diff --git a/.gitattributes b/.gitattributes index 5970cb72e..c48d5eb65 100644 --- a/.gitattributes +++ b/.gitattributes @@ -350,6 +350,9 @@ conformance/composition/aeb-crossing-lifecycle-v1/run.mjs linguist-generated=tru conformance/composition/aeb-crossing-lifecycle-v1/run.node-test.mjs linguist-generated=true conformance/composition/aeb-crossing-record-v1/run.mjs linguist-generated=true conformance/composition/aeb-crossing-record-v1/run.node-test.mjs linguist-generated=true +conformance/composition/aic-aeb-crossing-v0.2/run.mjs linguist-generated=true +conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mjs linguist-generated=true +conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mjs linguist-generated=true conformance/composition/ccs-l1-aeb-v1/run.mjs linguist-generated=true conformance/composition/ccs-l1-aeb-v1/run.test.mjs linguist-generated=true conformance/composition/ccs-oasnt-aeb-v1/run.mjs linguist-generated=true @@ -671,6 +674,7 @@ packages/verify/a2a-receipt-binding.test.js linguist-generated=true packages/verify/aadp-authorization-artifact.test.js linguist-generated=true packages/verify/aeb-acceptance-profile.test.js linguist-generated=true packages/verify/aeb-adapter-contract.test.js linguist-generated=true +packages/verify/aeb-aic-crossing-adapter.test.js linguist-generated=true packages/verify/aeb-aps-adapter.test.js linguist-generated=true packages/verify/aeb-ccs-adapter.test.js linguist-generated=true packages/verify/aeb-consequence-conformance.test.js linguist-generated=true diff --git a/AI_CONTEXT.md b/AI_CONTEXT.md index fe3991d88..fcc7916a0 100644 --- a/AI_CONTEXT.md +++ b/AI_CONTEXT.md @@ -2,7 +2,7 @@ > EMILIA is the authority control plane for autonomous work. The plain-language operating picture is a customer-owned authority toll booth at a configured protected boundary, where a human or institution defines a finite operating mandate and agents work unattended inside it. EMILIA Gate verifies the authority and evidence the owner requires for the exact action, reserves accepted authority before provider entry, admits or refuses the crossing, preserves executed or indeterminate outcomes, refuses blind replay, and returns an action-bound receipt packet. EMILIA Host is the private local deployment form of Gate for activated covered HTTP and MCP paths at a credential-owning provider boundary; the current surface is an HTTP local service alpha, HTTP and MCP SDK protection, and governed pilots. Native mandates and credentials from A2A, AP2, OAuth, and hardware-backed approval systems remain attributable to their issuers. EMILIA Protocol is the open Action Receipt Contract underneath Gate; EMILIA Approver captures device-bound exact-action human decisions when the mandate or local policy requires fresh human authority; EMILIA Assurance Plane defines scoped verification, re-performance, conformance-report, and deployment-evidence procedures without acting as an auditor or accredited certifier. The toll-booth metaphor describes the intended cross-stack contract, not current coverage or operation of a central global network. -Generated from repository evidence. Evidence snapshot: 2026-09-01T09:44:11.545Z. Input digest: sha256:58ef6ac4a77b5d5dbc19181b45e6f796b0a54a61aace98f77114fa91bcd7a2a8. +Generated from repository evidence. Evidence snapshot: 2026-09-01T14:52:23.203Z. Input digest: sha256:b532abe6876389a10aac43bd2c66faef2d58c5cc50a644aa7578772e68052845. Do not edit this file directly. Source: [docs/ai/context-source.v1.json](docs/ai/context-source.v1.json). Freshness check: `npm run check:llm-context`. ## Read This First @@ -15,10 +15,10 @@ When this file conflicts with a quantitative claim elsewhere, use the machine-re ## Current Evidence Snapshot -- Automated tests: 10,609 cases across 658 files; all platform-applicable cases must pass; platform-specific cases may skip. +- Automated tests: 10,611 cases across 659 files; all platform-applicable cases must pass; platform-specific cases may skip. - Cross-language conformance: 21 suites, 332 current vectors, 3 same-team ports (JavaScript, Python, Go). This is consistency evidence, not implementation independence. - External Rust interoperability: pass on the time-pinned 164-vector set evaluated 2026-07-11; the current bundle has 332. The same pinned implementation passes 359 hostility cases. Strict clean-room construction acceptance: false. -- Security case: 35 executable claims, 259 evidence files, execution passed; bundle sha256:947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880. +- Security case: 35 executable claims, 259 evidence files, execution passed; bundle sha256:03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7. - Core formal inventory: 26 TLA+ invariants, 35 Alloy facts, 32 Alloy assertions. The selected-scenario models are reported separately below; formal scope and exclusions remain claim-specific. - Selected model/runtime scenario conformance: 78 content-addressed scenarios across 14 bounded models and 21 public claims; 51 negative controls pair a formal counterexample with a safe-runtime refusal. They do not mutate the runtime implementation. Boundary: selected model/runtime scenarios under explicit projection relations; not a mechanized implementation refinement proof. - Formal evidence taxonomy: 2 claims with verified formal obligations; 21 with bounded runtime-traced evidence; 1 with bounded formal evidence but no governed runtime bridge; 0 with partial symbolic coverage; 11 with executable or operational evidence only. diff --git a/conformance/clean-room/v2/bundle.v2.json b/conformance/clean-room/v2/bundle.v2.json index 9645abf50..0cbf35cf2 100644 --- a/conformance/clean-room/v2/bundle.v2.json +++ b/conformance/clean-room/v2/bundle.v2.json @@ -3,8 +3,8 @@ "claim_scope": "source-free current-bundle conformance input; independent construction acceptance requires a separate trusted-attestor signature", "source_manifest": { "path": "conformance/conformance-manifest.json", - "sha256": "1f0f5a06b90faabab4c4eada8a87380d94a8f0d872af0a56b9391287a83bc3f2", - "manifest_sha256": "de00937588feff870bb7b72e5f6b09549a3008142f76136dd6a1bd7cce91e71a" + "sha256": "cb64bb6cf65672d0ee785e92765d7e4028db7e31ce5c94a2c71fb89865c4e8c4", + "manifest_sha256": "9fb14a40af62b7a94b629021dc316ea6087ba6c2873da23a43e07e71bf7a9200" }, "runner_protocol": { "version": "EP-CONFORMANCE-FILE-RUNNER-v2", diff --git a/conformance/composition/aic-aeb-crossing-v0.2/README.md b/conformance/composition/aic-aeb-crossing-v0.2/README.md new file mode 100644 index 000000000..7cfc4a29c --- /dev/null +++ b/conformance/composition/aic-aeb-crossing-v0.2/README.md @@ -0,0 +1,160 @@ +# AIC exact-action crossing composition profile + +This kit maps two pinned AIC credential forms into one +`EP-AEB-CROSSING-RECORD-v1` decision without claiming the credential forms are +interchangeable: + +- pure-JSON AIC-JWT with protected-header `typ=aic+jwt` and an RFC 7638 JWK + thumbprint (`hash_alg=jkt`); and +- AIC identity certificates with a SHA-2 hash of the X.509 Subject Public Key + Info (SPKI). + +The v0.2 profile adds four relying-party-owned checks before a native AIC +decision can be recorded: + +1. the pinned capability-to-action projection must equal the executor's exact + `caid` and `action_digest`; +2. the projection must bind the same relying-party identifier, audience, + executor, and state domain used by the boundary; +3. source status must be explicitly `CURRENT` and carry both an observation + time (`status.checked_at`) and a source-head digest; and +4. that observation must not be future, older than the fixed 60-second v0.2 + freshness limit, or outside the native credential's validity window. + +Only the bound v2 authority mappings are public. They carry evaluation time and +the fixed freshness limit in the relying-party context. The package exposes no +unbound AIC authority result that can be handed to the generic crossing-record +issuer. + +The bound authority commits the full admission domain, including +`relying_party_id`, into its authority-instance, replay, and constraints +digests. `EP-AEB-CROSSING-RECORD-v1` then commits those opaque digests, but its +generic issuer cannot recompute the AIC context or prove that a separately +supplied boundary matches it. AIC issuance therefore uses +`issueAicBoundCrossingRecord`, which receives the native input, relying-party +context, and record draft together and refuses any action or admission-domain +mismatch before signing. The generic crossing issuer is not the AIC issuance +API. A future crossing-record v2 can make that admission-domain binding +recomputable without changing the frozen v1 digest. + +The adapter keeps the native-verifier result and relying-party policy as +separate arguments. The native result carries the claimed issuer anchor, +verifier descriptor, verification-evidence digest, and evaluated artifact. +Only the relying-party policy carries the trusted-anchor set, expected native +verifier, mapping profile, and action-projection profile. A presented result +cannot establish acceptance by changing both a claimed anchor and a colocated +"trusted" list. The relying-party context also pins the exact requested- +capability digest, action, and admission domain, so a presented projection +cannot mint a second replay identity by changing one of those values. + +The relying party supplies and authenticates the mapping-profile provenance +and digest. The reusable v0.2 adapter enforces the profile identifier and +exactly 60 seconds of source-status freshness, but it does not load or +recompute this directory's `mapping-profile.json` as a trust decision. + +The adapter checks a supplied capability-to-action projection for exact +equality. It does not create that projection. Unknown schemes, ambiguous +mappings, and unmapped material parameters must refuse upstream. + +The adapter consumes a successful native-verifier result. It does not +reimplement AIC-JWT signatures, delegation, capability or constraint +validation, token-status retrieval, or X.509 path validation. The native +verifier and the closed action-projection profile remain separately pinned +prerequisites. Unknown capability schemes, ambiguous mappings, or unmapped +material parameters must refuse before this adapter is called. The pinned +gateway bearer helper does not pass `ExpectedAudience`, `RequestCapability`, +`PrincipalMaterial`, or `PresenterKey` into the upstream validator. This +adapter derives and checks the compact token audience and the RFC 7638 +thumbprint of explicit public JWK material, but it does not prove possession of +that key or prove that the upstream helper evaluated the requested capability. +Production wiring therefore needs an authenticated native-result wrapper that +attests the same capability evaluation. + +The pinned `gateway-core` revision can verify an AIC-JWT bearer token and +return a synthesized `x509.Certificate` for its certificate-oriented pipeline. +That returned object is bare: the inspected implementation does not attach an +authenticated original-carrier tag, raw certificate DER, raw SPKI, or a public +key. This adapter therefore derives provenance from the exact raw source. The +JWT/JKT path requires the original compact token and derives its `typ`, artifact +digest, audience, issuer/JTI replay identity, signed `iat`/`nbf`/`exp` envelope, +claimed JKT, and the RFC 7638 thumbprint of explicit public JWK material. The +signed temporal envelope must exactly match the native wrapper's validity +window, so a stale or faulty wrapper cannot extend the token. The native +X.509/SPKI path requires +real, distinct agent and principal certificate DER and derives the bundle +digest, agent serial, and principal SHA-256 SPKI hash. The local distinct-DER +rule is stricter than the pinned upstream `VerifyBundle`, which requires both +chain slots but does not itself compare the leaf bytes for inequality. A +JWT-origin synthesized object has no native certificate bundle bytes and is +refused by the X.509 path while remaining eligible only for the JWT/JKT path. + +Raw DER does not establish every native-result field. X.509 issuer, subject, +status, validity, constraints, trust-anchor selection, and verifier-evidence +digest remain outputs of the trusted native wrapper. The DER-derived bundle +identity prevents free wrapper labels from fragmenting replay, but those labels +must still be authenticated before they cross a process boundary. + +The adapter derives raw-carrier fingerprints from the bytes it receives. Those +fingerprints do not prove the native verifier saw the same bytes unless an +authenticated wrapper binds them to the verifier result. + +The JWT-SVID helper has a separate, private source-verification path. It never +returns a crossing authority. Its projection digest commits the accepted +source evaluation, including the pinned verifier and source-verification +profile, verification-evidence digest, selected issuer anchor, status head and +observation time, native validity, and the fixed 60-second freshness context. + +That is a local fail-closed boundary, not an upstream integration claim. A +deployment crossing a Go or JSON process boundary still needs a tagged or +authenticated verifier-result wrapper that preserves the original carrier. +The inspected repository had no non-test `VerifyBearer` call site, and the +helper is not evidence of a wired or deployed bearer path. + +The deterministic positive fixtures are adapter-boundary stubs, not upstream +interoperability vectors. Native `VERIFIED` is stipulated: the compact JWT uses +a placeholder signature, and the parseable X.509 certificates do not carry the +AIC and principal-authorization extensions required by the pinned native +bundle verifier. The report records this explicitly and does not claim those +verifiers accepted the fixtures. + +## Reproduce + +From the repository root: + +```sh +npm --prefix packages/verify run build +node conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mjs +node --test \ + packages/verify/aeb-aic-crossing-adapter.test.js \ + conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mjs +node conformance/composition/aic-aeb-crossing-v0.2/run.mjs --check +``` + +The deterministic report covers twenty cases: two stipulated native-result mappings +and hybrid-signed crossing records; separation of jkt and SPKI profiles; +DER-stable X.509 replay identity; principal-binding mismatch; relying-party +self-pin refusal; native type +confusion; rejection of a JWT-origin synthesized X.509 carrier in the native +X.509 mapping while retaining its JWT/JKT route; failed or indeterminate native +verification; exact-action and requested-capability substitution; relying-party +domain and compact-token audience substitution; stale and future status +observations; refusal to widen the fixed 60-second freshness profile; signed +JWT temporal relabeling; revoked and unavailable status; +native-validity failure; issuer-time action and admission-domain mismatch +refusal before signing; and signed-body relying-party substitution refusal by +signature verification. + +`source-lock.json` pins the exact IETF draft bytes and the exact Varwof source +revisions inspected. `report.reference.json` embeds that source lock and the +claim limits so the deterministic output cannot silently outgrow its evidence. + +## Claim boundary + +A passing report means the EMILIA reference implementation produced the +committed results for the pinned inputs. It is not an independent +implementation of AIC, does not establish production deployment or +IETF adoption, and does not prove every relying party made the correct native +trust decision. It also does not authenticate a native-verifier result crossing +an untrusted process boundary. A verified crossing record remains evidence of +one past local boundary decision. It is never fresh authority for another +action. diff --git a/conformance/composition/aic-aeb-crossing-v0.2/mapping-profile.json b/conformance/composition/aic-aeb-crossing-v0.2/mapping-profile.json new file mode 100644 index 000000000..4c2169a44 --- /dev/null +++ b/conformance/composition/aic-aeb-crossing-v0.2/mapping-profile.json @@ -0,0 +1,101 @@ +{ + "@version": "EP-AIC-AEB-CROSSING-MAPPING-v0.2", + "crossing_record": "EP-AEB-CROSSING-RECORD-v1", + "native_mappings": [ + { + "id": "EP-AEB-CROSSING-AIC-JWT-JKT-BOUND-v2", + "native_profile": "AIC-JWT-RFC7638-JKT", + "source_carrier": "AIC-JWT-COMPACT", + "required_provenance": [ + "compact_token", + "derived_typ", + "derived_artifact_digest", + "derived_audience", + "derived_iat_nbf_exp_envelope", + "presented_principal_jwk", + "derived_claimed_principal_key_hash", + "derived_presented_rfc7638_thumbprint" + ], + "permitted_downstream_representations": [ + "DIRECT", + "SYNTHESIZED-X509" + ], + "principal_binding": "RFC7638_JKT", + "hash_alg": "jkt" + }, + { + "id": "EP-AEB-CROSSING-AIC-X509-SPKI-BOUND-v2", + "native_profile": "AIC-X509-SPKI", + "source_carrier": "AIC-X509-CREDENTIAL-BUNDLE", + "required_provenance": [ + "agent_certificate_der", + "principal_certificate_der", + "derived_bundle_digest", + "derived_agent_serial", + "derived_principal_spki_hash" + ], + "principal_binding": "X509_SPKI", + "hash_algs": ["sha-256"] + } + ], + "action_projection": { + "id": "AIC-EXACT-ACTION-PROJECTION-v1", + "unknown_scheme": "REFUSE", + "unmapped_material_parameter": "REFUSE", + "required_relation": "EXACT_MATCH", + "committed_members": [ + "requested_capability_digest", + "caid", + "action_digest" + ] + }, + "admission_domain": { + "id": "EP-AIC-ADMISSION-DOMAIN-v1", + "committed_members": [ + "relying_party_id", + "audience", + "executor_id", + "state_domain_id" + ], + "required_relation": "EXACT_MATCH" + }, + "workload_identity_projection": { + "id": "EP-AIC-JWT-SVID-PROJECTION-v1", + "source_verification_profile_id": "EP-AIC-JWT-SVID-SOURCE-VERIFICATION-v1", + "purpose": "WORKLOAD_IDENTITY_ONLY", + "authority_result_emitted": false, + "accepted_source_evaluation_digest_required": true + }, + "source_status": { + "required_value": "CURRENT", + "observation_member": "status.checked_at", + "source_head_member": "status.source_head_digest", + "maximum_age_seconds": 60, + "future_observation": "REFUSE", + "missing_or_non_current": "REFUSE", + "outside_native_validity": "REFUSE" + }, + "rules": { + "native_verification_required": "VERIFIED", + "relying_party_trust_anchor_pin_required": true, + "native_result_and_relying_party_policy_separate": true, + "native_verifier_descriptor_relying_party_pinned": true, + "mapping_and_action_projection_profiles_relying_party_pinned": true, + "requested_capability_digest_relying_party_pinned": true, + "raw_source_carrier_provenance_required": true, + "jwt_audience_must_include_relying_party_audience": true, + "jwt_signed_temporal_envelope_exact_match_required": true, + "jwt_presented_public_jwk_thumbprint_required": true, + "jwt_presented_public_jwk_proves_possession": false, + "jwt_synthesized_x509_requires_original_compact_token": true, + "native_x509_requires_real_agent_and_principal_der": true, + "native_x509_spki_hash_alg": "sha-256", + "principal_binding_exact_match_required": true, + "carrier_types_are_not_interchangeable": true, + "bound_authority_commits_relying_party_id": true, + "crossing_record_v1_contract_directly_commits_relying_party_id": false, + "aic_bound_issue_helper_requires_action_and_admission_domain_match": true, + "generic_crossing_issuer_revalidates_aic_opaque_context": false, + "crossing_record_is_execution_authority": false + } +} diff --git a/conformance/composition/aic-aeb-crossing-v0.2/report.reference.json b/conformance/composition/aic-aeb-crossing-v0.2/report.reference.json new file mode 100644 index 000000000..b40c761fa --- /dev/null +++ b/conformance/composition/aic-aeb-crossing-v0.2/report.reference.json @@ -0,0 +1,439 @@ +{ + "@version": "AIC-AEB-CROSSING-REFERENCE-REPORT-v0.2", + "action_projection": { + "committed_members": [ + "requested_capability_digest", + "caid", + "action_digest" + ], + "id": "AIC-EXACT-ACTION-PROJECTION-v1", + "required_relation": "EXACT_MATCH", + "unknown_scheme": "REFUSE", + "unmapped_material_parameter": "REFUSE" + }, + "admission_domain": { + "committed_members": [ + "relying_party_id", + "audience", + "executor_id", + "state_domain_id" + ], + "id": "EP-AIC-ADMISSION-DOMAIN-v1", + "required_relation": "EXACT_MATCH" + }, + "cases": [ + { + "category": "positive", + "expected": "RFC7638 jkt maps, receipt verifies, and remains non-authorizing", + "id": "AIC-JWT-JKT-CROSSING", + "observed": { + "algorithms": [ + "Ed25519", + "ML-DSA-65" + ], + "execution_authorizing": false, + "mapping_profile": "EP-AEB-CROSSING-AIC-JWT-JKT-BOUND-v2", + "verified": true + }, + "passed": true + }, + { + "category": "positive", + "expected": "X.509 SPKI maps, receipt verifies, and remains non-authorizing", + "id": "AIC-X509-SPKI-CROSSING", + "observed": { + "algorithms": [ + "Ed25519", + "ML-DSA-65" + ], + "execution_authorizing": false, + "mapping_profile": "EP-AEB-CROSSING-AIC-X509-SPKI-BOUND-v2", + "verified": true + }, + "passed": true + }, + { + "category": "mapping", + "expected": "RFC7638 jkt and X.509 SPKI are separate native profiles and instances", + "id": "NATIVE-BINDINGS-REMAIN-DISTINCT", + "observed": { + "instances_differ": true, + "jkt_profile": "EP-AEB-CROSSING-AIC-JWT-JKT-BOUND-v2", + "profiles_differ": true, + "x509_profile": "EP-AEB-CROSSING-AIC-X509-SPKI-BOUND-v2" + }, + "passed": true + }, + { + "category": "mapping", + "expected": "exact DER fixes replay identity while authenticated wrapper metadata remains instance-bound", + "id": "X509-DER-REPLAY-IDENTITY-STABLE", + "observed": { + "artifact_instance_changed": true, + "artifact_replay_stable": true, + "issuer_instance_changed": true, + "issuer_replay_stable": true + }, + "passed": true + }, + { + "category": "hostile", + "expected": "JWT-origin synthesized X.509 refuses the native X.509 path and remains JWT/JKT", + "id": "SYNTHESIZED-X509-CARRIER-CONFUSION-REFUSED", + "observed": { + "jwt_path_ok": true, + "x509_path_ok": false, + "x509_path_reason": "aic_carrier_provenance_unverifiable" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "aic_principal_binding_mismatch", + "id": "PRINCIPAL-BINDING-MISMATCH", + "observed": { + "ok": false, + "reason": "aic_principal_binding_mismatch" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "native result cannot carry or replace relying-party trust pins", + "id": "RP-POLICY-SELF-PIN-REFUSED", + "observed": { + "self_pin": "mapping_input_invalid", + "untrusted": "aic_issuer_untrusted" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "aic_carrier_provenance_unverifiable", + "id": "NATIVE-TYPE-CONFUSION", + "observed": { + "ok": false, + "reason": "aic_carrier_provenance_unverifiable" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "FAILED and INDETERMINATE both refuse", + "id": "NATIVE-VERIFICATION-REFUSAL", + "observed": { + "failed": "aic_native_verification_failed", + "indeterminate": "aic_native_verification_indeterminate" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "aic_action_projection_mismatch", + "id": "EXACT-ACTION-SUBSTITUTION-REFUSED", + "observed": { + "ok": false, + "reason": "aic_action_projection_mismatch" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "aic_requested_capability_mismatch", + "id": "REQUEST-CAPABILITY-SUBSTITUTION-REFUSED", + "observed": { + "ok": false, + "reason": "aic_requested_capability_mismatch" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "aic_admission_domain_mismatch", + "id": "RELYING-PARTY-DOMAIN-SUBSTITUTION-REFUSED", + "observed": { + "ok": false, + "reason": "aic_admission_domain_mismatch" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "aic_audience_mismatch", + "id": "JWT-AUDIENCE-SUBSTITUTION-REFUSED", + "observed": { + "ok": false, + "reason": "aic_audience_mismatch" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "signed compact-token iat/nbf/exp must exactly bind wrapper validity", + "id": "JWT-TEMPORAL-RELABELING-REFUSED", + "observed": { + "ok": false, + "reason": "aic_jwt_validity_mismatch" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "stale and future observations both refuse", + "id": "STATUS-OBSERVATION-TIME-REFUSALS", + "observed": { + "future": "aic_status_observation_future", + "stale": "aic_status_observation_stale" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "the fixed 60-second v0.2 freshness profile cannot be widened by a caller", + "id": "STATUS-FRESHNESS-PROFILE-WIDENING-REFUSED", + "observed": { + "bound_jwt": "aic_status_freshness_profile_mismatch", + "bound_x509": "aic_status_freshness_profile_mismatch", + "jwt_svid_projection": "aic_status_freshness_profile_mismatch" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "revoked and unavailable source status both refuse", + "id": "NON-CURRENT-SOURCE-STATUS-REFUSED", + "observed": { + "revoked": "aic_status_not_current", + "unavailable": "aic_status_not_current" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "aic_validity_window_mismatch", + "id": "NATIVE-VALIDITY-WINDOW-REFUSED", + "observed": { + "ok": false, + "reason": "aic_validity_window_mismatch" + }, + "passed": true + }, + { + "category": "hostile", + "expected": "aic_crossing_issue_admission_domain_mismatch", + "id": "AIC-ISSUER-DOMAIN-MISMATCH-REFUSED-BEFORE-SIGNING", + "observed": { + "ok": false, + "reason": "aic_crossing_issue_admission_domain_mismatch" + }, + "passed": true + }, + { + "category": "boundary", + "expected": "signature_invalid", + "id": "SIGNED-BODY-RP-SUBSTITUTION-REFUSED", + "observed": { + "reason": "signature_invalid", + "verified": false + }, + "passed": true + } + ], + "crossing_record_version": "EP-AEB-CROSSING-RECORD-v1", + "known_limits": [ + "This run exercises the EMILIA reference adapter and crossing-record implementation; it is not an independent implementation of AIC-JWT or AIC-X509.", + "The adapter consumes a native verifier result; it does not reimplement AIC signature, certificate-path, delegation, capability, constraint, status, or proof-of-possession validation.", + "This deterministic suite stipulates native VERIFIED results to test the adapter boundary. Its JWT signature is a placeholder and its parseable X.509 certificates are not AIC credential-bundle fixtures, so it does not claim the pinned upstream verifiers accepted them.", + "The relying party pins the exact requested-capability digest and action-projection profile. Production integration must also provide an authenticated native result proving that the same capability request was evaluated; the pinned gateway bearer helper does not set RequestCapability.", + "The adapter checks a supplied capability-to-action projection for exact equality; it does not produce that projection. Unknown schemes, ambiguous mappings, and unmapped material parameters must refuse upstream.", + "The bound authority commits one exact action and one relying-party admission domain. The AIC-specific issue helper compares both against the record draft before signing; changing the action, relying party, audience, executor, or state domain requires a new evaluation.", + "EP-AEB-CROSSING-RECORD-v1 commits the bound authority's opaque instance, replay, and constraints digests but does not directly commit relying_party_id in its contract digest. The generic issuer cannot recompute the AIC context, so it is not the AIC issuance API. A versioned crossing-record v2 is required for generic recomputable admission-domain binding.", + "status.checked_at is the explicit source-status observation time. The v0.2 runtime accepts exactly a 60-second maximum age; a caller cannot widen it. CURRENT status is accepted only within that fixed freshness limit and native validity window; revoked, unavailable, stale, future, or otherwise non-current observations refuse.", + "The native verifier result and relying-party policy are structurally separate. Trusted anchors and expected verifier, mapping-profile, and action-projection pins come only from relying-party policy, never from the presented native result.", + "The relying party supplies and authenticates mapping-profile provenance and its digest. This reusable adapter enforces the profile identifier and fixed freshness rule but does not load or recompute the checked-in mapping-profile JSON.", + "RFC 7638 JWK thumbprints and X.509 SHA-256 SPKI hashes remain separate native mappings and are never treated as interchangeable proof. The JWT path derives the presented JWK thumbprint but does not prove possession of that key.", + "The JWT/JKT mapping requires the original compact token, derives its audience, issuer/JTI replay identity, and signed iat/nbf/exp envelope, requires exact agreement with wrapper validity, and requires explicit public JWK material. A bare X.509 object synthesized from a verified AIC-JWT has no native bundle DER and cannot enter the native X.509/SPKI mapping.", + "The X.509 path derives replay identity, bundle digest, serial, and principal SHA-256 SPKI from DER. Issuer, subject, status, validity, constraints, trust-anchor selection, and verification evidence remain authenticated native-wrapper outputs, not facts derived by this adapter from the leaf DER.", + "Raw-carrier fingerprints are derived from the bytes supplied to this adapter. They do not prove that the native verifier saw those same bytes unless an authenticated wrapper binds the verifier result to them.", + "JWT-SVID workload projection uses a private source verifier that emits no crossing authority. The projection digest commits the accepted source evaluation, including verifier, source-policy, evidence, trust-anchor, status, validity, and freshness inputs.", + "The local raw-source boundary does not authenticate a verifier result crossing an untrusted Go or JSON boundary. Integration still requires a tagged or authenticated verifier-result wrapper; the pinned gateway bearer helper sets neither ExpectedAudience, RequestCapability, PrincipalMaterial, nor PresenterKey, and no non-test VerifyBearer wiring was observed.", + "A verified crossing record is evidence of one past relying-party boundary decision and never authorizes another action.", + "Passing these checks does not establish IETF adoption, certification, production deployment, independent interoperability, or employer endorsement." + ], + "mapping_profile_digest": "sha256:cda0f113627b79e7dcd79e9181f4cf3fd2d3136bdbb016cf4c19d1370bcffb98", + "mappings": [ + "EP-AEB-CROSSING-AIC-JWT-JKT-BOUND-v2", + "EP-AEB-CROSSING-AIC-X509-SPKI-BOUND-v2" + ], + "native_verification_fixture": { + "execution": "STIPULATED_NOT_EXECUTED", + "jwt_signature": "PLACEHOLDER", + "upstream_native_acceptance_claimed": false, + "x509_aic_and_principal_authorization_extensions": "ABSENT" + }, + "passed": true, + "profile": "EP-AIC-AEB-CROSSING-COMPOSITION-v0.2", + "required_algorithms": [ + "Ed25519", + "ML-DSA-65" + ], + "results_digest": "sha256:1eac98d86ccc496938ba9c7efd006b047d4bc3216ed7b651f3a8bd2630751ebf", + "source_lock": { + "@version": "AIC-AEB-CROSSING-SOURCE-LOCK-v0.2", + "drafts": [ + { + "bounded_sections": [ + "5 AIC-JWT Token Format", + "9 Principal Key Binding", + "11 Validation Algorithm", + "16 Compatibility with the Varwof Unified JWT Profile" + ], + "name": "draft-wei-aic-jwt-00", + "sha256": "c103cb5d4c541c7aa30ee49e0c36d56ad3ac76f50ce73a39fd0be1109781bd3c", + "url": "https://www.ietf.org/archive/id/draft-wei-aic-jwt-00.txt" + }, + { + "bounded_sections": [ + "5 AI Agent Identity Certificate Extension", + "8 Agent Authentication and Authorization", + "9 Security Considerations" + ], + "name": "draft-wei-aic-identity-cert-00", + "sha256": "169d2f4ae37b3448e955d8a0e0fde04ef43855b93e7aa1e8e3021fb4eba73b2e", + "url": "https://www.ietf.org/archive/id/draft-wei-aic-identity-cert-00.txt" + } + ], + "inspection": { + "gateway_bearer_bridge": { + "authenticated_original_carrier_provenance_returned": false, + "gateway_module_manifest_path": "go.mod", + "gateway_types_module_revision": "76f725ffc375ae7fda1f0255ea3e12a0074f6c4c", + "gateway_types_module_version": "v0.4.0", + "jwt_mapping_requires_original_compact_token": true, + "local_boundary": "The synthesized object is not admissible to the native X.509/SPKI mapping; JWT/JKT mapping requires the original compact token", + "local_mapping_derives_compact_token_audience": true, + "local_mapping_derives_presented_jwk_thumbprint": true, + "local_mapping_proves_presenter_key_possession": false, + "non_test_verify_bearer_call_sites_observed": false, + "path": "jwt.go", + "separate_authenticated_capability_evaluation_required": true, + "synthesized_certificate_admissible_to_native_x509_mapping": false, + "synthesized_certificate_sets_public_key": false, + "synthesized_certificate_sets_raw_der": false, + "synthesized_certificate_sets_raw_spki": false, + "verified_behavior": "VerifyBearer validates the compact AIC-JWT, then returns a bare synthesized *x509.Certificate plus parsed outer claims", + "verify_bearer_returns_outer_claims": true, + "verify_bearer_returns_synthesized_certificate": true, + "verify_bearer_sets_expected_audience": false, + "verify_bearer_sets_presenter_key": false, + "verify_bearer_sets_principal_material": false, + "verify_bearer_sets_request_capability": false + }, + "native_x509_bundle": { + "compares_principal_key_hash_to_principal_certificate_spki": true, + "enforces_distinct_agent_and_principal_leaf_der": false, + "local_boundary": "Native X.509 mapping requires exact agent and principal certificate DER and derives the bundle digest, agent serial, and principal SPKI hash from those bytes", + "local_mapping_requires_distinct_agent_and_principal_der": true, + "local_mapping_requires_exact_certificate_der": true, + "path": "credential_bundle.go", + "principal_spki_hash_algorithm": "sha-256", + "requires_nonempty_agent_and_principal_chains": true, + "verified_behavior": "VerifyBundle requires nonempty agent and principal chain slots, verifies both chains, and compares the AIC principal key hash with the principal certificate SHA-256 SPKI" + }, + "scope": { + "repository": "https://github.com/varwof/gateway-core", + "revision": "718d42ecdaf90a11ad882b5651fffdd2aeaeb417" + }, + "upstream_wiring": { + "cross_process_authenticated_provenance_wrapper_required": true, + "deployed_wiring_verified": false, + "limit": "A tagged or authenticated verifier-result wrapper is still required to preserve carrier provenance across a Go or JSON process boundary" + } + }, + "varwof": { + "repositories": [ + { + "inspected_files": [ + { + "path": "ts/aicjwt.ts", + "sha256": "2e5c59b60ce86a309003be8f6e5df8aaeae96e81027b0c3a7cba9e561545c097", + "url": "https://raw.githubusercontent.com/varwof/aic-jwt/a3499b07bbe858a79d95ab98f9134f44238cb8cf/ts/aicjwt.ts" + } + ], + "repository": "https://github.com/varwof/aic-jwt", + "revision": "a3499b07bbe858a79d95ab98f9134f44238cb8cf" + }, + { + "inspected_files": [ + { + "path": "aicjwt/validate.go", + "sha256": "9d85b2212d1ffbc4f76fc7d300d764f93845d6ced35636687619b476b742c9e3", + "url": "https://raw.githubusercontent.com/varwof/types/683520cd8ae8596a297c24187d0137efe2b263fe/aicjwt/validate.go" + }, + { + "path": "aicjwt/keyhash.go", + "sha256": "e2fc32c4b17dc49323b92425484a808c19353f12a2554a1ed50f034fd433134e", + "url": "https://raw.githubusercontent.com/varwof/types/683520cd8ae8596a297c24187d0137efe2b263fe/aicjwt/keyhash.go" + }, + { + "path": "aicjwt/certjwk.go", + "sha256": "20bd28626f1559c50a0683ded84f9425504d50a5775d538156965be2628cb3ed", + "url": "https://raw.githubusercontent.com/varwof/types/683520cd8ae8596a297c24187d0137efe2b263fe/aicjwt/certjwk.go" + } + ], + "repository": "https://github.com/varwof/types", + "revision": "683520cd8ae8596a297c24187d0137efe2b263fe" + }, + { + "inspected_files": [ + { + "path": "credential_bundle.go", + "sha256": "4c69c00e4e3f8f9ad8c7082f61b6bcee4ddb68ec250cef3eafce49fbc1bd4edc", + "url": "https://raw.githubusercontent.com/varwof/gateway-core/718d42ecdaf90a11ad882b5651fffdd2aeaeb417/credential_bundle.go" + }, + { + "path": "jwt.go", + "sha256": "d2ab9d638f8383aebc06c6244eb9451c23dfc8134450995582bae6f0a8cf3d9a", + "url": "https://raw.githubusercontent.com/varwof/gateway-core/718d42ecdaf90a11ad882b5651fffdd2aeaeb417/jwt.go" + }, + { + "path": "go.mod", + "sha256": "23e8b43e0ecbf537f273ded9558e9888425455d00272fe36c42436b3003eef2c", + "url": "https://raw.githubusercontent.com/varwof/gateway-core/718d42ecdaf90a11ad882b5651fffdd2aeaeb417/go.mod" + } + ], + "repository": "https://github.com/varwof/gateway-core", + "revision": "718d42ecdaf90a11ad882b5651fffdd2aeaeb417" + }, + { + "consumed_by": "https://github.com/varwof/gateway-core@718d42ecdaf90a11ad882b5651fffdd2aeaeb417", + "inspected_files": [ + { + "path": "aicjwt/validate.go", + "sha256": "9d85b2212d1ffbc4f76fc7d300d764f93845d6ced35636687619b476b742c9e3", + "url": "https://raw.githubusercontent.com/varwof/types/76f725ffc375ae7fda1f0255ea3e12a0074f6c4c/aicjwt/validate.go" + }, + { + "path": "aicjwt/keyhash.go", + "sha256": "e2fc32c4b17dc49323b92425484a808c19353f12a2554a1ed50f034fd433134e", + "url": "https://raw.githubusercontent.com/varwof/types/76f725ffc375ae7fda1f0255ea3e12a0074f6c4c/aicjwt/keyhash.go" + } + ], + "repository": "https://github.com/varwof/types", + "resolved_module_version": "v0.4.0", + "revision": "76f725ffc375ae7fda1f0255ea3e12a0074f6c4c" + } + ] + } + }, + "source_lock_digest": "sha256:4db4c7e1db99663caecc82887cbf60c826725383b9e0e01f186a08fc105e0f4a", + "source_status": { + "future_observation": "REFUSE", + "maximum_age_seconds": 60, + "missing_or_non_current": "REFUSE", + "observation_member": "status.checked_at", + "outside_native_validity": "REFUSE", + "required_value": "CURRENT", + "source_head_member": "status.source_head_digest" + } +} diff --git a/conformance/composition/aic-aeb-crossing-v0.2/run.mjs b/conformance/composition/aic-aeb-crossing-v0.2/run.mjs new file mode 100644 index 000000000..2b67a5fc1 --- /dev/null +++ b/conformance/composition/aic-aeb-crossing-v0.2/run.mjs @@ -0,0 +1,733 @@ +// SPDX-License-Identifier: Apache-2.0 +// Generated from run.mts by scripts/build-standalone-runtimes.mjs. Do not edit. +/* eslint-disable */ +/** + * AIC x EP-AEB-CROSSING-RECORD-v1 deterministic composition runner. + * + * The native AIC verifier remains authoritative for AIC-JWT or AIC-X509 + * validation. This runner starts from that verifier's result, checks the + * relying party's pinned issuer and principal binding, and records the local + * boundary decision. It does not turn an AIC credential or a crossing record + * into reusable execution authority. + */ +import assert from "node:assert/strict"; +import crypto from "node:crypto"; +import { readFileSync, writeFileSync } from "node:fs"; +import { dirname, resolve } from "node:path"; +import { fileURLToPath } from "node:url"; +import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js"; +import { AIC_ADMISSION_DOMAIN_VERSION, AIC_CROSSING_MAX_STATUS_AGE_SECONDS, AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION, AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, issueAicBoundCrossingRecord, mapAicJwtJktBoundCrossingAuthority, mapAicX509SpkiBoundCrossingAuthority, projectAicJwtToStrictJwtSvid, } from "../../../packages/verify/aeb-aic-crossing-adapter.js"; +import { AEB_CROSSING_RECORD_REQUIRED_ALGORITHMS, AEB_CROSSING_RECORD_VERSION, verifyAebCrossingRecord, } from "../../../packages/verify/aeb-crossing-record.js"; +import { canonicalizeAeb, digestAebTyped, } from "../../../packages/verify/aeb-adapter-contract.js"; +import { loadDefaultAgilityMldsaBackend } from "../../../packages/verify/pq-signature-agility.js"; +export const PROFILE = "EP-AIC-AEB-CROSSING-COMPOSITION-v0.2"; +const HERE = dirname(fileURLToPath(import.meta.url)); +const REFERENCE_PATH = resolve(HERE, "report.reference.json"); +const SOURCE_LOCK = JSON.parse(readFileSync(resolve(HERE, "source-lock.json"), "utf8")); +const SOURCE_LOCK_DIGEST = `sha256:${crypto.hash("sha256", canonicalizeAeb(SOURCE_LOCK), "hex")}`; +const MAPPING_PROFILE = JSON.parse(readFileSync(resolve(HERE, "mapping-profile.json"), "utf8")); +const MAPPING_PROFILE_DIGEST = `sha256:${crypto.hash("sha256", canonicalizeAeb(MAPPING_PROFILE), "hex")}`; +const NOW = "2026-09-01T07:00:00Z"; +const ED_PRIVATE_JWK = { + crv: "Ed25519", + d: "EBsZ3aVNd8cSzmZECgG0MMAPTreFIhgDFtTY9UTkQ_Y", + x: "c_kUSHs4ymdA65GF3OV8C3PDWhelodqfOvCmFe-6oUI", + kty: "OKP", +}; +const ED_PUBLIC_JWK = { + crv: "Ed25519", + x: "c_kUSHs4ymdA65GF3OV8C3PDWhelodqfOvCmFe-6oUI", + kty: "OKP", +}; +const edPrivate = crypto.createPrivateKey({ key: ED_PRIVATE_JWK, format: "jwk" }); +const edPublic = crypto.createPublicKey({ key: ED_PUBLIC_JWK, format: "jwk" }); +const edPublicSpki = edPublic + .export({ type: "spki", format: "der" }) + .toString("base64url"); +const pqPair = ml_dsa65.keygen(new Uint8Array(32).fill(0x41)); +const pqPublic = Buffer.from(pqPair.publicKey).toString("base64url"); +const mldsaBackend = await loadDefaultAgilityMldsaBackend(); +assert.ok(mldsaBackend, "real ML-DSA-65 backend must be available"); +const SIGNERS = [ + { alg: "Ed25519", key_id: "aic-crossing-ed", private_key: edPrivate }, + { alg: "ML-DSA-65", key_id: "aic-crossing-pq", private_key: pqPair.secretKey }, +]; +const VERIFICATION_KEYS = [ + { alg: "Ed25519", key_id: "aic-crossing-ed", public_key: edPublicSpki }, + { alg: "ML-DSA-65", key_id: "aic-crossing-pq", public_key: pqPublic }, +]; +const ISSUER_PIN = `sha256:${"a1".repeat(32)}`; +const PRINCIPAL_JWK = Object.freeze({ + kty: "OKP", + crv: "Ed25519", + x: "c_kUSHs4ymdA65GF3OV8C3PDWhelodqfOvCmFe-6oUI", +}); +const JKT = crypto.createHash("sha256") + .update(JSON.stringify({ + crv: PRINCIPAL_JWK.crv, + kty: PRINCIPAL_JWK.kty, + x: PRINCIPAL_JWK.x, +})) + .digest("base64url"); +const SPKI = "HHZknPZ96UejPrdBkR8uVScD38l0C-CydQ-8aWJ1iFo"; +const AGENT_CERTIFICATE_DER = "MIIBczCCASWgAwIBAgICEIcwBQYDK2VwMDgxGTAXBgNVBAMMEGFnZW50LWFjY291bnRpbmcxGzAZBgNVBAoMEkVNSUxJQSBBSUMgRml4dHVyZTAeFw0yNjA5MDEwNjM1MTRaFw0zNjA4MjkwNjM1MTRaMDgxGTAXBgNVBAMMEGFnZW50LWFjY291bnRpbmcxGzAZBgNVBAoMEkVNSUxJQSBBSUMgRml4dHVyZTAqMAUGAytlcAMhABlRhmmMT_c3eHf39WJ53gjQ-XsXrkk2JjbOst7y2iG6o1MwUTAdBgNVHQ4EFgQUYRN3QUuM-4WfrO9gw0jrbCge6WkwHwYDVR0jBBgwFoAUYRN3QUuM-4WfrO9gw0jrbCge6WkwDwYDVR0TAQH_BAUwAwEB_zAFBgMrZXADQQAMwAAYlEzDMMFWXJomesb1_O7QypjsRF3DGHQLhuoBh2op5s9xTo7aiF1BAfW2O82QCy9LOCZsX1ymKcLUEJYL"; +const PRINCIPAL_CERTIFICATE_DER = "MIIBezCCAS2gAwIBAgICEIgwBQYDK2VwMDwxHTAbBgNVBAMMFHByaW5jaXBhbC1hY2NvdW50aW5nMRswGQYDVQQKDBJFTUlMSUEgQUlDIEZpeHR1cmUwHhcNMjYwOTAxMDYzNTE0WhcNMzYwODI5MDYzNTE0WjA8MR0wGwYDVQQDDBRwcmluY2lwYWwtYWNjb3VudGluZzEbMBkGA1UECgwSRU1JTElBIEFJQyBGaXh0dXJlMCowBQYDK2VwAyEAWP6IT_BCkU9xUCVQR2MePkJ_zYdkFYqAFp0jSzW6Re6jUzBRMB0GA1UdDgQWBBRZkhmqaCLhEEtolUAUZLVa7eBfejAfBgNVHSMEGDAWgBRZkhmqaCLhEEtolUAUZLVa7eBfejAPBgNVHRMBAf8EBTADAQH_MAUGAytlcANBAL-e_CxbdYdZRTB86m3ldvMg_dCpJHAtMl26I-T40QR2JFbG3xWhJTKfEMuZooI2jjHbjLsE1qHQ6s5v3EtphQ0"; +function pinnedSourceDigest(repository, path, revision) { + const repositories = SOURCE_LOCK.varwof.repositories.filter((entry) => entry.repository === repository + && (revision === undefined || entry.revision === revision)); + assert.equal(repositories.length, 1, `ambiguous pinned repository ${repository}${revision ? `@${revision}` : ""}`); + const file = repositories[0].inspected_files.find((entry) => entry.path === path); + assert.equal(typeof file?.sha256, "string", `missing pinned source ${repository}:${path}`); + return file.sha256; +} +const JWT_VERIFIER = Object.freeze({ + id: "varwof:aic-jwt-validate.gateway-verify-bearer", + version: "source-lock-v0.2", + implementation_digest: digestAebTyped({ + validate_go_sha256: pinnedSourceDigest("https://github.com/varwof/types", "aicjwt/validate.go", "76f725ffc375ae7fda1f0255ea3e12a0074f6c4c"), + keyhash_go_sha256: pinnedSourceDigest("https://github.com/varwof/types", "aicjwt/keyhash.go", "76f725ffc375ae7fda1f0255ea3e12a0074f6c4c"), + gateway_bearer_sha256: pinnedSourceDigest("https://github.com/varwof/gateway-core", "jwt.go"), + gateway_go_mod_sha256: pinnedSourceDigest("https://github.com/varwof/gateway-core", "go.mod"), + complete_inspection_set_digest: SOURCE_LOCK_DIGEST, + }, "AIC-JWT-NATIVE-VERIFIER-SOURCE-LOCK-v1"), +}); +const X509_VERIFIER = Object.freeze({ + id: "varwof:gateway-verify-credential-bundle", + version: "source-lock-v0.2", + implementation_digest: digestAebTyped({ + credential_bundle_sha256: pinnedSourceDigest("https://github.com/varwof/gateway-core", "credential_bundle.go"), + gateway_go_mod_sha256: pinnedSourceDigest("https://github.com/varwof/gateway-core", "go.mod"), + complete_inspection_set_digest: SOURCE_LOCK_DIGEST, + }, "AIC-X509-NATIVE-VERIFIER-SOURCE-LOCK-v1"), +}); +function jwtCompactToken(typ = "aic+jwt", audience = "erp:vendor-master") { + const segment = (value) => Buffer.from(JSON.stringify(value), "utf8") + .toString("base64url"); + return [ + segment({ alg: "EdDSA", typ, kid: "issuer-key-1" }), + segment({ + iss: "https://issuer.example", + sub: "spiffe://example.org/agent/accounting", + aud: audience, + iat: 1788245700, + exp: 1788246300, + jti: "aic-jwt:agent-accounting:17", + cnf: { jkt: JKT }, + aic: { + ver: 1, + principal: { + realm: "example.org", + id: "principal:accounting-owner", + key_hash: JKT, + hash_alg: "jkt", + }, + delegation_mode: "authorized", + capabilities: [{ + scheme: "varwof/core", + id: "finance.vendor-account-change", + params: { + vendor_id: "vendor-0042", + account_fingerprint: "acct:7e8c", + }, + }], + }, + }), + Buffer.from("fixture-signature", "utf8").toString("base64url"), + ].join("."); +} +const JWT_COMPACT_TOKEN = jwtCompactToken(); +const JWT_ARTIFACT_DIGEST = `sha256:${crypto.createHash("sha256") + .update(JWT_COMPACT_TOKEN, "utf8") + .digest("hex")}`; +const X509_ARTIFACT_DIGEST = digestAebTyped({ + agent_certificate_der: AGENT_CERTIFICATE_DER, + principal_certificate_der: PRINCIPAL_CERTIFICATE_DER, +}, AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION); +const ACTION = Object.freeze({ + caid: "caid:1:finance.vendor-account-change.1:jcs-sha256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", + action_digest: `sha256:${"11".repeat(32)}`, +}); +const BOUNDARY = Object.freeze({ + relying_party_id: "rp:example-finance", + audience: "erp:vendor-master", + executor_id: "executor:erp-production", + state_domain_id: "state-domain:finance-primary", +}); +const REQUEST_BINDING = Object.freeze({ + action_projection_profile_id: "AIC-EXACT-ACTION-PROJECTION-v1", + action_projection_profile_digest: MAPPING_PROFILE_DIGEST, + requested_capability_digest: sha256(canonicalizeAeb({ + scheme: "varwof/core", + id: "finance.vendor-account-change", + params: { + vendor_id: "vendor-0042", + account_fingerprint: "acct:7e8c", + }, + })), + projected_action: ACTION, + projected_admission_domain_digest: digestAebTyped(BOUNDARY, AIC_ADMISSION_DOMAIN_VERSION), +}); +const JWT_POLICY = Object.freeze({ + mapping_profile_id: AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + mapping_profile_digest: MAPPING_PROFILE_DIGEST, + action_projection_profile_id: REQUEST_BINDING.action_projection_profile_id, + action_projection_profile_digest: REQUEST_BINDING.action_projection_profile_digest, + trusted_issuer_trust_anchor_digests: [ISSUER_PIN], + native_verifier: JWT_VERIFIER, +}); +const X509_POLICY = Object.freeze({ + mapping_profile_id: AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + mapping_profile_digest: MAPPING_PROFILE_DIGEST, + action_projection_profile_id: REQUEST_BINDING.action_projection_profile_id, + action_projection_profile_digest: REQUEST_BINDING.action_projection_profile_digest, + trusted_issuer_trust_anchor_digests: [ISSUER_PIN], + native_verifier: X509_VERIFIER, +}); +const JWT_PROJECTION_SOURCE_POLICY = Object.freeze({ + source_verification_profile_id: AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, + source_verification_profile_digest: MAPPING_PROFILE_DIGEST, + trusted_issuer_trust_anchor_digests: [ISSUER_PIN], + native_verifier: JWT_VERIFIER, +}); +function relyingPartyContext(policy = JWT_POLICY) { + return { + action: ACTION, + admission_domain: BOUNDARY, + requested_capability_digest: REQUEST_BINDING.requested_capability_digest, + evaluated_at: NOW, + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + policy, + }; +} +const RP_CONTEXT = Object.freeze(relyingPartyContext()); +const X509_RP_CONTEXT = Object.freeze(relyingPartyContext(X509_POLICY)); +const REQUIREMENTS = Object.freeze({ + admission_digest: `sha256:${"22".repeat(32)}`, + review_digest: `sha256:${"33".repeat(32)}`, +}); +const ADMIT_AXES = { + native_verification: "VERIFIED", + rp_acceptance: "ACCEPTED", + action_relation: "EXACT_MATCH", + status: "CURRENT", + replay: "FRESH", + admission: "ADMIT", + custody: "RESERVED", + provider_commitment: "NOT_INVOKED", + observed_effect: "NOT_OBSERVED", + retry: "NOT_APPLICABLE", + reconciliation: "NOT_APPLICABLE", + reason_codes: [], +}; +function sorted(value) { + if (Array.isArray(value)) + return value.map(sorted); + if (value !