@vess-id/vess 0.0.0-dev-20260902121045

package/dist/gateway/gateway-client.js

@@ -0,0 +1,611 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentdGatewayClient = exports.GatewayHttpError = exports.GatewayNetworkError = void 0;
+const credential_errors_1 = require("../utils/credential-errors");
+const ai_identity_1 = require("@vess-id/ai-identity");
+/**
+ * Custom error for network-level failures (connection refused, DNS, timeout).
+ * Used by ExecutionEngine to distinguish network issues from code bugs.
+ */
+class GatewayNetworkError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = 'GatewayNetworkError';
+    }
+}
+exports.GatewayNetworkError = GatewayNetworkError;
+/**
+ * Custom error for HTTP-level failures from the gateway (non-2xx, non-network).
+ *
+ * Exposes `status` (numeric HTTP status code) so callers can distinguish
+ * 409 (idempotent conflict) from 5xx (transient) without string-matching
+ * the error message. This makes the agentd-side retry logic robust against
+ * any future change in the message format produced by gateway-client.
+ */
+class GatewayHttpError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+        this.name = 'GatewayHttpError';
+    }
+}
+exports.GatewayHttpError = GatewayHttpError;
+class AgentdGatewayClient {
+    baseUrl;
+    getSessionToken;
+    onTokenRefreshed;
+    /** Shared promise for deduplicating concurrent token refresh attempts */
+    refreshPromise = null;
+    constructor(baseUrl, getSessionToken, onTokenRefreshed) {
+        this.baseUrl = baseUrl;
+        this.getSessionToken = getSessionToken;
+        this.onTokenRefreshed = onTokenRefreshed;
+    }
+    buildHeaders() {
+        return {
+            'Content-Type': 'application/json',
+            'X-Device-Session-Token': this.getSessionToken(),
+        };
+    }
+    /**
+     * Wrap fetch calls to convert network errors into GatewayNetworkError.
+     */
+    async fetchWithNetworkError(url, init) {
+        try {
+            return await fetch(url, init);
+        }
+        catch (err) {
+            throw new GatewayNetworkError(`Network error calling ${url}: ${err instanceof Error ? err.message : String(err)}`, err);
+        }
+    }
+    /**
+     * Wrap fetch calls with automatic retry on 401 (token expired).
+     * On 401, attempts to refresh the token and retry the original request.
+     * Does NOT apply to refreshToken itself (to avoid infinite loops).
+     */
+    async fetchWithAuthRetry(url, options) {
+        const response = await this.fetchWithNetworkError(url, options);
+        if (response.status === 401 && this.onTokenRefreshed) {
+            try {
+                // Deduplicate concurrent refreshes — only one refresh in flight at a time
+                if (!this.refreshPromise) {
+                    this.refreshPromise = this.refreshToken().finally(() => {
+                        this.refreshPromise = null;
+                    });
+                }
+                const result = await this.refreshPromise;
+                try {
+                    this.onTokenRefreshed(result.deviceSessionToken);
+                }
+                catch {
+                    // onTokenRefreshed failed (e.g. Keychain write error) — continue with retry anyway
+                }
+                // Retry with new token
+                const retryOptions = {
+                    ...options,
+                    headers: {
+                        ...options.headers,
+                        'X-Device-Session-Token': result.deviceSessionToken,
+                    },
+                };
+                return this.fetchWithNetworkError(url, retryOptions);
+            }
+            catch {
+                // Refresh failed — token may be expired beyond recovery
+                process.stderr.write('[vess] Session token refresh failed. Run "vess login" to re-authenticate.\n');
+                return response;
+            }
+        }
+        return response;
+    }
+    /**
+     * Refresh the device session token.
+     * POST /api/v1/device/refresh
+     * NOTE: Uses fetchWithNetworkError (not fetchWithAuthRetry) to avoid infinite loops.
