agent-protocols 0.7.0 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (48) hide show
  1. package/README.md +38 -9
  2. package/dist/delegation.d.ts +98 -29
  3. package/dist/delegation.d.ts.map +1 -1
  4. package/dist/delegation.js +377 -51
  5. package/dist/delegation.js.map +1 -1
  6. package/dist/discourse.d.ts +196 -74
  7. package/dist/discourse.d.ts.map +1 -1
  8. package/dist/discourse.js +568 -116
  9. package/dist/discourse.js.map +1 -1
  10. package/dist/errors.d.ts.map +1 -1
  11. package/dist/errors.js.map +1 -1
  12. package/dist/http-client.d.ts +47 -17
  13. package/dist/http-client.d.ts.map +1 -1
  14. package/dist/http-client.js +118 -39
  15. package/dist/http-client.js.map +1 -1
  16. package/dist/identity.d.ts +101 -4
  17. package/dist/identity.d.ts.map +1 -1
  18. package/dist/identity.js +334 -8
  19. package/dist/identity.js.map +1 -1
  20. package/dist/local-connector/catalog.d.ts +1 -16
  21. package/dist/local-connector/catalog.d.ts.map +1 -1
  22. package/dist/local-connector/catalog.js +53 -63
  23. package/dist/local-connector/catalog.js.map +1 -1
  24. package/dist/local-connector/engine.d.ts +57 -33
  25. package/dist/local-connector/engine.d.ts.map +1 -1
  26. package/dist/local-connector/engine.js +652 -607
  27. package/dist/local-connector/engine.js.map +1 -1
  28. package/dist/local-connector/inputs.d.ts +29 -76
  29. package/dist/local-connector/inputs.d.ts.map +1 -1
  30. package/dist/local-connector/inputs.js +19 -1
  31. package/dist/local-connector/inputs.js.map +1 -1
  32. package/dist/local-connector/projection.d.ts +24 -9
  33. package/dist/local-connector/projection.d.ts.map +1 -1
  34. package/dist/local-connector/projection.js +79 -40
  35. package/dist/local-connector/projection.js.map +1 -1
  36. package/dist/local-connector/state.d.ts +10 -3
  37. package/dist/local-connector/state.d.ts.map +1 -1
  38. package/dist/local-connector/state.js +3 -0
  39. package/dist/local-connector/state.js.map +1 -1
  40. package/dist/local-connector/views.d.ts +36 -12
  41. package/dist/local-connector/views.d.ts.map +1 -1
  42. package/dist/local-connector/views.js +49 -31
  43. package/dist/local-connector/views.js.map +1 -1
  44. package/dist/profile.d.ts +23 -9
  45. package/dist/profile.d.ts.map +1 -1
  46. package/dist/profile.js +120 -3
  47. package/dist/profile.js.map +1 -1
  48. package/package.json +5 -5
@@ -1,34 +1,110 @@
1
+ import canonicalize from "canonicalize";
1
2
  import { protocolError } from "./errors.js";
2
- import { createEvent, validateAgentId, verifyEnvelope, } from "./identity.js";
3
+ import { AGENT_ID_PREFIX, createEvent, validateAgentId, validateEventFields, validateOrigin, verifyEnvelope, } from "./identity.js";
3
4
  export const DELEGATION_PROTOCOL = "agent-delegation/1.0";
4
5
  export const DELEGATION_GRANT = "delegation.grant";
5
6
  export const DELEGATION_REVOKE = "delegation.revoke";
7
+ /** Delegation IDs are unreserved URL characters: no percent-encoding, no look-alikes. */
8
+ export const DELEGATION_ID_PATTERN = /^[A-Za-z0-9._~-]{1,128}$/;
9
+ /** Delegation-specific error codes (Agent Delegation Section 9.7). */
10
+ export const DELEGATION_ERROR_CODES = [
11
+ "principal_unresolvable",
12
+ "principal_not_canonical",
13
+ "controller_not_current",
14
+ "delegation_not_permitted",
15
+ "delegation_ceiling_exceeded",
16
+ "not_owner_controller",
17
+ "credential_not_found",
18
+ "credential_identity_mismatch",
19
+ "grant_expired",
20
+ ];
6
21
  export function delegationGrantEvent(actor, createdAt, nonce, payload) {
7
22
  return createEvent(DELEGATION_PROTOCOL, DELEGATION_GRANT, actor, createdAt, nonce, payload);
8
23
  }
9
24
  export function delegationRevokeEvent(actor, createdAt, nonce, payload) {
10
25
  return createEvent(DELEGATION_PROTOCOL, DELEGATION_REVOKE, actor, createdAt, nonce, payload);
11
26
  }
27
+ export function validateController(controller, retired = false) {
28
+ if (!isRecord(controller))
29
+ fail("controller must be an object");
30
+ validateAgentId(controller.id);
31
+ if (controller.source !== "local")
32
+ validateOrigin(controller.source);
33
+ timestamp(controller.valid_from, "valid_from");
34
+ if (controller.name !== undefined)
35
+ validateNonEmpty(controller.name, "name");
36
+ if (controller.delegation !== undefined && controller.delegation !== "*") {
37
+ const policy = controller.delegation;
38
