@provian/mcp 0.0.0-stage → 1.2.0

package/dist/agent-wallet-registration.js

@@ -0,0 +1,440 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_AGENT_WALLET_IDENTITY_PATH = exports.MCP_PENDING_AGENT_WALLET_PATH = void 0;
+exports.loadOrCreatePendingAgentWalletRegistration = loadOrCreatePendingAgentWalletRegistration;
+exports.reloadPendingAgentWalletRegistration = reloadPendingAgentWalletRegistration;
+exports.completePendingAgentWalletRegistration = completePendingAgentWalletRegistration;
+exports.loadCompletedAgentWalletIdentity = loadCompletedAgentWalletIdentity;
+exports.clearCompletedAgentWalletPending = clearCompletedAgentWalletPending;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const os_1 = require("os");
+const path = __importStar(require("path"));
+const util_1 = require("util");
+const crypto_2 = require("./core/crypto");
+exports.MCP_PENDING_AGENT_WALLET_PATH = path.join((0, os_1.homedir)(), '.provian', 'pending-mcp-agent-wallet.json');
+exports.MCP_AGENT_WALLET_IDENTITY_PATH = path.join((0, os_1.homedir)(), '.provian', 'agent-wallet-identity.json');
+const PENDING_KEYS = [
+    'address',
+    'agent_id',
+    'agent_name',
+    'constitution_accepted_at',
+    'context_sha256',
+    'created_at_ms',
+    'encrypted_private_key',
+    'platform',
+    'public_key',
+    'registration_id',
+    'schema_version',
+];
+const ENCRYPTED_KEY_KEYS = [
+    'N',
+    'cipher',
+    'ciphertext',
+    'iv',
+    'kdf',
+    'p',
+    'r',
+    'salt',
+    'tag',
+];
+const FINAL_KEYS = ['pending_identity', 'schema_version', 'wallet_id'];
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    return actual.length === expected.length
+        && actual.every((key, index) => key === expected[index]);
+}
+function hasPathEntry(filePath) {
+    try {
+        fs.lstatSync(filePath);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        return true;
+    }
+}
+function readPrivateJson(filePath, label) {
+    const noFollow = process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW;
+    let fd;
+    try {
+        const pathStat = fs.lstatSync(filePath);
+        if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
+            throw new Error(`${label} must be a private regular file`);
+        }
+        fd = fs.openSync(filePath, fs.constants.O_RDONLY | noFollow);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith(label))
+            throw error;
+        throw new Error(`${label} is missing, unreadable, or unsafe`);
+    }
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile()
+            || (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
+            throw new Error(`${label} must be a private 0600 regular file`);
+        }
+        return JSON.parse(fs.readFileSync(fd, 'utf8'));
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith(label))
+            throw error;
+        throw new Error(`${label} is malformed`);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function contextHash(context) {
+    return (0, crypto_1.createHash)('sha256').update(JSON.stringify({
+        relay_url: context.relay_url,
+        agent_name: context.agent_name,
+        requested_agent_id: context.requested_agent_id,
+        platform: context.platform,
+    }), 'utf8').digest('hex');
+}
+function validateContext(context) {
+    if (typeof context.relay_url !== 'string' || context.relay_url.trim().length === 0
+        || typeof context.agent_name !== 'string' || context.agent_name.trim().length === 0
+        || context.agent_name.length > 200
+        || typeof context.platform !== 'string' || context.platform.trim().length === 0
+        || context.platform.length > 64
+        || (context.requested_agent_id !== null
+            && !/^[A-Za-z0-9._-]{1,128}$/.test(context.requested_agent_id))) {
+        throw new Error('MCP wallet registration context is malformed');
+    }
+}
+function aad(file) {
+    return Buffer.from(JSON.stringify(file), 'utf8');
+}
+function deriveKey(passphrase, salt, N) {
+    return (0, crypto_1.scryptSync)(passphrase, salt, 32, { N, r: 8, p: 1, maxmem: 256 * N * 8 });
+}
+function parsePendingFile(value, expectedContext) {
+    if (!isRecord(value) || !hasExactKeys(value, PENDING_KEYS)) {
+        throw new Error('Pending MCP wallet identity has an unknown or incomplete schema');
+    }
+    const encrypted = value.encrypted_private_key;
+    if (!isRecord(encrypted) || !hasExactKeys(encrypted, ENCRYPTED_KEY_KEYS)) {
+        throw new Error('Pending MCP wallet encryption metadata has an unknown or incomplete schema');
+    }
+    if (value.schema_version !== 'provian-mcp-agent-wallet-pending/v1'
+        || typeof value.context_sha256 !== 'string'