+     */
+    async refreshToken() {
+        const url = `${this.baseUrl}/api/v1/device/refresh`;
+        const response = await this.fetchWithNetworkError(url, {
+            method: 'POST',
+            headers: this.buildHeaders(),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            throw new Error(`refreshToken failed: ${response.status}`);
+        }
+        const result = await response.json();
+        return result.data;
+    }
+    // ===========================================================================
+    // v1/agentd/ endpoints
+    // ===========================================================================
+    /**
+     * Issue nonce for VP replay prevention.
+     * POST /api/v1/agentd/nonce
+     */
+    async issueNonce(agentDid) {
+        const url = `${this.baseUrl}/api/v1/agentd/nonce`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: this.buildHeaders(),
+            body: JSON.stringify({ agentDid }),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            throw new Error(`issueNonce failed: ${response.status}`);
+        }
+        const result = await response.json();
+        return result.data;
+    }
+    /**
+     * Auto-issue VC when grant has autoApprove enabled.
+     * POST /api/v1/agentd/vc/auto-issue
+     */
+    async autoIssueVC(params) {
+        const url = `${this.baseUrl}/api/v1/agentd/vc/auto-issue`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: this.buildHeaders(),
+            body: JSON.stringify(params),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            const body = await response.text().catch(() => '');
+            // Surface the 403 body so the ExecutionEngine can detect a Cedar forbid
+            // (`policy_forbidden`) and render a terminal denial instead of minting an
+            // un-redeemable approval URL. GatewayHttpError carries status + body so
+            // callers branch without re-parsing the bare message.
+            throw new GatewayHttpError(`autoIssueVC failed: ${response.status}`, response.status, body);
+        }
+        const result = await response.json();
+        const data = result.data;
+        // API returns null when no auto-issue is available
+        if (!data || !data.autoIssued) {
+            return null;
+        }
+        // Guard: autoIssued=true but credential missing (edge case)
+        if (!data.credential) {
+            return null;
+        }
+        // API returns flat format: { credential: "jwt-string", expiresAt: "ISO-string", ... }
+        // Normalize to AutoIssueVCResult: { credential: { jwt, expiresAt (epoch ms) }, ... }
+        const expiresAt = typeof data.expiresAt === 'string'
+            ? Date.parse(data.expiresAt)
+            : (data.credential?.expiresAt ?? data.expiresAt);
+        // Guard: unparseable expiresAt
+        if (typeof expiresAt !== 'number' || Number.isNaN(expiresAt)) {
+            return null;
+        }
+        return {
+            autoIssued: data.autoIssued,
+            credential: {
+                jwt: typeof data.credential === 'string' ? data.credential : data.credential?.jwt,
+                expiresAt,
+            },
+            actions: data.actions ?? [],
+            ...(data.resources?.length ? { resources: data.resources } : {}),
+            ...(data.metadata != null ? { metadata: data.metadata } : {}),
+        };
+    }
+    /**
+     * Find approved requests by subjectDid.
+     * GET /api/v1/agentd/vc/approved?subjectDid=...
+     */
+    async findApprovedRequests(subjectDid) {
+        const url = `${this.baseUrl}/api/v1/agentd/vc/approved?subjectDid=${encodeURIComponent(subjectDid)}`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'GET',
+            headers: this.buildHeaders(),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            throw new Error(`findApprovedRequests failed: ${response.status}`);
+        }
+        const result = await response.json();
+        // Phase 4: API no longer returns credential — just return id, actions, resources, approvalExpiresAt
+        return result.data.map((item) => ({
+            id: item.id,
+            actions: item.actions,
+            ...(item.resources ? { resources: item.resources } : {}),
+            ...(item.approvalExpiresAt ? { approvalExpiresAt: item.approvalExpiresAt } : {}),
+        }));
+    }
+    /**
+     * Claim a VC from an approved request (atomic, one-time).