== null && typeof value === "object") { + return Object.fromEntries(Object.keys(value).sort().map((key) => [key, sorted(value[key])])); + } + return value; +} +function sha256(value) { + return `sha256:${crypto.hash("sha256", value, "hex")}`; +} +function result(id, category, passed, expected, observed) { + return { id, category, passed, expected, observed }; +} +function jktInput(overrides = {}) { + return { + native_verification: "VERIFIED", + native_verifier: JWT_VERIFIER, + native_verification_evidence_digest: `sha256:${"b0".repeat(32)}`, + carrier_provenance: { + source_carrier: "AIC-JWT-COMPACT", + compact_token: JWT_COMPACT_TOKEN, + presented_principal_jwk: PRINCIPAL_JWK, + downstream_representation: "DIRECT", + }, + issuer: "https://issuer.example", + subject: "spiffe://example.org/agent/accounting", + artifact_id: "aic-jwt:agent-accounting:17", + artifact_digest: JWT_ARTIFACT_DIGEST, + issuer_trust_anchor_digest: ISSUER_PIN, + constraints_digest: `sha256:${"b3".repeat(32)}`, + principal_binding: { + kind: "RFC7638_JKT", + hash_alg: "jkt", + claimed_key_hash: JKT, + presented_key_hash: JKT, + }, + status: { + value: "CURRENT", + checked_at: NOW, + source_head_digest: `sha256:${"b4".repeat(32)}`, + }, + validity: { + not_before: "2026-09-01T06:55:00Z", + not_after: "2026-09-01T07:05:00Z", + }, + request_binding: REQUEST_BINDING, + ...overrides, + }; +} +function x509Input(overrides = {}) { + return { + native_verification: "VERIFIED", + native_verifier: X509_VERIFIER, + native_verification_evidence_digest: `sha256:${"c0".repeat(32)}`, + carrier_provenance: { + source_carrier: "AIC-X509-CREDENTIAL-BUNDLE", + agent_certificate_der: AGENT_CERTIFICATE_DER, + principal_certificate_der: PRINCIPAL_CERTIFICATE_DER, + }, + issuer: "https://ca.example", + subject: "spiffe://example.org/agent/accounting", + artifact_id: "aic-x509:agent-accounting:17", + artifact_digest: X509_ARTIFACT_DIGEST, + issuer_trust_anchor_digest: ISSUER_PIN, + constraints_digest: `sha256:${"c3".repeat(32)}`, + principal_binding: { + kind: "X509_SPKI", + hash_alg: "sha-256", + claimed_key_hash: SPKI, + presented_key_hash: SPKI, + }, + status: { + value: "CURRENT", + checked_at: NOW, + source_head_digest: `sha256:${"c4".repeat(32)}`, + }, + validity: { + not_before: "2026-09-01T06:55:00Z", + not_after: "2026-09-01T07:05:00Z", + }, + request_binding: REQUEST_BINDING, + ...overrides, + }; +} +function projectionJwtInput() { + const { request_binding: omitted, ...input } = jktInput(); + assert.ok(omitted); + return input; +} +function mapJkt(input = jktInput()) { + const mapped = mapAicJwtJktBoundCrossingAuthority(input, RP_CONTEXT); + assert.equal(mapped.ok, true, JSON.stringify(mapped)); + return mapped.authority; +} +function mapX509(input = x509Input()) { + const mapped = mapAicX509SpkiBoundCrossingAuthority(input, X509_RP_CONTEXT); + assert.equal(mapped.ok, true, JSON.stringify(mapped)); + return mapped.authority; +} +function crossingDraft(recordId) { + return { + record_id: recordId, + operation_id: `operation:${recordId}`, + issued_at: NOW, + action: ACTION, + boundary: BOUNDARY, + requirements: REQUIREMENTS, + admission_reference: { + state: "PRESENT", + digest: `sha256:${"88".repeat(32)}`, + }, + lifecycle_records: { + evaluation_digest: `sha256:${"ee".repeat(32)}`, + consumption_digest: `sha256:${"99".repeat(32)}`, + provider_entry_digest: null, + }, + evaluated_evidence_digests: [ + `sha256:${"66".repeat(32)}`, + `sha256:${"77".repeat(32)}`, + ], + configuration_digests: [ + `sha256:${"44".repeat(32)}`, + `sha256:${"55".repeat(32)}`, + ], + referee: ADMIT_AXES, + }; +} +async function issue(input, context, recordId) { + const issued = await issueAicBoundCrossingRecord(input, context, crossingDraft(recordId), { signing_keys: [...SIGNERS], deterministic: true, mldsaBackend }); + assert.equal(issued.ok, true, JSON.stringify(issued)); + return issued.record; +} +async function verify(value) { + return verifyAebCrossingRecord(value, { + verification_keys: [...VERIFICATION_KEYS], + mldsaBackend, + }); +} +export async function buildReferenceReport() { + const cases = []; + const jkt = mapJkt(); + const x509 = mapX509(); + const jktRecord = await issue(jktInput(), RP_CONTEXT, "crossing:aic:jkt:0001"); + const jktCheck = await verify(jktRecord); + cases.push(result("AIC-JWT-JKT-CROSSING", "positive", jkt.mapping_profile_id === AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE + && jktCheck.verified + && jktCheck.execution_authorizing === false, "RFC7638 jkt maps, receipt verifies, and remains non-authorizing", { + mapping_profile: jkt.mapping_profile_id, + verified: jktCheck.verified, + execution_authorizing: jktCheck.execution_authorizing, + algorithms: jktRecord.signatures.map((entry) => entry.alg), + })); + const x509Record = await issue(x509Input(), X509_RP_CONTEXT, "crossing:aic:x509:0001"); + const x509Check = await verify(x509Record); + cases.push(result("AIC-X509-SPKI-CROSSING", "positive", x509.mapping_profile_id === AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE + && x509Check.verified + && x509Check.execution_authorizing === false, "X.509 SPKI maps, receipt verifies, and remains non-authorizing", { + mapping_profile: x509.mapping_profile_id, + verified: x509Check.verified, + execution_authorizing: x509Check.execution_authorizing, + algorithms: x509Record.signatures.map((entry) => entry.alg), + })); + cases.push(result("NATIVE-BINDINGS-REMAIN-DISTINCT", "mapping", jkt.mapping_profile_id !== x509.mapping_profile_id + && jkt.native_profile !== x509.native_profile + && jkt.authority_instance_digest !== x509.authority_instance_digest, "RFC7638 jkt and X.509 SPKI are separate native profiles and instances", { + jkt_profile: jkt.mapping_profile_id, + x509_profile: x509.mapping_profile_id, + profiles_differ: jkt.mapping_profile_id !== x509.mapping_profile_id, + instances_differ: jkt.authority_instance_digest !== x509.authority_instance_digest, + })); + const relabeledArtifact = mapX509(x509Input({ + artifact_id: "wrapper-label:changed", + })); + const relabeledIssuer = mapX509(x509Input({ + issuer: "https://other-wrapper-label.example", + })); + cases.push(result("X509-DER-REPLAY-IDENTITY-STABLE", "mapping", x509.replay_unit === relabeledArtifact.replay_unit + && x509.replay_unit === relabeledIssuer.replay_unit + && x509.authority_instance_digest !== relabeledArtifact.authority_instance_digest + && x509.authority_instance_digest !== relabeledIssuer.authority_instance_digest, "exact DER fixes replay identity while authenticated wrapper metadata remains instance-bound", { + artifact_replay_stable: x509.replay_unit === relabeledArtifact.replay_unit, + issuer_replay_stable: x509.replay_unit === relabeledIssuer.replay_unit, + artifact_instance_changed: x509.authority_instance_digest !== relabeledArtifact.authority_instance_digest, + issuer_instance_changed: x509.authority_instance_digest !== relabeledIssuer.authority_instance_digest, + })); + const synthesizedJwtAsX509 = mapAicX509SpkiBoundCrossingAuthority({ + ...x509Input(), + artifact_digest: JWT_ARTIFACT_DIGEST, + carrier_provenance: { + ...jktInput().carrier_provenance, + downstream_representation: "SYNTHESIZED-X509", + }, + }, X509_RP_CONTEXT); + const synthesizedJwtAsJwt = mapAicJwtJktBoundCrossingAuthority(jktInput({ + carrier_provenance: { + ...jktInput().carrier_provenance, + downstream_representation: "SYNTHESIZED-X509", + }, + }), RP_CONTEXT); + cases.push(result("SYNTHESIZED-X509-CARRIER-CONFUSION-REFUSED", "hostile", !synthesizedJwtAsX509.ok + && synthesizedJwtAsX509.reason === "aic_carrier_provenance_unverifiable" + && synthesizedJwtAsJwt.ok, "JWT-origin synthesized X.509 refuses the native X.509 path and remains JWT/JKT", { + x509_path_ok: synthesizedJwtAsX509.ok, + x509_path_reason: synthesizedJwtAsX509.ok ? null : synthesizedJwtAsX509.reason, + jwt_path_ok: synthesizedJwtAsJwt.ok, + })); + const mismatch = mapAicJwtJktBoundCrossingAuthority(jktInput({ + principal_binding: { + kind: "RFC7638_JKT", + hash_alg: "jkt", + claimed_key_hash: JKT, + presented_key_hash: "K".repeat(43), + }, + }), RP_CONTEXT); + cases.push(result("PRINCIPAL-BINDING-MISMATCH", "hostile", !mismatch.ok && mismatch.reason === "aic_principal_binding_mismatch", "aic_principal_binding_mismatch", { ok: mismatch.ok, reason: mismatch.ok ? null : mismatch.reason })); + const attackerAnchor = `sha256:${"a2".repeat(32)}`; + const untrusted = mapAicX509SpkiBoundCrossingAuthority(x509Input({ + issuer_trust_anchor_digest: attackerAnchor, + }), X509_RP_CONTEXT); + const selfPinned = mapAicX509SpkiBoundCrossingAuthority({ + ...x509Input(), + issuer_trust_anchor_digest: attackerAnchor, + trusted_issuer_trust_anchor_digests: [attackerAnchor], + }, X509_RP_CONTEXT); + cases.push(result("RP-POLICY-SELF-PIN-REFUSED", "hostile", !untrusted.ok && untrusted.reason === "aic_issuer_untrusted" + && !selfPinned.ok && selfPinned.reason === "mapping_input_invalid", "native result cannot carry or replace relying-party trust pins", { + untrusted: untrusted.ok ? null : untrusted.reason, + self_pin: selfPinned.ok ? null : selfPinned.reason, + })); + const wrongTypToken = jwtCompactToken("JWT"); + const confused = mapAicJwtJktBoundCrossingAuthority({ + ...jktInput(), + artifact_digest: `sha256:${crypto.createHash("sha256") + .update(wrongTypToken, "utf8") + .digest("hex")}`, + carrier_provenance: { + ...jktInput().carrier_provenance, + compact_token: wrongTypToken, + }, + }, RP_CONTEXT); + cases.push(result("NATIVE-TYPE-CONFUSION", "hostile", !confused.ok && confused.reason === "aic_carrier_provenance_unverifiable", "aic_carrier_provenance_unverifiable", { ok: confused.ok, reason: confused.ok ? null : confused.reason })); + const failed = mapAicJwtJktBoundCrossingAuthority(jktInput({ + native_verification: "FAILED", + }), RP_CONTEXT); + const indeterminate = mapAicX509SpkiBoundCrossingAuthority(x509Input({ + native_verification: "INDETERMINATE", + }), X509_RP_CONTEXT); + cases.push(result("NATIVE-VERIFICATION-REFUSAL", "hostile", !failed.ok && failed.reason === "aic_native_verification_failed" + && !indeterminate.ok + && indeterminate.reason === "aic_native_verification_indeterminate", "FAILED and INDETERMINATE both refuse", { + failed: failed.ok ? null : failed.reason, + indeterminate: indeterminate.ok ? null : indeterminate.reason, + })); + const actionMismatch = mapAicJwtJktBoundCrossingAuthority(jktInput(), { + ...RP_CONTEXT, + action: { + ...ACTION, + action_digest: `sha256:${"01".repeat(32)}`, + }, + }); + cases.push(result("EXACT-ACTION-SUBSTITUTION-REFUSED", "hostile", !actionMismatch.ok + && actionMismatch.reason === "aic_action_projection_mismatch", "aic_action_projection_mismatch", { + ok: actionMismatch.ok, + reason: actionMismatch.ok ? null : actionMismatch.reason, + })); + const changedCapability = mapAicJwtJktBoundCrossingAuthority(jktInput({ + request_binding: { + ...REQUEST_BINDING, + requested_capability_digest: `sha256:${"02".repeat(32)}`, + }, + }), RP_CONTEXT); + cases.push(result("REQUEST-CAPABILITY-SUBSTITUTION-REFUSED", "hostile", !changedCapability.ok + && changedCapability.reason === "aic_requested_capability_mismatch", "aic_requested_capability_mismatch", { + ok: changedCapability.ok, + reason: changedCapability.ok ? null : changedCapability.reason, + })); + const wrongDomain = mapAicJwtJktBoundCrossingAuthority(jktInput(), { + ...RP_CONTEXT, + admission_domain: { + ...BOUNDARY, + relying_party_id: "rp:other-company", + }, + }); + cases.push(result("RELYING-PARTY-DOMAIN-SUBSTITUTION-REFUSED", "hostile", !wrongDomain.ok + && wrongDomain.reason === "aic_admission_domain_mismatch", "aic_admission_domain_mismatch", { + ok: wrongDomain.ok, + reason: wrongDomain.ok ? null : wrongDomain.reason, + })); + const wrongAudienceToken = jwtCompactToken("aic+jwt", "erp:other-system"); + const wrongAudience = mapAicJwtJktBoundCrossingAuthority(jktInput({ + artifact_digest: `sha256:${crypto.createHash("sha256") + .update(wrongAudienceToken, "utf8") + .digest("hex")}`, + carrier_provenance: { + ...jktInput().carrier_provenance, + compact_token: wrongAudienceToken, + }, + }), RP_CONTEXT); + cases.push(result("JWT-AUDIENCE-SUBSTITUTION-REFUSED", "hostile", !wrongAudience.ok && wrongAudience.reason === "aic_audience_mismatch", "aic_audience_mismatch", { + ok: wrongAudience.ok, + reason: wrongAudience.ok ? null : wrongAudience.reason, + })); + const relabeledJwtValidity = mapAicJwtJktBoundCrossingAuthority(jktInput({ + validity: { + not_before: "2026-09-01T06:54:00Z", + not_after: "2026-09-01T07:06:00Z", + }, + }), RP_CONTEXT); + cases.push(result("JWT-TEMPORAL-RELABELING-REFUSED", "hostile", !relabeledJwtValidity.ok + && relabeledJwtValidity.reason === "aic_jwt_validity_mismatch", "signed compact-token iat/nbf/exp must exactly bind wrapper validity", { + ok: relabeledJwtValidity.ok, + reason: relabeledJwtValidity.ok ? null : relabeledJwtValidity.reason, + })); + const stale = mapAicJwtJktBoundCrossingAuthority(jktInput({ + status: { + value: "CURRENT", + checked_at: "2026-09-01T06:58:00Z", + source_head_digest: `sha256:${"b4".repeat(32)}`, + }, + }), RP_CONTEXT); + const future = mapAicJwtJktBoundCrossingAuthority(jktInput({ + status: { + value: "CURRENT", + checked_at: "2026-09-01T07:00:01Z", + source_head_digest: `sha256:${"b4".repeat(32)}`, + }, + }), RP_CONTEXT); + cases.push(result("STATUS-OBSERVATION-TIME-REFUSALS", "hostile", !stale.ok && stale.reason === "aic_status_observation_stale" + && !future.ok && future.reason === "aic_status_observation_future", "stale and future observations both refuse", { + stale: stale.ok ? null : stale.reason, + future: future.ok ? null : future.reason, + })); + const widenedFreshness = { + evaluated_at: NOW, + max_status_age_seconds: 86_400, + }; + const widenedBoundJwt = mapAicJwtJktBoundCrossingAuthority(jktInput(), { + ...RP_CONTEXT, + ...widenedFreshness, + }); + const widenedBoundX509 = mapAicX509SpkiBoundCrossingAuthority(x509Input(), { + ...X509_RP_CONTEXT, + ...widenedFreshness, + }); + const widenedProjection = projectAicJwtToStrictJwtSvid({ + source: projectionJwtInput(), + purpose: "WORKLOAD_IDENTITY_ONLY", + audience: ["spiffe://services.example/payment-gate"], + issued_at: 1788246000, + not_before: 1788245940, + expires_at: 1788246240, + token_id: "jwt-svid-projection-freshness-widening", + projected_algorithm: "ES256", + projected_key_id: "jwt-svid-key-2026-08", + }, { + source_verification_policy: JWT_PROJECTION_SOURCE_POLICY, + ...widenedFreshness, + }); + const freshnessMismatch = (value) => !value.ok && value.reason === "aic_status_freshness_profile_mismatch"; + cases.push(result("STATUS-FRESHNESS-PROFILE-WIDENING-REFUSED", "hostile", freshnessMismatch(widenedBoundJwt) + && freshnessMismatch(widenedBoundX509) + && freshnessMismatch(widenedProjection), "the fixed 60-second v0.2 freshness profile cannot be widened by a caller", { + bound_jwt: widenedBoundJwt.ok ? null : widenedBoundJwt.reason, + bound_x509: widenedBoundX509.ok ? null : widenedBoundX509.reason, + jwt_svid_projection: widenedProjection.ok ? null : widenedProjection.reason, + })); + const revoked = mapAicX509SpkiBoundCrossingAuthority(x509Input({ + status: { + value: "REVOKED", + checked_at: NOW, + source_head_digest: `sha256:${"c4".repeat(32)}`, + }, + }), X509_RP_CONTEXT); + const unavailable = mapAicX509SpkiBoundCrossingAuthority(x509Input({ + status: { + value: "UNAVAILABLE", + checked_at: NOW, + source_head_digest: `sha256:${"c4".repeat(32)}`, + }, + }), X509_RP_CONTEXT); + cases.push(result("NON-CURRENT-SOURCE-STATUS-REFUSED", "hostile", !revoked.ok && revoked.reason === "aic_status_not_current" + && !unavailable.ok && unavailable.reason === "aic_status_not_current", "revoked and unavailable source status both refuse", { + revoked: revoked.ok ? null : revoked.reason, + unavailable: unavailable.ok ? null : unavailable.reason, + })); + const outOfWindow = mapAicJwtJktBoundCrossingAuthority(jktInput({ + status: { + ...jktInput().status, + checked_at: "2026-09-01T07:06:00Z", + }, + }), { + ...RP_CONTEXT, + evaluated_at: "2026-09-01T07:06:00Z", + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + }); + cases.push(result("NATIVE-VALIDITY-WINDOW-REFUSED", "hostile", !outOfWindow.ok + && outOfWindow.reason === "aic_validity_window_mismatch", "aic_validity_window_mismatch", { + ok: outOfWindow.ok, + reason: outOfWindow.ok ? null : outOfWindow.reason, + })); + const issuerTimeDomainMismatch = await issueAicBoundCrossingRecord(jktInput(), RP_CONTEXT, { + ...crossingDraft("crossing:aic:jkt:issuer-domain-mismatch"), + boundary: { + ...BOUNDARY, + relying_party_id: "rp:other-company", + }, + }, { signing_keys: [] }); + cases.push(result("AIC-ISSUER-DOMAIN-MISMATCH-REFUSED-BEFORE-SIGNING", "hostile", !issuerTimeDomainMismatch.ok + && issuerTimeDomainMismatch.reason + === "aic_crossing_issue_admission_domain_mismatch", "aic_crossing_issue_admission_domain_mismatch", { + ok: issuerTimeDomainMismatch.ok, + reason: issuerTimeDomainMismatch.ok + ? null + : issuerTimeDomainMismatch.reason, + })); + const rpSubstitutedRecord = structuredClone(jktRecord); + rpSubstitutedRecord.body.boundary.relying_party_id = "rp:other-company"; + const rpSubstitutedCheck = await verify(rpSubstitutedRecord); + cases.push(result("SIGNED-BODY-RP-SUBSTITUTION-REFUSED", "boundary", !rpSubstitutedCheck.verified + && rpSubstitutedCheck.reason === "signature_invalid", "signature_invalid", { + verified: rpSubstitutedCheck.verified, + reason: rpSubstitutedCheck.reason, + })); + const base = { + "@version": "AIC-AEB-CROSSING-REFERENCE-REPORT-v0.2", + profile: PROFILE, + crossing_record_version: AEB_CROSSING_RECORD_VERSION, + required_algorithms: [...AEB_CROSSING_RECORD_REQUIRED_ALGORITHMS], + mappings: [ + AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + ], + action_projection: MAPPING_PROFILE.action_projection, + admission_domain: MAPPING_PROFILE.admission_domain, + source_status: MAPPING_PROFILE.source_status, + source_lock: SOURCE_LOCK, + source_lock_digest: SOURCE_LOCK_DIGEST, + mapping_profile_digest: sha256(canonicalizeAeb(MAPPING_PROFILE)), + native_verification_fixture: { + execution: "STIPULATED_NOT_EXECUTED", + jwt_signature: "PLACEHOLDER", + x509_aic_and_principal_authorization_extensions: "ABSENT", + upstream_native_acceptance_claimed: false, + }, + cases, + passed: cases.every((entry) => entry.passed), + known_limits: [ + "This run exercises the EMILIA reference adapter and crossing-record implementation; it is not an independent implementation of AIC-JWT or AIC-X509.", + "The adapter consumes a native verifier result; it does not reimplement AIC signature, certificate-path, delegation, capability, constraint, status, or proof-of-possession validation.", + "This deterministic suite stipulates native VERIFIED results to test the adapter boundary. Its JWT signature is a placeholder and its parseable X.509 certificates are not AIC credential-bundle fixtures, so it does not claim the pinned upstream verifiers accepted them.", + "The relying party pins the exact requested-capability digest and action-projection profile. Production integration must also provide an authenticated native result proving that the same capability request was evaluated; the pinned gateway bearer helper does not set RequestCapability.", + "The adapter checks a supplied capability-to-action projection for exact equality; it does not produce that projection. Unknown schemes, ambiguous mappings, and unmapped material parameters must refuse upstream.", + "The bound authority commits one exact action and one relying-party admission domain. The AIC-specific issue helper compares both against the record draft before signing; changing the action, relying party, audience, executor, or state domain requires a new evaluation.", + "EP-AEB-CROSSING-RECORD-v1 commits the bound authority's opaque instance, replay, and constraints digests but does not directly commit relying_party_id in its contract digest. The generic issuer cannot recompute the AIC context, so it is not the AIC issuance API. A versioned crossing-record v2 is required for generic recomputable admission-domain binding.", + "status.checked_at is the explicit source-status observation time. The v0.2 runtime accepts exactly a 60-second maximum age; a caller cannot widen it. CURRENT status is accepted only within that fixed freshness limit and native validity window; revoked, unavailable, stale, future, or otherwise non-current observations refuse.", + "The native verifier result and relying-party policy are structurally separate. Trusted anchors and expected verifier, mapping-profile, and action-projection pins come only from relying-party policy, never from the presented native result.", + "The relying party supplies and authenticates mapping-profile provenance and its digest. This reusable adapter enforces the profile identifier and fixed freshness rule but does not load or recompute the checked-in mapping-profile JSON.", + "RFC 7638 JWK thumbprints and X.509 SHA-256 SPKI hashes remain separate native mappings and are never treated as interchangeable proof. The JWT path derives the presented JWK thumbprint but does not prove possession of that key.", + "The JWT/JKT mapping requires the original compact token, derives its audience, issuer/JTI replay identity, and signed iat/nbf/exp envelope, requires exact agreement with wrapper validity, and requires explicit public JWK material. A bare X.509 object synthesized from a verified AIC-JWT has no native bundle DER and cannot enter the native X.509/SPKI mapping.", + "The X.509 path derives replay identity, bundle digest, serial, and principal SHA-256 SPKI from DER. Issuer, subject, status, validity, constraints, trust-anchor selection, and verification evidence remain authenticated native-wrapper outputs, not facts derived by this adapter from the leaf DER.", + "Raw-carrier fingerprints are derived from the bytes supplied to this adapter. They do not prove that the native verifier saw those same bytes unless an authenticated wrapper binds the verifier result to them.", + "JWT-SVID workload projection uses a private source verifier that emits no crossing authority. The projection digest commits the accepted source evaluation, including verifier, source-policy, evidence, trust-anchor, status, validity, and freshness inputs.", + "The local raw-source boundary does not authenticate a verifier result crossing an untrusted Go or JSON boundary. Integration still requires a tagged or authenticated verifier-result wrapper; the pinned gateway bearer helper sets neither ExpectedAudience, RequestCapability, PrincipalMaterial, nor PresenterKey, and no non-test VerifyBearer wiring was observed.", + "A verified crossing record is evidence of one past relying-party boundary decision and never authorizes another action.", + "Passing these checks does not establish IETF adoption, certification, production deployment, independent interoperability, or employer endorsement.", + ], + }; + return { ...base, results_digest: sha256(canonicalizeAeb(base)) }; +} +export async function runProfile(runner = { + name: "EMILIA reference runner", + affiliation: "EMILIA Protocol", + revision: "aic-aeb-crossing-v0.2", + executed_at: NOW, +}) { + const reference = await buildReferenceReport(); + const passed = reference.cases.filter((entry) => entry.passed).length; + return { + ...reference, + runner, + reproduction_statement: `${runner.name} (${runner.affiliation}) reproduced ${passed}/${reference.cases.length} AIC crossing checks at ${runner.revision}. This is a reproduction of the EMILIA reference composition, not independent AIC interoperability, IETF adoption, certification, or employer endorsement.`, + }; +} +function argument(name) { + const index = process.argv.indexOf(name); + return index === -1 ? undefined : process.argv[index + 1]; +} +if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + const deterministicReference = sorted(await buildReferenceReport()); + if (process.argv.includes("--check")) { + assert.deepEqual(deterministicReference, JSON.parse(readFileSync(REFERENCE_PATH, "utf8")), "AIC crossing output changed; inspect the semantic delta before deliberately re-pinning report.reference.json"); + } + const report = await runProfile({ + name: argument("--runner-name") ?? "EMILIA reference runner", + affiliation: argument("--runner-affiliation") ?? "EMILIA Protocol", + revision: argument("--runner-revision") ?? "aic-aeb-crossing-v0.2", + executed_at: argument("--executed-at") ?? NOW, + }); + const output = argument("--output"); + if (process.argv.includes("--write-reference")) { + writeFileSync(REFERENCE_PATH, `${JSON.stringify(deterministicReference, null, 2)}\n`, "utf8"); + } + if (output) { + writeFileSync(resolve(output), `${JSON.stringify(sorted(report), null, 2)}\n`, "utf8"); + } + else { + process.stdout.write(`${JSON.stringify(sorted(report), null, 2)}\n`); + } + if (!report.passed) + process.exitCode = 1; +} diff --git a/conformance/composition/aic-aeb-crossing-v0.2/run.mts b/conformance/composition/aic-aeb-crossing-v0.2/run.mts new file mode 100644 index 000000000..ae4372253 --- /dev/null +++ b/conformance/composition/aic-aeb-crossing-v0.2/run.mts @@ -0,0 +1,1040 @@ +// SPDX-License-Identifier: Apache-2.0 +/** + * AIC x EP-AEB-CROSSING-RECORD-v1 deterministic composition runner. + * + * The native AIC verifier remains authoritative for AIC-JWT or AIC-X509 + * validation. This runner starts from that verifier's result, checks the + * relying party's pinned issuer and principal binding, and records the local + * boundary decision. It does not turn an AIC credential or a crossing record + * into reusable execution authority. + */ +import assert from "node:assert/strict"; +import crypto from "node:crypto"; +import { readFileSync, writeFileSync } from "node:fs"; +import { dirname, resolve } from "node:path"; +import { fileURLToPath } from "node:url"; + +import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js"; + +import { + AIC_ADMISSION_DOMAIN_VERSION, + AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, + AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION, + AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + issueAicBoundCrossingRecord, + mapAicJwtJktBoundCrossingAuthority, + mapAicX509SpkiBoundCrossingAuthority, + projectAicJwtToStrictJwtSvid, + type AicCrossingRelyingPartyContext, + type AicCrossingRelyingPartyPolicy, + type AicJwtJktCrossingInput, + type AicJwtJktBoundCrossingInput, + type AicJwtSvidSourceVerificationPolicy, + type AicX509SpkiBoundCrossingInput, +} from "../../../packages/verify/aeb-aic-crossing-adapter.js"; +import { + AEB_CROSSING_RECORD_REQUIRED_ALGORITHMS, + AEB_CROSSING_RECORD_VERSION, + verifyAebCrossingRecord, + type CrossingNativeAuthority, + type CrossingRefereeAxes, +} from "../../../packages/verify/aeb-crossing-record.js"; +import { + canonicalizeAeb, + digestAebTyped, +} from "../../../packages/verify/aeb-adapter-contract.js"; +import { loadDefaultAgilityMldsaBackend } from "../../../packages/verify/pq-signature-agility.js"; + +export const PROFILE = "EP-AIC-AEB-CROSSING-COMPOSITION-v0.2"; +const HERE = dirname(fileURLToPath(import.meta.url)); +const REFERENCE_PATH = resolve(HERE, "report.reference.json"); +const SOURCE_LOCK = JSON.parse( + readFileSync(resolve(HERE, "source-lock.json"), "utf8"), +); +const SOURCE_LOCK_DIGEST = `sha256:${crypto.hash( + "sha256", + canonicalizeAeb(SOURCE_LOCK), + "hex", +)}` as const; +const MAPPING_PROFILE = JSON.parse( + readFileSync(resolve(HERE, "mapping-profile.json"), "utf8"), +); +const MAPPING_PROFILE_DIGEST = `sha256:${crypto.hash( + "sha256", + canonicalizeAeb(MAPPING_PROFILE), + "hex", +)}` as const; +const NOW = "2026-09-01T07:00:00Z"; + +type Json = null | boolean | number | string | Json[] | { [key: string]: Json }; +type CaseResult = { + id: string; + category: "mapping" | "positive" | "hostile" | "boundary"; + passed: boolean; + expected: string; + observed: Json; +}; + +const ED_PRIVATE_JWK = { + crv: "Ed25519", + d: "EBsZ3aVNd8cSzmZECgG0MMAPTreFIhgDFtTY9UTkQ_Y", + x: "c_kUSHs4ymdA65GF3OV8C3PDWhelodqfOvCmFe-6oUI", + kty: "OKP", +} as const; +const ED_PUBLIC_JWK = { + crv: "Ed25519", + x: "c_kUSHs4ymdA65GF3OV8C3PDWhelodqfOvCmFe-6oUI", + kty: "OKP", +} as const; +const edPrivate = crypto.createPrivateKey({ key: ED_PRIVATE_JWK, format: "jwk" }); +const edPublic = crypto.createPublicKey({ key: ED_PUBLIC_JWK, format: "jwk" }); +const edPublicSpki = edPublic + .export({ type: "spki", format: "der" }) + .toString("base64url"); +const pqPair = ml_dsa65.keygen(new Uint8Array(32).fill(0x41)); +const pqPublic = Buffer.from(pqPair.publicKey).toString("base64url"); +const mldsaBackend = await loadDefaultAgilityMldsaBackend(); +assert.ok(mldsaBackend, "real ML-DSA-65 backend must be available"); + +const SIGNERS = [ + { alg: "Ed25519", key_id: "aic-crossing-ed", private_key: edPrivate }, + { alg: "ML-DSA-65", key_id: "aic-crossing-pq", private_key: pqPair.secretKey }, +] as const; +const VERIFICATION_KEYS = [ + { alg: "Ed25519", key_id: "aic-crossing-ed", public_key: edPublicSpki }, + { alg: "ML-DSA-65", key_id: "aic-crossing-pq", public_key: pqPublic }, +] as const; + +const ISSUER_PIN = `sha256:${"a1".repeat(32)}` as const; +const PRINCIPAL_JWK = Object.freeze({ + kty: "OKP" as const, + crv: "Ed25519", + x: "c_kUSHs4ymdA65GF3OV8C3PDWhelodqfOvCmFe-6oUI", +}); +const JKT = crypto.createHash("sha256") + .update(JSON.stringify({ + crv: PRINCIPAL_JWK.crv, + kty: PRINCIPAL_JWK.kty, + x: PRINCIPAL_JWK.x, + })) + .digest("base64url"); +const SPKI = "HHZknPZ96UejPrdBkR8uVScD38l0C-CydQ-8aWJ1iFo"; +const AGENT_CERTIFICATE_DER = "MIIBczCCASWgAwIBAgICEIcwBQYDK2VwMDgxGTAXBgNVBAMMEGFnZW50LWFjY291bnRpbmcxGzAZBgNVBAoMEkVNSUxJQSBBSUMgRml4dHVyZTAeFw0yNjA5MDEwNjM1MTRaFw0zNjA4MjkwNjM1MTRaMDgxGTAXBgNVBAMMEGFnZW50LWFjY291bnRpbmcxGzAZBgNVBAoMEkVNSUxJQSBBSUMgRml4dHVyZTAqMAUGAytlcAMhABlRhmmMT_c3eHf39WJ53gjQ-XsXrkk2JjbOst7y2iG6o1MwUTAdBgNVHQ4EFgQUYRN3QUuM-4WfrO9gw0jrbCge6WkwHwYDVR0jBBgwFoAUYRN3QUuM-4WfrO9gw0jrbCge6WkwDwYDVR0TAQH_BAUwAwEB_zAFBgMrZXADQQAMwAAYlEzDMMFWXJomesb1_O7QypjsRF3DGHQLhuoBh2op5s9xTo7aiF1BAfW2O82QCy9LOCZsX1ymKcLUEJYL"; +const PRINCIPAL_CERTIFICATE_DER = "MIIBezCCAS2gAwIBAgICEIgwBQYDK2VwMDwxHTAbBgNVBAMMFHByaW5jaXBhbC1hY2NvdW50aW5nMRswGQYDVQQKDBJFTUlMSUEgQUlDIEZpeHR1cmUwHhcNMjYwOTAxMDYzNTE0WhcNMzYwODI5MDYzNTE0WjA8MR0wGwYDVQQDDBRwcmluY2lwYWwtYWNjb3VudGluZzEbMBkGA1UECgwSRU1JTElBIEFJQyBGaXh0dXJlMCowBQYDK2VwAyEAWP6IT_BCkU9xUCVQR2MePkJ_zYdkFYqAFp0jSzW6Re6jUzBRMB0GA1UdDgQWBBRZkhmqaCLhEEtolUAUZLVa7eBfejAfBgNVHSMEGDAWgBRZkhmqaCLhEEtolUAUZLVa7eBfejAPBgNVHRMBAf8EBTADAQH_MAUGAytlcANBAL-e_CxbdYdZRTB86m3ldvMg_dCpJHAtMl26I-T40QR2JFbG3xWhJTKfEMuZooI2jjHbjLsE1qHQ6s5v3EtphQ0"; +function pinnedSourceDigest( + repository: string, + path: string, + revision?: string, +): string { + const repositories = SOURCE_LOCK.varwof.repositories.filter( + (entry: any) => entry.repository === repository + && (revision === undefined || entry.revision === revision), + ); + assert.equal( + repositories.length, + 1, + `ambiguous pinned repository ${repository}${revision ? `@${revision}` : ""}`, + ); + const file = repositories[0].inspected_files.find((entry: any) => entry.path === path); + assert.equal(typeof file?.sha256, "string", `missing pinned source ${repository}:${path}`); + return file.sha256; +} +const JWT_VERIFIER = Object.freeze({ + id: "varwof:aic-jwt-validate.gateway-verify-bearer", + version: "source-lock-v0.2", + implementation_digest: digestAebTyped({ + validate_go_sha256: pinnedSourceDigest( + "https://github.com/varwof/types", + "aicjwt/validate.go", + "76f725ffc375ae7fda1f0255ea3e12a0074f6c4c", + ), + keyhash_go_sha256: pinnedSourceDigest( + "https://github.com/varwof/types", + "aicjwt/keyhash.go", + "76f725ffc375ae7fda1f0255ea3e12a0074f6c4c", + ), + gateway_bearer_sha256: pinnedSourceDigest( + "https://github.com/varwof/gateway-core", + "jwt.go", + ), + gateway_go_mod_sha256: pinnedSourceDigest( + "https://github.com/varwof/gateway-core", + "go.mod", + ), + complete_inspection_set_digest: SOURCE_LOCK_DIGEST, + }, "AIC-JWT-NATIVE-VERIFIER-SOURCE-LOCK-v1"), +}); +const X509_VERIFIER = Object.freeze({ + id: "varwof:gateway-verify-credential-bundle", + version: "source-lock-v0.2", + implementation_digest: digestAebTyped({ + credential_bundle_sha256: pinnedSourceDigest( + "https://github.com/varwof/gateway-core", + "credential_bundle.go", + ), + gateway_go_mod_sha256: pinnedSourceDigest( + "https://github.com/varwof/gateway-core", + "go.mod", + ), + complete_inspection_set_digest: SOURCE_LOCK_DIGEST, + }, "AIC-X509-NATIVE-VERIFIER-SOURCE-LOCK-v1"), +}); + +function jwtCompactToken( + typ = "aic+jwt", + audience: string | string[] = "erp:vendor-master", +): string { + const segment = (value: unknown) => Buffer.from(JSON.stringify(value), "utf8") + .toString("base64url"); + return [ + segment({ alg: "EdDSA", typ, kid: "issuer-key-1" }), + segment({ + iss: "https://issuer.example", + sub: "spiffe://example.org/agent/accounting", + aud: audience, + iat: 1788245700, + exp: 1788246300, + jti: "aic-jwt:agent-accounting:17", + cnf: { jkt: JKT }, + aic: { + ver: 1, + principal: { + realm: "example.org", + id: "principal:accounting-owner", + key_hash: JKT, + hash_alg: "jkt", + }, + delegation_mode: "authorized", + capabilities: [{ + scheme: "varwof/core", + id: "finance.vendor-account-change", + params: { + vendor_id: "vendor-0042", + account_fingerprint: "acct:7e8c", + }, + }], + }, + }), + Buffer.from("fixture-signature", "utf8").toString("base64url"), + ].join("."); +} + +const JWT_COMPACT_TOKEN = jwtCompactToken(); +const JWT_ARTIFACT_DIGEST = `sha256:${crypto.createHash("sha256") + .update(JWT_COMPACT_TOKEN, "utf8") + .digest("hex")}` as const; +const X509_ARTIFACT_DIGEST = digestAebTyped( + { + agent_certificate_der: AGENT_CERTIFICATE_DER, + principal_certificate_der: PRINCIPAL_CERTIFICATE_DER, + }, + AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION, +); +const ACTION = Object.freeze({ + caid: "caid:1:finance.vendor-account-change.1:jcs-sha256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", + action_digest: `sha256:${"11".repeat(32)}` as const, +}); +const BOUNDARY = Object.freeze({ + relying_party_id: "rp:example-finance", + audience: "erp:vendor-master", + executor_id: "executor:erp-production", + state_domain_id: "state-domain:finance-primary", +}); +const REQUEST_BINDING = Object.freeze({ + action_projection_profile_id: "AIC-EXACT-ACTION-PROJECTION-v1", + action_projection_profile_digest: MAPPING_PROFILE_DIGEST, + requested_capability_digest: sha256(canonicalizeAeb({ + scheme: "varwof/core", + id: "finance.vendor-account-change", + params: { + vendor_id: "vendor-0042", + account_fingerprint: "acct:7e8c", + }, + })) as `sha256:${string}`, + projected_action: ACTION, + projected_admission_domain_digest: digestAebTyped( + BOUNDARY, + AIC_ADMISSION_DOMAIN_VERSION, + ), +}); +const JWT_POLICY = Object.freeze({ + mapping_profile_id: AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + mapping_profile_digest: MAPPING_PROFILE_DIGEST, + action_projection_profile_id: REQUEST_BINDING.action_projection_profile_id, + action_projection_profile_digest: + REQUEST_BINDING.action_projection_profile_digest, + trusted_issuer_trust_anchor_digests: [ISSUER_PIN], + native_verifier: JWT_VERIFIER, +}) satisfies AicCrossingRelyingPartyPolicy; +const X509_POLICY = Object.freeze({ + mapping_profile_id: AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + mapping_profile_digest: MAPPING_PROFILE_DIGEST, + action_projection_profile_id: REQUEST_BINDING.action_projection_profile_id, + action_projection_profile_digest: + REQUEST_BINDING.action_projection_profile_digest, + trusted_issuer_trust_anchor_digests: [ISSUER_PIN], + native_verifier: X509_VERIFIER, +}) satisfies AicCrossingRelyingPartyPolicy; +const JWT_PROJECTION_SOURCE_POLICY = Object.freeze({ + source_verification_profile_id: + AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, + source_verification_profile_digest: MAPPING_PROFILE_DIGEST, + trusted_issuer_trust_anchor_digests: [ISSUER_PIN], + native_verifier: JWT_VERIFIER, +}) satisfies AicJwtSvidSourceVerificationPolicy; +function relyingPartyContext( + policy: AicCrossingRelyingPartyPolicy = JWT_POLICY, +): AicCrossingRelyingPartyContext { + return { + action: ACTION, + admission_domain: BOUNDARY, + requested_capability_digest: REQUEST_BINDING.requested_capability_digest, + evaluated_at: NOW, + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + policy, + }; +} +const RP_CONTEXT = Object.freeze(relyingPartyContext()); +const X509_RP_CONTEXT = Object.freeze(relyingPartyContext(X509_POLICY)); +const REQUIREMENTS = Object.freeze({ + admission_digest: `sha256:${"22".repeat(32)}` as const, + review_digest: `sha256:${"33".repeat(32)}` as const, +}); +const ADMIT_AXES = { + native_verification: "VERIFIED", + rp_acceptance: "ACCEPTED", + action_relation: "EXACT_MATCH", + status: "CURRENT", + replay: "FRESH", + admission: "ADMIT", + custody: "RESERVED", + provider_commitment: "NOT_INVOKED", + observed_effect: "NOT_OBSERVED", + retry: "NOT_APPLICABLE", + reconciliation: "NOT_APPLICABLE", + reason_codes: [] as string[], +} satisfies CrossingRefereeAxes; + +function sorted(value: any): Json { + if (Array.isArray(value)) return value.map(sorted); + if (value !== null && typeof value === "object") { + return Object.fromEntries( + Object.keys(value).sort().map((key) => [key, sorted(value[key])]), + ) as Json; + } + return value as Json; +} + +function sha256(value: string): string { + return `sha256:${crypto.hash("sha256", value, "hex")}`; +} + +function result( + id: string, + category: CaseResult["category"], + passed: boolean, + expected: string, + observed: Json, +): CaseResult { + return { id, category, passed, expected, observed }; +} + +function jktInput( + overrides: Partial = {}, +): AicJwtJktBoundCrossingInput { + return { + native_verification: "VERIFIED", + native_verifier: JWT_VERIFIER, + native_verification_evidence_digest: `sha256:${"b0".repeat(32)}`, + carrier_provenance: { + source_carrier: "AIC-JWT-COMPACT", + compact_token: JWT_COMPACT_TOKEN, + presented_principal_jwk: PRINCIPAL_JWK, + downstream_representation: "DIRECT", + }, + issuer: "https://issuer.example", + subject: "spiffe://example.org/agent/accounting", + artifact_id: "aic-jwt:agent-accounting:17", + artifact_digest: JWT_ARTIFACT_DIGEST, + issuer_trust_anchor_digest: ISSUER_PIN, + constraints_digest: `sha256:${"b3".repeat(32)}`, + principal_binding: { + kind: "RFC7638_JKT", + hash_alg: "jkt", + claimed_key_hash: JKT, + presented_key_hash: JKT, + }, + status: { + value: "CURRENT", + checked_at: NOW, + source_head_digest: `sha256:${"b4".repeat(32)}`, + }, + validity: { + not_before: "2026-09-01T06:55:00Z", + not_after: "2026-09-01T07:05:00Z", + }, + request_binding: REQUEST_BINDING, + ...overrides, + }; +} + +function x509Input( + overrides: Partial = {}, +): AicX509SpkiBoundCrossingInput { + return { + native_verification: "VERIFIED", + native_verifier: X509_VERIFIER, + native_verification_evidence_digest: `sha256:${"c0".repeat(32)}`, + carrier_provenance: { + source_carrier: "AIC-X509-CREDENTIAL-BUNDLE", + agent_certificate_der: AGENT_CERTIFICATE_DER, + principal_certificate_der: PRINCIPAL_CERTIFICATE_DER, + }, + issuer: "https://ca.example", + subject: "spiffe://example.org/agent/accounting", + artifact_id: "aic-x509:agent-accounting:17", + artifact_digest: X509_ARTIFACT_DIGEST, + issuer_trust_anchor_digest: ISSUER_PIN, + constraints_digest: `sha256:${"c3".repeat(32)}`, + principal_binding: { + kind: "X509_SPKI", + hash_alg: "sha-256", + claimed_key_hash: SPKI, + presented_key_hash: SPKI, + }, + status: { + value: "CURRENT", + checked_at: NOW, + source_head_digest: `sha256:${"c4".repeat(32)}`, + }, + validity: { + not_before: "2026-09-01T06:55:00Z", + not_after: "2026-09-01T07:05:00Z", + }, + request_binding: REQUEST_BINDING, + ...overrides, + }; +} + +function projectionJwtInput(): AicJwtJktCrossingInput { + const { request_binding: omitted, ...input } = jktInput(); + assert.ok(omitted); + return input; +} + +function mapJkt(input = jktInput()): CrossingNativeAuthority { + const mapped = mapAicJwtJktBoundCrossingAuthority(input, RP_CONTEXT); + assert.equal(mapped.ok, true, JSON.stringify(mapped)); + return mapped.authority; +} + +function mapX509(input = x509Input()): CrossingNativeAuthority { + const mapped = mapAicX509SpkiBoundCrossingAuthority(input, X509_RP_CONTEXT); + assert.equal(mapped.ok, true, JSON.stringify(mapped)); + return mapped.authority; +} + +function crossingDraft(recordId: string) { + return { + record_id: recordId, + operation_id: `operation:${recordId}`, + issued_at: NOW, + action: ACTION, + boundary: BOUNDARY, + requirements: REQUIREMENTS, + admission_reference: { + state: "PRESENT" as const, + digest: `sha256:${"88".repeat(32)}` as const, + }, + lifecycle_records: { + evaluation_digest: `sha256:${"ee".repeat(32)}` as const, + consumption_digest: `sha256:${"99".repeat(32)}` as const, + provider_entry_digest: null, + }, + evaluated_evidence_digests: [ + `sha256:${"66".repeat(32)}` as const, + `sha256:${"77".repeat(32)}` as const, + ], + configuration_digests: [ + `sha256:${"44".repeat(32)}` as const, + `sha256:${"55".repeat(32)}` as const, + ], + referee: ADMIT_AXES, + }; +} + +async function issue( + input: AicJwtJktBoundCrossingInput | AicX509SpkiBoundCrossingInput, + context: AicCrossingRelyingPartyContext, + recordId: string, +) { + const issued = await issueAicBoundCrossingRecord( + input, + context, + crossingDraft(recordId), + { signing_keys: [...SIGNERS], deterministic: true, mldsaBackend }, + ); + assert.equal(issued.ok, true, JSON.stringify(issued)); + return issued.record; +} + +async function verify(value: unknown) { + return verifyAebCrossingRecord(value, { + verification_keys: [...VERIFICATION_KEYS], + mldsaBackend, + }); +} + +export async function buildReferenceReport() { + const cases: CaseResult[] = []; + const jkt = mapJkt(); + const x509 = mapX509(); + + const jktRecord = await issue( + jktInput(), + RP_CONTEXT, + "crossing:aic:jkt:0001", + ); + const jktCheck = await verify(jktRecord); + cases.push(result( + "AIC-JWT-JKT-CROSSING", + "positive", + jkt.mapping_profile_id === AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE + && jktCheck.verified + && jktCheck.execution_authorizing === false, + "RFC7638 jkt maps, receipt verifies, and remains non-authorizing", + { + mapping_profile: jkt.mapping_profile_id, + verified: jktCheck.verified, + execution_authorizing: jktCheck.execution_authorizing, + algorithms: jktRecord.signatures.map((entry) => entry.alg), + }, + )); + + const x509Record = await issue( + x509Input(), + X509_RP_CONTEXT, + "crossing:aic:x509:0001", + ); + const x509Check = await verify(x509Record); + cases.push(result( + "AIC-X509-SPKI-CROSSING", + "positive", + x509.mapping_profile_id === AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE + && x509Check.verified + && x509Check.execution_authorizing === false, + "X.509 SPKI maps, receipt verifies, and remains non-authorizing", + { + mapping_profile: x509.mapping_profile_id, + verified: x509Check.verified, + execution_authorizing: x509Check.execution_authorizing, + algorithms: x509Record.signatures.map((entry) => entry.alg), + }, + )); + + cases.push(result( + "NATIVE-BINDINGS-REMAIN-DISTINCT", + "mapping", + jkt.mapping_profile_id !== x509.mapping_profile_id + && jkt.native_profile !== x509.native_profile + && jkt.authority_instance_digest !== x509.authority_instance_digest, + "RFC7638 jkt and X.509 SPKI are separate native profiles and instances", + { + jkt_profile: jkt.mapping_profile_id, + x509_profile: x509.mapping_profile_id, + profiles_differ: jkt.mapping_profile_id !== x509.mapping_profile_id, + instances_differ: jkt.authority_instance_digest !== x509.authority_instance_digest, + }, + )); + + const relabeledArtifact = mapX509(x509Input({ + artifact_id: "wrapper-label:changed", + })); + const relabeledIssuer = mapX509(x509Input({ + issuer: "https://other-wrapper-label.example", + })); + cases.push(result( + "X509-DER-REPLAY-IDENTITY-STABLE", + "mapping", + x509.replay_unit === relabeledArtifact.replay_unit + && x509.replay_unit === relabeledIssuer.replay_unit + && x509.authority_instance_digest !== relabeledArtifact.authority_instance_digest + && x509.authority_instance_digest !== relabeledIssuer.authority_instance_digest, + "exact DER fixes replay identity while authenticated wrapper metadata remains instance-bound", + { + artifact_replay_stable: x509.replay_unit === relabeledArtifact.replay_unit, + issuer_replay_stable: x509.replay_unit === relabeledIssuer.replay_unit, + artifact_instance_changed: + x509.authority_instance_digest !== relabeledArtifact.authority_instance_digest, + issuer_instance_changed: + x509.authority_instance_digest !