agent-protocols 0.7.0 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +38 -9
- package/dist/delegation.d.ts +98 -29
- package/dist/delegation.d.ts.map +1 -1
- package/dist/delegation.js +377 -51
- package/dist/delegation.js.map +1 -1
- package/dist/discourse.d.ts +196 -74
- package/dist/discourse.d.ts.map +1 -1
- package/dist/discourse.js +568 -116
- package/dist/discourse.js.map +1 -1
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js.map +1 -1
- package/dist/http-client.d.ts +47 -17
- package/dist/http-client.d.ts.map +1 -1
- package/dist/http-client.js +118 -39
- package/dist/http-client.js.map +1 -1
- package/dist/identity.d.ts +101 -4
- package/dist/identity.d.ts.map +1 -1
- package/dist/identity.js +334 -8
- package/dist/identity.js.map +1 -1
- package/dist/local-connector/catalog.d.ts +1 -16
- package/dist/local-connector/catalog.d.ts.map +1 -1
- package/dist/local-connector/catalog.js +53 -63
- package/dist/local-connector/catalog.js.map +1 -1
- package/dist/local-connector/engine.d.ts +57 -33
- package/dist/local-connector/engine.d.ts.map +1 -1
- package/dist/local-connector/engine.js +652 -607
- package/dist/local-connector/engine.js.map +1 -1
- package/dist/local-connector/inputs.d.ts +29 -76
- package/dist/local-connector/inputs.d.ts.map +1 -1
- package/dist/local-connector/inputs.js +19 -1
- package/dist/local-connector/inputs.js.map +1 -1
- package/dist/local-connector/projection.d.ts +24 -9
- package/dist/local-connector/projection.d.ts.map +1 -1
- package/dist/local-connector/projection.js +79 -40
- package/dist/local-connector/projection.js.map +1 -1
- package/dist/local-connector/state.d.ts +10 -3
- package/dist/local-connector/state.d.ts.map +1 -1
- package/dist/local-connector/state.js +3 -0
- package/dist/local-connector/state.js.map +1 -1
- package/dist/local-connector/views.d.ts +36 -12
- package/dist/local-connector/views.d.ts.map +1 -1
- package/dist/local-connector/views.js +49 -31
- package/dist/local-connector/views.js.map +1 -1
- package/dist/profile.d.ts +23 -9
- package/dist/profile.d.ts.map +1 -1
- package/dist/profile.js +120 -3
- package/dist/profile.js.map +1 -1
- package/package.json +5 -5
package/dist/delegation.js
CHANGED
|
@@ -1,34 +1,110 @@
|
|
|
1
|
+
import canonicalize from "canonicalize";
|
|
1
2
|
import { protocolError } from "./errors.js";
|
|
2
|
-
import { createEvent, validateAgentId, verifyEnvelope, } from "./identity.js";
|
|
3
|
+
import { AGENT_ID_PREFIX, createEvent, validateAgentId, validateEventFields, validateOrigin, verifyEnvelope, } from "./identity.js";
|
|
3
4
|
export const DELEGATION_PROTOCOL = "agent-delegation/1.0";
|
|
4
5
|
export const DELEGATION_GRANT = "delegation.grant";
|
|
5
6
|
export const DELEGATION_REVOKE = "delegation.revoke";
|
|
7
|
+
/** Delegation IDs are unreserved URL characters: no percent-encoding, no look-alikes. */
|
|
8
|
+
export const DELEGATION_ID_PATTERN = /^[A-Za-z0-9._~-]{1,128}$/;
|
|
9
|
+
/** Delegation-specific error codes (Agent Delegation Section 9.7). */
|
|
10
|
+
export const DELEGATION_ERROR_CODES = [
|
|
11
|
+
"principal_unresolvable",
|
|
12
|
+
"principal_not_canonical",
|
|
13
|
+
"controller_not_current",
|
|
14
|
+
"delegation_not_permitted",
|
|
15
|
+
"delegation_ceiling_exceeded",
|
|
16
|
+
"not_owner_controller",
|
|
17
|
+
"credential_not_found",
|
|
18
|
+
"credential_identity_mismatch",
|
|
19
|
+
"grant_expired",
|
|
20
|
+
];
|
|
6
21
|
export function delegationGrantEvent(actor, createdAt, nonce, payload) {
|
|
7
22
|
return createEvent(DELEGATION_PROTOCOL, DELEGATION_GRANT, actor, createdAt, nonce, payload);
|
|
8
23
|
}
|
|
9
24
|
export function delegationRevokeEvent(actor, createdAt, nonce, payload) {
|
|
10
25
|
return createEvent(DELEGATION_PROTOCOL, DELEGATION_REVOKE, actor, createdAt, nonce, payload);
|
|
11
26
|
}
|
|
27
|
+
export function validateController(controller, retired = false) {
|
|
28
|
+
if (!isRecord(controller))
|
|
29
|
+
fail("controller must be an object");
|
|
30
|
+
validateAgentId(controller.id);
|
|
31
|
+
if (controller.source !== "local")
|
|
32
|
+
validateOrigin(controller.source);
|
|
33
|
+
timestamp(controller.valid_from, "valid_from");
|
|
34
|
+
if (controller.name !== undefined)
|
|
35
|
+
validateNonEmpty(controller.name, "name");
|
|
36
|
+
if (controller.delegation !== undefined && controller.delegation !== "*") {
|
|
37
|
+
const policy = controller.delegation;
|
|
38
|
+
if (!isRecord(policy) || Object.keys(policy).sort().join(",") !== "audiences,scopes")