+ if (!isRecord(policy) || Object.keys(policy).sort().join(",") !== "audiences,scopes")
39
+ fail("invalid delegation policy");
40
+ stringList(policy.scopes, "scopes");
41
+ stringList(policy.audiences, "audiences");
42
+ for (const audience of policy.audiences)
43
+ validateAudience(audience);
44
+ }
45
+ if (controller.supersedes !== undefined) {
46
+ stringList(controller.supersedes, "supersedes");
47
+ for (const id of controller.supersedes)
48
+ validateAgentId(id);
49
+ }
50
+ if (retired) {
51
+ timestamp(controller.retired_at, "retired_at");
52
+ if (controller.retired_at < controller.valid_from)
53
+ fail("retired_at precedes valid_from");
54
+ if (controller.invalid_from !== undefined) {
55
+ timestamp(controller.invalid_from, "invalid_from");
56
+ if (controller.invalid_from < controller.valid_from || controller.invalid_from > controller.retired_at)
57
+ fail("invalid compromise interval");
58
+ }
59
+ }
60
+ else if (controller.retired_at !== undefined || controller.invalid_from !== undefined)
61
+ fail("current controller has retirement fields");
62
+ }
12
63
  export function validatePrincipalDocument(document) {
64
+ if (!isRecord(document))
65
+ fail("principal must be an object");
13
66
  validateHttpsUrl(document.id, "principal.id");
14
- if (!Array.isArray(document.controllers) || document.controllers.length === 0) {
15
- throw protocolError("invalid_principal", "principal document controllers must be non-empty");
67
+ if (document.protocol !== DELEGATION_PROTOCOL)
68
+ fail("invalid principal protocol");
69
+ timestamp(document.updated_at, "updated_at");
70
+ if (!Array.isArray(document.controllers) || (document.retired_controllers !== undefined && !Array.isArray(document.retired_controllers)))
71
+ fail("controllers must be arrays");
72
+ const records = new Map();
73
+ let delegates = false;
74
+ for (const [list, retired] of [[document.controllers, false], [document.retired_controllers ?? [], true]]) {
75
+ for (const record of list) {
76
+ validateController(record, retired);
77
+ if (records.has(record.id))
78
+ fail("duplicate controller key");
79
+ records.set(record.id, record);
80
+ if (record.delegation !== undefined)
81
+ delegates = true;
82
+ if (record.valid_from > document.updated_at || (record.retired_at !== undefined && record.retired_at > document.updated_at))
83
+ fail("controller timestamp exceeds document update");
84
+ }
16
85
  }
17
- for (const controller of document.controllers)
18
- validateAgentId(controller);
19
- if (document.aliases !== undefined) {
20
- if (!Array.isArray(document.aliases)) {
21
- throw protocolError("invalid_principal", "aliases must be an array");
86
+ // Succession (Section 5.1): each entry names another, earlier record.
87
+ for (const record of records.values()) {
88
+ for (const id of record.supersedes ?? []) {
89
+ const predecessor = records.get(id);
90
+ if (!predecessor || id === record.id || predecessor.valid_from >= record.valid_from)
91
+ fail("invalid supersedes entry");
22
92
  }
93
+ }
94
+ if (document.aliases !== undefined) {
95
+ stringList(document.aliases, "aliases", true);
23
96
  for (const alias of document.aliases)
24
97
  validateHttpsUrl(alias, "alias");
25
98
  }
26
- if (document.delegation_query_url !== undefined) {
99
+ if (document.avatar_url !== undefined)
100
+ validateHttpsUrl(document.avatar_url, "avatar_url");
101
+ if (document.delegation_query_url !== undefined)
27
102
  validateHttpsUrl(document.delegation_query_url, "delegation_query_url");
28
- }
103
+ else if (delegates)
104
+ fail("delegation_query_url is required when a controller carries delegation");
29
105
  }
30
106
  /**
31
- * Checks the authoritative-read rule of Agent Delegation Section 5.3: a
107
+ * Checks the authoritative-read rule of Agent Delegation Section 3: a
32
108
  * principal document binds controller keys only when it is read at its own
33
109
  * `id`. A document served anywhere else is a copy; its `controllers` MUST be
34
110
  * discarded and `document.id` resolved instead.
@@ -46,25 +122,52 @@ export function validatePrincipalResolution(document, resolvedUrl) {
46
122
  export function isPrincipalAlias(document, url) {
47
123
  return document.aliases?.includes(url) ?? false;
48
124
  }
125
+ /**
126
+ * The lineage of a controller (Section 5.1): its own ID plus, transitively,
127
+ * every record it supersedes. A restricted controller owns a credential whose
128
+ * `owner_controller` is in its lineage.
