@synoi/sraid 0.2.0

package/dist/authority.js

@@ -0,0 +1,563 @@
+/**
+ * @synoi/sraid — authority.ts
+ *
+ * L4 authority VERIFIER for CDRO objects (the authorized axis).
+ *
+ * This is deliberately more than a shape check. Per the Adversary review
+ * (panel A6: "ship a verifier, not just a schema"), an attacker who can
+ * attach any well-shaped `authority` block to an object would otherwise
+ * forge authorization for free. So this module verifies, locally and
+ * offline, the parts of authorization that ARE locally checkable:
+ *
+ *   1. STRUCTURE  — the object carries a present, well-formed authority
+ *      block (grant reference present; decision verb, if any, is a valid
+ *      GAP verb; intent ref well-formed).
+ *   2. BINDING    — the object's authority block actually references the
+ *      supplied grant (the grant's OID matches `authority.grant_oid`),
+ *      AND the grant is itself a hash-honest CDRO whose recomputed OID
+ *      equals its claimed OID (so the grant body cannot be swapped under
+ *      a fixed OID reference).
+ *   3. SIGNATURE  — the grant carries a valid hybrid (Ed25519 + ML-DSA-65)
+ *      signature over its own content core, when grant signing material
+ *      and verifier public keys are supplied. A grant with no/invalid
+ *      signature does not authorize.
+ *   4. COVERAGE   — the grant's capability scopes cover the requested
+ *      object type / action (dotted-taxonomy match with segment-boundary
+ *      wildcards), and the grant has not expired relative to the object's
+ *      creation time. Both are computable from the bytes in hand.
+ *
+ * What this module does NOT and CANNOT do offline — stated honestly,
+ * never silently assumed (CLAIMS_DISCIPLINE):
+ *
+ *   - LIVE REVOCATION  — whether the grant has since been revoked.
+ *   - EXISTENCE        — whether the grant OID actually resolves to a
+ *                        published, retrievable grant at all (when the
+ *                        caller did not supply the grant material).
+ *
+ * Both require the OID Resolver, which is presently undeployed
+ * (SRAID_FOUNDATION_PUNCHLIST C). This module DEFINES the resolver
+ * interface (`AuthorityResolver`) and, when a resolver is supplied, calls
+ * it and folds its answer into the result — but when no resolver is
+ * supplied, the result is explicitly marked `revocation_checked: false`
+ * and `existence_checked: false` so a caller can never mistake a
+ * locally-passing verification for a live one.
+ *
+ * DELEGATION CHAINS (`verifyDelegationChain`, K2) — VERIFY-ONLY. This module
+ * also carries a synchronous, offline delegation-chain verifier. It is
+ * deliberately scoped to verification with NO enforcement wiring and NO
+ * resolver: the caller supplies the ordered ancestors and the per-link
+ * verifier keys, and the function makes NO live claim. It ALWAYS returns
+ * `revocation_checked: false`, `not_revoked: false`, and
+ * `existence_checked: false` — those fields are LITERAL-TYPED `false` so the
+ * type system itself forbids a future edit from quietly asserting a live,
+ * resolver-backed claim from an offline function (CLAIMS_DISCIPLINE made
+ * structural). Synchronicity is intentional: with no Promise overload there is
+ * no place for a resolver call, which is what makes the no-live-claim
+ * guarantee structural rather than merely documented.
+ */
+import { cdroOid, cdroContentCore } from './oid.js';
+import { verifySignature } from './signature.js';
+import { verifyAttestation } from './attestation.js';
+// ── Valid verb set (mirrors AuthorityDecision in types.ts) ────────────────────
+const VALID_DECISIONS = new Set([
+    'allow',
+    'deny',
+    'defer',
+    'step_up',
+    'delegate',
+    'revoke',
+]);
+// ── Capability pattern matching ───────────────────────────────────────────────
+/**
+ * Match a capability `target` against a grant `pattern`. Pure string logic,
+ * re-stated here so L0 stays dependency-free (the same rule lives in
+ * `@synoi/gap-types` `capabilityMatches`; L0 must not depend on L3).
+ *
+ *   - exact match → true
+ *   - '*' → match-all
+ *   - 'skill.*' matches 'skill.create' and deeper (segment-boundary only).
+ *     A non-boundary 'admin.us*' must NOT match 'admin.users.delete'
+ *     (privilege-escalation footgun) — only a '.'-anchored '*' is a wildcard.
+ */
+export function capabilityCovers(pattern, target) {
+    if (pattern === target)
+        return true;
+    if (pattern === '*')
+        return true;
+    if (pattern.endsWith('.*')) {
+        const prefix = pattern.slice(0, -1); // keep trailing '.', e.g. 'skill.'
