aqta-verify-receipt 1.2.6 → 1.3.0

package/README.md

@@ -34,7 +34,7 @@ Invalid:
 ✕ invalid  signature mismatch  2d41…871e94c
 ```
 
-Optional flourish (never the proof):
+Optional human-readable summary (the compact line and exit code are the result):
 
 ```bash
 npx aqta-verify-receipt receipt.json --key <pinned> --pretty
@@ -110,11 +110,11 @@ aqta-verify-receipt <file|-> --integrity-only [options]
 
 | Flag | Meaning |
 |------|---------|
-| `--key` | Pin issuer identity (required for counsel-grade). |
+| `--key` | Pin the issuer key. Required unless `--integrity-only`. |
 | `--integrity-only` | Signature vs embedded key only; returns untrusted. Anyone can self-sign. |
 | `--no-strict` | Allow unknown top-level fields |
 | `--json` | One JSON object on stdout |
-| `--pretty` | Optional human flourish after the compact line (not the proof) |
+| `--pretty` | Optional human-readable summary after the compact line |
 | `-q` | Silent; exit code only |
 
 `NO_COLOR=1` disables colour. Meaning never depends on colour alone.
@@ -138,6 +138,26 @@ Default: `https://app.aqta.ai/security/pubkey.txt`. Same material as
 Conformance suite, covering receipts, agent action records and transparency proofs:
 [`test-vectors/`](https://github.com/Aqta-ai/attestation-spec/tree/main/test-vectors).
 
+## Chain profile (draft)
+
+GRANT-v1 and USE-v1 are **draft specifications, not frozen**; their wire
+formats may change. `--profile chain` checks a bundle of GRANT-v1 approvals,
+USE-v1 records and the ACTION-v1 records they authorised, and returns `PASS`,
+`FAIL` or `INCOMPLETE`. Missing evidence is `INCOMPLETE`, never `PASS`, and
+without `--approver-keys` an authorised action is `INCOMPLETE`.
+
+```bash
+npx aqta-verify-receipt bundle.json --profile chain --key <issuer key> --approver-keys <k1,k2>
+```
+
+Exit 0 `PASS`, 1 `FAIL`, 3 `INCOMPLETE`, 2 usage or IO. `--key` is required;
+`--integrity-only` and `--no-strict` are refused. Library:
+`require('aqta-verify-receipt/dist/chain.js').verifyChain(bundle, { trustedPublicKey, approverKeys })`.
+Opt-in only: nothing selects this profile from a record's shape. The two
+separately written verifiers, this one and the Python one, must return the
+same verdict and reason on every vector in
+[`test-vectors/chain/`](https://github.com/Aqta-ai/attestation-spec/tree/main/test-vectors/chain).
+
 ## Transparency proofs
 
 A receipt signature answers what the issuer asserted. It cannot answer whether
@@ -166,11 +186,10 @@ An inclusion proof establishes that what you were shown is genuinely in the
 log. It does not establish that what you were **not** shown is irrelevant.
 That is omission, and it is open.
 
-## What this is not
+## Scope
 
-Not a governance dashboard. Not a cost router. Not a chain explorer.
-A small verifier for signed decision records and the log proofs that accompany them. The novel part is the
-receipt format and offline verification model, not ASCII theatre.
+A small offline verifier for signed decision records and the log proofs that accompany them. It reads a
+record and a key, and reports a verdict. It does not store, send or host records, and it never contacts Aqta.
 
 ## Security
 

package/dist/chain.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The `chain` profile (spec/USE-v1.md section 9), GRANT-v1 (spec/GRANT-v1.md)
+ * and USE-v1 (spec/USE-v1.md). DRAFT: both record formats are drafts, not
+ * frozen.
+ *
+ * Three verdicts, never two: PASS, FAIL, INCOMPLETE. Missing evidence is never
+ * a pass. The check order and every reason string are a cross-implementation
+ * contract with the Python verifier (aqta_verify_receipt/chain.py): first FAIL
+ * wins, and the two must return the same verdict and reason on the same bytes.
+ *
+ * Explicit opt-in only. Nothing here is reached by inspecting input shape.
+ * Node-only, like transparency.ts: it needs SHA-256.
+ */
+export type ChainVerdict = 'PASS' | 'FAIL' | 'INCOMPLETE';
+export interface ChainResult {
+    verdict: ChainVerdict;
+    reason: string | null;
+}
+export interface ChainOptions {
+    trustedPublicKey?: string;
+    /** The relying party's designated approver keys. Absent: authorised actions are INCOMPLETE. */
+    approverKeys?: string[] | null;
+}
+type Obj = Record<string, unknown>;
+declare function cmpInstant(a: string, b: string): number;
+/** Integrity of one grant: null when it holds, else the reason. Says nothing about authority. */
+export declare function checkGrantRecord(grant: unknown): string | null;
+export declare function grantHash(grant: Obj): string;
+export declare function checkUseRecord(use: unknown, trustedPublicKey: string | undefined): string | null;
+/** Verify a chain bundle. Never throws. */
+export declare function verifyChain(bundle: unknown, options?: ChainOptions): ChainResult;
+/** Internal, for the interop sweep only: the exact-instant comparator. */
+export declare const _chainInternal: {
+    cmpInstant: typeof cmpInstant;
+};
+export {};
+//# sourceMappingURL=chain.d.ts.map

