@safebrowse/core 0.1.2-rc.1

package/dist/toolProtocolV2.js

@@ -0,0 +1,330 @@
+import { randomUUID } from "node:crypto";
+import { normalizeTrustSignals } from "./trust.js";
+import { clamp, isPrivateHost, normalizeOrigin, sha256Hex, stableStringify, uniq } from "./utils.js";
+const SECURITY_SENSITIVE_TEXT = /\b(?:attach|carry|forward|include|pass|relay|send|submit|transport)\b[\s\S]{0,48}\b(?:authorization proof|bearer|callback|credential|secret|session|token)\b/i;
+const CALLBACK_CONTINUITY_TEXT = /\b(?:callback continuity|continue|continuity|handshake|onboarding|finalize|finalise|resume)\b/i;
+function matchToolPatterns(reasons, patterns) {
+    const hints = reasons.join(" ").toLowerCase();
+    return patterns
+        .filter((pattern) => {
+        const family = String(pattern.family_key ?? "").toLowerCase();
+        const name = String(pattern.pattern_name ?? "").toLowerCase();
+        return ((hints.includes("registry") && family.includes("registry")) ||
+            (hints.includes("redirect") && name.includes("redirect")) ||
+            (hints.includes("callback") && name.includes("callback")) ||
+            (hints.includes("schema") && family.includes("schema")) ||
+            (hints.includes("artifact") && family.includes("artifact")) ||
+            (hints.includes("token") && name.includes("token")));
+    })
+        .slice(0, 8)
+        .map((pattern) => String(pattern.pattern_id ?? "unknown-tool-pattern"));
+}
+export function computeToolManifestHash(request) {
+    return sha256Hex(stableStringify({
+        toolId: request.toolId,
+        description: request.description,
+        authType: request.authType ?? "none",
+        requestedScopes: request.requestedScopes ?? [],
+        callbackUri: request.callbackUri ?? request.requestedRedirectUri ?? ""
+    }));
+}
+export function computeToolSchemaHash(schemaDescriptions) {
+    return sha256Hex(stableStringify(schemaDescriptions ?? []));
+}
+function findRegistryEntry(request, context) {
+    const registry = context.verifiedRegistry;
+    if (!registry?.signatureVerified) {
+        return undefined;
+    }
+    const requestIds = uniq([
+        request.registryEntryId,
+        request.toolId
+    ].filter((value) => Boolean(value?.trim())));
+    return registry.entries.find((entry) => requestIds.includes(entry.registryEntryId) || requestIds.includes(entry.adapterId));
+}
+function inferOriginatingSurface(request) {
+    if (request.originatingSurface) {
+        return request.originatingSurface;
+    }
+    if (request.sourceArtifactId) {
+        return "artifact";
+    }
+    if (request.schemaDescriptions?.length) {
+        return "tool_schema";
+    }
+    return "tool_description";
+}
+function buildWorkflowBinding(request, lineageChain, derivedTaintClass, createdAt) {
+    return {
+        bindingId: randomUUID(),
+        sourceObservationId: request.sourceObservationId,
+        sourceArtifactId: request.sourceArtifactId,
+        originatingSurface: inferOriginatingSurface(request),
+        lineageChain,
+        derivedTaintClass,
+        createdAt
+    };
+}
+function isEntryExpired(entry, now = new Date()) {
+    if (!entry?.expiresAt) {
+        return false;
+    }
+    return new Date(entry.expiresAt).getTime() <= now.getTime();
+}
+function resolveCallbackUri(request) {
+    return (request.oauthContext?.callbackUri ??
+        request.callbackUri ??
+        request.oauthContext?.redirectUri ??
