@vorionsys/security 1.0.0

package/dist/security/pairwise-did.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Pairwise DID Service
+ *
+ * Implements privacy-preserving pairwise (relationship-specific) DID generation
+ * for CAR ID security hardening. Pairwise DIDs prevent correlation attacks where
+ * services could collude to build profiles by tracking a single DID across services.
+ *
+ * Key features:
+ * - HKDF-based deterministic DID derivation
+ * - SHA-256 fallback derivation
+ * - Secure salt generation
+ * - Validation and verification
+ * - Registry management for pairwise relationships
+ *
+ * Data classification requirements:
+ * - Public: Pairwise not required
+ * - Business: Pairwise recommended
+ * - Personal: Pairwise required
+ * - Sensitive: Pairwise required
+ * - Regulated: Pairwise required + audit trail
+ *
+ * @packageDocumentation
+ */
+import { VorionError } from '../common/errors.js';
+import { type PairwiseDIDConfig, type PairwiseDerivation, type DataClassification } from './types.js';
+/**
+ * Pairwise DID error
+ */
+export declare class PairwiseDIDError extends VorionError {
+    code: string;
+    statusCode: number;
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Pairwise DID Service for privacy-preserving identity management
+ *
+ * @example
+ * ```typescript
+ * const pairwise = new PairwiseDIDService({
+ *   requiredForDataTypes: ['personal', 'sensitive', 'regulated'],
+ *   derivationAlgorithm: 'hkdf',
+ *   saltLength: 32,
+ * });
+ *
+ * // Derive a pairwise DID
+ * const pairwiseDid = await pairwise.derivePairwiseDID(
+ *   'did:car:a3i:vorion:agent-master',
+ *   'did:web:api.example.com'
+ * );
+ *
+ * // Validate a pairwise DID
+ * const isValid = await pairwise.validatePairwiseDID(
+ *   pairwiseDid,
+ *   'did:car:a3i:vorion:agent-master',
+ *   'did:web:api.example.com',
+ *   salt
+ * );
+ * ```
+ */
+export declare class PairwiseDIDService {
+    private config;
+    private registry;
+    /**
+     * Create a new pairwise DID service
+     *
+     * @param config - Pairwise DID configuration
+     */
+    constructor(config: Partial<PairwiseDIDConfig>);
+    /**
+     * Derive a pairwise DID for a relying party relationship
+     *
+     * The derivation is deterministic given the same inputs:
+     * - Master DID
+     * - Relying party DID
+     * - Salt (generated per relationship)
+     *
+     * @param masterDID - Agent's root/master DID
+     * @param relyingPartyDID - Service's DID
+     * @param salt - Optional salt (generated if not provided)
+     * @returns Pairwise DID string
+     */
+    derivePairwiseDID(masterDID: string, relyingPartyDID: string, salt?: string): Promise<string>;
+    /**
+     * Check if pairwise DID is required for a data type
+     *
+     * @param dataType - Data classification
+     * @returns Whether pairwise DID is required
+     */
+    isRequired(dataType: DataClassification): boolean;
+    /**
+     * Validate a pairwise DID
+     *
+     * Re-derives the DID using the provided parameters and compares
+     * with the given pairwise DID.