+        return target.startsWith(prefix);
+    }
+    return false;
+}
+const DEFAULT_GRANT_PAYLOAD_TYPE = 'application/vnd.synoi.sraid+json';
+export function verifyAuthority(input) {
+    const reasons = [];
+    const auth = input.object?.authority;
+    // ── 1. STRUCTURE ──────────────────────────────────────────────────────────
+    let structure_ok = true;
+    if (auth === undefined || auth === null || typeof auth !== 'object') {
+        structure_ok = false;
+        reasons.push('authority block absent — object asserts no authority');
+    }
+    else {
+        if (auth.grant_oid !== undefined) {
+            if (typeof auth.grant_oid !== 'string' || !auth.grant_oid.startsWith('sha256:')) {
+                structure_ok = false;
+                reasons.push('authority.grant_oid must be a "sha256:" OID');
+            }
+        }
+        else {
+            // grant_oid is the only thing that ties an object to an authorizer.
+            // Its absence is allowed ONLY for an uncorrelated state-change event,
+            // which is the orphan case — not "authorized".
+            structure_ok = false;
+            reasons.push('authority.grant_oid absent — orphaned / uncorrelated authority');
+        }
+        if (auth.decision !== undefined &&
+            auth.decision !== null &&
+            !VALID_DECISIONS.has(auth.decision)) {
+            structure_ok = false;
+            reasons.push(`authority.decision "${String(auth.decision)}" is not a valid GAP verb`);
+        }
+        if (auth.intent_oid !== undefined &&
+            (typeof auth.intent_oid !== 'string' || !auth.intent_oid.startsWith('sha256:'))) {
+            structure_ok = false;
+            reasons.push('authority.intent_oid, if present, must be a "sha256:" OID');
+        }
+    }
+    // ── 2-4. BINDING / SIGNATURE / COVERAGE (need the grant) ─────────────────────
+    const grant = input.grant;
+    const grant_supplied = grant !== undefined && grant !== null;
+    let binding_ok = false;
+    let signature_ok = false;
+    let signature_checked = false;
+    let coverage_ok = false;
+    if (structure_ok && grant_supplied) {
+        // BINDING — recompute the grant's OID over its content core and require it
+        // to equal both the grant's own claimed OID and the object's reference.
+        // This defeats "swap the grant body under a fixed OID reference".
+        let recomputed = null;
+        try {
+            recomputed = cdroOid(grant);
+        }
+        catch {
+            recomputed = null;
+        }
+        const claimedOid = grant.oid;
+        const referenced = auth?.grant_oid;
+        if (recomputed === null) {
+            reasons.push('grant content core not hashable');
+        }
+        else if (recomputed !== claimedOid) {
+            reasons.push('grant OID does not match its content (tampered grant body)');
+        }
+        else if (recomputed !== referenced) {
+            reasons.push('object.authority.grant_oid does not reference the supplied grant');
+        }
+        else {
+            binding_ok = true;
+        }
+        // SIGNATURE — verify the grant's hybrid signature over its content core.
+        // BINDING and SIGNATURE must hash identical bytes: both route through
+        // cdroContentCore (strips oid, signature, attestation) so they are
+        // provably the same bytes.
+        if (input.grant_ed25519_pub !== undefined &&
+            input.grant_ml_dsa_pub !== undefined) {
+            signature_checked = true;
+            const att = grant.attestation;
+            const sig = grant.signature;
+            // Compute the canonical content core once — shared by both paths.
+            let canonical = null;
+            try {
+                canonical = canonicalize(cdroContentCore(grant));
+            }
+            catch {
+                canonical = null;
+            }
+            if (canonical === null) {
+                reasons.push('grant content core not canonicalizable for signature check');
+            }
+            else if (att) {
+                // DSSE attestation path — prefer when present.
+                // payload-swap guard: the signed payload MUST equal this grant's content core.
+                if (att.payload !== canonical) {
+                    signature_ok = false;
+                    reasons.push('grant attestation payload does not match its content core (payload swap)');
+                }
+                else {
+                    const expectedPayloadType = input.grant_payload_type ?? DEFAULT_GRANT_PAYLOAD_TYPE;
+                    const r = verifyAttestation({
+                        envelope: att,
+                        ed25519_pub: input.grant_ed25519_pub,
+                        ml_dsa_pub: input.grant_ml_dsa_pub,
+                        expectedPayloadType,
+                    });
+                    signature_ok = r.valid;
+                    if (!r.valid)
+                        reasons.push(`grant attestation invalid: ${r.reasons.join(',')}`);
+                }
+            }
+            else if (sig) {
+                // Legacy signature envelope path.
+                const r = verifySignature({
+                    canonical,
+                    envelope: sig,
+                    ed25519_pub: input.grant_ed25519_pub,
+                    ml_dsa_pub: input.grant_ml_dsa_pub,
+                });
+                signature_ok = r.valid;
+                if (!r.valid)
+                    reasons.push(`grant signature invalid: ${r.reasons.join(',')}`);
+            }
+            else {
+                reasons.push('grant carries no signature or attestation');
+            }
+        }
+        // COVERAGE — scope covers the action, and grant not expired at object time.