+        request.requestedRedirectUri);
+}
+function resolveCallbackOrigin(request, callbackUri) {
+    return normalizeOrigin(request.oauthContext?.callbackOrigin ?? request.callbackOrigin ?? callbackUri);
+}
+function containsSensitiveCallbackText(request) {
+    const texts = [request.description, ...(request.schemaDescriptions ?? [])].filter(Boolean);
+    return texts.some((text) => SECURITY_SENSITIVE_TEXT.test(text) || CALLBACK_CONTINUITY_TEXT.test(text));
+}
+function derivedTaintClass(request, trustTaint) {
+    if (request.sourceArtifactId || request.originatingSurface === "artifact") {
+        return "tainted";
+    }
+    if (request.schemaDescriptions?.length || request.originatingSurface === "tool_schema") {
+        return "tainted";
+    }
+    return trustTaint === "trusted" ? "trusted" : "tainted";
+}
+function isPrivilegedConnectorFlow(request, callbackUri) {
+    return Boolean(request.authType === "oauth" ||
+        callbackUri ||
+        request.requestedScopes?.length ||
+        request.oauthContext?.requestedScopes?.length);
+}
+function isAllowedCallbackOrigin(callbackOrigin, entry, context) {
+    if (entry.allowedCallbackOrigins.length) {
+        return entry.allowedCallbackOrigins.includes(callbackOrigin);
+    }
+    if (callbackOrigin === "unknown") {
+        return false;
+    }
+    let host = callbackOrigin;
+    try {
+        host = new URL(callbackOrigin).hostname;
+    }
+    catch {
+        host = callbackOrigin;
+    }
+    if (isPrivateHost(host)) {
+        return entry.allowLoopbackCallbacks || context.policy.allowLoopbackCallbacksInDev;
+    }
+    return true;
+}
+export function prepareToolOnboarding(request, context) {
+    const now = (context.now?.() ?? new Date()).toISOString();
+    const trustSignals = normalizeTrustSignals({
+        artifactKind: "tool_manifest",
+        extractionMethod: "api",
+        ...(request.trustSignals ?? {})
+    });
+    const lineageChain = trustSignals.lineageChain;
+    const taint = derivedTaintClass(request, trustSignals.taintClass);
+    const workflowBinding = buildWorkflowBinding(request, lineageChain, taint, now);
+    const callbackUri = resolveCallbackUri(request);
+    const callbackOrigin = resolveCallbackOrigin(request, callbackUri);
+    const entry = findRegistryEntry(request, context);
+    const reasonCodes = [];
+    let decision = "ALLOW";
+    let riskScore = 0.35;
+    if (context.policy.requireVerifiedRegistry && !context.verifiedRegistry?.signatureVerified) {
+        decision = "BLOCK";
+        reasonCodes.push("REGISTRY_BUNDLE_UNAVAILABLE");
+        riskScore = 0.98;
+    }
+    if (!entry) {
+        decision = "BLOCK";
+        reasonCodes.push("REGISTRY_ENTRY_NOT_FOUND");
+        riskScore = Math.max(riskScore, 0.98);
+    }
+    if (entry && isEntryExpired(entry, new Date(now))) {
+        decision = "BLOCK";
+        reasonCodes.push("REGISTRY_ENTRY_EXPIRED");
+        riskScore = Math.max(riskScore, 0.98);
+    }
+    if (entry &&
+        context.policy.allowedRegistrySigners.size &&
+        !context.policy.allowedRegistrySigners.has(entry.signer.toLowerCase())) {
+        decision = "BLOCK";
+        reasonCodes.push("REGISTRY_SIGNER_NOT_ALLOWLISTED");
+        riskScore = Math.max(riskScore, 0.95);
+    }
+    if (entry && request.authType && request.authType !== entry.authType) {
+        decision = "BLOCK";
+        reasonCodes.push("AUTH_TYPE_MISMATCH");
+        riskScore = Math.max(riskScore, 0.92);
+    }
+    if (request.tokenPassthroughRequested || containsSensitiveCallbackText(request)) {
+        decision = "BLOCK";
+        reasonCodes.push("SECURITY_SENSITIVE_CALLBACK_TEXT");
+        riskScore = Math.max(riskScore, 0.99);
+    }
+    if (entry?.manifestHash) {
+        if (!request.manifestHash) {
+            decision = "BLOCK";
+            reasonCodes.push("MANIFEST_HASH_REQUIRED");
+            riskScore = Math.max(riskScore, 0.97);
+        }
+        else if (request.manifestHash !== entry.manifestHash) {
+            decision = "BLOCK";
+            reasonCodes.push("MANIFEST_HASH_MISMATCH");
+            riskScore = Math.max(riskScore, 0.99);
+        }
+    }
+    if (entry?.schemaHash) {
+        if (!request.schemaHash) {
+            decision = "BLOCK";
+            reasonCodes.push("SCHEMA_HASH_REQUIRED");
+            riskScore = Math.max(riskScore, 0.97);
+        }
+        else if (request.schemaHash !== entry.schemaHash) {
+            decision = "BLOCK";
+            reasonCodes.push("SCHEMA_HASH_MISMATCH");
+            riskScore = Math.max(riskScore, 0.99);
+        }
+    }