|
|
39
|
+
fail("invalid delegation policy");
|
|
40
|
+
stringList(policy.scopes, "scopes");
|
|
41
|
+
stringList(policy.audiences, "audiences");
|
|
42
|
+
for (const audience of policy.audiences)
|
|
43
|
+
validateAudience(audience);
|
|
44
|
+
}
|
|
45
|
+
if (controller.supersedes !== undefined) {
|
|
46
|
+
stringList(controller.supersedes, "supersedes");
|
|
47
|
+
for (const id of controller.supersedes)
|
|
48
|
+
validateAgentId(id);
|
|
49
|
+
}
|
|
50
|
+
if (retired) {
|
|
51
|
+
timestamp(controller.retired_at, "retired_at");
|
|
52
|
+
if (controller.retired_at < controller.valid_from)
|
|
53
|
+
fail("retired_at precedes valid_from");
|
|
54
|
+
if (controller.invalid_from !== undefined) {
|
|
55
|
+
timestamp(controller.invalid_from, "invalid_from");
|
|
56
|
+
if (controller.invalid_from < controller.valid_from || controller.invalid_from > controller.retired_at)
|
|
57
|
+
fail("invalid compromise interval");
|
|
58
|
+
}
|
|
59
|
+
}
|
|
60
|
+
else if (controller.retired_at !== undefined || controller.invalid_from !== undefined)
|
|
61
|
+
fail("current controller has retirement fields");
|
|
62
|
+
}
|
|
12
63
|
export function validatePrincipalDocument(document) {
|
|
64
|
+
if (!isRecord(document))
|
|
65
|
+
fail("principal must be an object");
|
|
13
66
|
validateHttpsUrl(document.id, "principal.id");
|
|
14
|
-
if (
|
|
15
|
-
|
|
67
|
+
if (document.protocol !== DELEGATION_PROTOCOL)
|
|
68
|
+
fail("invalid principal protocol");
|
|
69
|
+
timestamp(document.updated_at, "updated_at");
|
|
70
|
+
if (!Array.isArray(document.controllers) || (document.retired_controllers !== undefined && !Array.isArray(document.retired_controllers)))
|
|
71
|
+
fail("controllers must be arrays");
|
|
72
|
+
const records = new Map();
|
|
73
|
+
let delegates = false;
|
|
74
|
+
for (const [list, retired] of [[document.controllers, false], [document.retired_controllers ?? [], true]]) {
|
|
75
|
+
for (const record of list) {
|
|
76
|
+
validateController(record, retired);
|
|
77
|
+
if (records.has(record.id))
|
|
78
|
+
fail("duplicate controller key");
|
|
79
|
+
records.set(record.id, record);
|
|
80
|
+
if (record.delegation !== undefined)
|
|
81
|
+
delegates = true;
|
|
82
|
+
if (record.valid_from > document.updated_at || (record.retired_at !== undefined && record.retired_at > document.updated_at))
|
|
83
|
+
fail("controller timestamp exceeds document update");
|
|
84
|
+
}
|
|
16
85
|
}
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
86
|
+
// Succession (Section 5.1): each entry names another, earlier record.
|
|
87
|
+
for (const record of records.values()) {
|
|
88
|
+
for (const id of record.supersedes ?? []) {
|
|
89
|
+
const predecessor = records.get(id);
|
|
90
|
+
if (!predecessor || id === record.id || predecessor.valid_from >= record.valid_from)
|
|
91
|
+
fail("invalid supersedes entry");
|
|
22
92
|
}
|
|
93
|
+
}
|
|
94
|
+
if (document.aliases !== undefined) {
|
|
95
|
+
stringList(document.aliases, "aliases", true);
|
|
23
96
|
for (const alias of document.aliases)
|
|
24
97
|
validateHttpsUrl(alias, "alias");
|
|
25
98
|
}
|
|
26
|
-
if (document.
|
|
99
|
+
if (document.avatar_url !== undefined)
|
|
100
|
+
validateHttpsUrl(document.avatar_url, "avatar_url");
|
|
101
|
+
if (document.delegation_query_url !== undefined)
|
|
27
102
|
validateHttpsUrl(document.delegation_query_url, "delegation_query_url");
|
|
28
|
-
|
|
103
|
+
else if (delegates)
|
|
104
|
+
fail("delegation_query_url is required when a controller carries delegation");
|
|
29
105
|
}
|
|
30
106
|
/**
|
|
31
|
-
* Checks the authoritative-read rule of Agent Delegation Section
|
|
107
|
+
* Checks the authoritative-read rule of Agent Delegation Section 3: a
|
|
32
108
|
* principal document binds controller keys only when it is read at its own
|
|
33
109
|
* `id`. A document served anywhere else is a copy; its `controllers` MUST be
|
|
34
110
|
* discarded and `document.id` resolved instead.
|
|
@@ -46,25 +122,52 @@ export function validatePrincipalResolution(document, resolvedUrl) {
|
|
|
46
122
|
export function isPrincipalAlias(document, url) {
|
|
47
123
|
return document.aliases?.includes(url) ?? false;
|
|
48
124
|
}
|
|
125
|
+
/**
|
|
126
|
+
* The lineage of a controller (Section 5.1): its own ID plus, transitively,
|
|
127
|
+
* every record it supersedes. A restricted controller owns a credential whose
|
|
128
|
+
* `owner_controller` is in its lineage.