129
+ */
130
+ export function controllerLineage(document, controllerId) {
131
+ const records = new Map();
132
+ for (const record of [...document.controllers, ...document.retired_controllers ?? []])
133
+ records.set(record.id, record);
134
+ const lineage = new Set();
135
+ const pending = [controllerId];
136
+ while (pending.length > 0) {
137
+ const id = pending.pop();
138
+ if (lineage.has(id))
139
+ continue;
140
+ lineage.add(id);
141
+ pending.push(...(records.get(id)?.supersedes ?? []));
142
+ }
143
+ return lineage;
144
+ }
49
145
  export function validateDelegationGrantPayload(payload, createdAt) {
50
- validateNonEmpty(payload.id, "payload.id");
51
- validatePrincipalDescriptor(payload.principal);
146
+ if (!isRecord(payload))
147
+ fail("payload must be an object");
148
+ validateDelegationId(payload.id);
149
+ validateHttpsUrl(payload.principal_id, "principal_id");
52
150
  validateAgentId(payload.subject);
53
- if (!Array.isArray(payload.scopes) || payload.scopes.length === 0) {
54
- throw protocolError("invalid_delegation", "delegation scopes must be non-empty");
55
- }
56
- for (const scope of payload.scopes)
57
- validateNonEmpty(scope, "scope");
151
+ stringList(payload.scopes, "scopes");
152
+ stringList(payload.audiences, "audiences");
153
+ for (const audience of payload.audiences)
154
+ validateAudience(audience);
155
+ if (createdAt !== undefined)
156
+ timestamp(createdAt, "created_at");
157
+ if (payload.not_before !== undefined)
158
+ timestamp(payload.not_before, "not_before");
159
+ if (payload.expires_at !== undefined)
160
+ timestamp(payload.expires_at, "expires_at");
58
161
  if (payload.constraints !== undefined && !isRecord(payload.constraints)) {
59
162
  throw protocolError("invalid_delegation", "constraints must be an object");
60
163
  }
61
164
  if (payload.expires_at !== undefined) {
62
165
  if (payload.not_before !== undefined &&
63
166
  payload.expires_at <= payload.not_before) {
64
- throw protocolError("invalid_delegation", "expires_at must be greater than not_before");
167
+ throw protocolError("grant_expired", "expires_at must be greater than not_before");
65
168
  }
66
169
  if (createdAt !== undefined && payload.expires_at <= createdAt) {
67
- throw protocolError("invalid_delegation", "expires_at must be greater than created_at");
170
+ throw protocolError("grant_expired", "expires_at must be greater than created_at");
68
171
  }
69
172
  }
70
173
  }
@@ -78,28 +181,41 @@ export function validateDelegationGrantPayload(payload, createdAt) {
78
181
  export function validateDelegationQueryRequest(request, options = {}) {
79
182
  if (options.allowEnumeration) {
80
183
  if (request.subject === undefined && request.principal_id === undefined) {
81
- throw protocolError("invalid_delegation", "query must include at least one of subject or principal_id");
184
+ throw protocolError("invalid_request", "query must include at least one of subject or principal_id");
82
185
  }
83
186
  }
84
187
  else if (request.subject === undefined || request.principal_id === undefined) {
85
- throw protocolError("invalid_delegation", "public query must include both subject and principal_id");
188
+ throw protocolError("invalid_request", "public query must include both subject and principal_id");
86
189
  }
190
+ if (request.id !== undefined)
191
+ validateDelegationId(request.id);
192
+ if (request.status !== undefined && !["active", "suspended", "expired", "revoked"].includes(request.status))
193
+ fail("invalid status");
87
194
  if (request.subject !== undefined)
88
195
  validateAgentId(request.subject);
89
196
  if (request.principal_id !== undefined) {
90
197
  validateHttpsUrl(request.principal_id, "principal_id");
91
198
  }
92
199
  if (request.limit !== undefined &&
93
- (!Number.isInteger(request.limit) || request.limit < 1)) {
94
- throw protocolError("invalid_delegation", "limit must be a positive integer");
200
+ (!Number.isSafeInteger(request.limit) || request.limit < 1)) {
201
+ throw protocolError("invalid_request", "limit must be a positive integer");
95
202
  }
96
203
  }
97
204
  export function validateDelegationRevokePayload(payload) {
98
- validateNonEmpty(payload.id, "payload.id");
205
+ if (!isRecord(payload))
206
+ fail("payload must be an object");
207
+ validateDelegationId(payload.id);
99
208
  validateHttpsUrl(payload.principal_id, "principal_id");
100
209
  }
210
+ export function validateDelegationId(value) {
211
+ if (typeof value !== "string" || !DELEGATION_ID_PATTERN.test(value) || value === "." || value === "..") {
212
+ fail("delegation id must match [A-Za-z0-9._~-]{1,128} and not be a dot segment");
213
+ }
214
+ }
101
215
  export function validateDelegationEnvelope(envelope) {
102
216
  verifyEnvelope(envelope);
217
+ // Delegation events carry only the six Agent Identity event fields.
