sealbridge 0.2.2 → 0.3.1

package/dist/packages/runtime/dist/connection-service.d.ts

@@ -0,0 +1,159 @@
+import type { ConnectionAccepted, ConnectionAck, ConnectionRequest, KeyPair, RevocationList, Signed, SignedAgentCard, SignedEnvelope } from '../../core/dist/index.js';
+import type { ConnectionTransport } from './connection-transport.js';
+/** Content-free offer metadata. Bodies belong to the injected held-content port. */
+export interface ConnectionOffer {
+    requestId: string;
+    requestDigest: string;
+    fromOwnerDid: string;
+    toOwnerDid: string;
+    peerAgentDid?: string;
+    /** Derived locally from a verified peer card; never an identity selector. */
+    peerDisplayName?: string;
+    relayUrl: string;
+    createdAt: string;
+    expiresAt: string;
+    inviteDigest?: string;
+}
+export interface ConnectionConsent {
+    type: 'ConnectionConsent';
+    v: 1;
+    ownerDid: string;
+    requestDigest: string;
+    decidedAt: string;
+}
+export interface ConnectionOutboxEntry {
+    id: string;
+    requestId: string;
+    relayUrl: string;
+    deliveryDeadline: string;
+    envelope: SignedEnvelope;
+}
+export interface ConnectionAcceptanceCommit {
+    offer: ConnectionOffer;
+    accepted: Signed<ConnectionAccepted>;
+    outbox: ConnectionOutboxEntry;
+    consent: Signed<ConnectionConsent> | {
+        inviteDigest: string;
+    };
+    now: number;
+}
+export interface ConnectionRedemptionCommit extends ConnectionAcceptanceCommit {
+    inviteDigest: string;
+    requesterOwnerDid: string;
+    tokenExpiresAt: string;
+}
+/**
+ * All mutations are durable and atomic, scoped to the selected local owner DID.
+ * Implementations serialize concurrent writers and enforce these preconditions under lock:
+ * - record operations reject conflicting request IDs and blocked/withdrawn/tombstoned offers;
+ *   repeated incoming requests return their retained decision without creating a new offer;
+ * - accept checks the recorded incoming digest, deadline and current owner decision,
+ *   retaining signed local consent with the connection and acceptance/outbox;
+ * - redeem binds first owner + limited connection + acceptance/outbox in one write;
+ *   same means the exact original offer is still connected, inactive means a same-owner
+ *   reuse has no matching active offer, and other writes no authority;
+ * - apply checks the exact outgoing digest, owners, deadline, invite digest and consent,
+ *   then writes limited connection + ACK outbox before returning; duplicates requeue the
+ *   original ACK, including after markSent, without changing consent or connection state;
+ * - disconnect/block/withdraw supersede duplicates; retained decisions prevent restoration;
+ * - acknowledge checks the acceptance digest, request ID and both owners against the outbox,
+ *   durably marks receipt, and treats duplicate/unknown ACKs as no-ops.
+ * No connection operation creates trusted authority or task execution permission.
+ */
+export interface ConnectionPersistencePort {
+    outgoing(requestId: string): Promise<ConnectionOffer | undefined>;
+    incoming(requestId: string): Promise<ConnectionOffer | undefined>;
+    recordOutgoing(offer: ConnectionOffer, consent: Signed<ConnectionConsent>, outbox: ConnectionOutboxEntry, now: number): Promise<void>;
+    recordIncoming(offer: ConnectionOffer, now: number): Promise<'pending' | 'accepted'>;
+    accept(commit: ConnectionAcceptanceCommit): Promise<void>;
+    redeem(commit: ConnectionRedemptionCommit): Promise<'first' | 'same' | 'other' | 'inactive'>;
+    applyAccepted(commit: {
+        offer: ConnectionOffer;
+        accepted: Signed<ConnectionAccepted>;
+        acknowledgement: Signed<ConnectionAck>;
+        outbox: ConnectionOutboxEntry;
+        now: number;
+    }): Promise<void>;
+    acknowledge(ack: Signed<ConnectionAck>, requestId: string, now: number): Promise<void>;
+    listOutbox(now: number): Promise<ConnectionOutboxEntry[]>;
+    /** Retain sent notifications until application ACK (ACK notifications need no further ACK). */
+    markSent(id: string, now: number): Promise<void>;
+}
+export interface ConnectionHumanReviewProvider {
+    readonly kind: 'human';
+    review(context: {
+        reason: 'outgoing' | 'incoming' | 'confirm-invite';
+        localOwnerDid: string;
+        peerOwnerDid: string;
+        requestDigest: string;
+        request: Signed<ConnectionRequest>;
+    }): Promise<boolean>;
+}
+export interface ConnectionInspectionPort {
+    /** Persist the encrypted original, capped at min(offer deadline, first receivedAt + 24h).
