+ * lockstep copy of `packages/delegation-verifier/src/keyset.ts` and imports them under the same
+ * names that package gives them.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRecord = isRecord;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=support.js.map

package/dist/cjs/jwks/support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"support.js","sourceRoot":"","sources":["../../../src/jwks/support.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAEH,4BAEC;AAFD,SAAgB,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/cjs/polling.d.ts

@@ -0,0 +1,10 @@
+import type { WaitOptions } from './types.js';
+/**
+ * Generic polling helper. Calls `retrieve` repeatedly until the returned
+ * object's `status` field is in `terminalStates`, or the timeout is reached.
+ * Uses exponential backoff with jitter per the standard polling contract.
+ */
+export declare function pollUntilComplete<T extends {
+    status: string;
+}>(retrieve: () => Promise<T>, terminalStates: readonly string[], label: string, options?: WaitOptions): Promise<T>;
+//# sourceMappingURL=polling.d.ts.map

package/dist/cjs/polling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"polling.d.ts","sourceRoot":"","sources":["../../src/polling.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA6B9C;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAClE,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC1B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,CAAC,CAAC,CA2BZ"}

package/dist/cjs/polling.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pollUntilComplete = pollUntilComplete;
+const errors_js_1 = require("./errors.js");
+const DEFAULT_INTERVAL = 2000;
+const DEFAULT_TIMEOUT = 600000;
+const DEFAULT_BACKOFF = 1.5;
+const DEFAULT_MAX_INTERVAL = 30000;
+const DEFAULT_JITTER = 500;
+function requirePositiveFinite(name, value) {
+    if (!Number.isFinite(value) || value <= 0) {
+        throw new RangeError(`${name} must be a finite positive number, got ${value}`);
+    }
+    return value;
+}
+function requireBackoff(value) {
+    if (!Number.isFinite(value) || value < 1) {
+        throw new RangeError(`backoff must be a finite number >= 1, got ${value}`);
+    }
+    return value;
+}
+function requireJitter(value) {
+    if (!Number.isFinite(value) || value < 0) {
+        throw new RangeError(`jitter must be a finite non-negative number, got ${value}`);
+    }
+    return value;
+}
+/**
+ * Generic polling helper. Calls `retrieve` repeatedly until the returned
+ * object's `status` field is in `terminalStates`, or the timeout is reached.
+ * Uses exponential backoff with jitter per the standard polling contract.
+ */
+async function pollUntilComplete(retrieve, terminalStates, label, options) {
+    let interval = requirePositiveFinite('interval', options?.interval ?? DEFAULT_INTERVAL);
+    const timeout = requirePositiveFinite('timeout', options?.timeout ?? DEFAULT_TIMEOUT);
+    const backoff = requireBackoff(options?.backoff ?? DEFAULT_BACKOFF);
+    const maxInterval = requirePositiveFinite('maxInterval', options?.maxInterval ?? DEFAULT_MAX_INTERVAL);
+    const jitterMax = requireJitter(options?.jitter ?? DEFAULT_JITTER);
+    const start = performance.now();
+    while (true) {
+        options?.signal?.throwIfAborted();
+        const resource = await retrieve();
+        if (terminalStates.includes(resource.status)) {
+            return resource;
+        }
+        if (performance.now() - start >= timeout) {
+            throw new errors_js_1.PollingTimeoutError(`${label} did not complete within ${timeout}ms (last status: ${resource.status})`);
+        }
+        const jitter = Math.random() * jitterMax;
+        await sleepWithAbort(interval + jitter, options?.signal);
+        interval = Math.min(interval * backoff, maxInterval);
+    }
+}
+function sleepWithAbort(ms, signal) {
+    if (!signal) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=polling.js.map

package/dist/cjs/polling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"polling.js","sourceRoot":"","sources":["../../src/polling.ts"],"names":[],"mappings":";;AAmCA,8CAgCC;AAnED,2CAAkD;AAGlD,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,eAAe,GAAG,MAAO,CAAC;AAChC,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,oBAAoB,GAAG,KAAM,CAAC;AACpC,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,SAAS,qBAAqB,CAAC,IAAY,EAAE,KAAa;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,0CAA0C,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,UAAU,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,UAAU,CAAC,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CACrC,QAA0B,EAC1B,cAAiC,EACjC,KAAa,EACb,OAAqB;IAErB,IAAI,QAAQ,GAAG,qBAAqB,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,IAAI,gBAAgB,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,qBAAqB,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,IAAI,oBAAoB,CAAC,CAAC;IACvG,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,IAAI,cAAc,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAEhC,OAAO,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAElC,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;QAElC,IAAI,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,+BAAmB,CAC3B,GAAG,KAAK,4BAA4B,OAAO,oBAAoB,QAAQ,CAAC,MAAM,GAAG,CAClF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC;QACzC,MAAM,cAAc,CAAC,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzD,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,EAAU,EAAE,MAAoB;IACtD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC"}