+     * POST /api/v1/agentd/vc/claim
+     */
+    async claimVC(requestId, subjectDid) {
+        const url = `${this.baseUrl}/api/v1/agentd/vc/claim`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: this.buildHeaders(),
+            body: JSON.stringify({ requestId, subjectDid }),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (response.status === 409)
+            throw new Error('CLAIM_CONSUMED');
+        if (response.status === 410)
+            throw new Error('CLAIM_EXPIRED');
+        if (!response.ok)
+            throw new Error(`claimVC failed: ${response.status}`);
+        const result = await response.json();
+        const expiresAtMs = Date.parse(result.data.expiresAt);
+        if (Number.isNaN(expiresAtMs)) {
+            throw new Error('claimVC: invalid expiresAt in response');
+        }
+        return {
+            credential: {
+                jwt: result.data.credential,
+                expiresAt: expiresAtMs,
+            },
+            vcId: result.data.vcId,
+            actions: result.data.actions || [],
+            resources: result.data.resources,
+            actionParams: result.data.actionParams,
+        };
+    }
+    /**
+     * Check VC revocation status by jti.
+     * GET /api/v1/agentd/vc/status/:jti
+     */
+    async checkVCStatus(jti) {
+        const url = `${this.baseUrl}/api/v1/agentd/vc/status/${encodeURIComponent(jti)}`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'GET',
+            headers: this.buildHeaders(),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            return { valid: false, reason: `VC status check failed: ${response.status}` };
+        }
+        const result = await response.json();
+        return result.data;
+    }
+    /**
+     * VP verify + grant authorization check (gateway_verified_local).
+     * POST /api/v1/agentd/vp/verify-authorize
+     */
+    async verifyAndAuthorize(vpJwt, challenge, domain, action, holderDid) {
+        const url = `${this.baseUrl}/api/v1/agentd/vp/verify-authorize`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: this.buildHeaders(),
+            body: JSON.stringify({ vpJwt, challenge, domain, action, holderDid }),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            return { authorized: false, reason: `VP verify-authorize failed: ${response.status}` };
+        }
+        const result = await response.json();
+        return result.data;
+    }
+    // ===========================================================================
+    // api/v1/ endpoints (spec Appendix B)
+    // ===========================================================================
+    /**
+     * Register an agent in the API Agent table so it appears in agents.html / timeline.html.
+     * POST /api/v1/agents/create
+     *
+     * Requires X-Project-Id header for ProjectRoleGuard.
+     * Treats 409 Conflict as success (idempotent — agent already exists).
+     */
+    async registerAgent(params) {
+        const url = `${this.baseUrl}/api/v1/agents/create`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: {
+                ...this.buildHeaders(),
+                'X-Project-Id': params.projectId,
+            },
+            body: JSON.stringify({
+                agentDid: params.agentDid,
+                name: params.name,
+                type: params.type,
+                publicKey: params.publicKey,
+                deviceInfo: params.deviceInfo,
+            }),
+            signal: AbortSignal.timeout(10000),
+        });
+        // 409 Conflict = agent already registered — treat as success
+        if (response.status === 409) {
+            return {
+                id: '',
+                did: params.agentDid,
+                name: params.name,
+                type: params.type,
+                status: 'active',
+            };
+        }
+        if (!response.ok) {
+            const body = await response.text().catch(() => '');
+            throw new GatewayHttpError(`registerAgent failed: ${response.status} ${response.statusText} - ${body}`, response.status, body);
+        }
+        const result = await response.json();
+        return result.agent;
+    }
+    /**
+     * Inline Grant + VC issuance (spec §6.2).
+     * POST /api/v1/grant/quick-approve
+     */
+    async quickApprove(params) {
+        const url = `${this.baseUrl}/api/v1/grant/quick-approve`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: this.buildHeaders(),
+            body: JSON.stringify(params),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            const body = await response.text().catch(() => '');
+            throw new Error(`quickApprove failed: ${response.status} ${response.statusText} - ${body}`);
+        }
+        const result = await response.json();
+        if (!result.success) {
+            throw new Error(`quickApprove failed: ${JSON.stringify(result)}`);
+        }
+        // Enrich resources with provider derived from the first action
+        const data = result.data;
+        const provider = params.actions[0]?.split('.')[0] || '';
+        data.resources = data.grant?.resources?.map((r) => ({ ...r, provider }));
+        return data;
+    }
+    /**
+     * Create an OOB approval request for high-risk actions.