== relabeledIssuer.authority_instance_digest, + }, + )); + + const synthesizedJwtAsX509 = mapAicX509SpkiBoundCrossingAuthority({ + ...x509Input(), + artifact_digest: JWT_ARTIFACT_DIGEST, + carrier_provenance: { + ...jktInput().carrier_provenance, + downstream_representation: "SYNTHESIZED-X509", + }, + } as unknown as AicX509SpkiBoundCrossingInput, X509_RP_CONTEXT); + const synthesizedJwtAsJwt = mapAicJwtJktBoundCrossingAuthority(jktInput({ + carrier_provenance: { + ...jktInput().carrier_provenance, + downstream_representation: "SYNTHESIZED-X509", + }, + }), RP_CONTEXT); + cases.push(result( + "SYNTHESIZED-X509-CARRIER-CONFUSION-REFUSED", + "hostile", + !synthesizedJwtAsX509.ok + && synthesizedJwtAsX509.reason === "aic_carrier_provenance_unverifiable" + && synthesizedJwtAsJwt.ok, + "JWT-origin synthesized X.509 refuses the native X.509 path and remains JWT/JKT", + { + x509_path_ok: synthesizedJwtAsX509.ok, + x509_path_reason: + synthesizedJwtAsX509.ok ? null : synthesizedJwtAsX509.reason, + jwt_path_ok: synthesizedJwtAsJwt.ok, + }, + )); + + const mismatch = mapAicJwtJktBoundCrossingAuthority(jktInput({ + principal_binding: { + kind: "RFC7638_JKT", + hash_alg: "jkt", + claimed_key_hash: JKT, + presented_key_hash: "K".repeat(43), + }, + }), RP_CONTEXT); + cases.push(result( + "PRINCIPAL-BINDING-MISMATCH", + "hostile", + !mismatch.ok && mismatch.reason === "aic_principal_binding_mismatch", + "aic_principal_binding_mismatch", + { ok: mismatch.ok, reason: mismatch.ok ? null : mismatch.reason }, + )); + + const attackerAnchor = `sha256:${"a2".repeat(32)}` as const; + const untrusted = mapAicX509SpkiBoundCrossingAuthority(x509Input({ + issuer_trust_anchor_digest: attackerAnchor, + }), X509_RP_CONTEXT); + const selfPinned = mapAicX509SpkiBoundCrossingAuthority({ + ...x509Input(), + issuer_trust_anchor_digest: attackerAnchor, + trusted_issuer_trust_anchor_digests: [attackerAnchor], + } as unknown as AicX509SpkiBoundCrossingInput, X509_RP_CONTEXT); + cases.push(result( + "RP-POLICY-SELF-PIN-REFUSED", + "hostile", + !untrusted.ok && untrusted.reason === "aic_issuer_untrusted" + && !selfPinned.ok && selfPinned.reason === "mapping_input_invalid", + "native result cannot carry or replace relying-party trust pins", + { + untrusted: untrusted.ok ? null : untrusted.reason, + self_pin: selfPinned.ok ? null : selfPinned.reason, + }, + )); + + const wrongTypToken = jwtCompactToken("JWT"); + const confused = mapAicJwtJktBoundCrossingAuthority({ + ...jktInput(), + artifact_digest: `sha256:${crypto.createHash("sha256") + .update(wrongTypToken, "utf8") + .digest("hex")}`, + carrier_provenance: { + ...jktInput().carrier_provenance, + compact_token: wrongTypToken, + }, + }, RP_CONTEXT); + cases.push(result( + "NATIVE-TYPE-CONFUSION", + "hostile", + !confused.ok && confused.reason === "aic_carrier_provenance_unverifiable", + "aic_carrier_provenance_unverifiable", + { ok: confused.ok, reason: confused.ok ? null : confused.reason }, + )); + + const failed = mapAicJwtJktBoundCrossingAuthority(jktInput({ + native_verification: "FAILED", + }), RP_CONTEXT); + const indeterminate = mapAicX509SpkiBoundCrossingAuthority(x509Input({ + native_verification: "INDETERMINATE", + }), X509_RP_CONTEXT); + cases.push(result( + "NATIVE-VERIFICATION-REFUSAL", + "hostile", + !failed.ok && failed.reason === "aic_native_verification_failed" + && !indeterminate.ok + && indeterminate.reason === "aic_native_verification_indeterminate", + "FAILED and INDETERMINATE both refuse", + { + failed: failed.ok ? null : failed.reason, + indeterminate: indeterminate.ok ? null : indeterminate.reason, + }, + )); + + const actionMismatch = mapAicJwtJktBoundCrossingAuthority( + jktInput(), + { + ...RP_CONTEXT, + action: { + ...ACTION, + action_digest: `sha256:${"01".repeat(32)}`, + }, + }, + ); + cases.push(result( + "EXACT-ACTION-SUBSTITUTION-REFUSED", + "hostile", + !actionMismatch.ok + && actionMismatch.reason === "aic_action_projection_mismatch", + "aic_action_projection_mismatch", + { + ok: actionMismatch.ok, + reason: actionMismatch.ok ? null : actionMismatch.reason, + }, + )); + + const changedCapability = mapAicJwtJktBoundCrossingAuthority(jktInput({ + request_binding: { + ...REQUEST_BINDING, + requested_capability_digest: `sha256:${"02".repeat(32)}`, + }, + }), RP_CONTEXT); + cases.push(result( + "REQUEST-CAPABILITY-SUBSTITUTION-REFUSED", + "hostile", + !changedCapability.ok + && changedCapability.reason === "aic_requested_capability_mismatch", + "aic_requested_capability_mismatch", + { + ok: changedCapability.ok, + reason: changedCapability.ok ? null : changedCapability.reason, + }, + )); + + const wrongDomain = mapAicJwtJktBoundCrossingAuthority( + jktInput(), + { + ...RP_CONTEXT, + admission_domain: { + ...BOUNDARY, + relying_party_id: "rp:other-company", + }, + }, + ); + cases.push(result( + "RELYING-PARTY-DOMAIN-SUBSTITUTION-REFUSED", + "hostile", + !wrongDomain.ok + && wrongDomain.reason === "aic_admission_domain_mismatch", + "aic_admission_domain_mismatch", + { + ok: wrongDomain.ok, + reason: wrongDomain.ok ? null : wrongDomain.reason, + }, + )); + + const wrongAudienceToken = jwtCompactToken("aic+jwt", "erp:other-system"); + const wrongAudience = mapAicJwtJktBoundCrossingAuthority(jktInput({ + artifact_digest: `sha256:${crypto.createHash("sha256") + .update(wrongAudienceToken, "utf8") + .digest("hex")}`, + carrier_provenance: { + ...jktInput().carrier_provenance, + compact_token: wrongAudienceToken, + }, + }), RP_CONTEXT); + cases.push(result( + "JWT-AUDIENCE-SUBSTITUTION-REFUSED", + "hostile", + !wrongAudience.ok && wrongAudience.reason === "aic_audience_mismatch", + "aic_audience_mismatch", + { + ok: wrongAudience.ok, + reason: wrongAudience.ok ? null : wrongAudience.reason, + }, + )); + + const relabeledJwtValidity = mapAicJwtJktBoundCrossingAuthority(jktInput({ + validity: { + not_before: "2026-09-01T06:54:00Z", + not_after: "2026-09-01T07:06:00Z", + }, + }), RP_CONTEXT); + cases.push(result( + "JWT-TEMPORAL-RELABELING-REFUSED", + "hostile", + !relabeledJwtValidity.ok + && relabeledJwtValidity.reason === "aic_jwt_validity_mismatch", + "signed compact-token iat/nbf/exp must exactly bind wrapper validity", + { + ok: relabeledJwtValidity.ok, + reason: relabeledJwtValidity.ok ? null : relabeledJwtValidity.reason, + }, + )); + + const stale = mapAicJwtJktBoundCrossingAuthority(jktInput({ + status: { + value: "CURRENT", + checked_at: "2026-09-01T06:58:00Z", + source_head_digest: `sha256:${"b4".repeat(32)}`, + }, + }), RP_CONTEXT); + const future = mapAicJwtJktBoundCrossingAuthority(jktInput({ + status: { + value: "CURRENT", + checked_at: "2026-09-01T07:00:01Z", + source_head_digest: `sha256:${"b4".repeat(32)}`, + }, + }), RP_CONTEXT); + cases.push(result( + "STATUS-OBSERVATION-TIME-REFUSALS", + "hostile", + !stale.ok && stale.reason === "aic_status_observation_stale" + && !future.ok && future.reason === "aic_status_observation_future", + "stale and future observations both refuse", + { + stale: stale.ok ? null : stale.reason, + future: future.ok ? null : future.reason, + }, + )); + + const widenedFreshness = { + evaluated_at: NOW, + max_status_age_seconds: 86_400, + }; + const widenedBoundJwt = mapAicJwtJktBoundCrossingAuthority(jktInput(), { + ...RP_CONTEXT, + ...widenedFreshness, + }); + const widenedBoundX509 = mapAicX509SpkiBoundCrossingAuthority(x509Input(), { + ...X509_RP_CONTEXT, + ...widenedFreshness, + }); + const widenedProjection = projectAicJwtToStrictJwtSvid({ + source: projectionJwtInput(), + purpose: "WORKLOAD_IDENTITY_ONLY", + audience: ["spiffe://services.example/payment-gate"], + issued_at: 1788246000, + not_before: 1788245940, + expires_at: 1788246240, + token_id: "jwt-svid-projection-freshness-widening", + projected_algorithm: "ES256", + projected_key_id: "jwt-svid-key-2026-08", + }, { + source_verification_policy: JWT_PROJECTION_SOURCE_POLICY, + ...widenedFreshness, + }); + const freshnessMismatch = (value: { ok: boolean; reason?: string }) => + !value.ok && value.reason === "aic_status_freshness_profile_mismatch"; + cases.push(result( + "STATUS-FRESHNESS-PROFILE-WIDENING-REFUSED", + "hostile", + freshnessMismatch(widenedBoundJwt) + && freshnessMismatch(widenedBoundX509) + && freshnessMismatch(widenedProjection), + "the fixed 60-second v0.2 freshness profile cannot be widened by a caller", + { + bound_jwt: widenedBoundJwt.ok ? null : widenedBoundJwt.reason, + bound_x509: widenedBoundX509.ok ? null : widenedBoundX509.reason, + jwt_svid_projection: widenedProjection.ok ? null : widenedProjection.reason, + }, + )); + + const revoked = mapAicX509SpkiBoundCrossingAuthority(x509Input({ + status: { + value: "REVOKED", + checked_at: NOW, + source_head_digest: `sha256:${"c4".repeat(32)}`, + }, + }), X509_RP_CONTEXT); + const unavailable = mapAicX509SpkiBoundCrossingAuthority(x509Input({ + status: { + value: "UNAVAILABLE", + checked_at: NOW, + source_head_digest: `sha256:${"c4".repeat(32)}`, + }, + }), X509_RP_CONTEXT); + cases.push(result( + "NON-CURRENT-SOURCE-STATUS-REFUSED", + "hostile", + !revoked.ok && revoked.reason === "aic_status_not_current" + && !unavailable.ok && unavailable.reason === "aic_status_not_current", + "revoked and unavailable source status both refuse", + { + revoked: revoked.ok ? null : revoked.reason, + unavailable: unavailable.ok ? null : unavailable.reason, + }, + )); + + const outOfWindow = mapAicJwtJktBoundCrossingAuthority( + jktInput({ + status: { + ...jktInput().status, + checked_at: "2026-09-01T07:06:00Z", + }, + }), + { + ...RP_CONTEXT, + evaluated_at: "2026-09-01T07:06:00Z", + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + }, + ); + cases.push(result( + "NATIVE-VALIDITY-WINDOW-REFUSED", + "hostile", + !outOfWindow.ok + && outOfWindow.reason === "aic_validity_window_mismatch", + "aic_validity_window_mismatch", + { + ok: outOfWindow.ok, + reason: outOfWindow.ok ? null : outOfWindow.reason, + }, + )); + + const issuerTimeDomainMismatch = await issueAicBoundCrossingRecord( + jktInput(), + RP_CONTEXT, + { + ...crossingDraft("crossing:aic:jkt:issuer-domain-mismatch"), + boundary: { + ...BOUNDARY, + relying_party_id: "rp:other-company", + }, + }, + { signing_keys: [] }, + ); + cases.push(result( + "AIC-ISSUER-DOMAIN-MISMATCH-REFUSED-BEFORE-SIGNING", + "hostile", + !issuerTimeDomainMismatch.ok + && issuerTimeDomainMismatch.reason + === "aic_crossing_issue_admission_domain_mismatch", + "aic_crossing_issue_admission_domain_mismatch", + { + ok: issuerTimeDomainMismatch.ok, + reason: issuerTimeDomainMismatch.ok + ? null + : issuerTimeDomainMismatch.reason, + }, + )); + + const rpSubstitutedRecord = structuredClone(jktRecord); + rpSubstitutedRecord.body.boundary.relying_party_id = "rp:other-company"; + const rpSubstitutedCheck = await verify(rpSubstitutedRecord); + cases.push(result( + "SIGNED-BODY-RP-SUBSTITUTION-REFUSED", + "boundary", + !rpSubstitutedCheck.verified + && rpSubstitutedCheck.reason === "signature_invalid", + "signature_invalid", + { + verified: rpSubstitutedCheck.verified, + reason: rpSubstitutedCheck.reason, + }, + )); + + const base = { + "@version": "AIC-AEB-CROSSING-REFERENCE-REPORT-v0.2", + profile: PROFILE, + crossing_record_version: AEB_CROSSING_RECORD_VERSION, + required_algorithms: [...AEB_CROSSING_RECORD_REQUIRED_ALGORITHMS], + mappings: [ + AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + ], + action_projection: MAPPING_PROFILE.action_projection, + admission_domain: MAPPING_PROFILE.admission_domain, + source_status: MAPPING_PROFILE.source_status, + source_lock: SOURCE_LOCK, + source_lock_digest: SOURCE_LOCK_DIGEST, + mapping_profile_digest: sha256(canonicalizeAeb(MAPPING_PROFILE)), + native_verification_fixture: { + execution: "STIPULATED_NOT_EXECUTED", + jwt_signature: "PLACEHOLDER", + x509_aic_and_principal_authorization_extensions: "ABSENT", + upstream_native_acceptance_claimed: false, + }, + cases, + passed: cases.every((entry) => entry.passed), + known_limits: [ + "This run exercises the EMILIA reference adapter and crossing-record implementation; it is not an independent implementation of AIC-JWT or AIC-X509.", + "The adapter consumes a native verifier result; it does not reimplement AIC signature, certificate-path, delegation, capability, constraint, status, or proof-of-possession validation.", + "This deterministic suite stipulates native VERIFIED results to test the adapter boundary. Its JWT signature is a placeholder and its parseable X.509 certificates are not AIC credential-bundle fixtures, so it does not claim the pinned upstream verifiers accepted them.", + "The relying party pins the exact requested-capability digest and action-projection profile. Production integration must also provide an authenticated native result proving that the same capability request was evaluated; the pinned gateway bearer helper does not set RequestCapability.", + "The adapter checks a supplied capability-to-action projection for exact equality; it does not produce that projection. Unknown schemes, ambiguous mappings, and unmapped material parameters must refuse upstream.", + "The bound authority commits one exact action and one relying-party admission domain. The AIC-specific issue helper compares both against the record draft before signing; changing the action, relying party, audience, executor, or state domain requires a new evaluation.", + "EP-AEB-CROSSING-RECORD-v1 commits the bound authority's opaque instance, replay, and constraints digests but does not directly commit relying_party_id in its contract digest. The generic issuer cannot recompute the AIC context, so it is not the AIC issuance API. A versioned crossing-record v2 is required for generic recomputable admission-domain binding.", + "status.checked_at is the explicit source-status observation time. The v0.2 runtime accepts exactly a 60-second maximum age; a caller cannot widen it. CURRENT status is accepted only within that fixed freshness limit and native validity window; revoked, unavailable, stale, future, or otherwise non-current observations refuse.", + "The native verifier result and relying-party policy are structurally separate. Trusted anchors and expected verifier, mapping-profile, and action-projection pins come only from relying-party policy, never from the presented native result.", + "The relying party supplies and authenticates mapping-profile provenance and its digest. This reusable adapter enforces the profile identifier and fixed freshness rule but does not load or recompute the checked-in mapping-profile JSON.", + "RFC 7638 JWK thumbprints and X.509 SHA-256 SPKI hashes remain separate native mappings and are never treated as interchangeable proof. The JWT path derives the presented JWK thumbprint but does not prove possession of that key.", + "The JWT/JKT mapping requires the original compact token, derives its audience, issuer/JTI replay identity, and signed iat/nbf/exp envelope, requires exact agreement with wrapper validity, and requires explicit public JWK material. A bare X.509 object synthesized from a verified AIC-JWT has no native bundle DER and cannot enter the native X.509/SPKI mapping.", + "The X.509 path derives replay identity, bundle digest, serial, and principal SHA-256 SPKI from DER. Issuer, subject, status, validity, constraints, trust-anchor selection, and verification evidence remain authenticated native-wrapper outputs, not facts derived by this adapter from the leaf DER.", + "Raw-carrier fingerprints are derived from the bytes supplied to this adapter. They do not prove that the native verifier saw those same bytes unless an authenticated wrapper binds the verifier result to them.", + "JWT-SVID workload projection uses a private source verifier that emits no crossing authority. The projection digest commits the accepted source evaluation, including verifier, source-policy, evidence, trust-anchor, status, validity, and freshness inputs.", + "The local raw-source boundary does not authenticate a verifier result crossing an untrusted Go or JSON boundary. Integration still requires a tagged or authenticated verifier-result wrapper; the pinned gateway bearer helper sets neither ExpectedAudience, RequestCapability, PrincipalMaterial, nor PresenterKey, and no non-test VerifyBearer wiring was observed.", + "A verified crossing record is evidence of one past relying-party boundary decision and never authorizes another action.", + "Passing these checks does not establish IETF adoption, certification, production deployment, independent interoperability, or employer endorsement.", + ], + }; + return { ...base, results_digest: sha256(canonicalizeAeb(base)) }; +} + +export async function runProfile( + runner = { + name: "EMILIA reference runner", + affiliation: "EMILIA Protocol", + revision: "aic-aeb-crossing-v0.2", + executed_at: NOW, + }, +) { + const reference = await buildReferenceReport(); + const passed = reference.cases.filter((entry) => entry.passed).length; + return { + ...reference, + runner, + reproduction_statement: `${runner.name} (${runner.affiliation}) reproduced ${passed}/${reference.cases.length} AIC crossing checks at ${runner.revision}. This is a reproduction of the EMILIA reference composition, not independent AIC interoperability, IETF adoption, certification, or employer endorsement.`, + }; +} + +function argument(name: string): string | undefined { + const index = process.argv.indexOf(name); + return index === -1 ? undefined : process.argv[index + 1]; +} + +if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + const deterministicReference = sorted(await buildReferenceReport()); + if (process.argv.includes("--check")) { + assert.deepEqual( + deterministicReference, + JSON.parse(readFileSync(REFERENCE_PATH, "utf8")), + "AIC crossing output changed; inspect the semantic delta before deliberately re-pinning report.reference.json", + ); + } + const report = await runProfile({ + name: argument("--runner-name") ?? "EMILIA reference runner", + affiliation: argument("--runner-affiliation") ?? "EMILIA Protocol", + revision: argument("--runner-revision") ?? "aic-aeb-crossing-v0.2", + executed_at: argument("--executed-at") ?? NOW, + }); + const output = argument("--output"); + if (process.argv.includes("--write-reference")) { + writeFileSync( + REFERENCE_PATH, + `${JSON.stringify(deterministicReference, null, 2)}\n`, + "utf8", + ); + } + if (output) { + writeFileSync(resolve(output), `${JSON.stringify(sorted(report), null, 2)}\n`, "utf8"); + } else { + process.stdout.write(`${JSON.stringify(sorted(report), null, 2)}\n`); + } + if (!report.passed) process.exitCode = 1; +} diff --git a/conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mjs b/conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mjs new file mode 100644 index 000000000..052f36cff --- /dev/null +++ b/conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mjs @@ -0,0 +1,137 @@ +// SPDX-License-Identifier: Apache-2.0 +// Generated from run.node-test.mts by scripts/build-standalone-runtimes.mjs. Do not edit. +/* eslint-disable */ +import assert from "node:assert/strict"; +import { readFileSync } from "node:fs"; +import { dirname, resolve } from "node:path"; +import test from "node:test"; +import { fileURLToPath } from "node:url"; +import { buildReferenceReport, PROFILE, runProfile } from "./run.mjs"; +import { assertAicInspectionBoundary, assertAicRawRepositoryFileUrl, } from "./verify-source-lock.mjs"; +const HERE = dirname(fileURLToPath(import.meta.url)); +const SOURCE_LOCK = JSON.parse(readFileSync(resolve(HERE, "source-lock.json"), "utf8")); +test("current AIC inspected-file URLs bind the declared repositories, revisions, and paths", () => { + let inspectedFileCount = 0; + for (const repository of SOURCE_LOCK.varwof.repositories) { + for (const inspectedFile of repository.inspected_files) { + assertAicRawRepositoryFileUrl(repository.repository, repository.revision, inspectedFile.path, inspectedFile.url); + inspectedFileCount += 1; + } + } + assert.equal(inspectedFileCount, 9); +}); +test("AIC source-lock validation rejects a raw URL with a different revision", () => { + const repository = SOURCE_LOCK.varwof.repositories[0]; + const inspectedFile = repository.inspected_files[0]; + const differentRevision = repository.revision === "0".repeat(40) + ? "1".repeat(40) + : "0".repeat(40); + const mismatchedUrl = inspectedFile.url.replace(`/${repository.revision}/`, `/${differentRevision}/`); + assert.throws(() => assertAicRawRepositoryFileUrl(repository.repository, repository.revision, inspectedFile.path, mismatchedUrl), /does not match declared repository, revision, and path/); +}); +test("AIC source-lock validation rejects a raw URL with a different path", () => { + const repository = SOURCE_LOCK.varwof.repositories[0]; + const inspectedFile = repository.inspected_files[0]; + assert.throws(() => assertAicRawRepositoryFileUrl(repository.repository, repository.revision, inspectedFile.path, `${inspectedFile.url}.different`), /does not match declared repository, revision, and path/); +}); +test("AIC source lock keeps carrier provenance and upstream wiring limits fail closed", () => { + assert.doesNotThrow(() => assertAicInspectionBoundary(SOURCE_LOCK)); + const relabeled = structuredClone(SOURCE_LOCK); + relabeled.inspection.gateway_bearer_bridge + .synthesized_certificate_admissible_to_native_x509_mapping = true; + assert.throws(() => assertAicInspectionBoundary(relabeled), /inspection fact changed/); + const wired = structuredClone(SOURCE_LOCK); + wired.inspection.upstream_wiring.deployed_wiring_verified = true; + assert.throws(() => assertAicInspectionBoundary(wired), /upstream wiring boundary changed/); + const widenedSpki = structuredClone(SOURCE_LOCK); + widenedSpki.inspection.native_x509_bundle.principal_spki_hash_algorithm = "sha-512"; + assert.throws(() => assertAicInspectionBoundary(widenedSpki), /SPKI algorithm changed/); +}); +test("all AIC crossing cases pass and match the committed deterministic report", async () => { + const report = await runProfile(); + const reference = JSON.parse(readFileSync(resolve(HERE, "report.reference.json"), "utf8")); + assert.equal(report.profile, PROFILE); + assert.equal(report.passed, true, JSON.stringify(report, null, 2)); + assert.equal(report.cases.length, 20); + assert.equal(report.results_digest, reference.results_digest); + assert.deepEqual(await buildReferenceReport(), reference); +}); +test("pure JSON jkt and X.509 SPKI stay separate while both produce non-authorizing receipts", async () => { + const report = await runProfile(); + const byId = Object.fromEntries(report.cases.map((entry) => [entry.id, entry])); + assert.equal(byId["AIC-JWT-JKT-CROSSING"].passed, true); + assert.equal(byId["AIC-X509-SPKI-CROSSING"].passed, true); + assert.equal(byId["NATIVE-BINDINGS-REMAIN-DISTINCT"].passed, true); + assert.equal(byId["X509-DER-REPLAY-IDENTITY-STABLE"].passed, true); + assert.equal(byId["SYNTHESIZED-X509-CARRIER-CONFUSION-REFUSED"].passed, true); + assert.equal(byId["SYNTHESIZED-X509-CARRIER-CONFUSION-REFUSED"].observed.x509_path_reason, "aic_carrier_provenance_unverifiable"); + assert.match(report.known_limits.join(" "), /never treated as interchangeable/); + assert.match(report.known_limits.join(" "), /requires the original compact token/); + assert.match(report.known_limits.join(" "), /tagged or authenticated verifier-result wrapper/); + assert.match(report.known_limits.join(" "), /never authorizes another action/); +}); +test("hostile native inputs fail before a crossing authority is emitted", async () => { + const report = await runProfile(); + const byId = Object.fromEntries(report.cases.map((entry) => [entry.id, entry])); + for (const id of [ + "PRINCIPAL-BINDING-MISMATCH", + "RP-POLICY-SELF-PIN-REFUSED", + "NATIVE-TYPE-CONFUSION", + "SYNTHESIZED-X509-CARRIER-CONFUSION-REFUSED", + "NATIVE-VERIFICATION-REFUSAL", + "REQUEST-CAPABILITY-SUBSTITUTION-REFUSED", + "JWT-AUDIENCE-SUBSTITUTION-REFUSED", + "JWT-TEMPORAL-RELABELING-REFUSED", + ]) + assert.equal(byId[id].passed, true, id); + assert.deepEqual(byId["RP-POLICY-SELF-PIN-REFUSED"].observed, { + self_pin: "mapping_input_invalid", + untrusted: "aic_issuer_untrusted", + }); + assert.match(report.known_limits.join(" "), /native verifier result and relying-party policy are structurally separate/); +}); +test("exact action, admission domain, and source-status substitutions all refuse", async () => { + const report = await runProfile(); + const byId = Object.fromEntries(report.cases.map((entry) => [entry.id, entry])); + for (const id of [ + "EXACT-ACTION-SUBSTITUTION-REFUSED", + "RELYING-PARTY-DOMAIN-SUBSTITUTION-REFUSED", + "STATUS-OBSERVATION-TIME-REFUSALS", + "STATUS-FRESHNESS-PROFILE-WIDENING-REFUSED", + "NON-CURRENT-SOURCE-STATUS-REFUSED", + "NATIVE-VALIDITY-WINDOW-REFUSED", + "AIC-ISSUER-DOMAIN-MISMATCH-REFUSED-BEFORE-SIGNING", + "SIGNED-BODY-RP-SUBSTITUTION-REFUSED", + ]) + assert.equal(byId[id].passed, true, id); + assert.deepEqual(byId["AIC-ISSUER-DOMAIN-MISMATCH-REFUSED-BEFORE-SIGNING"].observed, { + ok: false, + reason: "aic_crossing_issue_admission_domain_mismatch", + }); + assert.deepEqual(byId["SIGNED-BODY-RP-SUBSTITUTION-REFUSED"].observed, { + reason: "signature_invalid", + verified: false, + }); + assert.match(report.known_limits.join(" "), /commits one exact action/); + assert.match(report.known_limits.join(" "), /explicit source-status observation time/); + assert.match(report.known_limits.join(" "), /exactly a 60-second maximum age/); +}); +test("the report carries exact source revisions and calls an external run a reproduction", async () => { + const report = await runProfile({ + name: "External operator", + affiliation: "Example project", + revision: "example-commit", + executed_at: "2026-08-26T20:00:00Z", + }); + assert.equal(report.source_lock.varwof.repositories.length, 4); + assert.equal(report.source_lock.drafts.length, 2); + assert.equal(report.source_lock.inspection.gateway_bearer_bridge + .non_test_verify_bearer_call_sites_observed, false); + assert.equal(report.source_lock.inspection.upstream_wiring + .cross_process_authenticated_provenance_wrapper_required, true); + assert.equal(report.native_verification_fixture.execution, "STIPULATED_NOT_EXECUTED"); + assert.equal(report.native_verification_fixture.upstream_native_acceptance_claimed, false); + assert.match(report.known_limits.join(" "), /does not claim the pinned upstream verifiers accepted/); + assert.match(report.reproduction_statement, /20\/20/); + assert.match(report.reproduction_statement, /not independent AIC interoperability/); +}); diff --git a/conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mts b/conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mts new file mode 100644 index 000000000..c7d83c7e7 --- /dev/null +++ b/conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mts @@ -0,0 +1,202 @@ +// SPDX-License-Identifier: Apache-2.0 +import assert from "node:assert/strict"; +import { readFileSync } from "node:fs"; +import { dirname, resolve } from "node:path"; +import test from "node:test"; +import { fileURLToPath } from "node:url"; + +import { buildReferenceReport, PROFILE, runProfile } from "./run.mjs"; +import { + assertAicInspectionBoundary, + assertAicRawRepositoryFileUrl, +} from "./verify-source-lock.mjs"; + +const HERE = dirname(fileURLToPath(import.meta.url)); +const SOURCE_LOCK = JSON.parse( + readFileSync(resolve(HERE, "source-lock.json"), "utf8"), +); + +test("current AIC inspected-file URLs bind the declared repositories, revisions, and paths", () => { + let inspectedFileCount = 0; + for (const repository of SOURCE_LOCK.varwof.repositories) { + for (const inspectedFile of repository.inspected_files) { + assertAicRawRepositoryFileUrl( + repository.repository, + repository.revision, + inspectedFile.path, + inspectedFile.url, + ); + inspectedFileCount += 1; + } + } + assert.equal(inspectedFileCount, 9); +}); + +test("AIC source-lock validation rejects a raw URL with a different revision", () => { + const repository = SOURCE_LOCK.varwof.repositories[0]; + const inspectedFile = repository.inspected_files[0]; + const differentRevision = repository.revision === "0".repeat(40) + ? "1".repeat(40) + : "0".repeat(40); + const mismatchedUrl = inspectedFile.url.replace( + `/${repository.revision}/`, + `/${differentRevision}/`, + ); + assert.throws( + () => assertAicRawRepositoryFileUrl( + repository.repository, + repository.revision, + inspectedFile.path, + mismatchedUrl, + ), + /does not match declared repository, revision, and path/, + ); +}); + +test("AIC source-lock validation rejects a raw URL with a different path", () => { + const repository = SOURCE_LOCK.varwof.repositories[0]; + const inspectedFile = repository.inspected_files[0]; + assert.throws( + () => assertAicRawRepositoryFileUrl( + repository.repository, + repository.revision, + inspectedFile.path, + `${inspectedFile.url}.different`, + ), + /does not match declared repository, revision, and path/, + ); +}); + +test("AIC source lock keeps carrier provenance and upstream wiring limits fail closed", () => { + assert.doesNotThrow(() => assertAicInspectionBoundary(SOURCE_LOCK)); + const relabeled = structuredClone(SOURCE_LOCK); + relabeled.inspection.gateway_bearer_bridge + .synthesized_certificate_admissible_to_native_x509_mapping = true; + assert.throws( + () => assertAicInspectionBoundary(relabeled), + /inspection fact changed/, + ); + const wired = structuredClone(SOURCE_LOCK); + wired.inspection.upstream_wiring.deployed_wiring_verified = true; + assert.throws( + () => assertAicInspectionBoundary(wired), + /upstream wiring boundary changed/, + ); + const widenedSpki = structuredClone(SOURCE_LOCK); + widenedSpki.inspection.native_x509_bundle.principal_spki_hash_algorithm = "sha-512"; + assert.throws( + () => assertAicInspectionBoundary(widenedSpki), + /SPKI algorithm changed/, + ); +}); + +test("all AIC crossing cases pass and match the committed deterministic report", async () => { + const report = await runProfile(); + const reference = JSON.parse( + readFileSync(resolve(HERE, "report.reference.json"), "utf8"), + ); + assert.equal(report.profile, PROFILE); + assert.equal(report.passed, true, JSON.stringify(report, null, 2)); + assert.equal(report.cases.length, 20); + assert.equal(report.results_digest, reference.results_digest); + assert.deepEqual(await buildReferenceReport(), reference); +}); + +test("pure JSON jkt and X.509 SPKI stay separate while both produce non-authorizing receipts", async () => { + const report = await runProfile(); + const byId = Object.fromEntries(report.cases.map((entry) => [entry.id, entry])); + assert.equal(byId["AIC-JWT-JKT-CROSSING"].passed, true); + assert.equal(byId["AIC-X509-SPKI-CROSSING"].passed, true); + assert.equal(byId["NATIVE-BINDINGS-REMAIN-DISTINCT"].passed, true); + assert.equal(byId["X509-DER-REPLAY-IDENTITY-STABLE"].passed, true); + assert.equal(byId["SYNTHESIZED-X509-CARRIER-CONFUSION-REFUSED"].passed, true); + assert.equal( + byId["SYNTHESIZED-X509-CARRIER-CONFUSION-REFUSED"].observed.x509_path_reason, + "aic_carrier_provenance_unverifiable", + ); + assert.match(report.known_limits.join(" "), /never treated as interchangeable/); + assert.match(report.known_limits.join(" "), /requires the original compact token/); + assert.match(report.known_limits.join(" "), /tagged or authenticated verifier-result wrapper/); + assert.match(report.known_limits.join(" "), /never authorizes another action/); +}); + +test("hostile native inputs fail before a crossing authority is emitted", async () => { + const report = await runProfile(); + const byId = Object.fromEntries(report.cases.map((entry) => [entry.id, entry])); + for (const id of [ + "PRINCIPAL-BINDING-MISMATCH", + "RP-POLICY-SELF-PIN-REFUSED", + "NATIVE-TYPE-CONFUSION", + "SYNTHESIZED-X509-CARRIER-CONFUSION-REFUSED", + "NATIVE-VERIFICATION-REFUSAL", + "REQUEST-CAPABILITY-SUBSTITUTION-REFUSED", + "JWT-AUDIENCE-SUBSTITUTION-REFUSED", + "JWT-TEMPORAL-RELABELING-REFUSED", + ]) assert.equal(byId[id].passed, true, id); + assert.deepEqual(byId["RP-POLICY-SELF-PIN-REFUSED"].observed, { + self_pin: "mapping_input_invalid", + untrusted: "aic_issuer_untrusted", + }); + assert.match( + report.known_limits.join(" "), + /native verifier result and relying-party policy are structurally separate/, + ); +}); + +test("exact action, admission domain, and source-status substitutions all refuse", async () => { + const report = await runProfile(); + const byId = Object.fromEntries(report.cases.map((entry) => [entry.id, entry])); + for (const id of [ + "EXACT-ACTION-SUBSTITUTION-REFUSED", + "RELYING-PARTY-DOMAIN-SUBSTITUTION-REFUSED", + "STATUS-OBSERVATION-TIME-REFUSALS", + "STATUS-FRESHNESS-PROFILE-WIDENING-REFUSED", + "NON-CURRENT-SOURCE-STATUS-REFUSED", + "NATIVE-VALIDITY-WINDOW-REFUSED", + "AIC-ISSUER-DOMAIN-MISMATCH-REFUSED-BEFORE-SIGNING", + "SIGNED-BODY-RP-SUBSTITUTION-REFUSED", + ]) assert.equal(byId[id].passed, true, id); + assert.deepEqual( + byId["AIC-ISSUER-DOMAIN-MISMATCH-REFUSED-BEFORE-SIGNING"].observed, + { + ok: false, + reason: "aic_crossing_issue_admission_domain_mismatch", + }, + ); + assert.deepEqual( + byId["SIGNED-BODY-RP-SUBSTITUTION-REFUSED"].observed, + { + reason: "signature_invalid", + verified: false, + }, + ); + assert.match(report.known_limits.join(" "), /commits one exact action/); + assert.match(report.known_limits.join(" "), /explicit source-status observation time/); + assert.match(report.known_limits.join(" "), /exactly a 60-second maximum age/); +}); + +test("the report carries exact source revisions and calls an external run a reproduction", async () => { + const report = await runProfile({ + name: "External operator", + affiliation: "Example project", + revision: "example-commit", + executed_at: "2026-08-26T20:00:00Z", + }); + assert.equal(report.source_lock.varwof.repositories.length, 4); + assert.equal(report.source_lock.drafts.length, 2); + assert.equal( + report.source_lock.inspection.gateway_bearer_bridge + .non_test_verify_bearer_call_sites_observed, + false, + ); + assert.equal( + report.source_lock.inspection.upstream_wiring + .cross_process_authenticated_provenance_wrapper_required, + true, + ); + assert.equal(report.native_verification_fixture.execution, "STIPULATED_NOT_EXECUTED"); + assert.equal(report.native_verification_fixture.upstream_native_acceptance_claimed, false); + assert.match(report.known_limits.join(" "), /does not claim the pinned upstream verifiers accepted/); + assert.match(report.reproduction_statement, /20\/20/); + assert.match(report.reproduction_statement, /not independent AIC interoperability/); +}); diff --git a/conformance/composition/aic-aeb-crossing-v0.2/source-lock.json b/conformance/composition/aic-aeb-crossing-v0.2/source-lock.json new file mode 100644 index 000000000..3094496c9 --- /dev/null +++ b/conformance/composition/aic-aeb-crossing-v0.2/source-lock.json @@ -0,0 +1,148 @@ +{ + "@version": "AIC-AEB-CROSSING-SOURCE-LOCK-v0.2", + "drafts": [ + { + "name": "draft-wei-aic-jwt-00", + "url": "https://www.ietf.org/archive/id/draft-wei-aic-jwt-00.txt", + "sha256": "c103cb5d4c541c7aa30ee49e0c36d56ad3ac76f50ce73a39fd0be1109781bd3c", + "bounded_sections": [ + "5 AIC-JWT Token Format", + "9 Principal Key Binding", + "11 Validation Algorithm", + "16 Compatibility with the Varwof Unified JWT Profile" + ] + }, + { + "name": "draft-wei-aic-identity-cert-00", + "url": "https://www.ietf.org/archive/id/draft-wei-aic-identity-cert-00.txt", + "sha256": "169d2f4ae37b3448e955d8a0e0fde04ef43855b93e7aa1e8e3021fb4eba73b2e", + "bounded_sections": [ + "5 AI Agent Identity Certificate Extension", + "8 Agent Authentication and Authorization", + "9 Security Considerations" + ] + } + ], + "inspection": { + "scope": { + "repository": "https://github.com/varwof/gateway-core", + "revision": "718d42ecdaf90a11ad882b5651fffdd2aeaeb417" + }, + "gateway_bearer_bridge": { + "path": "jwt.go", + "verified_behavior": "VerifyBearer validates the compact AIC-JWT, then returns a bare synthesized *x509.Certificate plus parsed outer claims", + "verify_bearer_returns_synthesized_certificate": true, + "verify_bearer_returns_outer_claims": true, + "verify_bearer_sets_expected_audience": false, + "verify_bearer_sets_request_capability": false, + "verify_bearer_sets_principal_material": false, + "verify_bearer_sets_presenter_key": false, + "synthesized_certificate_sets_raw_der": false, + "synthesized_certificate_sets_raw_spki": false, + "synthesized_certificate_sets_public_key": false, + "authenticated_original_carrier_provenance_returned": false, + "non_test_verify_bearer_call_sites_observed": false, + "gateway_module_manifest_path": "go.mod", + "gateway_types_module_version": "v0.4.0", + "gateway_types_module_revision": "76f725ffc375ae7fda1f0255ea3e12a0074f6c4c", + "jwt_mapping_requires_original_compact_token": true, + "local_mapping_derives_compact_token_audience": true, + "local_mapping_derives_presented_jwk_thumbprint": true, + "local_mapping_proves_presenter_key_possession": false, + "separate_authenticated_capability_evaluation_required": true, + "synthesized_certificate_admissible_to_native_x509_mapping": false, + "local_boundary": "The synthesized object is not admissible to the native X.509/SPKI mapping; JWT/JKT mapping requires the original compact token" + }, + "native_x509_bundle": { + "path": "credential_bundle.go", + "verified_behavior": "VerifyBundle requires nonempty agent and principal chain slots, verifies both chains, and compares the AIC principal key hash with the principal certificate SHA-256 SPKI", + "requires_nonempty_agent_and_principal_chains": true, + "enforces_distinct_agent_and_principal_leaf_der": false, + "compares_principal_key_hash_to_principal_certificate_spki": true, + "local_mapping_requires_exact_certificate_der": true, + "local_mapping_requires_distinct_agent_and_principal_der": true, + "principal_spki_hash_algorithm": "sha-256", + "local_boundary": "Native X.509 mapping requires exact agent and principal certificate DER and derives the bundle digest, agent serial, and principal SPKI hash from those bytes" + }, + "upstream_wiring": { + "cross_process_authenticated_provenance_wrapper_required": true, + "deployed_wiring_verified": false, + "limit": "A tagged or authenticated verifier-result wrapper is still required to preserve carrier provenance across a Go or JSON process boundary" + } + }, + "varwof": { + "repositories": [ + { + "repository": "https://github.com/varwof/aic-jwt", + "revision": "a3499b07bbe858a79d95ab98f9134f44238cb8cf", + "inspected_files": [ + { + "path": "ts/aicjwt.ts", + "url": "https://raw.githubusercontent.com/varwof/aic-jwt/a3499b07bbe858a79d95ab98f9134f44238cb8cf/ts/aicjwt.ts", + "sha256": "2e5c59b60ce86a309003be8f6e5df8aaeae96e81027b0c3a7cba9e561545c097" + } + ] + }, + { + "repository": "https://github.com/varwof/types", + "revision": "683520cd8ae8596a297c24187d0137efe2b263fe", + "inspected_files": [ + { + "path": "aicjwt/validate.go", + "url": "https://raw.githubusercontent.com/varwof/types/683520cd8ae8596a297c24187d0137efe2b263fe/aicjwt/validate.go", + "sha256": "9d85b2212d1ffbc4f76fc7d300d764f93845d6ced35636687619b476b742c9e3" + }, + { + "path": "aicjwt/keyhash.go", + "url": "https://raw.githubusercontent.com/varwof/types/683520cd8ae8596a297c24187d0137efe2b263fe/aicjwt/keyhash.go", + "sha256": "e2fc32c4b17dc49323b92425484a808c19353f12a2554a1ed50f034fd433134e" + }, + { + "path": "aicjwt/certjwk.go", + "url": "https://raw.githubusercontent.com/varwof/types/683520cd8ae8596a297c24187d0137efe2b263fe/aicjwt/certjwk.go", + "sha256": "20bd28626f1559c50a0683ded84f9425504d50a5775d538156965be2628cb3ed" + } + ] + }, + { + "repository": "https://github.com/varwof/gateway-core", + "revision": "718d42ecdaf90a11ad882b5651fffdd2aeaeb417", + "inspected_files": [ + { + "path": "credential_bundle.go", + "url": "https://raw.githubusercontent.com/varwof/gateway-core/718d42ecdaf90a11ad882b5651fffdd2aeaeb417/credential_bundle.go", + "sha256": "4c69c00e4e3f8f9ad8c7082f61b6bcee4ddb68ec250cef3eafce49fbc1bd4edc" + }, + { + "path": "jwt.go", + "url": "https://raw.githubusercontent.com/varwof/gateway-core/718d42ecdaf90a11ad882b5651fffdd2aeaeb417/jwt.go", + "sha256": "d2ab9d638f8383aebc06c6244eb9451c23dfc8134450995582bae6f0a8cf3d9a" + }, + { + "path": "go.mod", + "url": "https://raw.githubusercontent.com/varwof/gateway-core/718d42ecdaf90a11ad882b5651fffdd2aeaeb417/go.mod", + "sha256": "23e8b43e0ecbf537f273ded9558e9888425455d00272fe36c42436b3003eef2c" + } + ] + }, + { + "repository": "https://github.com/varwof/types", + "revision": "76f725ffc375ae7fda1f0255ea3e12a0074f6c4c", + "resolved_module_version": "v0.4.0", + "consumed_by": "https://github.com/varwof/gateway-core@718d42ecdaf90a11ad882b5651fffdd2aeaeb417", + "inspected_files": [ + { + "path": "aicjwt/validate.go", + "url": "https://raw.githubusercontent.com/varwof/types/76f725ffc375ae7fda1f0255ea3e12a0074f6c4c/aicjwt/validate.go", + "sha256": "9d85b2212d1ffbc4f76fc7d300d764f93845d6ced35636687619b476b742c9e3" + }, + { + "path": "aicjwt/keyhash.go", + "url": "https://raw.githubusercontent.com/varwof/types/76f725ffc375ae7fda1f0255ea3e12a0074f6c4c/aicjwt/keyhash.go", + "sha256": "e2fc32c4b17dc49323b92425484a808c19353f12a2554a1ed50f034fd433134e" + } + ] + } + ] + } +} diff --git a/conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mjs b/conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mjs new file mode 100644 index 000000000..83971fec0 --- /dev/null +++ b/conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mjs @@ -0,0 +1,209 @@ +// SPDX-License-Identifier: Apache-2.0 +// Generated from verify-source-lock.mts by scripts/build-standalone-runtimes.mjs. Do not edit. +/* eslint-disable */ +import crypto from 'node:crypto'; +import { readFileSync } from 'node:fs'; +import { fileURLToPath } from 'node:url'; +const SOURCE_LOCK_BYTES = readFileSync(new URL('./source-lock.json', import.meta.url)); +const SOURCE_LOCK = JSON.parse(SOURCE_LOCK_BYTES.toString('utf8')); +function sha256(bytes) { + return crypto.createHash('sha256').update(bytes).digest('hex'); +} +const GITHUB_REPOSITORY_PATTERN = /^https:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/; +const GIT_REVISION_PATTERN = /^[0-9a-f]{40}$/; +function isRecord(value) { + return value !== null && typeof value === 'object' && !Array.isArray(value); +} +function inspectedRepository(sourceLock, repositoryUrl, revision) { + const repositories = sourceLock?.varwof?.repositories; + if (!Array.isArray(repositories)) { + throw new Error('source lock Varwof repositories must be an array'); + } + const matches = repositories.filter((entry) => (entry?.repository === repositoryUrl && entry?.revision === revision)); + if (matches.length !== 1) { + throw new Error(`source lock inspection scope must match one pinned repository revision: ${repositoryUrl}@${revision}`); + } + return matches[0]; +} +function assertInspectedPath(repository, path) { + if (!Array.isArray(repository?.inspected_files) + || !repository.inspected_files.some((entry) => entry?.path === path)) { + throw new Error(`source lock inspection claim references an unpinned path: ${path}`); + } +} +export function assertAicInspectionBoundary(sourceLock = SOURCE_LOCK) { + const inspection = sourceLock?.inspection; + if (!isRecord(inspection) || !isRecord(inspection.scope)) { + throw new Error('source lock inspection boundary is missing'); + } + const { repository, revision } = inspection.scope; + if (repository !== 'https://github.com/varwof/gateway-core' + || typeof revision !== 'string' + || !GIT_REVISION_PATTERN.test(revision)) { + throw new Error('source lock inspection scope must pin the gateway-core revision'); + } + const pinnedRepository = inspectedRepository(sourceLock, repository, revision); + const bearer = inspection.gateway_bearer_bridge; + if (!isRecord(bearer) || bearer.path !== 'jwt.go') { + throw new Error('source lock bearer-bridge inspection is missing'); + } + assertInspectedPath(pinnedRepository, bearer.path); + if (bearer.gateway_module_manifest_path !== 'go.mod' + || bearer.gateway_types_module_version !== 'v0.4.0' + || bearer.gateway_types_module_revision + !== '76f725ffc375ae7fda1f0255ea3e12a0074f6c4c') { + throw new Error('source lock bearer-bridge module resolution changed'); + } + assertInspectedPath(pinnedRepository, bearer.gateway_module_manifest_path); + const resolvedTypes = inspectedRepository(sourceLock, 'https://github.com/varwof/types', bearer.gateway_types_module_revision); + if (resolvedTypes.resolved_module_version !== bearer.gateway_types_module_version + || resolvedTypes.consumed_by + !== `${repository}@${revision}`) { + throw new Error('source lock bearer-bridge dependency resolution changed'); + } + assertInspectedPath(resolvedTypes, 'aicjwt/validate.go'); + assertInspectedPath(resolvedTypes, 'aicjwt/keyhash.go'); + const requiredBearerFacts = { + verify_bearer_returns_synthesized_certificate: true, + verify_bearer_returns_outer_claims: true, + verify_bearer_sets_expected_audience: false, + verify_bearer_sets_request_capability: false, + verify_bearer_sets_principal_material: false, + verify_bearer_sets_presenter_key: false, + synthesized_certificate_sets_raw_der: false, + synthesized_certificate_sets_raw_spki: false, + synthesized_certificate_sets_public_key: false, + authenticated_original_carrier_provenance_returned: false, + non_test_verify_bearer_call_sites_observed: false, + jwt_mapping_requires_original_compact_token: true, + local_mapping_derives_compact_token_audience: true, + local_mapping_derives_presented_jwk_thumbprint: true, + local_mapping_proves_presenter_key_possession: false, + separate_authenticated_capability_evaluation_required: true, + synthesized_certificate_admissible_to_native_x509_mapping: false, + }; + for (const [name, expected] of Object.entries(requiredBearerFacts)) { + if (bearer[name] !== expected) { + throw new Error(`source lock bearer-bridge inspection fact changed: ${name}`); + } + } + const bundle = inspection.native_x509_bundle; + if (!isRecord(bundle) || bundle.path !== 'credential_bundle.go') { + throw new Error('source lock native-X.509 inspection is missing'); + } + assertInspectedPath(pinnedRepository, bundle.path); + const requiredBundleFacts = { + requires_nonempty_agent_and_principal_chains: true, + enforces_distinct_agent_and_principal_leaf_der: false, + compares_principal_key_hash_to_principal_certificate_spki: true, + local_mapping_requires_exact_certificate_der: true, + local_mapping_requires_distinct_agent_and_principal_der: true, + }; + for (const [name, expected] of Object.entries(requiredBundleFacts)) { + if (bundle[name] !== expected) { + throw new Error(`source lock native-X.509 inspection fact changed: ${name}`); + } + } + if (bundle.principal_spki_hash_algorithm !== 'sha-256') { + throw new Error('source lock native-X.509 SPKI algorithm changed'); + } + const wiring = inspection.upstream_wiring; + if (!isRecord(wiring) + || wiring.cross_process_authenticated_provenance_wrapper_required !== true + || wiring.deployed_wiring_verified !== false) { + throw new Error('source lock upstream wiring boundary changed'); + } +} +export function assertAicRawRepositoryFileUrl(repositoryUrl, revision, inspectedPath, rawUrl) { + const repositoryMatch = GITHUB_REPOSITORY_PATTERN.exec(repositoryUrl); + if (!repositoryMatch) { + throw new Error(`source lock repository must be an exact https://github.com/{owner}/{name} URL: ${repositoryUrl}`); + } + if (!GIT_REVISION_PATTERN.test(revision)) { + throw new Error(`source lock revision must be an exact lowercase 40-hex commit: ${revision}`); + } + const pathSegments = inspectedPath.split('/'); + if (inspectedPath.length === 0 + || inspectedPath.startsWith('/') + || inspectedPath.endsWith('/') + || inspectedPath.includes('\\') + || inspectedPath.includes('?') + || inspectedPath.includes('#') + || inspectedPath.includes('%') + || pathSegments.some((segment) => segment === '' || segment === '.' || segment === '..')) { + throw new Error(`source lock inspected path must be a safe relative POSIX path: ${inspectedPath}`); + } + const [, owner, repository] = repositoryMatch; + const expectedRawUrl = `https://raw.githubusercontent.com/${owner}/${repository}/${revision}/${inspectedPath}`; + let parsedRawUrl; + try { + parsedRawUrl = new URL(rawUrl); + } + catch { + throw new Error(`source lock raw URL is invalid: ${rawUrl}`); + } + if (rawUrl !== expectedRawUrl + || parsedRawUrl.href !== rawUrl + || parsedRawUrl.protocol !== 'https:' + || parsedRawUrl.hostname !== 'raw.githubusercontent.com' + || parsedRawUrl.username !== '' + || parsedRawUrl.password !== '' + || parsedRawUrl.port !== '' + || parsedRawUrl.search !== '' + || parsedRawUrl.hash !== '') { + throw new Error(`source lock raw URL does not match declared repository, revision, and path: expected ${expectedRawUrl}, got ${rawUrl}`); + } +} +export async function verifyAicSourceLock(fetchBytes = async (url) => { + const response = await fetch(url, { + headers: { accept: 'application/octet-stream, text/plain;q=0.9, */*;q=0.1' }, + redirect: 'error', + }); + if (!response.ok) + throw new Error(`source fetch failed: ${response.status} ${url}`); + return new Uint8Array(await response.arrayBuffer()); +}) { + assertAicInspectionBoundary(); + const sources = [ + ...SOURCE_LOCK.drafts.map((entry) => ({ + name: entry.name, + url: entry.url, + expected_sha256: entry.sha256, + })), + ...SOURCE_LOCK.varwof.repositories.flatMap((repository) => (repository.inspected_files.map((entry) => { + assertAicRawRepositoryFileUrl(repository.repository, repository.revision, entry.path, entry.url); + return { + name: `${repository.repository}@${repository.revision}:${entry.path}`, + url: entry.url, + expected_sha256: entry.sha256, + }; + }))), + ]; + const verified = []; + for (const source of sources) { + const bytes = await fetchBytes(source.url); + const actual = sha256(bytes); + if (actual !== source.expected_sha256) { + throw new Error(`source lock mismatch for ${source.name}: expected ${source.expected_sha256}, got ${actual}`); + } + verified.push({ + name: source.name, + url: source.url, + sha256: actual, + bytes: bytes.byteLength, + verified: true, + }); + } + return { + profile: 'AIC-AEB-CROSSING-SOURCE-LOCK-VERIFICATION-v1', + source_lock_file_sha256: `sha256:${sha256(SOURCE_LOCK_BYTES)}`, + sources: verified, + passed: true, + }; +} +async function main() { + process.stdout.write(`${JSON.stringify(await verifyAicSourceLock(), null, 2)}\n`); +} +if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) { + await main(); +} diff --git a/conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mts b/conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mts new file mode 100644 index 000000000..581121008 --- /dev/null +++ b/conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mts @@ -0,0 +1,265 @@ +// SPDX-License-Identifier: Apache-2.0 +import crypto from 'node:crypto'; +import { readFileSync } from 'node:fs'; +import { fileURLToPath } from 'node:url'; + +const SOURCE_LOCK_BYTES = readFileSync(new URL('./source-lock.json', import.meta.url)); +const SOURCE_LOCK = JSON.parse(SOURCE_LOCK_BYTES.toString('utf8')); + +function sha256(bytes: Uint8Array): string { + return crypto.createHash('sha256').update(bytes).digest('hex'); +} + +const GITHUB_REPOSITORY_PATTERN = + /^https:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/; +const GIT_REVISION_PATTERN = /^[0-9a-f]{40}$/; + +function isRecord(value: unknown): value is Record { + return value !== null && typeof value === 'object' && !Array.isArray(value); +} + +function inspectedRepository( + sourceLock: any, + repositoryUrl: string, + revision: string, +): any { + const repositories = sourceLock?.varwof?.repositories; + if (!Array.isArray(repositories)) { + throw new Error('source lock Varwof repositories must be an array'); + } + const matches = repositories.filter((entry: any) => ( + entry?.repository === repositoryUrl && entry?.revision === revision + )); + if (matches.length !== 1) { + throw new Error( + `source lock inspection scope must match one pinned repository revision: ${repositoryUrl}@${revision}`, + ); + } + return matches[0]; +} + +function assertInspectedPath(repository: any, path: string): void { + if (!Array.isArray(repository?.inspected_files) + || !repository.inspected_files.some((entry: any) => entry?.path === path)) { + throw new Error(`source lock inspection claim references an unpinned path: ${path}`); + } +} + +export function assertAicInspectionBoundary(sourceLock: any = SOURCE_LOCK): void { + const inspection = sourceLock?.inspection; + if (!isRecord(inspection) || !isRecord(inspection.scope)) { + throw new Error('source lock inspection boundary is missing'); + } + const { repository, revision } = inspection.scope; + if (repository !== 'https://github.com/varwof/gateway-core' + || typeof revision !== 'string' + || !GIT_REVISION_PATTERN.test(revision)) { + throw new Error('source lock inspection scope must pin the gateway-core revision'); + } + const pinnedRepository = inspectedRepository(sourceLock, repository, revision); + + const bearer = inspection.gateway_bearer_bridge; + if (!isRecord(bearer) || bearer.path !== 'jwt.go') { + throw new Error('source lock bearer-bridge inspection is missing'); + } + assertInspectedPath(pinnedRepository, bearer.path); + if (bearer.gateway_module_manifest_path !== 'go.mod' + || bearer.gateway_types_module_version !== 'v0.4.0' + || bearer.gateway_types_module_revision + !