package/dist/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,YAAY,CAAC;AAC1D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AACD,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAChC;AAqBD,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA6FnC,iBAAS,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQhD;AASD,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAgD9D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAE5C;AAID,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAqBhG;AAwDD,2CAA2C;AAC3C,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,WAAW,CAOpF;AAkKD,0EAA0E;AAC1E,eAAO,MAAM,cAAc;;CAAiB,CAAC"}

package/dist/chain.js

@@ -0,0 +1,521 @@
+"use strict";
+/**
+ * The `chain` profile (spec/USE-v1.md section 9), GRANT-v1 (spec/GRANT-v1.md)
+ * and USE-v1 (spec/USE-v1.md). DRAFT: both record formats are drafts, not
+ * frozen.
+ *
+ * Three verdicts, never two: PASS, FAIL, INCOMPLETE. Missing evidence is never
+ * a pass. The check order and every reason string are a cross-implementation
+ * contract with the Python verifier (aqta_verify_receipt/chain.py): first FAIL
+ * wins, and the two must return the same verdict and reason on the same bytes.
+ *
+ * Explicit opt-in only. Nothing here is reached by inspecting input shape.
+ * Node-only, like transparency.ts: it needs SHA-256.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports._chainInternal = void 0;
+exports.checkGrantRecord = checkGrantRecord;
+exports.grantHash = grantHash;
+exports.checkUseRecord = checkUseRecord;
+exports.verifyChain = verifyChain;
+const tweetnacl_1 = __importDefault(require("tweetnacl"));
+const node_crypto_1 = require("node:crypto");
+const index_js_1 = require("./index.js");
+const { canonicalValue, RFC3339_OFFSET, B64URL_STRICT, base64urlDecode, canonicalScalar } = index_js_1._internal;
+const GRANT_FIELDS = [
+    'v', 'grant_id', 'intent_ref', 'org_id', 'approver', 'signing_mode', 'scope_tool', 'scope_resource',
+    'scope_environment', 'max_uses', 'not_before', 'not_after', 'require_args', 'public_key', 'signature',
+];
+const GRANT_OPTIONAL = ['scope_args', 'agent_key_id'];
+const USE_FIELDS = [
+    'v', 'use_id', 'org_id', 'action_id', 'args_hash', 'grant_id', 'grant_hash', 'approver_public_key',
+    'consumption_key', 'use_index', 'max_uses', 'timestamp', 'public_key', 'signature',
+];
+const BUNDLE_MEMBERS = ['v', 'grants', 'uses', 'actions'];
+const DECIMAL = /^(0|[1-9][0-9]*)$/;
+const DECIMAL_POSITIVE = /^[1-9][0-9]*$/;
+const HEX64 = /^[0-9a-f]{64}$/;
+const ARG_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+const KEY_ID = /^[A-Za-z0-9_.:-]{1,128}$/;
+const UNBINDABLE = new Set(['aqta_grant', 'aqta_grant_id', 'aqta_grant_hash']);
+const TS = /^(\d{4})-(\d{2})-(\d{2})[Tt ](\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(?:[Zz]|([+-])(\d{2}):(\d{2}))$/;
+class Fail extends Error {
+}
+function isObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function has(o, k) {
+    return Object.prototype.hasOwnProperty.call(o, k);
+}
+/** Own-property read: `args.constructor` must not reach Object.prototype. */
+function own(o, k) {
+    return has(o, k) ? o[k] : undefined;
+}
+function firstUnknown(o, allowed) {
+    const unknown = Object.keys(o).filter((k) => !allowed.has(k)).sort();
+    return unknown.length ? unknown[0] : null;
+}
+function canonicalBytes(o) {
+    return new TextEncoder().encode(canonicalValue(o));
+}
+function withoutSignature(o) {
+    const p = { ...o };
+    delete p.signature;
+    return p;
+}
+function signatureReason(payload, signature, publicKey) {
+    let canonical;
+    try {
+        canonical = canonicalBytes(payload);
+    }
+    catch {
+        return 'record is not canonicalisable';
+    }
+    if (typeof signature !== 'string' || !B64URL_STRICT.test(signature) ||
+        typeof publicKey !== 'string' || !B64URL_STRICT.test(publicKey)) {
+        return 'signature decode error: not base64url';
+    }
+    let sig;
+    let pub;
+    try {
+        sig = base64urlDecode(signature);
+        pub = base64urlDecode(publicKey);
+    }
+    catch {
+        return 'signature decode error: not base64url';
+    }
+    if (sig.length !== 64)
+        return 'signature length != 64 bytes';
+    if (pub.length !== 32)
+        return 'public key length != 32 bytes';
+    if (!canonicalScalar(sig))
+        return 'signature check failed';
+    try {
+        if (!tweetnacl_1.default.sign.detached.verify(canonical, sig, pub))
