@swal/edge-mesh 0.0.0-stage → 0.1.0

package/dist/medico/aval.js

@@ -0,0 +1,281 @@
+/**
+ * `Aval` — the peer endorsement, and the line it cannot cross.
+ *
+ * ─── WHY AN AVAL IS STRUCTURALLY NOT A CITA ─────────────────────────────────
+ *
+ * An `Aval` is a peer assertion *about a claim*: `avalador → avalado`, subject =
+ * a credential hash, carrying `metodoVerificacion` (how the checker checked) and
+ * no patient, no date of encounter, no diagnosis, no content. A `Cita` is a
+ * patient assertion *about an encounter*, and needs none of those fields.
+ *
+ * Conflating them destroys the anti-Sybil property, so the separation is
+ * enforced three ways here: the type carries a closed `objetoAval` union, the
+ * endorsement counter in {@link resumirAvales} only counts the two objects that
+ * are about licensure, and {@link OBJETO_QUE_CUENTA} is the single place that
+ * decision lives.
+ *
+ * ─── THE LOAD-BEARING RULE ───────────────────────────────────────────────────
+ *
+ * Only `licencia_verificada` and `especialidad_verificada` promote a credential
+ * to `atestiguada_pares`. An `Aval` of `interaccion_clinica` proves the claimer
+ * *treated patients*, not that they are *licensed*. Allowing clinical `Aval`s to
+ * count is precisely the hole that lets a well-liked non-doctor buy their way
+ * into a network of doctors — money can buy encounters, and it cannot buy a
+ * government record.
+ */
+import { bytesAval, hashCredencial, hashLicencia, idAval } from "./canonica.js";
+import { ALCANCE_AVAL, CLASE_VERIFICACION, OBJETO_AVAL, VERSION_MODELO, } from "./types.js";
+/** Why an `Aval` was refused. Every value means it does not count. */
+export const MOTIVO_RECHAZO_AVAL = {
+    /** `avalador === avalado`. The `auto_emision` rule, copied. */
+    AUTO_ENDORSEMENT: "auto_endorsement",
+    /** No signature bytes. */
+    FIRMA_AUSENTE: "firma_ausente",
+    /** Signature does not verify against the avalador's public key. */
+    FIRMA_INVALIDA: "firma_invalida",
+    /** `objetoAval`, `alcance`, `revocable` or `metodoVerificacion.clase` invalid. */
+    CAMPO_INVALIDO: "campo_invalido",
+    /** `emitidoEn` / `vigenteHasta` incoherent. */
+    VIGENCIA_INVALIDA: "vigencia_invalida",
+    /** The `Aval` has lapsed. */
+    AVAL_CADUCADO: "aval_caducado",
+    /** `metodoVerificacion: 'registro_por_pais'` without `versionRegistro`. */
+    VERSION_REGISTRO_AUSENTE: "version_registro_ausente",
+};
+function fallo(motivo, detalle) {
+    return { ok: false, motivo, detalle, cuentaParaPromocion: false };
+}
+/**
+ * The only `objetoAval` values that may promote a credential to
+ * `atestiguada_pares`.
+ *
+ * Exported as data so that the rule has exactly one definition in the codebase.
+ * If a test, a counter or a threshold function disagreed with this set, a
+ * clinical `Aval` would end up counting toward licensure somewhere.
+ */
+export const OBJETO_QUE_CUENTA = [
+    OBJETO_AVAL.LICENCIA_VERIFICADA,
+    OBJETO_AVAL.ESPECIALIDAD_VERIFICADA,
+];
+export function avalCuentaParaPromocion(objeto) {
+    return OBJETO_QUE_CUENTA.includes(objeto);
+}
+/**
+ * Structural validation of an `Aval`, no signature check. Cheap first, PQC last,
+ * same ordering as the credential path.
+ *
+ * @param ahora - injected clock (ms epoch). The function never reads the clock
+ *   itself, which is what keeps it pure.
+ */
+export function validarAval(aval, ahora) {
+    if (!aval || typeof aval !== "object") {
+        return fallo(MOTIVO_RECHAZO_AVAL.CAMPO_INVALIDO, "el aval no es un objeto");
+    }
+    // ── Self-endorsement, refused first and unconditionally ──
+    // `KarmaManager.applyTransaction` refuses `emisor === sujeto` with
+    // `auto_emision`; the same rule, copied, because the failure mode is identical
+    // (one node manufacturing its own evidence).