+     *
+     * @param pairwiseDID - Pairwise DID to validate
+     * @param masterDID - Agent's root/master DID
+     * @param relyingPartyDID - Service's DID
+     * @param salt - Salt used in derivation
+     * @returns Whether the pairwise DID is valid
+     */
+    validatePairwiseDID(pairwiseDID: string, masterDID: string, relyingPartyDID: string, salt: string): Promise<boolean>;
+    /**
+     * Generate a cryptographically secure salt
+     *
+     * @returns Base64-encoded salt
+     */
+    generateSalt(): string;
+    /**
+     * Get a stored derivation for a relationship
+     *
+     * @param masterDID - Agent's root/master DID
+     * @param relyingPartyDID - Service's DID
+     * @returns Derivation record if exists
+     */
+    getDerivation(masterDID: string, relyingPartyDID: string): PairwiseDerivation | undefined;
+    /**
+     * Store a derivation (e.g., loaded from database)
+     *
+     * @param derivation - Derivation record to store
+     */
+    storeDerivation(derivation: PairwiseDerivation): void;
+    /**
+     * List all derivations for a master DID
+     *
+     * @param masterDID - Agent's root/master DID
+     * @returns List of derivations
+     */
+    listDerivations(masterDID: string): PairwiseDerivation[];
+    /**
+     * Revoke a pairwise relationship
+     *
+     * @param masterDID - Agent's root/master DID
+     * @param relyingPartyDID - Service's DID
+     * @returns Whether revocation was successful
+     */
+    revokeRelationship(masterDID: string, relyingPartyDID: string): boolean;
+    /**
+     * Get current configuration
+     */
+    getConfig(): Readonly<PairwiseDIDConfig>;
+    /**
+     * Check if a data type should use pairwise DID based on classification
+     *
+     * @param dataType - Data classification string
+     * @returns Whether pairwise is required and the classification
+     */
+    getRequirement(dataType: string): {
+        required: boolean;
+        classification: DataClassification | null;
+    };
+}
+/**
+ * Create a pairwise DID service with default configuration for CAR ID
+ */
+export declare function createPairwiseDIDService(config?: Partial<PairwiseDIDConfig>): PairwiseDIDService;
+//# sourceMappingURL=pairwise-did.d.ts.map

package/dist/security/pairwise-did.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairwise-did.d.ts","sourceRoot":"","sources":["../../src/security/pairwise-did.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EAMxB,MAAM,YAAY,CAAC;AAiCpB;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,WAAW;IACtC,IAAI,SAAwB;IAC5B,UAAU,SAAO;gBAEd,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAwJD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAkC;IAElD;;;;OAIG;gBACS,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAwB9C;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IA8DlB;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO;IAIjD;;;;;;;;;;;OAWG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IAmCnB;;;;OAIG;IACH,YAAY,IAAI,MAAM;IAStB;;;;;;OAMG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAKzF;;;;OAIG;IACH,eAAe,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAMrD;;;;;OAKG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAWxD;;;;;;OAMG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO;IAYvE;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAIxC;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAAA;KAAE;CA6BnG;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAClC,kBAAkB,CAapB"}

package/dist/security/pairwise-did.js

@@ -0,0 +1,450 @@
+/**
+ * Pairwise DID Service
+ *
+ * Implements privacy-preserving pairwise (relationship-specific) DID generation
+ * for CAR ID security hardening. Pairwise DIDs prevent correlation attacks where
+ * services could collude to build profiles by tracking a single DID across services.
+ *
+ * Key features:
+ * - HKDF-based deterministic DID derivation
+ * - SHA-256 fallback derivation
+ * - Secure salt generation
+ * - Validation and verification
+ * - Registry management for pairwise relationships
+ *
+ * Data classification requirements:
+ * - Public: Pairwise not required
+ * - Business: Pairwise recommended
+ * - Personal: Pairwise required
+ * - Sensitive: Pairwise required
+ * - Regulated: Pairwise required + audit trail
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../common/logger.js';
+import { VorionError } from '../common/errors.js';
+import { Counter, Histogram } from 'prom-client';
+import { vorionRegistry } from '../common/metrics-registry.js';
+import { DataClassification as DataClassificationEnum, PairwiseDerivationAlgorithm as DerivationAlgorithmEnum, pairwiseDIDConfigSchema, pairwiseDerivationSchema, } from './types.js';
+const logger = createLogger({ component: 'security-pairwise-did' });
+// =============================================================================