+            return 'signature check failed';
+    }
+    catch {
+        return 'signature check failed';
+    }
+    return null;
+}
+function isKey(v) {
+    if (typeof v !== 'string' || !B64URL_STRICT.test(v))
+        return false;
+    try {
+        return base64urlDecode(v).length === 32;
+    }
+    catch {
+        return false;
+    }
+}
+// --- Times: exact instants without a date library (spec/GRANT-v1.md section 6.1) ------------------------------
+function daysFromCivil(y0, m, d) {
+    const y = m <= 2 ? y0 - 1 : y0;
+    const era = Math.floor(y / 400);
+    const yoe = y - era * 400;
+    const doy = Math.floor((153 * (m + (m > 2 ? -3 : 9)) + 2) / 5) + d - 1;
+    const doe = yoe * 365 + Math.floor(yoe / 4) - Math.floor(yoe / 100) + doy;
+    return era * 146097 + doe - 719468;
+}
+function instant(ts) {
+    const m = TS.exec(ts);
+    const n = (i) => parseInt(m[i], 10);
+    let secs = daysFromCivil(n(1), n(2), n(3)) * 86400 + n(4) * 3600 + n(5) * 60 + n(6);
+    if (m[8]) {
+        const off = n(9) * 3600 + n(10) * 60;
+        secs -= m[8] === '+' ? off : -off;
+    }
+    return [secs, m[7] ?? ''];
+}
+function cmpInstant(a, b) {
+    const [sa, fa0] = instant(a);
+    const [sb, fb0] = instant(b);
+    if (sa !== sb)
+        return sa < sb ? -1 : 1;
+    const len = Math.max(fa0.length, fb0.length);
+    const fa = fa0.padEnd(len, '0');
+    const fb = fb0.padEnd(len, '0');
+    return fa === fb ? 0 : fa < fb ? -1 : 1;
+}
+function decLe(a, b) {
+    if (a.length !== b.length)
+        return a.length < b.length;
+    return a <= b;
+}
+// --- GRANT-v1 (spec/GRANT-v1.md section 7.1) -------------------------------------------------------------------
+/** Integrity of one grant: null when it holds, else the reason. Says nothing about authority. */
+function checkGrantRecord(grant) {
+    if (!isObject(grant))
+        return 'grant must be an object';
+    for (const f of GRANT_FIELDS)
+        if (!has(grant, f))
+            return `missing required field: ${f}`;
+    const unknown = firstUnknown(grant, new Set([...GRANT_FIELDS, ...GRANT_OPTIONAL]));
+    if (unknown !== null)
+        return `unknown top-level field: ${unknown}`;
+    if (grant.v !== 'grant-1')
+        return "v must be the string 'grant-1'";
+    for (const f of [...GRANT_FIELDS, ...GRANT_OPTIONAL]) {
+        if (!has(grant, f))
+            continue;
+        if (f === 'require_args' || f === 'scope_args') {
+            if (!Array.isArray(grant[f]))
+                return `${f} must be an array`;
+        }
+        else if (typeof grant[f] !== 'string') {
+            return `${f} must be a string`;
+        }
+    }
+    const g = grant;
+    if (g.signing_mode !== 'approver-signed')
+        return "signing_mode must be 'approver-signed'";
+    for (const f of ['grant_id', 'org_id', 'approver', 'scope_tool']) {
+        if (g[f] === '')
+            return `${f} must be a non-empty string`;
+    }
+    if (g.max_uses !== '' && !DECIMAL.test(g.max_uses))
+        return "max_uses must be '' or a canonical decimal string";
+    if (g.not_before !== '' && !RFC3339_OFFSET.test(g.not_before)) {
+        return "not_before must be '' or an RFC 3339 datetime with an explicit offset";
+    }
+    if (!RFC3339_OFFSET.test(g.not_after))
+        return 'not_after must be an RFC 3339 datetime with an explicit offset';
+    const req = grant.require_args;
+    if (!req.every((x) => typeof x === 'string'))
+        return 'require_args must contain only strings';
+    const reqSorted = [...req].sort();
+    if (req.some((x, i) => x !== reqSorted[i]))
+        return 'require_args must be in lexicographic order';
+    if (has(grant, 'scope_args')) {
+        const entries = grant.scope_args;
+        if (entries.length === 0)
+            return 'scope_args must be a non-empty list of name=value strings';
+        const names = new Set();
+        for (const e of entries) {
+            if (typeof e !== 'string' || !e.includes('='))
+                return 'scope_args entries must be name=value strings';
+            const at = e.indexOf('=');
+            const name = e.slice(0, at);
+            const value = e.slice(at + 1);
+            if (!ARG_NAME.test(name) || UNBINDABLE.has(name) || value === '') {
+                return 'scope_args entry has an invalid name or an empty value';
+            }
+            if (names.has(name))
+                return `scope_args names ${name} twice`;
+            names.add(name);