+        || !/^[0-9a-f]{64}$/.test(value.context_sha256)
+        || typeof value.registration_id !== 'string'
+        || !/^[A-Za-z0-9][A-Za-z0-9_.:@-]{15,127}$/.test(value.registration_id)
+        || typeof value.agent_id !== 'string'
+        || !/^[A-Za-z0-9._-]{1,128}$/.test(value.agent_id)
+        || typeof value.agent_name !== 'string'
+        || value.agent_name.trim().length === 0
+        || value.agent_name.length > 200
+        || typeof value.platform !== 'string'
+        || value.platform.trim().length === 0
+        || value.platform.length > 64
+        || typeof value.constitution_accepted_at !== 'string'
+        || typeof value.created_at_ms !== 'number'
+        || !Number.isSafeInteger(value.created_at_ms)
+        || value.created_at_ms < 0
+        || value.created_at_ms > 8640000000000000
+        || new Date(value.created_at_ms).toISOString() !== value.constitution_accepted_at
+        || typeof value.public_key !== 'string'
+        || !/^[0-9a-f]{128}$/.test(value.public_key)
+        || typeof value.address !== 'string'
+        || !/^0x[0-9a-fA-F]{40}$/.test(value.address)
+        || encrypted.cipher !== 'aes-256-gcm'
+        || encrypted.kdf !== 'scrypt'
+        || typeof encrypted.N !== 'number'
+        || !Number.isSafeInteger(encrypted.N)
+        || encrypted.N < 1 << 10
+        || encrypted.N > 1 << 20
+        || (encrypted.N & (encrypted.N - 1)) !== 0
+        || encrypted.r !== 8
+        || encrypted.p !== 1
+        || typeof encrypted.salt !== 'string'
+        || !/^[0-9a-f]{64}$/.test(encrypted.salt)
+        || typeof encrypted.iv !== 'string'
+        || !/^[0-9a-f]{24}$/.test(encrypted.iv)
+        || typeof encrypted.tag !== 'string'
+        || !/^[0-9a-f]{32}$/.test(encrypted.tag)
+        || typeof encrypted.ciphertext !== 'string'
+        || !/^[0-9a-f]{64}$/.test(encrypted.ciphertext)) {
+        throw new Error('Pending MCP wallet identity is malformed');
+    }
+    if (expectedContext
+        && (value.context_sha256 !== contextHash(expectedContext)
+            || value.agent_name !== expectedContext.agent_name
+            || value.platform !== expectedContext.platform
+            || (expectedContext.requested_agent_id !== null
+                && value.agent_id !== expectedContext.requested_agent_id))) {
+        throw new Error('Pending MCP wallet identity does not match this relay/request context; refusing replacement');
+    }
+    return value;
+}
+function parseFinalFile(value) {
+    if (!isRecord(value) || !hasExactKeys(value, FINAL_KEYS)
+        || value.schema_version !== 'provian-mcp-agent-wallet/v1'
+        || typeof value.wallet_id !== 'string'
+        || !/^wallet_aw_[A-Za-z0-9_-]+$/.test(value.wallet_id)) {
+        throw new Error('Completed MCP wallet identity is malformed');
+    }
+    return {
+        schema_version: value.schema_version,
+        wallet_id: value.wallet_id,
+        pending_identity: parsePendingFile(value.pending_identity),
+    };
+}
+function encryptPrivateKey(privateKey, header, passphrase, N) {
+    if (passphrase.length < 8)
+        throw new Error('PROVIAN_KEYSTORE_PASSPHRASE must be at least 8 characters');
+    const salt = (0, crypto_1.randomBytes)(32);
+    const iv = (0, crypto_1.randomBytes)(12);
+    const cipher = (0, crypto_1.createCipheriv)('aes-256-gcm', deriveKey(passphrase, salt, N), iv);
+    cipher.setAAD(aad(header));
+    const ciphertext = Buffer.concat([
+        cipher.update(Buffer.from(privateKey, 'hex')),
+        cipher.final(),
+    ]);
+    return {
+        cipher: 'aes-256-gcm',
+        kdf: 'scrypt',
+        N,
+        r: 8,
+        p: 1,
+        salt: salt.toString('hex'),
+        iv: iv.toString('hex'),
+        tag: cipher.getAuthTag().toString('hex'),
+        ciphertext: ciphertext.toString('hex'),
+    };
+}
+function decryptPrivateKey(file, passphrase) {
+    const encrypted = file.encrypted_private_key;
+    const { encrypted_private_key: _encrypted, ...header } = file;
+    const decipher = (0, crypto_1.createDecipheriv)('aes-256-gcm', deriveKey(passphrase, Buffer.from(encrypted.salt, 'hex'), encrypted.N), Buffer.from(encrypted.iv, 'hex'));
+    decipher.setAAD(aad(header));
+    decipher.setAuthTag(Buffer.from(encrypted.tag, 'hex'));
+    try {
+        const privateKey = Buffer.concat([
+            decipher.update(Buffer.from(encrypted.ciphertext, 'hex')),
+            decipher.final(),
+        ]).toString('hex');
+        if (!/^[0-9a-f]{64}$/.test(privateKey)
+            || (0, crypto_2.deriveAddressFromPrivateKey)(privateKey).toLowerCase() !== file.address.toLowerCase()
+            || (0, crypto_2.derivePublicKeyFromPrivateKey)(privateKey) !== file.public_key) {