|
|
129
|
+
*/
|
|
130
|
+
export function controllerLineage(document, controllerId) {
|
|
131
|
+
const records = new Map();
|
|
132
|
+
for (const record of [...document.controllers, ...document.retired_controllers ?? []])
|
|
133
|
+
records.set(record.id, record);
|
|
134
|
+
const lineage = new Set();
|
|
135
|
+
const pending = [controllerId];
|
|
136
|
+
while (pending.length > 0) {
|
|
137
|
+
const id = pending.pop();
|
|
138
|
+
if (lineage.has(id))
|
|
139
|
+
continue;
|
|
140
|
+
lineage.add(id);
|
|
141
|
+
pending.push(...(records.get(id)?.supersedes ?? []));
|
|
142
|
+
}
|
|
143
|
+
return lineage;
|
|
144
|
+
}
|
|
49
145
|
export function validateDelegationGrantPayload(payload, createdAt) {
|
|
50
|
-
|
|
51
|
-
|
|
146
|
+
if (!isRecord(payload))
|
|
147
|
+
fail("payload must be an object");
|
|
148
|
+
validateDelegationId(payload.id);
|
|
149
|
+
validateHttpsUrl(payload.principal_id, "principal_id");
|
|
52
150
|
validateAgentId(payload.subject);
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
151
|
+
stringList(payload.scopes, "scopes");
|
|
152
|
+
stringList(payload.audiences, "audiences");
|
|
153
|
+
for (const audience of payload.audiences)
|
|
154
|
+
validateAudience(audience);
|
|
155
|
+
if (createdAt !== undefined)
|
|
156
|
+
timestamp(createdAt, "created_at");
|
|
157
|
+
if (payload.not_before !== undefined)
|
|
158
|
+
timestamp(payload.not_before, "not_before");
|
|
159
|
+
if (payload.expires_at !== undefined)
|
|
160
|
+
timestamp(payload.expires_at, "expires_at");
|
|
58
161
|
if (payload.constraints !== undefined && !isRecord(payload.constraints)) {
|
|
59
162
|
throw protocolError("invalid_delegation", "constraints must be an object");
|
|
60
163
|
}
|
|
61
164
|
if (payload.expires_at !== undefined) {
|
|
62
165
|
if (payload.not_before !== undefined &&
|
|
63
166
|
payload.expires_at <= payload.not_before) {
|
|
64
|
-
throw protocolError("
|
|
167
|
+
throw protocolError("grant_expired", "expires_at must be greater than not_before");
|
|
65
168
|
}
|
|
66
169
|
if (createdAt !== undefined && payload.expires_at <= createdAt) {
|
|
67
|
-
throw protocolError("
|
|
170
|
+
throw protocolError("grant_expired", "expires_at must be greater than created_at");
|
|
68
171
|
}
|
|
69
172
|
}
|
|
70
173
|
}
|
|
@@ -78,28 +181,41 @@ export function validateDelegationGrantPayload(payload, createdAt) {
|
|
|
78
181
|
export function validateDelegationQueryRequest(request, options = {}) {
|
|
79
182
|
if (options.allowEnumeration) {
|
|
80
183
|
if (request.subject === undefined && request.principal_id === undefined) {
|
|
81
|
-
throw protocolError("
|
|
184
|
+
throw protocolError("invalid_request", "query must include at least one of subject or principal_id");
|
|
82
185
|
}
|
|
83
186
|
}
|
|
84
187
|
else if (request.subject === undefined || request.principal_id === undefined) {
|
|
85
|
-
throw protocolError("
|
|
188
|
+
throw protocolError("invalid_request", "public query must include both subject and principal_id");
|
|
86
189
|
}
|
|
190
|
+
if (request.id !== undefined)
|
|
191
|
+
validateDelegationId(request.id);
|
|
192
|
+
if (request.status !== undefined && !["active", "suspended", "expired", "revoked"].includes(request.status))
|
|
193
|
+
fail("invalid status");
|
|
87
194
|
if (request.subject !== undefined)
|
|
88
195
|
validateAgentId(request.subject);
|
|
89
196
|
if (request.principal_id !== undefined) {
|
|
90
197
|
validateHttpsUrl(request.principal_id, "principal_id");
|
|
91
198
|
}
|
|
92
199
|
if (request.limit !== undefined &&
|
|
93
|
-
(!Number.
|
|
94
|
-
throw protocolError("
|
|
200
|
+
(!Number.isSafeInteger(request.limit) || request.limit < 1)) {
|
|
201
|
+
throw protocolError("invalid_request", "limit must be a positive integer");
|
|
95
202
|
}
|
|
96
203
|
}
|
|
97
204
|
export function validateDelegationRevokePayload(payload) {
|
|
98
|
-
|
|
205
|
+
if (!isRecord(payload))
|
|
206
|
+
fail("payload must be an object");
|
|
207
|
+
validateDelegationId(payload.id);
|
|
99
208
|
validateHttpsUrl(payload.principal_id, "principal_id");
|
|
100
209
|
}
|
|
210
|
+
export function validateDelegationId(value) {
|
|
211
|
+
if (typeof value !== "string" || !DELEGATION_ID_PATTERN.test(value) || value === "." || value === "..") {
|
|
212
|
+
fail("delegation id must match [A-Za-z0-9._~-]{1,128} and not be a dot segment");
|
|
213
|
+
}
|
|
214
|
+
}
|
|
101
215
|
export function validateDelegationEnvelope(envelope) {
|
|
102
216
|
verifyEnvelope(envelope);
|
|
217
|
+
// Delegation events carry only the six Agent Identity event fields.