+// Metrics
+// =============================================================================
+const pairwiseDidsGenerated = new Counter({
+    name: 'vorion_security_pairwise_dids_generated_total',
+    help: 'Total pairwise DIDs generated',
+    labelNames: ['algorithm'],
+    registers: [vorionRegistry],
+});
+const pairwiseDerivationDuration = new Histogram({
+    name: 'vorion_security_pairwise_derivation_duration_seconds',
+    help: 'Duration of pairwise DID derivation',
+    buckets: [0.001, 0.005, 0.01, 0.025, 0.05],
+    registers: [vorionRegistry],
+});
+const pairwiseValidations = new Counter({
+    name: 'vorion_security_pairwise_validations_total',
+    help: 'Total pairwise DID validations',
+    labelNames: ['result'],
+    registers: [vorionRegistry],
+});
+// =============================================================================
+// Errors
+// =============================================================================
+/**
+ * Pairwise DID error
+ */
+export class PairwiseDIDError extends VorionError {
+    code = 'PAIRWISE_DID_ERROR';
+    statusCode = 400;
+    constructor(message, details) {
+        super(message, details);
+        this.name = 'PairwiseDIDError';
+    }
+}
+// =============================================================================
+// Helper Functions
+// =============================================================================
+/**
+ * HKDF-Expand function
+ * Implements RFC 5869 HKDF-Expand
+ */
+async function hkdfExpand(hashAlg, prk, info, length) {
+    const hashLength = hashAlg === 'SHA-256' ? 32 : hashAlg === 'SHA-384' ? 48 : 64;
+    const n = Math.ceil(length / hashLength);
+    if (n > 255) {
+        throw new PairwiseDIDError('HKDF output length too large');
+    }
+    const key = await crypto.subtle.importKey('raw', prk, { name: 'HMAC', hash: hashAlg }, false, ['sign']);
+    let t = new Uint8Array(0);
+    const okm = new Uint8Array(n * hashLength);
+    for (let i = 1; i <= n; i++) {
+        const input = new Uint8Array(t.length + info.length + 1);
+        input.set(t);
+        input.set(info, t.length);
+        input[t.length + info.length] = i;
+        const signed = await crypto.subtle.sign('HMAC', key, input);
+        t = new Uint8Array(signed);
+        okm.set(t, (i - 1) * hashLength);
+    }
+    return okm.buffer.slice(0, length);
+}
+/**
+ * HKDF-Extract function
+ * Implements RFC 5869 HKDF-Extract
+ */
+async function hkdfExtract(hashAlg, salt, ikm) {
+    const saltBuffer = salt.length > 0 ? salt : new Uint8Array(hashAlg === 'SHA-256' ? 32 : hashAlg === 'SHA-384' ? 48 : 64);
+    const key = await crypto.subtle.importKey('raw', saltBuffer, { name: 'HMAC', hash: hashAlg }, false, ['sign']);
+    return crypto.subtle.sign('HMAC', key, ikm);
+}
+/**
+ * Full HKDF function
+ */
+async function hkdf(hashAlg, ikm, salt, info, length) {
+    const prk = await hkdfExtract(hashAlg, salt, ikm);
+    return hkdfExpand(hashAlg, prk, info, length);
+}
+/**
+ * Convert ArrayBuffer to hex string
+ */
+function bufferToHex(buffer) {
+    const bytes = new Uint8Array(buffer);
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Generate cryptographically secure random bytes
+ */
+function randomBytes(length) {
+    const bytes = new Uint8Array(length);
+    crypto.getRandomValues(bytes);
+    return bytes;
+}
+/**
+ * Encode bytes as base58 (Bitcoin-style)
+ */
+function base58Encode(bytes) {
+    const ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+    // Convert bytes to a big integer
+    let num = BigInt(0);
+    for (let i = 0; i < bytes.length; i++) {
+        num = num * BigInt(256) + BigInt(bytes[i]);
+    }
+    // Convert to base58
+    let result = '';
+    while (num > 0) {
+        result = ALPHABET[Number(num % BigInt(58))] + result;
+        num = num / BigInt(58);
+    }
+    // Add leading zeros
+    for (let i = 0; i < bytes.length; i++) {
+        if (bytes[i] === 0) {
+            result = '1' + result;
+        }
+        else {
+            break;
+        }
+    }
+    return result || '1';
+}
+/**
+ * Create a did:key from a public key
+ * Uses Ed25519 key type with multicodec prefix 0xed01
+ */
+function createDidKey(publicKeyBytes) {
+    // Multicodec prefix for Ed25519 public key: 0xed01
+    const multicodecPrefix = new Uint8Array([0xed, 0x01]);
+    const prefixedKey = new Uint8Array(multicodecPrefix.length + publicKeyBytes.length);
+    prefixedKey.set(multicodecPrefix);
+    prefixedKey.set(publicKeyBytes, multicodecPrefix.length);
+    // Multibase prefix 'z' for base58btc
+    return `did:key:z${base58Encode(prefixedKey)}`;
+}
+// =============================================================================
+// Pairwise DID Service
+// =============================================================================
+/**
+ * Pairwise DID Service for privacy-preserving identity management
