@vorionsys/security 1.0.0

package/dist/security/revocation.js

@@ -0,0 +1,522 @@
+/**
+ * Revocation Management Service
+ *
+ * Implements revocation enforcement with SLA guarantees for CAR ID security hardening.
+ * Handles recursive revocation when an agent in a delegation chain is revoked,
+ * ensuring all downstream capabilities are invalidated.
+ *
+ * Key features:
+ * - Tier-based revocation SLAs
+ * - Recursive delegation chain revocation
+ * - Token invalidation
+ * - Webhook notifications
+ * - Synchronous revocation checks for high-value operations
+ * - Event subscription system
+ *
+ * Revocation SLAs per CAR ID spec:
+ * - T0-T1: 60 seconds max propagation
+ * - T2: 30 seconds max propagation
+ * - T3: 10 seconds max propagation
+ * - T4-T5: 1 second max propagation (sync check always)
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../common/logger.js';
+import { VorionError } from '../common/errors.js';
+import { Counter, Histogram, Gauge } from 'prom-client';
+import { vorionRegistry } from '../common/metrics-registry.js';
+import { DEFAULT_REVOCATION_SLAS, RevocationStatusEnum, revocationSLASchema, revocationPropagationSchema, revocationResultSchema, revocationStatusSchema, revocationEventSchema, } from './types.js';
+const logger = createLogger({ component: 'security-revocation' });
+// =============================================================================
+// Metrics
+// =============================================================================
+const revocationsTotal = new Counter({
+    name: 'vorion_security_revocations_total',
+    help: 'Total revocations processed',
+    labelNames: ['outcome'], // success, partial, failed
+    registers: [vorionRegistry],
+});
+const descendantsRevoked = new Counter({
+    name: 'vorion_security_descendants_revoked_total',
+    help: 'Total descendant DIDs revoked during recursive revocation',
+    registers: [vorionRegistry],
+});
+const tokensInvalidated = new Counter({
+    name: 'vorion_security_tokens_invalidated_total',
+    help: 'Total tokens invalidated during revocation',
+    registers: [vorionRegistry],
+});
+const revocationDuration = new Histogram({
+    name: 'vorion_security_revocation_duration_seconds',
+    help: 'Duration of revocation operations',
+    buckets: [0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5],
+    registers: [vorionRegistry],
+});
+const revocationChecks = new Counter({
+    name: 'vorion_security_revocation_checks_total',
+    help: 'Total revocation status checks',
+    labelNames: ['type', 'result'], // type: sync/cached, result: active/revoked
+    registers: [vorionRegistry],
+});
+const revocationCacheHits = new Counter({
+    name: 'vorion_security_revocation_cache_hits_total',
+    help: 'Total revocation cache hits',
+    registers: [vorionRegistry],
+});
+const activeRevocations = new Gauge({
+    name: 'vorion_security_active_revocations',
+    help: 'Number of active revocations in the system',
+    registers: [vorionRegistry],
+});
+// =============================================================================
+// Errors
+// =============================================================================
+/**
+ * Revocation-specific error
+ */
+export class RevocationError extends VorionError {
+    code = 'REVOCATION_ERROR';
+    statusCode = 500;
+    constructor(message, details) {
+        super(message, details);
+        this.name = 'RevocationError';
+    }
+}
+/**
+ * Agent is revoked error
+ */
+export class AgentRevokedError extends VorionError {
+    code = 'AGENT_REVOKED';
+    statusCode = 403;
+    constructor(did, reason) {
+        super(`Agent ${did} has been revoked${reason ? `: ${reason}` : ''}`, { did, reason });
+        this.name = 'AgentRevokedError';
+    }
+}
+/**
+ * In-memory revocation cache
+ * For production, use Redis-backed implementation
+ */
+class RevocationCache {
+    defaultTTLMs;
+    cache = new Map();
+    cleanupInterval = null;
+    constructor(defaultTTLMs = 60000) {
+        this.defaultTTLMs = defaultTTLMs;
+        // Cleanup expired entries every 30 seconds
+        this.cleanupInterval = setInterval(() => this.cleanup(), 30000);
+    }
+    get(did, maxAgeMs) {
+        const entry = this.cache.get(did);
+        if (!entry) {
+            return null;
+        }
+        const age = Date.now() - entry.cachedAt;
+        if (age > maxAgeMs) {
+            this.cache.delete(did);
+            return null;
+        }
+        revocationCacheHits.inc();
+        return {