|
|
218
|
+
validateEventFields(envelope.event);
|
|
103
219
|
if (envelope.event.protocol !== DELEGATION_PROTOCOL) {
|
|
104
220
|
throw protocolError("invalid_event_protocol", `expected ${DELEGATION_PROTOCOL}, got ${envelope.event.protocol}`);
|
|
105
221
|
}
|
|
@@ -113,33 +229,243 @@ export function validateDelegationEnvelope(envelope) {
|
|
|
113
229
|
throw protocolError("invalid_event_type", `expected ${DELEGATION_GRANT} or ${DELEGATION_REVOKE}, got ${envelope.event.type}`);
|
|
114
230
|
}
|
|
115
231
|
}
|
|
116
|
-
|
|
232
|
+
/** Materializes an already accepted event. The caller supplies trusted previous state
|
|
233
|
+
* and the service's actual acceptance time; this function does not authorize it. */
|
|
234
|
+
export function materializeDelegationCredential(envelope, options) {
|
|
235
|
+
validateDelegationEnvelope(envelope);
|
|
236
|
+
timestamp(options.acceptedAt, "accepted_at");
|
|
237
|
+
const event = envelope.event;
|
|
238
|
+
const previous = options.previous;
|
|
239
|
+
checkPrevious(event, previous);
|
|
240
|
+
if (previous && options.acceptedAt < previous.accepted_at)
|
|
241
|
+
fail("acceptance order reversed");
|
|
242
|
+
const checkedAt = options.checkedAt ?? options.acceptedAt;
|
|
243
|
+
timestamp(checkedAt, "checked_at");
|
|
244
|
+
if (checkedAt < options.acceptedAt)
|
|
245
|
+
fail("checked_at precedes acceptance");
|
|
246
|
+
if (event.type === DELEGATION_REVOKE) {
|
|
247
|
+
if (!previous)
|
|
248
|
+
fail("revocation requires previous credential");
|
|
249
|
+
return { ...structuredClone(previous), controller: event.actor, status: "revoked", event_id: envelope.hash, accepted_at: options.acceptedAt, checked_at: checkedAt };
|
|
250
|
+
}
|
|
251
|
+
const payload = event.payload;
|
|
252
|
+
if (payload.expires_at !== undefined && payload.expires_at <= options.acceptedAt) {
|
|
253
|
+
throw protocolError("grant_expired", "grant expired at acceptance");
|
|
254
|
+
}
|
|
255
|
+
const status = options.status ?? "active";
|
|
256
|
+
if (!["active", "suspended", "expired", "revoked"].includes(status))
|
|
257
|
+
fail("invalid status");
|
|
258
|
+
return { ...structuredClone(payload), protocol: DELEGATION_PROTOCOL, controller: event.actor,
|
|
259
|
+
owner_controller: previous?.owner_controller ?? event.actor, status,
|
|
260
|
+
event_id: envelope.hash, grant_event_id: envelope.hash, accepted_at: options.acceptedAt, checked_at: checkedAt };
|
|
261
|
+
}
|
|
262
|
+
/** Pre-signing authority check. Input previous state and document must be trusted.
|
|
263
|
+
* This does not verify signatures, fetch HTTPS, check cache age, or enforce nonce/time windows. */
|
|
264
|
+
export function validateDelegationEventAuthority(event, document, acceptedAt, previous) {
|
|
265
|
+
checkAuthority(event, document, acceptedAt, previous, false);
|
|
266
|
+
}
|
|
267
|
+
/** Online acceptance checks over a document read at resolvedUrl. Services must also
|
|
268
|
+
* enforce fresh resolution, Identity live replay rules, and atomic persistence. */
|
|
269
|
+
export function validateDelegationAcceptance(envelope, document, resolvedUrl, acceptedAt, previous) {
|
|
117
270
|
validateDelegationEnvelope(envelope);
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
271
|
+
validatePrincipalResolution(document, resolvedUrl);
|
|
272
|
+
checkAuthority(envelope.event, document, acceptedAt, previous, false);
|
|
273
|
+
}
|
|
274
|
+
/** Uses caller-trusted acceptance evidence, never an event's self-reported time as proof.
|
|
275
|
+
* Current status, evidence authenticity and application constraints are separate checks. */
|
|
276
|
+
export function validateHistoricalDelegation(record, document, resolvedUrl, previous) {
|
|
277
|
+
validateDelegationEnvelope(record.envelope);
|
|
278
|
+
validatePrincipalResolution(document, resolvedUrl);
|
|
279
|
+
checkAuthority(record.envelope.event, document, record.accepted_at, previous, true);
|
|
280
|
+
}
|
|
281
|
+
/** Per-result enumeration check; the caller authenticates actor and resolves the document. */
|
|
282
|
+
export function validateControllerEnumeration(document, actor, now, owner) {
|
|
283
|
+
validatePrincipalDocument(document);
|
|
284
|
+
timestamp(now, "now");
|
|
285
|
+
validateAgentId(owner);
|
|
286
|
+
const controller = document.controllers.find(c => c.id === actor);
|
|
287
|
+
if (!controller || now < controller.valid_from)
|
|
288
|
+
throw protocolError("controller_not_current", "controller cannot enumerate");
|
|
289
|
+
if (controller.delegation === undefined)
|
|
290
|
+
throw protocolError("delegation_not_permitted", "controller cannot enumerate");
|
|
291
|
+
if (controller.delegation !== "*" && !controllerLineage(document, actor).has(owner)) {
|
|
292
|
+
throw protocolError("not_owner_controller", "controller does not own credential");
|
|
293
|
+
}
|
|
294
|
+
}
|
|
295
|
+
/** Checks audience/status/time only, after cryptographic and historical verification.