+     * Duplicate holds retain the original deadline; expired content cannot be renewed. */
+    hold(envelope: SignedEnvelope, context: {
+        contentDigest: string;
+        expiresAt: string;
+        receivedAt: string;
+    }): Promise<void>;
+    /** Complete means the returned digest identifies this immutable held content. */
+    inspect(contentDigest: string): Promise<{
+        status: 'complete' | 'unavailable' | 'error';
+        contentDigest: string;
+    }>;
+    discard(contentDigest: string): Promise<void>;
+}
+export interface ConnectionServiceOptions {
+    owner: KeyPair;
+    agentCard: SignedAgentCard;
+    relayUrl: string;
+    persistence: ConnectionPersistencePort;
+    transport: ConnectionTransport;
+    humanReview?: ConnectionHumanReviewProvider;
+    inspection?: ConnectionInspectionPort;
+    revocations?: RevocationList;
+    allowPrivateRelay?: boolean;
+    now?: () => number;
+    id?: () => string;
+}
+export type ConnectionServiceResult = {
+    requestId: string;
+    status: 'pending' | 'connected' | 'acknowledged';
+    code?: 'PENDING_OWNER_APPROVAL' | 'CONNECTION_DELIVERY_PENDING';
+    retryable?: false;
+};
+/** Signed connection exchange; task execution remains a separate owner decision. */
+export declare class ConnectionService {
+    private readonly options;
+    private readonly now;
+    private readonly id;
+    constructor(options: ConnectionServiceOptions);
+    setAgentCard(card: SignedAgentCard): void;
+    private iso;
+    private review;
+    private invite;
+    private offer;
+    private outbox;
+    request(input: {
+        toOwnerDid: string;
+        peerAgentCard?: SignedAgentCard;
+        message?: string;
+        expiresAt?: string;
+        inviteToken?: string;
+        originProposalDigest?: string;
+        deferDelivery?: boolean;
+    }): Promise<ConnectionServiceResult>;
+    private checkRequest;
+    /** Validate an attached request before the task path mutates invitation or intake state. */
+    validateRequest(envelope: SignedEnvelope): void;
+    private inspect;
+    private accept;
+    /** Caller acknowledges relay delivery only after this resolves. No task mailbox is involved. */
+    receive(envelope: SignedEnvelope): Promise<ConnectionServiceResult>;
+    approve(envelope: SignedEnvelope): Promise<ConnectionServiceResult>;
+    /** Retries only retained control notifications, each bounded by its original offer deadline. */
+    flushOutbox(): Promise<boolean>;
+}
+/** Both owners derive the same ID, with the smaller DID as the base. */
+export declare function connectionIdFor(left: string, right: string): string;

package/dist/packages/runtime/dist/connection-service.js

@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: Apache-2.0
+import { randomUUID } from 'node:crypto';
+import { assertConnectionRequestCurrent, CONNECTION_OFFER_LIFETIME_MS, DEFAULT_CLOCK_SKEW_MS, digest, parseAndVerifyInviteToken, signConnectionAccepted, signConnectionAck, signConnectionRequest, signPayload, validateRelayEndpointUrl, verifyConnectionRequest, verifySignedAgentCard, } from '../../core/dist/index.js';
+import { openConnectionFrame, retryConnectionEnvelope, sealConnectionFrame } from './connection-transport.js';
+/** Signed connection exchange; task execution remains a separate owner decision. */
+export class ConnectionService {
+    options;
+    now;
+    id;
+    constructor(options) {
+        this.options = options;
+        this.now = options.now ?? Date.now;
+        this.id = options.id ?? randomUUID;
+        validateRelayEndpointUrl(options.relayUrl, options);
+        if (!verifySignedAgentCard(options.agentCard, this.now()) ||
+            options.agentCard.payload.ownerDid !== options.owner.did ||
+            options.agentCard.payload.relayEndpoint !== options.relayUrl)
+            throw new Error('INVALID_AGENT_CARD');
+    }
+    setAgentCard(card) {
+        if (!verifySignedAgentCard(card, this.now()) || card.payload.ownerDid !== this.options.owner.did ||
+            card.payload.relayEndpoint !== this.options.relayUrl)
+            throw new Error('INVALID_AGENT_CARD');
+        this.options.agentCard = card;
+    }
+    iso() { return new Date(this.now()).toISOString(); }
+    async review(reason, request) {
+        const provider = this.options.humanReview;
+        if (!provider || provider.kind !== 'human')
+            throw new Error('APPROVAL_CHANNEL_UNAVAILABLE');
+        const p = request.payload;
+        const requestDigest = digest(request);
+        const approved = await provider.review({ reason, localOwnerDid: this.options.owner.did,
+            peerOwnerDid: p.fromOwnerDid === this.options.owner.did ? p.toOwnerDid : p.fromOwnerDid,
+            requestDigest, request: structuredClone(request) });
+        if (approved !== true)
+            throw new Error('APPROVAL_REJECTED');
+        assertConnectionRequestCurrent(p, this.now());
+        return signPayload({ type: 'ConnectionConsent', v: 1, ownerDid: this.options.owner.did,
+            requestDigest, decidedAt: this.iso() }, this.options.owner, this.iso());
+    }
+    invite(token, expectedOwner, expectedAgent) {
+        const now = this.now();
+        // Historical verification permits revocation to precede expiry, as in current admission.