218
+ validateEventFields(envelope.event);
103
219
  if (envelope.event.protocol !== DELEGATION_PROTOCOL) {
104
220
  throw protocolError("invalid_event_protocol", `expected ${DELEGATION_PROTOCOL}, got ${envelope.event.protocol}`);
105
221
  }
@@ -113,33 +229,243 @@ export function validateDelegationEnvelope(envelope) {
113
229
  throw protocolError("invalid_event_type", `expected ${DELEGATION_GRANT} or ${DELEGATION_REVOKE}, got ${envelope.event.type}`);
114
230
  }
115
231
  }
116
- export function materializeDelegationCredential(envelope, options = {}) {
232
+ /** Materializes an already accepted event. The caller supplies trusted previous state
233
+ * and the service's actual acceptance time; this function does not authorize it. */
234
+ export function materializeDelegationCredential(envelope, options) {
235
+ validateDelegationEnvelope(envelope);
236
+ timestamp(options.acceptedAt, "accepted_at");
237
+ const event = envelope.event;
238
+ const previous = options.previous;
239
+ checkPrevious(event, previous);
240
+ if (previous && options.acceptedAt < previous.accepted_at)
241
+ fail("acceptance order reversed");
242
+ const checkedAt = options.checkedAt ?? options.acceptedAt;
243
+ timestamp(checkedAt, "checked_at");
244
+ if (checkedAt < options.acceptedAt)
245
+ fail("checked_at precedes acceptance");
246
+ if (event.type === DELEGATION_REVOKE) {
247
+ if (!previous)
248
+ fail("revocation requires previous credential");
249
+ return { ...structuredClone(previous), controller: event.actor, status: "revoked", event_id: envelope.hash, accepted_at: options.acceptedAt, checked_at: checkedAt };
250
+ }
251
+ const payload = event.payload;
252
+ if (payload.expires_at !== undefined && payload.expires_at <= options.acceptedAt) {
253
+ throw protocolError("grant_expired", "grant expired at acceptance");
254
+ }
255
+ const status = options.status ?? "active";
256
+ if (!["active", "suspended", "expired", "revoked"].includes(status))
257
+ fail("invalid status");
258
+ return { ...structuredClone(payload), protocol: DELEGATION_PROTOCOL, controller: event.actor,
259
+ owner_controller: previous?.owner_controller ?? event.actor, status,
260
+ event_id: envelope.hash, grant_event_id: envelope.hash, accepted_at: options.acceptedAt, checked_at: checkedAt };
261
+ }
262
+ /** Pre-signing authority check. Input previous state and document must be trusted.
263
+ * This does not verify signatures, fetch HTTPS, check cache age, or enforce nonce/time windows. */
264
+ export function validateDelegationEventAuthority(event, document, acceptedAt, previous) {
265
+ checkAuthority(event, document, acceptedAt, previous, false);
266
+ }
267
+ /** Online acceptance checks over a document read at resolvedUrl. Services must also
268
+ * enforce fresh resolution, Identity live replay rules, and atomic persistence. */
269
+ export function validateDelegationAcceptance(envelope, document, resolvedUrl, acceptedAt, previous) {
117
270
  validateDelegationEnvelope(envelope);
118
- if (envelope.event.type !== DELEGATION_GRANT) {
119
- throw protocolError("invalid_event_type", "delegation credential materialization requires a grant event");
120
- }
121
- const payload = envelope.event.payload;
122
- return {
123
- id: payload.id,
124
- protocol: DELEGATION_PROTOCOL,
125
- principal: payload.principal,
126
- controller: envelope.event.actor,
127
- subject: payload.subject,
128
- relationship: payload.relationship,
129
- scopes: payload.scopes,
130
- constraints: payload.constraints,
131
- not_before: payload.not_before,
132
- expires_at: payload.expires_at,
133
- status: options.status ?? "active",
134
- updated_at: options.updatedAt ?? envelope.event.created_at,
135
- event_id: envelope.hash,
136
- };
137
- }
138
- function validatePrincipalDescriptor(principal) {
139
- if (!isRecord(principal)) {
140
- throw protocolError("invalid_principal", "principal must be an object");
141
- }
142
- validateHttpsUrl(principal.id, "principal.id");
271
+ validatePrincipalResolution(document, resolvedUrl);
272
+ checkAuthority(envelope.event, document, acceptedAt, previous, false);
273
+ }
274
+ /** Uses caller-trusted acceptance evidence, never an event's self-reported time as proof.
275
+ * Current status, evidence authenticity and application constraints are separate checks. */
276
+ export function validateHistoricalDelegation(record, document, resolvedUrl, previous) {
277
+ validateDelegationEnvelope(record.envelope);
278
+ validatePrincipalResolution(document, resolvedUrl);
279
+ checkAuthority(record.envelope.event, document, record.accepted_at, previous, true);
280
+ }
281
+ /** Per-result enumeration check; the caller authenticates actor and resolves the document. */
282
+ export function validateControllerEnumeration(document, actor, now, owner) {
283
+ validatePrincipalDocument(document);
284
+ timestamp(now, "now");
285
+ validateAgentId(owner);
286
+ const controller = document.controllers.find(c => c.id === actor);
287
+ if (!controller || now < controller.valid_from)
288
+ throw protocolError("controller_not_current", "controller cannot enumerate");
289
+ if (controller.delegation === undefined)
290
+ throw protocolError("delegation_not_permitted", "controller cannot enumerate");
291
+ if (controller.delegation !== "*" && !controllerLineage(document, actor).has(owner)) {
292
+ throw protocolError("not_owner_controller", "controller does not own credential");
293
+ }
294
+ }
295
+ /** Checks audience/status/time only, after cryptographic and historical verification.