|
|
296
|
+
* The application still authenticates the subject and enforces scopes and constraints. */
|
|
297
|
+
export function validateDelegationUse(credential, audience, now) {
|
|
298
|
+
validateAudience(audience);
|
|
299
|
+
timestamp(now, "now");
|
|
300
|
+
validateDelegationGrantPayload(credential);
|
|
301
|
+
if (credential.protocol !== DELEGATION_PROTOCOL || credential.status !== "active" ||
|
|
302
|
+
!credential.audiences.includes(audience) || (credential.not_before !== undefined && now < credential.not_before) ||
|
|
303
|
+
(credential.expires_at !== undefined && now >= credential.expires_at))
|
|
304
|
+
fail("delegation is not usable");
|
|
305
|
+
}
|
|
306
|
+
/** Grant fields a credential carries from its latest grant. */
|
|
307
|
+
const GRANT_FIELDS = [
|
|
308
|
+
"id", "principal_id", "subject", "relationship", "scopes", "audiences",
|
|
309
|
+
"constraints", "not_before", "expires_at",
|
|
310
|
+
];
|
|
311
|
+
/**
|
|
312
|
+
* Verifies a credential under Agent Delegation Section 8 with the online
|
|
313
|
+
* service-trusting evidence policy: checks the accepted record of its latest
|
|
314
|
+
* grant — signature, Controller binding, ceiling, and authority interval —
|
|
315
|
+
* confirms that the grant matches the credential, and then checks use for
|
|
316
|
+
* `audience` at `now`. Ownership and `supersedes` lineage govern management,
|
|
317
|
+
* which the service enforced at acceptance; auditors replay them with
|
|
318
|
+
* {@link auditDelegationHistory}. Relying parties still enforce scopes and
|
|
319
|
+
* constraints and authenticate the subject.
|
|
320
|
+
*/
|
|
321
|
+
export function verifyDelegationCredential(credential, records, document, resolvedUrl, audience, now) {
|
|
322
|
+
const reasons = [];
|
|
323
|
+
try {
|
|
324
|
+
const record = records.find((candidate) => candidate.envelope.hash === credential.grant_event_id);
|
|
325
|
+
if (!record)
|
|
326
|
+
fail("latest grant record is missing");
|
|
327
|
+
validateHistoricalDelegation(record, document, resolvedUrl);
|
|
328
|
+
if (record.envelope.event.type !== DELEGATION_GRANT)
|
|
329
|
+
fail("grant_event_id does not name a grant");
|
|
330
|
+
const grant = record.envelope.event.payload;
|
|
331
|
+
if (credential.protocol !== DELEGATION_PROTOCOL ||
|
|
332
|
+
GRANT_FIELDS.some((field) => canonicalize(grant[field]) !== canonicalize(credential[field]))) {
|
|
333
|
+
fail("credential does not match its latest grant");
|
|
334
|
+
}
|
|
335
|
+
if (credential.event_id === credential.grant_event_id) {
|
|
336
|
+
if (credential.accepted_at !== record.accepted_at || credential.controller !== record.envelope.event.actor ||
|
|
337
|
+
credential.status === "revoked") {
|
|
338
|
+
fail("credential does not match its latest grant");
|
|
339
|
+
}
|
|
340
|
+
}
|
|
341
|
+
else if (credential.status !== "revoked") {
|
|
342
|
+
fail("a credential last changed by a revocation must be revoked");
|
|
343
|
+
}
|
|
344
|
+
}
|
|
345
|
+
catch (error) {
|
|
346
|
+
reasons.push(error instanceof Error ? error.message : String(error));
|
|
347
|
+
}
|
|
348
|
+
const verified = reasons.length === 0;
|
|
349
|
+
if (credential.status !== "active")
|
|
350
|
+
reasons.push(`status is ${credential.status}`);
|
|
351
|
+
if (!credential.audiences?.includes(audience))
|
|
352
|
+
reasons.push(`audience ${audience} is not granted`);
|
|
353
|
+
if (credential.not_before !== undefined && now < credential.not_before)
|
|
354
|
+
reasons.push("not yet valid");
|
|
355
|
+
if (credential.expires_at !== undefined && now >= credential.expires_at)
|
|
356
|
+
reasons.push("expired");
|
|
357
|
+
return { credential, verified, usable: reasons.length === 0, reasons };
|
|
358
|
+
}
|
|
359
|
+
/**
|
|
360
|
+
* Auditor check (Section 8): replays every accepted record of a credential
|
|
361
|
+
* against the authoritative principal document — signatures, controller
|
|
362
|
+
* intervals, ceilings, and ownership lineage — and confirms that the replay
|
|
363
|
+
* matches the credential. Relying parties use {@link verifyDelegationCredential}.
|
|
364
|
+
*/
|
|
365
|
+
export function auditDelegationHistory(credential, records, document, resolvedUrl) {
|
|
366
|
+
if (records.length === 0)
|
|
367
|
+
fail("no accepted records");
|
|
368
|
+
let replayed;
|
|
369
|
+
for (const record of records) {
|
|
370
|
+
validateHistoricalDelegation(record, document, resolvedUrl, replayed);
|
|
371
|
+
replayed = materializeDelegationCredential(record.envelope, { acceptedAt: record.accepted_at, previous: replayed });
|
|
372
|
+
}
|
|
373
|
+
const r = replayed;
|
|
374
|
+
// Only status and the service's check time may differ from event replay.