== '76f725ffc375ae7fda1f0255ea3e12a0074f6c4c') { + throw new Error('source lock bearer-bridge module resolution changed'); + } + assertInspectedPath(pinnedRepository, bearer.gateway_module_manifest_path); + const resolvedTypes = inspectedRepository( + sourceLock, + 'https://github.com/varwof/types', + bearer.gateway_types_module_revision, + ); + if (resolvedTypes.resolved_module_version !== bearer.gateway_types_module_version + || resolvedTypes.consumed_by + !== `${repository}@${revision}`) { + throw new Error('source lock bearer-bridge dependency resolution changed'); + } + assertInspectedPath(resolvedTypes, 'aicjwt/validate.go'); + assertInspectedPath(resolvedTypes, 'aicjwt/keyhash.go'); + const requiredBearerFacts: Record = { + verify_bearer_returns_synthesized_certificate: true, + verify_bearer_returns_outer_claims: true, + verify_bearer_sets_expected_audience: false, + verify_bearer_sets_request_capability: false, + verify_bearer_sets_principal_material: false, + verify_bearer_sets_presenter_key: false, + synthesized_certificate_sets_raw_der: false, + synthesized_certificate_sets_raw_spki: false, + synthesized_certificate_sets_public_key: false, + authenticated_original_carrier_provenance_returned: false, + non_test_verify_bearer_call_sites_observed: false, + jwt_mapping_requires_original_compact_token: true, + local_mapping_derives_compact_token_audience: true, + local_mapping_derives_presented_jwk_thumbprint: true, + local_mapping_proves_presenter_key_possession: false, + separate_authenticated_capability_evaluation_required: true, + synthesized_certificate_admissible_to_native_x509_mapping: false, + }; + for (const [name, expected] of Object.entries(requiredBearerFacts)) { + if (bearer[name] !== expected) { + throw new Error(`source lock bearer-bridge inspection fact changed: ${name}`); + } + } + + const bundle = inspection.native_x509_bundle; + if (!isRecord(bundle) || bundle.path !== 'credential_bundle.go') { + throw new Error('source lock native-X.509 inspection is missing'); + } + assertInspectedPath(pinnedRepository, bundle.path); + const requiredBundleFacts: Record = { + requires_nonempty_agent_and_principal_chains: true, + enforces_distinct_agent_and_principal_leaf_der: false, + compares_principal_key_hash_to_principal_certificate_spki: true, + local_mapping_requires_exact_certificate_der: true, + local_mapping_requires_distinct_agent_and_principal_der: true, + }; + for (const [name, expected] of Object.entries(requiredBundleFacts)) { + if (bundle[name] !== expected) { + throw new Error(`source lock native-X.509 inspection fact changed: ${name}`); + } + } + if (bundle.principal_spki_hash_algorithm !== 'sha-256') { + throw new Error('source lock native-X.509 SPKI algorithm changed'); + } + + const wiring = inspection.upstream_wiring; + if (!isRecord(wiring) + || wiring.cross_process_authenticated_provenance_wrapper_required !== true + || wiring.deployed_wiring_verified !== false) { + throw new Error('source lock upstream wiring boundary changed'); + } +} + +export function assertAicRawRepositoryFileUrl( + repositoryUrl: string, + revision: string, + inspectedPath: string, + rawUrl: string, +): void { + const repositoryMatch = GITHUB_REPOSITORY_PATTERN.exec(repositoryUrl); + if (!repositoryMatch) { + throw new Error( + `source lock repository must be an exact https://github.com/{owner}/{name} URL: ${repositoryUrl}`, + ); + } + if (!GIT_REVISION_PATTERN.test(revision)) { + throw new Error(`source lock revision must be an exact lowercase 40-hex commit: ${revision}`); + } + + const pathSegments = inspectedPath.split('/'); + if ( + inspectedPath.length === 0 + || inspectedPath.startsWith('/') + || inspectedPath.endsWith('/') + || inspectedPath.includes('\\') + || inspectedPath.includes('?') + || inspectedPath.includes('#') + || inspectedPath.includes('%') + || pathSegments.some((segment) => segment === '' || segment === '.' || segment === '..') + ) { + throw new Error(`source lock inspected path must be a safe relative POSIX path: ${inspectedPath}`); + } + + const [, owner, repository] = repositoryMatch; + const expectedRawUrl = + `https://raw.githubusercontent.com/${owner}/${repository}/${revision}/${inspectedPath}`; + let parsedRawUrl: URL; + try { + parsedRawUrl = new URL(rawUrl); + } catch { + throw new Error(`source lock raw URL is invalid: ${rawUrl}`); + } + if ( + rawUrl !== expectedRawUrl + || parsedRawUrl.href !== rawUrl + || parsedRawUrl.protocol !== 'https:' + || parsedRawUrl.hostname !== 'raw.githubusercontent.com' + || parsedRawUrl.username !== '' + || parsedRawUrl.password !== '' + || parsedRawUrl.port !== '' + || parsedRawUrl.search !== '' + || parsedRawUrl.hash !== '' + ) { + throw new Error( + `source lock raw URL does not match declared repository, revision, and path: expected ${expectedRawUrl}, got ${rawUrl}`, + ); + } +} + +export async function verifyAicSourceLock( + fetchBytes: (url: string) => Promise = async (url) => { + const response = await fetch(url, { + headers: { accept: 'application/octet-stream, text/plain;q=0.9, */*;q=0.1' }, + redirect: 'error', + }); + if (!response.ok) throw new Error(`source fetch failed: ${response.status} ${url}`); + return new Uint8Array(await response.arrayBuffer()); + }, +): Promise { + assertAicInspectionBoundary(); + const sources = [ + ...SOURCE_LOCK.drafts.map((entry: any) => ({ + name: entry.name, + url: entry.url, + expected_sha256: entry.sha256, + })), + ...SOURCE_LOCK.varwof.repositories.flatMap((repository: any) => ( + repository.inspected_files.map((entry: any) => { + assertAicRawRepositoryFileUrl( + repository.repository, + repository.revision, + entry.path, + entry.url, + ); + return { + name: `${repository.repository}@${repository.revision}:${entry.path}`, + url: entry.url, + expected_sha256: entry.sha256, + }; + }) + )), + ]; + const verified: Array<{ + name: string; + url: string; + sha256: string; + bytes: number; + verified: true; + }> = []; + for (const source of sources) { + const bytes = await fetchBytes(source.url); + const actual = sha256(bytes); + if (actual !== source.expected_sha256) { + throw new Error( + `source lock mismatch for ${source.name}: expected ${source.expected_sha256}, got ${actual}`, + ); + } + verified.push({ + name: source.name, + url: source.url, + sha256: actual, + bytes: bytes.byteLength, + verified: true, + }); + } + return { + profile: 'AIC-AEB-CROSSING-SOURCE-LOCK-VERIFICATION-v1', + source_lock_file_sha256: `sha256:${sha256(SOURCE_LOCK_BYTES)}`, + sources: verified, + passed: true, + }; +} + +async function main(): Promise { + process.stdout.write(`${JSON.stringify(await verifyAicSourceLock(), null, 2)}\n`); +} + +if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) { + await main(); +} diff --git a/conformance/conformance-manifest.json b/conformance/conformance-manifest.json index f4602c4cb..e5ab06fe5 100644 --- a/conformance/conformance-manifest.json +++ b/conformance/conformance-manifest.json @@ -130,9 +130,9 @@ "sha256": "7452eb7b6b91ac9a1387a63eb8a0bc299c0597371945cb8aea0096980d039a7b" }, "source": { - "files": 335, - "bytes": 5891512, - "tree_sha256": "edd2f424249b99042764f4ade69492957aa854f4a4ff04da6dd5bfc63fa831b3" + "files": 339, + "bytes": 6030190, + "tree_sha256": "40cf2859cd45a9f16d9cc1323c64cf6551734bf652e860247727c775e2cef4ce" }, "suites": 21, "vectors": 332, @@ -176,5 +176,5 @@ "status": "pass" } ], - "manifest_sha256": "de00937588feff870bb7b72e5f6b09549a3008142f76136dd6a1bd7cce91e71a" + "manifest_sha256": "9fb14a40af62b7a94b629021dc316ea6087ba6c2873da23a43e07e71bf7a9200" } diff --git a/docs/conformance/CLEAN-ROOM-V2.md b/docs/conformance/CLEAN-ROOM-V2.md index 8b5915684..315e1c76a 100644 --- a/docs/conformance/CLEAN-ROOM-V2.md +++ b/docs/conformance/CLEAN-ROOM-V2.md @@ -7,9 +7,9 @@ immutable source commit is supplied separately when the kit is built: - 21 counted suites; - 332 counted vectors; - current manifest byte SHA-256 - `1f0f5a06b90faabab4c4eada8a87380d94a8f0d872af0a56b9391287a83bc3f2`; + `cb64bb6cf65672d0ee785e92765d7e4028db7e31ce5c94a2c71fb89865c4e8c4`; - current manifest canonical claim SHA-256 - `de00937588feff870bb7b72e5f6b09549a3008142f76136dd6a1bd7cce91e71a`; + `9fb14a40af62b7a94b629021dc316ea6087ba6c2873da23a43e07e71bf7a9200`; and - Authority Document execution companion SHA-256 `121a358459ffed223a41a79570cc5307693eaa89a59b3ad330710c5e2f286959`. diff --git a/formal/results/formal-runtime-scenario-conformance.v2.json b/formal/results/formal-runtime-scenario-conformance.v2.json index e959214e5..04896938c 100644 --- a/formal/results/formal-runtime-scenario-conformance.v2.json +++ b/formal/results/formal-runtime-scenario-conformance.v2.json @@ -507,7 +507,7 @@ }, { "path": "package.json", - "sha256": "75a856b7cb092b08ee8a2ead331a26e51ddaef5f2eff194122e90c9b6447851a" + "sha256": "62f0a9cb0f529e06dd1fa2d455c6190fc16c2c2c44f596ca5ad655aa35ac58d5" }, { "path": "packages/gate/aec-execution.js", @@ -1053,6 +1053,10 @@ "path": "packages/verify/dist/aeb-adapter-contract.js", "sha256": "19f4ad5c4cad003f7955cebdd1f8675d85941f75ac6ffc168f6a296897704668" }, + { + "path": "packages/verify/dist/aeb-aic-crossing-adapter.js", + "sha256": "e752a52fdb2e261fb539c090380ad4f4c2f9631adb1155aebf725e55b7386c94" + }, { "path": "packages/verify/dist/aeb-aps-adapter.js", "sha256": "4fa18a0bfd4bf7bbfab96be86c9173b961725f15700ec802aa1bcd4445cf60a9" @@ -1191,7 +1195,7 @@ }, { "path": "packages/verify/dist/index.js", - "sha256": "24a38bfeb2eb98bf2f6d4f47000265efc9c97ab71a50bd0a92e5e03ccf805a86" + "sha256": "a365d26932aad41a9830a86652e9fe87f263c43a74cb1fd228c6c8ff52c98655" }, { "path": "packages/verify/dist/initiator-attestation.js", @@ -1339,7 +1343,7 @@ }, { "path": "packages/verify/src/index.ts", - "sha256": "b98f02b992726287f0a692845991035ec203693e8dbd2e8a53009164ae21705d" + "sha256": "7b188727aaf526a9bff1f4677c2037b60fda1755d83e29e3b64d2972b246b2b4" }, { "path": "packages/verify/src/outcome-binding.ts", diff --git a/lib/proof-stats.json b/lib/proof-stats.json index 70d10d28a..8b2a27fca 100644 --- a/lib/proof-stats.json +++ b/lib/proof-stats.json @@ -1,8 +1,8 @@ { - "generatedAt": "2026-09-01T09:44:11.545Z", + "generatedAt": "2026-09-01T14:52:23.203Z", "tests": { - "total": 10609, - "files": 658, + "total": 10611, + "files": 659, "policy": "all platform-applicable cases must pass; platform-specific cases may skip" }, "tla": { @@ -21,7 +21,7 @@ "coveredModelActions": 28, "actionCompleteModels": 1, "formalMutationOperators": 51, - "evidenceSha256": "fa7e5e6fc32db8984a2fe54b0593aec925750423692869ddb34cb70a3eb622d6", + "evidenceSha256": "b0906119807c78944e5997913f23f52ee2561edcf9583bf11ef50a97ace2bcf3", "boundary": "selected model/runtime scenarios under explicit projection relations; not a mechanized implementation refinement proof" }, "formalEvidenceCoverage": { @@ -105,7 +105,7 @@ "status": "passed", "claims": 35, "evidenceFiles": 259, - "evidenceBundleSha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "evidenceBundleSha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" }, "conformance": { "suites": 21, diff --git a/package.json b/package.json index 13e7a2189..a0f403966 100644 --- a/package.json +++ b/package.json @@ -46,6 +46,7 @@ "conformance:composition:noa-policy-replay": "vitest run conformance/composition/noa-policy-replay-v0.1/run.test.mjs && node conformance/composition/noa-policy-replay-v0.1/run.mjs", "conformance:composition:caplease-emilia": "node --test conformance/composition/caplease-emilia-v0.1/run.test.mjs && node conformance/composition/caplease-emilia-v0.1/run.mjs --check", "conformance:composition:aadp-ep": "npm --prefix packages/verify run build && node conformance/composition/aadp-ep-authorization-v0.1/verify-source-lock.mjs && node --test packages/verify/aadp-authorization-artifact.test.js conformance/composition/aadp-ep-authorization-v0.1/run.node-test.mjs && node conformance/composition/aadp-ep-authorization-v0.1/run.mjs --check", + "conformance:composition:aic-aeb-crossing": "npm --prefix packages/verify run build && node conformance/composition/aic-aeb-crossing-v0.2/verify-source-lock.mjs && node --test packages/verify/aeb-aic-crossing-adapter.test.js conformance/composition/aic-aeb-crossing-v0.2/run.node-test.mjs && node conformance/composition/aic-aeb-crossing-v0.2/run.mjs --check", "conformance:composition:coaz-translation": "node conformance/composition/coaz-translation-v0.1/run.mjs", "conformance:composition:scitt-statement-identity": "npm --prefix packages/verify run build && node --test conformance/composition/scitt-statement-identity-v0.1/run.node-test.mjs && node conformance/composition/scitt-statement-identity-v0.1/run.mjs --check", "conformance:composition:scitt-capsule-seam": "npm --prefix packages/verify run build && node --test examples/scitt/capsule-seam-vector-v2.test.mjs && node examples/scitt/capsule-seam-vector-v2.mjs --check", diff --git a/packages/verify/aeb-aic-crossing-adapter.js b/packages/verify/aeb-aic-crossing-adapter.js new file mode 100644 index 000000000..163a44849 --- /dev/null +++ b/packages/verify/aeb-aic-crossing-adapter.js @@ -0,0 +1,3 @@ +// SPDX-License-Identifier: Apache-2.0 +// Compatibility entry point for the TypeScript AIC crossing adapter. +export * from './dist/aeb-aic-crossing-adapter.js'; diff --git a/packages/verify/aeb-aic-crossing-adapter.test.js b/packages/verify/aeb-aic-crossing-adapter.test.js new file mode 100644 index 000000000..77c9eb88f --- /dev/null +++ b/packages/verify/aeb-aic-crossing-adapter.test.js @@ -0,0 +1,961 @@ +// SPDX-License-Identifier: Apache-2.0 +// Generated from aeb-aic-crossing-adapter.test.ts by scripts/build-standalone-runtimes.mjs. Do not edit. +/* eslint-disable */ +import assert from 'node:assert/strict'; +import crypto from 'node:crypto'; +import test from 'node:test'; +import { digestAebTyped } from './dist/aeb-adapter-contract.js'; +import * as aicAdapterSurface from './dist/aeb-aic-crossing-adapter.js'; +import { AIC_CROSSING_MAX_STATUS_AGE_SECONDS, AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, AIC_JWT_SVID_PROJECTION_VERSION, AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION, issueAicBoundCrossingRecord, mapAicJwtJktBoundCrossingAuthority, mapAicX509SpkiBoundCrossingAuthority, projectAicJwtToStrictJwtSvid, } from './dist/aeb-aic-crossing-adapter.js'; +import { ML_DSA_65_SECRET_KEY_BYTES, ML_DSA_65_SIGNATURE_BYTES, } from './dist/pq-signature-agility.js'; +const NOW = '2026-09-01T07:00:00Z'; +const DIGEST = (octet) => `sha256:${octet.repeat(32)}`; +const TRUST_ANCHOR = DIGEST('11'); +const JWT_VERIFIER = { + id: 'varwof:aic-jwt-validate.gateway-verify-bearer', + version: 'source-lock-v0.2', + implementation_digest: DIGEST('dd'), +}; +const X509_VERIFIER = { + id: 'varwof:gateway-verify-credential-bundle', + version: 'source-lock-v0.2', + implementation_digest: DIGEST('ee'), +}; +const AGENT_CERTIFICATE_DER = 'MIIBczCCASWgAwIBAgICEIcwBQYDK2VwMDgxGTAXBgNVBAMMEGFnZW50LWFjY291bnRpbmcxGzAZBgNVBAoMEkVNSUxJQSBBSUMgRml4dHVyZTAeFw0yNjA5MDEwNjM1MTRaFw0zNjA4MjkwNjM1MTRaMDgxGTAXBgNVBAMMEGFnZW50LWFjY291bnRpbmcxGzAZBgNVBAoMEkVNSUxJQSBBSUMgRml4dHVyZTAqMAUGAytlcAMhABlRhmmMT_c3eHf39WJ53gjQ-XsXrkk2JjbOst7y2iG6o1MwUTAdBgNVHQ4EFgQUYRN3QUuM-4WfrO9gw0jrbCge6WkwHwYDVR0jBBgwFoAUYRN3QUuM-4WfrO9gw0jrbCge6WkwDwYDVR0TAQH_BAUwAwEB_zAFBgMrZXADQQAMwAAYlEzDMMFWXJomesb1_O7QypjsRF3DGHQLhuoBh2op5s9xTo7aiF1BAfW2O82QCy9LOCZsX1ymKcLUEJYL'; +const PRINCIPAL_CERTIFICATE_DER = 'MIIBezCCAS2gAwIBAgICEIgwBQYDK2VwMDwxHTAbBgNVBAMMFHByaW5jaXBhbC1hY2NvdW50aW5nMRswGQYDVQQKDBJFTUlMSUEgQUlDIEZpeHR1cmUwHhcNMjYwOTAxMDYzNTE0WhcNMzYwODI5MDYzNTE0WjA8MR0wGwYDVQQDDBRwcmluY2lwYWwtYWNjb3VudGluZzEbMBkGA1UECgwSRU1JTElBIEFJQyBGaXh0dXJlMCowBQYDK2VwAyEAWP6IT_BCkU9xUCVQR2MePkJ_zYdkFYqAFp0jSzW6Re6jUzBRMB0GA1UdDgQWBBRZkhmqaCLhEEtolUAUZLVa7eBfejAfBgNVHSMEGDAWgBRZkhmqaCLhEEtolUAUZLVa7eBfejAPBgNVHRMBAf8EBTADAQH_MAUGAytlcANBAL-e_CxbdYdZRTB86m3ldvMg_dCpJHAtMl26I-T40QR2JFbG3xWhJTKfEMuZooI2jjHbjLsE1qHQ6s5v3EtphQ0'; +const X509_SPKI = 'HHZknPZ96UejPrdBkR8uVScD38l0C-CydQ-8aWJ1iFo'; +const PRINCIPAL_JWK = { + kty: 'OKP', + crv: 'Ed25519', + x: 'c_kUSHs4ymdA65GF3OV8C3PDWhelodqfOvCmFe-6oUI', +}; +const JKT = crypto.createHash('sha256') + .update(JSON.stringify({ crv: PRINCIPAL_JWK.crv, kty: PRINCIPAL_JWK.kty, x: PRINCIPAL_JWK.x })) + .digest('base64url'); +function jwtCompactToken(typ = 'aic+jwt', audience = 'erp:vendor-master') { + const segment = (value) => Buffer.from(JSON.stringify(value), 'utf8') + .toString('base64url'); + return [ + segment({ alg: 'EdDSA', typ, kid: 'issuer-key-1' }), + segment({ + iss: 'https://issuer.varwof.example', + sub: 'spiffe://agents.example/agent/release-bot', + aud: audience, + iat: 1788245700, + exp: 1788246300, + jti: 'aic-artifact-0001', + cnf: { jkt: JKT }, + aic: { + ver: 1, + principal: { + realm: 'agents.example', + id: 'principal:release-owner', + key_hash: JKT, + hash_alg: 'jkt', + }, + delegation_mode: 'authorized', + capabilities: [{ + scheme: 'varwof/core', + id: 'finance.vendor-account-change', + params: { + vendor_id: 'vendor-0042', + account_fingerprint: 'acct:7e8c', + }, + }], + }, + }), + Buffer.from('fixture-signature', 'utf8').toString('base64url'), + ].join('.'); +} +const JWT_COMPACT_TOKEN = jwtCompactToken(); +const JWT_ARTIFACT_DIGEST = `sha256:${crypto.createHash('sha256') + .update(JWT_COMPACT_TOKEN, 'utf8') + .digest('hex')}`; +const X509_ARTIFACT_DIGEST = digestAebTyped({ + agent_certificate_der: AGENT_CERTIFICATE_DER, + principal_certificate_der: PRINCIPAL_CERTIFICATE_DER, +}, AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION); +const ACTION = { + caid: 'caid:1:finance.vendor-account-change.1:jcs-sha256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', + action_digest: DIGEST('77'), +}; +const ADMISSION_DOMAIN = { + relying_party_id: 'rp:example-finance', + audience: 'erp:vendor-master', + executor_id: 'executor:erp-production', + state_domain_id: 'state-domain:finance-primary', +}; +function common(nativeVerifier = JWT_VERIFIER) { + return { + native_verification: 'VERIFIED', + native_verifier: nativeVerifier, + native_verification_evidence_digest: DIGEST('de'), + issuer: 'https://issuer.varwof.example', + subject: 'spiffe://agents.example/agent/release-bot', + artifact_id: 'aic-artifact-0001', + artifact_digest: JWT_ARTIFACT_DIGEST, + issuer_trust_anchor_digest: TRUST_ANCHOR, + constraints_digest: DIGEST('44'), + status: { + value: 'CURRENT', + checked_at: NOW, + source_head_digest: DIGEST('55'), + }, + validity: { + not_before: '2026-09-01T06:55:00Z', + not_after: '2026-09-01T07:05:00Z', + }, + }; +} +function jwtPolicy() { + return { + mapping_profile_id: AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + mapping_profile_digest: DIGEST('33'), + action_projection_profile_id: 'AIC-EXACT-ACTION-PROJECTION-v1', + action_projection_profile_digest: DIGEST('88'), + trusted_issuer_trust_anchor_digests: [TRUST_ANCHOR], + native_verifier: JWT_VERIFIER, + }; +} +function x509Policy() { + return { + mapping_profile_id: AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + mapping_profile_digest: DIGEST('33'), + action_projection_profile_id: 'AIC-EXACT-ACTION-PROJECTION-v1', + action_projection_profile_digest: DIGEST('88'), + trusted_issuer_trust_anchor_digests: [TRUST_ANCHOR], + native_verifier: X509_VERIFIER, + }; +} +function projectionContext() { + return { + source_verification_policy: { + source_verification_profile_id: AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, + source_verification_profile_digest: DIGEST('32'), + trusted_issuer_trust_anchor_digests: [TRUST_ANCHOR], + native_verifier: JWT_VERIFIER, + }, + evaluated_at: NOW, + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + }; +} +function jwtInput() { + return { + ...common(), + carrier_provenance: { + source_carrier: 'AIC-JWT-COMPACT', + compact_token: JWT_COMPACT_TOKEN, + presented_principal_jwk: PRINCIPAL_JWK, + downstream_representation: 'DIRECT', + }, + principal_binding: { + kind: 'RFC7638_JKT', + hash_alg: 'jkt', + claimed_key_hash: JKT, + presented_key_hash: JKT, + }, + }; +} +function x509Input() { + return { + ...common(X509_VERIFIER), + artifact_digest: X509_ARTIFACT_DIGEST, + carrier_provenance: { + source_carrier: 'AIC-X509-CREDENTIAL-BUNDLE', + agent_certificate_der: AGENT_CERTIFICATE_DER, + principal_certificate_der: PRINCIPAL_CERTIFICATE_DER, + }, + principal_binding: { + kind: 'X509_SPKI', + hash_alg: 'sha-256', + claimed_key_hash: X509_SPKI, + presented_key_hash: X509_SPKI, + }, + }; +} +function boundContext(policy = jwtPolicy()) { + return { + action: ACTION, + admission_domain: ADMISSION_DOMAIN, + requested_capability_digest: DIGEST('99'), + evaluated_at: NOW, + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + policy, + }; +} +function boundX509Input() { + return { + ...x509Input(), + request_binding: boundJwtInput().request_binding, + }; +} +function boundIssueDraft() { + return { + record_id: 'crossing:aic:0001', + operation_id: 'operation:aic:0001', + issued_at: NOW, + action: ACTION, + boundary: ADMISSION_DOMAIN, + requirements: { + admission_digest: DIGEST('a1'), + review_digest: DIGEST('a2'), + }, + admission_reference: { + state: 'PRESENT', + digest: DIGEST('a3'), + }, + lifecycle_records: { + evaluation_digest: DIGEST('a4'), + consumption_digest: DIGEST('a5'), + provider_entry_digest: null, + }, + evaluated_evidence_digests: [DIGEST('a6')], + configuration_digests: [DIGEST('a7')], + referee: { + native_verification: 'VERIFIED', + rp_acceptance: 'ACCEPTED', + action_relation: 'EXACT_MATCH', + status: 'CURRENT', + replay: 'FRESH', + admission: 'ADMIT', + custody: 'RESERVED', + provider_commitment: 'NOT_INVOKED', + observed_effect: 'NOT_OBSERVED', + retry: 'NOT_APPLICABLE', + reconciliation: 'NOT_APPLICABLE', + reason_codes: [], + }, + }; +} +function boundJwtInput() { + return { + ...jwtInput(), + request_binding: { + action_projection_profile_id: 'AIC-EXACT-ACTION-PROJECTION-v1', + action_projection_profile_digest: DIGEST('88'), + requested_capability_digest: DIGEST('99'), + projected_action: ACTION, + projected_admission_domain_digest: digestAebTyped(ADMISSION_DOMAIN, 'EP-AIC-ADMISSION-DOMAIN-v1'), + }, + }; +} +test('bound mapping requires the same exact action and relying-party admission domain', () => { + const result = mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), boundContext()); + assert.equal(result.ok, true, JSON.stringify(result)); + if (!result.ok) + return; + assert.equal(result.authority.mapping_profile_id, AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE); + const substitutedAction = mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), { + ...boundContext(), + action: { ...ACTION, action_digest: DIGEST('aa') }, + }); + assert.deepEqual(substitutedAction, { + ok: false, + reason: 'aic_action_projection_mismatch', + }); + const substitutedDomain = mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), { + ...boundContext(), + admission_domain: { + ...ADMISSION_DOMAIN, + relying_party_id: 'rp:attacker-controlled', + }, + }); + assert.deepEqual(substitutedDomain, { + ok: false, + reason: 'aic_admission_domain_mismatch', + }); + const substitutedMappingPolicy = mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), { + ...boundContext(), + policy: { + ...jwtPolicy(), + mapping_profile_id: 'attacker-selected-mapping-v1', + }, + }); + assert.deepEqual(substitutedMappingPolicy, { + ok: false, + reason: 'aic_mapping_profile_unpinned', + }); + const selfPinnedProjection = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + request_binding: { + ...boundJwtInput().request_binding, + action_projection_profile_id: 'attacker-selected-projection-v1', + action_projection_profile_digest: DIGEST('af'), + }, + }, boundContext()); + assert.deepEqual(selfPinnedProjection, { + ok: false, + reason: 'aic_action_projection_profile_unpinned', + }); + const substitutedCapability = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + request_binding: { + ...boundJwtInput().request_binding, + requested_capability_digest: DIGEST('af'), + }, + }, boundContext()); + assert.deepEqual(substitutedCapability, { + ok: false, + reason: 'aic_requested_capability_mismatch', + }); +}); +test('bound mapping fails closed on non-current, stale, future, or out-of-window source status', () => { + assert.deepEqual(mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + status: { ...boundJwtInput().status, value: 'REVOKED' }, + }, boundContext()), { ok: false, reason: 'aic_status_not_current' }); + assert.deepEqual(mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + status: { ...boundJwtInput().status, checked_at: '2026-09-01T06:58:00Z' }, + }, boundContext()), { ok: false, reason: 'aic_status_observation_stale' }); + assert.deepEqual(mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + status: { ...boundJwtInput().status, checked_at: '2026-09-01T07:00:01Z' }, + }, boundContext()), { ok: false, reason: 'aic_status_observation_future' }); + assert.deepEqual(mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + status: { ...boundJwtInput().status, checked_at: '2026-09-01T07:06:00Z' }, + }, { + ...boundContext(), + evaluated_at: '2026-09-01T07:06:00Z', + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + }), { ok: false, reason: 'aic_validity_window_mismatch' }); +}); +test('the fixed source-status freshness profile cannot be widened by a caller', () => { + assert.deepEqual(mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), { + ...boundContext(), + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS - 1, + }), { ok: false, reason: 'aic_status_freshness_profile_mismatch' }); + const widened = { + evaluated_at: NOW, + max_status_age_seconds: 86_400, + }; + assert.deepEqual(mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), { + ...boundContext(), + ...widened, + }), { ok: false, reason: 'aic_status_freshness_profile_mismatch' }); + assert.deepEqual(mapAicX509SpkiBoundCrossingAuthority(boundX509Input(), { + ...boundContext(x509Policy()), + ...widened, + }), { ok: false, reason: 'aic_status_freshness_profile_mismatch' }); + assert.deepEqual(projectAicJwtToStrictJwtSvid({ + source: jwtInput(), + purpose: 'WORKLOAD_IDENTITY_ONLY', + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: 1788245940, + expires_at: 1788246240, + token_id: 'jwt-svid-projection-freshness-widening', + projected_algorithm: 'ES256', + projected_key_id: 'jwt-svid-key-2026-08', + }, { + ...projectionContext(), + max_status_age_seconds: widened.max_status_age_seconds, + }), { ok: false, reason: 'aic_status_freshness_profile_mismatch' }); +}); +test('bound JWT validity must equal the signed compact-token temporal envelope', () => { + const result = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + validity: { + not_before: '2026-09-01T06:54:00Z', + not_after: '2026-09-01T07:06:00Z', + }, + }, boundContext()); + assert.deepEqual(result, { ok: false, reason: 'aic_jwt_validity_mismatch' }); +}); +test('bound JWT expiration is exclusive while X.509 notAfter remains inclusive', () => { + const evaluatedAt = '2026-09-01T07:05:00Z'; + const jwtAtExpiration = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + status: { + ...boundJwtInput().status, + checked_at: evaluatedAt, + }, + }, { + ...boundContext(), + evaluated_at: evaluatedAt, + }); + assert.deepEqual(jwtAtExpiration, { + ok: false, + reason: 'aic_validity_window_mismatch', + }); + const projectionAtExpiration = projectAicJwtToStrictJwtSvid({ + source: { + ...jwtInput(), + status: { + ...jwtInput().status, + checked_at: evaluatedAt, + }, + }, + purpose: 'WORKLOAD_IDENTITY_ONLY', + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: 1788245940, + expires_at: 1788246240, + token_id: 'jwt-svid-projection-source-at-expiration', + projected_algorithm: 'ES256', + projected_key_id: 'jwt-svid-key-2026-08', + }, { + ...projectionContext(), + evaluated_at: evaluatedAt, + }); + assert.deepEqual(projectionAtExpiration, { + ok: false, + reason: 'jwt_svid_source_validity_mismatch', + }); + const x509AtNotAfter = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + status: { + ...boundX509Input().status, + checked_at: evaluatedAt, + }, + }, { + ...boundContext(x509Policy()), + evaluated_at: evaluatedAt, + }); + assert.equal(x509AtNotAfter.ok, true, JSON.stringify(x509AtNotAfter)); +}); +test('pure-JSON RFC 7638 jkt and X.509 SPKI remain distinct native mappings', () => { + const jwt = mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), boundContext()); + const x509 = mapAicX509SpkiBoundCrossingAuthority(boundX509Input(), boundContext(x509Policy())); + assert.equal(jwt.ok, true, JSON.stringify(jwt)); + assert.equal(x509.ok, true, JSON.stringify(x509)); + if (!jwt.ok || !x509.ok) + return; + assert.equal(jwt.authority.mapping_profile_id, AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE); + assert.equal(x509.authority.mapping_profile_id, AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE); + assert.equal(jwt.authority.native_profile, 'AIC-JWT-RFC7638-JKT'); + assert.equal(x509.authority.native_profile, 'AIC-X509-SPKI'); + assert.notEqual(jwt.authority.authority_instance_digest, x509.authority.authority_instance_digest); + assert.notEqual(jwt.authority.replay_unit, x509.authority.replay_unit); + assert.equal(jwt.authority.rp_acceptance, 'ACCEPTED'); + assert.equal(x509.authority.rp_acceptance, 'ACCEPTED'); +}); +test('X.509 replay identity comes from exact DER rather than free wrapper labels', () => { + const context = boundContext(x509Policy()); + const original = mapAicX509SpkiBoundCrossingAuthority(boundX509Input(), context); + const relabeledArtifact = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + artifact_id: 'attacker-selected-artifact-label', + }, context); + const relabeledIssuer = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + issuer: 'https://other-wrapper-label.example', + }, context); + assert.equal(original.ok, true, JSON.stringify(original)); + assert.equal(relabeledArtifact.ok, true, JSON.stringify(relabeledArtifact)); + assert.equal(relabeledIssuer.ok, true, JSON.stringify(relabeledIssuer)); + if (!original.ok || !relabeledArtifact.ok || !relabeledIssuer.ok) + return; + assert.equal(original.authority.replay_unit, relabeledArtifact.authority.replay_unit); + assert.equal(original.authority.replay_unit, relabeledIssuer.authority.replay_unit); + assert.notEqual(original.authority.authority_instance_digest, relabeledArtifact.authority.authority_instance_digest); + assert.notEqual(original.authority.authority_instance_digest, relabeledIssuer.authority.authority_instance_digest); +}); +test('JWT replay identity follows issuer and jti across a re-signed compact token', () => { + const segments = JWT_COMPACT_TOKEN.split('.'); + const resignedToken = [ + segments[0], + segments[1], + Buffer.from('different-fixture-signature', 'utf8').toString('base64url'), + ].join('.'); + const original = mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), boundContext()); + const resigned = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + artifact_digest: `sha256:${crypto.createHash('sha256') + .update(resignedToken, 'utf8') + .digest('hex')}`, + carrier_provenance: { + ...boundJwtInput().carrier_provenance, + compact_token: resignedToken, + }, + }, boundContext()); + assert.equal(original.ok, true, JSON.stringify(original)); + assert.equal(resigned.ok, true, JSON.stringify(resigned)); + if (!original.ok || !resigned.ok) + return; + assert.equal(original.authority.replay_unit, resigned.authority.replay_unit); + assert.notEqual(original.authority.authority_instance_digest, resigned.authority.authority_instance_digest); +}); +test('principal binding mismatch refuses before a crossing authority is emitted', () => { + const jwt = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + principal_binding: { + ...boundJwtInput().principal_binding, + presented_key_hash: 'C'.repeat(43), + }, + }, boundContext()); + const x509 = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + principal_binding: { + ...boundX509Input().principal_binding, + presented_key_hash: 'D'.repeat(43), + }, + }, boundContext(x509Policy())); + assert.deepEqual(jwt, { ok: false, reason: 'aic_principal_binding_mismatch' }); + assert.deepEqual(x509, { ok: false, reason: 'aic_principal_binding_mismatch' }); +}); +test('native results cannot self-pin relying-party trust or verifier policy', () => { + const untrusted = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + issuer_trust_anchor_digest: DIGEST('66'), + }, boundContext()); + const selfPinned = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + issuer_trust_anchor_digest: DIGEST('66'), + trusted_issuer_trust_anchor_digests: [DIGEST('66')], + }, boundContext()); + const emptyPolicy = mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), boundContext({ + ...jwtPolicy(), + trusted_issuer_trust_anchor_digests: [], + })); + const verifierSelfPin = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + native_verifier: { + ...JWT_VERIFIER, + implementation_digest: DIGEST('fe'), + }, + }, boundContext()); + assert.deepEqual(untrusted, { ok: false, reason: 'aic_issuer_untrusted' }); + assert.deepEqual(selfPinned, { ok: false, reason: 'mapping_input_invalid' }); + assert.deepEqual(emptyPolicy, { + ok: false, + reason: 'mapping_input_invalid', + }); + assert.deepEqual(verifierSelfPin, { + ok: false, + reason: 'aic_native_verifier_unpinned', + }); +}); +test('raw carrier provenance refuses synthesized-certificate relabeling and type confusion', () => { + const wrongJwtCarrier = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + carrier_provenance: x509Input().carrier_provenance, + }, boundContext()); + const wrongTypToken = jwtCompactToken('JWT'); + const jwtTyp = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + artifact_digest: `sha256:${crypto.createHash('sha256') + .update(wrongTypToken, 'utf8') + .digest('hex')}`, + carrier_provenance: { + ...boundJwtInput().carrier_provenance, + compact_token: wrongTypToken, + }, + }, boundContext()); + const claimAsPresentedKey = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + carrier_provenance: { + source_carrier: 'AIC-JWT-COMPACT', + compact_token: JWT_COMPACT_TOKEN, + downstream_representation: 'DIRECT', + }, + }, boundContext()); + const jktAsX509 = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + principal_binding: jwtInput().principal_binding, + }, boundContext(x509Policy())); + const synthesizedJwtAsX509 = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + artifact_digest: JWT_ARTIFACT_DIGEST, + carrier_provenance: { + ...jwtInput().carrier_provenance, + downstream_representation: 'SYNTHESIZED-X509', + }, + }, boundContext(x509Policy())); + const synthesizedJwtAsJwt = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + carrier_provenance: { + ...boundJwtInput().carrier_provenance, + downstream_representation: 'SYNTHESIZED-X509', + }, + }, boundContext()); + const missingNativeDer = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + carrier_provenance: { + ...boundX509Input().carrier_provenance, + agent_certificate_der: '', + }, + }, boundContext(x509Policy())); + const changedBundleDigest = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + artifact_digest: DIGEST('ab'), + }, boundContext(x509Policy())); + const unsupportedSpkiHash = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + principal_binding: { + kind: 'X509_SPKI', + hash_alg: 'sha-384', + claimed_key_hash: 'A'.repeat(64), + presented_key_hash: 'A'.repeat(64), + }, + }, boundContext(x509Policy())); + assert.deepEqual(wrongJwtCarrier, { + ok: false, + reason: 'aic_carrier_provenance_unverifiable', + }); + assert.deepEqual(jwtTyp, { + ok: false, + reason: 'aic_carrier_provenance_unverifiable', + }); + assert.deepEqual(claimAsPresentedKey, { + ok: false, + reason: 'aic_carrier_provenance_unverifiable', + }); + assert.deepEqual(jktAsX509, { ok: false, reason: 'aic_native_type_confusion' }); + assert.deepEqual(synthesizedJwtAsX509, { + ok: false, + reason: 'aic_carrier_provenance_unverifiable', + }); + assert.equal(synthesizedJwtAsJwt.ok, true, JSON.stringify(synthesizedJwtAsJwt)); + assert.deepEqual(missingNativeDer, { + ok: false, + reason: 'aic_carrier_provenance_unverifiable', + }); + assert.deepEqual(changedBundleDigest, { + ok: false, + reason: 'aic_carrier_artifact_digest_mismatch', + }); + assert.deepEqual(unsupportedSpkiHash, { + ok: false, + reason: 'aic_native_type_confusion', + }); +}); +test('bound JWT mapping derives and pins the compact-token audience', () => { + const wrongAudienceToken = jwtCompactToken('aic+jwt', 'erp:other-system'); + const result = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + artifact_digest: `sha256:${crypto.createHash('sha256') + .update(wrongAudienceToken, 'utf8') + .digest('hex')}`, + carrier_provenance: { + ...boundJwtInput().carrier_provenance, + compact_token: wrongAudienceToken, + }, + }, boundContext()); + assert.deepEqual(result, { ok: false, reason: 'aic_audience_mismatch' }); +}); +test('strict JWT-SVID projection creates new typ=JWT TBS bytes and never passes aic+jwt through', () => { + const result = projectAicJwtToStrictJwtSvid({ + source: jwtInput(), + purpose: 'WORKLOAD_IDENTITY_ONLY', + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: 1788245940, + expires_at: 1788246240, + token_id: 'jwt-svid-projection-0001', + projected_algorithm: 'ES256', + projected_key_id: 'jwt-svid-key-2026-08', + }, projectionContext()); + assert.equal(result.ok, true, JSON.stringify(result)); + if (!result.ok) + return; + assert.equal(result.projection['@version'], AIC_JWT_SVID_PROJECTION_VERSION); + assert.deepEqual(result.projection.protected_header, { + alg: 'ES256', + kid: 'jwt-svid-key-2026-08', + typ: 'JWT', + }); + assert.equal(result.projection.payload.aud, 'spiffe://services.example/payment-gate'); + assert.equal(result.projection.payload.sub, jwtInput().subject); + assert.equal('scope' in result.projection.payload, false); + assert.equal(result.projection.source.typ, 'aic+jwt'); + assert.equal(result.projection.source.token_digest, jwtInput().artifact_digest); + assert.equal(result.projection.new_signature_required, true); + assert.equal(result.projection.compact_token, null); + assert.equal(result.projection.authorization_decision, false); + assert.equal(result.projection.authority_semantics_preserved, false); + assert.deepEqual(result.projection.omitted_source_members, [ + 'iss', + 'aic.principal', + 'aic.capabilities', + 'aic.delegation_mode', + 'cnf', + ]); + assert.equal(result.projection.projection_digest, digestAebTyped({ + protected_header: result.projection.protected_header, + payload: result.projection.payload, + source: result.projection.source, + purpose: result.projection.purpose, + omitted_source_members: result.projection.omitted_source_members, + authority_semantics_preserved: false, + new_signature_required: true, + }, `${AIC_JWT_SVID_PROJECTION_VERSION}:projection`)); +}); +test('JWT-SVID projection refuses type confusion, multiple audiences, and authority-semantic loss', () => { + const base = { + source: jwtInput(), + purpose: 'WORKLOAD_IDENTITY_ONLY', + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: null, + expires_at: 1788246240, + token_id: 'jwt-svid-projection-0001', + projected_algorithm: 'ES256', + projected_key_id: 'jwt-svid-key-2026-08', + }; + assert.deepEqual(projectAicJwtToStrictJwtSvid({ + ...base, + source: { + ...jwtInput(), + artifact_digest: `sha256:${crypto.createHash('sha256') + .update(jwtCompactToken('JWT'), 'utf8') + .digest('hex')}`, + carrier_provenance: { + ...jwtInput().carrier_provenance, + compact_token: jwtCompactToken('JWT'), + }, + }, + }, projectionContext()), { ok: false, reason: 'aic_carrier_provenance_unverifiable' }); + assert.deepEqual(projectAicJwtToStrictJwtSvid({ + ...base, + audience: [...base.audience, 'spiffe://services.example/other'], + }, projectionContext()), { ok: false, reason: 'jwt_svid_single_audience_required' }); + assert.deepEqual(projectAicJwtToStrictJwtSvid({ + ...base, + purpose: 'AIC_AUTHORITY', + }, projectionContext()), { ok: false, reason: 'aic_jwt_svid_semantic_loss' }); + assert.deepEqual(projectAicJwtToStrictJwtSvid({ + ...base, + source: { + ...jwtInput(), + status: { ...jwtInput().status, value: 'REVOKED' }, + }, + }, projectionContext()), { ok: false, reason: 'aic_status_not_current' }); + assert.deepEqual(projectAicJwtToStrictJwtSvid({ + ...base, + source: { + ...jwtInput(), + status: { ...jwtInput().status, checked_at: '2026-09-01T06:58:00Z' }, + }, + }, projectionContext()), { ok: false, reason: 'jwt_svid_source_status_stale' }); + assert.deepEqual(projectAicJwtToStrictJwtSvid({ + ...base, + expires_at: 2099520000, + }, projectionContext()), { ok: false, reason: 'jwt_svid_source_validity_mismatch' }); + assert.deepEqual(projectAicJwtToStrictJwtSvid({ + ...base, + has_constraints: true, + }, projectionContext()), { ok: false, reason: 'jwt_svid_projection_input_invalid' }); + assert.deepEqual(projectAicJwtToStrictJwtSvid(base, { + ...projectionContext(), + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + attacker_selected: true, + }), { ok: false, reason: 'jwt_svid_projection_input_invalid' }); +}); +test('public AIC surfaces expose no unbound authority mapping', async () => { + const mainSurface = await import('./index.js'); + const subpathSurface = await import('./aeb-aic-crossing-adapter.js'); + const forbidden = [ + 'AIC_JWT_JKT_CROSSING_MAPPING_PROFILE', + 'AIC_X509_SPKI_CROSSING_MAPPING_PROFILE', + 'mapAicJwtJktCrossingAuthority', + 'mapAicX509SpkiCrossingAuthority', + ]; + for (const name of forbidden) { + assert.equal(name in mainSurface, false, `${name} leaked from the package main entry`); + assert.equal(name in subpathSurface, false, `${name} leaked from the AIC subpath`); + } + assert.equal(typeof subpathSurface.issueAicBoundCrossingRecord, 'function'); +}); +test('AIC bound issuance refuses an action or boundary mismatch before signing', async () => { + const issueAicBound = aicAdapterSurface + .issueAicBoundCrossingRecord; + assert.equal(typeof issueAicBound, 'function'); + if (typeof issueAicBound !