+    if (aval.avalador === aval.avalado) {
+        return fallo(MOTIVO_RECHAZO_AVAL.AUTO_ENDORSEMENT, `${aval.avalador} no puede avalarse a sí mismo (equivale a auto_emision en karma.ts)`);
+    }
+    if (aval.version !== VERSION_MODELO) {
+        return fallo(MOTIVO_RECHAZO_AVAL.CAMPO_INVALIDO, `version no soportada: ${String(aval.version)}`);
+    }
+    if (!Object.values(OBJETO_AVAL).includes(aval.objetoAval)) {
+        return fallo(MOTIVO_RECHAZO_AVAL.CAMPO_INVALIDO, `objetoAval desconocido: ${String(aval.objetoAval)}`);
+    }
+    if (!Object.values(ALCANCE_AVAL).includes(aval.alcance)) {
+        return fallo(MOTIVO_RECHAZO_AVAL.CAMPO_INVALIDO, `alcance desconocido: ${String(aval.alcance)}`);
+    }
+    if (aval.revocable !== true) {
+        // An `Aval` that is not revocable is a permanent fact, and the design says
+        // endorsements must be revocable (`docs/medico/protocolo.md` §5).
+        return fallo(MOTIVO_RECHAZO_AVAL.CAMPO_INVALIDO, "revocable debe ser true: todo aval es revocable");
+    }
+    if (!aval.credencialRef || !aval.hashCredencial) {
+        return fallo(MOTIVO_RECHAZO_AVAL.CAMPO_INVALIDO, "un aval debe referirse a una credencial concreta (credencialRef + hashCredencial)");
+    }
+    // ── `metodoVerificacion` must be complete for its class ──
+    const metodo = aval.metodoVerificacion;
+    if (!metodo || !Object.values(CLASE_VERIFICACION).includes(metodo.clase)) {
+        return fallo(MOTIVO_RECHAZO_AVAL.CAMPO_INVALIDO, "metodoVerificacion.clase desconocida");
+    }
+    if (metodo.clase === CLASE_VERIFICACION.REGISTRO_POR_PAIS) {
+        // Mandatory so a stale snapshot is visible on the face of the record. A
+        // registry check with no version cannot be reasoned about later.
+        if (!metodo.versionRegistro) {
+            return fallo(MOTIVO_RECHAZO_AVAL.VERSION_REGISTRO_AUSENTE, "registro_por_pais exige versionRegistro: sin ella un snapshot obsoleto es indistinguible de uno fresco");
+        }
+        if (!metodo.pais) {
+            return fallo(MOTIVO_RECHAZO_AVAL.CAMPO_INVALIDO, "registro_por_pais exige pais");
+        }
+    }
+    if (metodo.clase === CLASE_VERIFICACION.COLEGIO_DIRECTO && !metodo.ref) {
+        return fallo(MOTIVO_RECHAZO_AVAL.CAMPO_INVALIDO, "colegio_directo exige ref");
+    }
+    if (metodo.clase === CLASE_VERIFICACION.SUPERVISION) {
+        if (typeof metodo.desde !== "number" || typeof metodo.hasta !== "number") {
+            return fallo(MOTIVO_RECHAZO_AVAL.CAMPO_INVALIDO, "supervision exige desde y hasta");
+        }
+        if (metodo.desde > metodo.hasta) {
+            return fallo(MOTIVO_RECHAZO_AVAL.VIGENCIA_INVALIDA, `supervision desde (${metodo.desde}) > hasta (${metodo.hasta})`);
+        }
+    }
+    // ── Dates ──
+    if (typeof aval.emitidoEn !== "number" || !Number.isFinite(aval.emitidoEn)) {
+        return fallo(MOTIVO_RECHAZO_AVAL.VIGENCIA_INVALIDA, `emitidoEn inválido: ${String(aval.emitidoEn)}`);
+    }
+    if (typeof aval.vigenteHasta !== "number" ||
+        !Number.isFinite(aval.vigenteHasta)) {
+        return fallo(MOTIVO_RECHAZO_AVAL.VIGENCIA_INVALIDA, "vigenteHasta ausente o no numérico");
+    }
+    if (aval.emitidoEn > aval.vigenteHasta) {
+        return fallo(MOTIVO_RECHAZO_AVAL.VIGENCIA_INVALIDA, `emitidoEn (${aval.emitidoEn}) es posterior a vigenteHasta (${aval.vigenteHasta})`);
+    }
+    if (aval.vigenteHasta <= ahora) {
+        return fallo(MOTIVO_RECHAZO_AVAL.AVAL_CADUCADO, `aval caducado: vigente hasta ${aval.vigenteHasta}, ahora ${ahora}`);
+    }
+    if (!(aval.firma instanceof Uint8Array) || aval.firma.length === 0) {
+        return fallo(MOTIVO_RECHAZO_AVAL.FIRMA_AUSENTE, "firma ausente o vacía");
+    }
+    return { ok: true, aval };
+}
+/**
+ * Verify the avalador's signature over the canonical `Aval` bytes.
