@sphereon/ssi-sdk-ext.jwt-service 0.28.1-feature.jose.vcdm.52 → 0.28.1-feature.oyd.cmsm.improv.20

package/dist/functions/index.js

@@ -0,0 +1,385 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toJwsJsonGeneralWithIdentifiers = exports.toJwsJsonGeneral = exports.verifyJws = exports.checkAndUpdateJwsHeader = exports.createJwsJsonGeneral = exports.createJwsJsonFlattened = exports.createJwsCompact = exports.prepareJwsObject = void 0;
+const ssi_sdk_ext_identifier_resolution_1 = require("@sphereon/ssi-sdk-ext.identifier-resolution");
+const ssi_sdk_ext_key_utils_1 = require("@sphereon/ssi-sdk-ext.key-utils");
+const utils_1 = require("@veramo/utils");
+const u8a = __importStar(require("uint8arrays"));
+const IJwtService_1 = require("../types/IJwtService");
+const payloadToBytes = (payload) => {
+    const isBytes = payload instanceof Uint8Array;
+    const isString = typeof payload === 'string';
+    return isBytes ? payload : isString ? u8a.fromString(payload, 'base64url') : u8a.fromString(JSON.stringify(payload), 'utf-8');
+};
+const prepareJwsObject = (args, context) => __awaiter(void 0, void 0, void 0, function* () {
+    const { existingSignatures, protectedHeader, unprotectedHeader, issuer, payload, mode = 'auto', clientId, clientIdScheme } = args;
+    const { noIdentifierInHeader = false } = issuer;
+    const identifier = yield (0, ssi_sdk_ext_identifier_resolution_1.ensureManagedIdentifierResult)(issuer, context);
+    yield (0, exports.checkAndUpdateJwsHeader)({ mode, identifier, noIdentifierInHeader, header: protectedHeader }, context);
+    const isBytes = payload instanceof Uint8Array;
+    const isString = typeof payload === 'string';
+    if (!isBytes && !isString) {
+        if (issuer.noIssPayloadUpdate !== true && !payload.iss && identifier.issuer) {
+            payload.iss = identifier.issuer;
+        }
+        if (clientIdScheme && !payload.client_id_scheme) {
+            payload.client_id_scheme = clientIdScheme;
+        }
+        if (clientId && !payload.client_id) {
+            payload.client_id = clientId;
+        }
+    }
+    const payloadBytes = payloadToBytes(payload);
+    const base64urlHeader = (0, utils_1.encodeJoseBlob)(protectedHeader);
+    const base64urlPayload = (0, utils_1.bytesToBase64url)(payloadBytes);
+    return {
+        jws: {
+            unprotectedHeader,
+            protectedHeader,
+            payload: payloadBytes,
+            existingSignatures,
+        },
+        b64: {
+            protectedHeader: base64urlHeader,
+            payload: base64urlPayload,
+        },
+        identifier,
+    };
+});
+exports.prepareJwsObject = prepareJwsObject;
+const createJwsCompact = (args, context) => __awaiter(void 0, void 0, void 0, function* () {
+    const { protected: protectedHeader, payload, signature } = yield (0, exports.createJwsJsonFlattened)(args, context);
+    return `${protectedHeader}.${payload}.${signature}`;
+});
+exports.createJwsCompact = createJwsCompact;
+const createJwsJsonFlattened = (args, context) => __awaiter(void 0, void 0, void 0, function* () {
+    const jws = yield (0, exports.createJwsJsonGeneral)(args, context);
+    if (jws.signatures.length !== 1) {
+        return Promise.reject(Error(`JWS flattened signature can only contain 1 signature. Found ${jws.signatures.length}`));
+    }
+    return Object.assign(Object.assign({}, jws.signatures[0]), { payload: jws.payload });
+});
+exports.createJwsJsonFlattened = createJwsJsonFlattened;
+const createJwsJsonGeneral = (args, context) => __awaiter(void 0, void 0, void 0, function* () {