+        }
+        const sorted = [...entries].sort();
+        if (entries.some((x, i) => x !== sorted[i]))
+            return 'scope_args must be sorted';
+    }
+    if (has(grant, 'agent_key_id') && !KEY_ID.test(g.agent_key_id))
+        return 'agent_key_id must be an API key id';
+    return signatureReason(withoutSignature(grant), grant.signature, grant.public_key);
+}
+function grantHash(grant) {
+    return (0, node_crypto_1.createHash)('sha256').update(canonicalBytes(withoutSignature(grant))).digest('hex');
+}
+// --- USE-v1 (spec/USE-v1.md section 7) -------------------------------------------------------------------------
+function checkUseRecord(use, trustedPublicKey) {
+    if (!isObject(use))
+        return 'use must be an object';
+    for (const f of USE_FIELDS)
+        if (!has(use, f))
+            return `missing required field: ${f}`;
+    const unknown = firstUnknown(use, new Set(USE_FIELDS));
+    if (unknown !== null)
+        return `unknown top-level field: ${unknown}`;
+    if (use.v !== 'use-1')
+        return "v must be the string 'use-1'";
+    for (const f of USE_FIELDS)
+        if (typeof use[f] !== 'string')
+            return `${f} must be a string`;
+    const u = use;
+    for (const f of ['use_id', 'org_id', 'action_id', 'grant_id', 'consumption_key']) {
+        if (u[f] === '')
+            return `${f} must be a non-empty string`;
+    }
+    for (const f of ['args_hash', 'grant_hash']) {
+        if (!HEX64.test(u[f]))
+            return `${f} must be 64 lowercase hex characters`;
+    }
+    if (!isKey(u.approver_public_key))
+        return 'approver_public_key must be a base64url Ed25519 key';
+    if (!DECIMAL_POSITIVE.test(u.use_index))
+        return 'use_index must be a canonical decimal string of at least 1';
+    if (!DECIMAL.test(u.max_uses))
+        return 'max_uses must be a canonical decimal string';
+    if (!RFC3339_OFFSET.test(u.timestamp))
+        return 'timestamp must be an RFC 3339 datetime with an explicit offset';
+    if (trustedPublicKey === undefined)
+        return 'trusted_public_key required';
+    if (u.public_key !== trustedPublicKey)
+        return 'public_key does not match trusted key';
+    return signatureReason(withoutSignature(use), use.signature, use.public_key);
+}
+// --- Scope (spec/GRANT-v1.md section 6) ------------------------------------------------------------------------
+function matches(pattern, value) {
+    if (pattern.endsWith('*'))
+        return value.startsWith(pattern.slice(0, -1));
+    return pattern === value;
+}
+function isEmptyEvidence(v) {
+    if (v === null || v === undefined || v === '')
+        return true;
+    if (Array.isArray(v))
+        return v.length === 0;
+    if (isObject(v))
+        return Object.keys(v).length === 0;
+    return false;
+}
+function scopeReason(g, rec, args) {
+    if (g.org_id !== rec.org_id)
+        return 'the grant was issued for a different organisation';
+    if (!matches(g.scope_tool, rec.tool))
+        return "the tool is outside the grant's scope_tool";
+    const res = g.scope_resource;
+    if (res !== '') {
+        const declared = ['device_id', 'resource'].filter((k) => has(args, k) && args[k] !== null && args[k] !== '');
+        if (declared.length === 0)
+            return 'the action declares no resource and the grant names one';
+        for (const k of declared) {
+            if (typeof args[k] !== 'string' || args[k] !== res)
+                return `the action's ${k} is not the grant's resource`;
+        }
+    }
+    const env = g.scope_environment;
+    if (env !== '') {
+        const e = own(args, 'environment');
+        if (typeof e !== 'string' || e !== env)
+            return "the action's environment is not the grant's";
+    }
+    for (const entry of (has(g, 'scope_args') ? g.scope_args : [])) {
+        const at = entry.indexOf('=');
+        const name = entry.slice(0, at);
+        const value = entry.slice(at + 1);
+        const v = own(args, name);
+        if (typeof v !== 'string' || v !== value)
+            return `the action does not match the value the grant fixes for ${name}`;
+    }
+    for (const name of g.require_args) {
+        if (!has(args, name) || isEmptyEvidence(args[name]))
+            return `the action lacks evidence the grant requires: ${name}`;
+    }
+    return null;
+}
+function inWindow(g, ts) {
+    if (g.not_before !== '' && cmpInstant(ts, g.not_before) < 0)