+ *
+ * Note the key must be the *avalador's*, never the avalado's: the whole content
+ * of an endorsement is that a second party looked and agreed.
+ */
+export async function verificarFirmaAval(aval, identidad, parPublicoAvalador) {
+    try {
+        return await identidad.verificar(bytesAval(aval), aval.firma, parPublicoAvalador);
+    }
+    catch {
+        return false;
+    }
+}
+/** Full validation: structure, then signature. */
+export async function validarAvalFirmado(aval, identidad, parPublicoAvalador, ahora) {
+    const estructural = validarAval(aval, ahora);
+    if (!estructural.ok)
+        return estructural;
+    if (!(await verificarFirmaAval(aval, identidad, parPublicoAvalador))) {
+        return fallo(MOTIVO_RECHAZO_AVAL.FIRMA_INVALIDA, `la firma no verifica contra la clave pública de ${aval.avalador}`);
+    }
+    return { ok: true, aval };
+}
+/**
+ * Build and sign an `Aval`.
+ *
+ * `hashCredencial` is computed from the credential object rather than taken on
+ * trust, so an `Aval` cannot be minted against a hash that does not match the
+ * bytes it claims to have checked.
+ */
+export async function crearAval(borrador, identidadAvalador, credencialVerificada) {
+    const id = idAval(borrador.avalador, borrador.avalado, borrador.emitidoEn, borrador.nonce);
+    if (credencialVerificada.hash !== borrador.hashCredencial) {
+        throw new Error(`crearAval: hashCredencial (${borrador.hashCredencial}) no corresponde a la credencial verificada (${credencialVerificada.hash})`);
+    }
+    const sinFirmar = {
+        id,
+        version: VERSION_MODELO,
+        avalador: borrador.avalador,
+        avalado: borrador.avalado,
+        objetoAval: borrador.objetoAval,
+        credencialRef: borrador.credencialRef,
+        hashCredencial: borrador.hashCredencial,
+        metodoVerificacion: borrador.metodoVerificacion,
+        evidenciaHash: borrador.evidenciaHash,
+        alcance: borrador.alcance,
+        emitidoEn: borrador.emitidoEn,
+        vigenteHasta: borrador.vigenteHasta,
+        revocable: true,
+        firma: new Uint8Array(0),
+    };
+    const firma = await identidadAvalador.firmar(bytesAval(sinFirmar));
+    return { ...sinFirmar, firma };
+}
+/** Convenience: hash a credential's canonical bytes for use in `crearAval`. */
+export function prepararCredencialParaAval(credencial) {
+    return hashCredencial(credencial);
+}
+/** Convenience: `sha256(normalize(numeroLicencia))`. Never pass the number itself. */
+export function idLicenciaDesdeNumero(numeroLicencia) {
+    return hashLicencia(numeroLicencia);
+}
+/**
+ * Fold live `Aval`s into a {@link ResumenAvales}.
+ *
+ * This fold, not a stored fact, is what makes `atestiguada_pares` revocable:
+ * drop a revocation and the count falls on the next recomputation.
+ *
+ * Only unexpired, self-consistent `Aval`s are counted, and only the two
+ * licensure objects feed {@link ResumenAvales.verificacionesLicencia}.
+ * `avaladoresUnicos` counts distinct signers, not `Aval`s, so one peer endorsing
+ * fifty times cannot move the threshold.
+ *
+ * @param ahora - injected clock. Pure: the function never reads time itself.
+ */
+export function resumirAvales(avales, ahora) {
+    const porObjeto = {
+        [OBJETO_AVAL.LICENCIA_VERIFICADA]: 0,
+        [OBJETO_AVAL.ESPECIALIDAD_VERIFICADA]: 0,
+        [OBJETO_AVAL.INTERACCION_CLINICA]: 0,
+        [OBJETO_AVAL.DOCENCIA]: 0,
+    };
+    const avaladoresUnicos = new Set();
+    const avaladoresDeLicencia = new Set();
+    let ultimoAval;
+    let total = 0;
+    for (const aval of avales) {
+        // Signature verification needs a public key and is async, so it is the
+        // caller's job (Phase 3) to hand over already-verified `Aval`s. Structural
+        // validity plus expiry is what this pure fold can check on its own.