+            ...entry.status,
+            fromCache: true,
+            cacheAgeMs: age,
+        };
+    }
+    set(did, status) {
+        this.cache.set(did, {
+            status: { ...status, fromCache: false },
+            cachedAt: Date.now(),
+        });
+    }
+    invalidate(did) {
+        this.cache.delete(did);
+    }
+    cleanup() {
+        const now = Date.now();
+        const entries = Array.from(this.cache.entries());
+        for (const [did, entry] of entries) {
+            if (now - entry.cachedAt > this.defaultTTLMs) {
+                this.cache.delete(did);
+            }
+        }
+    }
+    destroy() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+        }
+        this.cache.clear();
+    }
+}
+// =============================================================================
+// Revocation Service
+// =============================================================================
+/**
+ * Revocation Service for managing agent revocation with SLA enforcement
+ *
+ * @example
+ * ```typescript
+ * const revocation = new RevocationService(
+ *   DEFAULT_REVOCATION_SLAS,
+ *   delegationRegistry,
+ *   tokenService,
+ *   webhookService
+ * );
+ *
+ * // Revoke an agent with recursive propagation
+ * const result = await revocation.revokeAgent({
+ *   revokedDid: 'did:car:a3i:vorion:agent-123',
+ *   reason: 'Security incident',
+ *   propagationPolicy: {
+ *     terminateDescendants: true,
+ *     gracePeriodMs: 0,
+ *     notifyWebhooks: true,
+ *   },
+ * });
+ *
+ * // Check revocation status
+ * const status = await revocation.checkRevocationStatus('did:car:a3i:vorion:agent-123');
+ * ```
+ */
+export class RevocationService {
+    delegationRegistry;
+    tokenService;
+    webhookService;
+    slaConfig;
+    cache;
+    revocations; // did -> revocation
+    eventCallbacks;
+    /**
+     * Create a new revocation service
+     *
+     * @param slaConfig - Revocation SLAs per tier
+     * @param delegationRegistry - Optional delegation registry for recursive revocation
+     * @param tokenService - Optional token service for invalidation
+     * @param webhookService - Optional webhook service for notifications
+     */
+    constructor(slaConfig = DEFAULT_REVOCATION_SLAS, delegationRegistry, tokenService, webhookService) {
+        this.delegationRegistry = delegationRegistry;
+        this.tokenService = tokenService;
+        this.webhookService = webhookService;
+        // Validate and store SLA config
+        this.slaConfig = new Map();
+        for (const sla of slaConfig) {
+            revocationSLASchema.parse(sla);
+            this.slaConfig.set(sla.tier, sla);
+        }
+        this.cache = new RevocationCache();
+        this.revocations = new Map();
+        this.eventCallbacks = new Set();
+        logger.info({ slaCount: this.slaConfig.size }, 'Revocation service initialized');
+    }
+    /**
+     * Revoke an agent with recursive propagation
+     *
+     * @param revocation - Revocation request
+     * @returns Revocation result
+     */
+    async revokeAgent(revocation) {
+        const startTime = Date.now();
+        revocationPropagationSchema.parse(revocation);
+        const revocationId = crypto.randomUUID();
+        logger.info({ revocationId, did: revocation.revokedDid, reason: revocation.reason }, 'Starting agent revocation');
+        try {
+            // Propagate to descendants if configured
+            let descendantsRevoked = [];
+            if (revocation.propagationPolicy.terminateDescendants) {
+                descendantsRevoked = await this.propagateToDescendants(revocation.revokedDid, revocation.reason, revocation.propagationPolicy.gracePeriodMs);
+            }
+            // Invalidate tokens
+            let invalidatedCount = 0;
+            if (this.tokenService) {
+                invalidatedCount = await this.invalidateTokens(revocation.revokedDid);
+                // Also invalidate tokens for descendants
+                for (const descendantDid of descendantsRevoked) {
+                    invalidatedCount += await this.invalidateTokens(descendantDid);
+                }
+            }
+            // Create result
+            const result = {
+                revocationId,
+                revokedDid: revocation.revokedDid,
+                descendantsRevoked,
+                tokensInvalidated: invalidatedCount,
+                propagationComplete: true,
+                timestamp: new Date(),
+            };
+            revocationResultSchema.parse(result);