+ *
+ * @example
+ * ```typescript
+ * const pairwise = new PairwiseDIDService({
+ *   requiredForDataTypes: ['personal', 'sensitive', 'regulated'],
+ *   derivationAlgorithm: 'hkdf',
+ *   saltLength: 32,
+ * });
+ *
+ * // Derive a pairwise DID
+ * const pairwiseDid = await pairwise.derivePairwiseDID(
+ *   'did:car:a3i:vorion:agent-master',
+ *   'did:web:api.example.com'
+ * );
+ *
+ * // Validate a pairwise DID
+ * const isValid = await pairwise.validatePairwiseDID(
+ *   pairwiseDid,
+ *   'did:car:a3i:vorion:agent-master',
+ *   'did:web:api.example.com',
+ *   salt
+ * );
+ * ```
+ */
+export class PairwiseDIDService {
+    config;
+    registry; // masterDid:rpDid -> derivation
+    /**
+     * Create a new pairwise DID service
+     *
+     * @param config - Pairwise DID configuration
+     */
+    constructor(config) {
+        const defaultConfig = {
+            requiredForDataTypes: [
+                DataClassificationEnum.PERSONAL,
+                DataClassificationEnum.SENSITIVE,
+                DataClassificationEnum.REGULATED,
+            ],
+            derivationAlgorithm: DerivationAlgorithmEnum.HKDF,
+            saltLength: 32,
+            hkdfInfo: 'aci-pairwise-did-v1',
+        };
+        this.config = { ...defaultConfig, ...pairwiseDIDConfigSchema.parse(config) };
+        this.registry = new Map();
+        logger.info({
+            requiredForDataTypes: this.config.requiredForDataTypes,
+            derivationAlgorithm: this.config.derivationAlgorithm,
+            saltLength: this.config.saltLength,
+        }, 'Pairwise DID service initialized');
+    }
+    /**
+     * Derive a pairwise DID for a relying party relationship
+     *
+     * The derivation is deterministic given the same inputs:
+     * - Master DID
+     * - Relying party DID
+     * - Salt (generated per relationship)
+     *
+     * @param masterDID - Agent's root/master DID
+     * @param relyingPartyDID - Service's DID
+     * @param salt - Optional salt (generated if not provided)
+     * @returns Pairwise DID string
+     */
+    async derivePairwiseDID(masterDID, relyingPartyDID, salt) {
+        const startTime = Date.now();
+        try {
+            // Check if we already have a derivation for this relationship
+            const cacheKey = `${masterDID}:${relyingPartyDID}`;
+            const existing = this.registry.get(cacheKey);
+            if (existing) {
+                logger.debug({ masterDID, relyingPartyDID, derivedDid: existing.derivedDid }, 'Returning cached pairwise DID');
+                return existing.derivedDid;
+            }
+            // Generate salt if not provided
+            const contextSalt = salt ?? this.generateSalt();
+            const saltBytes = new TextEncoder().encode(contextSalt);
+            // Derive the pairwise DID
+            let derivedKey;
+            if (this.config.derivationAlgorithm === DerivationAlgorithmEnum.HKDF) {
+                // HKDF derivation
+                const ikm = new TextEncoder().encode(`${masterDID}:${relyingPartyDID}`);
+                const info = new TextEncoder().encode(this.config.hkdfInfo ?? 'aci-pairwise-did-v1');
+                derivedKey = await hkdf('SHA-256', ikm, saltBytes, info, 32);
+            }
+            else {
+                // SHA-256 derivation
+                const data = `${masterDID}:${relyingPartyDID}:${contextSalt}`;
+                derivedKey = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(data));
+            }
+            // Create did:key from derived bytes
+            const derivedDid = createDidKey(new Uint8Array(derivedKey));
+            // Store the derivation
+            const derivation = {
+                masterDid: masterDID,
+                relyingPartyDid: relyingPartyDID,
+                contextSalt,
+                derivedDid,
+                createdAt: new Date(),
+            };
+            pairwiseDerivationSchema.parse(derivation);
+            this.registry.set(cacheKey, derivation);
+            pairwiseDidsGenerated.inc({ algorithm: this.config.derivationAlgorithm });
+            logger.info({ masterDID, relyingPartyDID, derivedDid }, 'Pairwise DID derived');
+            return derivedDid;
+        }
+        finally {
+            const duration = (Date.now() - startTime) / 1000;
+            pairwiseDerivationDuration.observe(duration);
+        }
+    }
+    /**
+     * Check if pairwise DID is required for a data type
+     *
+     * @param dataType - Data classification
+     * @returns Whether pairwise DID is required
+     */
+    isRequired(dataType) {
+        return this.config.requiredForDataTypes.includes(dataType);
+    }
+    /**
+     * Validate a pairwise DID
+     *
+     * Re-derives the DID using the provided parameters and compares
+     * with the given pairwise DID.