+        if (!validarAval(aval, ahora).ok)
+            continue;
+        porObjeto[aval.objetoAval] = (porObjeto[aval.objetoAval] ?? 0) + 1;
+        avaladoresUnicos.add(aval.avalador);
+        if (avalCuentaParaPromocion(aval.objetoAval))
+            avaladoresDeLicencia.add(aval.avalador);
+        if (ultimoAval === undefined || aval.emitidoEn > ultimoAval)
+            ultimoAval = aval.emitidoEn;
+        total++;
+    }
+    return {
+        total,
+        porObjeto,
+        avaladoresUnicos: avaladoresUnicos.size,
+        verificacionesLicencia: avaladoresDeLicencia.size,
+        ...(ultimoAval === undefined ? {} : { ultimoAval }),
+    };
+}
+/**
+ * Adapt an `Aval` to the existing {@link TransaccionKarma} shape.
+ *
+ * The signature envelope of an endorsement — `id`, `emisor`, `timestamp`,
+ * `firma` — is karma's, reused rather than reinvented, so an `Aval` can ride
+ * the OpLog and the replay/idempotency path that already exist.
+ *
+ * `razon` states *what was verified and how*, so the karma ledger is auditable
+ * without a join back to the `Aval`. The subject is the **endorsed** node, which
+ * is the node earning standing — matching karma's `sujeto` semantics.
+ *
+ * `delta` is deliberately left to the caller as `deltaPorAvalacion`: the weight
+ * of an `Aval` is a policy decision (DECISIÓN B.3), and this module must not
+ * quietly pick one. Note that karma is a *signal* and never grants access
+ * (`docs/medico/reglas-red.md` §1).
+ */
+export function aTransaccionKarma(aval, deltaPorAvalacion) {
+    return {
+        id: aval.id,
+        tipo: "aval",
+        proyecto: aval.objetoAval,
+        sujeto: aval.avalado,
+        delta: deltaPorAvalacion,
+        razon: `${aval.objetoAval} via ${aval.metodoVerificacion.clase}`,
+        emisor: aval.avalador,
+        timestamp: aval.emitidoEn,
+        firma: aval.firma,
+    };
+}
+//# sourceMappingURL=aval.js.map

package/dist/medico/aval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aval.js","sourceRoot":"","sources":["../../src/medico/aval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EACN,YAAY,EAGZ,kBAAkB,EAElB,WAAW,EAGX,cAAc,GACd,MAAM,YAAY,CAAC;AAEpB,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAClC,+DAA+D;IAC/D,gBAAgB,EAAE,kBAAkB;IACpC,0BAA0B;IAC1B,aAAa,EAAE,eAAe;IAC9B,mEAAmE;IACnE,cAAc,EAAE,gBAAgB;IAChC,kFAAkF;IAClF,cAAc,EAAE,gBAAgB;IAChC,+CAA+C;IAC/C,iBAAiB,EAAE,mBAAmB;IACtC,6BAA6B;IAC7B,aAAa,EAAE,eAAe;IAC9B,2EAA2E;IAC3E,wBAAwB,EAAE,0BAA0B;CAC3C,CAAC;AAeX,SAAS,KAAK,CACb,MAAyB,EACzB,OAAe;IAEf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAChC,WAAW,CAAC,mBAAmB;IAC/B,WAAW,CAAC,uBAAuB;CAC1B,CAAC;AAEX,MAAM,UAAU,uBAAuB,CAAC,MAAkB;IACzD,OAAQ,iBAA2C,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAC1B,IAAU,EACV,KAAa;IAEb,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,mBAAmB,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;IAC7E,CAAC;IAED,4DAA4D;IAC5D,mEAAmE;IACnE,+EAA+E;IAC/E,6CAA6C;IAC7C,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,OAAO,KAAK,CACX,mBAAmB,CAAC,gBAAgB,EACpC,GAAG,IAAI,CAAC,QAAQ,qEAAqE,CACrF,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACrC,OAAO,KAAK,CACX,mBAAmB,CAAC,cAAc,EAClC,yBAAyB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC/C,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CACX,mBAAmB,CAAC,cAAc,EAClC,2BAA2B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CACpD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CACX,mBAAmB,CAAC,cAAc,EAClC,wBAAwB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC9C,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,kEAAkE;QAClE,OAAO,KAAK,CACX,mBAAmB,CAAC,cAAc,EAClC,iDAAiD,CACjD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACjD,OAAO,KAAK,CACX,mBAAmB,CAAC,cAAc,EAClC,mFAAmF,CACnF,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CACX,mBAAmB,CAAC,cAAc,EAClC,sCAAsC,CACtC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;QAC3D,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC7B,OAAO,KAAK,CACX,mBAAmB,CAAC,wBAAwB,EAC5C,wGAAwG,CACxG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