+        const invite = parseAndVerifyInviteToken(token, now, { allowPrivateRelay: this.options.allowPrivateRelay, allowExpired: true });
+        if (invite.ownerDid !== expectedOwner || (expectedAgent && invite.agentDid !== expectedAgent) ||
+            invite.relayUrl !== this.options.relayUrl)
+            throw new Error('INVITE_WORKER_MISMATCH');
+        this.options.revocations?.assertNotRevoked('invite', digest(invite));
+        this.options.revocations?.assertNotRevoked('invite', token);
+        if (Math.min(Date.parse(invite.expiresAt), Date.parse(invite.agentCard.payload.expiresAt)) <= now)
+            throw new Error('INVITE_EXPIRED');
+        return invite;
+    }
+    offer(request, outgoing = false, peerCard) {
+        const p = request.payload;
+        return { requestId: p.requestId, requestDigest: digest(request), fromOwnerDid: p.fromOwnerDid,
+            toOwnerDid: p.toOwnerDid,
+            ...(!outgoing ? { peerAgentDid: p.agentCard.payload.agentDid } : peerCard ? { peerAgentDid: peerCard.payload.agentDid } : {}),
+            ...(!outgoing ? { peerDisplayName: p.agentCard.payload.name } : peerCard ? { peerDisplayName: peerCard.payload.name } : {}),
+            relayUrl: this.options.relayUrl, createdAt: p.createdAt, expiresAt: p.expiresAt,
+            ...(p.inviteDigest ? { inviteDigest: p.inviteDigest } : {}) };
+    }
+    outbox(frame, deadline) {
+        return { id: frame.event.payload.type === 'ConnectionRequest' ? frame.requestId : frame.event.payload.eventId,
+            requestId: frame.requestId, relayUrl: this.options.relayUrl, deliveryDeadline: deadline,
+            envelope: sealConnectionFrame(frame, this.options.owner, this.now(), this.id()) };
+    }
+    async request(input) {
+        const invite = input.inviteToken === undefined ? undefined : this.invite(input.inviteToken, input.toOwnerDid);
+        const peerCard = invite?.agentCard ?? input.peerAgentCard;
+        if (input.peerAgentCard && (!verifySignedAgentCard(input.peerAgentCard, this.now()) ||
+            input.peerAgentCard.payload.ownerDid !== input.toOwnerDid ||
+            input.peerAgentCard.payload.relayEndpoint !== this.options.relayUrl ||
+            (invite && input.peerAgentCard.payload.agentDid !== invite.agentDid)))
+            throw new Error('INVALID_AGENT_CARD');
+        const now = this.now();
+        const request = signConnectionRequest({ type: 'ConnectionRequest', v: 1, protocolVersion: '0.2.0',
+            requestId: this.id(), fromOwnerDid: this.options.owner.did, toOwnerDid: input.toOwnerDid,
+            agentCard: this.options.agentCard, message: input.message ?? '', createdAt: new Date(now).toISOString(),
+            expiresAt: input.expiresAt ?? new Date(now + CONNECTION_OFFER_LIFETIME_MS).toISOString(),
+            ...(invite ? { inviteDigest: digest(invite) } : {}),
+            ...(input.originProposalDigest === undefined ? {} : { originProposalDigest: input.originProposalDigest }),
+        }, this.options.owner);
+        const consent = await this.review(invite ? 'confirm-invite' : 'outgoing', request);
+        const offer = this.offer(request, true, peerCard);
+        const outbox = this.outbox({ requestId: offer.requestId, event: request,
+            ...(input.inviteToken === undefined ? {} : { inviteToken: input.inviteToken }) }, offer.expiresAt);
+        await this.options.persistence.recordOutgoing(offer, consent, outbox, this.now());
+        const delivered = input.deferDelivery ? true : await this.flushOutbox();
+        return { requestId: offer.requestId, status: 'pending', ...(!delivered ? { code: 'CONNECTION_DELIVERY_PENDING' } : {}) };
+    }
+    checkRequest(frame) {
+        const request = frame.event;
+        if (!verifyConnectionRequest(request) || request.payload.toOwnerDid !== this.options.owner.did ||
+            request.payload.agentCard.payload.relayEndpoint !== this.options.relayUrl)