+     *
+     * @param pairwiseDID - Pairwise DID to validate
+     * @param masterDID - Agent's root/master DID
+     * @param relyingPartyDID - Service's DID
+     * @param salt - Salt used in derivation
+     * @returns Whether the pairwise DID is valid
+     */
+    async validatePairwiseDID(pairwiseDID, masterDID, relyingPartyDID, salt) {
+        try {
+            // Re-derive the DID
+            const saltBytes = new TextEncoder().encode(salt);
+            let derivedKey;
+            if (this.config.derivationAlgorithm === DerivationAlgorithmEnum.HKDF) {
+                const ikm = new TextEncoder().encode(`${masterDID}:${relyingPartyDID}`);
+                const info = new TextEncoder().encode(this.config.hkdfInfo ?? 'aci-pairwise-did-v1');
+                derivedKey = await hkdf('SHA-256', ikm, saltBytes, info, 32);
+            }
+            else {
+                const data = `${masterDID}:${relyingPartyDID}:${salt}`;
+                derivedKey = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(data));
+            }
+            const expectedDid = createDidKey(new Uint8Array(derivedKey));
+            const valid = pairwiseDID === expectedDid;
+            pairwiseValidations.inc({ result: valid ? 'success' : 'invalid' });
+            if (!valid) {
+                logger.debug({ pairwiseDID, expectedDid, masterDID, relyingPartyDID }, 'Pairwise DID validation failed');
+            }
+            return valid;
+        }
+        catch (error) {
+            pairwiseValidations.inc({ result: 'error' });
+            logger.error({ error, pairwiseDID }, 'Error validating pairwise DID');
+            return false;
+        }
+    }
+    /**
+     * Generate a cryptographically secure salt
+     *
+     * @returns Base64-encoded salt
+     */
+    generateSalt() {
+        const bytes = randomBytes(this.config.saltLength);
+        let binary = '';
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+    }
+    /**
+     * Get a stored derivation for a relationship
+     *
+     * @param masterDID - Agent's root/master DID
+     * @param relyingPartyDID - Service's DID
+     * @returns Derivation record if exists
+     */
+    getDerivation(masterDID, relyingPartyDID) {
+        const cacheKey = `${masterDID}:${relyingPartyDID}`;
+        return this.registry.get(cacheKey);
+    }
+    /**
+     * Store a derivation (e.g., loaded from database)
+     *
+     * @param derivation - Derivation record to store
+     */
+    storeDerivation(derivation) {
+        pairwiseDerivationSchema.parse(derivation);
+        const cacheKey = `${derivation.masterDid}:${derivation.relyingPartyDid}`;
+        this.registry.set(cacheKey, derivation);
+    }
+    /**
+     * List all derivations for a master DID
+     *
+     * @param masterDID - Agent's root/master DID
+     * @returns List of derivations
+     */
+    listDerivations(masterDID) {
+        const derivations = [];
+        const allDerivations = Array.from(this.registry.values());
+        for (const derivation of allDerivations) {
+            if (derivation.masterDid === masterDID) {
+                derivations.push(derivation);
+            }
+        }
+        return derivations;
+    }
+    /**
+     * Revoke a pairwise relationship
+     *
+     * @param masterDID - Agent's root/master DID
+     * @param relyingPartyDID - Service's DID
+     * @returns Whether revocation was successful
+     */
+    revokeRelationship(masterDID, relyingPartyDID) {
+        const cacheKey = `${masterDID}:${relyingPartyDID}`;
+        const existed = this.registry.has(cacheKey);
+        this.registry.delete(cacheKey);
+        if (existed) {
+            logger.info({ masterDID, relyingPartyDID }, 'Pairwise relationship revoked');
+        }
+        return existed;
+    }
+    /**
+     * Get current configuration
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+    /**
+     * Check if a data type should use pairwise DID based on classification
+     *
+     * @param dataType - Data classification string
+     * @returns Whether pairwise is required and the classification
+     */
+    getRequirement(dataType) {
+        const normalizedType = dataType.toLowerCase();
+        // Map common data type strings to classifications