+            throw new Error('Pending MCP wallet key does not match its declared identity');
+        }
+        return privateKey;
+    }
+    catch {
+        throw new Error('Unable to decrypt pending MCP wallet identity');
+    }
+}
+function atomicCreate(filePath, value) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    const temp = `${filePath}.${process.pid}.${(0, crypto_1.randomBytes)(8).toString('hex')}.tmp`;
+    const fd = fs.openSync(temp, 'wx', 0o600);
+    try {
+        fs.writeFileSync(fd, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    try {
+        fs.linkSync(temp, filePath);
+        const dirFd = fs.openSync(path.dirname(filePath), 'r');
+        try {
+            fs.fsyncSync(dirFd);
+        }
+        finally {
+            fs.closeSync(dirFd);
+        }
+    }
+    finally {
+        try {
+            fs.unlinkSync(temp);
+        }
+        catch { /* linked */ }
+    }
+}
+function fsyncParentDirectory(filePath) {
+    const directoryFd = fs.openSync(path.dirname(filePath), 'r');
+    try {
+        fs.fsyncSync(directoryFd);
+    }
+    finally {
+        fs.closeSync(directoryFd);
+    }
+}
+function unlinkDurably(filePath) {
+    fs.unlinkSync(filePath);
+    fsyncParentDirectory(filePath);
+}
+function decodedPending(raw, context, passphrase) {
+    const file = parsePendingFile(raw, context);
+    return {
+        file,
+        registration: {
+            registrationId: file.registration_id,
+            agentId: file.agent_id,
+            agentName: file.agent_name,
+            platform: file.platform,
+            constitutionAcceptedAt: file.constitution_accepted_at,
+            privateKey: decryptPrivateKey(file, passphrase),
+            publicKey: file.public_key,
+            address: file.address,
+        },
+    };
+}
+function readPending(context, passphrase, pendingPath) {
+    return decodedPending(readPrivateJson(pendingPath, 'Pending MCP wallet identity'), context, passphrase).registration;
+}
+function loadOrCreatePendingAgentWalletRegistration(context, passphrase, pendingPath = exports.MCP_PENDING_AGENT_WALLET_PATH, scryptN = 1 << 17) {
+    validateContext(context);
+    if (hasPathEntry(pendingPath))
+        return readPending(context, passphrase, pendingPath);
+    const slug = context.agent_name.toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, '-')
+        .replace(/^[-.]+|[-.]+$/g, '') || 'mcp-agent';
+    const agentId = context.requested_agent_id ?? `${slug}-${(0, crypto_1.randomBytes)(3).toString('hex')}`;
+    if (!/^[A-Za-z0-9._-]{1,128}$/.test(agentId))
+        throw new Error('agent_id format is invalid');
+    const keyPair = (0, crypto_2.generateAgentKeyPair)();
+    const createdAtMs = Date.now();
+    const header = {
+        schema_version: 'provian-mcp-agent-wallet-pending/v1',
+        context_sha256: contextHash(context),
+        registration_id: `mcp-agent-registration-${(0, crypto_1.randomUUID)()}`,
+        agent_id: agentId,
+        agent_name: context.agent_name,
+        platform: context.platform,
+        constitution_accepted_at: new Date(createdAtMs).toISOString(),
+        public_key: keyPair.publicKey,
+        address: keyPair.address,
+        created_at_ms: createdAtMs,
+    };
+    const file = {
+        ...header,
+        encrypted_private_key: encryptPrivateKey(keyPair.privateKey, header, passphrase, scryptN),
+    };
+    try {
+        atomicCreate(pendingPath, file);
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        return readPending(context, passphrase, pendingPath);
+    }
+    return { ...readPending(context, passphrase, pendingPath) };
+}
+/** Re-read the encrypted pending bytes after the relay challenge and require
+ * them to match the exact identity used for that challenge. The create POST
+ * must be built only from this second authenticated snapshot. */
+function reloadPendingAgentWalletRegistration(context, passphrase, expected, pendingPath = exports.MCP_PENDING_AGENT_WALLET_PATH) {
+    validateContext(context);
+    const reloaded = readPending(context, passphrase, pendingPath);
+    if (!(0, util_1.isDeepStrictEqual)(reloaded, expected)) {
+        throw new Error('Pending MCP wallet identity changed after the relay challenge');
+    }
+    return { ...reloaded };
+}
+function completePendingAgentWalletRegistration(registrationId, wallet, options) {
+    validateContext(options.context);
+    const pendingPath = options.pendingPath ?? exports.MCP_PENDING_AGENT_WALLET_PATH;
+    const finalPath = options.finalPath ?? exports.MCP_AGENT_WALLET_IDENTITY_PATH;
+    if (!/^wallet_aw_[A-Za-z0-9_-]+$/.test(wallet.wallet_id)
+        || !/^0x[0-9a-fA-F]{40}$/.test(wallet.address)) {