+            // Store revocation
+            this.revocations.set(revocation.revokedDid, result);
+            this.cache.invalidate(revocation.revokedDid);
+            activeRevocations.set(this.revocations.size);
+            // Emit events
+            await this.emitEvent({
+                type: 'agent.revoked',
+                revocationId,
+                did: revocation.revokedDid,
+                reason: revocation.reason,
+                timestamp: new Date(),
+                metadata: { descendantsRevoked: descendantsRevoked.length },
+            });
+            // Notify webhooks
+            if (revocation.propagationPolicy.notifyWebhooks && this.webhookService) {
+                try {
+                    await this.webhookService.notify('revocation', {
+                        revocationId,
+                        agentDid: revocation.revokedDid,
+                        reason: revocation.reason,
+                        descendantsRevoked,
+                        tokensInvalidated: invalidatedCount,
+                        timestamp: result.timestamp.toISOString(),
+                    });
+                }
+                catch (error) {
+                    logger.error({ error, revocationId }, 'Failed to notify webhooks');
+                }
+            }
+            // Update metrics
+            revocationsTotal.inc({ outcome: 'success' });
+            descendantsRevokedCounter(descendantsRevoked.length);
+            tokensInvalidated.inc(invalidatedCount);
+            logger.info({
+                revocationId,
+                did: revocation.revokedDid,
+                descendantsRevoked: descendantsRevoked.length,
+                tokensInvalidated: invalidatedCount,
+                durationMs: Date.now() - startTime,
+            }, 'Agent revocation completed');
+            return result;
+        }
+        catch (error) {
+            revocationsTotal.inc({ outcome: 'failed' });
+            logger.error({ error, revocationId, did: revocation.revokedDid }, 'Agent revocation failed');
+            throw new RevocationError(`Failed to revoke agent: ${error instanceof Error ? error.message : 'Unknown error'}`, { revocationId, did: revocation.revokedDid });
+        }
+        finally {
+            const duration = (Date.now() - startTime) / 1000;
+            revocationDuration.observe(duration);
+        }
+    }
+    /**
+     * Check revocation status of a DID
+     *
+     * @param did - DID to check
+     * @param tier - Trust tier for SLA-based caching
+     * @returns Revocation status
+     */
+    async checkRevocationStatus(did, tier) {
+        // Get cache TTL based on tier
+        const sla = tier !== undefined ? this.slaConfig.get(tier) : undefined;
+        const cacheTTL = sla?.maxPropagationLatencyMs ?? 60000;
+        // Check cache first
+        const cached = this.cache.get(did, cacheTTL);
+        if (cached) {
+            revocationChecks.inc({ type: 'cached', result: cached.status });
+            return cached;
+        }
+        // Perform fresh check
+        const revocation = this.revocations.get(did);
+        const status = revocation
+            ? {
+                did,
+                status: RevocationStatusEnum.REVOKED,
+                revokedAt: revocation.timestamp,
+                reason: 'Agent revoked', // We could store reason in revocation result
+                fromCache: false,
+            }
+            : {
+                did,
+                status: RevocationStatusEnum.ACTIVE,
+                fromCache: false,
+            };
+        revocationStatusSchema.parse(status);
+        // Cache the result
+        this.cache.set(did, status);
+        revocationChecks.inc({
+            type: 'sync',
+            result: status.status === RevocationStatusEnum.REVOKED ? 'revoked' : 'active',
+        });
+        return status;
+    }
+    /**
+     * Get SLA for a trust tier
+     *
+     * @param tier - Trust tier
+     * @returns Revocation SLA
+     */
+    getSLA(tier) {
+        const sla = this.slaConfig.get(tier);
+        if (!sla) {
+            // Return default SLA for unknown tiers
+            return {
+                tier,
+                maxPropagationLatencyMs: 60000,
+                syncCheckRequired: false,
+                introspectionRequired: false,
+            };
+        }
+        return sla;
+    }
+    /**
+     * Synchronous revocation check for high-value operations
+     *
+     * Always performs a fresh check, bypassing cache.