+        const classificationMap = {
+            public: DataClassificationEnum.PUBLIC,
+            business: DataClassificationEnum.BUSINESS,
+            personal: DataClassificationEnum.PERSONAL,
+            pii: DataClassificationEnum.PERSONAL,
+            sensitive: DataClassificationEnum.SENSITIVE,
+            financial: DataClassificationEnum.SENSITIVE,
+            health: DataClassificationEnum.SENSITIVE,
+            phi: DataClassificationEnum.SENSITIVE,
+            regulated: DataClassificationEnum.REGULATED,
+            gdpr: DataClassificationEnum.REGULATED,
+            hipaa: DataClassificationEnum.REGULATED,
+        };
+        const classification = classificationMap[normalizedType] ?? null;
+        if (classification === null) {
+            return { required: false, classification: null };
+        }
+        return {
+            required: this.config.requiredForDataTypes.includes(classification),
+            classification,
+        };
+    }
+}
+/**
+ * Create a pairwise DID service with default configuration for CAR ID
+ */
+export function createPairwiseDIDService(config) {
+    const defaultConfig = {
+        requiredForDataTypes: [
+            DataClassificationEnum.PERSONAL,
+            DataClassificationEnum.SENSITIVE,
+            DataClassificationEnum.REGULATED,
+        ],
+        derivationAlgorithm: DerivationAlgorithmEnum.HKDF,
+        saltLength: 32,
+        hkdfInfo: 'aci-pairwise-did-v1',
+    };
+    return new PairwiseDIDService({ ...defaultConfig, ...config });
+}
+//# sourceMappingURL=pairwise-did.js.map

package/dist/security/pairwise-did.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairwise-did.js","sourceRoot":"","sources":["../../src/security/pairwise-did.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAKL,kBAAkB,IAAI,sBAAsB,EAC5C,2BAA2B,IAAI,uBAAuB,EACtD,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAEpE,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,qBAAqB,GAAG,IAAI,OAAO,CAAC;IACxC,IAAI,EAAE,+CAA+C;IACrD,IAAI,EAAE,+BAA+B;IACrC,UAAU,EAAE,CAAC,WAAW,CAAU;IAClC,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,IAAI,SAAS,CAAC;IAC/C,IAAI,EAAE,sDAAsD;IAC5D,IAAI,EAAE,qCAAqC;IAC3C,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;IAC1C,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,OAAO,CAAC;IACtC,IAAI,EAAE,4CAA4C;IAClD,IAAI,EAAE,gCAAgC;IACtC,UAAU,EAAE,CAAC,QAAQ,CAAU;IAC/B,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,WAAW;IACtC,IAAI,GAAG,oBAAoB,CAAC;IAC5B,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,OAA0C,EAC1C,GAAgB,EAChB,IAAgB,EAChB,MAAc;IAEd,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;IAEzC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAC/B,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;IAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,OAA0C,EAC1C,IAAgB,EAChB,GAAe;IAEf,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,UAA0B,EAC1B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAC/B,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAmB,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,IAAI,CACjB,OAA0C,EAC1C,GAAe,EACf,IAAgB,EAChB,IAAgB,EAChB,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,KAAiB;IACrC,MAAM,QAAQ,GAAG,4DAA4D,CAAC;IAE9E,iCAAiC;IACjC,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9C,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;QACrD,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;IAED,oBAAoB;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,MAAM,IAAI,GAAG,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,cAA0B;IAC9C,mDAAmD;IACnD,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpF,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAClC,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEzD,qCAAqC;IACrC,OAAO,YAAY,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,kBAAkB;IACrB,MAAM,CAAoB;IAC1B,QAAQ,CAAkC,CAAC,gCAAgC;IAEnF;;;;OAIG;IACH,YAAY,MAAkC;QAC5C,MAAM,aAAa,GAAsB;YACvC,oBAAoB,EAAE;gBACpB,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,SAAS;gBAChC,sBAAsB,CAAC,SAAS;aACjC;YACD,mBAAmB,EAAE,uBAAuB,CAAC,IAAI;YACjD,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,qBAAqB;SAChC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAE1B,MAAM,CAAC,IAAI,CACT;YACE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