,KAAK,CACX,mBAAmB,CAAC,cAAc,EAClC,8BAA8B,CAC9B,CAAC;QACH,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACxE,OAAO,KAAK,CACX,mBAAmB,CAAC,cAAc,EAClC,2BAA2B,CAC3B,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1E,OAAO,KAAK,CACX,mBAAmB,CAAC,cAAc,EAClC,iCAAiC,CACjC,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YACjC,OAAO,KAAK,CACX,mBAAmB,CAAC,iBAAiB,EACrC,sBAAsB,MAAM,CAAC,KAAK,cAAc,MAAM,CAAC,KAAK,GAAG,CAC/D,CAAC;QACH,CAAC;IACF,CAAC;IAED,cAAc;IACd,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CACX,mBAAmB,CAAC,iBAAiB,EACrC,uBAAuB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAC/C,CAAC;IACH,CAAC;IACD,IACC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QACrC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAClC,CAAC;QACF,OAAO,KAAK,CACX,mBAAmB,CAAC,iBAAiB,EACrC,oCAAoC,CACpC,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,OAAO,KAAK,CACX,mBAAmB,CAAC,iBAAiB,EACrC,cAAc,IAAI,CAAC,SAAS,kCAAkC,IAAI,CAAC,YAAY,GAAG,CAClF,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,IAAI,KAAK,EAAE,CAAC;QAChC,OAAO,KAAK,CACX,mBAAmB,CAAC,aAAa,EACjC,gCAAgC,IAAI,CAAC,YAAY,WAAW,KAAK,EAAE,CACnE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC,mBAAmB,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,IAAU,EACV,SAA8B,EAC9B,kBAA8B;IAE9B,IAAI,CAAC;QACJ,OAAO,MAAM,SAAS,CAAC,SAAS,CAC/B,SAAS,CAAC,IAAI,CAAC,EACf,IAAI,CAAC,KAAK,EACV,kBAAkB,CAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,IAAU,EACV,SAA8B,EAC9B,kBAA8B,EAC9B,KAAa;IAEb,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IAExC,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,KAAK,CACX,mBAAmB,CAAC,cAAc,EAClC,mDAAmD,IAAI,CAAC,QAAQ,EAAE,CAClE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,QAAsB,EACtB,iBAAsC,EACtC,oBAA+C;IAE/C,MAAM,EAAE,GAAG,MAAM,CAChB,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,KAAK,CACd,CAAC;IAEF,IAAI,oBAAoB,CAAC,IAAI,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACd,8BAA8B,QAAQ,CAAC,cAAc,gDAAgD,oBAAoB,CAAC,IAAI,GAAG,CACjI,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAS;QACvB,EAAE;QACF,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;KACxB,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,0BAA0B,CACzC,UAAgD;IAEhD,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC3D,OAAO,YAAY,CAAC,cAAc,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC5B,MAAuB,EACvB,KAAa;IAEb,MAAM,SAAS,GAAG;QACjB,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,CAAC,WAAW,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACxC,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;KACK,CAAC;IAEhC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/C,IAAI,UAA8B,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC3B,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE;YAAE,SAAS;QAE3C,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC;YAC3C,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,UAAU;YAC1D,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,KAAK,EAAE,CAAC;IACT,CAAC;IAED,OAAO;QACN,KAAK;QACL,SAAS;QACT,gBAAgB,EAAE,gBAAgB,CAAC,IAAI;QACvC,sBAAsB,EAAE,oBAAoB,CAAC,IAAI;QACjD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACnD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAChC,IAAU,EACV,iBAAyB;IAEzB,OAAO;QACN,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,IAAI,CAAC,UAAU;QACzB,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,GAAG,IAAI,CAAC,UAAU,QAAQ,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE;QAChE,MAAM,EAAE,IAAI,CAAC,QAAQ;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;KACjB,CAAC;AACH,CAAC"}

package/dist/medico/canonica.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Canonical bytes for the medical layer.
+ *
+ * Every signature in this layer is taken over a *deterministic* serialisation,
+ * because a signature that covers `JSON.stringify` output is not verifiable by
+ * anyone who re-serialises in a different key order. The pattern is lifted from
+ * `src/maloca/karma.ts` (`canonicalStringify`) rather than reinvented, so the
+ * medical layer and the karma layer agree on what "the same bytes" means.