|
|
375
|
+
const fields = [
|
|
376
|
+
...GRANT_FIELDS, "protocol", "event_id", "grant_event_id", "owner_controller", "controller", "accepted_at",
|
|
377
|
+
];
|
|
378
|
+
if (fields.some((field) => canonicalize(r[field]) !== canonicalize(credential[field])) ||
|
|
379
|
+
(r.status === "revoked") !== (credential.status === "revoked")) {
|
|
380
|
+
fail("credential does not match its accepted records");
|
|
381
|
+
}
|
|
382
|
+
}
|
|
383
|
+
/** A relying-party audience (Section 5): an origin for a relying application, or an Agent ID for a relying agent. */
|
|
384
|
+
export function validateAudience(value) {
|
|
385
|
+
if (typeof value === "string" && value.startsWith(AGENT_ID_PREFIX)) {
|
|
386
|
+
validateAgentId(value);
|
|
387
|
+
return;
|
|
388
|
+
}
|
|
389
|
+
validateOrigin(value);
|
|
390
|
+
}
|
|
391
|
+
function eventIdentity(event) {
|
|
392
|
+
const payload = event.payload;
|
|
393
|
+
return { id: payload.id, principalId: payload.principal_id };
|
|
394
|
+
}
|
|
395
|
+
function checkPrevious(event, previous) {
|
|
396
|
+
if (!previous) {
|
|
397
|
+
if (event.type === DELEGATION_REVOKE)
|
|
398
|
+
throw protocolError("credential_not_found", "revocation requires previous credential");
|
|
399
|
+
return;
|
|
400
|
+
}
|
|
401
|
+
validateAgentId(previous.owner_controller);
|
|
402
|
+
timestamp(previous.accepted_at, "previous.accepted_at");
|
|
403
|
+
const { id, principalId } = eventIdentity(event);
|
|
404
|
+
const sameSubject = event.type !== DELEGATION_GRANT || event.payload.subject === previous.subject;
|
|
405
|
+
if (previous.id !== id || previous.principal_id !== principalId || previous.protocol !== DELEGATION_PROTOCOL || !sameSubject) {
|
|
406
|
+
throw protocolError("credential_identity_mismatch", "credential principal, subject, and protocol are immutable");
|
|
407
|
+
}
|
|
408
|
+
}
|
|
409
|
+
function checkAuthority(event, document, acceptedAt, previous, historical) {
|
|
410
|
+
validatePrincipalDocument(document);
|
|
411
|
+
timestamp(acceptedAt, "accepted_at");
|
|
412
|
+
timestamp(event.created_at, "created_at");
|
|
413
|
+
validateAgentId(event.actor);
|
|
414
|
+
if (event.protocol !== DELEGATION_PROTOCOL)
|
|
415
|
+
fail("invalid event protocol");
|
|
416
|
+
const grant = event.type === DELEGATION_GRANT;
|
|
417
|
+
if (grant)
|
|
418
|
+
validateDelegationGrantPayload(event.payload, event.created_at);
|
|
419
|
+
else if (event.type === DELEGATION_REVOKE)
|
|
420
|
+
validateDelegationRevokePayload(event.payload);
|
|
421
|
+
else
|
|
422
|
+
fail("invalid event type");
|
|
423
|
+
if (eventIdentity(event).principalId !== document.id)
|
|
424
|
+
throw protocolError("principal_not_canonical", "principal mismatch");
|
|
425
|
+
const records = historical ? [...document.controllers, ...document.retired_controllers ?? []] : document.controllers;
|
|
426
|
+
const controller = records.find(c => c.id === event.actor);
|
|
427
|
+
if (!controller)
|
|
428
|
+
throw protocolError("controller_not_current", "actor is not a controller of the principal");
|
|
429
|
+
if (controller.delegation === undefined)
|
|
430
|
+
throw protocolError("delegation_not_permitted", "actor has no delegation authority");
|
|
431
|
+
for (const time of [event.created_at, acceptedAt]) {
|
|
432
|
+
if (time < controller.valid_from || (controller.retired_at !== undefined && time >= controller.retired_at) || (controller.invalid_from !== undefined && time >= controller.invalid_from)) {
|
|
433
|
+
throw protocolError("controller_not_current", "outside controller authority interval");
|
|
434
|
+
}
|
|
435
|
+
}
|
|
436
|
+
checkPrevious(event, previous);
|
|
437
|
+
if (previous && acceptedAt < previous.accepted_at)
|
|
438
|
+
fail("acceptance order reversed");
|
|
439
|
+
if (previous && controller.delegation !== "*" && !controllerLineage(document, event.actor).has(previous.owner_controller)) {
|
|
440
|
+
throw protocolError("not_owner_controller", "controller does not own credential");
|
|
441
|
+
}
|
|
442
|
+
if (grant) {
|
|
443
|
+
const payload = event.payload;
|
|
444
|
+
if (payload.expires_at !== undefined && payload.expires_at <= acceptedAt)
|
|
445
|
+
throw protocolError("grant_expired", "grant expired at acceptance");
|
|
446
|
+
if (controller.delegation !== "*") {
|
|
447
|
+
const policy = controller.delegation;
|
|
448
|
+
if (payload.scopes.some(x => !policy.scopes.includes(x)) || payload.audiences.some(x => !policy.audiences.includes(x))) {
|
|
449
|
+
throw protocolError("delegation_ceiling_exceeded", "grant exceeds controller delegation policy");
|
|
450
|
+
}
|
|
451
|
+
}
|
|
452
|
+
}
|
|
453
|
+
}
|
|
454
|
+
function fail(message) { throw protocolError("invalid_delegation", message); }
|
|
455
|
+
function timestamp(value, field) {
|
|
456
|
+
if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
|
|
457
|
+
fail(`${field} must be a non-negative safe integer`);
|
|
458
|
+
}
|
|
459
|
+
function stringList(value, field, empty = false) {
|
|
460
|
+
if (!Array.isArray(value) || (!empty && value.length === 0))
|
|
461
|
+
fail(`${field} must be a non-empty array`);
|
|
462
|
+
for (const item of value) {
|
|
463
|
+
validateNonEmpty(item, field);
|
|
464
|
+
if (item === "*")
|
|
465
|
+
fail(`${field} cannot contain wildcard`);
|
|
466
|
+
}
|
|
467
|
+
if (new Set(value).size !== value.length)
|
|
468
|
+
fail(`${field} contains duplicates`);
|
|
143
469
|
}
|
|
144
470
|
function validateHttpsUrl(value, field) {
|
|
145
471
|
if (typeof value !== "string") {
|
package/dist/delegation.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../src/delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAIL,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAsHrD,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,SAAiB,EACjB,KAAa,EACb,OAA+B;IAE/B,OAAO,WAAW,CAChB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,EACL,SAAS,EACT,KAAK,EACL,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,SAAiB,EACjB,KAAa,EACb,OAAgC;IAEhC,OAAO,WAAW,CAChB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,EACL,SAAS,EACT,KAAK,EACL,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,aAAa,CACjB,mBAAmB,EACnB,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW;QAAE,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,aAAa,CAAC,mBAAmB,EAAE,0BAA0B,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO;YAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAChD,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA2B,EAC3B,WAAmB;IAEnB,IAAI,QAAQ,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,aAAa,CACjB,mBAAmB,EACnB,yBAAyB,QAAQ,CAAC,EAAE,kBAAkB,WAAW,EAAE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,GAAW;IAEX,OAAO,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,SAAkB;IAElB,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC3C,2BAA2B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,aAAa,CAAC,oBAAoB,EAAE,qCAAqC,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM;QAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,aAAa,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,IACE,OAAO,CAAC,UAAU,KAAK,SAAS;YAChC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