+     *
+     * @param did - DID to check
+     * @returns Whether DID is revoked (true = revoked)
+     */
+    async syncRevocationCheck(did) {
+        // Invalidate cache to force fresh check
+        this.cache.invalidate(did);
+        const status = await this.checkRevocationStatus(did);
+        return status.status === RevocationStatusEnum.REVOKED;
+    }
+    /**
+     * Subscribe to revocation events
+     *
+     * @param callback - Callback to invoke on revocation events
+     * @returns Unsubscribe function
+     */
+    onRevocation(callback) {
+        this.eventCallbacks.add(callback);
+        return () => {
+            this.eventCallbacks.delete(callback);
+        };
+    }
+    /**
+     * Check if synchronous revocation check is required
+     *
+     * @param tier - Trust tier
+     * @param isHighValueOperation - Whether this is a high-value operation
+     * @returns Whether sync check is required
+     */
+    requiresSyncCheck(tier, isHighValueOperation = false) {
+        const sla = this.getSLA(tier);
+        // T4+ always requires sync check
+        if (sla.syncCheckRequired) {
+            return true;
+        }
+        // High-value operations for L3+ require sync check
+        if (isHighValueOperation) {
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Propagate revocation to descendants in delegation chain
+     */
+    async propagateToDescendants(revokedDid, reason, gracePeriodMs) {
+        if (!this.delegationRegistry) {
+            return [];
+        }
+        const revokedDescendants = [];
+        // Apply grace period
+        if (gracePeriodMs > 0) {
+            await new Promise((resolve) => setTimeout(resolve, gracePeriodMs));
+        }
+        try {
+            // Get all delegations from this agent
+            const delegations = await this.delegationRegistry.getDelegationsFrom(revokedDid);
+            for (const delegation of delegations) {
+                // Revoke the delegation
+                await this.delegationRegistry.revokeDelegation(delegation.delegationId, `Parent revoked: ${revokedDid}`);
+                revokedDescendants.push(delegation.delegateDid);
+                // Emit event
+                await this.emitEvent({
+                    type: 'delegation.terminated',
+                    revocationId: crypto.randomUUID(),
+                    did: delegation.delegateDid,
+                    reason: `Parent agent revoked: ${reason}`,
+                    timestamp: new Date(),
+                    metadata: { parentDid: revokedDid },
+                });
+                // Recursively revoke descendants
+                const childDescendants = await this.propagateToDescendants(delegation.delegateDid, `Ancestor revoked: ${revokedDid}`, 0 // No grace period for recursive calls
+                );
+                revokedDescendants.push(...childDescendants);
+            }
+        }
+        catch (error) {
+            logger.error({ error, revokedDid }, 'Error propagating revocation to descendants');
+        }
+        return revokedDescendants;
+    }
+    /**
+     * Invalidate active tokens for an agent
+     */
+    async invalidateTokens(did) {
+        if (!this.tokenService) {
+            return 0;
+        }
+        try {
+            const count = await this.tokenService.invalidateForAgent(did);
+            if (count > 0) {
+                await this.emitEvent({
+                    type: 'token.invalidated',
+                    revocationId: crypto.randomUUID(),
+                    did,
+                    reason: 'Agent revoked',
+                    timestamp: new Date(),
+                    metadata: { count },
+                });
+            }
+            return count;
+        }
+        catch (error) {
+            logger.error({ error, did }, 'Error invalidating tokens');
+            return 0;
+        }
+    }
+    /**
+     * Emit a revocation event to subscribers
+     */
+    async emitEvent(event) {
+        revocationEventSchema.parse(event);
+        const callbacks = Array.from(this.eventCallbacks);
+        for (const callback of callbacks) {
+            try {
+                await callback(event);
+            }
+            catch (error) {
+                logger.error({ error, event }, 'Error in revocation event callback');
+            }
+        }
+    }
+    /**
+     * Clear a revocation (for testing or admin operations)
+     */
+    clearRevocation(did) {
+        this.revocations.delete(did);
+        this.cache.invalidate(did);
+        activeRevocations.set(this.revocations.size);
+        logger.info({ did }, 'Revocation cleared');
+    }
+    /**