296
+ * The application still authenticates the subject and enforces scopes and constraints. */
297
+ export function validateDelegationUse(credential, audience, now) {
298
+ validateAudience(audience);
299
+ timestamp(now, "now");
300
+ validateDelegationGrantPayload(credential);
301
+ if (credential.protocol !== DELEGATION_PROTOCOL || credential.status !== "active" ||
302
+ !credential.audiences.includes(audience) || (credential.not_before !== undefined && now < credential.not_before) ||
303
+ (credential.expires_at !== undefined && now >= credential.expires_at))
304
+ fail("delegation is not usable");
305
+ }
306
+ /** Grant fields a credential carries from its latest grant. */
307
+ const GRANT_FIELDS = [
308
+ "id", "principal_id", "subject", "relationship", "scopes", "audiences",
309
+ "constraints", "not_before", "expires_at",
310
+ ];
311
+ /**
312
+ * Verifies a credential under Agent Delegation Section 8 with the online
313
+ * service-trusting evidence policy: checks the accepted record of its latest
314
+ * grant — signature, Controller binding, ceiling, and authority interval —
315
+ * confirms that the grant matches the credential, and then checks use for
316
+ * `audience` at `now`. Ownership and `supersedes` lineage govern management,
317
+ * which the service enforced at acceptance; auditors replay them with
318
+ * {@link auditDelegationHistory}. Relying parties still enforce scopes and
319
+ * constraints and authenticate the subject.
320
+ */
321
+ export function verifyDelegationCredential(credential, records, document, resolvedUrl, audience, now) {
322
+ const reasons = [];
323
+ try {
324
+ const record = records.find((candidate) => candidate.envelope.hash === credential.grant_event_id);
325
+ if (!record)
326
+ fail("latest grant record is missing");
327
+ validateHistoricalDelegation(record, document, resolvedUrl);
328
+ if (record.envelope.event.type !== DELEGATION_GRANT)
329
+ fail("grant_event_id does not name a grant");
330
+ const grant = record.envelope.event.payload;
331
+ if (credential.protocol !== DELEGATION_PROTOCOL ||
332
+ GRANT_FIELDS.some((field) => canonicalize(grant[field]) !== canonicalize(credential[field]))) {
333
+ fail("credential does not match its latest grant");
334
+ }
335
+ if (credential.event_id === credential.grant_event_id) {
336
+ if (credential.accepted_at !== record.accepted_at || credential.controller !== record.envelope.event.actor ||
337
+ credential.status === "revoked") {
338
+ fail("credential does not match its latest grant");
339
+ }
340
+ }
341
+ else if (credential.status !== "revoked") {
342
+ fail("a credential last changed by a revocation must be revoked");
343
+ }
344
+ }
345
+ catch (error) {
346
+ reasons.push(error instanceof Error ? error.message : String(error));
347
+ }
348
+ const verified = reasons.length === 0;
349
+ if (credential.status !== "active")
350
+ reasons.push(`status is ${credential.status}`);
351
+ if (!credential.audiences?.includes(audience))
352
+ reasons.push(`audience ${audience} is not granted`);
353
+ if (credential.not_before !== undefined && now < credential.not_before)
354
+ reasons.push("not yet valid");
355
+ if (credential.expires_at !== undefined && now >= credential.expires_at)
356
+ reasons.push("expired");
357
+ return { credential, verified, usable: reasons.length === 0, reasons };
358
+ }
359
+ /**
360
+ * Auditor check (Section 8): replays every accepted record of a credential
361
+ * against the authoritative principal document — signatures, controller
362
+ * intervals, ceilings, and ownership lineage — and confirms that the replay
363
+ * matches the credential. Relying parties use {@link verifyDelegationCredential}.
364
+ */
365
+ export function auditDelegationHistory(credential, records, document, resolvedUrl) {
366
+ if (records.length === 0)
367
+ fail("no accepted records");
368
+ let replayed;
369
+ for (const record of records) {
370
+ validateHistoricalDelegation(record, document, resolvedUrl, replayed);
371
+ replayed = materializeDelegationCredential(record.envelope, { acceptedAt: record.accepted_at, previous: replayed });
372
+ }
373
+ const r = replayed;
374
+ // Only status and the service's check time may differ from event replay.