+     * POST /api/v1/agentd/approval/request
+     */
+    async createApprovalRequest(params) {
+        const url = `${this.baseUrl}/api/v1/agentd/approval/request`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: this.buildHeaders(),
+            body: JSON.stringify(params),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new Error(`createApprovalRequest failed: ${response.status} ${text}`);
+        }
+        const result = await response.json();
+        return result.data;
+    }
+    /**
+     * Poll the status of an OOB approval request.
+     * GET /api/v1/agentd/approval/:requestId/status
+     */
+    async getApprovalStatus(requestId) {
+        const url = `${this.baseUrl}/api/v1/agentd/approval/${encodeURIComponent(requestId)}/status`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'GET',
+            headers: this.buildHeaders(),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new Error(`getApprovalStatus failed: ${response.status} ${text}`);
+        }
+        const result = await response.json();
+        return result.data;
+    }
+    /**
+     * One-time grant atomic consumption (spec §6.2).
+     * POST /api/v1/grant/consume
+     */
+    async consumeGrant(grantId) {
+        const url = `${this.baseUrl}/api/v1/grant/consume`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: this.buildHeaders(),
+            body: JSON.stringify({ grantId }),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            return { consumed: false, reason: `consumeGrant failed: ${response.status}` };
+        }
+        const result = await response.json();
+        return result.data;
+    }
+    /**
+     * SaaS tool execution via Gateway (VP in Authorization header).
+     * POST /api/v1/tool/invoke
+     */
+    async invokeTool(params) {
+        const url = `${this.baseUrl}/api/v1/tool/invoke`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: {
+                ...this.buildHeaders(),
+                'Authorization': `Bearer ${params.vpJwt}`,
+                'x-holder-did': params.holderDid,
+                'x-auth-challenge': params.vpChallenge,
+            },
+            body: JSON.stringify({
+                tool: params.action.split('.')[0],
+                action: params.action,
+                params: params.parameters,
+                holderDid: params.holderDid,
+                vpChallenge: params.vpChallenge,
+                vpDomain: params.vpDomain,
+            }),
+            signal: AbortSignal.timeout(30000),
+        });
+        if (!response.ok) {
+            const body = await response.text().catch(() => '');
+            // Parse structured error codes (e.g., RESOURCE_MISMATCH, CREDENTIAL_INVALID, REAUTH_REQUIRED)
+            try {
+                const parsed = JSON.parse(body);
+                // Phase 2c-B — if a future api change envelopes reauth in a non-2xx,
+                // honor it before the generic CREDENTIAL_INVALID heuristic below.
+                const reauth = (0, credential_errors_1.extractReauthRequired)(parsed);
+                if (reauth) {
+                    return {
+                        success: false,
+                        // Keep this priority aligned with the 200 path below
+                        // (`raw.error || reauth.message`). The api envelope carries the
+                        // human message on `error`, not `message`, so dropping the
+                        // `parsed.message` tier removes a never-taken fallback.
+                        error: parsed.error || reauth.message,
+                        errorCode: ai_identity_1.GATEWAY_ERROR_CODE.REAUTH_REQUIRED,
+                        reauthRequired: reauth,
+                    };
+                }
+                if (parsed.code === 'policy_forbidden' || parsed.error === 'policy_forbidden') {
+                    // Cedar forbid — terminal, approval cannot lift it. Classify so the
+                    // ExecutionEngine denies without re-approval/retry (mirrors api 403).