+        throw new Error('Completed MCP wallet response has a malformed wallet identity');
+    }
+    const decoded = decodedPending(readPrivateJson(pendingPath, 'Pending MCP wallet identity'), options.context, options.passphrase);
+    const pending = decoded.file;
+    if (pending.registration_id !== registrationId
+        || pending.address.toLowerCase() !== wallet.address.toLowerCase()) {
+        throw new Error('Pending MCP wallet identity changed before completion');
+    }
+    const final = {
+        schema_version: 'provian-mcp-agent-wallet/v1',
+        wallet_id: wallet.wallet_id,
+        pending_identity: pending,
+    };
+    if (hasPathEntry(finalPath)) {
+        const existing = parseFinalFile(readPrivateJson(finalPath, 'Completed MCP wallet identity'));
+        decodedPending(existing.pending_identity, options.context, options.passphrase);
+        if (!(0, util_1.isDeepStrictEqual)(existing, final)) {
+            throw new Error('A different final MCP wallet identity already exists');
+        }
+    }
+    else {
+        atomicCreate(finalPath, final);
+    }
+    options.afterDurableStage?.('final_identity_durable');
+    unlinkDurably(pendingPath);
+    options.afterDurableStage?.('pending_identity_removed');
+    return finalPath;
+}
+function loadCompletedAgentWalletIdentity(passphrase, finalPath = exports.MCP_AGENT_WALLET_IDENTITY_PATH, expectedContext) {
+    if (expectedContext)
+        validateContext(expectedContext);
+    if (!hasPathEntry(finalPath))
+        return null;
+    const final = parseFinalFile(readPrivateJson(finalPath, 'Completed MCP wallet identity'));
+    const decoded = decodedPending(final.pending_identity, expectedContext, passphrase);
+    const pending = decoded.file;
+    return {
+        walletId: final.wallet_id,
+        ...decoded.registration,
+    };
+}
+/** Remove a retained pending file only after the final encrypted identity and
+ * separate exact same-wallet credentials have both been verified by the
+ * caller. This is the restart path for a crash after final-identity fsync. */
+function clearCompletedAgentWalletPending(passphrase, expectedContext, pendingPath = exports.MCP_PENDING_AGENT_WALLET_PATH, finalPath = exports.MCP_AGENT_WALLET_IDENTITY_PATH) {
+    validateContext(expectedContext);
+    if (!hasPathEntry(pendingPath))
+        return;
+    const pending = decodedPending(readPrivateJson(pendingPath, 'Pending MCP wallet identity'), expectedContext, passphrase).file;
+    const final = parseFinalFile(readPrivateJson(finalPath, 'Completed MCP wallet identity'));
+    decodedPending(final.pending_identity, expectedContext, passphrase);
+    if (!(0, util_1.isDeepStrictEqual)(final.pending_identity, pending)) {
+        throw new Error('Pending MCP wallet identity conflicts with the completed identity');
+    }
+    unlinkDurably(pendingPath);
+}
+//# sourceMappingURL=agent-wallet-registration.js.map

package/dist/agent-wallet-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-wallet-registration.js","sourceRoot":"","sources":["../src/agent-wallet-registration.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6XA,gGAsCC;AAKD,oFAYC;AAED,wFA0CC;AAED,4EAgBC;AAKD,4EAqBC;AA5gBD,mCAOgB;AAChB,uCAAyB;AACzB,2BAA6B;AAC7B,2CAA6B;AAC7B,+BAAyC;AAEzC,0CAIuB;AAUV,QAAA,6BAA6B,GAAG,IAAI,CAAC,IAAI,CACpD,IAAA,YAAO,GAAE,EAAE,UAAU,EAAE,+BAA+B,CACvD,CAAC;AACW,QAAA,8BAA8B,GAAG,IAAI,CAAC,IAAI,CACrD,IAAA,YAAO,GAAE,EAAE,UAAU,EAAE,4BAA4B,CACpD,CAAC;AA8CF,MAAM,YAAY,GAAG;IACnB,SAAS;IACT,UAAU;IACV,YAAY;IACZ,0BAA0B;IAC1B,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,UAAU;IACV,YAAY;IACZ,iBAAiB;IACjB,gBAAgB;CACR,CAAC;AACX,MAAM,kBAAkB,GAAG;IACzB,GAAG;IACH,QAAQ;IACR,YAAY;IACZ,IAAI;IACJ,KAAK;IACL,GAAG;IACH,GAAG;IACH,MAAM;IACN,KAAK;CACG,CAAC;AACX,MAAM,UAAU,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,CAAU,CAAC;AAEhF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B,EAAE,QAA2B;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;WACnC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,KAAa;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;IAC5E,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;eACb,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAY,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAuC;IAC1D,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAChD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,OAAuC;IAC9D,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;WAC7E,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;WAChF,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG;WAC/B,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;WAC5E,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;WAC5B,CAAC,OAAO,CAAC,kBAAkB,KAAK