+    if (request.egressHosts?.some((host) => isPrivateHost(host)) && !entry?.allowPrivateEgress) {
+        decision = "BLOCK";
+        reasonCodes.push("PRIVATE_EGRESS_DENIED");
+        riskScore = Math.max(riskScore, 0.96);
+    }
+    if (request.authType === "oauth") {
+        if (!callbackUri) {
+            decision = "BLOCK";
+            reasonCodes.push("CALLBACK_URI_REQUIRED");
+            riskScore = Math.max(riskScore, 0.96);
+        }
+        if (entry &&
+            context.policy.enforceExactRedirectUri &&
+            callbackUri &&
+            !entry.allowedRedirectUris.includes(callbackUri)) {
+            decision = "BLOCK";
+            reasonCodes.push("CALLBACK_URI_NOT_VERIFIED");
+            riskScore = Math.max(riskScore, 0.99);
+        }
+        if (entry && callbackUri && !isAllowedCallbackOrigin(callbackOrigin, entry, context)) {
+            decision = "BLOCK";
+            reasonCodes.push("CALLBACK_ORIGIN_NOT_VERIFIED");
+            riskScore = Math.max(riskScore, 0.99);
+        }
+    }
+    if (request.requestedScopes?.length && entry?.allowedScopes.length) {
+        const unknownScopes = request.requestedScopes.filter((scope) => !entry.allowedScopes.includes(scope));
+        if (unknownScopes.length) {
+            decision = "BLOCK";
+            reasonCodes.push("REQUESTED_SCOPE_NOT_VERIFIED");
+            riskScore = Math.max(riskScore, 0.97);
+        }
+    }
+    const privilegedConnectorFlow = isPrivilegedConnectorFlow(request, callbackUri);
+    const untrustedDerivation = taint !== "trusted";
+    if (privilegedConnectorFlow && context.policy.requireApprovalBinding && !request.approvalBindingId) {
+        decision = untrustedDerivation ? "BLOCK" : decision === "ALLOW" ? "USER_CONFIRM" : decision;
+        reasonCodes.push(untrustedDerivation
+            ? "APPROVAL_BINDING_REQUIRED_FOR_UNTRUSTED_FLOW"
+            : "APPROVAL_BINDING_REQUIRED");
+        riskScore = Math.max(riskScore, 0.82);
+    }
+    if (privilegedConnectorFlow && untrustedDerivation && request.approvalBindingId && decision === "ALLOW") {
+        decision = "USER_CONFIRM";
+        reasonCodes.push("UNTRUSTED_CONNECTOR_FLOW_REQUIRES_CONFIRMATION");
+        riskScore = Math.max(riskScore, 0.88);
+    }
+    const matchedPatternIds = matchToolPatterns(reasonCodes, context.knowledgeBase?.toolProtocolPatterns ?? []);
+    return {
+        verdict: {
+            decision,
+            reasonCodes: uniq(reasonCodes),
+            riskScore: clamp(riskScore),
+            safeConstraints: {
+                verified_registry_required: context.policy.requireVerifiedRegistry,
+                approval_binding_required: context.policy.requireApprovalBinding,
+                oauth_mode: request.authType === "oauth" ? "pkce_s256" : "none",
+                allowed_callback_fields: ["code", "state", "iss"],
+                callback_origin: callbackOrigin,
+                derived_from_untrusted_artifact: request.originatingSurface === "artifact",
+                derived_from_schema_text: inferOriginatingSurface(request) === "tool_schema"
+            },
+            matchedPatternIds,
+            incidentPlaybookId: decision === "BLOCK" ? "IR-04" : decision === "USER_CONFIRM" ? "IR-02" : undefined,
+            telemetryTags: uniq([
+                request.toolId,
+                inferOriginatingSurface(request),
+                decision.toLowerCase()
+            ])
+        },
+        verifiedRegistryEntry: entry,
+        workflowBinding
+    };
+}
+export function verifyToolCallback(request, session, context) {
+    const verifiedAt = (context.now?.() ?? new Date()).toISOString();
+    const reasonCodes = [];
+    let decision = "ALLOW";
+    let riskScore = 0.2;
+    if (!session) {
+        decision = "BLOCK";
+        reasonCodes.push("UNKNOWN_ONBOARDING_SESSION");
+        riskScore = 0.99;
+    }
+    else {
+        if (session.status !== "prepared") {
+            decision = "BLOCK";
+            reasonCodes.push("ONBOARDING_SESSION_NOT_ACTIVE");
+            riskScore = Math.max(riskScore, 0.99);
+        }
+        if (new Date(session.expiresAt).getTime() <= new Date(verifiedAt).getTime()) {
+            decision = "BLOCK";
+            reasonCodes.push("ONBOARDING_SESSION_EXPIRED");
+            riskScore = Math.max(riskScore, 0.99);
+        }
+        if (request.state !== session.state) {
+            decision = "BLOCK";
+            reasonCodes.push("CALLBACK_STATE_MISMATCH");
+            riskScore = Math.max(riskScore, 0.99);
+        }
+        if (request.callbackUri !== session.callbackUri) {
+            decision = "BLOCK";