,EACxC,CAAC;YACD,MAAM,aAAa,CACjB,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;YAC/D,MAAM,aAAa,CACjB,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,UAA0C,EAAE;IAE5C,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,aAAa,CACjB,oBAAoB,EACpB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/E,MAAM,aAAa,CACjB,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;IACD,IACE,OAAO,CAAC,KAAK,KAAK,SAAS;QAC3B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EACvD,CAAC;QACD,MAAM,aAAa,CACjB,oBAAoB,EACpB,kCAAkC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAgC;IAEhC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC3C,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAAqC;IAErC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACpD,MAAM,aAAa,CACjB,wBAAwB,EACxB,YAAY,mBAAmB,SAAS,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC7C,8BAA8B,CAC5B,QAAQ,CAAC,KAAK,CAAC,OAAiC,EAChD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAC1B,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrD,+BAA+B,CAC7B,QAAQ,CAAC,KAAK,CAAC,OAAkC,CAClD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,CACjB,oBAAoB,EACpB,YAAY,gBAAgB,OAAO,iBAAiB,SAAS,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,QAA0C,EAC1C,UAGI,EAAE;IAEN,0BAA0B,CAAC,QAAuC,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC7C,MAAM,aAAa,CACjB,oBAAoB,EACpB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;IACvC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,mBAAmB;QAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ;QAClC,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,UAAU;QAC1D,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,SAA8B;IACjE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,mBAAmB,EAAE,6BAA6B,CAAC,CAAC;IAC1E,CAAC;IACD,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,aAAa,CAAC,oBAAoB,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
|
|
1
|
+
{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../src/delegation.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,eAAe,EAMf,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEhE,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,wBAAwB;IACxB,yBAAyB;IACzB,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,sBAAsB;IACtB,sBAAsB;IACtB,8BAA8B;IAC9B,eAAe;CAChB,CAAC;AAuIF,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,SAAiB,EACjB,KAAa,EACb,OAA+B;IAE/B,OAAO,WAAW,CAChB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,EACL,SAAS,EACT,KAAK,EACL,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,SAAiB,EACjB,KAAa,EACb,OAAgC;IAEhC,OAAO,WAAW,CAChB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,EACL,SAAS,EACT,KAAK,EACL,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAsB,EAAE,OAAO,GAAG,KAAK;IACxE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAChE,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO;QAAE,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrE,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS;QAAE,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7E,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,kBAAkB;YAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxH,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC1C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;YAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChD,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,UAAU;YAAE,eAAe,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,UAAW,GAAG,UAAU,CAAC,UAAU;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC3F,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,YAAY,GAAG,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,YAAY,GAAG,UAAU,CAAC,UAAW;gBAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC/I,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,0CAA0C,CAAC,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7D,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,QAAQ,KAAK,mBAAmB;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAClF,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC7K,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,EAAE,IAAI,CAAC,CAAU,EAAE,CAAC;QACnH,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;gBAAE,SAAS,GAAG,IAAI,CAAC;YACtD,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;gBAAE,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACpL,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpC,IAAI,CAAC,WAAW,IAAI,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,WAAW,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU;gBAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO;YAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;QAAE,gBAAgB,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,oBAAoB,KAAK,SAAS;QAAE,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;SACpH,IAAI,SAAS;QAAE,IAAI,CAAC,uEAAuE,CAAC,CAAC;AACpG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA2B,EAC3B,WAAmB;IAEnB,IAAI,QAAQ,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,aAAa,CACjB,mBAAmB,EACnB,yBAAyB,QAAQ,CAAC,EAAE,kBAAkB,WAAW,EAAE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,GAAW;IAEX,OAAO,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B,EAAE,YAAqB;IAClF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACtH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAW,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,SAAkB;IAElB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC1D,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS;QAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACrE,IAAI,SAAS,KAAK,SAAS;QAAE,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,aAAa,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,IACE,OAAO,CAAC,UAAU,KAAK,SAAS;YAChC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,EACxC,CAAC;YACD,MAAM,aAAa,CACjB,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;YAC/D,MAAM,aAAa,CACjB,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,OAAO,GAAmC,EAAE;IAE5C,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,aAAa,CACjB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/E,MAAM,aAAa,CACjB,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS;QAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpI,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;IACD,IACE,OAAO,CAAC,KAAK,KAAK,SAAS;QAC3B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAC3D,CAAC;QACD,MAAM,aAAa,CACjB,iBAAiB,EACjB,kCAAkC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAAgC;IAEhC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC1D,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACvG,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAAqC;IAErC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,oEAAoE;IACpE,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACpD,MAAM,aAAa,CACjB,wBAAwB,EACxB,YAAY,mBAAmB,SAAS,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC7C,8BAA8B,CAC5B,QAAQ,CAAC,KAAK,CAAC,OAAiC,EAChD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAC1B,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrD,+BAA+B,CAC7B,QAAQ,CAAC,KAAK,CAAC,OAAkC,CAClD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,CACjB,oBAAoB,EACpB,YAAY,gBAAgB,OAAO,iBAAiB,SAAS,