,IAAI;eAClC,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,IAA2D;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY,EAAE,CAAS;IAC5D,OAAO,IAAA,mBAAU,EAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,eAAgD;IAEhD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,qBAAqB,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,qCAAqC;WAC7D,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;WACxC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;WAC5C,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;WACzC,CAAC,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;WACpE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;WAClC,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;WAC/C,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;WACpC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;WACpC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG;WAC7B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;WAClC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;WAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;WAC1B,OAAO,KAAK,CAAC,wBAAwB,KAAK,QAAQ;WAClD,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;WACvC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC;WAC1C,KAAK,CAAC,aAAa,GAAG,CAAC;WACvB,KAAK,CAAC,aAAa,GAAG,gBAAqB;WAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,wBAAwB;WAC9E,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;WACpC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;WACzC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;WACjC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WAC1C,SAAS,CAAC,MAAM,KAAK,aAAa;WAClC,SAAS,CAAC,GAAG,KAAK,QAAQ;WAC1B,OAAO,SAAS,CAAC,CAAC,KAAK,QAAQ;WAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;WAClC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;WACrB,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;WACrB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;WACvC,SAAS,CAAC,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,CAAC,KAAK,CAAC;WACjB,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;WAClC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;WACtC,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;WAChC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;WACpC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;WACjC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;WACrC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;WACxC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,eAAe;WACd,CAAC,KAAK,CAAC,cAAc,KAAK,WAAW,CAAC,eAAe,CAAC;eACpD,KAAK,CAAC,UAAU,KAAK,eAAe,CAAC,UAAU;eAC/C,KAAK,CAAC,QAAQ,KAAK,eAAe,CAAC,QAAQ;eAC3C,CAAC,eAAe,CAAC,kBAAkB,KAAK,IAAI;mBAC1C,KAAK,CAAC,QAAQ,KAAK,eAAe,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC;WACnD,KAAK,CAAC,cAAc,KAAK,6BAA6B;WACtD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;WACnC,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,UAAkB,EAClB,MAA6D,EAC7D,UAAkB,EAClB,CAAS;IAET,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACxG,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,GAAG,EAAE,QAAQ;QACb,CAAC;QACD,CAAC,EAAE,CAAC;QACJ,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA4B,EAAE,UAAkB;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC;IAC7C,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAC/B,aAAa,EACb,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EACtE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CACjC,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACzD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;eACjC,IAAA,oCAA2B,EAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;eACpF,IAAA,sCAA6B,EAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,KAAc;IACpD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAChF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxB,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CACrB,GAAY,EACZ,OAAmD,EACnD,UAAkB;IAElB,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI;QACJ,YAAY,EAAE;YACZ,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,sBAAsB,EAAE,IAAI,CAAC,wBAAwB;YACrD,UAAU,EAAE,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,OAAuC,EACvC,UAAkB,EAClB,WAAmB;IAEnB,OAAO,cAAc,CACnB,eAAe,CAAC,WAAW,EAAE,6BAA6B,CAAC,EAC3D,OAAO,EACP,UAAU,CACX,CAAC,YAAY,CAAC;AACjB,CAAC;AAED,SAAgB,0CAA0C,CACxD,OAAuC,EACvC,UAAkB,EAClB,cAAsB,qCAA6B,EACnD,OAAO,GAAG,CAAC,IAAI,EAAE;IAEjB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,YAAY,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE;SAC1C,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,IAAI,GAAG,IAAI,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1F,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAA,6BAAoB,GAAE,CAAC;IACvC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