+            throw new Error('INVALID_CONNECTION_REQUEST');
+        assertConnectionRequestCurrent(request.payload, this.now());
+        if (!verifySignedAgentCard(request.payload.agentCard, this.now()))
+            throw new Error('INVALID_AGENT_CARD');
+        if (request.payload.inviteDigest && !frame.inviteToken)
+            throw new Error('INVALID_CONNECTION_REQUEST');
+        if (frame.inviteToken !== undefined) {
+            const invite = this.invite(frame.inviteToken, this.options.owner.did, this.options.agentCard.payload.agentDid);
+            if (digest(invite) !== request.payload.inviteDigest)
+                throw new Error('INVALID_CONNECTION_REQUEST');
+        }
+        return request;
+    }
+    /** Validate an attached request before the task path mutates invitation or intake state. */
+    validateRequest(envelope) {
+        const frame = openConnectionFrame(envelope, this.options.owner);
+        if (frame.event.payload.type !== 'ConnectionRequest')
+            throw new Error('INVALID_CONNECTION_REQUEST');
+        this.checkRequest(frame);
+    }
+    async inspect(envelope, request) {
+        const port = this.options.inspection;
+        if (!port)
+            return false;
+        const contentDigest = digest(request), now = this.now();
+        await port.hold(envelope, { contentDigest, receivedAt: new Date(now).toISOString(),
+            expiresAt: new Date(Math.min(Date.parse(request.payload.expiresAt), now + 24 * 60 * 60 * 1000)).toISOString() });
+        let completion;
+        try {
+            completion = await port.inspect(contentDigest);
+        }
+        catch {
+            return false;
+        }
+        return completion?.status === 'complete' && completion.contentDigest === contentDigest;
+    }
+    async accept(request, consent, token) {
+        const offer = this.offer(request);
+        assertConnectionRequestCurrent(request.payload, this.now());
+        const accepted = signConnectionAccepted({ type: 'ConnectionAccepted', v: 1, protocolVersion: '0.2.0',
+            eventId: this.id(), connectionId: connectionIdFor(this.options.owner.did, offer.fromOwnerDid), requestId: offer.requestId, requestDigest: offer.requestDigest,
+            fromOwnerDid: this.options.owner.did, toOwnerDid: offer.fromOwnerDid, acceptedAt: this.iso(), trust: 'limited',
+            ...(offer.inviteDigest ? { inviteDigest: offer.inviteDigest } : {}) }, this.options.owner);
+        const commit = { offer, accepted, consent, now: this.now(),
+            outbox: this.outbox({ requestId: offer.requestId, event: accepted }, offer.expiresAt) };
+        if (token !== undefined) {
+            const invite = this.invite(token, this.options.owner.did, this.options.agentCard.payload.agentDid);
+            const outcome = await this.options.persistence.redeem({ ...commit, inviteDigest: digest(invite),
+                requesterOwnerDid: offer.fromOwnerDid,
+                tokenExpiresAt: new Date(Math.min(Date.parse(invite.expiresAt), Date.parse(invite.agentCard.payload.expiresAt))).toISOString() });
+            if (outcome === 'other' || outcome === 'inactive')
+                return 'pending';
+        }
+        else
+            await this.options.persistence.accept(commit);
+        await this.options.inspection?.discard(offer.requestDigest);
+        return 'connected';
+    }
+    /** Caller acknowledges relay delivery only after this resolves. No task mailbox is involved. */
+    async receive(envelope) {
+        const frame = openConnectionFrame(envelope, this.options.owner), p = frame.event.payload;
+        if (p.type === 'ConnectionRequest') {
+            const request = this.checkRequest(frame);
+            const complete = await this.inspect(envelope, request);
+            // Without durable held content, leave relay delivery unacknowledged.
