chit402-verify 0.3.5 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +1 -1
- package/README.md +205 -17
- package/dist/anchor-trust.d.ts +144 -0
- package/dist/anchor-trust.d.ts.map +1 -0
- package/dist/anchor-trust.js +441 -0
- package/dist/anchor-trust.js.map +1 -0
- package/dist/anchor-witness.d.ts +265 -0
- package/dist/anchor-witness.d.ts.map +1 -0
- package/dist/anchor-witness.js +833 -0
- package/dist/anchor-witness.js.map +1 -0
- package/dist/base-payer.d.ts +65 -0
- package/dist/base-payer.d.ts.map +1 -0
- package/dist/base-payer.js +222 -0
- package/dist/base-payer.js.map +1 -0
- package/dist/binding.d.ts +52 -0
- package/dist/binding.d.ts.map +1 -0
- package/dist/binding.js +80 -0
- package/dist/binding.js.map +1 -0
- package/dist/canonical-preimage.d.ts +9 -0
- package/dist/canonical-preimage.d.ts.map +1 -0
- package/dist/canonical-preimage.js +25 -0
- package/dist/canonical-preimage.js.map +1 -0
- package/dist/carry-forward.d.ts +79 -0
- package/dist/carry-forward.d.ts.map +1 -0
- package/dist/carry-forward.js +184 -0
- package/dist/carry-forward.js.map +1 -0
- package/dist/cli.d.ts +18 -0
- package/dist/cli.d.ts.map +1 -0
- package/dist/cli.js +2086 -0
- package/dist/cli.js.map +1 -0
- package/dist/epoch.d.ts +143 -0
- package/dist/epoch.d.ts.map +1 -0
- package/dist/epoch.js +352 -0
- package/dist/epoch.js.map +1 -0
- package/dist/head-binding.d.ts +24 -0
- package/dist/head-binding.d.ts.map +1 -0
- package/dist/head-binding.js +61 -0
- package/dist/head-binding.js.map +1 -0
- package/dist/index.d.ts +585 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +1648 -0
- package/dist/index.js.map +1 -0
- package/dist/issuer-history.d.ts +151 -0
- package/dist/issuer-history.d.ts.map +1 -0
- package/dist/issuer-history.js +595 -0
- package/dist/issuer-history.js.map +1 -0
- package/dist/issuer-pin.d.ts +126 -0
- package/dist/issuer-pin.d.ts.map +1 -0
- package/dist/issuer-pin.js +567 -0
- package/dist/issuer-pin.js.map +1 -0
- package/dist/jcs.d.ts +8 -0
- package/dist/jcs.d.ts.map +1 -0
- package/dist/jcs.js +64 -0
- package/dist/jcs.js.map +1 -0
- package/dist/jws.d.ts +46 -0
- package/dist/jws.d.ts.map +1 -0
- package/dist/jws.js +129 -0
- package/dist/jws.js.map +1 -0
- package/dist/payer.d.ts +65 -0
- package/dist/payer.d.ts.map +1 -0
- package/dist/payer.js +148 -0
- package/dist/payer.js.map +1 -0
- package/dist/preimage.d.ts +78 -0
- package/dist/preimage.d.ts.map +1 -0
- package/dist/preimage.js +363 -0
- package/dist/preimage.js.map +1 -0
- package/dist/receipt-lane.d.ts +235 -0
- package/dist/receipt-lane.d.ts.map +1 -0
- package/dist/receipt-lane.js +446 -0
- package/dist/receipt-lane.js.map +1 -0
- package/dist/receipt-version.d.ts +98 -0
- package/dist/receipt-version.d.ts.map +1 -0
- package/dist/receipt-version.js +364 -0
- package/dist/receipt-version.js.map +1 -0
- package/dist/refusal.d.ts +93 -0
- package/dist/refusal.d.ts.map +1 -0
- package/dist/refusal.js +249 -0
- package/dist/refusal.js.map +1 -0
- package/dist/request-binding.d.ts +7 -0
- package/dist/request-binding.d.ts.map +1 -0
- package/dist/request-binding.js +26 -0
- package/dist/request-binding.js.map +1 -0
- package/dist/row-hash.d.ts +22 -0
- package/dist/row-hash.d.ts.map +1 -0
- package/dist/row-hash.js +26 -0
- package/dist/row-hash.js.map +1 -0
- package/dist/shell.d.ts +65 -0
- package/dist/shell.d.ts.map +1 -0
- package/dist/shell.js +268 -0
- package/dist/shell.js.map +1 -0
- package/dist/solana-payer.d.ts +99 -0
- package/dist/solana-payer.d.ts.map +1 -0
- package/dist/solana-payer.js +258 -0
- package/dist/solana-payer.js.map +1 -0
- package/dist/v11-receipt.d.ts +23 -0
- package/dist/v11-receipt.d.ts.map +1 -0
- package/dist/v11-receipt.js +368 -0
- package/dist/v11-receipt.js.map +1 -0
- package/dist/verdict.d.ts +98 -0
- package/dist/verdict.d.ts.map +1 -0
- package/dist/verdict.js +390 -0
- package/dist/verdict.js.map +1 -0
- package/issuer-history.snapshot.json +1 -0
- package/package.json +32 -22
- package/cli.js +0 -42
- package/index.cjs +0 -8
- package/index.d.ts +0 -5
- package/index.js +0 -7
|
@@ -0,0 +1,595 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.BUNDLED_HISTORY_AS_OF = exports.ISSUER_HISTORY_SCHEMA = void 0;
|
|
4
|
+
exports.issuerHistoryEntryBody = issuerHistoryEntryBody;
|
|
5
|
+
exports.issuerHistoryEntryHash = issuerHistoryEntryHash;
|
|
6
|
+
exports.verifyIssuerHistoryDocument = verifyIssuerHistoryDocument;
|
|
7
|
+
exports.issuerEntryWindow = issuerEntryWindow;
|
|
8
|
+
exports.issuerKeyWindow = issuerKeyWindow;
|
|
9
|
+
exports.issuerHistoryDocumentHash = issuerHistoryDocumentHash;
|
|
10
|
+
exports.readIssuerHistoryPin = readIssuerHistoryPin;
|
|
11
|
+
exports.checkReceiptIssuerHistory = checkReceiptIssuerHistory;
|
|
12
|
+
exports.historyPrefixExtends = historyPrefixExtends;
|
|
13
|
+
exports.loadBundledIssuerHistory = loadBundledIssuerHistory;
|
|
14
|
+
exports.resolveIssuerHistory = resolveIssuerHistory;
|
|
15
|
+
exports.historyUrlFromReceipt = historyUrlFromReceipt;
|
|
16
|
+
/**
|
|
17
|
+
* Public issuer key history.