+        return false;
+    return cmpInstant(ts, g.not_after) <= 0;
+}
+function ckey(g, orgId) {
+    return g.intent_ref !== '' ? `org:${orgId}|intent:${g.intent_ref}` : `org:${orgId}|grant:${g.grant_id}`;
+}
+// --- The chain (spec/USE-v1.md section 9.3) --------------------------------------------------------------------
+/** Verify a chain bundle. Never throws. */
+function verifyChain(bundle, options = {}) {
+    try {
+        return verifyChainInner(bundle, options);
+    }
+    catch (e) {
+        if (e instanceof Fail)
+            return { verdict: 'FAIL', reason: e.message };
+        return { verdict: 'FAIL', reason: 'verification error' };
+    }
+}
+function verifyChainInner(bundle, options) {
+    const incomplete = [];
+    const fail = (reason) => {
+        throw new Fail(reason);
+    };
+    const pinned = options.trustedPublicKey;
+    // 1. Inputs.
+    if (typeof pinned !== 'string' || !isKey(pinned))
+        fail('a pinned issuer key is required');
+    let trusted = null;
+    if (options.approverKeys !== undefined && options.approverKeys !== null) {
+        if (!Array.isArray(options.approverKeys) || !options.approverKeys.every(isKey)) {
+            fail('approver_keys must be base64url Ed25519 keys');
+        }
+        trusted = new Set(options.approverKeys);
+    }
+    // 2. Bundle.
+    if (!isObject(bundle))
+        fail('bundle must be an object');
+    const b = bundle;
+    for (const m of BUNDLE_MEMBERS)
+        if (!has(b, m))
+            fail(`bundle missing member: ${m}`);
+    const unknown = firstUnknown(b, new Set(BUNDLE_MEMBERS));
+    if (unknown !== null)
+        fail(`bundle has unknown member: ${unknown}`);
+    if (b.v !== 'chain-1')
+        fail("bundle v must be the string 'chain-1'");
+    for (const m of ['grants', 'uses', 'actions'])
+        if (!Array.isArray(b[m]))
+            fail(`bundle ${m} must be an array`);
+    // 3. Actions.
+    const actions = b.actions;
+    const byAction = new Map();
+    actions.forEach((a, i) => {
+        if (!isObject(a) || Object.keys(a).length !== 2 || !has(a, 'record') || !has(a, 'args')) {
+            fail(`actions[${i}] must be an object with record and args`);
+        }
+        const item = a;
+        if (!isObject(item.args))
+            fail(`actions[${i}].args must be an object`);
+        const r = (0, index_js_1.verifyActionRecord)(item.record, { trustedPublicKey: pinned });
+        if (!r.valid) {
+            // The published ACTION-v1 paths word a canonicalisation failure
+            // differently in each language (same verdict). The chain reason is one
+            // string in both.
+            const reason = (r.reason ?? '').startsWith('failed to canonicalise') ? 'record is not canonicalisable' : r.reason;
+            fail(`actions[${i}]: ${reason}`);
+        }
+        let h = '';
+        try {
+            h = (0, node_crypto_1.createHash)('sha256').update(canonicalBytes(item.args)).digest('hex');
+        }
+        catch {
+            fail(`actions[${i}].args is not canonicalisable`);
+        }
+        const rec = item.record;
+        if (h !== rec.args_hash)
+            fail(`actions[${i}].args do not match the record's args_hash`);
+        const aid = rec.action_id;
+        if (byAction.has(aid))
+            fail(`actions[${i}] repeats an action_id`);
+        byAction.set(aid, { record: rec, args: item.args });
+    });
+    // 4. Grants.
+    const byHash = new Map();
+    b.grants.forEach((g, i) => {
+        const why = checkGrantRecord(g);
+        if (why !== null)
+            fail(`grants[${i}]: ${why}`);
+        const h = grantHash(g);
+        if (byHash.has(h))
+            fail(`grants[${i}] repeats an earlier grant`);
+        byHash.set(h, g);
+    });
+    const ids = new Set([...byHash.values()].map((g) => g.grant_id));
+    // 5. Uses.
+    const uses = b.uses;
+    const seenUseIds = new Set();
+    uses.forEach((u, i) => {
+        const why = checkUseRecord(u, pinned);
+        if (why !== null)
+            fail(`uses[${i}]: ${why}`);
+        const id = u.use_id;
+        if (seenUseIds.has(id))
+            fail(`uses[${i}] repeats a use_id`);
+        seenUseIds.add(id);
+    });
+    const U = uses;
+    // 6. Conflicts.
+    const claims = new Set();
+    const named = new Set();
+    U.forEach((u, i) => {
+        const c = JSON.stringify([u.consumption_key, u.use_index]);
+        if (claims.has(c))