,MAAM,GAA0D;QACpE,cAAc,EAAE,qCAAqC;QACrD,cAAc,EAAE,WAAW,CAAC,OAAO,CAAC;QACpC,eAAe,EAAE,0BAA0B,IAAA,mBAAU,GAAE,EAAE;QACzD,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,wBAAwB,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;QAC7D,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,WAAW;KAC3B,CAAC;IACF,MAAM,IAAI,GAA2B;QACnC,GAAG,MAAM;QACT,qBAAqB,EAAE,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC;KAC1F,CAAC;IACF,IAAI,CAAC;QACH,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,OAAO,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;iEAEiE;AACjE,SAAgB,oCAAoC,CAClD,OAAuC,EACvC,UAAkB,EAClB,QAAwC,EACxC,cAAsB,qCAA6B;IAEnD,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAA,wBAAiB,EAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;AACzB,CAAC;AAED,SAAgB,sCAAsC,CACpD,cAAsB,EACtB,MAA8C,EAC9C,OAA+C;IAE/C,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qCAA6B,CAAC;IACzE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sCAA8B,CAAC;IACtE,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;WACnD,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAC5B,eAAe,CAAC,WAAW,EAAE,6BAA6B,CAAC,EAC3D,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,UAAU,CACnB,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7B,IAAI,OAAO,CAAC,eAAe,KAAK,cAAc;WACzC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAyB;QAClC,cAAc,EAAE,6BAA6B;QAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,gBAAgB,EAAE,OAAO;KAC1B,CAAC;IACF,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,cAAc,CAC7B,eAAe,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAC5D,CAAC;QACF,cAAc,CAAC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAA,wBAAiB,EAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,iBAAiB,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACtD,aAAa,CAAC,WAAW,CAAC,CAAC;IAC3B,OAAO,CAAC,iBAAiB,EAAE,CAAC,0BAA0B,CAAC,CAAC;IACxD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,gCAAgC,CAC9C,UAAkB,EAClB,YAAoB,sCAA8B,EAClD,eAAgD;IAEhD,IAAI,eAAe;QAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,cAAc,CAC1B,eAAe,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAC5D,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7B,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,GAAG,OAAO,CAAC,YAAY;KACxB,CAAC;AACJ,CAAC;AAED;;8EAE8E;AAC9E,SAAgB,gCAAgC,CAC9C,UAAkB,EAClB,eAA+C,EAC/C,cAAsB,qCAA6B,EACnD,YAAoB,sCAA8B;IAElD,eAAe,CAAC,eAAe,CAAC,CAAC;IACjC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;QAAE,OAAO;IACvC,MAAM,OAAO,GAAG,cAAc,CAC5B,eAAe,CAAC,WAAW,EAAE,6BAA6B,CAAC,EAC3D,eAAe,EACf,UAAU,CACX,CAAC,IAAI,CAAC;IACP,MAAM,KAAK,GAAG,cAAc,CAC1B,eAAe,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAC5D,CAAC;IACF,cAAc,CAAC,KAAK,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,IAAA,wBAAiB,EAAC,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,aAAa,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC"}

package/dist/core/challenge.d.ts

@@ -0,0 +1,187 @@
+/**
+ * SIGNED CHALLENGES (`provian-challenge-v1`,) — the requester's half of burn-to-present, for
+ * the MCP tool core.
+ *
+ * SHARED CORE — canonical in `provian-mcp/src/core/`, mirrored byte-identically into
+ * `provian-backend/src/mcp/core/`. Edit only the canonical copy and run `scripts/sync-mcp-core.sh`.
+ *
+ * A byte-for-byte port of the relay's `core/presentation/challenge.ts` (signing string, predicate
+ * digest, parse, structural rules, Ed25519 verdict). The MCP core cannot import the relay or the
+ * SDK, so it carries its own audited copy, pinned by the fixed vectors in
+ * `challenge.test.ts` the same vectors every other package pins.
+ *
+ * A requester hands a presenter `{ v, audience, challenge, predicates?, issuedAt, expiresAt,
+ * presenter?, requester, sig }`. With `requester`/`sig` it is SIGNED (Ed25519): a domain requester
+ * with its own key published at `https://<domain>/.well-known/provian-requester.json`, a wallet
+ * requester by the RELAY with the Provian presentation key (`/v1/present/jwks`) after it
+ * authenticated that wallet. `audience === requester.id`, so the presentation's `aud` IS the
+ * verified requester. An unsigned legacy `{ audience, challenge, predicates? }` stays valid and is
+ * shown UNVERIFIED; a signed challenge failing any check is INVALID and refused (Unknown = Block).
+ *
+ * The one outbound fetch here (a domain requester's key document) is SSRF-guarded to the same bar
+ * as the relay (Security Invariant #6): hostname regex (no IP literals, no localhost), resolve and
+ * refuse ANY private address, pin the socket to the validated address (no DNS-rebinding TOCTOU),
+ * https only, no redirects, ≤ 64 KiB, ≤ 5 s. Node built-ins only, so the relay mirror compiles with
+ * nothing new.