== 'function') + return; + const actionMismatch = await issueAicBound(boundJwtInput(), boundContext(), { + ...boundIssueDraft(), + action: { ...ACTION, action_digest: DIGEST('fa') }, + }, { signing_keys: [] }); + assert.deepEqual(actionMismatch, { + ok: false, + reason: 'aic_crossing_issue_action_mismatch', + }); + const boundaryMismatch = await issueAicBound(boundJwtInput(), boundContext(), { + ...boundIssueDraft(), + boundary: { + ...ADMISSION_DOMAIN, + relying_party_id: 'rp:other-company', + }, + }, { signing_keys: [] }); + assert.deepEqual(boundaryMismatch, { + ok: false, + reason: 'aic_crossing_issue_admission_domain_mismatch', + }); +}); +test('AIC issuance snapshots trusted state and signing options before hostile input', async () => { + const mismatchContext = structuredClone(boundContext()); + const mismatchDraft = structuredClone(boundIssueDraft()); + mismatchDraft.boundary.relying_party_id = 'rp:other-company'; + const mismatchOptions = { signing_keys: [] }; + const accessorInput = structuredClone(boundJwtInput()); + let getterCalls = 0; + Object.defineProperty(accessorInput, 'native_verification', { + enumerable: true, + configurable: true, + get() { + getterCalls += 1; + mismatchContext.admission_domain.relying_party_id = + mismatchDraft.boundary.relying_party_id; + accessorInput.request_binding.projected_admission_domain_digest = + digestAebTyped(mismatchContext.admission_domain, 'EP-AIC-ADMISSION-DOMAIN-v1'); + mismatchOptions.signing_keys.length = 0; + return 'VERIFIED'; + }, + }); + const mismatch = await issueAicBoundCrossingRecord(accessorInput, mismatchContext, mismatchDraft, mismatchOptions); + assert.deepEqual(mismatch, { + ok: false, + reason: 'aic_crossing_issue_admission_domain_mismatch', + }); + assert.equal(getterCalls, 0, 'trusted mismatch must refuse without invoking input accessors'); + const context = structuredClone(boundContext()); + const draft = structuredClone(boundIssueDraft()); + const pqPrivateKey = new Uint8Array(ML_DSA_65_SECRET_KEY_BYTES).fill(7); + const { privateKey: ed25519PrivateKey } = crypto.generateKeyPairSync('ed25519'); + let backendCalls = 0; + let observedPrivateKeyByte = -1; + let observedDeterministic = false; + const originalBackend = { + sign(_message, privateKey, options) { + backendCalls += 1; + observedPrivateKeyByte = privateKey[0] ?? -1; + observedDeterministic = options?.extraEntropy === false; + return new Uint8Array(ML_DSA_65_SIGNATURE_BYTES).fill(1); + }, + verify() { + return true; + }, + }; + const signingOptions = { + signing_keys: [ + { + alg: 'Ed25519', + private_key: ed25519PrivateKey, + key_id: 'aic-test-ed25519', + }, + { + alg: 'ML-DSA-65', + private_key: pqPrivateKey, + key_id: 'aic-test-ml-dsa-65', + }, + ], + deterministic: true, + mldsaBackend: originalBackend, + }; + let proxyTrapCalls = 0; + const proxiedInput = new Proxy(structuredClone(boundJwtInput()), { + getPrototypeOf(target) { + proxyTrapCalls += 1; + context.admission_domain.relying_party_id = 'rp:mutated-after-snapshot'; + draft.boundary.relying_party_id = 'rp:mutated-after-snapshot'; + pqPrivateKey.fill(9); + signingOptions.signing_keys.length = 0; + signingOptions.deterministic = false; + signingOptions.mldsaBackend = { + sign() { + throw new Error('mutated backend must not run'); + }, + verify() { + return false; + }, + }; + return Reflect.getPrototypeOf(target); + }, + }); + const issued = await issueAicBoundCrossingRecord(proxiedInput, context, draft, signingOptions); + assert.equal(issued.ok, true, JSON.stringify(issued)); + if (!issued.ok) + return; + assert.ok(proxyTrapCalls > 0); + assert.equal(issued.record.body.boundary.relying_party_id, ADMISSION_DOMAIN.relying_party_id); + assert.equal(issued.record.body.action.action_digest, ACTION.action_digest); + assert.equal(backendCalls, 1); + assert.equal(observedPrivateKeyByte, 7, 'ML-DSA key bytes must be copied before input inspection'); + assert.equal(observedDeterministic, true, 'deterministic signing option must be snapshotted'); +}); +test('native failure short-circuits carrier parsing after structural validation', () => { + assert.deepEqual(mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + native_verification: 'FAILED', + carrier_provenance: { + ...boundJwtInput().carrier_provenance, + compact_token: 'not-a-compact-jwt', + }, + }, boundContext()), { ok: false, reason: 'aic_native_verification_failed' }); + assert.deepEqual(mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + native_verification: 'INDETERMINATE', + carrier_provenance: { + ...boundX509Input().carrier_provenance, + agent_certificate_der: 'not-der', + }, + }, boundContext(x509Policy())), { ok: false, reason: 'aic_native_verification_indeterminate' }); + assert.deepEqual(projectAicJwtToStrictJwtSvid({ + source: { + ...jwtInput(), + native_verification: 'FAILED', + carrier_provenance: { + ...jwtInput().carrier_provenance, + compact_token: 'not-a-compact-jwt', + }, + }, + purpose: 'WORKLOAD_IDENTITY_ONLY', + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: null, + expires_at: 1788246240, + token_id: 'jwt-svid-failed-source', + projected_algorithm: 'ES256', + projected_key_id: 'jwt-svid-key-2026-08', + }, projectionContext()), { ok: false, reason: 'aic_native_verification_failed' }); +}); +test('JWT-SVID projection digest binds the accepted source evaluation', () => { + const projectionInput = { + source: jwtInput(), + purpose: 'WORKLOAD_IDENTITY_ONLY', + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: null, + expires_at: 1788246240, + token_id: 'jwt-svid-source-evaluation-binding', + projected_algorithm: 'ES256', + projected_key_id: 'jwt-svid-key-2026-08', + }; + const original = projectAicJwtToStrictJwtSvid(projectionInput, projectionContext()); + const changedEvidence = projectAicJwtToStrictJwtSvid({ + ...projectionInput, + source: { + ...projectionInput.source, + native_verification_evidence_digest: DIGEST('ef'), + }, + }, projectionContext()); + const changedStatusHead = projectAicJwtToStrictJwtSvid({ + ...projectionInput, + source: { + ...projectionInput.source, + status: { + ...projectionInput.source.status, + source_head_digest: DIGEST('f0'), + }, + }, + }, projectionContext()); + const changedPolicy = projectAicJwtToStrictJwtSvid(projectionInput, { + ...projectionContext(), + source_verification_policy: { + ...projectionContext().source_verification_policy, + source_verification_profile_digest: DIGEST('f1'), + }, + }); + assert.equal(original.ok, true, JSON.stringify(original)); + assert.equal(changedEvidence.ok, true, JSON.stringify(changedEvidence)); + assert.equal(changedStatusHead.ok, true, JSON.stringify(changedStatusHead)); + assert.equal(changedPolicy.ok, true, JSON.stringify(changedPolicy)); + if (!original.ok || !changedEvidence.ok || !changedStatusHead.ok || !changedPolicy.ok) { + return; + } + assert.notEqual(original.projection.projection_digest, changedEvidence.projection.projection_digest); + assert.notEqual(original.projection.projection_digest, changedStatusHead.projection.projection_digest); + assert.notEqual(original.projection.projection_digest, changedPolicy.projection.projection_digest); +}); diff --git a/packages/verify/aeb-aic-crossing-adapter.test.ts b/packages/verify/aeb-aic-crossing-adapter.test.ts new file mode 100644 index 000000000..75dc63851 --- /dev/null +++ b/packages/verify/aeb-aic-crossing-adapter.test.ts @@ -0,0 +1,1187 @@ +// SPDX-License-Identifier: Apache-2.0 +import assert from 'node:assert/strict'; +import crypto from 'node:crypto'; +import test from 'node:test'; + +import { digestAebTyped } from './dist/aeb-adapter-contract.js'; +import * as aicAdapterSurface from './dist/aeb-aic-crossing-adapter.js'; +import { + AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + AIC_JWT_SVID_PROJECTION_VERSION, + AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, + AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION, + issueAicBoundCrossingRecord, + mapAicJwtJktBoundCrossingAuthority, + mapAicX509SpkiBoundCrossingAuthority, + projectAicJwtToStrictJwtSvid, +} from './dist/aeb-aic-crossing-adapter.js'; +import { + ML_DSA_65_SECRET_KEY_BYTES, + ML_DSA_65_SIGNATURE_BYTES, +} from './dist/pq-signature-agility.js'; + +const NOW = '2026-09-01T07:00:00Z'; +const DIGEST = (octet: string) => `sha256:${octet.repeat(32)}` as const; +const TRUST_ANCHOR = DIGEST('11'); +const JWT_VERIFIER = { + id: 'varwof:aic-jwt-validate.gateway-verify-bearer', + version: 'source-lock-v0.2', + implementation_digest: DIGEST('dd'), +} as const; +const X509_VERIFIER = { + id: 'varwof:gateway-verify-credential-bundle', + version: 'source-lock-v0.2', + implementation_digest: DIGEST('ee'), +} as const; +const AGENT_CERTIFICATE_DER = 'MIIBczCCASWgAwIBAgICEIcwBQYDK2VwMDgxGTAXBgNVBAMMEGFnZW50LWFjY291bnRpbmcxGzAZBgNVBAoMEkVNSUxJQSBBSUMgRml4dHVyZTAeFw0yNjA5MDEwNjM1MTRaFw0zNjA4MjkwNjM1MTRaMDgxGTAXBgNVBAMMEGFnZW50LWFjY291bnRpbmcxGzAZBgNVBAoMEkVNSUxJQSBBSUMgRml4dHVyZTAqMAUGAytlcAMhABlRhmmMT_c3eHf39WJ53gjQ-XsXrkk2JjbOst7y2iG6o1MwUTAdBgNVHQ4EFgQUYRN3QUuM-4WfrO9gw0jrbCge6WkwHwYDVR0jBBgwFoAUYRN3QUuM-4WfrO9gw0jrbCge6WkwDwYDVR0TAQH_BAUwAwEB_zAFBgMrZXADQQAMwAAYlEzDMMFWXJomesb1_O7QypjsRF3DGHQLhuoBh2op5s9xTo7aiF1BAfW2O82QCy9LOCZsX1ymKcLUEJYL'; +const PRINCIPAL_CERTIFICATE_DER = 'MIIBezCCAS2gAwIBAgICEIgwBQYDK2VwMDwxHTAbBgNVBAMMFHByaW5jaXBhbC1hY2NvdW50aW5nMRswGQYDVQQKDBJFTUlMSUEgQUlDIEZpeHR1cmUwHhcNMjYwOTAxMDYzNTE0WhcNMzYwODI5MDYzNTE0WjA8MR0wGwYDVQQDDBRwcmluY2lwYWwtYWNjb3VudGluZzEbMBkGA1UECgwSRU1JTElBIEFJQyBGaXh0dXJlMCowBQYDK2VwAyEAWP6IT_BCkU9xUCVQR2MePkJ_zYdkFYqAFp0jSzW6Re6jUzBRMB0GA1UdDgQWBBRZkhmqaCLhEEtolUAUZLVa7eBfejAfBgNVHSMEGDAWgBRZkhmqaCLhEEtolUAUZLVa7eBfejAPBgNVHRMBAf8EBTADAQH_MAUGAytlcANBAL-e_CxbdYdZRTB86m3ldvMg_dCpJHAtMl26I-T40QR2JFbG3xWhJTKfEMuZooI2jjHbjLsE1qHQ6s5v3EtphQ0'; +const X509_SPKI = 'HHZknPZ96UejPrdBkR8uVScD38l0C-CydQ-8aWJ1iFo'; +const PRINCIPAL_JWK = { + kty: 'OKP' as const, + crv: 'Ed25519', + x: 'c_kUSHs4ymdA65GF3OV8C3PDWhelodqfOvCmFe-6oUI', +}; +const JKT = crypto.createHash('sha256') + .update(JSON.stringify({ crv: PRINCIPAL_JWK.crv, kty: PRINCIPAL_JWK.kty, x: PRINCIPAL_JWK.x })) + .digest('base64url'); + +function jwtCompactToken( + typ = 'aic+jwt', + audience: string | string[] = 'erp:vendor-master', +): string { + const segment = (value: unknown) => Buffer.from(JSON.stringify(value), 'utf8') + .toString('base64url'); + return [ + segment({ alg: 'EdDSA', typ, kid: 'issuer-key-1' }), + segment({ + iss: 'https://issuer.varwof.example', + sub: 'spiffe://agents.example/agent/release-bot', + aud: audience, + iat: 1788245700, + exp: 1788246300, + jti: 'aic-artifact-0001', + cnf: { jkt: JKT }, + aic: { + ver: 1, + principal: { + realm: 'agents.example', + id: 'principal:release-owner', + key_hash: JKT, + hash_alg: 'jkt', + }, + delegation_mode: 'authorized', + capabilities: [{ + scheme: 'varwof/core', + id: 'finance.vendor-account-change', + params: { + vendor_id: 'vendor-0042', + account_fingerprint: 'acct:7e8c', + }, + }], + }, + }), + Buffer.from('fixture-signature', 'utf8').toString('base64url'), + ].join('.'); +} + +const JWT_COMPACT_TOKEN = jwtCompactToken(); +const JWT_ARTIFACT_DIGEST = `sha256:${crypto.createHash('sha256') + .update(JWT_COMPACT_TOKEN, 'utf8') + .digest('hex')}` as const; +const X509_ARTIFACT_DIGEST = digestAebTyped( + { + agent_certificate_der: AGENT_CERTIFICATE_DER, + principal_certificate_der: PRINCIPAL_CERTIFICATE_DER, + }, + AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION, +); +const ACTION = { + caid: 'caid:1:finance.vendor-account-change.1:jcs-sha256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA', + action_digest: DIGEST('77'), +} as const; +const ADMISSION_DOMAIN = { + relying_party_id: 'rp:example-finance', + audience: 'erp:vendor-master', + executor_id: 'executor:erp-production', + state_domain_id: 'state-domain:finance-primary', +} as const; + +function common(nativeVerifier = JWT_VERIFIER) { + return { + native_verification: 'VERIFIED' as const, + native_verifier: nativeVerifier, + native_verification_evidence_digest: DIGEST('de'), + issuer: 'https://issuer.varwof.example', + subject: 'spiffe://agents.example/agent/release-bot', + artifact_id: 'aic-artifact-0001', + artifact_digest: JWT_ARTIFACT_DIGEST, + issuer_trust_anchor_digest: TRUST_ANCHOR, + constraints_digest: DIGEST('44'), + status: { + value: 'CURRENT' as const, + checked_at: NOW, + source_head_digest: DIGEST('55'), + }, + validity: { + not_before: '2026-09-01T06:55:00Z', + not_after: '2026-09-01T07:05:00Z', + }, + }; +} + +function jwtPolicy() { + return { + mapping_profile_id: AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + mapping_profile_digest: DIGEST('33'), + action_projection_profile_id: 'AIC-EXACT-ACTION-PROJECTION-v1', + action_projection_profile_digest: DIGEST('88'), + trusted_issuer_trust_anchor_digests: [TRUST_ANCHOR], + native_verifier: JWT_VERIFIER, + }; +} + +function x509Policy() { + return { + mapping_profile_id: AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + mapping_profile_digest: DIGEST('33'), + action_projection_profile_id: 'AIC-EXACT-ACTION-PROJECTION-v1', + action_projection_profile_digest: DIGEST('88'), + trusted_issuer_trust_anchor_digests: [TRUST_ANCHOR], + native_verifier: X509_VERIFIER, + }; +} + +function projectionContext() { + return { + source_verification_policy: { + source_verification_profile_id: + AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, + source_verification_profile_digest: DIGEST('32'), + trusted_issuer_trust_anchor_digests: [TRUST_ANCHOR], + native_verifier: JWT_VERIFIER, + }, + evaluated_at: NOW, + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + }; +} + +function jwtInput() { + return { + ...common(), + carrier_provenance: { + source_carrier: 'AIC-JWT-COMPACT' as const, + compact_token: JWT_COMPACT_TOKEN, + presented_principal_jwk: PRINCIPAL_JWK, + downstream_representation: 'DIRECT' as const, + }, + principal_binding: { + kind: 'RFC7638_JKT' as const, + hash_alg: 'jkt' as const, + claimed_key_hash: JKT, + presented_key_hash: JKT, + }, + }; +} + +function x509Input() { + return { + ...common(X509_VERIFIER), + artifact_digest: X509_ARTIFACT_DIGEST, + carrier_provenance: { + source_carrier: 'AIC-X509-CREDENTIAL-BUNDLE' as const, + agent_certificate_der: AGENT_CERTIFICATE_DER, + principal_certificate_der: PRINCIPAL_CERTIFICATE_DER, + }, + principal_binding: { + kind: 'X509_SPKI' as const, + hash_alg: 'sha-256' as const, + claimed_key_hash: X509_SPKI, + presented_key_hash: X509_SPKI, + }, + }; +} + +function boundContext(policy = jwtPolicy()) { + return { + action: ACTION, + admission_domain: ADMISSION_DOMAIN, + requested_capability_digest: DIGEST('99'), + evaluated_at: NOW, + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + policy, + }; +} + +function boundX509Input() { + return { + ...x509Input(), + request_binding: boundJwtInput().request_binding, + }; +} + +function boundIssueDraft() { + return { + record_id: 'crossing:aic:0001', + operation_id: 'operation:aic:0001', + issued_at: NOW, + action: ACTION, + boundary: ADMISSION_DOMAIN, + requirements: { + admission_digest: DIGEST('a1'), + review_digest: DIGEST('a2'), + }, + admission_reference: { + state: 'PRESENT' as const, + digest: DIGEST('a3'), + }, + lifecycle_records: { + evaluation_digest: DIGEST('a4'), + consumption_digest: DIGEST('a5'), + provider_entry_digest: null, + }, + evaluated_evidence_digests: [DIGEST('a6')], + configuration_digests: [DIGEST('a7')], + referee: { + native_verification: 'VERIFIED' as const, + rp_acceptance: 'ACCEPTED' as const, + action_relation: 'EXACT_MATCH' as const, + status: 'CURRENT' as const, + replay: 'FRESH' as const, + admission: 'ADMIT' as const, + custody: 'RESERVED' as const, + provider_commitment: 'NOT_INVOKED' as const, + observed_effect: 'NOT_OBSERVED' as const, + retry: 'NOT_APPLICABLE' as const, + reconciliation: 'NOT_APPLICABLE' as const, + reason_codes: [], + }, + }; +} + +function boundJwtInput() { + return { + ...jwtInput(), + request_binding: { + action_projection_profile_id: 'AIC-EXACT-ACTION-PROJECTION-v1', + action_projection_profile_digest: DIGEST('88'), + requested_capability_digest: DIGEST('99'), + projected_action: ACTION, + projected_admission_domain_digest: digestAebTyped( + ADMISSION_DOMAIN, + 'EP-AIC-ADMISSION-DOMAIN-v1', + ), + }, + }; +} + +test('bound mapping requires the same exact action and relying-party admission domain', () => { + const result = mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), boundContext()); + assert.equal(result.ok, true, JSON.stringify(result)); + if (!result.ok) return; + assert.equal( + result.authority.mapping_profile_id, + AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + ); + + const substitutedAction = mapAicJwtJktBoundCrossingAuthority( + boundJwtInput(), + { + ...boundContext(), + action: { ...ACTION, action_digest: DIGEST('aa') }, + }, + ); + assert.deepEqual(substitutedAction, { + ok: false, + reason: 'aic_action_projection_mismatch', + }); + + const substitutedDomain = mapAicJwtJktBoundCrossingAuthority( + boundJwtInput(), + { + ...boundContext(), + admission_domain: { + ...ADMISSION_DOMAIN, + relying_party_id: 'rp:attacker-controlled', + }, + }, + ); + assert.deepEqual(substitutedDomain, { + ok: false, + reason: 'aic_admission_domain_mismatch', + }); + + const substitutedMappingPolicy = mapAicJwtJktBoundCrossingAuthority( + boundJwtInput(), + { + ...boundContext(), + policy: { + ...jwtPolicy(), + mapping_profile_id: 'attacker-selected-mapping-v1', + }, + }, + ); + assert.deepEqual(substitutedMappingPolicy, { + ok: false, + reason: 'aic_mapping_profile_unpinned', + }); + + const selfPinnedProjection = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + request_binding: { + ...boundJwtInput().request_binding, + action_projection_profile_id: 'attacker-selected-projection-v1', + action_projection_profile_digest: DIGEST('af'), + }, + }, boundContext()); + assert.deepEqual(selfPinnedProjection, { + ok: false, + reason: 'aic_action_projection_profile_unpinned', + }); + + const substitutedCapability = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + request_binding: { + ...boundJwtInput().request_binding, + requested_capability_digest: DIGEST('af'), + }, + }, boundContext()); + assert.deepEqual(substitutedCapability, { + ok: false, + reason: 'aic_requested_capability_mismatch', + }); +}); + +test('bound mapping fails closed on non-current, stale, future, or out-of-window source status', () => { + assert.deepEqual( + mapAicJwtJktBoundCrossingAuthority( + { + ...boundJwtInput(), + status: { ...boundJwtInput().status, value: 'REVOKED' }, + }, + boundContext(), + ), + { ok: false, reason: 'aic_status_not_current' }, + ); + assert.deepEqual( + mapAicJwtJktBoundCrossingAuthority( + { + ...boundJwtInput(), + status: { ...boundJwtInput().status, checked_at: '2026-09-01T06:58:00Z' }, + }, + boundContext(), + ), + { ok: false, reason: 'aic_status_observation_stale' }, + ); + assert.deepEqual( + mapAicJwtJktBoundCrossingAuthority( + { + ...boundJwtInput(), + status: { ...boundJwtInput().status, checked_at: '2026-09-01T07:00:01Z' }, + }, + boundContext(), + ), + { ok: false, reason: 'aic_status_observation_future' }, + ); + assert.deepEqual( + mapAicJwtJktBoundCrossingAuthority( + { + ...boundJwtInput(), + status: { ...boundJwtInput().status, checked_at: '2026-09-01T07:06:00Z' }, + }, + { + ...boundContext(), + evaluated_at: '2026-09-01T07:06:00Z', + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + }, + ), + { ok: false, reason: 'aic_validity_window_mismatch' }, + ); +}); + +test('the fixed source-status freshness profile cannot be widened by a caller', () => { + assert.deepEqual( + mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), { + ...boundContext(), + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS - 1, + }), + { ok: false, reason: 'aic_status_freshness_profile_mismatch' }, + ); + const widened = { + evaluated_at: NOW, + max_status_age_seconds: 86_400, + }; + assert.deepEqual( + mapAicJwtJktBoundCrossingAuthority(boundJwtInput(), { + ...boundContext(), + ...widened, + }), + { ok: false, reason: 'aic_status_freshness_profile_mismatch' }, + ); + assert.deepEqual( + mapAicX509SpkiBoundCrossingAuthority(boundX509Input(), { + ...boundContext(x509Policy()), + ...widened, + }), + { ok: false, reason: 'aic_status_freshness_profile_mismatch' }, + ); + assert.deepEqual( + projectAicJwtToStrictJwtSvid({ + source: jwtInput(), + purpose: 'WORKLOAD_IDENTITY_ONLY', + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: 1788245940, + expires_at: 1788246240, + token_id: 'jwt-svid-projection-freshness-widening', + projected_algorithm: 'ES256', + projected_key_id: 'jwt-svid-key-2026-08', + }, { + ...projectionContext(), + max_status_age_seconds: widened.max_status_age_seconds, + }), + { ok: false, reason: 'aic_status_freshness_profile_mismatch' }, + ); +}); + +test('bound JWT validity must equal the signed compact-token temporal envelope', () => { + const result = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + validity: { + not_before: '2026-09-01T06:54:00Z', + not_after: '2026-09-01T07:06:00Z', + }, + }, boundContext()); + assert.deepEqual(result, { ok: false, reason: 'aic_jwt_validity_mismatch' }); +}); + +test('bound JWT expiration is exclusive while X.509 notAfter remains inclusive', () => { + const evaluatedAt = '2026-09-01T07:05:00Z'; + const jwtAtExpiration = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + status: { + ...boundJwtInput().status, + checked_at: evaluatedAt, + }, + }, { + ...boundContext(), + evaluated_at: evaluatedAt, + }); + assert.deepEqual(jwtAtExpiration, { + ok: false, + reason: 'aic_validity_window_mismatch', + }); + + const projectionAtExpiration = projectAicJwtToStrictJwtSvid({ + source: { + ...jwtInput(), + status: { + ...jwtInput().status, + checked_at: evaluatedAt, + }, + }, + purpose: 'WORKLOAD_IDENTITY_ONLY', + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: 1788245940, + expires_at: 1788246240, + token_id: 'jwt-svid-projection-source-at-expiration', + projected_algorithm: 'ES256', + projected_key_id: 'jwt-svid-key-2026-08', + }, { + ...projectionContext(), + evaluated_at: evaluatedAt, + }); + assert.deepEqual(projectionAtExpiration, { + ok: false, + reason: 'jwt_svid_source_validity_mismatch', + }); + + const x509AtNotAfter = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + status: { + ...boundX509Input().status, + checked_at: evaluatedAt, + }, + }, { + ...boundContext(x509Policy()), + evaluated_at: evaluatedAt, + }); + assert.equal(x509AtNotAfter.ok, true, JSON.stringify(x509AtNotAfter)); +}); + +test('pure-JSON RFC 7638 jkt and X.509 SPKI remain distinct native mappings', () => { + const jwt = mapAicJwtJktBoundCrossingAuthority( + boundJwtInput(), + boundContext(), + ); + const x509 = mapAicX509SpkiBoundCrossingAuthority( + boundX509Input(), + boundContext(x509Policy()), + ); + assert.equal(jwt.ok, true, JSON.stringify(jwt)); + assert.equal(x509.ok, true, JSON.stringify(x509)); + if (!jwt.ok || !x509.ok) return; + assert.equal( + jwt.authority.mapping_profile_id, + AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + ); + assert.equal( + x509.authority.mapping_profile_id, + AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + ); + assert.equal(jwt.authority.native_profile, 'AIC-JWT-RFC7638-JKT'); + assert.equal(x509.authority.native_profile, 'AIC-X509-SPKI'); + assert.notEqual(jwt.authority.authority_instance_digest, x509.authority.authority_instance_digest); + assert.notEqual(jwt.authority.replay_unit, x509.authority.replay_unit); + assert.equal(jwt.authority.rp_acceptance, 'ACCEPTED'); + assert.equal(x509.authority.rp_acceptance, 'ACCEPTED'); +}); + +test('X.509 replay identity comes from exact DER rather than free wrapper labels', () => { + const context = boundContext(x509Policy()); + const original = mapAicX509SpkiBoundCrossingAuthority( + boundX509Input(), + context, + ); + const relabeledArtifact = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + artifact_id: 'attacker-selected-artifact-label', + }, context); + const relabeledIssuer = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + issuer: 'https://other-wrapper-label.example', + }, context); + assert.equal(original.ok, true, JSON.stringify(original)); + assert.equal(relabeledArtifact.ok, true, JSON.stringify(relabeledArtifact)); + assert.equal(relabeledIssuer.ok, true, JSON.stringify(relabeledIssuer)); + if (!original.ok || !relabeledArtifact.ok || !relabeledIssuer.ok) return; + assert.equal(original.authority.replay_unit, relabeledArtifact.authority.replay_unit); + assert.equal(original.authority.replay_unit, relabeledIssuer.authority.replay_unit); + assert.notEqual( + original.authority.authority_instance_digest, + relabeledArtifact.authority.authority_instance_digest, + ); + assert.notEqual( + original.authority.authority_instance_digest, + relabeledIssuer.authority.authority_instance_digest, + ); +}); + +test('JWT replay identity follows issuer and jti across a re-signed compact token', () => { + const segments = JWT_COMPACT_TOKEN.split('.'); + const resignedToken = [ + segments[0], + segments[1], + Buffer.from('different-fixture-signature', 'utf8').toString('base64url'), + ].join('.'); + const original = mapAicJwtJktBoundCrossingAuthority( + boundJwtInput(), + boundContext(), + ); + const resigned = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + artifact_digest: `sha256:${crypto.createHash('sha256') + .update(resignedToken, 'utf8') + .digest('hex')}`, + carrier_provenance: { + ...boundJwtInput().carrier_provenance, + compact_token: resignedToken, + }, + }, boundContext()); + assert.equal(original.ok, true, JSON.stringify(original)); + assert.equal(resigned.ok, true, JSON.stringify(resigned)); + if (!original.ok || !resigned.ok) return; + assert.equal(original.authority.replay_unit, resigned.authority.replay_unit); + assert.notEqual( + original.authority.authority_instance_digest, + resigned.authority.authority_instance_digest, + ); +}); + +test('principal binding mismatch refuses before a crossing authority is emitted', () => { + const jwt = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + principal_binding: { + ...boundJwtInput().principal_binding, + presented_key_hash: 'C'.repeat(43), + }, + }, boundContext()); + const x509 = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + principal_binding: { + ...boundX509Input().principal_binding, + presented_key_hash: 'D'.repeat(43), + }, + }, boundContext(x509Policy())); + assert.deepEqual(jwt, { ok: false, reason: 'aic_principal_binding_mismatch' }); + assert.deepEqual(x509, { ok: false, reason: 'aic_principal_binding_mismatch' }); +}); + +test('native results cannot self-pin relying-party trust or verifier policy', () => { + const untrusted = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + issuer_trust_anchor_digest: DIGEST('66'), + }, boundContext()); + const selfPinned = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + issuer_trust_anchor_digest: DIGEST('66'), + trusted_issuer_trust_anchor_digests: [DIGEST('66')], + } as any, boundContext()); + const emptyPolicy = mapAicJwtJktBoundCrossingAuthority( + boundJwtInput(), + boundContext({ + ...jwtPolicy(), + trusted_issuer_trust_anchor_digests: [], + }), + ); + const verifierSelfPin = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + native_verifier: { + ...JWT_VERIFIER, + implementation_digest: DIGEST('fe'), + }, + }, boundContext()); + assert.deepEqual(untrusted, { ok: false, reason: 'aic_issuer_untrusted' }); + assert.deepEqual(selfPinned, { ok: false, reason: 'mapping_input_invalid' }); + assert.deepEqual(emptyPolicy, { + ok: false, + reason: 'mapping_input_invalid', + }); + assert.deepEqual(verifierSelfPin, { + ok: false, + reason: 'aic_native_verifier_unpinned', + }); +}); + +test('raw carrier provenance refuses synthesized-certificate relabeling and type confusion', () => { + const wrongJwtCarrier = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + carrier_provenance: x509Input().carrier_provenance, + } as any, boundContext()); + const wrongTypToken = jwtCompactToken('JWT'); + const jwtTyp = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + artifact_digest: `sha256:${crypto.createHash('sha256') + .update(wrongTypToken, 'utf8') + .digest('hex')}`, + carrier_provenance: { + ...boundJwtInput().carrier_provenance, + compact_token: wrongTypToken, + }, + }, boundContext()); + const claimAsPresentedKey = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + carrier_provenance: { + source_carrier: 'AIC-JWT-COMPACT', + compact_token: JWT_COMPACT_TOKEN, + downstream_representation: 'DIRECT', + }, + } as any, boundContext()); + const jktAsX509 = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + principal_binding: jwtInput().principal_binding, + } as any, boundContext(x509Policy())); + const synthesizedJwtAsX509 = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + artifact_digest: JWT_ARTIFACT_DIGEST, + carrier_provenance: { + ...jwtInput().carrier_provenance, + downstream_representation: 'SYNTHESIZED-X509', + }, + } as any, boundContext(x509Policy())); + const synthesizedJwtAsJwt = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + carrier_provenance: { + ...boundJwtInput().carrier_provenance, + downstream_representation: 'SYNTHESIZED-X509', + }, + }, boundContext()); + const missingNativeDer = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + carrier_provenance: { + ...boundX509Input().carrier_provenance, + agent_certificate_der: '', + }, + }, boundContext(x509Policy())); + const changedBundleDigest = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + artifact_digest: DIGEST('ab'), + }, boundContext(x509Policy())); + const unsupportedSpkiHash = mapAicX509SpkiBoundCrossingAuthority({ + ...boundX509Input(), + principal_binding: { + kind: 'X509_SPKI', + hash_alg: 'sha-384', + claimed_key_hash: 'A'.repeat(64), + presented_key_hash: 'A'.repeat(64), + }, + } as any, boundContext(x509Policy())); + assert.deepEqual(wrongJwtCarrier, { + ok: false, + reason: 'aic_carrier_provenance_unverifiable', + }); + assert.deepEqual(jwtTyp, { + ok: false, + reason: 'aic_carrier_provenance_unverifiable', + }); + assert.deepEqual(claimAsPresentedKey, { + ok: false, + reason: 'aic_carrier_provenance_unverifiable', + }); + assert.deepEqual(jktAsX509, { ok: false, reason: 'aic_native_type_confusion' }); + assert.deepEqual(synthesizedJwtAsX509, { + ok: false, + reason: 'aic_carrier_provenance_unverifiable', + }); + assert.equal(synthesizedJwtAsJwt.ok, true, JSON.stringify(synthesizedJwtAsJwt)); + assert.deepEqual(missingNativeDer, { + ok: false, + reason: 'aic_carrier_provenance_unverifiable', + }); + assert.deepEqual(changedBundleDigest, { + ok: false, + reason: 'aic_carrier_artifact_digest_mismatch', + }); + assert.deepEqual(unsupportedSpkiHash, { + ok: false, + reason: 'aic_native_type_confusion', + }); +}); + +test('bound JWT mapping derives and pins the compact-token audience', () => { + const wrongAudienceToken = jwtCompactToken('aic+jwt', 'erp:other-system'); + const result = mapAicJwtJktBoundCrossingAuthority({ + ...boundJwtInput(), + artifact_digest: `sha256:${crypto.createHash('sha256') + .update(wrongAudienceToken, 'utf8') + .digest('hex')}`, + carrier_provenance: { + ...boundJwtInput().carrier_provenance, + compact_token: wrongAudienceToken, + }, + }, boundContext()); + assert.deepEqual(result, { ok: false, reason: 'aic_audience_mismatch' }); +}); + +test('strict JWT-SVID projection creates new typ=JWT TBS bytes and never passes aic+jwt through', () => { + const result = projectAicJwtToStrictJwtSvid({ + source: jwtInput(), + purpose: 'WORKLOAD_IDENTITY_ONLY', + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: 1788245940, + expires_at: 1788246240, + token_id: 'jwt-svid-projection-0001', + projected_algorithm: 'ES256', + projected_key_id: 'jwt-svid-key-2026-08', + }, projectionContext()); + assert.equal(result.ok, true, JSON.stringify(result)); + if (!result.ok) return; + assert.equal(result.projection['@version'], AIC_JWT_SVID_PROJECTION_VERSION); + assert.deepEqual(result.projection.protected_header, { + alg: 'ES256', + kid: 'jwt-svid-key-2026-08', + typ: 'JWT', + }); + assert.equal(result.projection.payload.aud, 'spiffe://services.example/payment-gate'); + assert.equal(result.projection.payload.sub, jwtInput().subject); + assert.equal('scope' in result.projection.payload, false); + assert.equal(result.projection.source.typ, 'aic+jwt'); + assert.equal(result.projection.source.token_digest, jwtInput().artifact_digest); + assert.equal(result.projection.new_signature_required, true); + assert.equal(result.projection.compact_token, null); + assert.equal(result.projection.authorization_decision, false); + assert.equal(result.projection.authority_semantics_preserved, false); + assert.deepEqual(result.projection.omitted_source_members, [ + 'iss', + 'aic.principal', + 'aic.capabilities', + 'aic.delegation_mode', + 'cnf', + ]); + assert.equal( + result.projection.projection_digest, + digestAebTyped( + { + protected_header: result.projection.protected_header, + payload: result.projection.payload, + source: result.projection.source, + purpose: result.projection.purpose, + omitted_source_members: result.projection.omitted_source_members, + authority_semantics_preserved: false, + new_signature_required: true, + }, + `${AIC_JWT_SVID_PROJECTION_VERSION}:projection`, + ), + ); +}); + +test('JWT-SVID projection refuses type confusion, multiple audiences, and authority-semantic loss', () => { + const base = { + source: jwtInput(), + purpose: 'WORKLOAD_IDENTITY_ONLY' as const, + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: null, + expires_at: 1788246240, + token_id: 'jwt-svid-projection-0001', + projected_algorithm: 'ES256' as const, + projected_key_id: 'jwt-svid-key-2026-08', + }; + assert.deepEqual( + projectAicJwtToStrictJwtSvid({ + ...base, + source: { + ...jwtInput(), + artifact_digest: `sha256:${crypto.createHash('sha256') + .update(jwtCompactToken('JWT'), 'utf8') + .digest('hex')}`, + carrier_provenance: { + ...jwtInput().carrier_provenance, + compact_token: jwtCompactToken('JWT'), + }, + }, + }, projectionContext()), + { ok: false, reason: 'aic_carrier_provenance_unverifiable' }, + ); + assert.deepEqual( + projectAicJwtToStrictJwtSvid({ + ...base, + audience: [...base.audience, 'spiffe://services.example/other'], + }, projectionContext()), + { ok: false, reason: 'jwt_svid_single_audience_required' }, + ); + assert.deepEqual( + projectAicJwtToStrictJwtSvid({ + ...base, + purpose: 'AIC_AUTHORITY', + }, projectionContext()), + { ok: false, reason: 'aic_jwt_svid_semantic_loss' }, + ); + assert.deepEqual( + projectAicJwtToStrictJwtSvid({ + ...base, + source: { + ...jwtInput(), + status: { ...jwtInput().status, value: 'REVOKED' }, + }, + }, projectionContext()), + { ok: false, reason: 'aic_status_not_current' }, + ); + assert.deepEqual( + projectAicJwtToStrictJwtSvid({ + ...base, + source: { + ...jwtInput(), + status: { ...jwtInput().status, checked_at: '2026-09-01T06:58:00Z' }, + }, + }, projectionContext()), + { ok: false, reason: 'jwt_svid_source_status_stale' }, + ); + assert.deepEqual( + projectAicJwtToStrictJwtSvid({ + ...base, + expires_at: 2099520000, + }, projectionContext()), + { ok: false, reason: 'jwt_svid_source_validity_mismatch' }, + ); + assert.deepEqual( + projectAicJwtToStrictJwtSvid({ + ...base, + has_constraints: true, + } as any, projectionContext()), + { ok: false, reason: 'jwt_svid_projection_input_invalid' }, + ); + assert.deepEqual( + projectAicJwtToStrictJwtSvid(base, { + ...projectionContext(), + max_status_age_seconds: AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + attacker_selected: true, + } as any), + { ok: false, reason: 'jwt_svid_projection_input_invalid' }, + ); +}); + +test('public AIC surfaces expose no unbound authority mapping', async () => { + const mainSurface = await import('./index.js'); + const subpathSurface = await import('./aeb-aic-crossing-adapter.js'); + const forbidden = [ + 'AIC_JWT_JKT_CROSSING_MAPPING_PROFILE', + 'AIC_X509_SPKI_CROSSING_MAPPING_PROFILE', + 'mapAicJwtJktCrossingAuthority', + 'mapAicX509SpkiCrossingAuthority', + ]; + for (const name of forbidden) { + assert.equal(name in mainSurface, false, `${name} leaked from the package main entry`); + assert.equal(name in subpathSurface, false, `${name} leaked from the AIC subpath`); + } + assert.equal( + typeof (subpathSurface as Record).issueAicBoundCrossingRecord, + 'function', + ); +}); + +test('AIC bound issuance refuses an action or boundary mismatch before signing', async () => { + const issueAicBound = (aicAdapterSurface as Record) + .issueAicBoundCrossingRecord; + assert.equal(typeof issueAicBound, 'function'); + if (typeof issueAicBound !== 'function') return; + + const actionMismatch = await (issueAicBound as (...args: any[]) => Promise)( + boundJwtInput(), + boundContext(), + { + ...boundIssueDraft(), + action: { ...ACTION, action_digest: DIGEST('fa') }, + }, + { signing_keys: [] }, + ); + assert.deepEqual(actionMismatch, { + ok: false, + reason: 'aic_crossing_issue_action_mismatch', + }); + + const boundaryMismatch = await (issueAicBound as (...args: any[]) => Promise)( + boundJwtInput(), + boundContext(), + { + ...boundIssueDraft(), + boundary: { + ...ADMISSION_DOMAIN, + relying_party_id: 'rp:other-company', + }, + }, + { signing_keys: [] }, + ); + assert.deepEqual(boundaryMismatch, { + ok: false, + reason: 'aic_crossing_issue_admission_domain_mismatch', + }); +}); + +test('AIC issuance snapshots trusted state and signing options before hostile input', async () => { + const mismatchContext = structuredClone(boundContext()); + const mismatchDraft = structuredClone(boundIssueDraft()); + mismatchDraft.boundary.relying_party_id = 'rp:other-company'; + const mismatchOptions = { signing_keys: [] }; + const accessorInput = structuredClone(boundJwtInput()); + let getterCalls = 0; + Object.defineProperty(accessorInput, 'native_verification', { + enumerable: true, + configurable: true, + get() { + getterCalls += 1; + mismatchContext.admission_domain.relying_party_id = + mismatchDraft.boundary.relying_party_id; + accessorInput.request_binding.projected_admission_domain_digest = + digestAebTyped( + mismatchContext.admission_domain, + 'EP-AIC-ADMISSION-DOMAIN-v1', + ); + mismatchOptions.signing_keys.length = 0; + return 'VERIFIED'; + }, + }); + const mismatch = await issueAicBoundCrossingRecord( + accessorInput, + mismatchContext, + mismatchDraft, + mismatchOptions, + ); + assert.deepEqual(mismatch, { + ok: false, + reason: 'aic_crossing_issue_admission_domain_mismatch', + }); + assert.equal(getterCalls, 0, 'trusted mismatch must refuse without invoking input accessors'); + + const context = structuredClone(boundContext()); + const draft = structuredClone(boundIssueDraft()); + const pqPrivateKey = new Uint8Array(ML_DSA_65_SECRET_KEY_BYTES).fill(7); + const { privateKey: ed25519PrivateKey } = crypto.generateKeyPairSync('ed25519'); + let backendCalls = 0; + let observedPrivateKeyByte = -1; + let observedDeterministic = false; + const originalBackend = { + sign( + _message: Uint8Array, + privateKey: Uint8Array, + options?: { extraEntropy?: Uint8Array | false }, + ) { + backendCalls += 1; + observedPrivateKeyByte = privateKey[0] ?? -1; + observedDeterministic = options?.extraEntropy === false; + return new Uint8Array(ML_DSA_65_SIGNATURE_BYTES).fill(1); + }, + verify() { + return true; + }, + }; + const signingOptions = { + signing_keys: [ + { + alg: 'Ed25519', + private_key: ed25519PrivateKey, + key_id: 'aic-test-ed25519', + }, + { + alg: 'ML-DSA-65', + private_key: pqPrivateKey, + key_id: 'aic-test-ml-dsa-65', + }, + ], + deterministic: true, + mldsaBackend: originalBackend, + }; + let proxyTrapCalls = 0; + const proxiedInput = new Proxy(structuredClone(boundJwtInput()), { + getPrototypeOf(target) { + proxyTrapCalls += 1; + context.admission_domain.relying_party_id = 'rp:mutated-after-snapshot'; + draft.boundary.relying_party_id = 'rp:mutated-after-snapshot'; + pqPrivateKey.fill(9); + signingOptions.signing_keys.length = 0; + signingOptions.deterministic = false; + signingOptions.mldsaBackend = { + sign() { + throw new Error('mutated backend must not run'); + }, + verify() { + return false; + }, + }; + return Reflect.getPrototypeOf(target); + }, + }); + const issued = await issueAicBoundCrossingRecord( + proxiedInput, + context, + draft, + signingOptions, + ); + assert.equal(issued.ok, true, JSON.stringify(issued)); + if (!issued.ok) return; + assert.ok(proxyTrapCalls > 0); + assert.equal(issued.record.body.boundary.relying_party_id, ADMISSION_DOMAIN.relying_party_id); + assert.equal(issued.record.body.action.action_digest, ACTION.action_digest); + assert.equal(backendCalls, 1); + assert.equal(observedPrivateKeyByte, 7, 'ML-DSA key bytes must be copied before input inspection'); + assert.equal(observedDeterministic, true, 'deterministic signing option must be snapshotted'); +}); + +test('native failure short-circuits carrier parsing after structural validation', () => { + assert.deepEqual( + mapAicJwtJktBoundCrossingAuthority( + { + ...boundJwtInput(), + native_verification: 'FAILED', + carrier_provenance: { + ...boundJwtInput().carrier_provenance, + compact_token: 'not-a-compact-jwt', + }, + }, + boundContext(), + ), + { ok: false, reason: 'aic_native_verification_failed' }, + ); + assert.deepEqual( + mapAicX509SpkiBoundCrossingAuthority( + { + ...boundX509Input(), + native_verification: 'INDETERMINATE', + carrier_provenance: { + ...boundX509Input().carrier_provenance, + agent_certificate_der: 'not-der', + }, + }, + boundContext(x509Policy()), + ), + { ok: false, reason: 'aic_native_verification_indeterminate' }, + ); + assert.deepEqual( + projectAicJwtToStrictJwtSvid({ + source: { + ...jwtInput(), + native_verification: 'FAILED', + carrier_provenance: { + ...jwtInput().carrier_provenance, + compact_token: 'not-a-compact-jwt', + }, + }, + purpose: 'WORKLOAD_IDENTITY_ONLY', + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: null, + expires_at: 1788246240, + token_id: 'jwt-svid-failed-source', + projected_algorithm: 'ES256', + projected_key_id: 'jwt-svid-key-2026-08', + }, projectionContext()), + { ok: false, reason: 'aic_native_verification_failed' }, + ); +}); + +test('JWT-SVID projection digest binds the accepted source evaluation', () => { + const projectionInput = { + source: jwtInput(), + purpose: 'WORKLOAD_IDENTITY_ONLY' as const, + audience: ['spiffe://services.example/payment-gate'], + issued_at: 1788246000, + not_before: null, + expires_at: 1788246240, + token_id: 'jwt-svid-source-evaluation-binding', + projected_algorithm: 'ES256' as const, + projected_key_id: 'jwt-svid-key-2026-08', + }; + const original = projectAicJwtToStrictJwtSvid( + projectionInput, + projectionContext(), + ); + const changedEvidence = projectAicJwtToStrictJwtSvid({ + ...projectionInput, + source: { + ...projectionInput.source, + native_verification_evidence_digest: DIGEST('ef'), + }, + }, projectionContext()); + const changedStatusHead = projectAicJwtToStrictJwtSvid({ + ...projectionInput, + source: { + ...projectionInput.source, + status: { + ...projectionInput.source.status, + source_head_digest: DIGEST('f0'), + }, + }, + }, projectionContext()); + const changedPolicy = projectAicJwtToStrictJwtSvid( + projectionInput, + { + ...projectionContext(), + source_verification_policy: { + ...projectionContext().source_verification_policy, + source_verification_profile_digest: DIGEST('f1'), + }, + }, + ); + assert.equal(original.ok, true, JSON.stringify(original)); + assert.equal(changedEvidence.ok, true, JSON.stringify(changedEvidence)); + assert.equal(changedStatusHead.ok, true, JSON.stringify(changedStatusHead)); + assert.equal(changedPolicy.ok, true, JSON.stringify(changedPolicy)); + if (!original.ok || !changedEvidence.ok || !changedStatusHead.ok || !changedPolicy.ok) { + return; + } + assert.notEqual( + original.projection.projection_digest, + changedEvidence.projection.projection_digest, + ); + assert.notEqual( + original.projection.projection_digest, + changedStatusHead.projection.projection_digest, + ); + assert.notEqual( + original.projection.projection_digest, + changedPolicy.projection.projection_digest, + ); +}); diff --git a/packages/verify/aeb-crossing-record.test.js b/packages/verify/aeb-crossing-record.test.js index 93de515dd..b8289f68e 100644 --- a/packages/verify/aeb-crossing-record.test.js +++ b/packages/verify/aeb-crossing-record.test.js @@ -5,7 +5,7 @@ import assert from "node:assert/strict"; import crypto from "node:crypto"; import { test } from "node:test"; import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js"; -import { AEB_CROSSING_RECORD_REQUIRED_ALGORITHMS, AEB_CROSSING_RECORD_VERSION, BCR_CROSSING_MAPPING_PROFILE, WIMSE_OAUTH_CROSSING_MAPPING_PROFILE, issueAebCrossingRecord, mapBcrCrossingAuthority, mapWimseOAuthCrossingAuthority, verifyAebCrossingRecord, } from "./dist/aeb-crossing-record.js"; +import { AEB_CROSSING_RECORD_REQUIRED_ALGORITHMS, AEB_CROSSING_RECORD_VERSION, BCR_CROSSING_MAPPING_PROFILE, WIMSE_OAUTH_CROSSING_MAPPING_PROFILE, crossingRecordContractDigest, issueAebCrossingRecord, mapBcrCrossingAuthority, mapWimseOAuthCrossingAuthority, verifyAebCrossingRecord, } from "./dist/aeb-crossing-record.js"; import { digestAebTyped } from "./dist/aeb-adapter-contract.js"; import { loadDefaultAgilityMldsaBackend } from "./dist/pq-signature-agility.js"; const ED_PRIVATE_JWK = { @@ -194,6 +194,27 @@ test("different native authority systems produce different records accepted by t assert.equal((await verify(wimse)).verified, true); assert.equal((await verify(bcr)).verified, true); }); +test("the v1 contract digest remains compatible across relying-party labels", () => { + const authority = wimseAuthority(); + const common = { + native_authority: authority, + action: ACTION, + requirements: REQUIREMENTS, + }; + const finance = crossingRecordContractDigest({ + ...common, + boundary: BOUNDARY, + }); + const attacker = crossingRecordContractDigest({ + ...common, + boundary: { + ...BOUNDARY, + relying_party_id: "rp:attacker-controlled", + }, + }); + assert.equal(finance, attacker); + assert.equal(finance, "sha256:0d17ad047e432fd235d60ae06ab6f819691d90dc3b09ecf553b33d4d2c0472fc"); +}); test("signature stripping and algorithm-set narrowing both refuse", async () => { const record = await issue(); const stripped = structuredClone(record); diff --git a/packages/verify/aeb-crossing-record.test.ts b/packages/verify/aeb-crossing-record.test.ts index ce7ea2c17..e9b9c375b 100644 --- a/packages/verify/aeb-crossing-record.test.ts +++ b/packages/verify/aeb-crossing-record.test.ts @@ -10,6 +10,7 @@ import { AEB_CROSSING_RECORD_VERSION, BCR_CROSSING_MAPPING_PROFILE, WIMSE_OAUTH_CROSSING_MAPPING_PROFILE, + crossingRecordContractDigest, issueAebCrossingRecord, mapBcrCrossingAuthority, mapWimseOAuthCrossingAuthority, @@ -239,6 +240,31 @@ test("different native authority systems produce different records accepted by t assert.equal((await verify(bcr)).verified, true); }); +test("the v1 contract digest remains compatible across relying-party labels", () => { + const authority = wimseAuthority(); + const common = { + native_authority: authority, + action: ACTION, + requirements: REQUIREMENTS, + }; + const finance = crossingRecordContractDigest({ + ...common, + boundary: BOUNDARY, + }); + const attacker = crossingRecordContractDigest({ + ...common, + boundary: { + ...BOUNDARY, + relying_party_id: "rp:attacker-controlled", + }, + }); + assert.equal(finance, attacker); + assert.equal( + finance, + "sha256:0d17ad047e432fd235d60ae06ab6f819691d90dc3b09ecf553b33d4d2c0472fc", + ); +}); + test("signature stripping and algorithm-set narrowing both refuse", async () => { const record = await issue(); const stripped = structuredClone(record); diff --git a/packages/verify/dist/aeb-aic-crossing-adapter.d.ts b/packages/verify/dist/aeb-aic-crossing-adapter.d.ts new file mode 100644 index 000000000..8f275fc98 --- /dev/null +++ b/packages/verify/dist/aeb-aic-crossing-adapter.d.ts @@ -0,0 +1,193 @@ +import { type AebDigest } from './aeb-adapter-contract.js'; +import { type AebCrossingRecord, type AebCrossingRecordDraft, type AebCrossingRecordIssueOptions, type CrossingAuthorityMappingResult, type CrossingNativeStatus, type CrossingNativeVerification, type CrossingValidity } from './aeb-crossing-record.js'; +export declare const AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE = "EP-AEB-CROSSING-AIC-JWT-JKT-BOUND-v2"; +export declare const AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE = "EP-AEB-CROSSING-AIC-X509-SPKI-BOUND-v2"; +export declare const AIC_ADMISSION_DOMAIN_VERSION = "EP-AIC-ADMISSION-DOMAIN-v1"; +export declare const AIC_JWT_SVID_PROJECTION_VERSION = "EP-AIC-JWT-SVID-PROJECTION-v1"; +export declare const AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE = "EP-AIC-JWT-SVID-SOURCE-VERIFICATION-v1"; +export declare const AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION = "EP-AIC-X509-CREDENTIAL-BUNDLE-v1"; +export declare const AIC_CROSSING_MAX_STATUS_AGE_SECONDS = 60; +export type AicSpkiHashAlgorithm = 'sha-256'; +export type AicJwtDownstreamRepresentation = 'DIRECT' | 'SYNTHESIZED-X509'; +export type AicPrincipalPublicJwk = { + kty: 'EC'; + crv: string; + x: string; + y: string; +} | { + kty: 'RSA'; + n: string; + e: string; +} | { + kty: 'OKP'; + crv: string; + x: string; +}; +export interface AicNativeVerifierDescriptor { + id: string; + version: string; + implementation_digest: AebDigest; +} +export interface AicCrossingRelyingPartyPolicy { + mapping_profile_id: string; + mapping_profile_digest: AebDigest; + action_projection_profile_id: string; + action_projection_profile_digest: AebDigest; + trusted_issuer_trust_anchor_digests: AebDigest[]; + native_verifier: AicNativeVerifierDescriptor; +} +export interface AicJwtCarrierProvenance { + source_carrier: 'AIC-JWT-COMPACT'; + compact_token: string; + presented_principal_jwk: AicPrincipalPublicJwk; + downstream_representation: AicJwtDownstreamRepresentation; +} +export interface AicX509CarrierProvenance { + source_carrier: 'AIC-X509-CREDENTIAL-BUNDLE'; + agent_certificate_der: string; + principal_certificate_der: string; +} +export interface AicRfc7638JktBinding { + kind: 'RFC7638_JKT'; + hash_alg: 'jkt'; + claimed_key_hash: string; + presented_key_hash: string; +} +export interface AicX509SpkiBinding { + kind: 'X509_SPKI'; + hash_alg: AicSpkiHashAlgorithm; + claimed_key_hash: string; + presented_key_hash: string; +} +interface AicCrossingCommonInput { + native_verification: CrossingNativeVerification; + native_verifier: AicNativeVerifierDescriptor; + native_verification_evidence_digest: AebDigest; + issuer: string; + subject: string; + artifact_id: string; + artifact_digest: AebDigest; + issuer_trust_anchor_digest: AebDigest; + constraints_digest: AebDigest; + status: CrossingNativeStatus; + validity: CrossingValidity; +} +export interface AicCrossingExactAction { + caid: string; + action_digest: AebDigest; +} +export interface AicCrossingAdmissionDomain { + relying_party_id: string; + audience: string; + executor_id: string; + state_domain_id: string; +} +export interface AicCrossingRequestBinding { + action_projection_profile_id: string; + action_projection_profile_digest: AebDigest; + requested_capability_digest: AebDigest; + projected_action: AicCrossingExactAction; + projected_admission_domain_digest: AebDigest; +} +export interface AicCrossingRelyingPartyContext { + action: AicCrossingExactAction; + admission_domain: AicCrossingAdmissionDomain; + requested_capability_digest: AebDigest; + evaluated_at: string; + max_status_age_seconds: number; + policy: AicCrossingRelyingPartyPolicy; +} +export interface AicJwtJktCrossingInput extends AicCrossingCommonInput { + carrier_provenance: AicJwtCarrierProvenance; + principal_binding: AicRfc7638JktBinding; +} +export interface AicX509SpkiCrossingInput extends AicCrossingCommonInput { + carrier_provenance: AicX509CarrierProvenance; + principal_binding: AicX509SpkiBinding; +} +export interface AicJwtJktBoundCrossingInput extends AicJwtJktCrossingInput { + request_binding: AicCrossingRequestBinding; +} +export interface AicX509SpkiBoundCrossingInput extends AicX509SpkiCrossingInput { + request_binding: AicCrossingRequestBinding; +} +export type AicBoundCrossingInput = AicJwtJktBoundCrossingInput | AicX509SpkiBoundCrossingInput; +export type AicBoundCrossingRecordDraft = Omit; +export type AicBoundCrossingRecordIssueResult = { + ok: true; + record: AebCrossingRecord; +} | { + ok: false; + reason: string; +}; +export type AicJwtSvidProjectionPurpose = 'WORKLOAD_IDENTITY_ONLY' | 'AIC_AUTHORITY'; +export interface AicJwtSvidProjectionInput { + source: AicJwtJktCrossingInput; + purpose: AicJwtSvidProjectionPurpose; + audience: string[]; + issued_at: number; + not_before: number | null; + expires_at: number; + token_id: string; + projected_algorithm: 'ES256' | 'RS256'; + projected_key_id: string; +} +export interface AicJwtSvidSourceVerificationPolicy { + source_verification_profile_id: typeof AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE; + source_verification_profile_digest: AebDigest; + trusted_issuer_trust_anchor_digests: AebDigest[]; + native_verifier: AicNativeVerifierDescriptor; +} +export interface AicJwtSvidProjectionRelyingPartyContext { + source_verification_policy: AicJwtSvidSourceVerificationPolicy; + evaluated_at: string; + max_status_age_seconds: number; +} +export interface AicStrictJwtSvidProjection { + '@version': typeof AIC_JWT_SVID_PROJECTION_VERSION; + protected_header: { + alg: 'ES256' | 'RS256'; + kid: string; + typ: 'JWT'; + }; + payload: { + sub: string; + aud: string; + iat: number; + exp: number; + nbf?: number; + jti: string; + }; + source: { + typ: 'aic+jwt'; + issuer: string; + token_digest: AebDigest; + source_semantics_digest: AebDigest; + source_evaluation_digest: AebDigest; + }; + purpose: 'WORKLOAD_IDENTITY_ONLY'; + omitted_source_members: string[]; + authority_semantics_preserved: false; + new_signature_required: true; + compact_token: null; + authorization_decision: false; + projection_digest: AebDigest; +} +export type AicJwtSvidProjectionResult = { + ok: true; + projection: AicStrictJwtSvidProjection; +} | { + ok: false; + reason: string; +}; +export declare function mapAicJwtJktBoundCrossingAuthority(input: AicJwtJktBoundCrossingInput, context: AicCrossingRelyingPartyContext): CrossingAuthorityMappingResult; +export declare function mapAicX509SpkiBoundCrossingAuthority(input: AicX509SpkiBoundCrossingInput, context: AicCrossingRelyingPartyContext): CrossingAuthorityMappingResult; +/** + * Maps a bound AIC result and issues its crossing record as one operation. + * The caller-supplied record action and boundary must exactly match the + * relying-party context before the generic signer is reached. + */ +export declare function issueAicBoundCrossingRecord(input: AicBoundCrossingInput, context: AicCrossingRelyingPartyContext, draft: AicBoundCrossingRecordDraft, options: AebCrossingRecordIssueOptions): Promise; +export declare function projectAicJwtToStrictJwtSvid(input: AicJwtSvidProjectionInput, context: AicJwtSvidProjectionRelyingPartyContext): AicJwtSvidProjectionResult; +export {}; +//# sourceMappingURL=aeb-aic-crossing-adapter.d.ts.map \ No newline at end of file diff --git a/packages/verify/dist/aeb-aic-crossing-adapter.d.ts.map b/packages/verify/dist/aeb-aic-crossing-adapter.d.ts.map new file mode 100644 index 000000000..3a1e51317 --- /dev/null +++ b/packages/verify/dist/aeb-aic-crossing-adapter.d.ts.map @@ -0,0 +1 @@ +{"version":3,"file":"aeb-aic-crossing-adapter.d.ts","sourceRoot":"","sources":["../src/aeb-aic-crossing-adapter.ts"],"names":[],"mappings":"AAwBA,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EAEnC,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,0CAA0C,yCACf,CAAC;AACzC,eAAO,MAAM,4CAA4C,2CACf,CAAC;AAC3C,eAAO,MAAM,4BAA4B,+BACX,CAAC;AAC/B,eAAO,MAAM,+BAA+B,kCACX,CAAC;AAClC,eAAO,MAAM,wCAAwC,2CACX,CAAC;AAC3C,eAAO,MAAM,yCAAyC,qCAClB,CAAC;AAIrC,eAAO,MAAM,mCAAmC,KAAK,CAAC;AAEtD,MAAM,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAC7C,MAAM,MAAM,8BAA8B,GAAG,QAAQ,GAAG,kBAAkB,CAAC;AAE3E,MAAM,MAAM,qBAAqB,GAC7B;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB,EAAE,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,6BAA6B;IAC5C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,SAAS,CAAC;IAClC,4BAA4B,EAAE,MAAM,CAAC;IACrC,gCAAgC,EAAE,SAAS,CAAC;IAC5C,mCAAmC,EAAE,SAAS,EAAE,CAAC;IACjD,eAAe,EAAE,2BAA2B,CAAC;CAC9C;AAED,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,iBAAiB,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,qBAAqB,CAAC;IAC/C,yBAAyB,EAAE,8BAA8B,CAAC;CAC3D;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,4BAA4B,CAAC;IAC7C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,sBAAsB;IAC9B,mBAAmB,EAAE,0BAA0B,CAAC;IAChD,eAAe,EAAE,2BAA2B,CAAC;IAC7C,mCAAmC,EAAE,SAAS,CAAC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,SAAS,CAAC;IAC3B,0BAA0B,EAAE,SAAS,CAAC;IACtC,kBAAkB,EAAE,SAAS,CAAC;IAC9B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,4BAA4B,EAAE,MAAM,CAAC;IACrC,gCAAgC,EAAE,SAAS,CAAC;IAC5C,2BAA2B,EAAE,SAAS,CAAC;IACvC,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,iCAAiC,EAAE,SAAS,CAAC;CAC9C;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,2BAA2B,EAAE,SAAS,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,kBAAkB,EAAE,uBAAuB,CAAC;IAC5C,iBAAiB,EAAE,oBAAoB,CAAC;CACzC;AAED,MAAM,WAAW,wBAAyB,SAAQ,sBAAsB;IACtE,kBAAkB,EAAE,wBAAwB,CAAC;IAC7C,iBAAiB,EAAE,kBAAkB,CAAC;CACvC;AAED,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,eAAe,EAAE,yBAAyB,CAAC;CAC5C;AAED,MAAM,WAAW,6BAA8B,SAAQ,wBAAwB;IAC7E,eAAe,EAAE,yBAAyB,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,6BAA6B,CAAC;AAElC,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC5C,sBAAsB,EACtB,kBAAkB,CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GACzC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,MAAM,MAAM,2BAA2B,GACnC,wBAAwB,GACxB,eAAe,CAAC;AAEpB,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,2BAA2B,CAAC;IACrC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,OAAO,GAAG,OAAO,CAAC;IACvC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kCAAkC;IACjD,8BAA8B,EAC5B,OAAO,wCAAwC,CAAC;IAClD,kCAAkC,EAAE,SAAS,CAAC;IAC9C,mCAAmC,EAAE,SAAS,EAAE,CAAC;IACjD,eAAe,EAAE,2BAA2B,CAAC;CAC9C;AAED,MAAM,WAAW,uCAAuC;IACtD,0BAA0B,EAAE,kCAAkC,CAAC;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,OAAO,+BAA+B,CAAC;IACnD,gBAAgB,EAAE;QAChB,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QACvB,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,KAAK,CAAC;KACZ,CAAC;IACF,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,MAAM,EAAE;QACN,GAAG,EAAE,SAAS,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,SAAS,CAAC;QACxB,uBAAuB,EAAE,SAAS,CAAC;QACnC,wBAAwB,EAAE,SAAS,CAAC;KACrC,CAAC;IACF,OAAO,EAAE,wBAAwB,CAAC;IAClC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,6BAA6B,EAAE,KAAK,CAAC;IACrC,sBAAsB,EAAE,IAAI,CAAC;IAC7B,aAAa,EAAE,IAAI,CAAC;IACpB,sBAAsB,EAAE,KAAK,CAAC;IAC9B,iBAAiB,EAAE,SAAS,CAAC;CAC9B;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,0BAA0B,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwxBlC,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,2BAA2B,EAClC,OAAO,EAAE,8BAA8B,GACtC,8BAA8B,CA8DhC;AAED,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,6BAA6B,EACpC,OAAO,EAAE,8BAA8B,GACtC,8BAA8B,CAkDhC;AAyID;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,8BAA8B,EACvC,KAAK,EAAE,2BAA2B,EAClC,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,iCAAiC,CAAC,CAkE5C;AAyID,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,uCAAuC,GAC/C,0BAA0B,CA0H5B"} \ No newline at end of file diff --git a/packages/verify/dist/aeb-aic-crossing-adapter.js b/packages/verify/dist/aeb-aic-crossing-adapter.js new file mode 100644 index 000000000..483529341 --- /dev/null +++ b/packages/verify/dist/aeb-aic-crossing-adapter.js @@ -0,0 +1,1224 @@ +// SPDX-License-Identifier: Apache-2.0 +/** + * AIC native-authority mappings for EP-AEB-CROSSING-RECORD-v1. + * + * The adapter consumes the result of an AIC native verifier. It does not + * reimplement AIC-JWT signature, delegation, capability, constraint, status, + * or X.509 path validation. It keeps the RFC 7638 JWK-thumbprint and X.509 + * SPKI-hash paths separate, derives carrier fingerprints and identifiers from + * supplied raw carrier material, and keeps relying-party policy structurally + * separate from the native verifier result. Authenticating that the native + * verifier saw the same carrier bytes remains the deployment wrapper's + * responsibility. The pinned upstream + * bearer helper returns a bare synthesized X.509 object without authenticated + * provenance, so that object cannot enter the native X.509 mapping: the latter + * requires real agent and principal certificate DER. A deployment still needs + * to preserve this provenance inside its trusted verifier boundary. + * + * The JWT-SVID helper emits only a to-be-signed identity projection. Rewriting + * the protected header would invalidate the AIC-JWT signature, so a deployment + * must issue a new typ=JWT token under a key in its JWT-SVID bundle. The + * projection is never an AIC authority decision. + */ +import crypto, { X509Certificate } from 'node:crypto'; +import { canonicalizeAeb, digestAebTyped, } from './aeb-adapter-contract.js'; +import { issueAebCrossingRecord, } from './aeb-crossing-record.js'; +export const AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE = 'EP-AEB-CROSSING-AIC-JWT-JKT-BOUND-v2'; +export const AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE = 'EP-AEB-CROSSING-AIC-X509-SPKI-BOUND-v2'; +export const AIC_ADMISSION_DOMAIN_VERSION = 'EP-AIC-ADMISSION-DOMAIN-v1'; +export const AIC_JWT_SVID_PROJECTION_VERSION = 'EP-AIC-JWT-SVID-PROJECTION-v1'; +export const AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE = 'EP-AIC-JWT-SVID-SOURCE-VERIFICATION-v1'; +export const AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION = 'EP-AIC-X509-CREDENTIAL-BUNDLE-v1'; +// The reusable adapter does not load or authenticate the reference mapping- +// profile JSON. Relying-party policy supplies that profile's provenance and +// digest; this constant enforces the v0.2 runtime freshness semantic itself. +export const AIC_CROSSING_MAX_STATUS_AGE_SECONDS = 60; +const DIGEST_RE = /^sha256:[0-9a-f]{64}$/; +const CAID_RE = /^caid:1:[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)*\.