375
+ const fields = [
376
+ ...GRANT_FIELDS, "protocol", "event_id", "grant_event_id", "owner_controller", "controller", "accepted_at",
377
+ ];
378
+ if (fields.some((field) => canonicalize(r[field]) !== canonicalize(credential[field])) ||
379
+ (r.status === "revoked") !== (credential.status === "revoked")) {
380
+ fail("credential does not match its accepted records");
381
+ }
382
+ }
383
+ /** A relying-party audience (Section 5): an origin for a relying application, or an Agent ID for a relying agent. */
384
+ export function validateAudience(value) {
385
+ if (typeof value === "string" && value.startsWith(AGENT_ID_PREFIX)) {
386
+ validateAgentId(value);
387
+ return;
388
+ }
389
+ validateOrigin(value);
390
+ }
391
+ function eventIdentity(event) {
392
+ const payload = event.payload;
393
+ return { id: payload.id, principalId: payload.principal_id };
394
+ }
395
+ function checkPrevious(event, previous) {
396
+ if (!previous) {
397
+ if (event.type === DELEGATION_REVOKE)
398
+ throw protocolError("credential_not_found", "revocation requires previous credential");
399
+ return;
400
+ }
401
+ validateAgentId(previous.owner_controller);
402
+ timestamp(previous.accepted_at, "previous.accepted_at");
403
+ const { id, principalId } = eventIdentity(event);
404
+ const sameSubject = event.type !== DELEGATION_GRANT || event.payload.subject === previous.subject;
405
+ if (previous.id !== id || previous.principal_id !== principalId || previous.protocol !== DELEGATION_PROTOCOL || !sameSubject) {
406
+ throw protocolError("credential_identity_mismatch", "credential principal, subject, and protocol are immutable");
407
+ }
408
+ }
409
+ function checkAuthority(event, document, acceptedAt, previous, historical) {
410
+ validatePrincipalDocument(document);
411
+ timestamp(acceptedAt, "accepted_at");
412
+ timestamp(event.created_at, "created_at");
413
+ validateAgentId(event.actor);
414
+ if (event.protocol !== DELEGATION_PROTOCOL)
415
+ fail("invalid event protocol");
416
+ const grant = event.type === DELEGATION_GRANT;
417
+ if (grant)
418
+ validateDelegationGrantPayload(event.payload, event.created_at);
419
+ else if (event.type === DELEGATION_REVOKE)
420
+ validateDelegationRevokePayload(event.payload);
421
+ else
422
+ fail("invalid event type");
423
+ if (eventIdentity(event).principalId !== document.id)
424
+ throw protocolError("principal_not_canonical", "principal mismatch");
425
+ const records = historical ? [...document.controllers, ...document.retired_controllers ?? []] : document.controllers;
426
+ const controller = records.find(c => c.id === event.actor);
427
+ if (!controller)
428
+ throw protocolError("controller_not_current", "actor is not a controller of the principal");
429
+ if (controller.delegation === undefined)
430
+ throw protocolError("delegation_not_permitted", "actor has no delegation authority");
431
+ for (const time of [event.created_at, acceptedAt]) {
432
+ if (time < controller.valid_from || (controller.retired_at !== undefined && time >= controller.retired_at) || (controller.invalid_from !== undefined && time >= controller.invalid_from)) {
433
+ throw protocolError("controller_not_current", "outside controller authority interval");
434
+ }
435
+ }
436
+ checkPrevious(event, previous);
437
+ if (previous && acceptedAt < previous.accepted_at)
438
+ fail("acceptance order reversed");
439
+ if (previous && controller.delegation !== "*" && !controllerLineage(document, event.actor).has(previous.owner_controller)) {
440
+ throw protocolError("not_owner_controller", "controller does not own credential");
441
+ }
442
+ if (grant) {
443
+ const payload = event.payload;
444
+ if (payload.expires_at !== undefined && payload.expires_at <= acceptedAt)
445
+ throw protocolError("grant_expired", "grant expired at acceptance");
446
+ if (controller.delegation !== "*") {
447
+ const policy = controller.delegation;
448
+ if (payload.scopes.some(x => !policy.scopes.includes(x)) || payload.audiences.some(x => !policy.audiences.includes(x))) {
449
+ throw protocolError("delegation_ceiling_exceeded", "grant exceeds controller delegation policy");
450
+ }
451
+ }
452
+ }
453
+ }
454
+ function fail(message) { throw protocolError("invalid_delegation", message); }
455
+ function timestamp(value, field) {
456
+ if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
457
+ fail(`${field} must be a non-negative safe integer`);
458
+ }
459
+ function stringList(value, field, empty = false) {
460
+ if (!Array.isArray(value) || (!empty && value.length === 0))
461
+ fail(`${field} must be a non-empty array`);
462
+ for (const item of value) {
463
+ validateNonEmpty(item, field);
464
+ if (item === "*")
465
+ fail(`${field} cannot contain wildcard`);
466
+ }
467
+ if (new Set(value).size !== value.length)
468
+ fail(`${field} contains duplicates`);
143
469
  }
144
470
  function validateHttpsUrl(value, field) {
145
471
  if (typeof value !== "string") {
@@ -1 +1 @@
1
- {"version":3,"file":"delegation.js","sourceRoot":"","sources":["../src/delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAIL,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAsHrD,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,SAAiB,EACjB,KAAa,EACb,OAA+B;IAE/B,OAAO,WAAW,CAChB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,EACL,SAAS,EACT,KAAK,EACL,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,SAAiB,EACjB,KAAa,EACb,OAAgC;IAEhC,OAAO,WAAW,CAChB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,EACL,SAAS,EACT,KAAK,EACL,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,aAAa,CACjB,mBAAmB,EACnB,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW;QAAE,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,aAAa,CAAC,mBAAmB,EAAE,0BAA0B,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO;YAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAChD,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA2B,EAC3B,WAAmB;IAEnB,IAAI,QAAQ,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,aAAa,CACjB,mBAAmB,EACnB,yBAAyB,QAAQ,CAAC,EAAE,kBAAkB,WAAW,EAAE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,GAAW;IAEX,OAAO,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,SAAkB;IAElB,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC3C,2BAA2B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,aAAa,CAAC,oBAAoB,EAAE,qCAAqC,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM;QAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,aAAa,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,IACE,OAAO,CAAC,UAAU,KAAK,SAAS;YAChC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,EACxC,CAAC;YACD,MAAM,aAAa,CACjB,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;YAC/D,MAAM,aAAa,CACjB,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,UAA0C,EAAE;IAE5C,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,aAAa,CACjB,oBAAoB,EACpB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/E,MAAM,aAAa,CACjB,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