+ */
+import { requesterString, type PredicateRequest } from './presentation';
+import { type CanonicalDisclosureRequest } from './disclosure-request';
+export declare const CHALLENGE_SIGNING_TAG = "provian-challenge-v1";
+export declare const CHALLENGE_ENVELOPE_VERSION: 1;
+/** The requester key document path under the requester's domain. */
+export declare const REQUESTER_WELL_KNOWN_PATH = "/.well-known/provian-requester.json";
+/** Signed-challenge lifetime bounds (seconds): 60 s .. 7 days. */
+export declare const CHALLENGE_MIN_TTL_SECONDS = 60;
+export declare const CHALLENGE_MAX_TTL_SECONDS: number;
+/** Local gates default to 15 minutes. */
+export declare const CHALLENGE_DEFAULT_TTL_SECONDS = 900;
+export declare const REQUESTER_KEYS_MAX_BYTES: number;
+export declare const REQUESTER_KEYS_TIMEOUT_MS = 5000;
+export declare const REQUESTER_KEYS_CACHE_MS: number;
+export type RequesterType = 'domain' | 'wallet';
+export interface RequesterIdentity {
+    readonly type: RequesterType;
+    readonly id: string;
+    /** wallet only. */
+    readonly address?: string;
+}
+export { requesterString };
+export interface EnvelopeRequester {
+    readonly type: RequesterType;
+    /** domain: the hostname. wallet: the Provian wallet id. */
+    readonly id: string;
+    /** wallet only: the wallet's lowercase EVM address (Provian-attested). */
+    readonly address?: string;
+    /** The Ed25519 key id — the domain's well-known kid, or the Provian JWKS kid for a wallet. */
+    readonly kid: string;
+}
+export interface ChallengeEnvelope {
+    readonly v?: number;
+    readonly audience: string;
+    readonly challenge: string;
+    readonly predicates?: readonly PredicateRequest[];
+    /** Requester-named disclosure requests (2026-10-10). */
+    readonly disclosures?: readonly CanonicalDisclosureRequest[];
+    readonly issuedAt?: number;
+    readonly expiresAt?: number;
+    readonly presenter?: string;
+    readonly requester?: EnvelopeRequester;
+    readonly sig?: string;
+}
+/** One Ed25519 public key from a requester's well-known document (or the Provian JWKS). */
+export interface RequesterJwk {
+    readonly kty: string;
+    readonly crv?: string;
+    readonly x?: string;
+    readonly kid: string;
+}
+/** Fetch a domain requester's published keys. Throws when unreachable / malformed. */
+export type FetchRequesterKeys = (domain: string) => Promise<readonly RequesterJwk[]>;
+/** The Provian presentation public keys, or a lazy loader for them (fetched only for a wallet requester). */
+export type ProvianChallengeKeys = readonly RequesterJwk[] | (() => Promise<readonly RequesterJwk[]>);
+export type ChallengeInvalidReason = 'malformed' | 'unsupported_version' | 'bad_requester' | 'audience_not_requester' | 'bad_window' | 'bad_presenter' | 'bad_signature' | 'key_not_found' | 'requester_key_unreachable';
+export type ChallengeVerdict = {
+    readonly status: 'verified';
+    readonly requester: RequesterIdentity;
+    readonly envelope: ChallengeEnvelope;
+} | {
+    readonly status: 'unverified';
+    readonly envelope: ChallengeEnvelope;
+} | {
+    readonly status: 'invalid';
+    readonly reason: ChallengeInvalidReason;
+    readonly envelope?: ChallengeEnvelope;
+} | {
+    readonly status: 'expired';
+    readonly requester: RequesterIdentity;
+    readonly envelope: ChallengeEnvelope;
+} | {
+    readonly status: 'not_addressed';
+    readonly requester: RequesterIdentity;
+    readonly envelope: ChallengeEnvelope;
+};
+/** True when the envelope carries a requester signature (identity claim). */
+export declare function isSignedChallenge(env: ChallengeEnvelope): boolean;
+/**
+ * Parse an untrusted challenge envelope (object or JSON string). Structural only — no signature
+ * check. Returns null when it is not a well-formed challenge (legacy or signed).
+ */
+export declare function parseChallengeEnvelope(raw: unknown): ChallengeEnvelope | null;
+/** sha256 hex of the canonical (sorted, normalized) predicate list — the signing-string commitment. */
+export declare function challengePredicatesDigest(predicates: readonly PredicateRequest[] | undefined): string;
+/** The exact bytes a requester signs. Fixed line order, `\n`-joined, no trailing newline. */
+export declare function challengeSigningString(env: {
+    audience: string;
+    challenge: string;
+    issuedAt: number;
+    expiresAt: number;
+    requester: {
+        type: RequesterType;
+        id: string;
+        address?: string;
+        kid: string;
+    };
+    presenter?: string;
+    predicates?: readonly PredicateRequest[];
+    disclosures?: readonly CanonicalDisclosureRequest[];
+}): string;
+/** Structural rules for a SIGNED envelope (A.2), excluding the signature itself. */
+export declare function checkSignedStructure(env: ChallengeEnvelope): ChallengeInvalidReason | null;
+/**
+ * Verify a challenge envelope the way a presenter surface must BEFORE burning (A.3). Unsigned →
+ * `unverified`; signed and every check passes → `verified` (or `expired` / `not_addressed` when
+ * the signature holds but the deadline passed / the challenge names another presenter); any
+ * failure → `invalid`. A domain requester needs `fetchRequesterKeys`; a wallet requester needs
+ * `provianKeys` (the Provian presentation JWKS, or a lazy loader for it).