[1-9][0-9]*:jcs-sha256:[A-Za-z0-9_-]{43}$/; +const IDENTIFIER_RE = /^[A-Za-z0-9][A-Za-z0-9:_.@/#-]{0,511}$/; +const BASE64URL_RE = /^[A-Za-z0-9_-]+$/; +const MAX_AIC_JWT_BYTES = 64 * 1024; +const MAX_AIC_CERTIFICATE_BYTES = 64 * 1024; +const COMMON_KEYS = new Set([ + 'native_verification', + 'native_verifier', + 'native_verification_evidence_digest', + 'issuer', + 'subject', + 'artifact_id', + 'artifact_digest', + 'issuer_trust_anchor_digest', + 'constraints_digest', + 'status', + 'validity', +]); +const JWT_INPUT_KEYS = new Set([ + ...COMMON_KEYS, + 'carrier_provenance', + 'principal_binding', +]); +const X509_INPUT_KEYS = new Set([ + ...COMMON_KEYS, + 'carrier_provenance', + 'principal_binding', +]); +const BOUND_JWT_INPUT_KEYS = new Set([...JWT_INPUT_KEYS, 'request_binding']); +const BOUND_X509_INPUT_KEYS = new Set([...X509_INPUT_KEYS, 'request_binding']); +const REQUEST_BINDING_KEYS = new Set([ + 'action_projection_profile_id', + 'action_projection_profile_digest', + 'requested_capability_digest', + 'projected_action', + 'projected_admission_domain_digest', +]); +const ACTION_KEYS = new Set(['caid', 'action_digest']); +const ADMISSION_DOMAIN_KEYS = new Set([ + 'relying_party_id', + 'audience', + 'executor_id', + 'state_domain_id', +]); +const RP_CONTEXT_KEYS = new Set([ + 'action', + 'admission_domain', + 'requested_capability_digest', + 'evaluated_at', + 'max_status_age_seconds', + 'policy', +]); +const RP_POLICY_KEYS = new Set([ + 'mapping_profile_id', + 'mapping_profile_digest', + 'action_projection_profile_id', + 'action_projection_profile_digest', + 'trusted_issuer_trust_anchor_digests', + 'native_verifier', +]); +const VERIFIER_DESCRIPTOR_KEYS = new Set(['id', 'version', 'implementation_digest']); +const JWT_PROVENANCE_KEYS = new Set([ + 'source_carrier', + 'compact_token', + 'presented_principal_jwk', + 'downstream_representation', +]); +const X509_PROVENANCE_KEYS = new Set([ + 'source_carrier', + 'agent_certificate_der', + 'principal_certificate_der', +]); +const BINDING_KEYS = new Set([ + 'kind', + 'hash_alg', + 'claimed_key_hash', + 'presented_key_hash', +]); +const STATUS_KEYS = new Set(['value', 'checked_at', 'source_head_digest']); +const VALIDITY_KEYS = new Set(['not_before', 'not_after']); +const PROJECTION_INPUT_KEYS = new Set([ + 'source', + 'purpose', + 'audience', + 'issued_at', + 'not_before', + 'expires_at', + 'token_id', + 'projected_algorithm', + 'projected_key_id', +]); +const PROJECTION_CONTEXT_KEYS = new Set([ + 'source_verification_policy', + 'evaluated_at', + 'max_status_age_seconds', +]); +const PROJECTION_SOURCE_POLICY_KEYS = new Set([ + 'source_verification_profile_id', + 'source_verification_profile_digest', + 'trusted_issuer_trust_anchor_digests', + 'native_verifier', +]); +const ISSUE_OPTION_KEYS = new Set([ + 'signing_keys', + 'mldsaBackend', + 'mldsaBackendLoader', + 'deterministic', +]); +const ISSUE_SIGNING_KEY_KEYS = new Set([ + 'alg', + 'private_key', + 'key_id', +]); +const NATIVE_VERIFICATIONS = new Set([ + 'VERIFIED', + 'FAILED', + 'INDETERMINATE', +]); +const STATUSES = new Set([ + 'CURRENT', + 'STALE', + 'UNAVAILABLE', + 'REVOKED', + 'INDETERMINATE', +]); +function isRecord(value) { + if (value === null || typeof value !== 'object' || Array.isArray(value)) + return false; + const prototype = Object.getPrototypeOf(value); + return prototype === Object.prototype || prototype === null; +} +function exactKeys(value, expected) { + const keys = Reflect.ownKeys(value); + return keys.length === expected.size + && keys.every((key) => typeof key === 'string' && expected.has(key)); +} +function identifier(value) { + return typeof value === 'string' + && IDENTIFIER_RE.test(value) + && !/[\u0000-\u001f\u007f]/.test(value); +} +function digest(value) { + return typeof value === 'string' && DIGEST_RE.test(value); +} +function instant(value) { + return typeof value === 'string' + && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(value) + && Number.isFinite(Date.parse(value)); +} +function validStatus(value) { + return isRecord(value) + && exactKeys(value, STATUS_KEYS) + && typeof value.value === 'string' + && STATUSES.has(value.value) + && instant(value.checked_at) + && digest(value.source_head_digest); +} +function validValidity(value) { + return isRecord(value) + && exactKeys(value, VALIDITY_KEYS) + && instant(value.not_before) + && instant(value.not_after) + && Date.parse(value.not_before) < Date.parse(value.not_after); +} +function validAction(value) { + return isRecord(value) + && exactKeys(value, ACTION_KEYS) + && typeof value.caid === 'string' + && CAID_RE.test(value.caid) + && digest(value.action_digest); +} +function validAdmissionDomain(value) { + return isRecord(value) + && exactKeys(value, ADMISSION_DOMAIN_KEYS) + && identifier(value.relying_party_id) + && identifier(value.audience) + && identifier(value.executor_id) + && identifier(value.state_domain_id); +} +function validRequestBinding(value) { + return isRecord(value) + && exactKeys(value, REQUEST_BINDING_KEYS) + && identifier(value.action_projection_profile_id) + && digest(value.action_projection_profile_digest) + && digest(value.requested_capability_digest) + && validAction(value.projected_action) + && digest(value.projected_admission_domain_digest); +} +function validVerifierDescriptor(value) { + return isRecord(value) + && exactKeys(value, VERIFIER_DESCRIPTOR_KEYS) + && identifier(value.id) + && identifier(value.version) + && digest(value.implementation_digest); +} +function validRelyingPartyPolicy(value) { + return isRecord(value) + && exactKeys(value, RP_POLICY_KEYS) + && identifier(value.mapping_profile_id) + && digest(value.mapping_profile_digest) + && identifier(value.action_projection_profile_id) + && digest(value.action_projection_profile_digest) + && validTrustSet(value.trusted_issuer_trust_anchor_digests) + && validVerifierDescriptor(value.native_verifier); +} +function validRelyingPartyContext(value) { + return isRecord(value) + && exactKeys(value, RP_CONTEXT_KEYS) + && validAction(value.action) + && validAdmissionDomain(value.admission_domain) + && digest(value.requested_capability_digest) + && instant(value.evaluated_at) + && Number.isSafeInteger(value.max_status_age_seconds) + && Number(value.max_status_age_seconds) >= 0 + && Number(value.max_status_age_seconds) <= 86_400 + && validRelyingPartyPolicy(value.policy); +} +function validTrustSet(value) { + return Array.isArray(value) + && value.length > 0 + && value.length <= 64 + && value.every(digest) + && new Set(value).size === value.length; +} +function validProjectionSourcePolicy(value) { + return isRecord(value) + && exactKeys(value, PROJECTION_SOURCE_POLICY_KEYS) + && value.source_verification_profile_id + === AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE + && digest(value.source_verification_profile_digest) + && validTrustSet(value.trusted_issuer_trust_anchor_digests) + && validVerifierDescriptor(value.native_verifier); +} +function commonValid(value) { + return NATIVE_VERIFICATIONS.has(value.native_verification) + && validVerifierDescriptor(value.native_verifier) + && digest(value.native_verification_evidence_digest) + && identifier(value.issuer) + && identifier(value.subject) + && identifier(value.artifact_id) + && digest(value.artifact_digest) + && digest(value.issuer_trust_anchor_digest) + && digest(value.constraints_digest) + && validStatus(value.status) + && validValidity(value.validity); +} +function expectedHashLength(hashAlg) { + return 43; +} +function keyHash(value, hashAlg) { + return typeof value === 'string' + && value.length === expectedHashLength(hashAlg) + && BASE64URL_RE.test(value); +} +function validJktBinding(value) { + return isRecord(value) + && exactKeys(value, BINDING_KEYS) + && value.kind === 'RFC7638_JKT' + && value.hash_alg === 'jkt' + && keyHash(value.claimed_key_hash, 'jkt') + && keyHash(value.presented_key_hash, 'jkt'); +} +function validSpkiBinding(value) { + if (!isRecord(value) || !exactKeys(value, BINDING_KEYS)) + return false; + if (value.kind !== 'X509_SPKI') + return false; + if (value.hash_alg !== 'sha-256') + return false; + const hashAlg = value.hash_alg; + return keyHash(value.claimed_key_hash, hashAlg) + && keyHash(value.presented_key_hash, hashAlg); +} +function canonicalBase64urlBytes(value, maximumBytes) { + if (typeof value !== 'string' + || value.length === 0 + || !BASE64URL_RE.test(value) + || value.length % 4 === 1) + return null; + try { + const bytes = Buffer.from(value, 'base64url'); + if (bytes.length === 0 + || bytes.length > maximumBytes + || bytes.toString('base64url') !== value) + return null; + return bytes; + } + catch { + return null; + } +} +function jsonObjectFromSegment(segment) { + const bytes = canonicalBase64urlBytes(segment, MAX_AIC_JWT_BYTES); + if (!bytes) + return null; + try { + const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes); + const parsed = JSON.parse(text); + return isRecord(parsed) ? parsed : null; + } + catch { + return null; + } +} +function jwtNumericDate(value) { + if (!Number.isSafeInteger(value)) + return null; + const milliseconds = Number(value) * 1_000; + return Number.isSafeInteger(milliseconds) && Number.isFinite(new Date(milliseconds).valueOf()) + ? Number(value) + : null; +} +function inspectPrincipalPublicJwk(value) { + if (!isRecord(value) || typeof value.kty !== 'string') + return null; + let jwk; + let canonical; + if (value.kty === 'EC') { + const keys = new Set(['kty', 'crv', 'x', 'y']); + const { crv, x, y } = value; + if (!exactKeys(value, keys) + || !identifier(crv) + || typeof x !== 'string' + || typeof y !== 'string' + || !canonicalBase64urlBytes(x, 1_024) + || !canonicalBase64urlBytes(y, 1_024)) + return null; + jwk = { kty: 'EC', crv, x, y }; + canonical = { crv, kty: 'EC', x, y }; + } + else if (value.kty === 'RSA') { + const keys = new Set(['kty', 'n', 'e']); + const { n, e } = value; + if (!exactKeys(value, keys) + || typeof n !== 'string' + || typeof e !== 'string' + || !canonicalBase64urlBytes(n, 16 * 1_024) + || !canonicalBase64urlBytes(e, 16)) + return null; + jwk = { kty: 'RSA', n, e }; + canonical = { e, kty: 'RSA', n }; + } + else if (value.kty === 'OKP') { + const keys = new Set(['kty', 'crv', 'x']); + const { crv, x } = value; + if (!exactKeys(value, keys) + || !identifier(crv) + || typeof x !== 'string' + || !canonicalBase64urlBytes(x, 1_024)) + return null; + jwk = { kty: 'OKP', crv, x }; + canonical = { crv, kty: 'OKP', x }; + } + else { + return null; + } + try { + crypto.createPublicKey({ key: jwk, format: 'jwk' }); + } + catch { + return null; + } + return { + jwk, + thumbprint: crypto.createHash('sha256') + .update(JSON.stringify(canonical), 'utf8') + .digest('base64url'), + }; +} +function inspectJwtCarrier(input) { + const provenance = input.carrier_provenance; + if (!isRecord(provenance) + || !exactKeys(provenance, JWT_PROVENANCE_KEYS) + || provenance.source_carrier !== 'AIC-JWT-COMPACT' + || !['DIRECT', 'SYNTHESIZED-X509'].includes(String(provenance.downstream_representation)) + || typeof provenance.compact_token !== 'string' + || Buffer.byteLength(provenance.compact_token, 'utf8') > MAX_AIC_JWT_BYTES) { + return null; + } + const segments = provenance.compact_token.split('.'); + if (segments.length !== 3 + || segments.some((segment) => !canonicalBase64urlBytes(segment, MAX_AIC_JWT_BYTES))) { + return null; + } + const header = jsonObjectFromSegment(segments[0]); + const payload = jsonObjectFromSegment(segments[1]); + if (!header || !payload || header.typ !== 'aic+jwt') + return null; + const aic = payload.aic; + const principal = isRecord(aic) ? aic.principal : null; + const presentedPrincipal = inspectPrincipalPublicJwk(provenance.presented_principal_jwk); + const issuedAt = jwtNumericDate(payload.iat); + const expiresAt = jwtNumericDate(payload.exp); + const notBefore = payload.nbf === undefined ? null : jwtNumericDate(payload.nbf); + if (!isRecord(principal) + || !presentedPrincipal + || issuedAt === null + || issuedAt === 0 + || expiresAt === null + || expiresAt === 0 + || expiresAt <= issuedAt + || (payload.nbf !== undefined && notBefore === null) + || (notBefore !== null && notBefore > expiresAt) + || principal.hash_alg !== 'jkt' + || !keyHash(principal.key_hash, 'jkt') + || payload.iss !== input.issuer + || payload.sub !== input.subject + || payload.jti !== input.artifact_id) + return null; + const audiences = typeof payload.aud === 'string' + ? [payload.aud] + : Array.isArray(payload.aud) ? payload.aud : null; + if (!audiences + || audiences.length === 0 + || audiences.length > 64 + || !audiences.every(identifier) + || new Set(audiences).size !== audiences.length) + return null; + const delegationMode = isRecord(aic) ? aic.delegation_mode : null; + if (delegationMode !== 'authorized' && delegationMode !== 'representative') { + return null; + } + const constraints = isRecord(aic) ? aic.constraints : undefined; + if (constraints !== undefined && !Array.isArray(constraints)) + return null; + const delegationAssertion = payload.da; + if (delegationAssertion !== undefined + && (typeof delegationAssertion !== 'string' || delegationAssertion.length === 0)) { + return null; + } + const confirmation = payload.cnf; + if (confirmation !== undefined + && (!isRecord(confirmation) || !keyHash(confirmation.jkt, 'jkt'))) + return null; + return { + carrierOrigin: 'AIC-JWT', + representation: provenance.downstream_representation, + artifactDigest: `sha256:${crypto.createHash('sha256') + .update(provenance.compact_token, 'utf8') + .digest('hex')}`, + issuer: payload.iss, + artifactId: payload.jti, + claimedKeyHash: principal.key_hash, + presentedKeyHash: presentedPrincipal.thumbprint, + audiences, + issuedAt, + notBefore, + expiresAt, + semantics: { + hasConstraints: Array.isArray(constraints) && constraints.length > 0, + delegationMode, + hasDelegationAssertion: typeof delegationAssertion === 'string', + confirmationKeyPresent: isRecord(confirmation), + }, + }; +} +function inspectX509Carrier(input) { + const provenance = input.carrier_provenance; + if (!isRecord(provenance) + || !exactKeys(provenance, X509_PROVENANCE_KEYS) + || provenance.source_carrier !== 'AIC-X509-CREDENTIAL-BUNDLE') + return null; + const agentDer = canonicalBase64urlBytes(provenance.agent_certificate_der, MAX_AIC_CERTIFICATE_BYTES); + const principalDer = canonicalBase64urlBytes(provenance.principal_certificate_der, MAX_AIC_CERTIFICATE_BYTES); + if (!agentDer || !principalDer || agentDer.equals(principalDer)) + return null; + try { + const agent = new X509Certificate(agentDer); + const principal = new X509Certificate(principalDer); + if (!agent.raw.equals(agentDer) || !principal.raw.equals(principalDer)) + return null; + const principalSpki = principal.publicKey.export({ type: 'spki', format: 'der' }); + if (!Buffer.isBuffer(principalSpki)) + return null; + const hashName = input.principal_binding.hash_alg.replace('-', ''); + const serial = agent.serialNumber.replaceAll(':', '').toUpperCase(); + if (!/^[0-9A-F]{2,128}$/.test(serial)) + return null; + return { + carrierOrigin: 'AIC-X509-CERTIFICATE', + artifactDigest: digestAebTyped({ + agent_certificate_der: provenance.agent_certificate_der, + principal_certificate_der: provenance.principal_certificate_der, + }, AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION), + certificateSerial: serial, + presentedKeyHash: crypto.createHash(hashName) + .update(principalSpki) + .digest('base64url'), + }; + } + catch { + return null; + } +} +function sameVerifier(left, right) { + return left.id === right.id + && left.version === right.version + && left.implementation_digest === right.implementation_digest; +} +function nativeVerificationDisposition(input) { + if (input.native_verification === 'FAILED') { + return 'aic_native_verification_failed'; + } + if (input.native_verification === 'INDETERMINATE') { + return 'aic_native_verification_indeterminate'; + } + return null; +} +function trustDisposition(input, policy, expectedMappingProfileId) { + const nativeVerification = nativeVerificationDisposition(input); + if (nativeVerification) + return nativeVerification; + if (!validRelyingPartyPolicy(policy)) + return 'aic_relying_party_policy_invalid'; + if (policy.mapping_profile_id !== expectedMappingProfileId) { + return 'aic_mapping_profile_unpinned'; + } + if (!sameVerifier(input.native_verifier, policy.native_verifier)) { + return 'aic_native_verifier_unpinned'; + } + if (!policy.trusted_issuer_trust_anchor_digests.includes(input.issuer_trust_anchor_digest)) { + return 'aic_issuer_untrusted'; + } + if (input.status.value !== 'CURRENT') + return 'aic_status_not_current'; + return null; +} +function projectionSourceTrustDisposition(input, policy) { + const nativeVerification = nativeVerificationDisposition(input); + if (nativeVerification) + return nativeVerification; + if (!validProjectionSourcePolicy(policy)) { + return 'aic_projection_source_policy_invalid'; + } + if (!sameVerifier(input.native_verifier, policy.native_verifier)) { + return 'aic_native_verifier_unpinned'; + } + if (!policy.trusted_issuer_trust_anchor_digests.includes(input.issuer_trust_anchor_digest)) { + return 'aic_issuer_untrusted'; + } + if (input.status.value !== 'CURRENT') + return 'aic_status_not_current'; + return null; +} +function temporalDisposition(input, context) { + const evaluatedAt = Date.parse(context.evaluated_at); + const observedAt = Date.parse(input.status.checked_at); + if (observedAt > evaluatedAt) + return 'aic_status_observation_future'; + if (evaluatedAt - observedAt > context.max_status_age_seconds * 1_000) { + return 'aic_status_observation_stale'; + } + if (evaluatedAt < Date.parse(input.validity.not_before) + || evaluatedAt > Date.parse(input.validity.not_after)) { + return 'aic_validity_window_mismatch'; + } + return null; +} +function freshnessProfileDisposition(seconds) { + return seconds === AIC_CROSSING_MAX_STATUS_AGE_SECONDS + ? null + : 'aic_status_freshness_profile_mismatch'; +} +function jwtValidityDisposition(input, carrier, evaluatedAt) { + const signedNotBefore = (carrier.notBefore ?? carrier.issuedAt) * 1_000; + const signedExpiration = carrier.expiresAt * 1_000; + if (Date.parse(input.validity.not_before) !== signedNotBefore + || Date.parse(input.validity.not_after) !== signedExpiration) { + return 'aic_jwt_validity_mismatch'; + } + // JWT exp is an exclusive boundary: the token is invalid at the instant + // represented by exp, even though X.509 notAfter remains inclusive here. + if (Date.parse(evaluatedAt) >= signedExpiration) { + return 'aic_validity_window_mismatch'; + } + return null; +} +function authorityFrom(input, policy, native) { + return { + adapter_id: native.adapterId, + adapter_version: '1', + mapping_profile_id: native.mappingProfile, + mapping_profile_digest: policy.mapping_profile_digest, + native_profile: native.nativeProfile, + issuer: input.issuer, + subject: input.subject, + authority_instance_digest: digestAebTyped({ + native_profile: native.nativeProfile, + issuer: input.issuer, + subject: input.subject, + artifact_id: input.artifact_id, + artifact_digest: input.artifact_digest, + issuer_trust_anchor_digest: input.issuer_trust_anchor_digest, + native_verifier: input.native_verifier, + native_verification_evidence_digest: input.native_verification_evidence_digest, + principal_binding: native.binding, + native: native.instanceContext, + }, `${native.mappingProfile}:authority-instance`), + evidence_digest: input.artifact_digest, + replay_unit: digestAebTyped(native.replayIdentity, `${native.mappingProfile}:replay-unit`), + native_verification: 'VERIFIED', + rp_acceptance: 'ACCEPTED', + status: structuredClone(input.status), + constraints_digest: input.constraints_digest, + validity: structuredClone(input.validity), + }; +} +function boundDisposition(input, context, expectedMappingProfileId) { + const trust = trustDisposition(input, context.policy, expectedMappingProfileId); + if (trust) + return trust; + if (input.request_binding.action_projection_profile_id + !== context.policy.action_projection_profile_id + || input.request_binding.action_projection_profile_digest + !== context.policy.action_projection_profile_digest) { + return 'aic_action_projection_profile_unpinned'; + } + if (input.request_binding.requested_capability_digest + !== context.requested_capability_digest) { + return 'aic_requested_capability_mismatch'; + } + if (input.status.value !== 'CURRENT') + return 'aic_status_not_current'; + const freshnessProfile = freshnessProfileDisposition(context.max_status_age_seconds); + if (freshnessProfile) + return freshnessProfile; + const temporal = temporalDisposition(input, context); + if (temporal) + return temporal; + if (input.request_binding.projected_action.caid !== context.action.caid + || input.request_binding.projected_action.action_digest + !== context.action.action_digest) { + return 'aic_action_projection_mismatch'; + } + const expectedAdmissionDomainDigest = digestAebTyped(context.admission_domain, AIC_ADMISSION_DOMAIN_VERSION); + if (input.request_binding.projected_admission_domain_digest + !== expectedAdmissionDomainDigest) { + return 'aic_admission_domain_mismatch'; + } + return null; +} +function boundAuthorityFrom(input, context, native) { + const actionAndDomain = { + requested_capability_digest: context.requested_capability_digest, + action_projection_profile_id: input.request_binding.action_projection_profile_id, + action_projection_profile_digest: input.request_binding.action_projection_profile_digest, + max_status_age_seconds: context.max_status_age_seconds, + action: context.action, + admission_domain: context.admission_domain, + }; + const authority = authorityFrom(input, context.policy, { + ...native, + replayIdentity: { + ...native.replayIdentity, + action_and_domain: actionAndDomain, + }, + instanceContext: { + ...native.instanceContext, + action_and_domain: actionAndDomain, + source_status: input.status, + evaluated_at: context.evaluated_at, + }, + }); + return { + ...authority, + constraints_digest: digestAebTyped({ + native_constraints_digest: input.constraints_digest, + ...actionAndDomain, + }, `${native.mappingProfile}:bound-constraints`), + }; +} +export function mapAicJwtJktBoundCrossingAuthority(input, context) { + if (!isRecord(input) + || !exactKeys(input, BOUND_JWT_INPUT_KEYS) + || !commonValid(input) + || !validRequestBinding(input.request_binding) + || !validRelyingPartyContext(context)) { + return { ok: false, reason: 'mapping_input_invalid' }; + } + if (!validJktBinding(input.principal_binding)) { + return { ok: false, reason: 'aic_native_type_confusion' }; + } + const nativeVerification = nativeVerificationDisposition(input); + if (nativeVerification) + return { ok: false, reason: nativeVerification }; + const carrier = inspectJwtCarrier(input); + if (!carrier) + return { ok: false, reason: 'aic_carrier_provenance_unverifiable' }; + if (carrier.artifactDigest !== input.artifact_digest) { + return { ok: false, reason: 'aic_carrier_artifact_digest_mismatch' }; + } + if (carrier.claimedKeyHash !== input.principal_binding.claimed_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + if (carrier.presentedKeyHash !== input.principal_binding.presented_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + const jwtValidity = jwtValidityDisposition(input, carrier, context.evaluated_at); + if (jwtValidity) + return { ok: false, reason: jwtValidity }; + if (!carrier.audiences.includes(context.admission_domain.audience)) { + return { ok: false, reason: 'aic_audience_mismatch' }; + } + if (input.principal_binding.claimed_key_hash + !== input.principal_binding.presented_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + const disposition = boundDisposition(input, context, AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE); + if (disposition) + return { ok: false, reason: disposition }; + return { + ok: true, + authority: boundAuthorityFrom(input, context, { + adapterId: 'native:aic-jwt-rfc7638-jkt-bound', + mappingProfile: AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + nativeProfile: 'AIC-JWT-RFC7638-JKT', + binding: input.principal_binding, + replayIdentity: { + carrier_origin: carrier.carrierOrigin, + issuer: carrier.issuer, + artifact_id: carrier.artifactId, + }, + instanceContext: { + carrier_origin: carrier.carrierOrigin, + downstream_representation: carrier.representation, + typ: 'aic+jwt', + }, + }), + }; +} +export function mapAicX509SpkiBoundCrossingAuthority(input, context) { + if (!isRecord(input) + || !exactKeys(input, BOUND_X509_INPUT_KEYS) + || !commonValid(input) + || !validRequestBinding(input.request_binding) + || !validRelyingPartyContext(context)) { + return { ok: false, reason: 'mapping_input_invalid' }; + } + if (!validSpkiBinding(input.principal_binding)) { + return { ok: false, reason: 'aic_native_type_confusion' }; + } + const nativeVerification = nativeVerificationDisposition(input); + if (nativeVerification) + return { ok: false, reason: nativeVerification }; + const carrier = inspectX509Carrier(input); + if (!carrier) + return { ok: false, reason: 'aic_carrier_provenance_unverifiable' }; + if (carrier.artifactDigest !== input.artifact_digest) { + return { ok: false, reason: 'aic_carrier_artifact_digest_mismatch' }; + } + if (carrier.presentedKeyHash !== input.principal_binding.presented_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + if (input.principal_binding.claimed_key_hash + !== input.principal_binding.presented_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + const disposition = boundDisposition(input, context, AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE); + if (disposition) + return { ok: false, reason: disposition }; + return { + ok: true, + authority: boundAuthorityFrom(input, context, { + adapterId: 'native:aic-x509-spki-bound', + mappingProfile: AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + nativeProfile: 'AIC-X509-SPKI', + binding: input.principal_binding, + replayIdentity: { + carrier_origin: carrier.carrierOrigin, + artifact_digest: carrier.artifactDigest, + certificate_serial: carrier.certificateSerial, + }, + instanceContext: { + carrier_origin: carrier.carrierOrigin, + certificate_serial: carrier.certificateSerial, + hash_alg: input.principal_binding.hash_alg, + }, + }), + }; +} +function sameExactAction(left, right) { + return left.caid === right.caid + && left.action_digest === right.action_digest; +} +function sameAdmissionDomain(left, right) { + return left.relying_party_id === right.relying_party_id + && left.audience === right.audience + && left.executor_id === right.executor_id + && left.state_domain_id === right.state_domain_id; +} +function snapshotAicJson(value) { + return JSON.parse(canonicalizeAeb(value)); +} +function dataRecordValues(value, allowed, required) { + if (!isRecord(value)) + return null; + const keys = Reflect.ownKeys(value); + if (keys.some((key) => typeof key !== 'string' || !allowed.has(key))) { + return null; + } + const out = {}; + for (const key of keys) { + const descriptor = Object.getOwnPropertyDescriptor(value, key); + if (!descriptor || descriptor.enumerable !== true || !('value' in descriptor)) { + return null; + } + out[key] = descriptor.value; + } + return [...required].every((key) => Object.hasOwn(out, key)) ? out : null; +} +function dataArrayValues(value) { + if (!Array.isArray(value)) + return null; + const keys = Reflect.ownKeys(value); + const lengthDescriptor = Object.getOwnPropertyDescriptor(value, 'length'); + if (!lengthDescriptor || !('value' in lengthDescriptor) + || !Number.isSafeInteger(lengthDescriptor.value) + || lengthDescriptor.value < 0) { + return null; + } + const length = Number(lengthDescriptor.value); + const expected = new Set([ + 'length', + ...Array.from({ length }, (_, index) => String(index)), + ]); + if (keys.some((key) => typeof key !== 'string' || !expected.has(key)) + || keys.length !== expected.size) { + return null; + } + const out = []; + for (let index = 0; index < length; index += 1) { + const descriptor = Object.getOwnPropertyDescriptor(value, String(index)); + if (!descriptor || descriptor.enumerable !== true || !('value' in descriptor)) { + return null; + } + out.push(descriptor.value); + } + return out; +} +function snapshotIssueOptions(options) { + const fields = dataRecordValues(options, ISSUE_OPTION_KEYS, new Set(['signing_keys'])); + if (!fields) + return null; + const presentedKeys = dataArrayValues(fields.signing_keys); + if (!presentedKeys) + return null; + const signingKeys = []; + for (const presented of presentedKeys) { + const key = dataRecordValues(presented, ISSUE_SIGNING_KEY_KEYS, new Set(['alg', 'private_key'])); + if (!key || typeof key.alg !== 'string') + return null; + const presentedPrivateKey = key.private_key; + let privateKey; + if (presentedPrivateKey instanceof Uint8Array) { + privateKey = new Uint8Array(presentedPrivateKey); + } + else if (typeof presentedPrivateKey === 'string' + || presentedPrivateKey instanceof crypto.KeyObject) { + privateKey = presentedPrivateKey; + } + else { + return null; + } + if (Object.hasOwn(key, 'key_id') && typeof key.key_id !== 'string') { + return null; + } + signingKeys.push({ + alg: key.alg, + private_key: privateKey, + ...(typeof key.key_id === 'string' ? { key_id: key.key_id } : {}), + }); + } + const snapshot = { signing_keys: signingKeys }; + if (Object.hasOwn(fields, 'deterministic')) { + if (typeof fields.deterministic !== 'boolean') + return null; + snapshot.deterministic = fields.deterministic; + } + if (Object.hasOwn(fields, 'mldsaBackend')) { + if (fields.mldsaBackend !== null + && fields.mldsaBackend !== undefined + && typeof fields.mldsaBackend !== 'object') { + return null; + } + snapshot.mldsaBackend = fields.mldsaBackend; + } + if (Object.hasOwn(fields, 'mldsaBackendLoader')) { + if (fields.mldsaBackendLoader !== undefined + && typeof fields.mldsaBackendLoader !== 'function') { + return null; + } + snapshot.mldsaBackendLoader = fields.mldsaBackendLoader; + } + return snapshot; +} +/** + * Maps a bound AIC result and issues its crossing record as one operation. + * The caller-supplied record action and boundary must exactly match the + * relying-party context before the generic signer is reached. + */ +export async function issueAicBoundCrossingRecord(input, context, draft, options) { + let contextSnapshot; + let draftSnapshot; + try { + contextSnapshot = snapshotAicJson(context); + draftSnapshot = snapshotAicJson(draft); + } + catch { + return { ok: false, reason: 'aic_crossing_issue_input_invalid' }; + } + if (!validRelyingPartyContext(contextSnapshot) + || !isRecord(draftSnapshot) + || !validAction(draftSnapshot.action) + || !validAdmissionDomain(draftSnapshot.boundary)) { + return { ok: false, reason: 'aic_crossing_issue_input_invalid' }; + } + if (!sameExactAction(draftSnapshot.action, contextSnapshot.action)) { + return { ok: false, reason: 'aic_crossing_issue_action_mismatch' }; + } + if (!sameAdmissionDomain(draftSnapshot.boundary, contextSnapshot.admission_domain)) { + return { + ok: false, + reason: 'aic_crossing_issue_admission_domain_mismatch', + }; + } + let optionsSnapshot; + let inputSnapshot; + try { + optionsSnapshot = snapshotIssueOptions(options); + inputSnapshot = snapshotAicJson(input); + } + catch { + return { ok: false, reason: 'aic_crossing_issue_input_invalid' }; + } + if (!optionsSnapshot) { + return { ok: false, reason: 'aic_crossing_issue_input_invalid' }; + } + if (!isRecord(inputSnapshot) || !isRecord(inputSnapshot.principal_binding)) { + return { ok: false, reason: 'mapping_input_invalid' }; + } + let mapped; + if (inputSnapshot.principal_binding.kind === 'RFC7638_JKT') { + mapped = mapAicJwtJktBoundCrossingAuthority(inputSnapshot, contextSnapshot); + } + else if (inputSnapshot.principal_binding.kind === 'X509_SPKI') { + mapped = mapAicX509SpkiBoundCrossingAuthority(inputSnapshot, contextSnapshot); + } + else { + return { ok: false, reason: 'aic_native_type_confusion' }; + } + if (!mapped.ok) + return mapped; + const record = await issueAebCrossingRecord({ + ...draftSnapshot, + native_authority: mapped.authority, + action: structuredClone(contextSnapshot.action), + boundary: structuredClone(contextSnapshot.admission_domain), + }, optionsSnapshot); + return { ok: true, record }; +} +function spiffeId(value) { + if (typeof value !== 'string') + return false; + try { + const parsed = new URL(value); + return parsed.protocol === 'spiffe:' + && parsed.hostname.length > 0 + && parsed.username === '' + && parsed.password === '' + && parsed.port === '' + && parsed.search === '' + && parsed.hash === ''; + } + catch { + return false; + } +} +function validProjectionInput(value) { + return exactKeys(value, PROJECTION_INPUT_KEYS) + && (value.purpose === 'WORKLOAD_IDENTITY_ONLY' || value.purpose === 'AIC_AUTHORITY') + && Array.isArray(value.audience) + && value.audience.every(identifier) + && Number.isSafeInteger(value.issued_at) + && (value.not_before === null || Number.isSafeInteger(value.not_before)) + && Number.isSafeInteger(value.expires_at) + && identifier(value.token_id) + && (value.projected_algorithm === 'ES256' || value.projected_algorithm === 'RS256') + && identifier(value.projected_key_id); +} +function validProjectionContext(value) { + return isRecord(value) + && exactKeys(value, PROJECTION_CONTEXT_KEYS) + && validProjectionSourcePolicy(value.source_verification_policy) + && instant(value.evaluated_at) + && Number.isSafeInteger(value.max_status_age_seconds) + && Number(value.max_status_age_seconds) >= 0 + && Number(value.max_status_age_seconds) <= 86_400; +} +function verifyAicJwtProjectionSource(input, context) { + if (!isRecord(input) || !exactKeys(input, JWT_INPUT_KEYS) || !commonValid(input)) { + return { ok: false, reason: 'mapping_input_invalid' }; + } + if (!validJktBinding(input.principal_binding)) { + return { ok: false, reason: 'aic_native_type_confusion' }; + } + const nativeVerification = nativeVerificationDisposition(input); + if (nativeVerification) + return { ok: false, reason: nativeVerification }; + const carrier = inspectJwtCarrier(input); + if (!carrier) + return { ok: false, reason: 'aic_carrier_provenance_unverifiable' }; + if (carrier.artifactDigest !== input.artifact_digest) { + return { ok: false, reason: 'aic_carrier_artifact_digest_mismatch' }; + } + if (carrier.claimedKeyHash !== input.principal_binding.claimed_key_hash + || carrier.presentedKeyHash !== input.principal_binding.presented_key_hash + || input.principal_binding.claimed_key_hash + !== input.principal_binding.presented_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + const jwtValidity = jwtValidityDisposition(input, carrier, context.evaluated_at); + if (jwtValidity) + return { ok: false, reason: jwtValidity }; + const trust = projectionSourceTrustDisposition(input, context.source_verification_policy); + if (trust) + return { ok: false, reason: trust }; + const freshnessProfile = freshnessProfileDisposition(context.max_status_age_seconds); + if (freshnessProfile) + return { ok: false, reason: freshnessProfile }; + const temporal = temporalDisposition(input, context); + if (temporal) + return { ok: false, reason: temporal }; + return { + ok: true, + carrier, + sourceEvaluationDigest: digestAebTyped({ + source_verification_profile_id: context.source_verification_policy.source_verification_profile_id, + source_verification_profile_digest: context.source_verification_policy.source_verification_profile_digest, + trusted_issuer_trust_anchor_digests: [ + ...context.source_verification_policy + .trusted_issuer_trust_anchor_digests, + ].sort(), + native_verification: input.native_verification, + native_verifier: input.native_verifier, + native_verification_evidence_digest: input.native_verification_evidence_digest, + issuer: input.issuer, + subject: input.subject, + artifact_id: input.artifact_id, + artifact_digest: input.artifact_digest, + issuer_trust_anchor_digest: input.issuer_trust_anchor_digest, + constraints_digest: input.constraints_digest, + status: input.status, + validity: input.validity, + principal_binding: input.principal_binding, + carrier: { + origin: carrier.carrierOrigin, + representation: carrier.representation, + issuer: carrier.issuer, + artifact_id: carrier.artifactId, + artifact_digest: carrier.artifactDigest, + audiences: carrier.audiences, + issued_at: carrier.issuedAt, + not_before: carrier.notBefore, + expires_at: carrier.expiresAt, + semantics: carrier.semantics, + }, + evaluated_at: context.evaluated_at, + max_status_age_seconds: context.max_status_age_seconds, + }, `${AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE}:accepted-source-evaluation`), + }; +} +export function projectAicJwtToStrictJwtSvid(input, context) { + if (!isRecord(input) + || !validProjectionInput(input) + || !validProjectionContext(context)) { + return { ok: false, reason: 'jwt_svid_projection_input_invalid' }; + } + const source = verifyAicJwtProjectionSource(input.source, context); + if (!source.ok) { + if (source.reason === 'aic_status_observation_future') { + return { ok: false, reason: 'jwt_svid_source_status_future' }; + } + if (source.reason === 'aic_status_observation_stale') { + return { ok: false, reason: 'jwt_svid_source_status_stale' }; + } + if (source.reason === 'aic_validity_window_mismatch') { + return { ok: false, reason: 'jwt_svid_source_validity_mismatch' }; + } + return source; + } + const carrier = source.carrier; + const evaluatedAtMillis = Date.parse(context.evaluated_at); + const issuedAtMillis = input.issued_at * 1_000; + if (issuedAtMillis !== evaluatedAtMillis) { + return { ok: false, reason: 'jwt_svid_projection_evaluation_time_mismatch' }; + } + const observedAtMillis = Date.parse(input.source.status.checked_at); + if (observedAtMillis > evaluatedAtMillis) { + return { ok: false, reason: 'jwt_svid_source_status_future' }; + } + if (evaluatedAtMillis - observedAtMillis + > context.max_status_age_seconds * 1_000) { + return { ok: false, reason: 'jwt_svid_source_status_stale' }; + } + const sourceNotBeforeMillis = Date.parse(input.source.validity.not_before); + const sourceNotAfterMillis = Date.parse(input.source.validity.not_after); + const projectedNotBeforeMillis = (input.not_before ?? input.issued_at) * 1_000; + if (issuedAtMillis < sourceNotBeforeMillis + || projectedNotBeforeMillis < sourceNotBeforeMillis + || input.expires_at * 1_000 > sourceNotAfterMillis) { + return { ok: false, reason: 'jwt_svid_source_validity_mismatch' }; + } + if (!spiffeId(input.source.subject)) { + return { ok: false, reason: 'jwt_svid_spiffe_subject_required' }; + } + if (input.audience.length !== 1) { + return { ok: false, reason: 'jwt_svid_single_audience_required' }; + } + if (input.expires_at <= input.issued_at + || (input.not_before !== null && input.not_before >= input.expires_at)) { + return { ok: false, reason: 'jwt_svid_projection_time_invalid' }; + } + if (input.purpose !== 'WORKLOAD_IDENTITY_ONLY') { + return { ok: false, reason: 'aic_jwt_svid_semantic_loss' }; + } + const omittedSourceMembers = [ + 'iss', + 'aic.principal', + 'aic.capabilities', + 'aic.delegation_mode', + ...(carrier.semantics.hasConstraints ? ['aic.constraints'] : []), + ...(carrier.semantics.hasDelegationAssertion ? ['da'] : []), + ...(carrier.semantics.confirmationKeyPresent ? ['cnf'] : []), + ]; + const protectedHeader = { + alg: input.projected_algorithm, + kid: input.projected_key_id, + typ: 'JWT', + }; + const payload = { + sub: input.source.subject, + aud: input.audience[0], + iat: input.issued_at, + exp: input.expires_at, + ...(input.not_before === null ? {} : { nbf: input.not_before }), + jti: input.token_id, + }; + const sourceEvidence = { + typ: 'aic+jwt', + issuer: carrier.issuer, + token_digest: carrier.artifactDigest, + source_semantics_digest: digestAebTyped({ + principal_binding: input.source.principal_binding, + source_audiences: carrier.audiences, + has_constraints: carrier.semantics.hasConstraints, + delegation_mode: carrier.semantics.delegationMode, + has_delegation_assertion: carrier.semantics.hasDelegationAssertion, + confirmation_key_present: carrier.semantics.confirmationKeyPresent, + }, `${AIC_JWT_SVID_PROJECTION_VERSION}:source-semantics`), + source_evaluation_digest: source.sourceEvaluationDigest, + }; + const projectionDigest = digestAebTyped({ + protected_header: protectedHeader, + payload, + source: sourceEvidence, + purpose: input.purpose, + omitted_source_members: omittedSourceMembers, + authority_semantics_preserved: false, + new_signature_required: true, + }, `${AIC_JWT_SVID_PROJECTION_VERSION}:projection`); + return { + ok: true, + projection: { + '@version': AIC_JWT_SVID_PROJECTION_VERSION, + protected_header: protectedHeader, + payload, + source: sourceEvidence, + purpose: 'WORKLOAD_IDENTITY_ONLY', + omitted_source_members: omittedSourceMembers, + authority_semantics_preserved: false, + new_signature_required: true, + compact_token: null, + authorization_decision: false, + projection_digest: projectionDigest, + }, + }; +} +//# sourceMappingURL=aeb-aic-crossing-adapter.js.map \ No newline at end of file diff --git a/packages/verify/dist/aeb-aic-crossing-adapter.js.map b/packages/verify/dist/aeb-aic-crossing-adapter.js.map new file mode 100644 index 000000000..1e47d682f --- /dev/null +++ b/packages/verify/dist/aeb-aic-crossing-adapter.js.map @@ -0,0 +1 @@ +{"version":3,"file":"aeb-aic-crossing-adapter.js","sourceRoot":"","sources":["../src/aeb-aic-crossing-adapter.