+                    return {
+                        success: false,
+                        error: parsed.message || 'Action forbidden by policy',
+                        errorCode: ai_identity_1.GATEWAY_ERROR_CODE.POLICY_FORBIDDEN,
+                    };
+                }
+                if (parsed.code === 'RESOURCE_MISMATCH') {
+                    return {
+                        success: false,
+                        error: parsed.message || `invokeTool failed: ${response.status}`,
+                        errorCode: ai_identity_1.GATEWAY_ERROR_CODE.RESOURCE_MISMATCH,
+                        allowedResources: parsed.allowedResources,
+                        requestedResource: parsed.requestedResource,
+                    };
+                }
+                // #1286 — the gateway sent a code we do not recognise. Stop here rather
+                // than falling through to the message heuristic below: that classifies
+                // by matching the body against /credential.*expired/i and friends, so a
+                // policy denial whose wording happens to mention a credential would come
+                // back as CREDENTIAL_INVALID and ExecutionEngine would discard the VC,
+                // reissue and retry (execution-engine.ts:1114). A denial the gateway
+                // chose to send must not become a retry loop.
+                //
+                // Returning without an errorCode is what makes it terminal: undefined
+                // matches none of the engine's branches. Same property that already
+                // makes RESOURCE_UNRESOLVED behave correctly.
+                //
+                // 401 is deliberately excluded — invokeTool is always VP-authenticated,
+                // so a 401 genuinely is about the credential and keeps its old handling.
+                if (typeof parsed.code === 'string' && parsed.code !== '' && response.status !== 401) {
+                    return {
+                        success: false,
+                        error: parsed.message || `invokeTool failed: ${response.status}`,
+                    };
+                }
+            }
+            catch { /* not JSON or no code field, fall through */ }
+            // Detect credential-invalid errors (expired VC, invalid VP, etc.)
+            // NOTE: Any 401 from invokeTool is treated as credential-invalid since this endpoint
+            // is always VP-authenticated — non-VC auth failures cannot occur here.
+            const errorMessage = body;
+            const isCredentialInvalid = response.status === 401 ||
+                (0, credential_errors_1.isCredentialInvalidError)(errorMessage);
+            if (isCredentialInvalid) {
+                return {
+                    success: false,
+                    error: errorMessage || `invokeTool failed: ${response.status}`,
+                    errorCode: ai_identity_1.GATEWAY_ERROR_CODE.CREDENTIAL_INVALID,
+                };
+            }
+            return { success: false, error: `invokeTool failed: ${response.status} - ${body}` };
+        }
+        // Phase 2c-B — 200 happy path: the api returns reauth failures with
+        // HTTP 200 and `{ success:false, metadata:{ action:'reauth_required', ... } }`.
+        // Detect that shape here so the caller sees a typed `REAUTH_REQUIRED`
+        // errorCode instead of a raw `success:false`.
+        const raw = await response.json();
+        const reauth = (0, credential_errors_1.extractReauthRequired)(raw);
+        if (reauth) {
+            return {
+                success: false,
+                error: raw.error || reauth.message,
+                errorCode: ai_identity_1.GATEWAY_ERROR_CODE.REAUTH_REQUIRED,
+                reauthRequired: reauth,
+            };
+        }
+        // Invoke-time Cedar RequireApproval arrives as HTTP 202 (response.ok), so it
+        // lands here on the happy path — NOT the !response.ok block above. The body
+        // carries top-level `decision: 'auth_required'` (no approvalUrl). Classify
+        // it so the ExecutionEngine mints an OOB approval URL. Checked after reauth
+        // (a revoked token is a distinct, higher-priority signal).
+        const approval = (0, credential_errors_1.extractApprovalRequired)(raw);
+        if (approval) {
+            return {
+                success: false,
+                error: raw.message || raw.error || `Approval required for ${approval.action ?? 'this action'}`,
+                errorCode: ai_identity_1.GATEWAY_ERROR_CODE.APPROVAL_REQUIRED,
+            };
+        }
+        return raw;
+    }
+    /**
+     * Resolve a human-readable resource identifier to its canonical ID.