+    const { payload, protectedHeader, unprotectedHeader, existingSignatures, mode, issuer } = args;
+    const { b64, identifier } = yield (0, exports.prepareJwsObject)({
+        protectedHeader,
+        unprotectedHeader,
+        payload,
+        existingSignatures,
+        issuer,
+        mode,
+    }, context);
+    // const algorithm = await signatureAlgorithmFromKey({ key: identifier.key })
+    const signature = yield context.agent.keyManagerSign({
+        keyRef: identifier.kmsKeyRef,
+        data: `${b64.protectedHeader}.${b64.payload}`,
+        encoding: undefined,
+    });
+    const jsonSignature = {
+        protected: b64.protectedHeader,
+        header: unprotectedHeader,
+        signature,
+    };
+    return {
+        payload: b64.payload,
+        signatures: [...(existingSignatures !== null && existingSignatures !== void 0 ? existingSignatures : []), jsonSignature],
+    };
+});
+exports.createJwsJsonGeneral = createJwsJsonGeneral;
+/**
+ * Updates the JWT header to include x5c, kid, jwk objects using the supplied issuer identifier that will be used to sign. If not present will automatically make the header objects available
+ * @param mode The type of header to check or include
+ * @param identifier The identifier of the signer. This identifier will be used later to sign
+ * @param header The JWT header
+ * @param noIdentifierInHeader
+ * @param context
+ */
+const checkAndUpdateJwsHeader = (_a, context_1) => __awaiter(void 0, [_a, context_1], void 0, function* ({ mode = 'auto', identifier, header, noIdentifierInHeader = false, }, context) {
+    if (isIdentifierMode(mode, identifier.method, 'did')) {
+        // kid is VM of the DID
+        // @see https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.4
+        yield checkAndUpdateDidHeader({ header, identifier, noIdentifierInHeader }, context);
+    }
+    else if (isIdentifierMode(mode, identifier.method, 'x5c')) {
+        // Include the x5c in the header. No kid
+        // @see https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.6
+        yield checkAndUpdateX5cHeader({ header, identifier, noIdentifierInHeader }, context);
+    }
+    else if (isIdentifierMode(mode, identifier.method, 'kid', false)) {
+        yield checkAndUpdateKidHeader({ header, identifier, noIdentifierInHeader }, context);
+    }
+    else if (isIdentifierMode(mode, identifier.method, 'jwk', false)) {
+        // Include the JWK in the header as well as its kid if present
+        // @see https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.3
+        // @see https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.4
+        yield checkAndUpdateJwkHeader({ header, identifier, noIdentifierInHeader }, context);
+    }
+    else {
+        // Better safe than sorry. We could let it pass, but we want to force implementers to make a conscious choice
+        return Promise.reject(`Invalid combination of JWS creation mode ${mode} and identifier method ${identifier.method} chosen`);
+    }
+});
+exports.checkAndUpdateJwsHeader = checkAndUpdateJwsHeader;
+const checkAndUpdateX5cHeader = (_a, context_1) => __awaiter(void 0, [_a, context_1], void 0, function* ({ header, identifier, noIdentifierInHeader = false, }, context) {
+    const { x5c } = header;
+    if (x5c) {
+        // let's resolve the provided x5c to be sure
+        const x5cIdentifier = yield context.agent.identifierManagedGetByX5c({ identifier: x5c });
+        if (x5cIdentifier.kmsKeyRef !== identifier.kmsKeyRef) {
+            return Promise.reject(Error(`An x5c header was present, but its issuer public key did not match the provided signing public key!`));
+        }
+    }