+            if (!this.options.inspection)
+                throw new Error('INSPECTION_UNAVAILABLE');
+            const decision = await this.options.persistence.recordIncoming(this.offer(request), this.now());
+            if (decision === 'accepted') {
+                await this.options.inspection.discard(digest(request));
+                const delivered = await this.flushOutbox();
+                return { requestId: frame.requestId, status: 'connected', ...(!delivered ? { code: 'CONNECTION_DELIVERY_PENDING' } : {}) };
+            }
+            if (complete && frame.inviteToken !== undefined) {
+                const status = await this.accept(request, { inviteDigest: p.inviteDigest }, frame.inviteToken);
+                if (status === 'connected') {
+                    const delivered = await this.flushOutbox();
+                    return { requestId: frame.requestId, status, ...(!delivered ? { code: 'CONNECTION_DELIVERY_PENDING' } : {}) };
+                }
+            }
+            return { requestId: frame.requestId, status: 'pending', code: 'PENDING_OWNER_APPROVAL', retryable: false };
+        }
+        if (p.type === 'ConnectionAccepted') {
+            const offer = await this.options.persistence.outgoing(frame.requestId);
+            if (!offer || offer.fromOwnerDid !== this.options.owner.did || offer.toOwnerDid !== p.fromOwnerDid ||
+                offer.requestDigest !== p.requestDigest || offer.inviteDigest !== p.inviteDigest)
+                throw new Error('CONNECTION_NOT_PENDING');
+            if (Date.parse(offer.expiresAt) <= this.now())
+                throw new Error('CONNECTION_REQUEST_EXPIRED');
+            if (Date.parse(p.acceptedAt) < Date.parse(offer.createdAt) || Date.parse(p.acceptedAt) >= Date.parse(offer.expiresAt) ||
+                Date.parse(p.acceptedAt) > this.now() + DEFAULT_CLOCK_SKEW_MS)
+                throw new Error('INVALID_CONNECTION_ACCEPTED');
+            const acknowledgement = signConnectionAck({ type: 'ConnectionAck', v: 1, eventId: this.id(),
+                acceptedDigest: digest(frame.event), fromOwnerDid: this.options.owner.did, toOwnerDid: p.fromOwnerDid,
+                receivedAt: this.iso() }, this.options.owner);
+            await this.options.persistence.applyAccepted({ offer, accepted: frame.event,
+                acknowledgement, outbox: this.outbox({ requestId: frame.requestId, event: acknowledgement }, offer.expiresAt), now: this.now() });
+            const delivered = await this.flushOutbox();
+            return { requestId: frame.requestId, status: 'connected', ...(!delivered ? { code: 'CONNECTION_DELIVERY_PENDING' } : {}) };
+        }
+        if (Date.parse(p.receivedAt) > this.now() + DEFAULT_CLOCK_SKEW_MS)
+            throw new Error('INVALID_CONNECTION_ACK');
+        await this.options.persistence.acknowledge(frame.event, frame.requestId, this.now());
+        return { requestId: frame.requestId, status: 'acknowledged' };
+    }
+    async approve(envelope) {
+        const frame = openConnectionFrame(envelope, this.options.owner);
+        const request = this.checkRequest(frame), offer = await this.options.persistence.incoming(frame.requestId);
+        if (!offer || offer.requestDigest !== digest(request))
+            throw new Error('CONNECTION_NOT_PENDING');
+        if (!await this.inspect(envelope, request))
+            throw new Error('INSPECTION_INCOMPLETE');
+        const consent = await this.review('incoming', request);
+        // Explicit review retains first-use invitation binding; an already-bound invite
+        // can still receive separate owner consent without changing that binding.