+        const action = input.action ?? input.object.type;
+        const scopes = grant.body?.capability_scopes;
+        let covered = false;
+        if (Array.isArray(scopes)) {
+            for (const s of scopes) {
+                if (s && typeof s.capability === 'string' && capabilityCovers(s.capability, action)) {
+                    covered = true;
+                    break;
+                }
+            }
+        }
+        if (!covered) {
+            reasons.push(`grant scope does not cover action "${action}"`);
+        }
+        const expires = grant.body?.expires_at_ms;
+        let notExpired = true;
+        if (typeof expires === 'number') {
+            if (input.object.created_at_ms > expires) {
+                notExpired = false;
+                reasons.push('grant had expired at the object creation time');
+            }
+        }
+        coverage_ok = covered && notExpired;
+    }
+    else if (structure_ok && !grant_supplied) {
+        reasons.push('grant not supplied — binding/signature/coverage not checked');
+    }
+    // Local verdict: every attempted local check passed. Signature counts only
+    // if it was checked; resolver checks are handled below.
+    const localAuthorized = structure_ok &&
+        grant_supplied &&
+        binding_ok &&
+        coverage_ok &&
+        (!signature_checked || signature_ok);
+    const base = {
+        authorized: localAuthorized,
+        structure_ok,
+        grant_supplied,
+        binding_ok,
+        signature_ok,
+        signature_checked,
+        coverage_ok,
+        existence_checked: false,
+        existence_ok: false,
+        revocation_checked: false,
+        not_revoked: false,
+        reasons,
+    };
+    // ── 5. RESOLVER (live revocation + existence) — resolver-dependent ──────────
+    if (input.resolver && auth?.grant_oid) {
+        const grantOid = auth.grant_oid;
+        return Promise.resolve(input.resolver.resolveGrantStatus(grantOid)).then((status) => {
+            const existence_ok = status.exists === true;
+            const not_revoked = existence_ok && status.revoked !== true;
+            if (!existence_ok)
+                base.reasons.push('resolver: grant does not exist');
+            if (existence_ok && status.revoked === true) {
+                base.reasons.push('resolver: grant has been revoked');
+            }
+            return {
+                ...base,
+                existence_checked: true,
+                existence_ok,
+                revocation_checked: true,
+                not_revoked,
+                authorized: localAuthorized && existence_ok && not_revoked,
+            };
+        });
+    }
+    return base;
+}
+// ── verifyDelegationChain (K2) — VERIFY-ONLY delegation-chain verifier ────────
+/**
+ * Hard cap on delegation depth. Checked BEFORE any hashing or signature work,
+ * so an over-long chain is a cheap rejection (DoS guard) and never triggers
+ * crypto. A chain of `links.length > MAX_DELEGATION_DEPTH` fails closed.
+ */
+export const MAX_DELEGATION_DEPTH = 8;
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/** Extract string capabilities from a grant body's scope array. */
+function scopeCaps(grant) {
+    const scopes = grant?.body?.capability_scopes;
+    if (!Array.isArray(scopes))
+        return [];
+    const out = [];
+    for (const s of scopes) {
+        if (s && typeof s.capability === 'string')
+            out.push(s.capability);
+    }
+    return out;
+}
+/**
+ * Verify a delegation chain OFFLINE (K2). VERIFY-ONLY: there is no enforcement
+ * wiring and no resolver — the caller supplies the ordered ancestors and the
+ * per-link verifier keys, and this function makes NO live claim. It ALWAYS
+ * returns `revocation_checked: false` and `existence_checked: false`; those
+ * remain RESOLVER-DEPENDENT (SRAID_FOUNDATION_PUNCHLIST C) and are explicitly
+ * out of scope here. The function is synchronous (no Promise overload), which
+ * is what makes "no live claim" structural rather than merely documented.
+ *
+ * The gate runs in this fixed order; DEPTH is checked BEFORE any crypto:
+ *
+ *   GATE 0  DEPTH CAP    — depth in [1, MAX_DELEGATION_DEPTH]; else return with
+ *                          NO hashing or signature work (cheap DoS guard).
+ *   GATE 1  OID HONESTY  — every link's recomputed content-core OID equals its
+ *                          claimed `oid` (rejects a body swapped under a fixed
+ *                          OID reference).
+ *   GATE 2  PER-HOP      — for each child links[i] under parent links[i+1]:
+ *                          (a) granted_by linkage, (b) scope attenuation (every
+ *                          child scope covered by some parent scope; empty
+ *                          child scopes = FAIL — a grant of nothing is not
+ *                          vacuously attenuated), (c) expiry monotone narrowing
+ *                          (null parent = unbounded; null child under a bounded
+ *                          parent = widening = FAIL).
+ *   GATE 3  SIGNATURES   — every link carries a hybrid DSSE attestation
+ *                          (ed25519 AND ml-dsa-65) over PAE(payloadType,
+ *                          payload), and the attestation payload equals
+ *                          canonicalize(cdroContentCore(link)) (payload-swap
+ *                          guard). A missing attestation sets signatures_checked
+ *                          false for that link and fails.