+    else if (!noIdentifierInHeader) {
+        if (!(0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierX5cResult)(identifier)) {
+            return Promise.reject(Error('No x5c header in the JWT, but mode was x5c and also no x5x identifier was provided!'));
+        }
+        else if (header.jwk || header.kid) {
+            return Promise.reject(Error('x5c mode was choosen, but jwk or kid headers were provided. These cannot be used together!'));
+        }
+        header.x5c = identifier.x5c;
+    }
+});
+const checkAndUpdateDidHeader = (_a, context_1) => __awaiter(void 0, [_a, context_1], void 0, function* ({ header, identifier, noIdentifierInHeader = false, }, context) {
+    const { kid } = header;
+    if (kid) {
+        // let's resolve the provided x5c to be sure
+        const vmIdentifier = yield context.agent.identifierManagedGetByDid({ identifier: kid });
+        if (vmIdentifier.kmsKeyRef !== identifier.kmsKeyRef) {
+            return Promise.reject(Error(`A kid header was present, but its value did not match the provided signing kid!`));
+        }
+    }
+    else if (!noIdentifierInHeader) {
+        if (!(0, ssi_sdk_ext_identifier_resolution_1.isManagedIdentifierDidResult)(identifier)) {
+            return Promise.reject(Error('No kid header in the JWT, but mode was did and also no DID identifier was provided!'));
+        }
+        else if (header.jwk || header.x5c) {
+            return Promise.reject(Error('did mode was chosen, but jwk or x5c headers were provided. These cannot be used together!'));
+        }
+        header.kid = identifier.kid;
+    }
+});
+const checkAndUpdateJwkHeader = (_a, context_1) => __awaiter(void 0, [_a, context_1], void 0, function* ({ header, identifier, noIdentifierInHeader = false, }, context) {
+    const { jwk } = header;
+    if (jwk) {
+        // let's resolve the provided x5c to be sure
+        const jwkIdentifier = yield context.agent.identifierManagedGetByJwk({ identifier: jwk });
+        if (jwkIdentifier.kmsKeyRef !== identifier.kmsKeyRef) {
+            return Promise.reject(Error(`A jwk header was present, but its value did not match the provided signing jwk or kid!`));
+        }
+    }
+    else if (!noIdentifierInHeader) {
+        // We basically accept everything for this mode, as we can always create JWKs from any key
+        if (header.x5c) {
+            return Promise.reject(Error('jwk mode was chosen, but x5c headers were provided. These cannot be used together!'));
+        }
+        header.jwk = identifier.jwk;
+    }
+});
+const checkAndUpdateKidHeader = (_a, context_1) => __awaiter(void 0, [_a, context_1], void 0, function* ({ header, identifier, noIdentifierInHeader = false, }, context) {
+    const { kid } = header;
+    if (kid) {
+        // let's resolve the provided x5c to be sure
+        const kidIdentifier = yield context.agent.identifierManagedGetByKid({ identifier: kid });
+        if (kidIdentifier.kmsKeyRef !== identifier.kmsKeyRef) {
+            return Promise.reject(Error(`A kid header was present, but its value did not match the provided signing kid!`));
+        }
+    }
+    else if (!noIdentifierInHeader) {
+        // We basically accept everything for this mode, as we can always create JWKs from any key
+        if (header.x5c) {
+            return Promise.reject(Error('kid mode was chosen, but x5c headers were provided. These cannot be used together!'));
+        }
+        header.kid = identifier.kid;
+    }
+});
+const isIdentifierMode = (mode, identifierMethod, checkMode, loose = true) => {
+    if (loose && (checkMode === 'jwk' || checkMode === 'kid')) {