+ *
+ * `canonicalEnvelopeBytes` in `src/protocol/index.ts` does the same job for the
+ * transport envelope. Three copies of this idea in the repo is a smell, but the
+ * envelope format is owned by a parallel agent and the karma one is internal to
+ * its module, so this file keeps its own copy instead of exporting a helper from
+ * a file that may change underneath it.
+ *
+ * Pure: no I/O, no clock, no randomness, no network. Hashing goes through WebCrypto
+ * (`crypto.subtle`), the same primitive `src/identity/index.ts` uses, so the
+ * module runs unchanged in Node and in the browser transport.
+ */
+import type { NodoId } from "../types/index.js";
+import type { Aval, CredencialMedica } from "./types.js";
+/** Hex encoding of a byte array, lower case. */
+export declare function bytesAHex(bytes: Uint8Array): string;
+export declare function hexABytes(hex: string): Uint8Array;
+/**
+ * Deterministically stringify for signing: object keys sorted, arrays in order,
+ * `undefined` members dropped, byte arrays hex-encoded.
+ *
+ * `undefined` is dropped rather than serialised as `null` so that an absent
+ * optional field and a present one holding `undefined` cannot produce two
+ * different signed payloads for what the caller means as the same record.
+ */
+export declare function canonicalStringify(obj: unknown): string;
+export declare function canonicalBytes(obj: unknown): Uint8Array;
+/**
+ * The exact fields a credential signature covers: everything except `firma`
+ * itself. A signature cannot be inside the bytes it signs.
+ */
+export declare function canonicalizarCredencial(credencial: CredencialMedica): Record<string, unknown>;
+export declare function bytesCredencial(credencial: CredencialMedica): Uint8Array;
+/** The exact fields an `Aval` signature covers: everything except `firma`. */
+export declare function canonicalizarAval(aval: Aval): Record<string, unknown>;
+export declare function bytesAval(aval: Aval): Uint8Array;
+/**
+ * SHA-256 via WebCrypto — the same primitive, and the same copy-into-a-fresh-
+ * `ArrayBuffer` workaround, as `src/identity/index.ts`.
+ *
+ * Async because `crypto.subtle` is. Every caller in this layer is already async
+ * (`firmar`, `verificar`), so no synchronous substitute is exposed in its place.
+ *
+ * Copying matters: the input may be a `Uint8Array` view over a larger backing
+ * store that is not itself an `ArrayBuffer`, which `subtle.digest` rejects.
+ */
+export declare function sha256(datos: Uint8Array): Promise<Uint8Array>;
+/** Lower-case hex of {@link sha256}. */
+export declare function sha256Hex(datos: Uint8Array): Promise<string>;
+/**
+ * SHA-256 over the canonical credential bytes, lower-case hex.
+ *
+ * This is what `Aval.hashCredencial` binds to: an `Aval` covers *exact*
+ * credential bytes, so editing a credential after endorsement invalidates every
+ * `Aval` bound to the old hash (`docs/medico/protocolo.md` Phase 3).
+ */
+export declare function hashCredencial(credencial: CredencialMedica): Promise<string>;
+/**
+ * Normalise a licence number the way the registry does, before hashing.
+ *
+ * Mirrors `LicenseVerifier.verify` in
+ * `apps/OrionHealth/lib/features/doctor_verification/domain/services/license_verifier.dart`:
+ * strip whitespace, upper-case. The *number* never leaves this function — only
+ * its hash is ever published.
+ */
+export declare function normalizarLicencia(numero: string): string;
+/** `sha256(normalize(licenceNumber))`, lower-case hex. The public-safe id. */
+export declare function hashLicencia(numeroLicencia: string): Promise<string>;
+/** Domain separation for credential ids. */
+export declare const DOMINIO_ID_CREDENCIAL = "shelf-edge-mesh/v1/id-credencial";
+/**
+ * Stable credential id: `hash(idLicencia + tipo + pais)`.
+ *
+ * Each component is hex-encoded and joined with a separator before hashing, so
+ * no two different triples can produce the same pre-image by moving characters
+ * across a field boundary — `('AB','licencia','CO')` must not collide with
+ * `('A','blicencia','CO')`.
+ */
+export declare function idCredencial(idLicencia: string, tipo: string, pais: string): Promise<string>;
+/**
+ * Build an `Aval` id: `${avalador}:${avalado}:${timestamp}:${nonce}`.