|
|
18
|
+
* The document is signed by the current issuer key. Entries chain by
|
|
19
|
+
* SHA-256(JCS(entry without entry_hash)).
|
|
20
|
+
*/
|
|
21
|
+
const node_crypto_1 = require("node:crypto");
|
|
22
|
+
const node_fs_1 = require("node:fs");
|
|
23
|
+
const node_module_1 = require("node:module");
|
|
24
|
+
const jcs_js_1 = require("./jcs.js");
|
|
25
|
+
const jws_js_1 = require("./jws.js");
|
|
26
|
+
exports.ISSUER_HISTORY_SCHEMA = 'chit402.issuer_history.v1';
|
|
27
|
+
function jwsHeaderKid(jws) {
|
|
28
|
+
const part = jws.split('.')[0];
|
|
29
|
+
if (!part)
|
|
30
|
+
return null;
|
|
31
|
+
try {
|
|
32
|
+
const header = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
|
|
33
|
+
return typeof header.kid === 'string' && header.kid ? header.kid : null;
|
|
34
|
+
}
|
|
35
|
+
catch {
|
|
36
|
+
return null;
|
|
37
|
+
}
|
|
38
|
+
}
|
|
39
|
+
function sha256Hex(text) {
|
|
40
|
+
return (0, node_crypto_1.createHash)('sha256').update(text, 'utf8').digest('hex');
|
|
41
|
+
}
|
|
42
|
+
function issuerHistoryEntryBody(entry) {
|
|
43
|
+
return {
|
|
44
|
+
kid: entry.kid,
|
|
45
|
+
jwk: entry.jwk ? {
|
|
46
|
+
kty: entry.jwk.kty,
|
|
47
|
+
crv: entry.jwk.crv,
|
|
48
|
+
x: entry.jwk.x,
|
|
49
|
+
y: entry.jwk.y,
|
|
50
|
+
kid: entry.jwk.kid,
|
|
51
|
+
alg: entry.jwk.alg || 'ES256',
|
|
52
|
+
use: entry.jwk.use || 'sig',
|
|
53
|
+
} : null,
|
|
54
|
+
alg: entry.alg || 'ES256',
|
|
55
|
+
not_before: entry.not_before,
|
|
56
|
+
not_after: entry.not_after ?? null,
|
|
57
|
+
status: entry.status,
|
|
58
|
+
revoked_at: entry.revoked_at ?? null,
|
|
59
|
+
reason: entry.reason ?? null,
|
|
60
|
+
custody: entry.custody,
|
|
61
|
+
prev_hash: entry.prev_hash ?? null,
|
|
62
|
+
};
|
|
63
|
+
}
|
|
64
|
+
function issuerHistoryEntryHash(entry) {
|
|
65
|
+
return sha256Hex((0, jcs_js_1.jcsCanonicalize)(issuerHistoryEntryBody(entry)));
|
|
66
|
+
}
|
|
67
|
+
function parseTime(value) {
|
|
68
|
+
if (value == null || value === '')
|
|
69
|
+
return null;
|
|
70
|
+
if (typeof value === 'number' && Number.isFinite(value))
|
|
71
|
+
return value > 1e12 ? value : value * 1000;
|
|
72
|
+
const ms = Date.parse(String(value));
|
|
73
|
+
return Number.isFinite(ms) ? ms : null;
|
|
74
|
+
}
|
|
75
|
+
function verifyIssuerHistoryDocument(doc, { jwks, trustedKids } = {}) {
|
|
76
|
+
if (!doc || doc.schema !== exports.ISSUER_HISTORY_SCHEMA || !Array.isArray(doc.entries) || !doc.entries.length) {
|
|
77
|
+
return { valid: false, reason: 'not_issuer_history' };
|
|
78
|
+
}
|
|
79
|
+
let prev = null;
|
|
80
|
+
for (const entry of doc.entries) {
|
|
81
|
+
if ((entry.prev_hash ?? null) !== prev)
|
|
82
|
+
return { valid: false, reason: 'prev_hash_mismatch' };
|
|
83
|
+
if (issuerHistoryEntryHash(entry) !== entry.entry_hash)
|
|
84
|
+
return { valid: false, reason: 'entry_hash_mismatch' };
|
|
85
|
+
if (!['active', 'retired', 'revoked'].includes(entry.status))
|
|
86
|
+
return { valid: false, reason: 'bad_status' };
|
|
87
|
+
prev = entry.entry_hash || null;
|
|
88
|
+
}
|
|
89
|
+
if (kidStatusRegression(doc.entries))
|
|
90
|
+
return { valid: false, reason: 'kid_status_regression' };
|
|
91
|
+
const head = doc.entries[doc.entries.length - 1].entry_hash;
|
|
92
|
+
if (doc.head_hash !== head)
|
|
93
|
+
return { valid: false, reason: 'head_hash_mismatch' };
|
|
94
|
+
const jws = doc.issuer_signature?.jws;
|
|
95
|
+
if (!jws)
|
|
96
|
+
return { valid: false, reason: 'no_signature' };
|
|
97
|
+
const headerKid = doc.issuer_signature?.kid || null;
|
|
98
|
+
// Undefined matches verifyReceipt / verifyRefusal: the production pin.
|
|
99
|
+
// An explicit empty list (--no-trusted-kid) does not.