+        // we always have the kid and jwk at hand no matter the identifier method, so we are okay with that
+        // todo: check the impact on the above expressions, as this will now always return true for the both of them
+        return true;
+    }
+    if (mode === checkMode) {
+        if (checkMode !== 'auto' && mode !== identifierMethod) {
+            throw Error(`Provided mode ${mode} conflicts with identifier method ${identifierMethod}`);
+        }
+        return true;
+    }
+    // we always have the kid and jwk at hand no matter the identifier method, so we are okay with that
+    return mode === 'auto' && identifierMethod === checkMode;
+};
+const verifyJws = (args, context) => __awaiter(void 0, void 0, void 0, function* () {
+    const jws = yield (0, exports.toJwsJsonGeneralWithIdentifiers)(args, context);
+    let errorMessages = [];
+    let index = 0;
+    yield Promise.all(jws.signatures.map((sigWithId) => __awaiter(void 0, void 0, void 0, function* () {
+        // If we have a specific KMS agent plugin that can do the verification prefer that over the generic verification
+        index++;
+        let valid;
+        const data = u8a.fromString(`${sigWithId.protected}.${jws.payload}`, 'utf-8');
+        const jwkInfo = sigWithId.identifier.jwks[0];
+        /* if (sigWithId.header?.alg === 'RSA' && contextHasPlugin(context, 'keyManagerVerify')) {
+          const publicKeyHex = jwkTtoPublicKeyHex(jwkInfo.jwk)
+          valid = await context.agent.keyManagerVerify({
+            signature: sigWithId.signature,
+            data,
+            publicKeyHex,
+            type: keyTypeFromCryptographicSuite({ crv: jwkInfo.jwk.crv ?? 'ES256' }),
+            // no kms arg, as the current key manager needs a bit more work
+          })
+        } else {*/
+        const signature = (0, utils_1.base64ToBytes)(sigWithId.signature);
+        valid = yield (0, ssi_sdk_ext_key_utils_1.verifyRawSignature)({ data, signature, key: jwkInfo.jwk });
+        // }
+        if (!valid) {
+            errorMessages.push(`Signature ${index} was not valid`);
+        }
+        return {
+            sigWithId,
+            valid,
+        };
+    })));
+    const error = errorMessages.length !== 0;
+    const result = {
+        name: 'jws',
+        jws,
+        error,
+        critical: error,
+        message: error ? errorMessages.join(', ') : 'Signature validated',
+        verificationTime: new Date(),
+    };
+    if (error) {
+        console.log(`Error verifying jws signature: ` + Object.assign({}, result));
+    }
+    return result;
+});
+exports.verifyJws = verifyJws;
+const toJwsJsonGeneral = (_a, context_1) => __awaiter(void 0, [_a, context_1], void 0, function* ({ jws }, context) {
+    let payload;
+    let signatures = [];
+    if ((0, IJwtService_1.isJwsCompact)(jws)) {
+        const split = jws.split('.');
+        payload = split[1];
+        signatures[0] = {
+            protected: split[0],
+            signature: split[2],
+        };
+    }
+    else if ((0, IJwtService_1.isJwsJsonGeneral)(jws)) {
+        payload = jws.payload;
+        signatures = jws.signatures;
+    }
+    else if ((0, IJwtService_1.isJwsJsonFlattened)(jws)) {
+        const { payload: _payload } = jws, signature = __rest(jws, ["payload"]);
+        payload = _payload;
+        signatures = [signature];
+    }
+    else {
+        return Promise.reject(Error(`Invalid JWS supplied`));
+    }
+    return {
+        payload,
+        signatures,
+    };
+});
+exports.toJwsJsonGeneral = toJwsJsonGeneral;