+            reasonCodes.push("CALLBACK_URI_MISMATCH");
+            riskScore = Math.max(riskScore, 0.99);
+        }
+        if (normalizeOrigin(request.callbackOrigin) !== normalizeOrigin(session.callbackOrigin)) {
+            decision = "BLOCK";
+            reasonCodes.push("CALLBACK_ORIGIN_MISMATCH");
+            riskScore = Math.max(riskScore, 0.99);
+        }
+    }
+    const payloadKeys = Object.keys(request.payload ?? {});
+    if (payloadKeys.some((key) => /(authorization|bearer|secret|session|token)/i.test(key))) {
+        decision = "BLOCK";
+        reasonCodes.push("DISALLOWED_CALLBACK_FIELDS");
+        riskScore = Math.max(riskScore, 0.99);
+    }
+    const matchedPatternIds = matchToolPatterns(reasonCodes, context.knowledgeBase?.toolProtocolPatterns ?? []);
+    return {
+        verdict: {
+            decision,
+            reasonCodes: uniq(reasonCodes),
+            riskScore: clamp(riskScore),
+            safeConstraints: {
+                verified_registry_required: context.policy.requireVerifiedRegistry,
+                approval_binding_required: context.policy.requireApprovalBinding,
+                oauth_mode: "pkce_s256",
+                allowed_callback_fields: ["code", "state", "iss"]
+            },
+            matchedPatternIds,
+            incidentPlaybookId: decision === "BLOCK" ? "IR-04" : undefined,
+            telemetryTags: uniq([request.sessionId, decision.toLowerCase()])
+        },
+        sessionId: request.sessionId,
+        verifiedAt
+    };
+}
+//# sourceMappingURL=toolProtocolV2.js.map

package/dist/toolProtocolV2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolProtocolV2.js","sourceRoot":"","sources":["../src/toolProtocolV2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAczC,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAErG,MAAM,uBAAuB,GAC3B,+JAA+J,CAAC;AAElK,MAAM,wBAAwB,GAC5B,gGAAgG,CAAC;AAEnG,SAAS,iBAAiB,CACxB,OAAiB,EACjB,QAAwC;IAExC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9D,OAAO,CACL,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3D,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvD,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3D,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACpD,CAAC;IACJ,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,sBAAsB,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAGvC;IACC,OAAO,SAAS,CACd,eAAe,CAAC;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE;QAC9C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,oBAAoB,IAAI,EAAE;KACvE,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,kBAA6B;IACjE,OAAO,SAAS,CAAC,eAAe,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAoB,EACpB,OAAuB;IAEvB,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC;QACtB,OAAO,CAAC,eAAe;QACvB,OAAO,CAAC,MAAM;KACf,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9D,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CACR,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAoB;IACnD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,kBAAkB,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAoB,EACpB,YAAsB,EACtB,iBAAuD,EACvD,SAAiB;IAEjB,OAAO;QACL,SAAS,EAAE,UAAU,EAAE;QACvB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,kBAAkB,EAAE,uBAAuB,CAAC,OAAO,CAAC;QACpD,YAAY;QACZ,iBAAiB;QACjB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAA6B,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACrE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoB;IAC9C,OAAO,CACL,OAAO,CAAC,YAAY,EAAE,WAAW;QACjC,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,YAAY,EAAE,WAAW;QACjC,OAAO,CAAC,oBAAoB,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAoB,EAAE,WAAoB;IACvE,OAAO,eAAe,CACpB,OAAO,CAAC,YAAY,EAAE,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,WAAW,CAC9E,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,OAAoB;IACzD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoB,EAAE,UAAkB;IACjE,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,EAAE,MAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,aAAa,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAoB,EAAE,WAAoB;IAC3E,OAAO,OAAO,CACZ,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,WAAW;QACX,OAAO,CAAC,eAAe,EAAE,MAAM;QAC/B,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,cAAsB,EACtB,KAA4B,EAC5B,OAAuB;IAEvB,IAAI,KAAK,CAAC,sBAAsB,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,sBAAsB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,GAAG,cAAc,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,cAAc,CAAC;IACxB,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,2BAA2B,CAAC;IACpF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAoB,EACpB,OAAuB;IAEvB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,YAAY,EAAE,eAAe;QAC7B,gBAAgB,EAAE,KAAK;QACvB,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;IAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAElD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,QAAQ,GAA4B,OAAO,CAAC;IAChD,IAAI,SAAS,GAAG,IAAI,CAAC;IAErB,IAAI,OAAO,CAAC,MAAM,CAAC,uBAAuB,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;QAC3F,QAAQ,GAAG,OAAO,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAChD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,GAAG,OAAO,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC7C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,KAAK,IAAI,cAAc,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAClD,QAAQ,GAAG,OAAO,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC3C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,IACE,KAAK;QACL,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI;QAC1C,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EACtE,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,KAAK,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrE,QAAQ,GAAG,OAAO,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACvC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,yBAAyB,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,QAAQ,GAAG,OAAO,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACrD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,KAAK,EAAE,YAAY,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAC3C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YACvD,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAC3C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,KAAK,EAAE,UAAU,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACzC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YACnD,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACzC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC3F,QAAQ,GAAG,OAAO,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC1C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC1C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,IACE,KAAK;YACL,OAAO,CAAC,MAAM,CAAC,uBAAuB;YACtC,WAAW;YACX,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAChD,CAAC;YACD,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC9C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACrF,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YACjD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,MAAM,IAAI,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC;QACnE,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAClD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAChD,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;YACzB,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YACjD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,uBAAuB,GAAG,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChF,MAAM,mBAAmB,GAAG,KAAK,KAAK,SAAS,CAAC;IAChD,IAAI,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,sBAAsB,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACnG,QAAQ,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5F,WAAW,CAAC,IAAI,CACd,mBAAmB;YACjB,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,2BAA2B,CAChC,CAAC;QACF,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,uBAAuB,IAAI,mBAAmB,IAAI,OAAO,CAAC,iBAAiB,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxG,QAAQ,GAAG,cAAc,CAAC;QAC1B,WAAW,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACnE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,iBAAiB,GAAG,iBAAiB,CACzC,WAAW,EACX,OAAO,CAAC,aAAa,EAAE,oBAAoB,IAAI,EAAE,CAClD,CAAC;IAEF,OAAO;QACL,OAAO,EAAE;YACP,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;YAC3B,eAAe,EAAE;gBACf,0BAA0B,EAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB;gBAClE,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,sBAAsB;gBAChE,UAAU,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;gBAC/D,uBAAuB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;gBACjD,eAAe,EAAE,cAAc;gBAC/B,+BAA+B,EAAE,OAAO,CAAC,kBAAkB,KAAK,UAAU;gBAC1E,wBAAwB,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,aAAa;aAC7E;YACD,iBAAiB;YACjB,kBAAkB,EAChB,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACpF,aAAa,EAAE,IAAI,CAAC;gBAClB,OAAO,CAAC,MAAM;gBACd,uBAAuB,CAAC,OAAO,CAAC;gBAChC,QAAQ,CAAC,WAAW,EAAE;aACvB,CAAC;SACH;QACD,qBAAqB,EAAE,KAAK;QAC5B,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAwC,EACxC,OAA0C,EAC1C,OAAuB;IAEvB,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,QAAQ,GAA4B,OAAO,CAAC;IAChD,IAAI,SAAS,GAAG,GAAG,CAAC;IAEpB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,QAAQ,GAAG,OAAO,