+     * POST /api/v1/agentd/resource/resolve
+     */
+    async resolveResource(params) {
+        const url = `${this.baseUrl}/api/v1/agentd/resource/resolve`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: this.buildHeaders(),
+            body: JSON.stringify(params),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            throw new Error(`resolveResource failed: ${response.status}`);
+        }
+        const result = await response.json();
+        return result.data;
+    }
+    // ===========================================================================
+    // Existing endpoints
+    // ===========================================================================
+    /**
+     * Fetch org-level policy for a project (spec §7.6).
+     */
+    async fetchOrgPolicy(projectId) {
+        const url = `${this.baseUrl}/api/v1/grant/policy/${encodeURIComponent(projectId)}`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'GET',
+            headers: this.buildHeaders(),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            throw new Error(`fetchOrgPolicy failed: ${response.status}`);
+        }
+        const result = await response.json();
+        return result.data;
+    }
+    /**
+     * Verify a VP with the Gateway (spec §7.4 gateway_verified_local).
+     * @deprecated Use verifyAndAuthorize instead for full VP+grant check.
+     */
+    async verifyVP(vpJwt, nonce, domain) {
+        const url = `${this.baseUrl}/api/v1/vp/verify`;
+        const response = await this.fetchWithAuthRetry(url, {
+            method: 'POST',
+            headers: this.buildHeaders(),
+            body: JSON.stringify({ vpJwt, nonce, domain }),
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!response.ok) {
+            return { valid: false, reason: `VP verification failed: ${response.status}` };
+        }
+        return await response.json();
+    }
+    /**
+     * Check if Gateway is reachable.
+     */
+    async isReachable() {
+        try {
+            const response = await fetch(`${this.baseUrl}/health`, {
+                method: 'GET',
+                signal: AbortSignal.timeout(5000),
+            });
+            return response.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+exports.AgentdGatewayClient = AgentdGatewayClient;
+//# sourceMappingURL=gateway-client.js.map

package/dist/gateway/gateway-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-client.js","sourceRoot":"","sources":["../../src/gateway/gateway-client.ts"],"names":[],"mappings":";;;AAAA,kEAAqH;AACrH,sDAA4F;AAsN5F;;;GAGG;AACH,MAAa,mBAAoB,SAAQ,KAAK;IACC;IAA7C,YAAY,OAAe,EAAkB,KAAe;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAA;QAD6B,UAAK,GAAL,KAAK,CAAU;QAE1D,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AALD,kDAKC;AAED;;;;;;;GAOG;AACH,MAAa,gBAAiB,SAAQ,KAAK;IAGvB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF;AATD,4CASC;AAED,MAAa,mBAAmB;IAKX;IACA;IACA;IANnB,yEAAyE;IACjE,cAAc,GAAsE,IAAI,CAAA;IAEhG,YACmB,OAAe,EACf,eAA6B,EAC7B,gBAA6C;QAF7C,YAAO,GAAP,OAAO,CAAQ;QACf,oBAAe,GAAf,eAAe,CAAc;QAC7B,qBAAgB,GAAhB,gBAAgB,CAA6B;IAC7D,CAAC;IAEI,YAAY;QAClB,OAAO;YACL,cAAc,EAAE,kBAAkB;YAClC,wBAAwB,EAAE,IAAI,CAAC,eAAe,EAAE;SACjD,CAAA;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB,CAAC,GAAW,EAAE,IAAiB;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACnF,GAAG,CACJ,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,OAAoB;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;wBACrD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;oBAC5B,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAA;gBACxC,IAAI,CAAC;oBACH,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,mFAAmF;gBACrF,CAAC;gBACD,uBAAuB;gBACvB,MAAM,YAAY,GAAG;oBACnB,GAAG,OAAO;oBACV,OAAO,EAAE;wBACP,GAAG,OAAO,CAAC,OAAiC;wBAC5C,wBAAwB,EAAE,MAAM,CAAC,kBAAkB;qBACpD;iBACF,CAAA;gBACD,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6EAA6E,CAC9E,CAAA;gBACD,OAAO,QAAQ,CAAA;YACjB,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,wBAAwB,CAAA;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAmF,CAAA;QACrH,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,sBAAsB,CAAA;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;YAClC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAmD,CAAA;QACrF,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,MAAyB;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,8BAA8B,CAAA;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,sDAAsD;YACtD,