+ *   GATE 4  ROOT ANCHOR  — the terminal link's issuer key deep-equals
+ *                          rootPubkeys.
+ *
+ * `authorized` is the AND of every gate.
+ */
+export function verifyDelegationChain(input) {
+    const reasons = [];
+    const links = [input.leaf, ...input.ancestors];
+    const depth = links.length;
+    const expectedPayloadType = input.attestationPayloadType ?? DEFAULT_GRANT_PAYLOAD_TYPE;
+    const fail = (over) => ({
+        authorized: false,
+        depth,
+        depth_ok: false,
+        links_ok: false,
+        attenuation_ok: false,
+        expiry_ok: false,
+        signatures_ok: false,
+        signatures_checked: false,
+        oids_ok: false,
+        root_ok: false,
+        action_ok: false,
+        action_checked: false,
+        revocation_checked: false,
+        not_revoked: false,
+        existence_checked: false,
+        per_hop: [],
+        reasons,
+        ...over,
+    });
+    // ── GATE 0 — DEPTH CAP (before any hashing or signature work) ──────────────
+    const depth_ok = depth >= 1 && depth <= MAX_DELEGATION_DEPTH;
+    if (!depth_ok) {
+        if (depth < 1)
+            reasons.push('empty chain — no leaf grant supplied');
+        else
+            reasons.push(`chain depth ${depth} exceeds cap ${MAX_DELEGATION_DEPTH}`);
+        // RETURN with no crypto run: signatures_checked stays false.
+        return fail({ depth_ok: false });
+    }
+    if (input.linkPubkeys.length !== depth) {
+        reasons.push(`linkPubkeys length ${input.linkPubkeys.length} does not match chain depth ${depth}`);
+        return fail({ depth_ok });
+    }
+    // ── GATE 1 — OID HASH-HONESTY, every link ──────────────────────────────────
+    let oids_ok = true;
+    for (let i = 0; i < depth; i++) {
+        const link = links[i];
+        let recomputed = null;
+        try {
+            recomputed = cdroOid(link);
+        }
+        catch {
+            recomputed = null;
+        }
+        if (recomputed === null || recomputed !== link.oid) {
+            oids_ok = false;
+            reasons.push(`link ${i} OID does not match its content (tampered grant body)`);
+        }
+    }
+    // ── GATE 2 — PER-HOP STRUCTURE (child links[i] under parent links[i+1]) ─────
+    let links_ok = true;
+    let attenuation_ok = true;
+    let expiry_ok = true;
+    const per_hop = [];
+    for (let i = 0; i < depth - 1; i++) {
+        const child = links[i];
+        const parent = links[i + 1];
+        // (a) GRANTED_BY linkage
+        const childGrantedBy = child.body?.granted_by;
+        const parentGrantee = parent.body?.grantee?.actor_oid;
+        const granted_by_ok = typeof childGrantedBy === 'string' &&
+            typeof parentGrantee === 'string' &&
+            childGrantedBy === parentGrantee;
+        if (!granted_by_ok) {
+            links_ok = false;
+            reasons.push(`hop ${i}: child.granted_by does not equal parent.grantee.actor_oid (broken signer link)`);
+        }
+        // (b) ATTENUATION — every child scope covered by some parent scope.
+        const childCaps = scopeCaps(child);
+        const parentCaps = scopeCaps(parent);
+        let hopAtten = true;
+        if (childCaps.length === 0) {
+            // A grant that grants nothing is REJECTED (conservative default), not
+            // treated as vacuously attenuated. (Flagged for founder review.)
+            hopAtten = false;
+            reasons.push(`hop ${i}: child grant has no capability scopes (rejected)`);
+        }
+        else {
+            for (const c of childCaps) {
+                const covered = parentCaps.some((p) => capabilityCovers(p, c));
+                if (!covered) {
+                    hopAtten = false;
+                    reasons.push(`hop ${i}: child scope "${c}" widens parent (not attenuated)`);
+                }
+            }
+        }
+        if (!hopAtten)
+            attenuation_ok = false;
+        // (c) EXPIRY MONOTONE-NARROWING
+        const pe = parent.body?.expires_at_ms;
+        const ce = child.body?.expires_at_ms;
+        let hopExpiry = true;
+        if (pe === null || pe === undefined) {
+            // unbounded parent: any child OK
+            hopExpiry = true;
+        }
+        else if (typeof pe === 'number') {
+            if (ce === null || ce === undefined) {
+                hopExpiry = false;
+                reasons.push(`hop ${i}: child expiry is unbounded under a bounded parent (widening)`);
+            }
+            else if (typeof ce === 'number') {
+                if (ce > pe) {
+                    hopExpiry = false;
+                    reasons.push(`hop ${i}: child expiry ${ce} is later than parent ${pe} (widening)`);
+                }
+            }
+        }
+        if (!hopExpiry)
+            expiry_ok = false;
+        per_hop.push({
+            child_index: i,
+            granted_by_ok,
+            attenuation_ok: hopAtten,
+            expiry_ok: hopExpiry,
+        });
+    }
+    // ── GATE 3 — HYBRID DSSE SIGNATURE, every link ─────────────────────────────
+    let signatures_ok = true;
+    let signatures_checked = true;
+    for (let i = 0; i < depth; i++) {
+        const link = links[i];
+        const att = link.attestation;
+        if (!att) {
+            signatures_checked = false;
+            signatures_ok = false;
+            reasons.push(`link ${i} carries no DSSE attestation`);
+            continue;
+        }
+        // payload-swap guard: the signed payload MUST equal this link's content core.