|
|
100
|
+
const pins = trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
|
|
101
|
+
const candidates = [];
|
|
102
|
+
if (jwks?.keys) {
|
|
103
|
+
for (const key of jwks.keys) {
|
|
104
|
+
if (!headerKid || key.kid === headerKid)
|
|
105
|
+
candidates.push(key);
|
|
106
|
+
}
|
|
107
|
+
}
|
|
108
|
+
const embedded = doc.issuer_signature?.issuer_jwk;
|
|
109
|
+
if (embedded && (0, jws_js_1.isPinnedTrustedJwk)(embedded, pins))
|
|
110
|
+
candidates.push(embedded);
|
|
111
|
+
if (!candidates.length && embedded && headerKid && pins.includes(headerKid)) {
|
|
112
|
+
if ((0, jws_js_1.jwkThumbprint)(embedded) === headerKid)
|
|
113
|
+
candidates.push(embedded);
|
|
114
|
+
}
|
|
115
|
+
if (!candidates.length)
|
|
116
|
+
return { valid: false, reason: 'key untrusted' };
|
|
117
|
+
for (const jwk of candidates) {
|
|
118
|
+
const result = (0, jws_js_1.verifyIssuerJws)(jws, jwk);
|
|
119
|
+
if (!result.valid)
|
|
120
|
+
continue;
|
|
121
|
+
const payload = result.payload || {};
|
|
122
|
+
if (payload.schema !== exports.ISSUER_HISTORY_SCHEMA)
|
|
123
|
+
return { valid: false, reason: 'schema_mismatch' };
|
|
124
|
+
if (Number(payload.entry_count) !== doc.entries.length)
|
|
125
|
+
return { valid: false, reason: 'entry_count_mismatch' };
|
|
126
|
+
if (payload.head_hash !== head)
|
|
127
|
+
return { valid: false, reason: 'signed_head_mismatch' };
|
|
128
|
+
if (payload.version != null && Number(payload.version) !== Number(doc.version)) {
|
|
129
|
+
return { valid: false, reason: 'version_mismatch' };
|
|
130
|
+
}
|
|
131
|
+
if (payload.seq != null && Number(payload.seq) !== Number(doc.seq)) {
|
|
132
|
+
return { valid: false, reason: 'seq_mismatch' };
|
|
133
|
+
}
|
|
134
|
+
if (inheritedKeyWindow(doc.entries))
|
|
135
|
+
return { valid: false, reason: 'inherited_key_window' };
|
|
136
|
+
const signerKid = jwsHeaderKid(jws) || headerKid;
|
|
137
|
+
if (signedOnlyByIntroducedKey(doc.entries, signerKid)) {
|
|
138
|
+
return { valid: false, reason: 'introduced_key_signature' };
|
|
139
|
+
}
|
|
140
|
+
return { valid: true };
|
|
141
|
+
}
|
|
142
|
+
return { valid: false, reason: 'signature_invalid' };
|
|
143
|
+
}
|
|
144
|
+
/**
|
|
145
|
+
* A new kid must not start at or before an earlier kid's not_before.
|
|
146
|
+
* That copy would accept receipts from the old window under the new key.
|
|
147
|
+
*/
|
|
148
|
+
function inheritedKeyWindow(entries) {
|
|
149
|
+
const seen = new Set();
|
|
150
|
+
let maxPrior = null;
|
|
151
|
+
for (const entry of entries) {
|
|
152
|
+
const start = parseTime(entry?.not_before);
|
|
153
|
+
if (!seen.has(entry?.kid)) {
|
|
154
|
+
if (seen.size > 0 && start != null && maxPrior != null && start <= maxPrior)
|
|
155
|
+
return true;
|
|
156
|
+
seen.add(entry.kid);
|
|
157
|
+
}
|
|
158
|
+
if (start != null && (maxPrior == null || start > maxPrior))
|
|
159
|
+
maxPrior = start;
|
|
160
|
+
}
|
|
161
|
+
return false;
|
|
162
|
+
}
|
|
163
|
+
/** Same instant is not a change. A missing stamp against a real one is. */
|
|
164
|
+
function notBeforeMoved(previous, next) {
|
|
165
|
+
const left = parseTime(previous);
|
|
166
|
+
const right = parseTime(next);
|
|
167
|
+
if (left == null || right == null)
|
|
168
|
+
return String(previous ?? '') !== String(next ?? '');
|
|
169
|
+
return left !== right;
|
|
170
|
+
}
|
|
171
|
+
/**
|
|
172
|
+
* Revocation sticks. A later entry cannot move a kid off `revoked`, a
|
|
173
|
+
* retired kid cannot become active again, and `not_before` cannot move.
|
|
174
|
+
* Moving it earlier would widen the window backwards.
|
|
175
|
+
*/
|
|
176
|
+
function kidStatusRegression(entries) {
|
|
177
|
+
const prior = new Map();
|
|
178
|
+
for (const entry of entries) {
|
|
179
|
+
const prev = prior.get(entry.kid);
|
|
180
|
+
if (prev) {
|
|
181
|
+
if (prev.status === 'revoked')
|
|
182
|
+
return true;
|
|
183
|
+
if (prev.status === 'retired' && entry.status === 'active')
|
|
184
|
+
return true;
|
|
185
|
+
if (notBeforeMoved(prev.notBefore, entry.not_before))
|
|
186
|
+
return true;
|
|
187
|
+
}
|
|
188
|
+
prior.set(entry.kid, { status: entry.status, notBefore: entry.not_before });
|
|
189
|
+
}
|
|
190
|
+
return false;
|
|
191
|
+
}
|
|
192
|
+
/** The signer must already be the genesis key. A key introduced later cannot sign the document that adds it. */
|
|
193
|
+
function signedOnlyByIntroducedKey(entries, signerKid) {
|
|
194
|
+
if (!signerKid || entries.length < 2)
|
|
195
|
+
return false;
|
|
196
|
+
const first = entries.findIndex((entry) => entry.kid === signerKid);
|
|
197
|
+
return first > 0;
|
|
198
|
+
}
|
|
199
|
+
function issuerEntryWindow(entry, issuedAt) {
|
|
200
|
+
if (!entry)
|
|
201
|
+
return { ok: false, reason: 'kid_not_in_history' };
|
|
202
|
+
const issued = parseTime(issuedAt);
|
|
203
|
+
if (issued == null)
|
|
204
|
+
return { ok: false, reason: 'issued_at_missing' };
|
|
205
|
+
const notBefore = parseTime(entry.not_before);
|
|
206
|
+
if (notBefore == null)
|
|
207
|
+
return { ok: false, reason: 'not_before_missing' };
|
|
208
|
+
if (issued < notBefore)
|
|
209
|
+
return { ok: false, reason: 'issued_before_not_before' };
|
|
210
|
+
const notAfter = parseTime(entry.not_after);
|
|
211
|
+
if (entry.not_after != null && notAfter == null)
|
|
212
|
+
return { ok: false, reason: 'not_after_invalid' };
|
|
213
|
+
if (notAfter != null && issued > notAfter)
|
|
214
|
+
return { ok: false, reason: 'issued_after_not_after' };
|
|
215
|
+
if (entry.status === 'revoked') {
|
|
216
|
+
const revoked = parseTime(entry.revoked_at);
|
|
217
|
+
if (revoked == null)
|
|
218
|
+
return { ok: false, reason: 'revoked_at_missing' };
|
|
219
|
+
if (issued >= revoked)
|
|
220
|
+
return { ok: false, reason: 'kid_revoked_before_issuance' };
|
|
221
|
+
}
|
|
222
|
+
return { ok: true, reason: null };
|
|
223
|
+
}
|
|
224
|
+
function issuerKeyWindow(doc, kid, issuedAt) {
|
|
225
|
+
// The end of the window is sticky. The earliest revoked_at and the earliest
|
|
226
|
+
// not_after across every entry for this kid still apply after a later row.