+function resolveExternalIdentifierFromJwsHeader(protectedHeader, context, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        if (protectedHeader.x5c) {
+            const x5c = protectedHeader.x5c;
+            return yield context.agent.identifierExternalResolveByX5c(Object.assign(Object.assign({}, (_a = args.opts) === null || _a === void 0 ? void 0 : _a.x5c), { identifier: x5c, verify: true }));
+        }
+        else if (protectedHeader.jwk) {
+            const jwk = protectedHeader.jwk;
+            const x5c = jwk.x5c; // todo resolve x5u
+            return yield context.agent.identifierExternalResolveByJwk(Object.assign({ identifier: protectedHeader.jwk }, (x5c && {
+                x5c: Object.assign(Object.assign({}, (_b = args === null || args === void 0 ? void 0 : args.opts) === null || _b === void 0 ? void 0 : _b.x5c), { identifier: x5c }),
+            })));
+        }
+        else if (protectedHeader.kid && protectedHeader.kid.startsWith('did:')) {
+            return yield context.agent.identifierExternalResolveByDid(Object.assign(Object.assign({}, (_c = args === null || args === void 0 ? void 0 : args.opts) === null || _c === void 0 ? void 0 : _c.did), { identifier: protectedHeader.kid }));
+        }
+        else if (protectedHeader.alg === 'none') {
+            return undefined;
+        }
+        else {
+            return Promise.reject(Error(`We can only process DIDs, X.509 certificate chains and JWKs for signature validation at present`));
+        }
+    });
+}
+function loadJWK(providedJwk, protectedHeader, jws) {
+    var _a, _b;
+    if (providedJwk) {
+        return providedJwk;
+    }
+    // TODO SDK-47 the identityResolver could handle this as well, but it's a really tiny function
+    if ((protectedHeader === null || protectedHeader === void 0 ? void 0 : protectedHeader.typ) === 'entity-statement+jwt') {
+        const payload = (0, utils_1.decodeJoseBlob)(jws.payload);
+        if (!((_b = (_a = payload === null || payload === void 0 ? void 0 : payload.jwks) === null || _a === void 0 ? void 0 : _a.keys) === null || _b === void 0 ? void 0 : _b[0])) {
+            throw new Error('Missing or invalid JWK in payload');
+        }
+        return payload.jwks.keys[0];
+    }
+    return undefined;
+}
+const toJwsJsonGeneralWithIdentifiers = (args, context) => __awaiter(void 0, void 0, void 0, function* () {
+    const jws = yield (0, exports.toJwsJsonGeneral)(args, context);
+    const signatures = (yield Promise.all(jws.signatures.map((signature) => __awaiter(void 0, void 0, void 0, function* () {
+        const protectedHeader = (0, utils_1.decodeJoseBlob)(signature.protected);
+        const jwk = loadJWK(args.jwk, protectedHeader, jws);
+        const identifier = jwk
+            ? yield (0, ssi_sdk_ext_identifier_resolution_1.resolveExternalJwkIdentifier)({ identifier: jwk, method: 'jwk' }, context)
+            : yield resolveExternalIdentifierFromJwsHeader(protectedHeader, context, args);
+        if (identifier !== undefined) {
+            return Object.assign(Object.assign({}, signature), { identifier });
+        }
+        return undefined;
+    }))));
+    return { payload: jws.payload, signatures };
+});
+exports.toJwsJsonGeneralWithIdentifiers = toJwsJsonGeneralWithIdentifiers;
+//# sourceMappingURL=index.js.map