+ *
+ * The nonce is what makes this an idempotency key rather than a timestamp: two
+ * independent avaladores never collide, and a captured `Aval` replayed from the
+ * OpLog is recognised as already applied and cannot be counted twice
+ * (`docs/medico/protocolo.md` Phase 3).
+ */
+export declare function idAval(avalador: NodoId, avalado: NodoId, timestamp: number, nonce: string): string;
+//# sourceMappingURL=canonica.d.ts.map

package/dist/medico/canonica.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonica.d.ts","sourceRoot":"","sources":["../../src/medico/canonica.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEzD,gDAAgD;AAChD,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAInD;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAQjD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAUvD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAEvD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACtC,UAAU,EAAE,gBAAgB,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,gBAAgB,GAAG,UAAU,CAExE;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGrE;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,CAEhD;AAED;;;;;;;;;GASG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAInE;AAED,wCAAwC;AACxC,wBAAsB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAElE;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CACnC,UAAU,EAAE,gBAAgB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,8EAA8E;AAC9E,wBAAsB,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1E;AAED,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,qCAAqC,CAAC;AAExE;;;;;;;GAOG;AACH,wBAAsB,YAAY,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACX,MAAM,CAER"}

package/dist/medico/canonica.js

@@ -0,0 +1,148 @@
+/**
+ * Canonical bytes for the medical layer.
+ *
+ * Every signature in this layer is taken over a *deterministic* serialisation,
+ * because a signature that covers `JSON.stringify` output is not verifiable by
+ * anyone who re-serialises in a different key order. The pattern is lifted from
+ * `src/maloca/karma.ts` (`canonicalStringify`) rather than reinvented, so the
+ * medical layer and the karma layer agree on what "the same bytes" means.
+ *
+ * `canonicalEnvelopeBytes` in `src/protocol/index.ts` does the same job for the
+ * transport envelope. Three copies of this idea in the repo is a smell, but the
+ * envelope format is owned by a parallel agent and the karma one is internal to
+ * its module, so this file keeps its own copy instead of exporting a helper from
+ * a file that may change underneath it.
+ *
+ * Pure: no I/O, no clock, no randomness, no network. Hashing goes through WebCrypto
+ * (`crypto.subtle`), the same primitive `src/identity/index.ts` uses, so the
+ * module runs unchanged in Node and in the browser transport.
+ */
+/** Hex encoding of a byte array, lower case. */
+export function bytesAHex(bytes) {
+    let out = "";
+    for (const b of bytes)
+        out += b.toString(16).padStart(2, "0");
+    return out;
+}
+export function hexABytes(hex) {
+    if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex)) {
+        throw new TypeError("hexABytes: input must be an even-length hex string");
+    }
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    return out;
+}
+/**
+ * Deterministically stringify for signing: object keys sorted, arrays in order,
+ * `undefined` members dropped, byte arrays hex-encoded.
+ *
+ * `undefined` is dropped rather than serialised as `null` so that an absent
+ * optional field and a present one holding `undefined` cannot produce two
+ * different signed payloads for what the caller means as the same record.
+ */
+export function canonicalStringify(obj) {
+    if (obj === null || typeof obj !== "object")
+        return JSON.stringify(obj) ?? "null";
+    if (obj instanceof Uint8Array)
+        return JSON.stringify(bytesAHex(obj));
+    if (Array.isArray(obj))
+        return `[${obj.map(canonicalStringify).join(",")}]`;
+    const source = obj;
+    const keys = Object.keys(source)
+        .filter((k) => source[k] !== undefined)
+        .sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalStringify(source[k])}`).join(",")}}`;
+}
+export function canonicalBytes(obj) {
+    return new TextEncoder().encode(canonicalStringify(obj));
+}
+/**
+ * The exact fields a credential signature covers: everything except `firma`
+ * itself. A signature cannot be inside the bytes it signs.
+ */
+export function canonicalizarCredencial(credencial) {
+    const { firma: _firma, ...resto } = credencial;
+    return { ...resto };
+}
+export function bytesCredencial(credencial) {
+    return canonicalBytes(canonicalizarCredencial(credencial));
+}
+/** The exact fields an `Aval` signature covers: everything except `firma`. */
+export function canonicalizarAval(aval) {
+    const { firma: _firma, ...resto } = aval;
+    return { ...resto };
+}
+export function bytesAval(aval) {
+    return canonicalBytes(canonicalizarAval(aval));
+}
+/**
+ * SHA-256 via WebCrypto — the same primitive, and the same copy-into-a-fresh-
+ * `ArrayBuffer` workaround, as `src/identity/index.ts`.