;YACtD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;YACpD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;SACnC,EACD,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,iBAAiB,CACrB,SAAiB,EACjB,eAAuB,EACvB,IAAa;QAEb,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,eAAe,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EAC/D,+BAA+B,CAChC,CAAC;gBACF,OAAO,QAAQ,CAAC,UAAU,CAAC;YAC7B,CAAC;YAED,gCAAgC;YAChC,MAAM,WAAW,GAAG,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAExD,0BAA0B;YAC1B,IAAI,UAAuB,CAAC;YAE5B,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,KAAK,uBAAuB,CAAC,IAAI,EAAE,CAAC;gBACrE,kBAAkB;gBAClB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,eAAe,EAAE,CAAC,CAAC;gBACxE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC,CAAC;gBACrF,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,qBAAqB;gBACrB,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,eAAe,IAAI,WAAW,EAAE,CAAC;gBAC9D,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,CAAC;YAED,oCAAoC;YACpC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;YAE5D,uBAAuB;YACvB,MAAM,UAAU,GAAuB;gBACrC,SAAS,EAAE,SAAS;gBACpB,eAAe,EAAE,eAAe;gBAChC,WAAW;gBACX,UAAU;gBACV,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;YAEF,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAExC,qBAAqB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC;YAE1E,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,EAC1C,sBAAsB,CACvB,CAAC;YAEF,OAAO,UAAU,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;YACjD,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,QAA4B;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,mBAAmB,CACvB,WAAmB,EACnB,SAAiB,EACjB,eAAuB,EACvB,IAAY;QAEZ,IAAI,CAAC;YACH,oBAAoB;YACpB,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,UAAuB,CAAC;YAE5B,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,KAAK,uBAAuB,CAAC,IAAI,EAAE,CAAC;gBACrE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,eAAe,EAAE,CAAC,CAAC;gBACxE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC,CAAC;gBACrF,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;gBACvD,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,CAAC;YAED,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,WAAW,KAAK,WAAW,CAAC;YAE1C,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAEnE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,CACV,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,EACxD,gCAAgC,CACjC,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,SAAiB,EAAE,eAAuB;QACtD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,eAAe,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,UAA8B;QAC5C,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,GAAG,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,SAAiB;QAC/B,MAAM,WAAW,GAAyB,EAAE,CAAC;QAC7C,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,UAAU,IAAI,cAAc,EAAE,CAAC;YACxC,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACvC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB,CAAC,SAAiB,EAAE,eAAuB;QAC3D,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,eAAe,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE/B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,QAAgB;QAC7B,MAAM,cAAc,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE9C,kDAAkD;QAClD,MAAM,iBAAiB,GAAuC;YAC5D,MAAM,EAAE,sBAAsB,CAAC,MAAM;YACrC,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;YACzC,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;YACzC,GAAG,EAAE,sBAAsB,CAAC,QAAQ;YACpC,SAAS,EAAE,sBAAsB,CAAC,SAAS;YAC3C,SAAS,EAAE,sBAAsB,CAAC,SAAS;YAC3C,MAAM,EAAE,sBAAsB,CAAC,SAAS;YACxC,GAAG,EAAE,sBAAsB,CAAC,SAAS;YACrC,SAAS,EAAE,sBAAsB,CAAC,SAAS;YAC3C,IAAI,EAAE,sBAAsB,CAAC,SAAS;YACtC,KAAK,EAAE,sBAAsB,CAAC,SAAS;SACxC,CAAC;QAEF,MAAM,cAAc,GAAG,iBAAiB,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;QAEjE,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACnD,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC;YACnE,cAAc;SACf,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAmC;IAEnC,MAAM,aAAa,GAA+B;QAChD,oBAAoB,EAAE;YACpB,sBAAsB,CAAC,QAAQ;YAC/B,sBAAsB,CAAC,SAAS;YAChC,sBAAsB,CAAC,SAAS;SACjC;QACD,mBAAmB,EAAE,uBAAuB,CAAC,IAAI;QACjD,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,qBAAqB;KAChC,CAAC;IAEF,OAAO,IAAI,kBAAkB,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC"}