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC/C,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAClD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5E,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC/C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YACpC,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAC5C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YAChD,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC1C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,eAAe,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACxF,QAAQ,GAAG,OAAO,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC7C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,8CAA8C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACxF,QAAQ,GAAG,OAAO,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC/C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,iBAAiB,GAAG,iBAAiB,CACzC,WAAW,EACX,OAAO,CAAC,aAAa,EAAE,oBAAoB,IAAI,EAAE,CAClD,CAAC;IAEF,OAAO;QACL,OAAO,EAAE;YACP,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;YAC3B,eAAe,EAAE;gBACf,0BAA0B,EAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB;gBAClE,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,sBAAsB;gBAChE,UAAU,EAAE,WAAW;gBACvB,uBAAuB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;aAClD;YACD,iBAAiB;YACjB,kBAAkB,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC9D,aAAa,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;SACjE;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/trust.d.ts

@@ -0,0 +1,4 @@
+import type { TrustSignalSet } from "./types.js";
+export declare function normalizeTrustSignals(input?: Partial<TrustSignalSet>): TrustSignalSet;
+export declare function appendLineage(trustSignals: TrustSignalSet, lineageId: string): TrustSignalSet;
+//# sourceMappingURL=trust.d.ts.map

package/dist/trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../src/trust.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAkC,cAAc,EAAmB,MAAM,YAAY,CAAC;AAGlG,wBAAgB,qBAAqB,CAAC,KAAK,GAAE,OAAO,CAAC,cAAc,CAAM,GAAG,cAAc,CAyBzF;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc,CAK7F"}

package/dist/trust.js

@@ -0,0 +1,32 @@
+import { randomUUID } from "node:crypto";
+import { normalizeOrigin, sameOriginRelation } from "./utils.js";
+export function normalizeTrustSignals(input = {}) {
+    const sourceOrigin = normalizeOrigin(input.sourceOrigin);
+    const frameOrigin = normalizeOrigin(input.frameOrigin ?? input.sourceOrigin);
+    const relation = input.sameOriginRelation ?? sameOriginRelation(sourceOrigin, frameOrigin);
+    return {
+        sourceOrigin,
+        frameOrigin,
+        sameOriginRelation: relation,
+        visibilityClass: (input.visibilityClass ?? "visible"),
+        extractionMethod: (input.extractionMethod ?? "dom"),
+        artifactKind: (input.artifactKind ?? "page"),
+        taintClass: input.taintClass ??
+            (input.userSharedFlag
+                ? "user-provided"
+                : input.sessionDiscoveredFlag
+                    ? "session-discovered"
+                    : "untrusted"),
+        approvalBindingId: input.approvalBindingId,
+        lineageChain: input.lineageChain?.length ? input.lineageChain : [randomUUID()],
+        userSharedFlag: input.userSharedFlag ?? false,
+        sessionDiscoveredFlag: input.sessionDiscoveredFlag ?? true
+    };
+}
+export function appendLineage(trustSignals, lineageId) {
+    return {
+        ...trustSignals,
+        lineageChain: [...trustSignals.lineageChain, lineageId]
+    };
+}
+//# sourceMappingURL=trust.js.map

package/dist/trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../src/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,UAAU,qBAAqB,CAAC,QAAiC,EAAE;IACvE,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7E,MAAM,QAAQ,GACZ,KAAK,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAE5E,OAAO;QACL,YAAY;QACZ,WAAW;QACX,kBAAkB,EAAE,QAAQ;QAC5B,eAAe,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,SAAS,CAAoB;QACxE,gBAAgB,EAAE,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAqB;QACvE,YAAY,EAAE,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAiB;QAC5D,UAAU,EACR,KAAK,CAAC,UAAU;YAChB,CAAC,KAAK,CAAC,cAAc;gBACnB,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,KAAK,CAAC,qBAAqB;oBAC3B,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,WAAW,CAAC;QACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAC9E,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,KAAK;QAC7C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAA4B,EAAE,SAAiB;IAC3E,OAAO;QACL,GAAG,YAAY;QACf,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC;KACxD,CAAC;AACJ,CAAC"}