|
|
227
|
+
// not_before uses the latest stamp, so a later row cannot widen it backwards.
|
|
228
|
+
const matches = (doc.entries || []).filter((row) => row.kid === kid);
|
|
229
|
+
if (!matches.length)
|
|
230
|
+
return { ok: false, reason: 'kid_not_in_history' };
|
|
231
|
+
const last = matches[matches.length - 1];
|
|
232
|
+
let notBefore = null;
|
|
233
|
+
let notBeforeMs = null;
|
|
234
|
+
for (const row of matches) {
|
|
235
|
+
const parsed = parseTime(row.not_before);
|
|
236
|
+
if (parsed == null)
|
|
237
|
+
return { ok: false, reason: 'not_before_missing' };
|
|
238
|
+
if (notBeforeMs == null || parsed > notBeforeMs) {
|
|
239
|
+
notBeforeMs = parsed;
|
|
240
|
+
notBefore = row.not_before;
|
|
241
|
+
}
|
|
242
|
+
}
|
|
243
|
+
let notAfter = null;
|
|
244
|
+
let notAfterMs = null;
|
|
245
|
+
for (const row of matches) {
|
|
246
|
+
if (row.not_after == null || row.not_after === '')
|
|
247
|
+
continue;
|
|
248
|
+
const parsed = parseTime(row.not_after);
|
|
249
|
+
if (parsed == null)
|
|
250
|
+
return { ok: false, reason: 'not_after_invalid' };
|
|
251
|
+
if (notAfterMs == null || parsed < notAfterMs) {
|
|
252
|
+
notAfterMs = parsed;
|
|
253
|
+
notAfter = row.not_after;
|
|
254
|
+
}
|
|
255
|
+
}
|
|
256
|
+
let revoked = false;
|
|
257
|
+
let revokedAt = null;
|
|
258
|
+
let revokedMs = null;
|
|
259
|
+
for (const row of matches) {
|
|
260
|
+
const stamp = row.revoked_at;
|
|
261
|
+
const hasStamp = stamp != null && stamp !== '';
|
|
262
|
+
if (row.status === 'revoked' || hasStamp)
|
|
263
|
+
revoked = true;
|
|
264
|
+
if (!hasStamp)
|
|
265
|
+
continue;
|
|
266
|
+
const parsed = parseTime(stamp);
|
|
267
|
+
if (parsed == null)
|
|
268
|
+
return { ok: false, reason: 'revoked_at_missing' };
|
|
269
|
+
if (revokedMs == null || parsed < revokedMs) {
|
|
270
|
+
revokedMs = parsed;
|
|
271
|
+
revokedAt = stamp;
|
|
272
|
+
}
|
|
273
|
+
}
|
|
274
|
+
if (revoked && revokedAt == null)
|
|
275
|
+
return { ok: false, reason: 'revoked_at_missing' };
|
|
276
|
+
return issuerEntryWindow({
|
|
277
|
+
not_before: notBefore,
|
|
278
|
+
not_after: notAfter,
|
|
279
|
+
status: revoked ? 'revoked' : last.status,
|
|
280
|
+
revoked_at: revoked ? revokedAt : null,
|
|
281
|
+
}, issuedAt);
|
|
282
|
+
}
|
|
283
|
+
function issuerHistoryDocumentHash(doc) {
|
|
284
|
+
return sha256Hex((0, jcs_js_1.jcsCanonicalize)(doc));
|
|
285
|
+
}
|
|
286
|
+
/** Pin from verified JWS claims. An unsigned outer copy is not a pin. */
|
|
287
|
+
function readIssuerHistoryPin(claims) {
|
|
288
|
+
const pin = claims?.issuer_history;
|
|
289
|
+
if (!pin || typeof pin !== 'object')
|
|
290
|
+
return null;
|
|
291
|
+
const row = pin;
|
|
292
|
+
if (typeof row.hash !== 'string' || !/^[0-9a-f]{64}$/.test(row.hash))
|
|
293
|
+
return null;
|
|
294
|
+
const version = Number(row.version);
|
|
295
|
+
const seq = Number(row.seq);
|
|
296
|
+
if (!Number.isInteger(version) || version < 1)
|
|
297
|
+
return null;
|
|
298
|
+
if (!Number.isInteger(seq) || seq < 1)
|
|
299
|
+
return null;
|
|
300
|
+
return { hash: row.hash, version, seq };
|
|
301
|
+
}
|
|
302
|
+
function historyUrlWithPin(url, pin) {
|
|
303
|
+
if (!pin)
|
|
304
|
+
return url;
|
|
305
|
+
const parsed = new URL(url);
|
|
306
|
+
parsed.searchParams.set('version', String(pin.version));
|
|
307
|
+
return parsed.toString();
|
|
308
|
+
}
|
|
309
|
+
function historyPinMatches(doc, raw, pin) {
|
|
310
|
+
if (raw != null && sha256Hex(raw) !== pin.hash)
|
|
311
|
+
return false;
|
|
312
|
+
if (issuerHistoryDocumentHash(doc) !== pin.hash)
|
|
313
|
+
return false;
|
|
314
|
+
if (Number(doc.version) !== pin.version)
|
|
315
|
+
return false;
|
|
316
|
+
if (Number(doc.seq) !== pin.seq)
|
|
317
|
+
return false;
|
|
318
|
+
return true;
|
|
319
|
+
}
|
|
320
|
+
/**
|
|
321
|
+
* Fetch or accept the issuer-history body. A rejected body is still returned
|
|
322
|
+
* so the caller can fail closed instead of ignoring it.