+        let expectedPayload = null;
+        try {
+            expectedPayload = canonicalize(cdroContentCore(link));
+        }
+        catch {
+            expectedPayload = null;
+        }
+        if (expectedPayload === null || att.payload !== expectedPayload) {
+            signatures_ok = false;
+            reasons.push(`link ${i} attestation payload does not match its content core (payload swap)`);
+            continue;
+        }
+        const keys = input.linkPubkeys[i];
+        const r = verifyAttestation({
+            envelope: att,
+            ed25519_pub: keys.ed25519,
+            ml_dsa_pub: keys.ml_dsa,
+            expectedPayloadType,
+        });
+        if (!r.valid) {
+            signatures_ok = false;
+            reasons.push(`link ${i} hybrid signature invalid: ${r.reasons.join(',')}`);
+        }
+    }
+    // ── GATE 4 — ROOT ANCHOR ───────────────────────────────────────────────────
+    const terminalKeys = input.linkPubkeys[depth - 1];
+    const root_ok = bytesEqual(terminalKeys.ed25519, input.rootPubkeys.ed25519) &&
+        bytesEqual(terminalKeys.ml_dsa, input.rootPubkeys.ml_dsa);
+    if (!root_ok) {
+        reasons.push('terminal link signer key does not equal rootPubkeys (forged/unknown root)');
+    }
+    // ── GATE 5 — ACTION COVERAGE (optional) ────────────────────────────────────
+    // When the caller supplies `action`, the leaf's capability scopes MUST cover
+    // it. Leaf = links[0]. Attenuation (GATE 2) already proved every ancestor
+    // covers the leaf, so leaf coverage + attenuation transitively proves the
+    // whole chain covers the action. Checking every hop would be redundant.
+    let action_ok = true;
+    let action_checked = false;
+    if (input.action !== undefined) {
+        action_checked = true;
+        const leafCaps = scopeCaps(input.leaf);
+        const covered = leafCaps.some((s) => capabilityCovers(s, input.action));
+        if (!covered) {
+            action_ok = false;
+            reasons.push(`requested action "${input.action}" not covered by leaf grant`);
+        }
+    }
+    const authorized = depth_ok &&
+        oids_ok &&
+        links_ok &&
+        attenuation_ok &&
+        expiry_ok &&
+        signatures_ok &&
+        signatures_checked &&
+        root_ok &&
+        action_ok;
+    return {
+        authorized,
+        depth,
+        depth_ok,
+        links_ok,
+        attenuation_ok,
+        expiry_ok,
+        signatures_ok,
+        signatures_checked,
+        oids_ok,
+        root_ok,
+        action_ok,
+        action_checked,
+        revocation_checked: false,
+        not_revoked: false,
+        existence_checked: false,
+        per_hop,
+        reasons,
+    };
+}
+import { canonicalize } from './canonicalize.js';
+//# sourceMappingURL=authority.js.map

package/dist/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../src/authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAQpD,iFAAiF;AAEjF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAoB;IACtE,OAAO;IACP,MAAM;IACN,OAAO;IACP,SAAS;IACT,UAAU;IACV,QAAQ;CACT,CAAC,CAAA;AAEF,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAc;IAC9D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,mCAAmC;QACvE,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAmID,MAAM,0BAA0B,GAAG,kCAAkC,CAAA;AAarE,MAAM,UAAU,eAAe,CAC7B,KAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,IAAI,GAA+B,KAAK,CAAC,MAAM,EAAE,SAAS,CAAA;IAEhE,6EAA6E;IAC7E,IAAI,YAAY,GAAG,IAAI,CAAA;IACvB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,YAAY,GAAG,KAAK,CAAA;QACpB,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAA;IACtE,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChF,YAAY,GAAG,KAAK,CAAA;gBACpB,OAAO,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAA;YAC7D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,sEAAsE;YACtE,+CAA+C;YAC/C,YAAY,GAAG,KAAK,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAA;QAChF,CAAC;QACD,IACE,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC3B,IAAI,CAAC,QAAQ,KAAK,IAAI;YACtB,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EACnC,CAAC;YACD,YAAY,GAAG,KAAK,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;QACvF,CAAC;QACD,IACE,IAAI,CAAC,UAAU,KAAK,SAAS;YAC7B,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAC/E,CAAC;YACD,YAAY,GAAG,KAAK,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,MAAM,cAAc,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAA;IAC5D,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,IAAI,WAAW,GAAG,KAAK,CAAA;IAEvB,IAAI,YAAY,IAAI,cAAc,EAAE,CAAC;QACnC,2EAA2E;QAC3E,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,UAAU,GAAkB,IAAI,CAAA;QACpC,IAAI,CAAC;YACH,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,MAAM,UAAU,GAAI,KAAc,CAAC,GAAG,CAAA;QACtC,MAAM,UAAU,GAAG,IAAI,EAAE,SAAS,CAAA;QAClC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAA;QAC5E,CAAC;aAAM,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAA;QAClF,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,mEAAmE;QACnE,2BAA2B;QAC3B,IACE,KAAK,CAAC,iBAAiB,KAAK,SAAS;YACrC,KAAK,CAAC,gBAAgB,KAAK,SAAS,EACpC,CAAC;YACD,iBAAiB,GAAG,IAAI,CAAA;YACxB,MAAM,GAAG,GAAI,KAAc,CAAC,WAAW,CAAA;YACvC,MAAM,GAAG,GAAmC,KAAc,CAAC,SAAS,CAAA;YAEpE,kEAAkE;YAClE,IAAI,SAAS,GAAkB,IAAI,CAAA;YACnC,IAAI,CAAC;gBACH,SAAS,GAAG,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,IAAI,CAAA;YAClB,CAAC;YAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAA;YAC5E,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,+CAA+C;gBAC/C,+EAA+E;gBAC/E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC9B,YAAY,GAAG,KAAK,CAAA;oBACpB,OAAO,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAA;gBAC1F,CAAC;qBAAM,CAAC;oBACN,MAAM,mBAAmB,GAAG,KAAK,CAAC,kBAAkB,IAAI,0BAA0B,CAAA;oBAClF,MAAM,CAAC,GAAG,iBAAiB,CAAC;wBAC1B,QAAQ,EAAE,GAAG;wBACb,WAAW,EAAE,KAAK,CAAC,iBAAiB;wBACpC,UAAU,EAAE,KAAK,CAAC,gBAAgB;wBAClC,mBAAmB;qBACpB,CAAC,CAAA;oBACF,YAAY,GAAG,CAAC,CAAC,KAAK,CAAA;oBACtB,IAAI,CAAC,CAAC,CAAC,KAAK;wBAAE,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBACjF,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,kCAAkC;gBAClC,MAAM,CAAC,GAAG,eAAe,CAAC;oBACxB,SAAS;oBACT,QAAQ,EAAE,GAAG;oBACb,WAAW,EAAE,KAAK,CAAC,iBAAiB;oBACpC,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC,CAAA;gBACF,YAAY,GAAG,CAAC,CAAC,KAAK,CAAA;gBACtB,IAAI,CAAC,CAAC,CAAC,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC/E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAA;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAA;QAC5C,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;oBACpF,OAAO,GAAG,IAAI,CAAA;oBACd,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,sCAAsC,MAAM,GAAG,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,aAAa,CAAA;QACzC,IAAI,UAAU,GAAG,IAAI,CAAA;QACrB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,OAAO,EAAE,CAAC;gBACzC,UAAU,GAAG,KAAK,CAAA;gBAClB,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QACD,WAAW,GAAG,OAAO,IAAI,UAAU,CAAA;IACrC,CAAC;SAAM,IAAI,YAAY,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;IAC7E,CAAC;IAED,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,eAAe,GACnB,YAAY;QACZ,cAAc;QACd,UAAU;QACV,WAAW;QACX,CAAC,CAAC,iBAAiB,IAAI,YAAY,CAAC,CAAA;IAEtC,MAAM,IAAI,GAA0B;QAClC,UAAU,EAAE,eAAe;QAC3B,YAAY;QACZ,cAAc;QACd,UAAU;QACV,YAAY;QACZ,iBAAiB;QACjB,WAAW;QACX,iBAAiB,EAAE,KAAK;QACxB,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,KAAK;QACzB,WAAW,EAAE,KAAK;QAClB,OAAO;KACR,CAAA;IAED,+EAA+E;IAC/E,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CACtE,CAAC,MAAM,EAAyB,EAAE;YAChC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAA;YAC3C,MAAM,WAAW,GAAG,YAAY,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAA;YAC3D,IAAI,CAAC,YAAY;gBAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;YACtE,IAAI,YAAY,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;YACvD,CAAC;YACD,OAAO;gBACL,GAAG,IAAI;gBACP,iBAAiB,EAAE,IAAI;gBACvB,YAAY;gBACZ,kBAAkB,EAAE,IAAI;gBACxB,WAAW;gBACX,UAAU,EAAE,eAAe,IAAI,YAAY,IAAI,WAAW;aAC3D,CAAA;QACH,CAAC,CACF,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAA;AA8GrC,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAK,CAAC,CAAC,CAAC,CAAY,GAAI,CAAC,CAAC,CAAC,CAAY,CAAA;IAC9E,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,mEAAmE;AACnE,SAAS,SAAS,CAAC,KAAuC;IACxD,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAA;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IACrC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAiC;IAEjC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAA;IAC1B,MAAM,mBAAmB,GAAG,KAAK,CAAC,sBAAsB,IAAI,0BAA0B,CAAA;IAEtF,MAAM,IAAI,GAAG,CACX,IAA0C,EACb,EAAE,CAAC,CAAC;QACjC,UAAU,EAAE,KAAK;QACjB,KAAK;QACL,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,cAAc,EAAE,KAAK;QACrB,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,KAAK;QACpB,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,KAAK;QACrB,kBAAkB,EAAE,KAAK;QACzB,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,KAAK;QACxB,OAAO,EAAE,EAAE;QACX,OAAO;QACP,GAAG,IAAI;KACR,CAAC,CAAA;IAEF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,oBAAoB,CAAA;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;;YAC9D,OAAO,CAAC,IAAI,CAAC,eAAe,KAAK,gBAAgB,oBAAoB,EAAE,CAAC,CAAA;QAC7E,6DAA6D;QAC7D,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CACV,sBAAsB,KAAK,CAAC,WAAW,CAAC,MAAM,+BAA+B,KAAK,EAAE,CACrF,CAAA;QACD