+            fail(`uses[${i}] claims a use another USE record already claims`);
+        claims.add(c);
+        if (named.has(u.action_id))
+            fail(`uses[${i}] names an action another USE record already names`);
+        named.add(u.action_id);
+    });
+    // 7. Each USE.
+    U.forEach((u, i) => {
+        const g = byHash.get(u.grant_hash);
+        if (g === undefined) {
+            if (ids.has(u.grant_id))
+                fail(`uses[${i}].grant_hash does not match the grant presented`);
+            incomplete.push(`uses[${i}] names a grant that is not in the bundle`);
+            return;
+        }
+        if (u.grant_id !== g.grant_id)
+            fail(`uses[${i}].grant_id differs from the grant's`);
+        if (u.org_id !== g.org_id)
+            fail(`uses[${i}].org_id differs from the grant's`);
+        if (u.approver_public_key !== g.public_key)
+            fail(`uses[${i}].approver_public_key differs from the grant's key`);
+        if (u.max_uses !== g.max_uses)
+            fail(`uses[${i}].max_uses differs from the grant's`);
+        if (g.max_uses === '')
+            fail(`uses[${i}] consumes a grant with no use limit`);
+        if (!decLe(u.use_index, g.max_uses))
+            fail(`uses[${i}] is use ${u.use_index} of ${g.max_uses}`);
+        if (u.consumption_key !== ckey(g, u.org_id)) {
+            fail(`uses[${i}].consumption_key is not the key the grant is counted against`);
+        }
+        if (!inWindow(g, u.timestamp))
+            fail(`uses[${i}] was recorded outside the grant's validity window`);
+        const a = byAction.get(u.action_id);
+        if (a === undefined) {
+            incomplete.push(`uses[${i}] names an action that is not in the bundle`);
+            return;
+        }
+        if (a.record.outcome !== 'ALLOWED')
+            fail(`uses[${i}] names an action that was not ALLOWED`);
+        if (a.record.org_id !== u.org_id)
+            fail(`uses[${i}].org_id differs from the action's`);
+        if (a.record.args_hash !== u.args_hash)
+            fail(`uses[${i}].args_hash differs from the action's`);
+        if (own(a.args, 'aqta_grant_hash') !== u.grant_hash) {
+            fail(`uses[${i}] names an action whose arguments do not reference its grant`);
+        }
+    });
+    // 8. Each action that references a grant.
+    actions.forEach((item, i) => {
+        const args = item.args;
+        const rec = item.record;
+        if (!has(args, 'aqta_grant_id') && !has(args, 'aqta_grant_hash'))
+            return;
+        const gid = own(args, 'aqta_grant_id');
+        const gh = own(args, 'aqta_grant_hash');
+        if (typeof gid !== 'string' || typeof gh !== 'string')
+            fail(`actions[${i}].args carry a partial grant reference`);
+        const g = byHash.get(gh);
+        if (g === undefined) {
+            if (ids.has(gid))
+                fail(`actions[${i}] names a grant whose content differs from the grant presented`);
+            if (rec.outcome === 'ALLOWED')
+                incomplete.push(`actions[${i}] names a grant that is not in the bundle`);
+            return;
+        }
+        if (gid !== g.grant_id)
+            fail(`actions[${i}].aqta_grant_id differs from the grant's`);
+        if (rec.outcome !== 'ALLOWED')
+            return;
+        const why = scopeReason(g, rec, args);
+        if (why !== null)
+            fail(`actions[${i}] is outside its grant: ${why}`);
+        if (trusted === null) {
+            incomplete.push('no approver key set was supplied');
+        }
+        else if (!trusted.has(g.public_key)) {
+            fail(`actions[${i}] was authorised by a grant whose key is not a designated approver`);
+        }
+        if (g.max_uses !== '') {
+            if (!U.some((u) => u.action_id === rec.action_id)) {
+                incomplete.push(`actions[${i}] consumed a counted grant and its USE record is not in the bundle`);
+            }
+        }
+        else if (!inWindow(g, rec.timestamp)) {
+            fail(`actions[${i}] is outside its grant's validity window`);
+        }
+    });
+    // 9. Empty.
+    if (actions.length === 0)
+        incomplete.push('the bundle carries no action');
+    if (incomplete.length)
+        return { verdict: 'INCOMPLETE', reason: incomplete[0] };
+    return { verdict: 'PASS', reason: null };
+}
+/** Internal, for the interop sweep only: the exact-instant comparator. */
+exports._chainInternal = { cmpInstant };
+//# sourceMappingURL=chain.js.map