package/dist/functions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/functions/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mGAUoD;AACpD,2EAAoE;AAGpE,yCAA+F;AAC/F,iDAAkC;AAClC,sDAsB6B;AAE7B,MAAM,cAAc,GAAG,CAAC,OAAyC,EAAc,EAAE;IAC/E,MAAM,OAAO,GAAG,OAAO,YAAY,UAAU,CAAA;IAC7C,MAAM,QAAQ,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAA;IAC5C,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;AAC/H,CAAC,CAAA;AAEM,MAAM,gBAAgB,GAAG,CAAO,IAAuB,EAAE,OAAyB,EAA8B,EAAE;IACvH,MAAM,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI,CAAA;IAEjI,MAAM,EAAE,oBAAoB,GAAG,KAAK,EAAE,GAAG,MAAM,CAAA;IAC/C,MAAM,UAAU,GAAG,MAAM,IAAA,iEAA6B,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACvE,MAAM,IAAA,+BAAuB,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,OAAO,CAAC,CAAA;IAC3G,MAAM,OAAO,GAAG,OAAO,YAAY,UAAU,CAAA;IAC7C,MAAM,QAAQ,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAA;IAC5C,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5E,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC,MAAM,CAAA;QACjC,CAAC;QACD,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAChD,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAA;QAC3C,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAA;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,eAAe,GAAG,IAAA,sBAAc,EAAC,eAAe,CAAC,CAAA;IACvD,MAAM,gBAAgB,GAAG,IAAA,wBAAgB,EAAC,YAAY,CAAC,CAAA;IAEvD,OAAO;QACL,GAAG,EAAE;YACH,iBAAiB;YACjB,eAAe;YACf,OAAO,EAAE,YAAY;YACrB,kBAAkB;SACnB;QACD,GAAG,EAAE;YACH,eAAe,EAAE,eAAe;YAChC,OAAO,EAAE,gBAAgB;SAC1B;QACD,UAAU;KACX,CAAA;AACH,CAAC,CAAA,CAAA;AApCY,QAAA,gBAAgB,oBAoC5B;AAEM,MAAM,gBAAgB,GAAG,CAAO,IAA0B,EAAE,OAAyB,EAAuB,EAAE;IACnH,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,8BAAsB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACtG,OAAO,GAAG,eAAe,IAAI,OAAO,IAAI,SAAS,EAAE,CAAA;AACrD,CAAC,CAAA,CAAA;AAHY,QAAA,gBAAgB,oBAG5B;AAEM,MAAM,sBAAsB,GAAG,CAAO,IAA4B,EAAE,OAAyB,EAA6B,EAAE;IACjI,MAAM,GAAG,GAAG,MAAM,IAAA,4BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACtH,CAAC;IACD,OAAO,gCACF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KACpB,OAAO,EAAE,GAAG,CAAC,OAAO,GACM,CAAA;AAC9B,CAAC,CAAA,CAAA;AATY,QAAA,sBAAsB,0BASlC;AAEM,MAAM,oBAAoB,GAAG,CAAO,IAAuB,EAAE,OAAyB,EAA2B,EAAE;IACxH,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9F,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,IAAA,wBAAgB,EAChD;QACE,eAAe;QACf,iBAAiB;QACjB,OAAO;QACP,kBAAkB;QAClB,MAAM;QACN,IAAI;KACL,EACD,OAAO,CACR,CAAA;IACD,6EAA6E;IAC7E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QACnD,MAAM,EAAE,UAAU,CAAC,SAAS;QAC5B,IAAI,EAAE,GAAG,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,OAAO,EAAE;QAC7C,QAAQ,EAAE,SAAS;KACpB,CAAC,CAAA;IACF,MAAM,aAAa,GAAG;QACpB,SAAS,EAAE,GAAG,CAAC,eAAe;QAC9B,MAAM,EAAE,iBAAiB;QACzB,SAAS;KACiB,CAAA;IAC5B,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,CAAC,GAAG,CAAC,kBAAkB,aAAlB,kBAAkB,cAAlB,kBAAkB,GAAI,EAAE,CAAC,EAAE,aAAa,CAAC;KAClC,CAAA;AAC5B,CAAC,CAAA,CAAA;AA5BY,QAAA,oBAAoB,wBA4BhC;AAED;;;;;;;GAOG;AAEI,MAAM,uBAAuB,GAAG,gBAarC,EAAE,uDAZF,EACE,IAAI,GAAG,MAAM,EACb,UAAU,EACV,MAAM,EACN,oBAAoB,GAAG,KAAK,GAM7B,EACD,OAAyB;IAEzB,IAAI,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACrD,uBAAuB;QACvB,mEAAmE;QACnE,MAAM,uBAAuB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAA;IACtF,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5D,wCAAwC;QACxC,mEAAmE;QACnE,MAAM,uBAAuB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAA;IACtF,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,uBAAuB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAA;IACtF,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACnE,8DAA8D;QAC9D,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,uBAAuB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,6GAA6G;QAC7G,OAAO,OAAO,CAAC,MAAM,CAAC,4CAA4C,IAAI,0BAA0B,UAAU,CAAC,MAAM,SAAS,CAAC,CAAA;IAC7H,CAAC;AACH,CAAC,CAAA,CAAA;AAjCY,QAAA,uBAAuB,2BAiCnC;AAED,MAAM,uBAAuB,GAAG,gBAW9B,EAAE,uDAVF,EACE,MAAM,EACN,UAAU,EACV,oBAAoB,GAAG,KAAK,GAK7B,EACD,OAAyB;IAEzB