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,MAAM,EAAE,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EACL,eAAe,EACf,cAAc,GAEf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sBAAsB,GASvB,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,0CAA0C,GACrD,sCAAsC,CAAC;AACzC,MAAM,CAAC,MAAM,4CAA4C,GACvD,wCAAwC,CAAC;AAC3C,MAAM,CAAC,MAAM,4BAA4B,GACvC,4BAA4B,CAAC;AAC/B,MAAM,CAAC,MAAM,+BAA+B,GAC1C,+BAA+B,CAAC;AAClC,MAAM,CAAC,MAAM,wCAAwC,GACnD,wCAAwC,CAAC;AAC3C,MAAM,CAAC,MAAM,yCAAyC,GACpD,kCAAkC,CAAC;AACrC,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAiMtD,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAC1C,MAAM,OAAO,GAAG,0FAA0F,CAAC;AAC3G,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAC/D,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,qBAAqB;IACrB,iBAAiB;IACjB,qCAAqC;IACrC,QAAQ;IACR,SAAS;IACT,aAAa;IACb,iBAAiB;IACjB,4BAA4B;IAC5B,oBAAoB;IACpB,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,GAAG,WAAW;IACd,oBAAoB;IACpB,mBAAmB;CACpB,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,GAAG,WAAW;IACd,oBAAoB;IACpB,mBAAmB;CACpB,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC7E,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC/E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,8BAA8B;IAC9B,kCAAkC;IAClC,6BAA6B;IAC7B,kBAAkB;IAClB,mCAAmC;CACpC,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;AACvD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,kBAAkB;IAClB,UAAU;IACV,aAAa;IACb,iBAAiB;CAClB,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,QAAQ;IACR,kBAAkB;IAClB,6BAA6B;IAC7B,cAAc;IACd,wBAAwB;IACxB,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,oBAAoB;IACpB,wBAAwB;IACxB,8BAA8B;IAC9B,kCAAkC;IAClC,qCAAqC;IACrC,iBAAiB;CAClB,CAAC,CAAC;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC,CAAC;AACrF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,gBAAgB;IAChB,eAAe;IACf,yBAAyB;IACzB,2BAA2B;CAC5B,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,gBAAgB;IAChB,uBAAuB;IACvB,2BAA2B;CAC5B,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,MAAM;IACN,UAAU;IACV,kBAAkB;IAClB,oBAAoB;CACrB,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AAC3D,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,QAAQ;IACR,SAAS;IACT,UAAU;IACV,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,qBAAqB;IACrB,kBAAkB;CACnB,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,4BAA4B;IAC5B,cAAc;IACd,wBAAwB;CACzB,CAAC,CAAC;AACH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,gCAAgC;IAChC,oCAAoC;IACpC,qCAAqC;IACrC,iBAAiB;CAClB,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,cAAc;IACd,cAAc;IACd,oBAAoB;IACpB,eAAe;CAChB,CAAC,CAAC;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK;IACL,aAAa;IACb,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAA6B;IAC/D,UAAU;IACV,QAAQ;IACR,eAAe;CAChB,CAAC,CAAC;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,SAAS;IACT,OAAO;IACP,aAAa;IACb,SAAS;IACT,eAAe;CAChB,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,KAAU,EAAE,QAA6B;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;WAC/B,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;WACzB,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,sDAAsD,CAAC,IAAI,CAAC,KAAK,CAAC;WAClE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC;WAC7B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;WAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;WACzB,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;WACzB,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC;WAC/B,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;WACzB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;WACxB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC;WAC7B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;WAC9B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;WACxB,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,qBAAqB,CAAC;WACvC,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC;WAClC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;WAC1B,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;WAC7B,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC;WACtC,UAAU,CAAC,KAAK,CAAC,4BAA4B,CAAC;WAC9C,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC;WAC9C,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC;WACzC,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC;WACnC,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,wBAAwB,CAAC;WAC1C,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;WACpB,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;WACzB,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc;IAEd,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC;WAChC,UAAU,CAAC,KAAK,CAAC,kBAAkB,CAAC;WACpC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC;WACpC,UAAU,CAAC,KAAK,CAAC,4BAA4B,CAAC;WAC9C,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC;WAC9C,aAAa,CAAC,KAAK,CAAC,mCAAmC,CAAC;WACxD,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAc;IAEd,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC;WACjC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;WACzB,oBAAoB,CAAC,KAAK,CAAC,gBAAgB,CAAC;WAC5C,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC;WACzC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;WAC3B,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,sBAAsB,CAAC;WAClD,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC;WACzC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,MAAM;WAC9C,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WACtB,KAAK,CAAC,MAAM,GAAG,CAAC;WAChB,KAAK,CAAC,MAAM,IAAI,EAAE;WAClB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;WACnB,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAc;IAEd,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,6BAA6B,CAAC;WAC/C,KAAK,CAAC,8BAA8B;gBACjC,wCAAwC;WAC3C,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC;WAChD,aAAa,CAAC,KAAK,CAAC,mCAAmC,CAAC;WACxD,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAU;IAC7B,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAiD,CAAC;WACnF,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC;WAC9C,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC;WACjD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;WACxB,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;WACzB,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;WAC7B,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;WAC7B,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC;WACxC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC;WAChC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;WACzB,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAqC;IAC/D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,OAAqC;IACpE,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,CAAC,MAAM,KAAK,kBAAkB,CAAC,OAAO,CAAC;WAC5C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC;WAC9B,KAAK,CAAC,IAAI,KAAK,aAAa;WAC5B,KAAK,CAAC,QAAQ,KAAK,KAAK;WACxB,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC;WACtC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,QAAgC,CAAC;IACvD,OAAO,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC;WAC1C,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AA6BD,SAAS,uBAAuB,CAAC,KAAc,EAAE,YAAoB;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ;WACxB,KAAK,CAAC,MAAM,KAAK,CAAC;WAClB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;WACzB,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;eACjB,KAAK,CAAC,MAAM,GAAG,YAAY;eAC3B,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAC3C,OAAO,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5F,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACf,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAI/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,GAA0B,CAAC;IAC/B,IAAI,SAAc,CAAC;IACnB,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;eACtB,CAAC,UAAU,CAAC,GAAG,CAAC;eAChB,OAAO,CAAC,KAAK,QAAQ;eACrB,OAAO,CAAC,KAAK,QAAQ;eACrB,CAAC,uBAAuB,CAAC,CAAC,EAAE,KAAK,CAAC;eAClC,CAAC,uBAAuB,CAAC,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/B,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;SAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;eACtB,OAAO,CAAC,KAAK,QAAQ;eACrB,OAAO,CAAC,KAAK,QAAQ;eACrB,CAAC,uBAAuB,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC;eACvC,CAAC,uBAAuB,CAAC,CAAC,EAAE,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3B,SAAS,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACnC,CAAC;SAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;eACtB,CAAC,UAAU,CAAC,GAAG,CAAC;eAChB,OAAO,CAAC,KAAK,QAAQ;eACrB,CAAC,uBAAuB,CAAC,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC7B,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,GAAG;QACH,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aACpC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;aACzC,MAAM,CAAC,WAAW,CAAC;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA6B;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;WACpB,CAAC,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;WAC3C,UAAU,CAAC,cAAc,KAAK,iBAAiB;WAC/C,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CACzC,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAC7C;WACE,OAAO,UAAU,CAAC,aAAa,KAAK,QAAQ;WAC5C,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;WACpB,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,MAAM,kBAAkB,GAAG,yBAAyB,CAClD,UAAU,CAAC,uBAAuB,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;WACnB,CAAC,kBAAkB;WACnB,QAAQ,KAAK,IAAI;WACjB,QAAQ,KAAK,CAAC;WACd,SAAS,KAAK,IAAI;WAClB,SAAS,KAAK,CAAC;WACf,SAAS,IAAI,QAAQ;WACrB,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;WACjD,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,SAAS,CAAC;WAC7C,SAAS,CAAC,QAAQ,KAAK,KAAK;WAC5B,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC;WACnC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM;WAC5B,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,OAAO;WAC7B,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/C,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACf,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,IAAI,CAAC,SAAS;WACT,SAAS,CAAC,MAAM,KAAK,CAAC;WACtB,SAAS,CAAC,MAAM,GAAG,EAAE;WACrB,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;WAC5B,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,cAAc,KAAK,YAAY,IAAI,cAAc,KAAK,gBAAgB,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,mBAAmB,GAAG,OAAO,CAAC,EAAE,CAAC;IACvC,IAAI,mBAAmB,KAAK,SAAS;WAChC,CAAC,OAAO,mBAAmB,KAAK,QAAQ,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC;IACjC,IAAI,YAAY,KAAK,SAAS;WACzB,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO;QACL,aAAa,EAAE,SAAS;QACxB,cAAc,EACZ,UAAU,CAAC,yBAA2D;QACxE,cAAc,EAAE,UAAU,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aAClD,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC;aACxC,MAAM,CAAC,KAAK,CAAC,EAAE;QAClB,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,cAAc,EAAE,SAAS,CAAC,QAAQ;QAClC,gBAAgB,EAAE,kBAAkB,CAAC,UAAU;QAC/C,SAAS;QACT,QAAQ;QACR,SAAS;QACT,SAAS;QACT,SAAS,EAAE;YACT,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YACpE,cAAc;YACd,sBAAsB,EAAE,OAAO,mBAAmB,KAAK,QAAQ;YAC/D,sBAAsB,EAAE,QAAQ,CAAC,YAAY,CAAC;SAC/C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,KAA+B;IAE/B,MAAM,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;WACpB,CAAC,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC;WAC5C,UAAU,CAAC,cAAc,KAAK,4BAA4B;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,QAAQ,GAAG,uBAAuB,CACtC,UAAU,CAAC,qBAAqB,EAChC,yBAAyB,CAC1B,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC1C,UAAU,CAAC,yBAAyB,EACpC,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QACpF,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO;YACL,aAAa,EAAE,sBAAsB;YACrC,cAAc,EAAE,cAAc,CAC5B;gBACE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;gBACvD,yBAAyB,EAAE,UAAU,CAAC,yBAAyB;aAChE,EACD,yCAAyC,CAC1C;YACD,iBAAiB,EAAE,MAAM;YACzB,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;iBAC1C,MAAM,CAAC,aAAa,CAAC;iBACrB,MAAM,CAAC,WAAW,CAAC;SACvB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,IAAiC,EACjC,KAAkC;IAElC,OAAO,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE;WACtB,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;WAC9B,IAAI,CAAC,qBAAqB,KAAK,KAAK,CAAC,qBAAqB,CAAC;AAClE,CAAC;AAED,SAAS,6BAA6B,CACpC,KAA6B;IAE7B,IAAI,KAAK,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,eAAe,EAAE,CAAC;QAClD,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,KAA6B,EAC7B,MAAqC,EACrC,wBAAgC;IAEhC,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAClD,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;QAAE,OAAO,kCAAkC,CAAC;IAChF,IAAI,MAAM,CAAC,kBAAkB,KAAK,wBAAwB,EAAE,CAAC;QAC3D,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACjE,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,mCAAmC,CAAC,QAAQ,CACtD,KAAK,CAAC,0BAA0B,CACjC,EAAE,CAAC;QACF,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gCAAgC,CACvC,KAA6B,EAC7B,MAA0C;IAE1C,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAClD,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACjE,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,mCAAmC,CAAC,QAAQ,CACtD,KAAK,CAAC,0BAA0B,CACjC,EAAE,CAAC;QACF,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAA6B,EAC7B,OAAiE;IAEjE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,UAAU,GAAG,WAAW;QAAE,OAAO,+BAA+B,CAAC;IACrE,IAAI,WAAW,GAAG,UAAU,GAAG,OAAO,CAAC,sBAAsB,GAAG,KAAK,EAAE,CAAC;QACtE,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,IAAI,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;WAClD,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe;IAClD,OAAO,OAAO,KAAK,mCAAmC;QACpD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,uCAAuC,CAAC;AAC9C,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA6B,EAC7B,OAA4B,EAC5B,WAAmB;IAEnB,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IACxE,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;IACnD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,eAAe;WACxD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAC/D,OAAO,2BAA2B,CAAC;IACrC,CAAC;IACD,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAChD,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACpB,KAA6B,EAC7B,MAAqC,EACrC,MAOC;IAED,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,eAAe,EAAE,GAAG;QACpB,kBAAkB,EAAE,MAAM,CAAC,cAAc;QACzC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,cAAc,CACvC;YACE,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,mCAAmC,EACjC,KAAK,CAAC,mCAAmC;YAC3C,iBAAiB,EAAE,MAAM,CAAC,OAAO;YACjC,MAAM,EAAE,MAAM,CAAC,eAAe;SAC/B,EACD,GAAG,MAAM,CAAC,cAAc,qBAAqB,CAC9C;QACD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,cAAc,CACzB,MAAM,CAAC,cAAc,EACrB,GAAG,MAAM,CAAC,cAAc,cAAc,CACvC;QACD,mBAAmB,EAAE,UAAU;QAC/B,aAAa,EAAE,UAAU;QACzB,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;QACrC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAA8E,EAC9E,OAAuC,EACvC,wBAAgC;IAEhC,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAChF,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,KAAK,CAAC,eAAe,CAAC,4BAA4B;YAC9C,OAAO,CAAC,MAAM,CAAC,4BAA4B;WAC9C,KAAK,CAAC,eAAe,CAAC,gCAAgC;gBACnD,OAAO,CAAC,MAAM,CAAC,gCAAgC,EAAE,CAAC;QACxD,OAAO,wCAAwC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,CAAC,2BAA2B;YAC7C,OAAO,CAAC,2BAA2B,EAAE,CAAC;QAC5C,OAAO,mCAAmC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC;IACtE,MAAM,gBAAgB,GAAG,2BAA2B,CAClD,OAAO,CAAC,sBAAsB,CAC/B,CAAC;IACF,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,KAAK,CAAC,eAAe,CAAC,gBAAgB,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;WAClE,KAAK,CAAC,eAAe,CAAC,gBAAgB,CAAC,aAAa;gBACjD,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACrC,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IACD,MAAM,6BAA6B,GAAG,cAAc,CAClD,OAAO,CAAC,gBAAgB,EACxB,4BAA4B,CAC7B,CAAC;IACF,IAAI,KAAK,CAAC,eAAe,CAAC,iCAAiC;YACrD,6BAA6B,EAAE,CAAC;QACpC,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CACzB,KAA8E,EAC9E,OAAuC,EACvC,MAOC;IAED,MAAM,eAAe,GAAG;QACtB,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;QAChE,4BAA4B,EAC1B,KAAK,CAAC,eAAe,CAAC,4BAA4B;QACpD,gCAAgC,EAC9B,KAAK,CAAC,eAAe,CAAC,gCAAgC;QACxD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE;QACrD,GAAG,MAAM;QACT,cAAc,EAAE;YACd,GAAG,MAAM,CAAC,cAAc;YACxB,iBAAiB,EAAE,eAAe;SACnC;QACD,eAAe,EAAE;YACf,GAAG,MAAM,CAAC,eAAe;YACzB,iBAAiB,EAAE,eAAe;YAClC,aAAa,EAAE,KAAK,CAAC,MAAM;YAC3B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC;KACF,CAAC,CAAC;IACH,OAAO;QACL,GAAG,SAAS;QACZ,kBAAkB,EAAE,cAAc,CAChC;YACE,yBAAyB,EAAE,KAAK,CAAC,kBAAkB;YACnD,GAAG,eAAe;SACnB,EACD,GAAG,MAAM,CAAC,cAAc,oBAAoB,CAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAkC,EAClC,OAAuC;IAEvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;WACf,CAAC,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC;WACvC,CAAC,WAAW,CAAC,KAAK,CAAC;WACnB,CAAC,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC;WAC3C,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,kBAAkB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAClF,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,WAAW,GAAG,sBAAsB,CACxC,KAAK,EACL,OAAO,EACP,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;YACtC,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAClC,KAAK,EACL,OAAO,EACP,0CAA0C,CAC3C,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE;YAC5C,SAAS,EAAE,kCAAkC;YAC7C,cAAc,EAAE,0CAA0C;YAC1D,aAAa,EAAE,qBAAqB;YACpC,OAAO,EAAE,KAAK,CAAC,iBAAiB;YAChC,cAAc,EAAE;gBACd,cAAc,EAAE,OAAO,CAAC,aAAa;gBACrC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,CAAC,UAAU;aAChC;YACD,eAAe,EAAE;gBACf,cAAc,EAAE,OAAO,CAAC,aAAa;gBACrC,yBAAyB,EAAE,OAAO,CAAC,cAAc;gBACjD,GAAG,EAAE,SAAS;aACf;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,KAAoC,EACpC,OAAuC;IAEvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;WACf,CAAC,SAAS,CAAC,KAAK,EAAE,qBAAqB,CAAC;WACxC,CAAC,WAAW,CAAC,KAAK,CAAC;WACnB,CAAC,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC;WAC3C,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,kBAAkB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAClF,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;YACtC,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAClC,KAAK,EACL,OAAO,EACP,4CAA4C,CAC7C,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE;YAC5C,SAAS,EAAE,4BAA4B;YACvC,cAAc,EAAE,4CAA4C;YAC5D,aAAa,EAAE,eAAe;YAC9B,OAAO,EAAE,KAAK,CAAC,iBAAiB;YAChC,cAAc,EAAE;gBACd,cAAc,EAAE,OAAO,CAAC,aAAa;gBACrC,eAAe,EAAE,OAAO,CAAC,cAAc;gBACvC,kBAAkB,EAAE,OAAO,CAAC,iBAAiB;aAC9C;YACD,eAAe,EAAE;gBACf,cAAc,EAAE,OAAO,CAAC,aAAa;gBACrC,kBAAkB,EAAE,OAAO,CAAC,iBAAiB;gBAC7C,QAAQ,EAAE,KAAK,CAAC,iBAAiB,CAAC,QAAQ;aAC3C;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAA4B,EAC5B,KAA6B;IAE7B,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;WAC1B,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAgC,EAChC,KAAiC;IAEjC,OAAO,IAAI,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB;WAClD,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;WAChC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;WACtC,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAI,KAAQ;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAM,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,OAA4B,EAC5B,QAA6B;IAE7B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,IAAgB,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,OAAO,IAAI,gBAAgB,CAAC;WAClD,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC;WAC7C,gBAAgB,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,QAAQ;QACR,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KACvD,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;WAChE,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAsC;IAEtC,MAAM,MAAM,GAAG,gBAAgB,CAC7B,OAAO,EACP,iBAAiB,EACjB,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,WAAW,GAAkD,EAAE,CAAC;IACtE,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,gBAAgB,CAC1B,SAAS,EACT,sBAAsB,EACtB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,mBAAmB,GAAG,GAAG,CAAC,WAAW,CAAC;QAC5C,IAAI,UAAkD,CAAC;QACvD,IAAI,mBAAmB,YAAY,UAAU,EAAE,CAAC;YAC9C,UAAU,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,OAAO,mBAAmB,KAAK,QAAQ;eAC7C,mBAAmB,YAAY,MAAM,CAAC,SAAS,EAAE,CAAC;YACrD,UAAU,GAAG,mBAAmB,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,WAAW,EAAE,UAAU;YACvB,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAkC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC3D,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI;eAC3B,MAAM,CAAC,YAAY,KAAK,SAAS;eACjC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,YACgB,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;eACtC,OAAO,MAAM,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBACgB,CAAC;IACxD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAA4B,EAC5B,OAAuC,EACvC,KAAkC,EAClC,OAAsC;IAEtC,IAAI,eAA+C,CAAC;IACpD,IAAI,aAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,eAAe,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3C,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC;WACzC,CAAC,QAAQ,CAAC,aAAa,CAAC;WACxB,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC;WAClC,CAAC,oBAAoB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,mBAAmB,CACtB,aAAa,CAAC,QAAQ,EACtB,eAAe,CAAC,gBAAgB,CACjC,EAAE,CAAC;QACF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IACD,IAAI,eAAqD,CAAC;IAC1D,IAAI,aAAoC,CAAC;IACzC,IAAI,CAAC;QACH,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAChD,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,MAAsC,CAAC;IAC3C,IAAI,aAAa,CAAC,iBAAiB,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3D,MAAM,GAAG,kCAAkC,CACzC,aAA4C,EAC5C,eAAe,CAChB,CAAC;IACJ,CAAC;SAAM,IAAI,aAAa,CAAC,iBAAiB,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChE,MAAM,GAAG,oCAAoC,CAC3C,aAA8C,EAC9C,eAAe,CAChB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;QACE,GAAG,aAAa;QAChB,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,MAAM,EAAE,eAAe,CAAC,eAAe,CAAC,MAAM,CAAC;QAC/C,QAAQ,EAAE,eAAe,CAAC,eAAe,CAAC,gBAAgB,CAAC;KAC5D,EACD,eAAe,CAChB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,KAAK,SAAS;eAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;eAC1B,MAAM,CAAC,QAAQ,KAAK,EAAE;eACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;eACtB,MAAM,CAAC,IAAI,KAAK,EAAE;eAClB,MAAM,CAAC,MAAM,KAAK,EAAE;eACpB,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAU;IACtC,OAAO,SAAS,CAAC,KAAK,EAAE,qBAAqB,CAAC;WACzC,CAAC,KAAK,CAAC,OAAO,KAAK,wBAAwB,IAAI,KAAK,CAAC,OAAO,KAAK,eAAe,CAAC;WACjF,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;WAC7B,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;WAChC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;WACrC,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;WACrE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;WACtC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;WAC1B,CAAC,KAAK,CAAC,mBAAmB,KAAK,OAAO,IAAI,KAAK,CAAC,mBAAmB,KAAK,OAAO,CAAC;WAChF,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc;IAEd,OAAO,QAAQ,CAAC,KAAK,CAAC;WACjB,SAAS,CAAC,KAAK,EAAE,uBAAuB,CAAC;WACzC,2BAA2B,CAAC,KAAK,CAAC,0BAA0B,CAAC;WAC7D,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;WAC3B,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,sBAAsB,CAAC;WAClD,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC;WACzC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,MAAM,CAAC;AACtD,CAAC;AAUD,SAAS,4BAA4B,CACnC,KAA6B,EAC7B,OAAgD;IAEhD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,kBAAkB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAClF,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;WAClE,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,iBAAiB,CAAC,kBAAkB;WACvE,KAAK,CAAC,iBAAiB,CAAC,gBAAgB;gBACrC,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,WAAW,GAAG,sBAAsB,CACxC,KAAK,EACL,OAAO,EACP,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,gCAAgC,CAC5C,KAAK,EACL,OAAO,CAAC,0BAA0B,CACnC,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/C,MAAM,gBAAgB,GAAG,2BAA2B,CAClD,OAAO,CAAC,sBAAsB,CAC/B,CAAC;IACF,IAAI,gBAAgB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,sBAAsB,EAAE,cAAc,CACpC;YACE,8BAA8B,EAC5B,OAAO,CAAC,0BAA0B,CAAC,8BAA8B;YACnE,kCAAkC,EAChC,OAAO,CAAC,0BAA0B,CAAC,kCAAkC;YACvE,mCAAmC,EAAE;gBACnC,GAAG,OAAO,CAAC,0BAA0B;qBAClC,mCAAmC;aACvC,CAAC,IAAI,EAAE;YACR,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,mCAAmC,EACjC,KAAK,CAAC,mCAAmC;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,aAAa;gBAC7B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,CAAC,UAAU;gBAC/B,eAAe,EAAE,OAAO,CAAC,cAAc;gBACvC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,UAAU,EAAE,OAAO,CAAC,SAAS;gBAC7B,UAAU,EAAE,OAAO,CAAC,SAAS;gBAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B;YACD,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;SACvD,EACD,GAAG,wCAAwC,6BAA6B,CACzE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAgC,EAChC,OAAgD;IAEhD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;WACf,CAAC,oBAAoB,CAAC,KAAK,CAAC;WAC5B,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,+BAA+B,EAAE,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,8BAA8B,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,8BAA8B,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;IAC/C,IAAI,cAAc,KAAK,iBAAiB,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpE,IAAI,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,iBAAiB,GAAG,gBAAgB;UAClC,OAAO,CAAC,sBAAsB,GAAG,KAAK,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,wBAAwB,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC/E,IAAI,cAAc,GAAG,qBAAqB;WACrC,wBAAwB,GAAG,qBAAqB;WAChD,KAAK,CAAC,UAAU,GAAG,KAAK,GAAG,oBAAoB,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS;WAClC,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,oBAAoB,GAAG;QAC3B,KAAK;QACL,eAAe;QACf,kBAAkB;QAClB,qBAAqB;QACrB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;IACF,MAAM,eAAe,GAAG;QACtB,GAAG,EAAE,KAAK,CAAC,mBAAmB;QAC9B,GAAG,EAAE,KAAK,CAAC,gBAAgB;QAC3B,GAAG,EAAE,KAAc;KACpB,CAAC;IACF,MAAM,OAAO,GAA0C;QACrD,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QACzB,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtB,GAAG,EAAE,KAAK,CAAC,SAAS;QACpB,GAAG,EAAE,KAAK,CAAC,UAAU;QACrB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC/D,GAAG,EAAE,KAAK,CAAC,QAAQ;KACpB,CAAC;IACF,MAAM,cAAc,GAAyC;QAC3D,GAAG,EAAE,SAAS;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,cAAc;QACpC,uBAAuB,EAAE,cAAc,CACrC;YACE,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB;YACjD,gBAAgB,EAAE,OAAO,CAAC,SAAS;YACnC,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,cAAc;YACjD,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,cAAc;YACjD,wBAAwB,EAAE,OAAO,CAAC,SAAS,CAAC,sBAAsB;YAClE,wBAAwB,EAAE,OAAO,CAAC,SAAS,CAAC,sBAAsB;SACnE,EACD,GAAG,+BAA+B,mBAAmB,CACtD;QACD,wBAAwB,EAAE,MAAM,CAAC,sBAAsB;KACxD,CAAC;IACF,MAAM,gBAAgB,GAAG,cAAc,CACrC;QACE,gBAAgB,EAAE,eAAe;QACjC,OAAO;QACP,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,sBAAsB,EAAE,oBAAoB;QAC5C,6BAA6B,EAAE,KAAK;QACpC,sBAAsB,EAAE,IAAI;KAC7B,EACD,GAAG,+BAA+B,aAAa,CAChD,CAAC;IACF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,UAAU,EAAE;YACV,UAAU,EAAE,+BAA+B;YAC3C,gBAAgB,EAAE,eAAe;YACjC,OAAO;YACP,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,wBAAwB;YACjC,sBAAsB,EAAE,oBAAoB;YAC5C,6BAA6B,EAAE,KAAK;YACpC,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,sBAAsB,EAAE,KAAK;YAC7B,iBAAiB,EAAE,gBAAgB;SACpC;KACF,CAAC;AACJ,CAAC"} \ No newline at end of file diff --git a/packages/verify/dist/index.d.ts b/packages/verify/dist/index.d.ts index f9d894943..8f94e9d97 100644 --- a/packages/verify/dist/index.d.ts +++ b/packages/verify/dist/index.d.ts @@ -345,4 +345,5 @@ export declare function evaluateAgentBinding(context: any, opts?: Obj): Obj; export { resolveOperatorKeys, verifyFederatedReceiptOffline, verifyFederatedReceipt, } from './federation.js'; export { verifyQuorum } from './quorum.js'; export { AEB_CROSSING_RECORD_REQUIRED_ALGORITHMS, AEB_CROSSING_RECORD_VERSION, BCR_CROSSING_ADAPTER, BCR_CROSSING_MAPPING_PROFILE, WIMSE_OAUTH_CROSSING_ADAPTER, WIMSE_OAUTH_CROSSING_MAPPING_PROFILE, crossingRecordContractDigest, crossingRecordDigest, crossingRecordSignedBytes, issueAebCrossingRecord, mapBcrCrossingAuthority, mapWimseOAuthCrossingAuthority, verifyAebCrossingRecord, } from './aeb-crossing-record.js'; +export { AIC_CROSSING_MAX_STATUS_AGE_SECONDS, AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, AIC_JWT_SVID_PROJECTION_VERSION, AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, AIC_ADMISSION_DOMAIN_VERSION, AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, mapAicJwtJktBoundCrossingAuthority, mapAicX509SpkiBoundCrossingAuthority, issueAicBoundCrossingRecord, projectAicJwtToStrictJwtSvid, } from './aeb-aic-crossing-adapter.js'; //# sourceMappingURL=index.d.ts.map \ No newline at end of file diff --git a/packages/verify/dist/index.d.ts.map b/packages/verify/dist/index.d.ts.map index adc418058..b60876d95 100644 --- a/packages/verify/dist/index.d.ts.map +++ b/packages/verify/dist/index.d.ts.map @@ -1 +1 @@ -{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,sBAAsB,EAGvB,MAAM,kBAAkB,CAAC;AAS1B,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAE/B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,2BAA2B,EAC3B,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mCAAmC,CAAC;AAClD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sCAAsC,CAAC;AACrD,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAM/C,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAIpC,cAAc,sBAAsB,CAAC;AAIrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,6BAA6B,EAC7B,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,aAAa,EACb,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,qCAAqC,EACrC,qCAAqC,GACtC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,YAAY,CAAC;AA6BpB,QAAA,MAAM,YAAY,+BAAyB,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,GAAG,GAAG,MAAM,CAErD;AAKD,OAAO,EAAE,YAAY,EAAE,CAAC;AAIxB,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAIlF,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAI9E,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAIxF,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAIhH,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,eAAe,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAI9S,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAO5G,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,yBAAyB,EACzB,6BAA6B,EAC7B,yCAAyC,EACzC,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAchF,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAMjF,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAOvB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,GACV,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,eAAe,EACf,QAAQ,IAAI,wBAAwB,EACpC,6BAA6B,EAC7B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAc9B,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAkB5C;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAyEvF;AAMD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,GAAE,GAAQ,GAAG,OAAO,CAehH;AAwED,sEAAsE;AACtE,eAAO,MAAM,6BAA6B,iCAAiD,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAExF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,yBAAyB,EAAE,OAAO,GACjC,0BAA0B,GAAG,IAAI,CAcnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAsK1G;AAMD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,GAAG,EACV,kBAAkB,GAAE,MAAM,GAAG,IAAI,GAAG,SAAgB,EACpD,OAAO,GAAE,GAAQ,GAChB,GAAG,CAqCL;AAMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,GAAG,GAAG,CAsBhF;AA8CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,oBAAoB,EAAE,GAAG,EACzB,gBAAgB,EAAE,GAAG,EACrB,IAAI,GAAE,GAAQ,GACb,GAAG,CAqEL;AAkZD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAwrBpE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAExF;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAE9F;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAiEtE;AASD,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAK3C,OAAO,EACL,uCAAuC,EACvC,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,EAC5B,4BAA4B,EAC5B,oCAAoC,EACpC,4BAA4B,EAC5B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,0BAA0B,CAAC"} \ No newline at end of file +{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,sBAAsB,EAGvB,MAAM,kBAAkB,CAAC;AAS1B,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAE/B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,2BAA2B,EAC3B,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mCAAmC,CAAC;AAClD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sCAAsC,CAAC;AACrD,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAM/C,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAIpC,cAAc,sBAAsB,CAAC;AAIrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,6BAA6B,EAC7B,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,aAAa,EACb,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,qCAAqC,EACrC,qCAAqC,GACtC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,YAAY,CAAC;AA6BpB,QAAA,MAAM,YAAY,+BAAyB,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,GAAG,GAAG,MAAM,CAErD;AAKD,OAAO,EAAE,YAAY,EAAE,CAAC;AAIxB,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAIlF,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAI9E,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAIxF,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAIhH,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,eAAe,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAI9S,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAO5G,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,yBAAyB,EACzB,6BAA6B,EAC7B,yCAAyC,EACzC,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAchF,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAMjF,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAOvB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,GACV,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,eAAe,EACf,QAAQ,IAAI,wBAAwB,EACpC,6BAA6B,EAC7B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAc9B,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAkB5C;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAyEvF;AAMD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,GAAE,GAAQ,GAAG,OAAO,CAehH;AAwED,sEAAsE;AACtE,eAAO,MAAM,6BAA6B,iCAAiD,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAExF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,yBAAyB,EAAE,OAAO,GACjC,0BAA0B,GAAG,IAAI,CAcnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAsK1G;AAMD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,GAAG,EACV,kBAAkB,GAAE,MAAM,GAAG,IAAI,GAAG,SAAgB,EACpD,OAAO,GAAE,GAAQ,GAChB,GAAG,CAqCL;AAMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,GAAG,GAAG,CAsBhF;AA8CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,oBAAoB,EAAE,GAAG,EACzB,gBAAgB,EAAE,GAAG,EACrB,IAAI,GAAE,GAAQ,GACb,GAAG,CAqEL;AAkZD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAwrBpE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAExF;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAE9F;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG,CAiEtE;AASD,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAK3C,OAAO,EACL,uCAAuC,EACvC,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,EAC5B,4BAA4B,EAC5B,oCAAoC,EACpC,4BAA4B,EAC5B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,+BAA+B,EAC/B,wCAAwC,EACxC,4BAA4B,EAC5B,4CAA4C,EAC5C,kCAAkC,EAClC,oCAAoC,EACpC,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC"} \ No newline at end of file diff --git a/packages/verify/dist/index.js b/packages/verify/dist/index.js index d6be877da..fe1c695bb 100644 --- a/packages/verify/dist/index.js +++ b/packages/verify/dist/index.js @@ -2150,6 +2150,10 @@ export { verifyQuorum } from './quorum.js'; // crossed one relying-party boundary under one verified native authority // instance. Verification is evidence-only and never authorizes another entry. export { AEB_CROSSING_RECORD_REQUIRED_ALGORITHMS, AEB_CROSSING_RECORD_VERSION, BCR_CROSSING_ADAPTER, BCR_CROSSING_MAPPING_PROFILE, WIMSE_OAUTH_CROSSING_ADAPTER, WIMSE_OAUTH_CROSSING_MAPPING_PROFILE, crossingRecordContractDigest, crossingRecordDigest, crossingRecordSignedBytes, issueAebCrossingRecord, mapBcrCrossingAuthority, mapWimseOAuthCrossingAuthority, verifyAebCrossingRecord, } from './aeb-crossing-record.js'; +// Native AIC crossing mappings preserve the pure-JSON RFC 7638 JKT and +// X.509 SPKI cases as separate authority systems. The JWT-SVID helper emits a +// new-signature-required identity projection and never authorizes an action. +export { AIC_CROSSING_MAX_STATUS_AGE_SECONDS, AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, AIC_JWT_SVID_PROJECTION_VERSION, AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, AIC_ADMISSION_DOMAIN_VERSION, AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, mapAicJwtJktBoundCrossingAuthority, mapAicX509SpkiBoundCrossingAuthority, issueAicBoundCrossingRecord, projectAicJwtToStrictJwtSvid, } from './aeb-aic-crossing-adapter.js'; // EP-AEC-v1 is available through the explicit `./evidence-chain` package subpath. // It is not re-exported here because evidence-chain.js composes this module and a // main-entry re-export would create a circular initialization path. diff --git a/packages/verify/dist/index.js.map b/packages/verify/dist/index.js.map index c5275943f..2e46cca36 100644 --- a/packages/verify/dist/index.js.map +++ b/packages/verify/dist/index.js.map @@ -1 +1 @@ -{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAE1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,IAAI,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAI7F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,2BAA2B,EAC3B,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mCAAmC,CAAC;AAClD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sCAAsC,CAAC;AACrD,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,sEAAsE;AACtE,0EAA0E;AAC1E,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,6EAA6E;AAC7E,wEAAwE;AACxE,gFAAgF;AAChF,cAAc,sBAAsB,CAAC;AACrC,2EAA2E;AAC3E,8EAA8E;AAC9E,0CAA0C;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,6BAA6B,EAC7B,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,2EAA2E;AAC3E,8EAA8E;AAC9E,0DAA0D;AAC1D,OAAO,EACL,aAAa,EACb,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,qCAAqC,EACrC,qCAAqC,GACtC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAE7D,SAAS,eAAe,CAAC,KAAU;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;WAC5C,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,CAAC,eAAe,CAAC,CAAC;AAC7C,MAAM,wBAAwB,GAAG,CAAC,aAAa,CAAC,CAAC;AAEjD,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAU;IAC1C,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAY;IAC3C,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,uCAAuC;AACvC,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,iFAAiF;AACjF,2EAA2E;AAC3E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAElF,0EAA0E;AAC1E,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAExF,8EAA8E;AAC9E,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEhH,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,eAAe,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAE9S,yEAAyE;AACzE,gFAAgF;AAChF,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE5G,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AACvE,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,yBAAyB,EACzB,6BAA6B,EAC7B,yCAAyC,EACzC,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAE7B,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEhF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAC9E,mCAAmC;AAEnC,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,iDAAiD;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEjF,8EAA8E;AAC9E,gFAAgF;AAChF,qEAAqE;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,0EAA0E;AAC1E,6EAA6E;AAC7E,wEAAwE;AACxE,qEAAqE;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,GACV,MAAM,wBAAwB,CAAC;AAEhC,wEAAwE;AACxE,4EAA4E;AAC5E,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,eAAe,EACf,QAAQ,IAAI,wBAAwB,EACpC,6BAA6B,EAC7B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAEpC,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,2EAA2E;AAC3E,qEAAqE;AACrE,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,uEAAuE;AACvE,mCAAmC;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAC5C,6DAA6D;AAC7D,SAAS,UAAU,CAAC,gBAAwB;IAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;SAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;SACnF,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AACD,oFAAoF;AACpF,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;SAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;SACnG,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,GAAQ,EAAE,kBAA0B,EAAE,OAAY,EAAE;IAChF,6EAA6E;IAC7E,MAAM,MAAM,GAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEvE,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,KAAK,EAAE,sFAAsF;SAC9F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAEtB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,KAAK,EAAE,qGAAqG;SAC7G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,gFAAgF;QAChF,6EAA6E;QAC7E,gFAAgF;QAChF,8EAA8E;QAC9E,yCAAyC;QACzC,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gCAAgC,SAAS,CAAC,iBAAiB,mCAAmC,EAAE,CAAC;QACzI,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kCAAkC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzH,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,EAAE,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;QACjF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,aAAa,CAAC;QAC9C,IAAI,IAAI,EAAE,CAAC;YACT,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,YAAY;mBAChD,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/G,CAAC;aAAM,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC3C,yEAAyE;YACzE,4EAA4E;YAC5E,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,CAAC,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACvG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,KAAY,EAAE,YAAoB,EAAE,OAAY,EAAE;IACrG,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtD,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACxE,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,OAAO,KAAK,YAAY,CAAC;AAClC,CAAC;AAED,gFAAgF;AAChF,mDAAmD;AACnD,gFAAgF;AAEhF,yEAAyE;AACzE,uEAAuE;AACvE,6BAA6B;AAC7B,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB,SAAS,6BAA6B,CAAC,QAAgB,EAAE,IAAS;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACxC,IAAI,aAAa,GAAG,WAAW,CAAC;IAChC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,aAAa,GAAG,aAAa,CAAC;IAChC,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;IACrE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO;QAC9C,YAAY,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO;QAC3C,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAa,EAAE,IAAS;IAC1D,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;WACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC;eACxC,IAAI,CAAC,iBAAiB,GAAG,CAAC;eAC1B,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,EAAE,CAAC;QAC9C,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;WAC7B,IAAI,CAAC,aAAa,KAAK,SAAS;WAChC,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,8CAA8C,CAAC;IACxD,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QACvD,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,QAAQ,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QACnF,OAAO,yFAAyF,CAAC;IACnG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,sEAAsE;AACtE,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,+EAA+E;AAC/E,wEAAwE;AACxE,oCAAoC;AACpC,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,6EAA6E;AAC7E,+CAA+C;AAC/C,8EAA8E;AAE9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,WAAW,CAAU,CAAC,CAAC;AAG5F;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,yBAAkC;IAElC,IAAI,CAAC;QACH,IAAI,OAAO,yBAAyB,KAAK,QAAQ,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzG,MAAM,GAAG,GAAG,eAAe,CAAC,yBAAyB,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,IAAI,SAAS,CAAC,iBAAiB,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC;QACpE,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,SAAS,CAAC,iBAAiB,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAY,EAAE,yBAAiC,EAAE,OAAY,EAAE;IACnG,qKAAqK;IACrK,MAAM,MAAM,GAAQ;QAClB,iBAAiB,EAAE,KAAK;QACxB,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,KAAK;QACnB,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,IAAI,aAAa,GAAe,IAAI,CAAC;IAErC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAClG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;eACnD,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;eAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAe,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC7E,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QACnF,CAAC;QAED,4DAA4D;QAC5D,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,2BAA2B,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5G,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,iBAAiB,GAAG,MAAM;aAC7B,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;aAC7C,MAAM,EAAE;aACR,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzB,MAAM,CAAC,iBAAiB,GAAG,UAAU,CAAC,SAAS,KAAK,iBAAiB,CAAC;QAEtE,6DAA6D;QAC7D,MAAM,CAAC,gBAAgB,GAAG,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC;QAE7D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;mBAC7B,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;mBAChD,UAAU,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO,CAAC;QACpD,MAAM,CAAC,aAAa,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO,CAAC;QACrD,aAAa,GAAG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,0BAA0B,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACrE,CAAC;QAED,gCAAgC;QAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACxF,MAAM,CAAC,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,QAAQ;YACR,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE;SAC7D,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;YACvC,GAAG,EAAE,eAAe,CAAC,yBAAyB,CAAC;YAC/C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,0BAA0B,CAAC,yBAAyB,CAAC,CAAC;QAElE,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAE,6BAAmD,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,oCAAoC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAChH,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM;oBACN,aAAa;oBACb,KAAK,EAAE,wCAAwC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,GAAG,IAAI,aAAa,EAAE;iBAC3G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAC9B,QAAQ,EACR,UAAU,EACV,SAAS,EACT,eAAe,CAAC,SAAS,CAAC,CAC3B,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,8DAA8D;YAC9D,4BAA4B;YAC5B,MAAM,YAAY,GAAG,yBAAyB,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC3F,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YAC1F,CAAC;YACD,MAAM,KAAK,GAAG,wBAAwB,CACpC,IAAI,UAAU,CAAC,UAAU,CAAC,EAC1B,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EACxF,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,EAC9C,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAmB,CACvC,CAAC;YACF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC5B,gEAAgE;gBAChE,kEAAkE;gBAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC;YAClG,CAAC;YACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,iCAAiC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACvI,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB;WACjC,MAAM,CAAC,gBAAgB;WACvB,MAAM,CAAC,YAAY;WACnB,MAAM,CAAC,aAAa;WACpB,MAAM,CAAC,SAAS;WAChB,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,gCAAgC;AAChC,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAU,EACV,qBAAgD,IAAI,EACpD,UAAe,EAAE;IAEjB,IAAI,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;IAC7F,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,CAAC,kBAAkB,CAAC;IAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC;IAE9C,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,YAAY;YAC1C,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,CAAC,YAAY;gBACb,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,uBAAuB,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,2BAA2B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9H,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAW,EAAE,kBAA0B;IACzE,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,cAAc,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;IACrF,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,mCAAmC,CAAC,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,KAAK;YAAE,QAAQ,EAAE,CAAC;;YACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,KAAK,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC1F,CAAC;AAED,gFAAgF;AAChF,8DAA8D;AAC9D,gFAAgF;AAEhF,uEAAuE;AACvE,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,yBAAyB;AACzB,uEAAuE;AACvE,8EAA8E;AAC9E,+BAA+B;AAC/B,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,uEAAuE;AAEvE,MAAM,WAAW,GAAG,UAAU,CAAC;AAE/B,SAAS,KAAK,CAAC,CAAM;IACnB,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,MAAM,CAAC,KAAK,EAAE,QAAQ,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAW;IAC7C,MAAM,UAAU,GAAG,OAAO,MAAM,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,SAAS,GAAG,sFAAsF,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1H,MAAM,QAAQ,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC;IAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,SAAS,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,SAAW,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mCAAmC,CACjD,oBAAyB,EACzB,gBAAqB,EACrB,OAAY,EAAE;IAEd,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAU,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,6DAA6D,CAAC;YACvE,WAAW;SACZ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,IAAI,OAAO,oBAAoB,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;WACrG,CAAC,gBAAgB,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpG,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,yEAAyE,CAAC;YACnF,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ;eAChD,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,SAAS;QAE7D,IAAI,SAAS,CAAC,cAAc,KAAK,SAAS,IAAI,SAAS,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAChF,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QAC9E,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,4CAA4C,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,aAAa,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,KAAK,IAAI;YAC7F,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,gDAAgD,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QAED,IAAI,WAAW,GAAG,eAAe,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,WAAW,GAAG,GAAG,CAAC;YACtC,MAAM,kBAAkB,GAAG,SAAS,CAAC,cAAc,KAAK,SAAS;mBAC5D,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC;YACvC,MAAM,kBAAkB,GAAG,IAAI,CAAC,uCAAuC,KAAK,IAAI,CAAC;YACjF,WAAW,CAAC,IAAI,CAAC;gBACf,eAAe,EAAE,KAAK;gBACtB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,2BAA2B;gBAClF,iBAAiB,EAAE,aAAa,CAAC,QAAQ,IAAI,IAAI;gBACjD,aAAa,EAAE,SAAS,CAAC,QAAQ;gBACjC,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,IAAI;gBAChD,kBAAkB,EAAE,kBAAkB;aACvC,CAAC,CAAC;YACH,IAAI,WAAW,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC9D,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,2DAA2D;sBACjE,kEAAkE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