|
|
323
|
+
*/
|
|
324
|
+
async function loadIssuerHistoryBody({ document = null, documentBytes = null, fetchHistory = false, strict = false, historyUrl = null, fetchImpl = globalThis.fetch, trustedHosts = ['api.chit402.com'], pin = null, receipt, }) {
|
|
325
|
+
let doc = document;
|
|
326
|
+
let raw = documentBytes;
|
|
327
|
+
if (doc || !(fetchHistory || historyUrl || strict || (pin && pin.hash))) {
|
|
328
|
+
return { doc: doc ?? null, raw, unreachable: false, warning: null };
|
|
329
|
+
}
|
|
330
|
+
const baseUrl = historyUrl || historyUrlFromReceipt(receipt);
|
|
331
|
+
if (!baseUrl) {
|
|
332
|
+
return {
|
|
333
|
+
doc: null,
|
|
334
|
+
raw: null,
|
|
335
|
+
unreachable: true,
|
|
336
|
+
warning: 'issuer history unreachable: no history url on the receipt',
|
|
337
|
+
};
|
|
338
|
+
}
|
|
339
|
+
let url = baseUrl;
|
|
340
|
+
try {
|
|
341
|
+
url = historyUrlWithPin(baseUrl, pin);
|
|
342
|
+
}
|
|
343
|
+
catch {
|
|
344
|
+
return { doc: null, raw: null, unreachable: true, warning: 'issuer history unreachable: bad history url' };
|
|
345
|
+
}
|
|
346
|
+
let parsed;
|
|
347
|
+
try {
|
|
348
|
+
parsed = new URL(url);
|
|
349
|
+
}
|
|
350
|
+
catch {
|
|
351
|
+
return { doc: null, raw: null, unreachable: true, warning: 'issuer history unreachable: bad history url' };
|
|
352
|
+
}
|
|
353
|
+
const explicit = !!historyUrl;
|
|
354
|
+
const hostOk = explicit
|
|
355
|
+
? parsed.protocol === 'https:'
|
|
356
|
+
: parsed.protocol === 'https:' && trustedHosts.some((host) => host.toLowerCase() === parsed.hostname.toLowerCase());
|
|
357
|
+
if (!hostOk) {
|
|
358
|
+
return {
|
|
359
|
+
doc: null,
|
|
360
|
+
raw: null,
|
|
361
|
+
unreachable: true,
|
|
362
|
+
warning: 'issuer history unreachable: history host is not allowed',
|
|
363
|
+
};
|
|
364
|
+
}
|
|
365
|
+
try {
|
|
366
|
+
const res = await fetchImpl(url, { signal: AbortSignal.timeout(4000) });
|
|
367
|
+
if (!res.ok)
|
|
368
|
+
throw new Error(`HTTP ${res.status}`);
|
|
369
|
+
raw = await res.text();
|
|
370
|
+
doc = JSON.parse(raw);
|
|
371
|
+
return { doc, raw, unreachable: false, warning: null };
|
|
372
|
+
}
|
|
373
|
+
catch (err) {
|
|
374
|
+
const warning = `issuer history unreachable: ${err instanceof Error ? err.message : String(err)}`;
|
|
375
|
+
return { doc: null, raw: null, unreachable: true, warning };
|
|
376
|
+
}
|
|
377
|
+
}
|
|
378
|
+
async function checkReceiptIssuerHistory(receipt, { document = null, fetchHistory = false, strict = false, historyUrl = null, jwks, trustedKids, fetchImpl = globalThis.fetch, trustedHosts = ['api.chit402.com'], issuedAt = null, kid = null, pin = null, requirePin = false, documentBytes = null, } = {}) {
|
|
379
|
+
const base = {
|
|
380
|
+
checked: false,
|
|
381
|
+
ok: true,
|
|
382
|
+
unreachable: false,
|
|
383
|
+
warning: null,
|
|
384
|
+
reason: null,
|
|
385
|
+
kid,
|
|
386
|
+
document: null,
|
|
387
|
+
loaded: false,
|
|
388
|
+
};
|
|
389
|
+
const pinned = !!(pin && pin.hash);
|
|
390
|
+
const failClosed = strict || pinned || requirePin;
|
|
391
|
+
if (requirePin && !pinned) {
|
|
392
|
+
return { ...base, checked: true, ok: false, reason: 'issuer_history_pin_missing' };
|
|
393
|
+
}
|
|
394
|
+
const loadedBody = await loadIssuerHistoryBody({
|
|
395
|
+
document,
|
|
396
|
+
documentBytes,
|
|
397
|
+
fetchHistory,
|
|
398
|
+
strict,
|
|
399
|
+
historyUrl,
|
|
400
|
+
fetchImpl,
|
|
401
|
+
trustedHosts,
|
|
402
|
+
pin,
|
|
403
|
+
receipt,
|
|
404
|
+
});
|
|
405
|
+
const doc = loadedBody.doc;
|
|
406
|
+
// A body that fails the pin or the signature must not become a trust root.
|
|
407
|
+
// `loaded` stays true so offline head trust fails closed instead of
|
|
408
|
+
// falling through to the production pin alone.