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,+BAA+B,CAC7C,QAAqC,EACrC,OAA+G;IAE/G,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACrC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/B,IAAI,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,WAAW;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC;IAC1D,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACnC,IAAI,SAAS,GAAG,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC3E,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,eAAe,CAAC,QAAS,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACxK,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAiC,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACjF,MAAM,aAAa,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5F,OAAO,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK;QAC1F,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM;QACnE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACrH,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,gCAAgC,CAAC,KAA+B,EAAE,QAA2B,EAC3G,UAAkB,EAAE,QAA+B;IACnD,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,4BAA4B,CAAC,QAAqC,EAAE,QAA2B,EAC7G,WAAmB,EAAE,UAAkB,EAAE,QAA+B;IACxE,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACrC,2BAA2B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnD,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACxE,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,4BAA4B,CAAC,MAAwB,EACnE,QAA2B,EAAE,WAAmB,EAAE,QAA+B;IACjF,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,2BAA2B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnD,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,6BAA6B,CAAC,QAA2B,EAAE,KAAc,EAAE,GAAW,EAAE,KAAc;IACpH,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,GAAG,GAAG,UAAU,CAAC,UAAU;QAAE,MAAM,aAAa,CAAC,wBAAwB,EAAE,6BAA6B,CAAC,CAAC;IAC7H,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,aAAa,CAAC,0BAA0B,EAAE,6BAA6B,CAAC,CAAC;IACxH,IAAI,UAAU,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpF,MAAM,aAAa,CAAC,sBAAsB,EAAE,oCAAoC,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;0FAC0F;AAC1F,MAAM,UAAU,qBAAqB,CAAC,UAAgC,EAAE,QAAgB,EAAE,GAAW;IACnG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,QAAQ,KAAK,mBAAmB,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ;QAC7E,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC;QAChH,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;AAC9G,CAAC;AAED,+DAA+D;AAC/D,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW;IACtE,aAAa,EAAE,YAAY,EAAE,YAAY;CACjC,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAgC,EAChC,OAAoC,EACpC,QAA2B,EAC3B,WAAmB,EACnB,QAAgB,EAChB,GAAW;IAEX,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,cAAc,CAAC,CAAC;QAClG,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACpD,4BAA4B,CAAC,MAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC7D,IAAI,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAAE,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAiC,CAAC;QACvE,IAAI,UAAU,CAAC,QAAQ,KAAK,mBAAmB;YAC3C,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;YACtD,IAAI,UAAU,CAAC,WAAW,KAAK,MAAO,CAAC,WAAW,IAAI,UAAU,CAAC,UAAU,KAAK,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK;gBACxG,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,iBAAiB,CAAC,CAAC;IACnG,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,UAAU,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtG,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjG,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAgC,EAChC,OAAoC,EACpC,QAA2B,EAC3B,WAAmB;IAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACtD,IAAI,QAA0C,CAAC;IAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,4BAA4B,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACtE,QAAQ,GAAG,+BAA+B,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,CAAC,GAAG,QAAS,CAAC;IACpB,yEAAyE;IACzE,MAAM,MAAM,GAAG;QACb,GAAG,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa;KAClG,CAAC;IACX,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACnE,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,cAAc,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,aAAa,CAAC,KAA+B;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,OAA2D,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,KAA+B,EAAE,QAA+B;IACrF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;YAAE,MAAM,aAAa,CAAC,sBAAsB,EAAE,yCAAyC,CAAC,CAAC;QAC7H,OAAO;IACT,CAAC;IACD,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;IACpG,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAK,KAAK,CAAC,OAAkC,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC;IAC9H,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,QAAQ,CAAC,YAAY,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,mBAAmB,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7H,MAAM,aAAa,CAAC,8BAA8B,EAAE,2DAA2D,CAAC,CAAC;IACnH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAA+B,EAAE,QAA2B,EAAE,UAAkB,EACtG,QAA0C,EAAE,UAAmB;IAC/D,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAAC,SAAS,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAAC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnJ,IAAI,KAAK,CAAC,QAAQ,KAAK,mBAAmB;QAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC;IAC9C,IAAI,KAAK;QAAE,8BAA8B,CAAC,KAAK,CAAC,OAAiC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;SAChG,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAAE,+BAA+B,CAAC,KAAK,CAAC,OAAkC,CAAC,CAAC;;QAChH,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAChC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE;QAAE,MAAM,aAAa,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IACrH,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU;QAAE,MAAM,aAAa,CAAC,wBAAwB,EAAE,4CAA4C,CAAC,CAAC;IAC7G,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,aAAa,CAAC,0BAA0B,EAAE,mCAAmC,CAAC,CAAC;IAC9H,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,GAAG,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACzL,MAAM,aAAa,CAAC,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/B,IAAI,QAAQ,IAAI,UAAU,GAAG,QAAQ,CAAC,WAAW;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrF,IAAI,QAAQ,IAAI,UAAU,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1H,MAAM,aAAa,CAAC,sBAAsB,EAAE,oCAAoC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,KAAK,CAAC,OAAiC,CAAC;QACxD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,UAAU;YAAE,MAAM,aAAa,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QAC9I,IAAI,UAAU,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvH,MAAM,aAAa,CAAC,6BAA6B,EAAE,4CAA4C,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,aAAa,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7F,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;AACnI,CAAC;AACD,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa,EAAE,KAAK,GAAG,KAAK;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACxG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAC,IAAI,IAAI,KAAK,GAAG;YAAE,IAAI,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IAAC,CAAC;IACxH,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;AACjF,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,aAAa,CAAC,oBAAoB,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
|