package/dist/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;AAqJH,4CAgDC;AAED,8BAEC;AAID,wCAqBC;AAyDD,kCAOC;AAhSD,0DAA6B;AAC7B,6CAAyC;AACzC,yCAA2D;AAE3D,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,oBAAS,CAAC;AAatG,MAAM,YAAY,GAAG;IACnB,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB;IACnG,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW;CACtG,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG;IACjB,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB;IAClG,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;CACnF,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE1D,MAAM,OAAO,GAAG,mBAAmB,CAAC;AACpC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAC1C,MAAM,MAAM,GAAG,0BAA0B,CAAC;AAC1C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC/E,MAAM,EAAE,GAAG,iGAAiG,CAAC;AAI7G,MAAM,IAAK,SAAQ,KAAK;CAAG;AAE3B,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,GAAG,CAAC,CAAM,EAAE,CAAS;IAC5B,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,6EAA6E;AAC7E,SAAS,GAAG,CAAC,CAAM,EAAE,CAAS;IAC5B,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,CAAM,EAAE,OAAoB;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,CAAM;IAC5B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAM;IAC9B,MAAM,CAAC,GAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,SAAS,CAAC;IACnB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CAAC,OAAY,EAAE,SAAkB,EAAE,SAAkB;IAC3E,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,IAAI,GAAe,CAAC;IACpB,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QACjC,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,8BAA8B,CAAC;IAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,+BAA+B,CAAC;IAC9D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,wBAAwB,CAAC;IAC3D,IAAI,CAAC;QACH,IAAI,CAAC,mBAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,wBAAwB,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,CAAU;IACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iHAAiH;AAEjH,SAAS,aAAa,CAAC,EAAU,EAAE,CAAS,EAAE,CAAS;IACrD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IAC1E,OAAO,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,EAAU;IACzB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAoB,CAAC;IACzC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,kHAAkH;AAElH,iGAAiG;AACjG,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,yBAAyB,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YAAE,OAAO,2BAA2B,CAAC,EAAE,CAAC;IACxF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,4BAA4B,OAAO,EAAE,CAAC;IACnE,IAAI,KAAK,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,gCAAgC,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC,mBAAmB,CAAC;QAC/D,CAAC;aAAM,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,GAAG,CAAC,mBAAmB,CAAC;QACjC,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,KAAqC,CAAC;IAChD,IAAI,CAAC,CAAC,YAAY,KAAK,iBAAiB;QAAE,OAAO,wCAAwC,CAAC;IAC1F,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC,6BAA6B,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,mDAAmD,CAAC;IAC/G,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,OAAO,uEAAuE,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,gEAAgE,CAAC;IAC/G,MAAM,GAAG,GAAG,KAAK,CAAC,YAAyB,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,wCAAwC,CAAC;IAC9F,MAAM,SAAS,GAAG,CAAC,GAAI,GAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,6CAA6C,CAAC;IACjG,IAAI,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAuB,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,2DAA2D,CAAC;QAC7F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,+CAA+C,CAAC;YACtG,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjE,OAAO,wDAAwD,CAAC;YAClE,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,oBAAoB,IAAI,QAAQ,CAAC;YAC7D,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAI,OAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,2BAA2B,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;QAAE,OAAO,oCAAoC,CAAC;IAC5G,OAAO,eAAe,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;AACrF,CAAC;AAED,SAAgB,SAAS,CAAC,KAAU;IAClC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,kHAAkH;AAElH,SAAgB,cAAc,CAAC,GAAY,EAAE,gBAAoC;IAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YAAE,OAAO,2BAA2B,CAAC,EAAE,CAAC;IACpF,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,4BAA4B,OAAO,EAAE,CAAC;IACnE,IAAI,GAAG,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,8BAA8B,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,mBAAmB,CAAC;IAC3F,MAAM,CAAC,GAAG,GAA6B,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC,6BAA6B,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC,sCAAsC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAAE,OAAO,qDAAqD,CAAC;IAChG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,4DAA4D,CAAC;IAC7G,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,6CAA6C,CAAC;IACpF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,gEAAgE,CAAC;IAC/G,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,6BAA6B,CAAC;IACzE,IAAI,CAAC,CAAC,UAAU,KAAK,gBAAgB;QAAE,OAAO,uCAAuC,CAAC;IACtF,OAAO,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;AAC/E,CAAC;AAED,kHAAkH;AAElH,SAAS,OAAO,CAAC,OAAe,EAAE,KAAa;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,OAAO,KAAK,KAAK,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAM,EAAE,GAAQ,EAAE,IAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,mDAAmD,CAAC;IACxF,