;IACD,IACE,OAAO,CAAC,KAAK,KAAK,SAAS;QAC3B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EACvD,CAAC;QACD,MAAM,aAAa,CACjB,oBAAoB,EACpB,kCAAkC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAgC;IAEhC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC3C,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAAqC;IAErC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACpD,MAAM,aAAa,CACjB,wBAAwB,EACxB,YAAY,mBAAmB,SAAS,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC7C,8BAA8B,CAC5B,QAAQ,CAAC,KAAK,CAAC,OAAiC,EAChD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAC1B,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrD,+BAA+B,CAC7B,QAAQ,CAAC,KAAK,CAAC,OAAkC,CAClD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,CACjB,oBAAoB,EACpB,YAAY,gBAAgB,OAAO,iBAAiB,SAAS,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,QAA0C,EAC1C,UAGI,EAAE;IAEN,0BAA0B,CAAC,QAAuC,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC7C,MAAM,aAAa,CACjB,oBAAoB,EACpB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;IACvC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,mBAAmB;QAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ;QAClC,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,UAAU;QAC1D,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,SAA8B;IACjE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,mBAAmB,EAAE,6BAA6B,CAAC,CAAC;IAC1E,CAAC;IACD,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,aAAa,CAAC,oBAAoB,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
1
+ {"version":3,"file":"delegation.js","sourceRoot":"","sources":["../src/delegation.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,eAAe,EAMf,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEhE,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,wBAAwB;IACxB,yBAAyB;IACzB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,sBAAsB;IACtB,sBAAsB;IACtB,8BAA8B;IAC9B,eAAe;CAChB,CAAC;AAuIF,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,SAAiB,EACjB,KAAa,EACb,OAA+B;IAE/B,OAAO,WAAW,CAChB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,EACL,SAAS,EACT,KAAK,EACL,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,SAAiB,EACjB,KAAa,EACb,OAAgC;IAEhC,OAAO,WAAW,CAChB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,EACL,SAAS,EACT,KAAK,EACL,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAsB,EAAE,OAAO,GAAG,KAAK;IACxE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAChE,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO;QAAE,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrE,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS;QAAE,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7E,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,kBAAkB;YAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxH,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC1C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;YAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChD,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,UAAU;YAAE,eAAe,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,UAAW,GAAG,UAAU,CAAC,UAAU;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC3F,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,YAAY,GAAG,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,YAAY,GAAG,UAAU,CAAC,UAAW;gBAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC/I,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,0CAA0C,CAAC,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7D,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,QAAQ,KAAK,mBAAmB;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAClF,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC7K,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,EAAE,IAAI,CAAC,CAAU,EAAE,CAAC;QACnH,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;gBAAE,SAAS,GAAG,IAAI,CAAC;YACtD,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;gBAAE,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACpL,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpC,IAAI,CAAC,WAAW,IAAI,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,WAAW,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU;gBAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO;YAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;QAAE,gBAAgB,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,oBAAoB,KAAK,SAAS;QAAE,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;SACpH,IAAI,SAAS;QAAE,IAAI,CAAC,uEAAuE,CAAC,CAAC;AACpG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA2B,EAC3B,WAAmB;IAEnB,IAAI,QAAQ,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,aAAa,CACjB,mBAAmB,EACnB,yBAAyB,QAAQ,CAAC,EAAE,kBAAkB,WAAW,EAAE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,GAAW;IAEX,OAAO,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B,EAAE,YAAqB;IAClF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACtH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAW,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,SAAkB;IAElB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC1D,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS;QAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACrE,IAAI,SAAS,KAAK,SAAS;QAAE,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,aAAa,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,IACE,OAAO,CAAC,UAAU,KAAK,SAAS;YAChC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,EACxC,CAAC;YACD,MAAM,aAAa,CACjB,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;YAC/D,MAAM,aAAa,CACjB,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,OAAO,GAAmC,EAAE;IAE5C,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,aAAa,CACjB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/E,MAAM,aAAa,CACjB,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS;QAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpI,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;IACD,IACE,OAAO,CAAC,KAAK,KAAK,SAAS;QAC3B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAC3D,CAAC;QACD,MAAM,aAAa,CACjB,iBAAiB,EACjB,kCAAkC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAgC;IAEhC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC1D,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACvG,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAAqC;IAErC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,oEAAoE;IACpE,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACpD,MAAM,aAAa,CACjB,wBAAwB,EACxB,YAAY,mBAAmB,SAAS,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC7C,8BAA8B,CAC5B,QAAQ,CAAC,KAAK,CAAC,OAAiC,EAChD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAC1B,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrD,+BAA+B,CAC7B,QAAQ,CAAC,KAAK,CAAC,OAAkC,CAClD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,CACjB,oBAAoB,EACpB,YAAY,gBAAgB,OAAO,iBAAiB,SAAS,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,+BAA+B,CAC7C,QAAqC,EACrC,OAA+G;IAE/G,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACrC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