,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC3B,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAyB,CAAA;QAC7C,IAAI,UAAU,GAAkB,IAAI,CAAA;QACpC,IAAI,CAAC;YACH,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACnD,OAAO,GAAG,KAAK,CAAA;YACf,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,IAAI,cAAc,GAAG,IAAI,CAAA;IACzB,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,MAAM,OAAO,GAAgB,EAAE,CAAA;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAyB,CAAA;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAyB,CAAA;QAEnD,yBAAyB;QACzB,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,CAAA;QAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAA;QACrD,MAAM,aAAa,GACjB,OAAO,cAAc,KAAK,QAAQ;YAClC,OAAO,aAAa,KAAK,QAAQ;YACjC,cAAc,KAAK,aAAa,CAAA;QAClC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,QAAQ,GAAG,KAAK,CAAA;YAChB,OAAO,CAAC,IAAI,CACV,OAAO,CAAC,iFAAiF,CAC1F,CAAA;QACH,CAAC;QAED,oEAAoE;QACpE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,QAAQ,GAAG,IAAI,CAAA;QACnB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,sEAAsE;YACtE,iEAAiE;YACjE,QAAQ,GAAG,KAAK,CAAA;YAChB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAA;QAC3E,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,QAAQ,GAAG,KAAK,CAAA;oBAChB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,cAAc,GAAG,KAAK,CAAA;QAErC,gCAAgC;QAChC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAA;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,aAAa,CAAA;QACpC,IAAI,SAAS,GAAG,IAAI,CAAA;QACpB,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACpC,iCAAiC;YACjC,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC;aAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACpC,SAAS,GAAG,KAAK,CAAA;gBACjB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAA;YACvF,CAAC;iBAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAClC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;oBACZ,SAAS,GAAG,KAAK,CAAA;oBACjB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,yBAAyB,EAAE,aAAa,CAAC,CAAA;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,SAAS,GAAG,KAAK,CAAA;QAEjC,OAAO,CAAC,IAAI,CAAC;YACX,WAAW,EAAE,CAAC;YACd,aAAa;YACb,cAAc,EAAE,QAAQ;YACxB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,8EAA8E;IAC9E,IAAI,aAAa,GAAG,IAAI,CAAA;IACxB,IAAI,kBAAkB,GAAG,IAAI,CAAA;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAyB,CAAA;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAA;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,kBAAkB,GAAG,KAAK,CAAA;YAC1B,aAAa,GAAG,KAAK,CAAA;YACrB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAA;YACrD,SAAQ;QACV,CAAC;QACD,8EAA8E;QAC9E,IAAI,eAAe,GAAkB,IAAI,CAAA;QACzC,IAAI,CAAC;YACH,eAAe,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,eAAe,GAAG,IAAI,CAAA;QACxB,CAAC;QACD,IAAI,eAAe,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YAChE,aAAa,GAAG,KAAK,CAAA;YACrB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,qEAAqE,CAAC,CAAA;YAC5F,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAgB,CAAA;QAChD,MAAM,CAAC,GAAG,iBAAiB,CAAC;YAC1B,QAAQ,EAAE,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,OAAO;YACzB,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,mBAAmB;SACpB,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACb,aAAa,GAAG,KAAK,CAAA;YACrB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,CAAgB,CAAA;IAChE,MAAM,OAAO,GACX,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC;QAC3D,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAA;IAC3F,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,IAAI,cAAc,GAAG,KAAK,CAAA;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,cAAc,GAAG,IAAI,CAAA;QACrB,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,MAAgB,CAAC,CAAC,CAAA;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS,GAAG,KAAK,CAAA;YACjB,OAAO,CAAC,IAAI,CACV,qBAAqB,KAAK,CAAC,MAAM,6BAA6B,CAC/D,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GACd,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,cAAc;QACd,SAAS;QACT,aAAa;QACb,kBAAkB;QAClB,OAAO;QACP,SAAS,CAAA;IAEX,OAAO;QACL,UAAU;QACV,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,cAAc;QACd,SAAS;QACT,aAAa;QACb,kBAAkB;QAClB,OAAO;QACP,OAAO;QACP,SAAS;QACT,cAAc;QACd,kBAAkB,EAAE,KAAK;QACzB,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,KAAK;QACxB,OAAO;QACP,OAAO;KACR,CAAA;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/canonicalize.d.ts

@@ -0,0 +1,70 @@
+/**
+ * @synoi/sraid — canonicalize.ts
+ *
+ * Strict RFC 8785 (JCS) serializer for SRAID objects. Produces
+ * byte-identical output to any other conformant RFC 8785 implementation
+ * given the same input, making this the normative canonical form for OID
+ * derivation and signing.