+        const status = frame.inviteToken === undefined ? 'pending' : await this.accept(request, consent, frame.inviteToken);
+        if (status !== 'connected')
+            await this.accept(request, consent);
+        const delivered = await this.flushOutbox();
+        return { requestId: frame.requestId, status: 'connected', ...(!delivered ? { code: 'CONNECTION_DELIVERY_PENDING' } : {}) };
+    }
+    /** Retries only retained control notifications, each bounded by its original offer deadline. */
+    async flushOutbox() {
+        let delivered = true;
+        for (const entry of await this.options.persistence.listOutbox(this.now())) {
+            if (Date.parse(entry.deliveryDeadline) <= this.now())
+                continue;
+            try {
+                await this.options.transport.send(entry.relayUrl, retryConnectionEnvelope(entry.envelope, this.options.owner, this.now()));
+                await this.options.persistence.markSent(entry.id, this.now());
+            }
+            catch {
+                delivered = false;
+            }
+        }
+        return delivered;
+    }
+}
+/** Both owners derive the same ID, with the smaller DID as the base. */
+export function connectionIdFor(left, right) {
+    return 'connection_' + digest([left, right].sort()).slice(7);
+}
+//# sourceMappingURL=connection-service.js.map

package/dist/packages/runtime/dist/connection-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-service.js","sourceRoot":"","sources":["../src/connection-service.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,8BAA8B,EAAE,4BAA4B,EAAE,qBAAqB,EACnF,MAAM,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,iBAAiB,EAC5E,qBAAqB,EAAE,WAAW,EAAE,wBAAwB,EAAE,uBAAuB,EACrF,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAKnB,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAoH9G,oFAAoF;AACpF,MAAM,OAAO,iBAAiB;IAGC;IAFZ,GAAG,CAAe;IAClB,EAAE,CAAe;IAClC,YAA6B,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAC5D,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,UAAU,CAAC;QACnC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YACrD,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG;YACxD,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1G,CAAC;IACD,YAAY,CAAC,IAAqB;QAChC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;YAC5F,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAChG,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAChC,CAAC;IACO,GAAG,KAAa,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC5D,KAAK,CAAC,MAAM,CAAC,MAAkD,EAAE,OAAkC;QACzG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC5F,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;YACpF,YAAY,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;YACvF,aAAa,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC5D,8BAA8B,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9C,OAAO,WAAW,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;YACpF,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;IACO,MAAM,CAAC,KAAa,EAAE,aAAqB,EAAE,aAAsB;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,yFAAyF;QACzF,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAChI,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa,CAAC;YACzF,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACzF,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG;YAC/F,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IACO,KAAK,CAAC,OAAkC,EAAE,QAAQ,GAAG,KAAK,EAAE,QAA0B;QAC5F,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY;YAC3F,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7H,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3H,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;YAC/E,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClE,CAAC;IACO,MAAM,CAAC,KAAsB,EAAE,QAAgB;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO;YAC3G,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ;YACvF,QAAQ,EAAE,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,KAEb;QACC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC;QAC1D,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/E,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,UAAU;YACzD,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;YACnE,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACjH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO;YAC/F,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;YACxF,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACvG,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,GAAG,4BAA4B,CAAC,CAAC,WAAW,EAAE;YACxF,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC;SAC1G,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO;YACrE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACxE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3H,CAAC;IACO,YAAY,CAAC,KAAsB;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAkC,CAAC;QACzD,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;YAC1F,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC3E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACzG,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACtG,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/G,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,4FAA4F;IAC5F,eAAe,CAAC,QAAwB;QACtC,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,mBAAmB;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACpG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,QAAwB,EAAE,OAAkC;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAChF,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACnH,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YAAC,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAC/E,OAAO,UAAU,EAAE,MAAM,KAAK,UAAU,IAAI,UAAU,CAAC,aAAa,KAAK,aAAa,CAAC;IACzF,CAAC;IACO,KAAK,CAAC,MAAM,CAAC,OAAkC,EAAE,OAA8C,EAAE,KAAc;QACrH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO;YAClG,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;YAC7J,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS;YAC9G,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7F,MAAM,MAAM,GAA+B,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACpF,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;gBAC7F,iBAAiB,EAAE,KAAK,CAAC,YAAY;gBACrC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACpI,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;QACtE,CAAC;;YAAM,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC5D,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,gGAAgG;IAChG,KAAK,CAAC,OAAO,CAAC,QAAwB;QACpC,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QACzF,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvD,qEAAqE;YACrE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChG,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC3C,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7H,CAAC;YACD,IAAI,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,YAAa,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;gBAChG,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;oBAC3B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC3C,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,YAAY;gBAC9F,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;gBAClF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC7F,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;gBACjH,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAClH,MAAM,eAAe,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE;gBACzF,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,YAAY;gBACrG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAmC;gBACvG,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACpI,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC3C,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7H,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC7G,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,KAA8B,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9G,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAChE,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAAwB;QACpC,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3G,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACvD,gFAAgF;QAChF,0EAA0E;QAC1E,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpH,IAAI,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7H,CAAC;IACD,gGAAgG;IAChG,KAAK,CAAC,WAAW;QACf,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,SAAS;YAC/D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC3H,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS,GAAG,KAAK,CAAC;YAAC,CAAC;QAChC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,OAAO,aAAa,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/packages/runtime/dist/connection-transport.d.ts

@@ -0,0 +1,14 @@
+import type { ConnectionControl, KeyPair, Signed, SignedEnvelope } from '../../core/dist/index.js';
+export interface ConnectionFrame {
+    requestId: string;
+    event: Signed<ConnectionControl>;
+    inviteToken?: string;
+}
+export interface ConnectionTransport {
+    send(relayUrl: string, envelope: SignedEnvelope): Promise<void>;
+}
+/** Owner-addressed control frames use a routing namespace independent of task sessions. */
+export declare function sealConnectionFrame(frame: ConnectionFrame, owner: KeyPair, now: number, envelopeId?: string): SignedEnvelope;
+export declare function openConnectionFrame(envelope: SignedEnvelope, owner: KeyPair): ConnectionFrame;
+/** Retry the same signed notification with a fresh relay envelope ID. Inner consent stays unchanged. */
+export declare function retryConnectionEnvelope(envelope: SignedEnvelope, owner: KeyPair, now: number): SignedEnvelope;

package/dist/packages/runtime/dist/connection-transport.js

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: Apache-2.0
+import { randomUUID } from 'node:crypto';
+import { canonicalize, connectionEventName, connectionRoutingId, encryptEnvelopePayload, isConnectionEvent, openEnvelope, signPayload, verifySigned, verifyConnectionRequest, verifyConnectionAccepted, verifyConnectionAck, } from '../../core/dist/index.js';
+function validEvent(event) {
+    switch (event?.payload?.type) {
+        case 'ConnectionRequest': return verifyConnectionRequest(event);
+        case 'ConnectionAccepted': return verifyConnectionAccepted(event);
+        case 'ConnectionAck': return verifyConnectionAck(event);
+        default: return false;
+    }
+}
+function validateFrame(frame) {
+    if (!validEvent(frame.event)) {
+        const type = frame.event?.payload?.type;
+        throw new Error(type === 'ConnectionRequest' ? 'INVALID_CONNECTION_REQUEST'
+            : type === 'ConnectionAccepted' ? 'INVALID_CONNECTION_ACCEPTED'
+                : type === 'ConnectionAck' ? 'INVALID_CONNECTION_ACK' : 'INVALID_CONNECTION_CONTROL');
+    }
+    connectionRoutingId(frame.requestId);
+    const p = frame.event.payload;
+    if (p.type !== 'ConnectionAck' && p.requestId !== frame.requestId)
+        throw new Error('INVALID_CONNECTION_CONTROL');
+    if (frame.inviteToken !== undefined && (p.type !== 'ConnectionRequest' ||
+        typeof frame.inviteToken !== 'string' || frame.inviteToken.length > 68 * 1024 || !p.inviteDigest))
+        throw new Error('INVALID_CONNECTION_REQUEST');
+}
+/** Owner-addressed control frames use a routing namespace independent of task sessions. */
+export function sealConnectionFrame(frame, owner, now, envelopeId = randomUUID()) {
+    validateFrame(frame);
+    const p = frame.event.payload;
+    if (p.fromOwnerDid !== owner.did)
+        throw new Error('INVALID_CONNECTION_CONTROL');
+    const header = {
+        taskId: connectionRoutingId(frame.requestId), seq: 0, eventType: connectionEventName(p),
+        senderDid: owner.did, recipientDid: p.toOwnerDid,
+    };
+    const body = p.type === 'ConnectionRequest'
+        ? { request: frame.event, ...(frame.inviteToken === undefined ? {} : { inviteToken: frame.inviteToken }) }
+        : frame.event;