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,4CAA4C;QAC5C,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;QACxF,IAAI,aAAa,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qGAAqG,CAAC,CAAC,CAAA;QACrI,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACjC,IAAI,CAAC,IAAA,gEAA4B,EAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC,CAAA;QACrH,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4FAA4F,CAAC,CAAC,CAAA;QAC5H,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAA;IAC7B,CAAC;AACH,CAAC,CAAA,CAAA;AAED,MAAM,uBAAuB,GAAG,gBAW9B,EAAE,uDAVF,EACE,MAAM,EACN,UAAU,EACV,oBAAoB,GAAG,KAAK,GAK7B,EACD,OAAyB;IAEzB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,4CAA4C;QAC5C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;QACvF,IAAI,YAAY,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC,CAAA;QACjH,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACjC,IAAI,CAAC,IAAA,gEAA4B,EAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC,CAAA;QACrH,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2FAA2F,CAAC,CAAC,CAAA;QAC3H,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAA;IAC7B,CAAC;AACH,CAAC,CAAA,CAAA;AAED,MAAM,uBAAuB,GAAG,gBAW9B,EAAE,uDAVF,EACE,MAAM,EACN,UAAU,EACV,oBAAoB,GAAG,KAAK,GAK7B,EACD,OAAyB;IAEzB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,4CAA4C;QAC5C,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,UAAU,EAAE,GAAU,EAAE,CAAC,CAAA;QAC/F,IAAI,aAAa,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wFAAwF,CAAC,CAAC,CAAA;QACxH,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACjC,0FAA0F;QAC1F,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC,CAAA;QACpH,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAA;IAC7B,CAAC;AACH,CAAC,CAAA,CAAA;AAED,MAAM,uBAAuB,GAAG,gBAW9B,EAAE,uDAVF,EACE,MAAM,EACN,UAAU,EACV,oBAAoB,GAAG,KAAK,GAK7B,EACD,OAAyB;IAEzB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,4CAA4C;QAC5C,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;QACxF,IAAI,aAAa,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC,CAAA;QACjH,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACjC,0FAA0F;QAC1F,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC,CAAA;QACpH,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAA;IAC7B,CAAC;AACH,CAAC,CAAA,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,IAAuB,EAAE,gBAAyC,EAAE,SAA4B,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE;IAC1I,IAAI,KAAK,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,KAAK,CAAC,EAAE,CAAC;QAC1D,mGAAmG;QACnG,4GAA4G;QAC5G,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,SAAS,KAAK,MAAM,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACtD,MAAM,KAAK,CAAC,iBAAiB,IAAI,qCAAqC,gBAAgB,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,mGAAmG;IACnG,OAAO,IAAI,KAAK,MAAM,IAAI,gBAAgB,KAAK,SAAS,CAAA;AAC1D,CAAC,CAAA;AAEM,MAAM,SAAS,GAAG,CAAO,IAAmB,EAAE,OAA6C,EAAiC,EAAE;IACnI,MAAM,GAAG,GAAG,MAAM,IAAA,uCAA+B,EAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAEhE,IAAI,aAAa,GAAa,EAAE,CAAA;IAChC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,OAAO,CAAC,GAAG,CACf,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAO,SAAS,EAAE,EAAE;QACrC,gHAAgH;QAChH,KAAK,EAAE,CAAA;QACP,IAAI,KAAc,CAAA;QAClB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAA;QAC7E,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC5C;;;;;;;;;kBASU;QACV,MAAM,SAAS,GAAG,IAAA,qBAAa,EAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACpD,KAAK,GAAG,MAAM,IAAA,0CAAkB,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QACvE,IAAI;QACJ,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,aAAa,CAAC,IAAI,CAAC,aAAa,KAAK,gBAAgB,CAAC,CAAA;QACxD,CAAC;QAED,OAAO;YACL,SAAS;YACT,KAAK;SACN,CAAA;IACH,CAAC,CAAA,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,KAAK,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,KAAK;QACX,GAAG;QACH,KAAK;QACL,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB;QACjE,gBAAgB,EAAE,IAAI,IAAI,EAAE;KACE,CAAA;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,iCAAiC,qBAAQ,MAAM,CAAE,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA,CAAA;AAhDY,QAAA,SAAS,aAgDrB;AAEM,MAAM,gBAAgB,GAAG,gBAAoF,EAAE,uDAA/E,EAAE,GAAG,EAAgB,EAAE,OAA2B;IACvF,IAAI,OAAe,CAAA;IACnB,IAAI,UAAU,GAAuB,EAAE,CAAA;IAEvC,IAAI,IAAA,0BAAY,EAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,UAAU,CAAC,CAAC,CAAC,GAAG;YACd,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YACnB,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;SACO,CAAA;IAC9B,CAAC;SAAM,IAAI,IAAA,8BAAgB,EAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;QACrB,UAAU,GAAG,GAAG,CAAC,UAAU,CAAA;IAC7B,CAAC;SAAM,IAAI,IAAA,gCAAkB,EAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,EAAE,OAAO,EAAE,QAAQ,KAAmB,GAAG,EAAjB,SAAS,UAAK,GAAG,EAAzC,WAAmC,CAAM,CAAA;QAC/C,OAAO,GAAG,QAAQ,CAAA;QAClB,UAAU,GAAG,CAAC,SAAS,CAAC,CAAA;IAC1B,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO;QACL,OAAO;QACP,UAAU;KACX,CAAA;AACH,CAAC,CAAA,CAAA;AAzBY,QAAA,gBAAgB,oBAyB5B;AAED,SAAe,sCAAsC,CACnD,eAA0B,EAC1B,OAA6C,EAC7C,IAGC;;;QAED,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAA;YAC/B,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,8BAA8B,iCACpD,MAAA,IAAI,CAAC,IAAI,0CAAE,GAAG,KACjB,UAAU,EAAE,GAAG,EACf,MAAM,EAAE,IAAI,IACZ,CAAA;QACJ,CAAC;aAAM,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAA;YAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAA,CAAC,mBAAmB;YACvC,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,8BAA8B,iBACvD,UAAU,EAAE,eAAe,CAAC,GAAG,IAC5B,CAAC,GAAG,IAAI;gBACT,GAAG,kCACE,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,IAAI,0CAAE,GAAG,KAClB,UAAU,EAAE,GAAG,GAChB;aACF,CAAC,EACF,CAAA;QACJ,CAAC;aAAM,IAAI,eAAe,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,8BAA8B,iCAAM,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,IAAI,0CAAE,GAAG,KAAE,UAAU,EAAE,eAAe,CAAC,GAAG,IAAG,CAAA;QACpH,CAAC;aAAM,IAAI,eAAe,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAA;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iGAAiG,CAAC,CAAC,CAAA;QACjI,CAAC;IACH,CAAC;CAAA;AAED,SAAS,OAAO,CAAC,WAA4B,EAAE,eAA0B,EAAE,GAAmB;;IAC5F,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,8FAA8F;IAC9F,IAAI,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,GAAG,MAAK,sBAAsB,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,IAAA,sBAAc,EAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,CAAC,CAAA,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,0CAAE,IAAI,0CAAG,CAAC,CAAC,CAAA,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAEM,MAAM,+BAA+B,GAAG,CAC7C,IAIC,EACD,OAA6C,EACL,EAAE;IAC1C,MAAM,GAAG,GAAG,MAAM,IAAA,wBAAgB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CACnC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAO,SAAS,EAAE,EAAE;QACrC,MAAM,eAAe,GAAc,IAAA,sBAAc,EAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACtE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;QACnD,MAAM,UAAU,GAAG,GAAG;YACpB,CAAC,CAAC,MAAM,IAAA,gEAA4B,EAAC,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC;YACjF,CAAC,CAAC,MAAM,sCAAsC,CAAC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QAChF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,uCAAY,SAAS,KAAE,UAAU,IAAE;QACrC,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA,CAAC,CACH,CAA0C,CAAA;IAE3C,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,CAAA;AAC7C,CAAC,CAAA,CAAA;AAxBY,QAAA,+BAA+B,mCAwB3C"}