+     * Get all active revocations
+     */
+    getActiveRevocations() {
+        return Array.from(this.revocations.values());
+    }
+    /**
+     * Destroy the service (cleanup)
+     */
+    destroy() {
+        this.cache.destroy();
+        this.eventCallbacks.clear();
+        this.revocations.clear();
+    }
+}
+// Helper to increment descendants counter with a specific value
+function descendantsRevokedCounter(count) {
+    for (let i = 0; i < count; i++) {
+        descendantsRevoked.inc();
+    }
+}
+/**
+ * Create a revocation service with default configuration for CAR ID
+ */
+export function createRevocationService(slaConfig, delegationRegistry, tokenService, webhookService) {
+    return new RevocationService(slaConfig ?? DEFAULT_REVOCATION_SLAS, delegationRegistry, tokenService, webhookService);
+}
+//# sourceMappingURL=revocation.js.map

package/dist/security/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/security/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAOL,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAElE,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC;IACnC,IAAI,EAAE,mCAAmC;IACzC,IAAI,EAAE,6BAA6B;IACnC,UAAU,EAAE,CAAC,SAAS,CAAU,EAAE,2BAA2B;IAC7D,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,OAAO,CAAC;IACrC,IAAI,EAAE,2CAA2C;IACjD,IAAI,EAAE,2DAA2D;IACjE,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAC;IACpC,IAAI,EAAE,0CAA0C;IAChD,IAAI,EAAE,4CAA4C;IAClD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,SAAS,CAAC;IACvC,IAAI,EAAE,6CAA6C;IACnD,IAAI,EAAE,mCAAmC;IACzC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC;IACnC,IAAI,EAAE,yCAAyC;IAC/C,IAAI,EAAE,gCAAgC;IACtC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU,EAAE,4CAA4C;IACrF,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,OAAO,CAAC;IACtC,IAAI,EAAE,6CAA6C;IACnD,IAAI,EAAE,6BAA6B;IACnC,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,KAAK,CAAC;IAClC,IAAI,EAAE,oCAAoC;IAC1C,IAAI,EAAE,4CAA4C;IAClD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,WAAW;IACrC,IAAI,GAAG,kBAAkB,CAAC;IAC1B,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IACvC,IAAI,GAAG,eAAe,CAAC;IACvB,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,GAAW,EAAE,MAAe;QACtC,KAAK,CAAC,SAAS,GAAG,oBAAoB,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AA8CD;;;GAGG;AACH,MAAM,eAAe;IAIC;IAHZ,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;IAClD,eAAe,GAA0B,IAAI,CAAC;IAEtD,YAAoB,eAAuB,KAAK;QAA5B,iBAAY,GAAZ,YAAY,CAAgB;QAC9C,2CAA2C;QAC3C,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,QAAgB;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;QACxC,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mBAAmB,CAAC,GAAG,EAAE,CAAC;QAC1B,OAAO;YACL,GAAG,KAAK,CAAC,MAAM;YACf,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,MAAwB;QACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;YACvC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAEO,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,OAAO,iBAAiB;IAgBlB;IACA;IACA;IAjBF,SAAS,CAAgC;IACzC,KAAK,CAAkB;IACvB,WAAW,CAAgC,CAAC,oBAAoB;IAChE,cAAc,CAA+B;IAErD;;;;;;;OAOG;IACH,YACE,YAA6B,uBAAuB,EAC5C,kBAAuC,EACvC,YAA2B,EAC3B,cAA+B;QAF/B,uBAAkB,GAAlB,kBAAkB,CAAqB;QACvC,iBAAY,GAAZ,YAAY,CAAe;QAC3B,mBAAc,GAAd,cAAc,CAAiB;QAEvC,gCAAgC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,EAAE,CAAC;QAEhC,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EACjC,gCAAgC,CACjC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,UAAiC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAE9C,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEzC,MAAM,CAAC,IAAI,CACT,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EACvE,2BAA2B,CAC5B,CAAC;QAEF,IAAI,CAAC;YACH,yCAAyC;YACzC,IAAI,kBAAkB,GAAa,EAAE,CAAC;YACtC,IAAI,UAAU,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,CAAC;gBACtD,kBAAkB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACpD,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,iBAAiB,CAAC,aAAa,CAC3C,CAAC;YACJ,CAAC;YAED,oBAAoB;YACpB,IAAI,gBAAgB,GAAG,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBACtE,yCAAyC;gBACzC,KAAK,MAAM,aAAa,IAAI,kBAAkB,EAAE,CAAC;oBAC/C,gBAAgB,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;YAED,gBAAgB;YAChB,MAAM,MAAM,GAAqB;gBAC/B,YAAY;gBACZ,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,kBAAkB;gBAClB,iBAAiB,EAAE,gBAAgB;gBACnC,mBAAmB,EAAE,IAAI;gBACzB,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;YAEF,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAErC,mBAAmB;YACnB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC7C,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAE7C,cAAc;YACd,MAAM,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,eAAe;gBACrB,YAAY;gBACZ,GAAG,EAAE,UAAU,CAAC,UAAU;