+    return signPayload({
+        type: 'SignedEnvelope', envelopeId, ...header,
+        payload: encryptEnvelopePayload(body, header),
+    }, owner, new Date(now).toISOString());
+}
+export function openConnectionFrame(envelope, owner) {
+    try {
+        const h = envelope.payload;
+        if (!isConnectionEvent(h.eventType) || h.type !== 'SignedEnvelope' || h.seq !== 0 ||
+            h.recipientDid !== owner.did || !h.taskId.startsWith('conn_') || !h.envelopeId ||
+            !verifySigned(envelope, h.senderDid) ||
+            Object.keys(envelope).sort().join() !== 'payload,signature' ||
+            Object.keys(envelope.signature).sort().join() !== 'canonicalization,payloadDigest,signature,signedAt,signerDid' ||
+            Object.keys(h).sort().join() !== 'envelopeId,eventType,payload,recipientDid,senderDid,seq,taskId,type' ||
+            Buffer.byteLength(canonicalize(envelope)) > 256 * 1024)
+            throw new Error();
+        const body = openEnvelope(envelope, owner);
+        let event, inviteToken;
+        if (h.eventType === 'CONNECTION_REQUEST') {
+            const b = body;
+            if (!b || Object.keys(b).some((k) => k !== 'request' && k !== 'inviteToken'))
+                throw new Error();
+            event = b.request;
+            inviteToken = b.inviteToken;
+        }
+        else
+            event = body;
+        const frame = { requestId: h.taskId.slice(5), event,
+            ...(inviteToken === undefined ? {} : { inviteToken }) };
+        validateFrame(frame);
+        if (connectionEventName(event.payload) !== h.eventType || event.payload.fromOwnerDid !== h.senderDid ||
+            event.payload.toOwnerDid !== h.recipientDid)
+            throw new Error();
+        return frame;
+    }
+    catch (error) {
+        if (error instanceof Error && ['UNENCRYPTED_ENVELOPE_REJECTED', 'INVALID_CONNECTION_REQUEST',
+            'INVALID_CONNECTION_ACCEPTED', 'INVALID_CONNECTION_ACK'].includes(error.message))
+            throw error;
+        throw new Error('INVALID_CONNECTION_CONTROL');
+    }
+}
+/** Retry the same signed notification with a fresh relay envelope ID. Inner consent stays unchanged. */
+export function retryConnectionEnvelope(envelope, owner, now) {
+    if (envelope.payload.senderDid !== owner.did || !isConnectionEvent(envelope.payload.eventType) ||
+        !verifySigned(envelope, owner.did))
+        throw new Error('INVALID_CONNECTION_CONTROL');
+    return signPayload({ ...envelope.payload, envelopeId: randomUUID() }, owner, new Date(now).toISOString());
+}
+//# sourceMappingURL=connection-transport.js.map

package/dist/packages/runtime/dist/connection-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-transport.js","sourceRoot":"","sources":["../src/connection-transport.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,EAC9E,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAC1D,uBAAuB,EAAE,wBAAwB,EAAE,mBAAmB,GACvE,MAAM,WAAW,CAAC;AAWnB,SAAS,UAAU,CAAC,KAAgC;IAClD,QAAQ,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,KAAK,mBAAmB,CAAC,CAAC,OAAO,uBAAuB,CAAC,KAAkC,CAAC,CAAC;QAC7F,KAAK,oBAAoB,CAAC,CAAC,OAAO,wBAAwB,CAAC,KAAuD,CAAC,CAAC;QACpH,KAAK,eAAe,CAAC,CAAC,OAAO,mBAAmB,CAAC,KAAkD,CAAC,CAAC;QACrG,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC;IACxB,CAAC;AACH,CAAC;AACD,SAAS,aAAa,CAAC,KAAsB;IAC3C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,4BAA4B;YACzE,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,6BAA6B;gBAC7D,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;IAC5F,CAAC;IACD,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACjH,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB;QAClE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAClD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CACjC,KAAsB,EAAE,KAAc,EAAE,GAAW,EAAE,aAAqB,UAAU,EAAE;IAEtF,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACvF,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU;KACjD,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,mBAAmB;QACzC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE;QAC1G,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAChB,OAAO,WAAW,CAAC;QACjB,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,MAAM;QAC7C,OAAO,EAAE,sBAAsB,CAAC,IAAuB,EAAE,MAAM,CAAC;KACjE,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAwB,EAAE,KAAc;IAC1E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;YAC7E,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;YAC9E,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,mBAAmB;YAC3D,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,6DAA6D;YAC/G,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,qEAAqE;YACtG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,GAAG,GAAG,GAAG,IAAI;YACxD,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,YAAY,CAAU,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,KAAgC,EAAE,WAA+B,CAAC;QACtE,IAAI,CAAC,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,IAAoE,CAAC;YAC/E,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,aAAa,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAChG,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC;YAClB,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;QAC9B,CAAC;;YAAM,KAAK,GAAG,IAAiC,CAAC;QACjD,MAAM,KAAK,GAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK;YAClE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC1D,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,SAAS;YAChG,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,CAAC,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,CAAC,+BAA+B,EAAE,4BAA4B;YAC1F,6BAA6B,EAAE,wBAAwB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,KAAK,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,uBAAuB,CAAC,QAAwB,EAAE,KAAc,EAAE,GAAW;IAC3F,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1F,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACtF,OAAO,WAAW,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5G,CAAC"}