+ *
+ * Async because `crypto.subtle` is. Every caller in this layer is already async
+ * (`firmar`, `verificar`), so no synchronous substitute is exposed in its place.
+ *
+ * Copying matters: the input may be a `Uint8Array` view over a larger backing
+ * store that is not itself an `ArrayBuffer`, which `subtle.digest` rejects.
+ */
+export async function sha256(datos) {
+    const buffer = new ArrayBuffer(datos.length);
+    new Uint8Array(buffer).set(datos);
+    return new Uint8Array(await crypto.subtle.digest("SHA-256", buffer));
+}
+/** Lower-case hex of {@link sha256}. */
+export async function sha256Hex(datos) {
+    return bytesAHex(await sha256(datos));
+}
+/**
+ * SHA-256 over the canonical credential bytes, lower-case hex.
+ *
+ * This is what `Aval.hashCredencial` binds to: an `Aval` covers *exact*
+ * credential bytes, so editing a credential after endorsement invalidates every
+ * `Aval` bound to the old hash (`docs/medico/protocolo.md` Phase 3).
+ */
+export async function hashCredencial(credencial) {
+    return sha256Hex(bytesCredencial(credencial));
+}
+/**
+ * Normalise a licence number the way the registry does, before hashing.
+ *
+ * Mirrors `LicenseVerifier.verify` in
+ * `apps/OrionHealth/lib/features/doctor_verification/domain/services/license_verifier.dart`:
+ * strip whitespace, upper-case. The *number* never leaves this function — only
+ * its hash is ever published.
+ */
+export function normalizarLicencia(numero) {
+    return numero.replace(/\s+/g, "").toUpperCase();
+}
+/** `sha256(normalize(licenceNumber))`, lower-case hex. The public-safe id. */
+export async function hashLicencia(numeroLicencia) {
+    return sha256Hex(new TextEncoder().encode(normalizarLicencia(numeroLicencia)));
+}
+/** Domain separation for credential ids. */
+export const DOMINIO_ID_CREDENCIAL = "shelf-edge-mesh/v1/id-credencial";
+/**
+ * Stable credential id: `hash(idLicencia + tipo + pais)`.
+ *
+ * Each component is hex-encoded and joined with a separator before hashing, so
+ * no two different triples can produce the same pre-image by moving characters
+ * across a field boundary — `('AB','licencia','CO')` must not collide with
+ * `('A','blicencia','CO')`.
+ */
+export async function idCredencial(idLicencia, tipo, pais) {
+    const partes = [DOMINIO_ID_CREDENCIAL, idLicencia, tipo, pais].map((p) => bytesAHex(new TextEncoder().encode(p)));
+    return sha256Hex(new TextEncoder().encode(partes.join("|")));
+}
+/**
+ * Build an `Aval` id: `${avalador}:${avalado}:${timestamp}:${nonce}`.
+ *
+ * The nonce is what makes this an idempotency key rather than a timestamp: two
+ * independent avaladores never collide, and a captured `Aval` replayed from the
+ * OpLog is recognised as already applied and cannot be counted twice
+ * (`docs/medico/protocolo.md` Phase 3).
+ */
+export function idAval(avalador, avalado, timestamp, nonce) {
+    return `${avalador}:${avalado}:${timestamp}:${nonce}`;
+}
+//# sourceMappingURL=canonica.js.map

package/dist/medico/canonica.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonica.js","sourceRoot":"","sources":["../../src/medico/canonica.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,gDAAgD;AAChD,MAAM,UAAU,SAAS,CAAC,KAAiB;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAClC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC9C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IACtC,IAAI,GAAG,YAAY,UAAU;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC5E,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACtC,IAAI,EAAE,CAAC;IACT,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY;IAC1C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACtC,UAA4B;IAE5B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,UAAU,CAAC;IAC/C,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAA4B;IAC3D,OAAO,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,IAAU;IAC3C,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAU;IACnC,OAAO,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAiB;IAC7C,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAiB;IAChD,OAAO,SAAS,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,UAA4B;IAE5B,OAAO,SAAS,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAChD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,cAAsB;IACxD,OAAO,SAAS,CACf,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAC5D,CAAC;AACH,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,MAAM,MAAM,GAAG,CAAC,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxE,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CACtC,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,MAAM,CACrB,QAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,KAAa;IAEb,OAAO,GAAG,QAAQ,IAAI,OAAO,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;AACvD,CAAC"}