|
|
409
|
+
const pinOk = !doc || !pinned || !pin || historyPinMatches(doc, loadedBody.raw, pin);
|
|
410
|
+
const signed = doc && pinOk
|
|
411
|
+
? verifyIssuerHistoryDocument(doc, { jwks, trustedKids })
|
|
412
|
+
: null;
|
|
413
|
+
const usable = doc && pinOk && signed?.valid ? doc : null;
|
|
414
|
+
const loaded = doc != null;
|
|
415
|
+
if (!kid) {
|
|
416
|
+
const warning = 'issuer history not checked: receipt has no kid';
|
|
417
|
+
if (failClosed) {
|
|
418
|
+
return { ...base, checked: true, ok: false, reason: warning, document: usable, loaded };
|
|
419
|
+
}
|
|
420
|
+
return { ...base, warning, document: usable, loaded };
|
|
421
|
+
}
|
|
422
|
+
if (loadedBody.unreachable) {
|
|
423
|
+
const warning = loadedBody.warning;
|
|
424
|
+
if (failClosed) {
|
|
425
|
+
return { ...base, checked: true, ok: false, unreachable: true, reason: warning, warning };
|
|
426
|
+
}
|
|
427
|
+
return { ...base, unreachable: true, warning };
|
|
428
|
+
}
|
|
429
|
+
if (!doc) {
|
|
430
|
+
const warning = 'issuer history not checked';
|
|
431
|
+
if (failClosed)
|
|
432
|
+
return { ...base, checked: true, ok: false, unreachable: true, reason: warning, warning };
|
|
433
|
+
return { ...base, warning };
|
|
434
|
+
}
|
|
435
|
+
if (!pinOk && pin) {
|
|
436
|
+
const reason = rawPinReason(doc, loadedBody.raw, pin);
|
|
437
|
+
return { ...base, checked: true, ok: false, reason, loaded: true };
|
|
438
|
+
}
|
|
439
|
+
if (!signed?.valid) {
|
|
440
|
+
return {
|
|
441
|
+
...base,
|
|
442
|
+
checked: true,
|
|
443
|
+
ok: false,
|
|
444
|
+
reason: signed?.reason || 'issuer_history_invalid',
|
|
445
|
+
loaded: true,
|
|
446
|
+
};
|
|
447
|
+
}
|
|
448
|
+
const window = issuerKeyWindow(doc, kid, issuedAt);
|
|
449
|
+
if (!window.ok) {
|
|
450
|
+
return { ...base, checked: true, ok: false, reason: window.reason, document: usable, loaded: true };
|
|
451
|
+
}
|
|
452
|
+
return { ...base, checked: true, ok: true, document: usable, loaded: true };
|
|
453
|
+
}
|
|
454
|
+
function rawPinReason(doc, raw, pin) {
|
|
455
|
+
if (raw != null && sha256Hex(raw) !== pin.hash)
|
|
456
|
+
return 'issuer_history_pin_mismatch';
|
|
457
|
+
if (issuerHistoryDocumentHash(doc) !== pin.hash)
|
|
458
|
+
return 'issuer_history_pin_mismatch';
|
|
459
|
+
if (Number(doc.version) !== pin.version)
|
|
460
|
+
return 'issuer_history_version_mismatch';
|
|
461
|
+
return 'issuer_history_seq_mismatch';
|
|
462
|
+
}
|
|
463
|
+
/**
|
|
464
|
+
* The snapshot shipped in this package. A live body is accepted only when
|
|
465
|
+
* it prefix-extends this chain. Used alone, the verifier reports this date.
|
|
466
|
+
*/
|
|
467
|
+
/** Day the bundled v2 snapshot was sealed into this package. */
|
|
468
|
+
exports.BUNDLED_HISTORY_AS_OF = '2026-10-14';
|
|
469
|
+
/**
|
|
470
|
+
* The one recorded rewrite. v1 genesis (custody field) may be followed by v2
|
|
471
|
+
* (that field dropped). The reverse is not an extension: an old file must
|
|
472
|
+
* not hide a later revoke.
|
|
473
|
+
*/
|
|
474
|
+
const GRANDFATHERED_HISTORY_REWRITES = [
|
|
475
|
+
{
|
|
476
|
+
from: '3d8259fb043f8ac80c924ea89d508f0a898f70bd0335658ef47370d5757e27a6',
|
|
477
|
+
to: '349d7bb495bad55aaa25d05ee91134575e6e7d300795b37b41f4bcf29af80f0e',
|
|
478
|
+
},
|
|
479
|
+
];
|
|
480
|
+
function grandfatheredRewrite(base, next) {
|
|
481
|
+
const from = base?.head_hash;
|
|
482
|
+
const to = next?.head_hash;
|
|
483
|
+
if (!from || !to)
|
|
484
|
+
return false;
|
|
485
|
+
return GRANDFATHERED_HISTORY_REWRITES.some((row) => row.from === from && row.to === to);
|
|
486
|
+
}
|
|
487
|
+
/** Later entries may be appended. The bundled entry_hash prefix must be unchanged. */
|
|
488
|
+
function historyPrefixExtends(base, next) {
|
|
489
|
+
if (grandfatheredRewrite(base, next))
|
|
490
|
+
return true;
|
|
491
|
+
const left = base?.entries || [];
|
|
492
|
+
const right = next?.entries || [];
|
|
493
|
+
if (!left.length || right.length < left.length)
|
|
494
|
+
return false;
|
|
495
|
+
for (let i = 0; i < left.length; i++) {
|
|
496
|
+
if (!left[i]?.entry_hash || right[i]?.entry_hash !== left[i]?.entry_hash)
|
|
497
|
+
return false;
|
|
498
|
+
}
|
|
499
|
+
return true;
|
|
500
|
+
}
|
|
501
|
+
function loadBundledIssuerHistory() {
|
|
502
|
+
const require = (0, node_module_1.createRequire)(__filename);
|
|
503
|
+
const bytes = (0, node_fs_1.readFileSync)(require.resolve('../issuer-history.snapshot.json'), 'utf8');
|
|
504
|
+
return { document: JSON.parse(bytes), bytes };
|
|
505
|
+
}
|
|
506
|
+
function resolvedFrom(source, document, bytes, asOf, invalid = false, reason = null) {
|
|
507
|
+
return {
|
|
508
|
+
source,
|
|
509
|
+
document,
|
|
510
|
+
bytes,
|
|
511
|
+
asOf,
|
|
512
|
+
headHash: document?.head_hash ?? null,
|
|
513
|
+
entryCount: document?.entries?.length ?? 0,
|
|
514
|
+
invalid,
|
|
515
|
+
reason,
|
|
516
|
+
};
|
|
517
|
+
}
|
|
518
|
+
/**
|
|
519
|
+
* File, else a live body that prefix-extends the bundled snapshot, else the
|
|
520
|
+
* bundled snapshot. A file that does not verify is invalid and is not replaced.
|
|
521
|
+
*/
|
|
522
|
+
async function resolveIssuerHistory({ fileBytes = null, receipt = {}, fetchImpl = globalThis.fetch, jwks, trustedKids, timeoutMs = 800, } = {}) {
|
|
523
|
+
const bundled = loadBundledIssuerHistory();
|
|
524
|
+
if (fileBytes != null) {
|
|
525
|
+
let doc;
|
|
526
|
+
try {
|
|
527
|
+
doc = JSON.parse(fileBytes);
|
|
528
|
+
}
|
|
529
|
+
catch {
|
|
530
|
+
return resolvedFrom('file', null, fileBytes, null, true, 'issuer_history_unreadable');
|
|
531
|
+
}
|
|
532
|
+
const signed = verifyIssuerHistoryDocument(doc, { jwks, trustedKids });
|
|
533
|
+
if (!signed.valid) {
|
|
534
|
+
return resolvedFrom('file', doc, fileBytes, null, true, signed.reason || 'issuer_history_invalid');
|
|
535
|
+
}
|
|
536
|
+
// A supplied file must extend the bundled chain. An older or forked file
|
|
537
|
+
// could hide a later revocation (truncation rollback).