+ */
+export declare function verifyChallengeEnvelope(env: ChallengeEnvelope, opts?: {
+    fetchRequesterKeys?: FetchRequesterKeys;
+    provianKeys?: ProvianChallengeKeys;
+    nowSeconds?: number;
+    presenterAddress?: string;
+}): Promise<ChallengeVerdict>;
+/** Parse a well-known requester key document body (or a JWKS). Throws on a malformed document. */
+export declare function parseRequesterKeyDocument(body: unknown): RequesterJwk[];
+export interface RequesterVerdictView {
+    readonly status: ChallengeVerdict['status'];
+    /** The verified (or signature-verified but refused) identity; null for unsigned / invalid. */
+    readonly identity: RequesterIdentity | null;
+    /** invalid only: why. */
+    readonly reason?: ChallengeInvalidReason;
+    /** One line a presenter surface shows. */
+    readonly display: string;
+}
+export declare function describeVerdict(v: ChallengeVerdict): RequesterVerdictView;
+/** A fresh unsigned (legacy) challenge in the wire shape. Presenters see it as UNVERIFIED. */
+export declare function issueUnsignedChallenge(input: {
+    audience: string;
+    predicates?: readonly PredicateRequest[];
+    disclosures?: readonly CanonicalDisclosureRequest[];
+    ttlSeconds?: number;
+    presenter?: string;
+    nowSeconds?: number;
+}): ChallengeEnvelope;
+/**
+ * Private / internal / non-routable address predicate. Anything it cannot parse as a public IPv4 /
+ * IPv6 address is treated as private (fail-closed). A superset of the relay's `isPrivateIp`
+ * (adds CGNAT, multicast/reserved, IPv6 multicast, NAT64 / 6to4 which can embed a private v4).
+ */
+export declare function isPrivateIp(ip: string): boolean;
+/** A requester domain the guard will fetch from: the spec's hostname regex, never localhost. */
+export declare function isAllowedRequesterDomain(domain: string): boolean;
+export interface RequesterKeyFetchDeps {
+    /** Resolve a hostname to A + AAAA addresses (test seam). */
+    readonly resolveHostname?: (hostname: string) => Promise<string[]>;
+    /** Perform the pinned GET (test seam). Resolves the body, or null on any non-2xx / failure. */
+    readonly get?: (url: string, pinnedIp: string) => Promise<Buffer | null>;
+    readonly nowMs?: () => number;
+}
+/** Clear the per-domain key cache (tests / key rotation). */
+export declare function clearRequesterKeyCache(): void;
+/**
+ * Fetch a domain requester's Ed25519 keys, SSRF-guarded. Throws on any failure (the caller maps a
+ * throw to `requester_key_unreachable`, never to a verified identity). Cached 5 minutes per domain
+ * so one requester cannot turn a presenter surface into a request amplifier.
+ */
+export declare function fetchRequesterKeysGuarded(domain: string, deps?: RequesterKeyFetchDeps): Promise<RequesterJwk[]>;
+//# sourceMappingURL=challenge.d.ts.map

package/dist/core/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../src/core/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,OAAO,EAOL,eAAe,EACf,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA2D,KAAK,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAEhI,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,EAAG,CAAU,CAAC;AACrD,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,wCAAwC,CAAC;AAC/E,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,yCAAyC;AACzC,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD,eAAO,MAAM,wBAAwB,QAAY,CAAC;AAClD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,uBAAuB,QAAgB,CAAC;AASrD,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mBAAmB;IACnB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,wDAAwD;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,2FAA2F;AAC3F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;AACtF,6GAA6G;AAC7G,MAAM,MAAM,oBAAoB,GAAG,SAAS,YAAY,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC,CAAC;AAEtG,MAAM,MAAM,sBAAsB,GAC9B,WAAW,GACX,qBAAqB,GACrB,eAAe,GACf,wBAAwB,GACxB,YAAY,GACZ,eAAe,GACf,eAAe,GACf,eAAe,GACf,2BAA2B,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GAC5G;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAA;CAAE,GAC9G;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GAC3G;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAMtH,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAEjE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAwB7E;AAED,uGAAuG;AACvG,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,GAAG,MAAM,CAGrG;AAED,6FAA6F;AAC7F,wBAAgB,sBAAsB,CAAC,GAAG,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACzC,WAAW,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACrD,GAAG,MAAM,CAcT;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,GAAG,sBAAsB,GAAG,IAAI,CAmB1F;AAeD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,iBAAiB,EACtB,IAAI,GAAE;IACJ,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACtB,GACL,OAAO,CAAC,gBAAgB,CAAC,CAuC3B;AAED,kGAAkG;AAClG,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,EAAE,CASvE;AAMD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC5C,yBAAyB;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IACzC,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD,wBAAgB,eAAe,CAAC,CAAC,EAAE,gBAAgB,GAAG,oBAAoB,CAazE;AAED,8FAA8F;AAC9F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACzC,WAAW,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,iBAAiB,CAUpB;AAqDD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAkC/C;AAED,gGAAgG;AAChG,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,+FAA+F;IAC/F,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAsDD,6DAA6D;AAC7D,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAqBzH"}