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAqC,CAAA;QACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QAExB,mDAAmD;QACnD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAA;QACb,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,sFAAsF;QACtF,qFAAqF;QACrF,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;YAClD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAC5B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;QAElD,+BAA+B;QAC/B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE;gBACV,GAAG,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG;gBACjF,SAAS;aACV;YACD,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,UAAkB;QAC3C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,yCAAyC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAA;QACpG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAuC,CAAA;QAEzE,oGAAoG;QACpG,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAS,EAAmB,EAAE,CAAC,CAAC;YACtD,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAyC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,UAAkB;QAOjD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,yBAAyB,CAAA;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;QAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAqC,CAAA;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3D,CAAC;QACD,OAAO;YACL,UAAU,EAAE;gBACV,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,WAAW;aACvB;YACD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE;YAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;YAChC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;SACvC,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,4BAA4B,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAA;QAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;QAC/E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAqE,CAAA;QACvG,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,SAAiB,EACjB,MAAc,EACd,MAAc,EACd,SAAiB;QAEjB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,oCAAoC,CAAA;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;QACxF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAuD,CAAA;QACzF,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED,8EAA8E;IAC9E,sCAAsC;IACtC,8EAA8E;IAE9E;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,MAA2B;QAC7C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,uBAAuB,CAAA;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,IAAI,CAAC,YAAY,EAAE;gBACtB,cAAc,EAAE,MAAM,CAAC,SAAS;aACjC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,6DAA6D;QAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,EAAE;gBACN,GAAG,EAAE,MAAM,CAAC,QAAQ;gBACpB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,QAAQ;aACjB,CAAA;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,gBAAgB,CACxB,yBAAyB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,IAAI,EAAE,EAC3E,QAAQ,CAAC,MAAM,EACf,IAAI,CACL,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsD,CAAA;QACxF,OAAO,MAAM,CAAC,KAAK,CAAA;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAA0B;QAC3C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,6BAA6B,CAAA;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,IAAI,EAAE,CAAC,CAAA;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAoD,CAAA;QACtF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,+DAA+D;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACvD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;QAE7E,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAAmC;QAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,iCAAiC,CAAA;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAA;QAC7E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6D,CAAA;QAC/F,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,2BAA2B,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAA;QAC5F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsD,CAAA;QACxF,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,uBAAuB,CAAA;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;YACjC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;QAC/E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAoD,CAAA;QACtF,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,qBAAqB,CAAA;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,IAAI,CAAC,YAAY,EAAE;gBACtB,eAAe,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE;gBACzC,cAAc,EAAE,MAAM,CAAC,SAAS;gBAChC,kBAAkB,EAAE,MAAM,CAAC,WAAW;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,UAAU;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