|
|
538
|
+
if (!historyPrefixExtends(bundled.document, doc)) {
|
|
539
|
+
return resolvedFrom('file', doc, fileBytes, null, true, 'issuer_history_not_extension');
|
|
540
|
+
}
|
|
541
|
+
return resolvedFrom('file', doc, fileBytes, null, false, null);
|
|
542
|
+
}
|
|
543
|
+
const liveUrl = historyUrlFromReceipt(receipt);
|
|
544
|
+
if (liveUrl) {
|
|
545
|
+
let hostOk = false;
|
|
546
|
+
try {
|
|
547
|
+
const parsed = new URL(liveUrl);
|
|
548
|
+
hostOk = parsed.protocol === 'https:'
|
|
549
|
+
&& ['api.chit402.com'].some((host) => host === parsed.hostname.toLowerCase());
|
|
550
|
+
}
|
|
551
|
+
catch {
|
|
552
|
+
hostOk = false;
|
|
553
|
+
}
|
|
554
|
+
if (hostOk) {
|
|
555
|
+
try {
|
|
556
|
+
const res = await fetchImpl(liveUrl, { signal: AbortSignal.timeout(timeoutMs) });
|
|
557
|
+
if (res.ok) {
|
|
558
|
+
const bytes = await res.text();
|
|
559
|
+
const doc = JSON.parse(bytes);
|
|
560
|
+
const signed = verifyIssuerHistoryDocument(doc, { jwks, trustedKids });
|
|
561
|
+
if (signed.valid && historyPrefixExtends(bundled.document, doc)) {
|
|
562
|
+
return resolvedFrom('live', doc, bytes, null, false, null);
|
|
563
|
+
}
|
|
564
|
+
}
|
|
565
|
+
}
|
|
566
|
+
catch {
|
|
567
|
+
// A live miss falls through to the bundled snapshot.
|
|
568
|
+
}
|
|
569
|
+
}
|
|
570
|
+
}
|
|
571
|
+
const signedBundle = verifyIssuerHistoryDocument(bundled.document, { jwks, trustedKids });
|
|
572
|
+
if (!signedBundle.valid) {
|
|
573
|
+
return resolvedFrom('bundled', null, null, exports.BUNDLED_HISTORY_AS_OF, false, 'kid_not_in_history');
|
|
574
|
+
}
|
|
575
|
+
return resolvedFrom('bundled', bundled.document, bundled.bytes, exports.BUNDLED_HISTORY_AS_OF, false, null);
|
|
576
|
+
}
|
|
577
|
+
function historyUrlFromReceipt(receipt) {
|
|
578
|
+
const jwks = receipt.verification?.jwks_uri;
|
|
579
|
+
if (jwks && jwks.includes('/.well-known/jwks.json')) {
|
|
580
|
+
return jwks.replace('/.well-known/jwks.json', '/.well-known/issuer-history.json');
|
|
581
|
+
}
|
|
582
|
+
if (receipt.verify_url) {
|
|
583
|
+
try {
|
|
584
|
+
const url = new URL(receipt.verify_url);
|
|
585
|
+
if (url.protocol !== 'https:' && url.protocol !== 'http:')
|
|
586
|
+
return null;
|
|
587
|
+
return `${url.origin}/.well-known/issuer-history.json`;
|
|
588
|
+
}
|
|
589
|
+
catch {
|
|
590
|
+
return null;
|
|
591
|
+
}
|
|
592
|
+
}
|
|
593
|
+
return null;
|
|
594
|
+
}
|
|
595
|
+
//# sourceMappingURL=issuer-history.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"issuer-history.js","sourceRoot":"","sources":["../src/issuer-history.ts"],"names":[],"mappings":";;;AAsFA,wDAqBC;AAED,wDAEC;AASD,kEAwDC;AAsDD,8CAwBC;AAED,0CAsDC;AAED,8DAEC;AAGD,oDAUC;AAqGD,8DA6GC;AAyDD,oDAYC;AAED,4DAIC;AA0BD,oDAmEC;AAED,sDAeC;AAltBD;;;;GAIG;AACH,6CAAyC;AACzC,qCAAuC;AACvC,6CAA4C;AAC5C,qCAA2C;AAC3C,qCAMkB;AAML,QAAA,qBAAqB,GAAG,2BAA2B,CAAC;AAkDjE,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;QAChG,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAyB;IAC9D,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACf,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG;YAClB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO;YAC7B,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK;SAC5B,CAAC,CAAC,CAAC,IAAI;QACR,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAyB;IAC9D,OAAO,SAAS,CAAC,IAAA,wBAAe,EAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;IACpG,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAgB,2BAA2B,CACzC,GAA0B,EAC1B,EAAE,IAAI,EAAE,WAAW,KAA8D,EAAE;IAEnF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,6BAAqB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC9F,IAAI,sBAAsB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,UAAU;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC/G,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC5G,IAAI,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IAClC,CAAC;IACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC/F,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5D,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAClF,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,gBAAgB,EAAE,GAAG,IAAI,IAAI,CAAC;IACpD,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,IAAI,GAAG,WAAW,IAAI,oCAA2B,CAAC;IACxD,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC;IAClD,IAAI,QAAQ,IAAI,IAAA,2BAAkB,EAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,QAAQ,IAAI,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,IAAI,IAAA,sBAAa,EAAC,QAAQ,CAAC,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,6BAAqB;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACjG,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAChH,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACxF,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC7F,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACjD,IAAI,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAA6B;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,KAAK,GAAG,QAAQ,CAAC;YAAE,QAAQ,GAAG,KAAK,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,QAAmC,EAAE,IAA+B;IAC1F,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACxF,OAAO,IAAI,KAAK,KAAK,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAA6B;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoE,CAAC;IAC1F,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACxE,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gHAAgH;AAChH,SAAS,yBAAyB,CAAC,OAA6B,EAAE,SAAwB;IACxF,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IACpE,OAAO,KAAK,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAgB,iBAAiB,CAC/B,KAKoB,EACpB,QAAiB;IAEjB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACtE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1E,IAAI,MAAM,GAAG,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACjF,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnG,IAAI,QAAQ,IAAI,IAAI,IAAI,MAAM,GAAG,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAClG,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,OAAO,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACxE,IAAI,MAAM,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAgB,eAAe,CAC7B,GAA0B,EAC1B,GAAW,EACX,QAAiB;IAEjB,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACvE,IAAI,WAAW,IAAI,IAAI,IAAI,MAAM,GAAG,WAAW,EAAE,CAAC;YAChD,WAAW,GAAG,MAAM,CAAC;YACrB,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE;YAAE,SAAS;QAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACtE,IAAI,UAAU,IAAI,IAAI,IAAI,MAAM,GAAG,UAAU,EAAE,CAAC;YAC9C,UAAU,GAAG,MAAM,CAAC;YACpB,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ;YAAE,OAAO,GAAG,IAAI,CAAC;QACzD,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACvE,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;YAC5C,SAAS,GAAG,MAAM,CAAC;YACnB,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrF,OAAO,iBAAiB,CAAC;QACvB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;QACzC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;KACvC,EAAE,QAAQ,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,yBAAyB,CAAC,GAAY;IACpD,OAAO,SAAS,CAAC,IAAA,wBAAe,EAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,yEAAyE;AACzE,SAAgB,oBAAoB,CAAC,MAAkD;IACrF,MAAM,GAAG,GAAG,MAAM,EAAE,cAAc,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,GAAG,GAAG,GAA2D,CAAC;IACxE,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,GAA4B;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CACxB,GAA0B,EAC1B,GAAkB,EAClB,GAAqB;IAErB,IAAI,GAAG,IAAI,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,EACnC,QAAQ,GAAG,IAAI,EACf,aAAa,GAAG,IAAI,EACpB,YAAY,GAAG,KAAK,EACpB,MAAM,GAAG,KAAK,EACd,UAAU,GAAG,IAAI,EACjB,SAAS,GAAG,UAAU,CAAC,KAAK,EAC5B,YAAY,GAAG,CAAC,iBAAiB,CAAC,EAClC,GAAG,GAAG,IAAI,EACV,OAAO,GAWR;IAMC,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,IAAI,GAAG,GAAG,aAAa,CAAC;IACxB,IAAI,GAAG,IAAI,CAAC,CAAC,YAAY,IAAI,UAAU,IAAI,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,IAAI;YACT,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,2DAA2D;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;IAC7G,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;IAC7G,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ;QACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC9B,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACtH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,IAAI;YACT,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,yDAAyD;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QAC/C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,OAA4F,EAC5F,EACE,QAAQ,GAAG,IAAI,EACf,YAAY,GAAG,KAAK,EACpB,MAAM,GAAG,KAAK,EACd,UAAU,GAAG,IAAI,EACjB,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,UAAU,CAAC,KAAK,EAC5B,YAAY,GAAG,CAAC,iBAAiB,CAAC,EAClC,QAAQ,GAAG,IAAI,EACf,GAAG,GAAG,IAAI,EACV,GAAG,GAAG,IAAI,EACV,UAAU,GAAG,KAAK,EAClB,aAAa,GAAG,IAAI,MAkBlB,EAAE;IAEN,MAAM,IAAI,GAAuB;QAC/B,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,IAAI;QACZ,GAAG;QACH,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,KAAK;KACd,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,MAAM,IAAI,MAAM,IAAI,UAAU,CAAC;IAClD,IAAI,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC;QAC7C,QAAQ;QACR,aAAa;QACb,YAAY;QACZ,MAAM;QACN,UAAU;QACV,SAAS;QACT,YAAY;QACZ,GAAG;QACH,OAAO;KACR,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC3B,2EAA2E;IAC3E,oEAAoE;IACpE,+CAA+C;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,GAAG,IAAI,KAAK;QACzB,CAAC,CAAC,2BAA2B,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,MAAM,GAAG,GAAG,IAAI,KAAK,IAAI,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC;IAE3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,gDAAgD,CAAC;QACjE,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QACnC,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,4BAA4B,CAAC;QAC7C,IAAI,UAAU;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC1G,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACnB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,wBAAwB;YAClD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CACnB,GAA0B,EAC1B,GAAkB,EAClB,GAAqB;IAErB,IAAI,GAAG,IAAI,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI;QAAE,OAAO,6BAA6B,CAAC;IACrF,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI;QAAE,OAAO,6BAA6B,CAAC;IACtF,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO;QAAE,OAAO,iCAAiC,CAAC;IAClF,OAAO,6BAA6B,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,gEAAgE;AACnD,QAAA,qBAAqB,GAAG,YAAY,CAAC;AAElD;;;;GAIG;AACH,MAAM,8BAA8B,GAAG;IACrC;QACE,IAAI,EAAE,kEAAkE;QACxE,EAAE,EAAE,kEAAkE;KACvE;CACO,CAAC;AAgBX,SAAS,oBAAoB,CAC3B,IAA8C,EAC9C,IAA8C;IAE9C,MAAM,IAAI,GAAG,IAAI,EAAE,SAAS,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAI,EAAE,SAAS,CAAC;IAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,8BAA8B,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,sFAAsF;AACtF,SAAgB,oBAAoB,CAClC,IAA8C,EAC9C,IAA8C;IAE9C,IAAI,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU;YAAE,OAAO,KAAK,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB;IACtC,MAAM,OAAO,GAAG,IAAA,2BAAa,EAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAA0B,EAAE,KAAK,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CACnB,MAA2B,EAC3B,QAAsC,EACtC,KAAoB,EACpB,IAAmB,EACnB,OAAO,GAAG,KAAK,EACf,SAAwB,IAAI;IAE5B,OAAO;QACL,MAAM;QACN,QAAQ;QACR,KAAK;QACL,IAAI;QACJ,QAAQ,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI;QACrC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;QAC1C,OAAO;QACP,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,oBAAoB,CAAC,EACzC,SAAS,GAAG,IAAI,EAChB,OAAO,GAAG,EAAE,EACZ,SAAS,GAAG,UAAU,CAAC,KAAK,EAC5B,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,GAAG,MAQb,EAAE;IACJ,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAC;IAC3C,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,GAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA0B,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,IAAI,wBAAwB,CAAC,CAAC;QACrG,CAAC;QACD,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ;mBAChC,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACjF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA0B,CAAC;oBACvD,MAAM,MAAM,GAAG,2BAA2B,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;oBACvE,IAAI,MAAM,CAAC,KAAK,IAAI,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;wBAChE,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;oBAC7D,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,2BAA2B,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,6BAAqB,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,6BAAqB,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAsE;IAC1G,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC;IAC5C,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YACvE,OAAO,GAAG,GAAG,CAAC,MAAM,kCAAkC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|