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,QAAQ,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,EAAE;aAC5D,CAAC,CAAC;YAEH,kBAAkB;YAClB,IAAI,UAAU,CAAC,iBAAiB,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvE,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE;wBAC7C,YAAY;wBACZ,QAAQ,EAAE,UAAU,CAAC,UAAU;wBAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,kBAAkB;wBAClB,iBAAiB,EAAE,gBAAgB;wBACnC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;qBAC1C,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,2BAA2B,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAED,iBAAiB;YACjB,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7C,yBAAyB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACrD,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAExC,MAAM,CAAC,IAAI,CACT;gBACE,YAAY;gBACZ,GAAG,EAAE,UAAU,CAAC,UAAU;gBAC1B,kBAAkB,EAAE,kBAAkB,CAAC,MAAM;gBAC7C,iBAAiB,EAAE,gBAAgB;gBACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,EACD,4BAA4B,CAC7B,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,CAAC,UAAU,EAAE,EAAE,yBAAyB,CAAC,CAAC;YAC7F,MAAM,IAAI,eAAe,CACvB,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EACrF,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,CAAC,UAAU,EAAE,CAC7C,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;YACjD,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CAAC,GAAW,EAAE,IAAgB;QACvD,8BAA8B;QAC9B,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,QAAQ,GAAG,GAAG,EAAE,uBAAuB,IAAI,KAAK,CAAC;QAEvD,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,sBAAsB;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE7C,MAAM,MAAM,GAAqB,UAAU;YACzC,CAAC,CAAC;gBACE,GAAG;gBACH,MAAM,EAAE,oBAAoB,CAAC,OAAO;gBACpC,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,eAAe,EAAE,6CAA6C;gBACtE,SAAS,EAAE,KAAK;aACjB;YACH,CAAC,CAAC;gBACE,GAAG;gBACH,MAAM,EAAE,oBAAoB,CAAC,MAAM;gBACnC,SAAS,EAAE,KAAK;aACjB,CAAC;QAEN,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAErC,mBAAmB;QACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5B,gBAAgB,CAAC,GAAG,CAAC;YACnB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;SAC9E,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAe;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,uCAAuC;YACvC,OAAO;gBACL,IAAI;gBACJ,uBAAuB,EAAE,KAAK;gBAC9B,iBAAiB,EAAE,KAAK;gBACxB,qBAAqB,EAAE,KAAK;aAC7B,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAW;QACnC,wCAAwC;QACxC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,MAAM,KAAK,oBAAoB,CAAC,OAAO,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,QAAiC;QAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,IAAe,EAAE,uBAAgC,KAAK;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE9B,iCAAiC;QACjC,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,IAAI,oBAAoB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAClC,UAAkB,EAClB,MAAc,EACd,aAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,kBAAkB,GAAa,EAAE,CAAC;QAExC,qBAAqB;QACrB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC;YACH,sCAAsC;YACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAEjF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,wBAAwB;gBACxB,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAC5C,UAAU,CAAC,YAAY,EACvB,mBAAmB,UAAU,EAAE,CAChC,CAAC;gBAEF,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;gBAEhD,aAAa;gBACb,MAAM,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,uBAAuB;oBAC7B,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE;oBACjC,GAAG,EAAE,UAAU,CAAC,WAAW;oBAC3B,MAAM,EAAE,yBAAyB,MAAM,EAAE;oBACzC,SAAS,EAAE,IAAI,IAAI,EAAE;oBACrB,QAAQ,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;iBACpC,CAAC,CAAC;gBAEH,iCAAiC;gBACjC,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACxD,UAAU,CAAC,WAAW,EACtB,qBAAqB,UAAU,EAAE,EACjC,CAAC,CAAC,sCAAsC;iBACzC,CAAC;gBAEF,kBAAkB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,6CAA6C,CAAC,CAAC;QACrF,CAAC;QAED,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAW;QACxC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAE9D,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,mBAAmB;oBACzB,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE;oBACjC,GAAG;oBACH,MAAM,EAAE,eAAe;oBACvB,SAAS,EAAE,IAAI,IAAI,EAAE;oBACrB,QAAQ,EAAE,EAAE,KAAK,EAAE;iBACpB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS,CAAC,KAAsB;QAC5C,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC3B,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,gEAAgE;AAChE,SAAS,yBAAyB,CAAC,KAAa;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,kBAAkB,CAAC,GAAG,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA2B,EAC3B,kBAAuC,EACvC,YAA2B,EAC3B,cAA+B;IAE/B,OAAO,IAAI,iBAAiB,CAC1B,SAAS,IAAI,uBAAuB,EACpC,kBAAkB,EAClB,YAAY,EACZ,cAAc,CACf,CAAC;AACJ,CAAC"}