,8FAA8F;YAC9F,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC/B,qEAAqE;gBACrE,kEAAkE;gBAClE,MAAM,MAAM,GAAG,IAAA,yCAAqB,EAAC,MAAM,CAAC,CAAA;gBAC5C,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,qDAAqD;wBACrD,gEAAgE;wBAChE,2DAA2D;wBAC3D,wDAAwD;wBACxD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO;wBACrC,SAAS,EAAE,gCAAkB,CAAC,eAAe;wBAC7C,cAAc,EAAE,MAAM;qBACvB,CAAA;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;oBAC9E,oEAAoE;oBACpE,sEAAsE;oBACtE,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,4BAA4B;wBACrD,SAAS,EAAE,gCAAkB,CAAC,gBAAgB;qBAC/C,CAAA;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBACxC,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,sBAAsB,QAAQ,CAAC,MAAM,EAAE;wBAChE,SAAS,EAAE,gCAAkB,CAAC,iBAAiB;wBAC/C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;wBACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;qBAC5C,CAAA;gBACH,CAAC;gBACD,wEAAwE;gBACxE,uEAAuE;gBACvE,wEAAwE;gBACxE,yEAAyE;gBACzE,uEAAuE;gBACvE,qEAAqE;gBACrE,8CAA8C;gBAC9C,EAAE;gBACF,sEAAsE;gBACtE,oEAAoE;gBACpE,8CAA8C;gBAC9C,EAAE;gBACF,wEAAwE;gBACxE,yEAAyE;gBACzE,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACrF,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,sBAAsB,QAAQ,CAAC,MAAM,EAAE;qBACjE,CAAA;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,6CAA6C,CAAC,CAAC;YAEzD,kEAAkE;YAClE,qFAAqF;YACrF,uEAAuE;YACvE,MAAM,YAAY,GAAG,IAAI,CAAA;YACzB,MAAM,mBAAmB,GACvB,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,IAAA,4CAAwB,EAAC,YAAY,CAAC,CAAA;YAExC,IAAI,mBAAmB,EAAE,CAAC;gBACxB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,YAAY,IAAI,sBAAsB,QAAQ,CAAC,MAAM,EAAE;oBAC9D,SAAS,EAAE,gCAAkB,CAAC,kBAAkB;iBACjD,CAAA;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,EAAE,CAAA;QACrF,CAAC;QAED,oEAAoE;QACpE,gFAAgF;QAChF,sEAAsE;QACtE,8CAA8C;QAC9C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAS,CAAA;QACxC,MAAM,MAAM,GAAG,IAAA,yCAAqB,EAAC,GAAG,CAAC,CAAA;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO;gBAClC,SAAS,EAAE,gCAAkB,CAAC,eAAe;gBAC7C,cAAc,EAAE,MAAM;aACvB,CAAA;QACH,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,IAAA,2CAAuB,EAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,IAAI,yBAAyB,QAAQ,CAAC,MAAM,IAAI,aAAa,EAAE;gBAC9F,SAAS,EAAE,gCAAkB,CAAC,iBAAiB;aAChD,CAAA;QACH,CAAC;QACD,OAAO,GAAuB,CAAA;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,MAKrB;QACC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,iCAAiC,CAAA;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAuD,CAAA;QACzF,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED,8EAA8E;IAC9E,qBAAqB;IACrB,8EAA8E;IAE9E;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,wBAAwB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAA;QAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAqC,CAAA;QACvE,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;QACzD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,mBAAmB,CAAA;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;QAC/E,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAyC,CAAA;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,SAAS,EAAE;gBACrD,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAA;YACF,OAAO,QAAQ,CAAC,EAAE,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;CACF;AAroBD,kDAqoBC"}

package/dist/identity/agent-identity.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Agent Identity resolver — manages Agent DIDs per project × client (spec §4.2).
+ *
+ * Each (projectId, clientName) pair gets its own Agent DID.
+ * Private keys stored in OS Keychain, metadata in SQLite `keys` table.
+ * Agent DID signs VPs (KB-JWT iss = Agent DID).
+ * Root DID is used ONLY for device enrollment.
+ */
+import Database from 'better-sqlite3';
+import { KeyManager } from './key-manager';
+export interface AgentIdentity {
+    agentDid: string;
+    privateKeyJwk: string;
+    projectId: string;
+    clientName: string;
+}
+export declare class AgentIdentityResolver {
+    private readonly keyManager;
+    private readonly db;
+    private readonly rootDid;
+    constructor(keyManager: KeyManager, db: Database.Database, rootDid: string);
+    /**
+     * Get or create an Agent DID for the given project × client combination.
+     * If one already exists in SQLite (status=active), reuse it.
+     * Otherwise, generate a new Agent DID and store in Keychain + SQLite.
+     */
+    resolveAgentIdentity(projectId: string, clientName: string): Promise<AgentIdentity>;
+}
+//# sourceMappingURL=agent-identity.d.ts.map