/B,IAAI,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,WAAW;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC;IAC1D,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACnC,IAAI,SAAS,GAAG,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC3E,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,eAAe,CAAC,QAAS,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACxK,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAiC,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACjF,MAAM,aAAa,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5F,OAAO,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK;QAC1F,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM;QACnE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACrH,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,gCAAgC,CAAC,KAA+B,EAAE,QAA2B,EAC3G,UAAkB,EAAE,QAA+B;IACnD,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,4BAA4B,CAAC,QAAqC,EAAE,QAA2B,EAC7G,WAAmB,EAAE,UAAkB,EAAE,QAA+B;IACxE,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACrC,2BAA2B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnD,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACxE,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,4BAA4B,CAAC,MAAwB,EACnE,QAA2B,EAAE,WAAmB,EAAE,QAA+B;IACjF,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,2BAA2B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnD,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,6BAA6B,CAAC,QAA2B,EAAE,KAAc,EAAE,GAAW,EAAE,KAAc;IACpH,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,GAAG,GAAG,UAAU,CAAC,UAAU;QAAE,MAAM,aAAa,CAAC,wBAAwB,EAAE,6BAA6B,CAAC,CAAC;IAC7H,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,aAAa,CAAC,0BAA0B,EAAE,6BAA6B,CAAC,CAAC;IACxH,IAAI,UAAU,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpF,MAAM,aAAa,CAAC,sBAAsB,EAAE,oCAAoC,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;0FAC0F;AAC1F,MAAM,UAAU,qBAAqB,CAAC,UAAgC,EAAE,QAAgB,EAAE,GAAW;IACnG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,QAAQ,KAAK,mBAAmB,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ;QAC7E,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC;QAChH,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;AAC9G,CAAC;AAED,+DAA+D;AAC/D,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW;IACtE,aAAa,EAAE,YAAY,EAAE,YAAY;CACjC,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAgC,EAChC,OAAoC,EACpC,QAA2B,EAC3B,WAAmB,EACnB,QAAgB,EAChB,GAAW;IAEX,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,cAAc,CAAC,CAAC;QAClG,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACpD,4BAA4B,CAAC,MAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC7D,IAAI,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAAE,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAiC,CAAC;QACvE,IAAI,UAAU,CAAC,QAAQ,KAAK,mBAAmB;YAC3C,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;YACtD,IAAI,UAAU,CAAC,WAAW,KAAK,MAAO,CAAC,WAAW,IAAI,UAAU,CAAC,UAAU,KAAK,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK;gBACxG,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,iBAAiB,CAAC,CAAC;IACnG,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,UAAU,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtG,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjG,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAgC,EAChC,OAAoC,EACpC,QAA2B,EAC3B,WAAmB;IAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACtD,IAAI,QAA0C,CAAC;IAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,4BAA4B,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACtE,QAAQ,GAAG,+BAA+B,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,CAAC,GAAG,QAAS,CAAC;IACpB,yEAAyE;IACzE,MAAM,MAAM,GAAG;QACb,GAAG,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa;KAClG,CAAC;IACX,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACnE,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,cAAc,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,aAAa,CAAC,KAA+B;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,OAA2D,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,KAA+B,EAAE,QAA+B;IACrF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;YAAE,MAAM,aAAa,CAAC,sBAAsB,EAAE,yCAAyC,CAAC,CAAC;QAC7H,OAAO;IACT,CAAC;IACD,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;IACpG,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAK,KAAK,CAAC,OAAkC,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC;IAC9H,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,QAAQ,CAAC,YAAY,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,mBAAmB,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7H,MAAM,aAAa,CAAC,8BAA8B,EAAE,2DAA2D,CAAC,CAAC;IACnH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAA+B,EAAE,QAA2B,EAAE,UAAkB,EACtG,QAA0C,EAAE,UAAmB;IAC/D,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAAC,SAAS,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAAC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnJ,IAAI,KAAK,CAAC,QAAQ,KAAK,mBAAmB;QAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC;IAC9C,IAAI,KAAK;QAAE,8BAA8B,CAAC,KAAK,CAAC,OAAiC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;SAChG,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAAE,+BAA+B,CAAC,KAAK,CAAC,OAAkC,CAAC,CAAC;;QAChH,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAChC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE;QAAE,MAAM,aAAa,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IACrH,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU;QAAE,MAAM,aAAa,CAAC,wBAAwB,EAAE,4CAA4C,CAAC,CAAC;IAC7G,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,aAAa,CAAC,0BAA0B,EAAE,mCAAmC,CAAC,CAAC;IAC9H,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,GAAG,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACzL,MAAM,aAAa,CAAC,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/B,IAAI,QAAQ,IAAI,UAAU,GAAG,QAAQ,CAAC,WAAW;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrF,IAAI,QAAQ,IAAI,UAAU,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1H,MAAM,aAAa,CAAC,sBAAsB,EAAE,oCAAoC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,KAAK,CAAC,OAAiC,CAAC;QACxD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,UAAU;YAAE,MAAM,aAAa,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QAC9I,IAAI,UAAU,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvH,MAAM,aAAa,CAAC,6BAA6B,EAAE,4CAA4C,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,aAAa,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7F,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;AACnI,CAAC;AACD,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa,EAAE,KAAK,GAAG,KAAK;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACxG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAC,IAAI,IAAI,KAAK,GAAG;YAAE,IAAI,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IAAC,CAAC;IACxH,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;AACjF,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,aAAa,CAAC,oBAAoB,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}