+ *
+ * Rules (strict RFC 8785 JCS):
+ *   - Primitives are emitted via JSON.stringify (strings are escaped with
+ *     standard JSON string escaping; booleans and null are literals).
+ *   - Numbers must be FINITE INTEGERS (ADR_019 decision 2). NaN, Infinity
+ *     (positive or negative), and any non-integer (float) are REJECTED with
+ *     a thrown TypeError BEFORE hashing. Forbidding floats everywhere matches
+ *     GAP-TS / GAP-Python and removes the hardest RFC 8785 cross-language
+ *     serialization trap from the signed byte string; the product only emits
+ *     integer minor-unit money and integer ms timestamps. Legal integers use
+ *     the ECMAScript number-to-string serialization of RFC 8785 §3.2.2.3
+ *     (equivalent to JS's default toString for integer values).
+ *   - Arrays preserve element order; elements are recursively canonicalized.
+ *   - Objects emit their keys sorted in ascending lexicographic
+ *     (UTF-16 code-unit) order — this is the order produced by
+ *     Array.prototype.sort(), which is exactly what RFC 8785 §3.2.3
+ *     specifies for implementations whose host language uses UTF-16
+ *     string encoding (including ECMAScript/TypeScript).
+ *   - Object properties whose value is `undefined` are OMITTED entirely.
+ *     (JSON has no undefined; this matches JSON.stringify semantics.)
+ *   - No whitespace anywhere. Separators are bare `,` and `:`.
+ *   - `null` is preserved as `null`.
+ *
+ * Stability invariant: any change to this function breaks every signed
+ * receipt, every OID, every grant — so it must NEVER be changed without
+ * a coordinated migration. The output bytes for a given input are a
+ * cross-package contract.
+ */
+/**
+ * Canonicalize an arbitrary JSON-compatible value into a deterministic
+ * UTF-8 string following RFC 8785 (JCS). The output is suitable as input
+ * to SHA-256 (or any other hash) for OID derivation and as the byte string
+ * signed by Ed25519 / ML-DSA-65 envelopes.
+ *
+ * Reject-loud contract: a TypeError is thrown for any value that is not a
+ * JSON value, rather than silently producing a wrong or invalid canonical
+ * form (which would corrupt an OID or signature):
+ *   - NaN / Infinity / -Infinity (RFC 8785 forbids non-finite numbers).
+ *   - non-integer numbers / floats (ADR_019 forbids them; use integer minor
+ *     units). e.g. 1.5, 0.1, 2e-3 all throw.
+ *   - undefined / function / symbol / bigint anywhere they appear as a value,
+ *     including as an ARRAY element (previously these produced invalid JSON
+ *     like "[1,,2]").
+ *   - objects with a toJSON() method (e.g. Date), which a bare keys-walk would
+ *     silently mis-serialize (a Date became "{}"). Convert to a JSON value
+ *     (e.g. an ISO string) first.
+ * Object properties whose value is `undefined` are OMITTED (matches
+ * JSON.stringify); an undefined array element throws (it cannot be omitted).
+ *
+ * @example
+ *   canonicalize({ b: 2, a: 1 })            // '{"a":1,"b":2}'
+ *   canonicalize({ a: undefined, b: 1 })    // '{"b":1}'  (object undefined omitted)
+ *   canonicalize([3, 1, 2])                 // '[3,1,2]'
+ *   canonicalize([1, null, 2])              // '[1,null,2]'
+ *   canonicalize({ foo: 1, bar: 'hi' })     // '{"bar":"hi","foo":1}'
+ *   canonicalize(NaN)                       // throws TypeError
+ *   canonicalize(Infinity)                  // throws TypeError
+ *   canonicalize(1.5)                       // throws TypeError (floats forbidden, ADR_019)
+ *   canonicalize([1, undefined, 2])         // throws TypeError (no empty slots)
+ *   canonicalize(new Date())                // throws TypeError (serialize first)
+ */
+export declare function canonicalize(value: unknown): string;
+//# sourceMappingURL=canonicalize.d.ts.map

package/dist/canonicalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../src/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAiGnD"}