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAoB,EAAE,GAAG,CAAC,IAAc,CAAC;QAAE,OAAO,4CAA4C,CAAC;IAC9G,MAAM,GAAG,GAAG,CAAC,CAAC,cAAwB,CAAC;IACvC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7G,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,yDAAyD,CAAC;QAC5F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,gBAAgB,CAAC,8BAA8B,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,iBAA2B,CAAC;IAC1C,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,6CAA6C,CAAC;IAC/F,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,UAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,2DAA2D,IAAI,EAAE,CAAC;IACrH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,YAAwB,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,iDAAiD,IAAI,EAAE,CAAC;IACtH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,CAAM,EAAE,EAAU;IAClC,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,UAAoB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,OAAO,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,SAAmB,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,IAAI,CAAC,CAAM,EAAE,KAAa;IACjC,OAAO,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC1G,CAAC;AAED,kHAAkH;AAElH,2CAA2C;AAC3C,SAAgB,WAAW,CAAC,MAAe,EAAE,UAAwB,EAAE;IACrE,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAe,EAAE,OAAqB;IAC9D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAS,EAAE;QACrC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAExC,aAAa;IACb,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC1F,IAAI,OAAO,GAAuB,IAAI,CAAC;IACvC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED,aAAa;IACb,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,MAAa,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,cAAc;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,IAAI,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;QAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAE9G,cAAc;IACd,MAAM,OAAO,GAAG,CAAC,CAAC,OAAoB,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC/D,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YACxF,IAAI,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,CAAQ,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACb,gEAAgE;YAChE,uEAAuE;YACvE,kBAAkB;YAClB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAClH,IAAI,CAAC,WAAW,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC;YACH,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAa,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,CAAC,SAAS;YAAE,IAAI,CAAC,WAAW,CAAC,4CAA4C,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,GAAG,CAAC,SAAmB,CAAC;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;QAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAW,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,aAAa;IACb,MAAM,MAAM,GAAG,IAAI,GAAG,EAAe,CAAC;IACrC,CAAC,CAAC,MAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAQ,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAkB,CAAC,CAAC,CAAC;IAE3E,WAAW;IACX,MAAM,IAAI,GAAG,CAAC,CAAC,IAAiB,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAI,CAAS,CAAC,MAAgB,CAAC;QACvC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAC5D,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,IAAqC,CAAC;IAEhD,gBAAgB;IAChB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;QACrF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,oDAAoD,CAAC,CAAC;QAChG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC;YAC1F,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QACpF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,mBAAmB,KAAK,CAAC,CAAC,UAAU;YAAE,IAAI,CAAC,QAAQ,CAAC,oDAAoD,CAAC,CAAC;QAChH,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QACpF,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE;YAAE,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAkB,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,+DAA+D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,oDAAoD,CAAC,CAAC;QACnG,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;QAC5F,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,IAAI,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;QAC/F,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,8DAA8D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAI,IAAY,CAAC,IAAW,CAAC;QACvC,MAAM,GAAG,GAAI,IAAY,CAAC,MAAa,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAAE,OAAO;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,IAAI,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC;QAClH,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAY,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAa,CAAC;gBAAE,IAAI,CAAC,WAAW,CAAC,gEAAgE,CAAC,CAAC;YAC/G,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ;YAAE,IAAI,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;QACrF,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO;QACtC,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI;YAAE,IAAI,CAAC,WAAW,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QACrE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAoB,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW,CAAC,oEAAoE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,oEAAoE,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,SAAmB,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,YAAY;IACZ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAE1E,IAAI,UAAU,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,0EAA0E;AAC7D,QAAA,cAAc,GAAG,EAAE,UAAU,EAAE,CAAC"}