,cAAc,GAAG,wFAAwF,CAAC;AAChH,SAAS,YAAY,CAAC,KAAU;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IACvB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,AAAD,EAAG,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;IACrF,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,IAAI,IAAI,IAAI,MAAM,IAAI,MAAM,EAAE;QAAE,OAAO,GAAG,CAAC;IAC9G,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,GAAG,CAAC;IACnG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,CAAM,EAAE,IAAS,EAAE,EAAO;IAC9C,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,IAAI,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAAC,CAAC;IACxF,IAAI,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAa;IACzC,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1D,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,sBAAsB,CAAC,QAAa,EAAE,WAAmB,EAAE,iBAAyB,EAAE,OAAY,EAAE;IAC3G,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC/F,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;QACzD,MAAM,aAAa,GAAG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,0BAA0B,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC5E,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QAC/E,IAAI,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACpH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACxF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACjG,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;mBAC/B,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;mBAChD,UAAU,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,0BAA0B;QAC5G,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,sCAAsC;QAExH,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3G,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;YACvC,GAAG,EAAE,eAAe,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;SACrE,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC1F,aAAa;SACd,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,aAAqB,EAAE,WAAmB,EAAE,iBAAyB;IACpG,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;YACvC,GAAG,EAAE,eAAe,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;SACrE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAG;IACzB,aAAa;IACb,OAAO;IACP,QAAQ;IACR,eAAe;IACf,mBAAmB;IACnB,aAAa;IACb,aAAa;IACb,aAAa;CACd,CAAC;AAEF,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,OAAO;QACL,OAAO;QACP,KAAK,EAAE,CAAC,OAAO;QACf,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QAC1F,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAU;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,wBAAwB;AACxB,SAAS,uBAAuB,CAAC,KAAU;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAAW,EAAE,IAAY,EAAE,EAAO,EAAE,OAAgB;IACtE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,IAAI,OAAO;QAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAW,EAAE,OAAY,EAAE,QAAe,EAAE,QAAe,EAAE,aAA+B,EAAE,YAAiB,EAAE,YAAiB,EAAE,IAAS;IAC/K,MAAM,cAAc,GAAG,EAAE,CAAC;IAE1B,IAAI,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;YACxB,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC1B,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,6EAA6E;QAC7E,6EAA6E;QAC7E,gEAAgE;QAChE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,QAAQ,EAAE,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzD,IAAI,QAAQ,KAAK,GAAG;YAAE,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,GAAG,KAAK,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC5D,IAAI,GAAG,KAAK,CAAC;gBACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAElC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;WACtB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACjF,QAAQ,GAAG,KAAK,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IAC7G,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;eACJ,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;eACxD,MAAM,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9C,QAAQ,GAAG,KAAK,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEvC,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7C,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7C,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAE9C,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;YAClC,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YAC9F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvF,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YACnG,SAAS;QACX,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,eAAe,uBAAuB,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,YAAY,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC;YACtB,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;YACrF,SAAS;QACX,CAAC;QACD,IAAI,kBAAkB,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,kBAAkB,EAAE,CAAC;YACxE,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,MAAM,YAAY,GAAG,CAAC,KAAU,EAAE,OAAe,EAAQ,EAAE;QACzD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC1D,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IACF,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;IAC7E,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,sDAAsD,CAAC,CAAC;IACxG,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,sDAAsD,CAAC,CAAC;IACnH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;QACtD,YAAY,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,gEAAgE,CAAC,CAAC;QACjG,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,gEAAgE,CAAC,CAAC;QACjG,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,4DAA4D,CAAC,CAAC;QAC1F,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,8DAA8D,CAAC,CAAC;QAC7F,YAAY,CAAC,GAAG,EAAE,UAAU,EAAE,+DAA+D,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,YAAY,CAAC,CAAC,EAAE,YAAY,EAAE,iEAAiE,CAAC,CAAC;QACjG,YAAY,CAAC,CAAC,EAAE,eAAe,EAAE,oEAAoE,CAAC,CAAC;QACvG,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,8DAA8D,CAAC,CAAC;QAC3F,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,8DAA8D,CAAC,CAAC;QAC3F,4EAA4E;QAC5E,8EAA8E;QAC9E,uDAAuD;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjF,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrB,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;YACxG,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,sDAAsD,CAAC,CAAC;YACpG,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,wDAAwD,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,uDAAuD,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAEhD,MAAM,CAAC,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,iFAAiF;AACjF,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAE5E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa;CACzF,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;AACzF,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,SAAS,sBAAsB,CAAC,QAAe;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,UAAU,GAAG,IAAI,CAAC;IAEtB,8EAA8E;IAC9E,uCAAuC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,UAAU,GAAG,KAAK,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,GAAG,KAAK,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,kHAAkH,CAAC,CAAC;IAClI,CAAC;IAED,kDAAkD;IAClD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,qBAAqB,CAAC;QACtC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,IAAI,kBAAkB,CAAC;QAC/C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,mBAAmB,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,2BAA2B,GAAG,wEAAwE,CAAC,CAAC;YACtJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,uCAAuC,GAAG,CAAC,kBAAkB,GAAG,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,GAAG,CAAC,kBAAkB,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,0EAA0E,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAC1F,MAAM,CAAC,IAAI,CAAC,uCAAuC,GAAG,gBAAgB,yBAAyB,6BAA6B,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,iCAAiC,CAAC,OAAY;IACrD,IAAI,CAAC;QACH,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,OAAO,oBAAoB,CAAC;QAE7D,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACnC,OAAO,WAAW,CAAC,SAAS,CAAC;QAC7B,OAAO,WAAW,CAAC,mBAAmB,CAAC;QACvC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC;YAAE,OAAO,oBAAoB,CAAC;QAEjE,MAAM,UAAU,GAAG,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC;QAClD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,gBAAgB,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;YAC3C,OAAO,gBAAgB,CAAC,aAAa,CAAC;YACtC,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;gBAAE,OAAO,0BAA0B,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAY,EAAE,OAAY,EAAE;IAC7D,IAAI,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAQ;QAClB,WAAW,EAAE,KAAK,EAAS,SAAS;QACpC,mBAAmB,EAAE,KAAK,EAAE,SAAS;QACrC,kBAAkB,EAAE,KAAK,EAAE,SAAS;QACpC,GAAG,EAAE,KAAK,EAAiB,SAAS;QACpC,SAAS,EAAE,KAAK,EAAW,UAAU;QACrC,oBAAoB,EAAE,KAAK,EAAE,UAAU;QACvC,OAAO,EAAE,KAAK,EAAa,SAAS;KACrC,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,eAAe,GAAQ,EAAE,CAAC;IAChC,MAAM,aAAa,GAAQ;QACzB,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,eAAe;QAC9B,iBAAiB,EAAE,SAAS;QAC5B,eAAe,EAAE;YACf,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,cAAc;SACzB;QACD,OAAO,EAAE,oDAAoD;KAC9D,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,YAAY,CAAC;IAC/D,IAAI,gBAAgB,KAAK,YAAY,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,MAAM,EAAE,CAAC,oDAAoD,CAAC;YAC9D,cAAc,EAAE,aAAa;SAC9B,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;QAC7D,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,MAAM,EAAE,CAAC,qCAAqC,CAAC;YAC/C,cAAc,EAAE,aAAa;SAC9B,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,MAAM,EAAE,CAAC,2EAA2E,CAAC;YACrF,cAAc,EAAE,aAAa;SAC9B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACxD,IAAI,WAAW,GAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAO,EAAE;QAChC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,MAAM;YACN,WAAW;YACX,MAAM;YACN,cAAc,EAAE,aAAa;YAC7B,GAAG,eAAe;SACnB,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,GAAG,YAAY,+EAA+E,CAAC,CAAC;IAC9G,CAAC;IACD,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,WAAW,GAAG,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IAC1D,MAAM,EAAE,YAAY,GAAG,EAAE,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,aAAa,CAAC,eAAe,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAY,EAAE,EAAE,CACvE,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAEhG,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,gFAAgF;IAChF,gFAAgF;IAChF,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC;IAC/F,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,mHAAmH,CAAC,CAAC;IACnI,CAAC;IAED,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,CAAC,wBAAwB,GAAG,KAAK,CAAC;QACxC,MAAM,UAAU,GAAG,mCAAmC,CACpD,IAAI,CAAC,oBAAoB,EACzB,YAAY,EACZ;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,uCAAuC,EACrC,IAAI,CAAC,uCAAuC,KAAK,IAAI;SACxD,CACF,CAAC;QACF,eAAe,CAAC,wBAAwB,GAAG,UAAU,CAAC;QACtD,MAAM,CAAC,wBAAwB,GAAG,UAAU,CAAC,KAAK,KAAK,IAAI,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,WAAW,GAAG,aAAa,KAAK,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAE/F,6EAA6E;IAC7E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,wBAAwB;IACzD,IAAI,aAAa,GAAG,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,aAAa,EAAE,CAAC;YAC7C,aAAa,GAAG,KAAK,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,QAAQ,IAAI,kBAAkB,qCAAqC,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,aAAa,GAAG,KAAK,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,aAAa,GAAG,KAAK,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1B,aAAa,GAAG,KAAK,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,CAAC,mBAAmB,GAAG,aAAa,CAAC;IAE3C,6EAA6E;IAC7E,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC,8DAA8D;IACxF,MAAM,cAAc,GAAG,EAAE,CAAC,CAAC,4DAA4D;IACvF,MAAM,gBAAgB,GAAU,EAAE,CAAC;IACnC,IAAI,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC1B,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,4CAA4C;QAC5C,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClF,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,eAAe,yBAAyB,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1C,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,eAAe,eAAe,QAAQ,CAAC,WAAW,0BAA0B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxH,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,2EAA2E;QAC3E,mEAAmE;QACnE,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAC9E,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChC,YAAY,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,eAAe,oCAAoC,CAAC,CAAC;gBACjF,SAAS;YACX,CAAC;YACD,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,eAAe,2DAA2D,CAAC,CAAC;YAC1G,SAAS;QACX,CAAC;QACD,0EAA0E;QAC1E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,eAAe,6BAA6B,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;mBACjD,WAAY,GAAG,WAAW,IAAI,WAAY,GAAG,SAAS,EAAE,CAAC;gBAC9D,YAAY,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,eAAe,+CAA+C,CAAC,CAAC;gBAC9F,SAAS;YACX,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,WAAW,KAAK,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,WAAW,EAAE,CAAC;YACtE,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,eAAe,kDAAkD,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QACD,IAAI,WAAW,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,WAAW,EAAE,CAAC;YACpE,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,eAAe,kDAAkD,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClD,8EAA8E;QAC9E,0EAA0E;QAC1E,0EAA0E;QAC1E,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACxD,IAAI,KAAc,CAAC;QACnB,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG;gBACrB,GAAG,IAAI;gBACP,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC/D,aAAa,EAAE,IAAI,CAAC,qBAAqB,IAAI,SAAS;aACvD,CAAC;YACF,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;gBACtF,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC/E,gBAAgB,CAAC,IAAI,CAAC;gBACpB,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,aAAa,EAAE,cAAc,CAAC,aAAa;gBAC3C,cAAc,EAAE,cAAc,CAAC,aAAa;gBAC5C,KAAK,EAAE,cAAc,CAAC,KAAK,KAAK,IAAI;gBACpC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,KAAK,GAAG,cAAc,CAAC,KAAK,KAAK,IAAI,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,uBAAuB,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,QAAQ,kBAAkB,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC;QAC/E,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpC,oEAAoE;QACpE,2EAA2E;QAC3E,4EAA4E;QAC5E,0DAA0D;QAC1D,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC9D,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,QAAQ,gCAAgC,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,QAAQ,uCAAuC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,MAAM,CAAC,kBAAkB,GAAG,YAAY,CAAC;IACzC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAAE,eAAe,CAAC,iBAAiB,GAAG,gBAAgB,CAAC;IAEtF,6EAA6E;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;IAC3C,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACxF,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACjD,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC9C,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,kBAAkB,cAAc,CAAC,MAAM,yBAAyB,iBAAiB,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;IAEnB,6EAA6E;IAC7E,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAC7B,IAAI,EAAE,EAAE,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;QACvD,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACnC,OAAO,WAAW,CAAC,SAAS,CAAC;QAC7B,OAAO,WAAW,CAAC,mBAAmB,CAAC;QACvC,MAAM,aAAa,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC;QAC9D,6EAA6E;QAC7E,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,uBAAuB;QACvB,IAAI,gBAAgB,GAAG,IAAI,CAAC;QAC5B,IAAI,EAAE,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;gBAClC,gBAAgB,GAAG,yEAAyE,CAAC;YAC/F,CAAC;iBAAM,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;gBAC9D,gBAAgB,GAAG,kEAAkE,CAAC;YACxF,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,2EAA2E;YAC3E,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YACpE,MAAM,CAAC,SAAS,GAAG,aAAa,KAAK,QAAQ;mBACxC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,IAAI,aAAa,KAAK,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;iBACvG,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACnH,CAAC;aAAM,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,IAAI,CAAC,6BAA6B,KAAK,IAAI,EAAE,CAAC;YAC1F,0EAA0E;YAC1E,uEAAuE;YACvE,kCAAkC;YAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;YACvC,MAAM,CAAC,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;QACrH,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;QACnG,CAAC;QAED,IAAI,YAAY,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YAChD,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,gBAAgB,CAAC,aAAa,CAAC;YACtC,MAAM,CAAC,oBAAoB,GAAG,uBAAuB,CACnD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EACzD,WAAW,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,EAC3C,YAAY,CACb,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBAAE,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,EAAE;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,gFAAgF;IAChF,EAAE;IACF,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACnC,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,CAAC;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACvG,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;QACxG,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,2BAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC1G,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,sEAAsE;IACtE,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,4CAA4C;IAC5C,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAC9B,MAAM,UAAU,GAAG,EAAE,EAAE,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClD,eAAe,CAAC,cAAc,GAAG;gBAC/B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;gBAC/C,OAAO,EAAE,CAAC,mDAAmD,CAAC;aAC/D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzC,eAAe,CAAC,cAAc,GAAG;gBAC/B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;gBAC/C,OAAO,EAAE,CAAC,wEAAwE,CAAC;aACpF,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1F,eAAe,CAAC,cAAc,GAAG,GAAG,CAAC;YACrC,MAAM,CAAC,cAAc,GAAG,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,+CAA+C,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,qDAAqD;IACrD,MAAM,yBAAyB,GAAG,IAAI,CAAC,qBAAqB,KAAK,IAAI,CAAC;IACtE,MAAM,mCAAmC,GACvC,gBAAgB,KAAK,SAAS,IAAI,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,iBAAiB,GAAG,yBAAyB,IAAI,mCAAmC,CAAC;IAC3F,IAAI,iBAAiB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,mCAAmC;YAChD,CAAC,CAAC,8EAA8E;YAChF,CAAC,CAAC,8CAA8C,CAAC;QACnD,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,eAAe,CAAC,eAAe,GAAG;YAChC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,MAAM;SACP,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;SAAM,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/B,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAClC,eAAe,CAAC,eAAe,GAAG;gBAChC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;gBACjD,MAAM,EAAE,2EAA2E;aACpF,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAChG,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAQ,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,aAAa,CAAQ,CAAC;YAC5F,eAAe,CAAC,eAAe,GAAG,GAAG,CAAC;YACtC,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,4DAA4D;IAC5D,8DAA8D;IAC9D,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,MAAM,MAAM,GAAG;YACb,WAAW,EAAE,SAAkB;YAC/B,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QACF,MAAM,OAAO,GAAU,EAAE,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,aAAa,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,SAAS,EAAE,WAAW,KAAK,MAAM,CAAC,WAAW;uBACtD,SAAS,EAAE,SAAS,KAAK,MAAM,CAAC,SAAS;uBACzC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjE,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE;oBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,IAAI,MAAM,CAAC,KAAK;oBAAE,OAAO,GAAG,IAAI,CAAC;;oBAC5B,aAAa,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,aAAa;gBACb,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,cAAc;oBACd,CAAC,CAAC,eAAe;oBACjB,CAAC,CAAC,4BAA4B,CAAC;QACrC,eAAe,CAAC,UAAU,GAAG;YAC3B,MAAM;YACN,uBAAuB,EAAE,OAAO,CAAC,MAAM;YACvC,OAAO;YACP,OAAO,EAAE,MAAM,KAAK,4BAA4B;gBAC9C,CAAC,CAAC,uEAAuE;gBACzE,CAAC,CAAC,IAAI;SACT,CAAC;QACF,aAAa,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACzC,MAAM,CAAC,UAAU,GAAG,MAAM,KAAK,4BAA4B,CAAC;QAC5D,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;aAC9F,IAAI,MAAM,KAAK,eAAe;YAAE,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACtG,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,2EAA2E;QAC3E,qEAAqE;QACrE,0EAA0E;QAC1E,6EAA6E;QAC7E,4EAA4E;QAC5E,mBAAmB;QACnB,MAAM,GAAG,GAAG,gBAAgB,CAAC;YAC3B,OAAO;YACP,sBAAsB,EAAE,CAAC,CAAC,sBAAsB,KAAK,IAAI;YACzD,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;YAC1C,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;SACvC,CAAC,CAAC;QACH,eAAe,CAAC,QAAQ,GAAG,GAAG,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,OAAO,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,wCAAwC,GAAG,CAAC,aAAa,CAAC,MAAM,MAAM,GAAG,CAAC,aAAa,CAAC,MAAM,wBAAwB,CAAC,CAAC;QACtI,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,sCAAsC;IACtC,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC1D,eAAe,CAAC,WAAW,GAAG,GAAG,CAAC;QAClC,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,qCAAqC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,aAAa,GAAG,2DAA2D,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,kEAAkE;IAClE,2EAA2E;IAC3E,IAAI,IAAI,CAAC,2BAA2B,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,CAAC,qBAAqB,GAAG,KAAK,CAAC;QACrC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;YAChE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;YACnC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,eAAe,CAAC,qBAAqB,GAAG;gBACtC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI;gBAC3B,MAAM,EAAE,CAAC,4EAA4E,CAAC;gBACtF,gBAAgB,EAAE,IAAI;aACvB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC9C,eAAe,CAAC,qBAAqB,GAAG,GAAG,CAAC;YAC5C,MAAM,CAAC,qBAAqB,GAAG,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,IAAI,SAAS,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,SAAS,GAAG,KAAK,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,wCAAwC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC;IACtD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,SAAS,GAAG,KAAK,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,IAAI,WAAW,KAAK,IAAI,IAAI,YAAY,CAAC,WAAW,CAAC,GAAG,WAAW,EAAE,CAAC;YACpE,SAAS,GAAG,KAAK,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAC9E,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9D,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;gBACpE,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC;IAE3B,+EAA+E;IAC/E,gFAAgF;IAChF,gFAAgF;IAChF,yEAAyE;IACzE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACjH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC;IACnE,8EAA8E;IAC9E,2EAA2E;IAC3E,OAAO;QACL,KAAK;QACL,MAAM;QACN,MAAM;QACN,WAAW;QACX,MAAM;QACN,cAAc,EAAE,aAAa;QAC7B,GAAG,eAAe;KACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAY,EAAE,WAAgB,EAAE,OAAY,EAAE;IACjF,OAAO,wBAAwB,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AAClF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,OAAY,EAAE,YAAmB,EAAE,OAAY,EAAE;IACvF,OAAO,2BAA2B,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACtF,CAAC;AAED,gFAAgF;AAChF,0EAA0E;AAC1E,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAY,EAAE,OAAY,EAAE;IAC/D,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACrG;;2EAEuE;IACvE,MAAM,GAAG,GAAQ;QACf,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,CAAC;YACX,CAAC,CAAC;gBACE,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD;YACH,CAAC,CAAC,IAAI;QACR,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI;QACpC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI;QACzC,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,UAAU;KACnB,CAAC;IAEF,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,2BAA2B,CAAC;YACzC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,uCAAuC,CAAC;YACrD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,yBAAyB,CAAC;YACvC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,kCAAkC,CAAC;YAChD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;QAClC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAuB,gDAAgD;YACxF,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,uBAAuB,CAAC;QACvC,CAAC;aAAM,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,+BAA+B,GAAG,CAAC,WAAW,cAAc,SAAS,IAAI,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;YACjB,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,+EAA+E;AAC/E,uFAAuF;AACvF,uEAAuE;AACvE,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAEzB,uFAAuF;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,OAAO,EACL,uCAAuC,EACvC,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,EAC5B,4BAA4B,EAC5B,oCAAoC,EACpC,4BAA4B,EAC5B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,kFAAkF;AAClF,kFAAkF;AAClF,oEAAoE"} \ No newline at end of file +{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAE1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,IAAI,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAI7F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,2BAA2B,EAC3B,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mCAAmC,CAAC;AAClD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sCAAsC,CAAC;AACrD,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,sEAAsE;AACtE,0EAA0E;AAC1E,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,6EAA6E;AAC7E,wEAAwE;AACxE,gFAAgF;AAChF,cAAc,sBAAsB,CAAC;AACrC,2EAA2E;AAC3E,8EAA8E;AAC9E,0CAA0C;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,6BAA6B,EAC7B,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,2EAA2E;AAC3E,8EAA8E;AAC9E,0DAA0D;AAC1D,OAAO,EACL,aAAa,EACb,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,qCAAqC,EACrC,qCAAqC,GACtC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAE7D,SAAS,eAAe,CAAC,KAAU;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;WAC5C,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,CAAC,eAAe,CAAC,CAAC;AAC7C,MAAM,wBAAwB,GAAG,CAAC,aAAa,CAAC,CAAC;AAEjD,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAU;IAC1C,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAY;IAC3C,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,uCAAuC;AACvC,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,iFAAiF;AACjF,2EAA2E;AAC3E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAElF,0EAA0E;AAC1E,iFAAiF;AACjF,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAExF,8EAA8E;AAC9E,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEhH,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,eAAe,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAE9S,yEAAyE;AACzE,gFAAgF;AAChF,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE5G,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AACvE,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,yBAAyB,EACzB,6BAA6B,EAC7B,yCAAyC,EACzC,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAE7B,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEhF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAC9E,mCAAmC;AAEnC,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,iDAAiD;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEjF,8EAA8E;AAC9E,gFAAgF;AAChF,qEAAqE;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,0EAA0E;AAC1E,6EAA6E;AAC7E,wEAAwE;AACxE,qEAAqE;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,SAAS,GACV,MAAM,wBAAwB,CAAC;AAEhC,wEAAwE;AACxE,4EAA4E;AAC5E,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,eAAe,EACf,QAAQ,IAAI,wBAAwB,EACpC,6BAA6B,EAC7B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAEpC,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,2EAA2E;AAC3E,qEAAqE;AACrE,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,uEAAuE;AACvE,mCAAmC;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAC5C,6DAA6D;AAC7D,SAAS,UAAU,CAAC,gBAAwB;IAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;SAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;SACnF,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AACD,oFAAoF;AACpF,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;SAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;SACnG,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,GAAQ,EAAE,kBAA0B,EAAE,OAAY,EAAE;IAChF,6EAA6E;IAC7E,MAAM,MAAM,GAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEvE,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,KAAK,EAAE,sFAAsF;SAC9F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAEtB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,KAAK,EAAE,qGAAqG;SAC7G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,gFAAgF;QAChF,6EAA6E;QAC7E,gFAAgF;QAChF,8EAA8E;QAC9E,yCAAyC;QACzC,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gCAAgC,SAAS,CAAC,iBAAiB,mCAAmC,EAAE,CAAC;QACzI,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kCAAkC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzH,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,EAAE,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;QACjF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,aAAa,CAAC;QAC9C,IAAI,IAAI,EAAE,CAAC;YACT,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,YAAY;mBAChD,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/G,CAAC;aAAM,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC3C,yEAAyE;YACzE,4EAA4E;YAC5E,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,CAAC,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACvG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,KAAY,EAAE,YAAoB,EAAE,OAAY,EAAE;IACrG,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtD,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACxE,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,OAAO,KAAK,YAAY,CAAC;AAClC,CAAC;AAED,gFAAgF;AAChF,mDAAmD;AACnD,gFAAgF;AAEhF,yEAAyE;AACzE,uEAAuE;AACvE,6BAA6B;AAC7B,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB,SAAS,6BAA6B,CAAC,QAAgB,EAAE,IAAS;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACxC,IAAI,aAAa,GAAG,WAAW,CAAC;IAChC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,aAAa,GAAG,aAAa,CAAC;IAChC,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;IACrE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO;QAC9C,YAAY,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO;QAC3C,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAa,EAAE,IAAS;IAC1D,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;WACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC;eACxC,IAAI,CAAC,iBAAiB,GAAG,CAAC;eAC1B,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,EAAE,CAAC;QAC9C,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;WAC7B,IAAI,CAAC,aAAa,KAAK,SAAS;WAChC,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,8CAA8C,CAAC;IACxD,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QACvD,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,QAAQ,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QACnF,OAAO,yFAAyF,CAAC;IACnG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,sEAAsE;AACtE,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,+EAA+E;AAC/E,wEAAwE;AACxE,oCAAoC;AACpC,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,6EAA6E;AAC7E,+CAA+C;AAC/C,8EAA8E;AAE9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,WAAW,CAAU,CAAC,CAAC;AAG5F;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,yBAAkC;IAElC,IAAI,CAAC;QACH,IAAI,OAAO,yBAAyB,KAAK,QAAQ,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzG,MAAM,GAAG,GAAG,eAAe,CAAC,yBAAyB,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,IAAI,SAAS,CAAC,iBAAiB,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC;QACpE,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,SAAS,CAAC,iBAAiB,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAY,EAAE,yBAAiC,EAAE,OAAY,EAAE;IACnG,qKAAqK;IACrK,MAAM,MAAM,GAAQ;QAClB,iBAAiB,EAAE,KAAK;QACxB,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,KAAK;QACnB,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,IAAI,aAAa,GAAe,IAAI,CAAC;IAErC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAClG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;eACnD,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;eAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAe,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC7E,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QACnF,CAAC;QAED,4DAA4D;QAC5D,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,2BAA2B,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5G,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,iBAAiB,GAAG,MAAM;aAC7B,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;aAC7C,MAAM,EAAE;aACR,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzB,MAAM,CAAC,iBAAiB,GAAG,UAAU,CAAC,SAAS,KAAK,iBAAiB,CAAC;QAEtE,6DAA6D;QAC7D,MAAM,CAAC,gBAAgB,GAAG,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC;QAE7D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;mBAC7B,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;mBAChD,UAAU,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO,CAAC;QACpD,MAAM,CAAC,aAAa,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO,CAAC;QACrD,aAAa,GAAG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,0BAA0B,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACrE,CAAC;QAED,gCAAgC;QAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACxF,MAAM,CAAC,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,QAAQ;YACR,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE;SAC7D,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;YACvC,GAAG,EAAE,eAAe,CAAC,yBAAyB,CAAC;YAC/C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,0BAA0B,CAAC,yBAAyB,CAAC,CAAC;QAElE,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAE,6BAAmD,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,oCAAoC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAChH,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM;oBACN,aAAa;oBACb,KAAK,EAAE,wCAAwC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,GAAG,IAAI,aAAa,EAAE;iBAC3G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAC9B,QAAQ,EACR,UAAU,EACV,SAAS,EACT,eAAe,CAAC,SAAS,CAAC,CAC3B,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,8DAA8D;YAC9D,4BAA4B;YAC5B,MAAM,YAAY,GAAG,yBAAyB,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC3F,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YAC1F,CAAC;YACD,MAAM,KAAK,GAAG,wBAAwB,CACpC,IAAI,UAAU,CAAC,UAAU,CAAC,EAC1B,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EACxF,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,EAC9C,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAmB,CACvC,CAAC;YACF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC5B,gEAAgE;gBAChE,kEAAkE;gBAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC;YAClG,CAAC;YACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,iCAAiC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACvI,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB;WACjC,MAAM,CAAC,gBAAgB;WACvB,MAAM,CAAC,YAAY;WACnB,MAAM,CAAC,aAAa;WACpB,MAAM,CAAC,SAAS;WAChB,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,gCAAgC;AAChC,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAU,EACV,qBAAgD,IAAI,EACpD,UAAe,EAAE;IAEjB,IAAI,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;IAC7F,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,CAAC,kBAAkB,CAAC;IAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC;IAE9C,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,YAAY;YAC1C,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,CAAC,YAAY;gBACb,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,uBAAuB,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,2BAA2B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9H,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAW,EAAE,kBAA0B;IACzE,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,cAAc,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;IACrF,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,mCAAmC,CAAC,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,KAAK;YAAE,QAAQ,EAAE,CAAC;;YACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,KAAK,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC1F,CAAC;AAED,gFAAgF;AAChF,8DAA8D;AAC9D,gFAAgF;AAEhF,uEAAuE;AACvE,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,yBAAyB;AACzB,uEAAuE;AACvE,8EAA8E;AAC9E,+BAA+B;AAC/B,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,uEAAuE;AAEvE,MAAM,WAAW,GAAG,UAAU,CAAC;AAE/B,SAAS,KAAK,CAAC,CAAM;IACnB,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,MAAM,CAAC,KAAK,EAAE,QAAQ,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAW;IAC7C,MAAM,UAAU,GAAG,OAAO,MAAM,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,SAAS,GAAG,sFAAsF,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1H,MAAM,QAAQ,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC;IAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,SAAS,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,SAAW,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mCAAmC,CACjD,oBAAyB,EACzB,gBAAqB,EACrB,OAAY,EAAE;IAEd,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAU,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,6DAA6D,CAAC;YACvE,WAAW;SACZ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,IAAI,OAAO,oBAAoB,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;WACrG,CAAC,gBAAgB,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpG,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,yEAAyE,CAAC;YACnF,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ;eAChD,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,SAAS;QAE7D,IAAI,SAAS,CAAC,cAAc,KAAK,SAAS,IAAI,SAAS,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAChF,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QAC9E,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,4CAA4C,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,aAAa,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,KAAK,IAAI;YAC7F,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,gDAAgD,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QAED,IAAI,WAAW,GAAG,eAAe,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,WAAW,GAAG,GAAG,CAAC;YACtC,MAAM,kBAAkB,GAAG,SAAS,CAAC,cAAc,KAAK,SAAS;mBAC5D,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC;YACvC,MAAM,kBAAkB,GAAG,IAAI,CAAC,uCAAuC,KAAK,IAAI,CAAC;YACjF,WAAW,CAAC,IAAI,CAAC;gBACf,eAAe,EAAE,KAAK;gBACtB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,2BAA2B;gBAClF,iBAAiB,EAAE,aAAa,CAAC,QAAQ,IAAI,IAAI;gBACjD,aAAa,EAAE,SAAS,CAAC,QAAQ;gBACjC,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,IAAI;gBAChD,kBAAkB,EAAE,kBAAkB;aACvC,CAAC,CAAC;YACH,IAAI,WAAW,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC9D,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,2DAA2D;sBACjE,kEAAkE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,cAAc,GAAG,wFAAwF,CAAC;AAChH,SAAS,YAAY,CAAC,KAAU;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IACvB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,AAAD,EAAG,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;IACrF,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,IAAI,IAAI,IAAI,MAAM,IAAI,MAAM,EAAE;QAAE,OAAO,GAAG,CAAC;IAC9G,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,GAAG,CAAC;IACnG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,CAAM,EAAE,IAAS,EAAE,EAAO;IAC9C,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,IAAI,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAAC,CAAC;IACxF,IAAI,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAa;IACzC,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1D,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,sBAAsB,CAAC,QAAa,EAAE,WAAmB,EAAE,iBAAyB,EAAE,OAAY,EAAE;IAC3G,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC/F,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;QACzD,MAAM,aAAa,GAAG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,0BAA0B,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC5E,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QAC/E,IAAI,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACpH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACxF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACjG,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;mBAC/B,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;mBAChD,UAAU,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,0BAA0B;QAC5G,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,sCAAsC;QAExH,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3G,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;YACvC,GAAG,EAAE,eAAe,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;SACrE,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC1F,aAAa;SACd,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,aAAqB,EAAE,WAAmB,EAAE,iBAAyB;IACpG,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;YACvC,GAAG,EAAE,eAAe,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;SACrE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAG;IACzB,aAAa;IACb,OAAO;IACP,QAAQ;IACR,eAAe;IACf,mBAAmB;IACnB,aAAa;IACb,aAAa;IACb,aAAa;CACd,CAAC;AAEF,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,OAAO;QACL,OAAO;QACP,KAAK,EAAE,CAAC,OAAO;QACf,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QAC1F,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAU;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,wBAAwB;AACxB,SAAS,uBAAuB,CAAC,KAAU;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAAW,EAAE,IAAY,EAAE,EAAO,EAAE,OAAgB;IACtE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,IAAI,OAAO;QAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAW,EAAE,OAAY,EAAE,QAAe,EAAE,QAAe,EAAE,aAA+B,EAAE,YAAiB,EAAE,YAAiB,EAAE,IAAS;IAC/K,MAAM,cAAc,GAAG,EAAE,CAAC;IAE1B,IAAI,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;YACxB,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC1B,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,6EAA6E;QAC7E,6EAA6E;QAC7E,gEAAgE;QAChE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,QAAQ,EAAE,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzD,IAAI,QAAQ,KAAK,GAAG;YAAE,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,GAAG,KAAK,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC5D,IAAI,GAAG,KAAK,CAAC;gBACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAElC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;WACtB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACjF,QAAQ,GAAG,KAAK,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IAC7G,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;eACJ,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;eACxD,MAAM,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9C,QAAQ,GAAG,KAAK,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEvC,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7C,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7C,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAE9C,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;YAClC,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YAC9F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvF,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YACnG,SAAS;QACX,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,eAAe,uBAAuB,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,YAAY,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC;YACtB,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;YACrF,SAAS;QACX,CAAC;QACD,IAAI,kBAAkB,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,kBAAkB,EAAE,CAAC;YACxE,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,MAAM,YAAY,GAAG,CAAC,KAAU,EAAE,OAAe,EAAQ,EAAE;QACzD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC1D,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IACF,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;IAC7E,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,sDAAsD,CAAC,CAAC;IACxG,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,sDAAsD,CAAC,CAAC;IACnH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;QACtD,YAAY,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,gEAAgE,CAAC,CAAC;QACjG,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,gEAAgE,CAAC,CAAC;QACjG,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,4DAA4D,CAAC,CAAC;QAC1F,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,8DAA8D,CAAC,CAAC;QAC7F,YAAY,CAAC,GAAG,EAAE,UAAU,EAAE,+DAA+D,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,YAAY,CAAC,CAAC,EAAE,YAAY,EAAE,iEAAiE,CAAC,CAAC;QACjG,YAAY,CAAC,CAAC,EAAE,eAAe,EAAE,oEAAoE,CAAC,CAAC;QACvG,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,8DAA8D,CAAC,CAAC;QAC3F,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,8DAA8D,CAAC,CAAC;QAC3F,4EAA4E;QAC5E,8EAA8E;QAC9E,uDAAuD;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjF,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrB,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;YACxG,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,sDAAsD,CAAC,CAAC;YACpG,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,wDAAwD,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,uDAAuD,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAEhD,MAAM,CAAC,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,iFAAiF;AACjF,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAE5E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa;CACzF,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;AACzF,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,SAAS,sBAAsB,CAAC,QAAe;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,UAAU,GAAG,IAAI,CAAC;IAEtB,8EAA8E;IAC9E,uCAAuC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,UAAU,GAAG,KAAK,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,GAAG,KAAK,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,kHAAkH,CAAC,CAAC;IAClI,CAAC;IAED,kDAAkD;IAClD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,qBAAqB,CAAC;QACtC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,IAAI,kBAAkB,CAAC;QAC/C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,mBAAmB,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,2BAA2B,GAAG,wEAAwE,CAAC,CAAC;YACtJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,uCAAuC,GAAG,CAAC,kBAAkB,GAAG,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,GAAG,CAAC,kBAAkB,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,0EAA0E,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAC1F,MAAM,CAAC,IAAI,CAAC,uCAAuC,GAAG,gBAAgB,yBAAyB,6BAA6B,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,iCAAiC,CAAC,OAAY;IACrD,IAAI,CAAC;QACH,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,OAAO,oBAAoB,CAAC;QAE7D,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACnC,OAAO,WAAW,CAAC,SAAS,CAAC;QAC7B,OAAO,WAAW,CAAC,mBAAmB,CAAC;QACvC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC;YAAE,OAAO,oBAAoB,CAAC;QAEjE,MAAM,UAAU,GAAG,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC;QAClD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,gBAAgB,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;YAC3C,OAAO,gBAAgB,CAAC,aAAa,CAAC;YACtC,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;gBAAE,OAAO,0BAA0B,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAY,EAAE,OAAY,EAAE;IAC7D,IAAI,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAQ;QAClB,WAAW,EAAE,KAAK,EAAS,SAAS;QACpC,mBAAmB,EAAE,KAAK,EAAE,SAAS;QACrC,kBAAkB,EAAE,KAAK,EAAE,SAAS;QACpC,GAAG,EAAE,KAAK,EAAiB,SAAS;QACpC,SAAS,EAAE,KAAK,EAAW,UAAU;QACrC,oBAAoB,EAAE,KAAK,EAAE,UAAU;QACvC,OAAO,EAAE,KAAK,EAAa,SAAS;KACrC,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,eAAe,GAAQ,EAAE,CAAC;IAChC,MAAM,aAAa,GAAQ;QACzB,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,eAAe;QAC9B,iBAAiB,EAAE,SAAS;QAC5B,eAAe,EAAE;YACf,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,cAAc;SACzB;QACD,OAAO,EAAE,oDAAoD;KAC9D,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,YAAY,CAAC;IAC/D,IAAI,gBAAgB,KAAK,YAAY,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,MAAM,EAAE,CAAC,oDAAoD,CAAC;YAC9D,cAAc,EAAE,aAAa;SAC9B,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;QAC7D,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,MAAM,EAAE,CAAC,qCAAqC,CAAC;YAC/C,cAAc,EAAE,aAAa;SAC9B,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,MAAM,EAAE,CAAC,2EAA2E,CAAC;YACrF,cAAc,EAAE,aAAa;SAC9B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACxD,IAAI,WAAW,GAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAO,EAAE;QAChC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM;YACN,MAAM;YACN,WAAW;YACX,MAAM;YACN,cAAc,EAAE,aAAa;YAC7B,GAAG,eAAe;SACnB,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,GAAG,YAAY,+EAA+E,CAAC,CAAC;IAC9G,CAAC;IACD,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,WAAW,GAAG,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IAC1D,MAAM,EAAE,YAAY,GAAG,EAAE,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,aAAa,CAAC,eAAe,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAY,EAAE,EAAE,CACvE,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAEhG,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,gFAAgF;IAChF,gFAAgF;IAChF,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC;IAC/F,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,mHAAmH,CAAC,CAAC;IACnI,CAAC;IAED,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,CAAC,wBAAwB,GAAG,KAAK,CAAC;QACxC,MAAM,UAAU,GAAG,mCAAmC,CACpD,IAAI,CAAC,oBAAoB,EACzB,YAAY,EACZ;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,uCAAuC,EACrC,IAAI,CAAC,uCAAuC,KAAK,IAAI;SACxD,CACF,CAAC;QACF,eAAe,CAAC,wBAAwB,GAAG,UAAU,CAAC;QACtD,MAAM,CAAC,wBAAwB,GAAG,UAAU,CAAC,KAAK,KAAK,IAAI,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,WAAW,GAAG,aAAa,KAAK,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAE/F,6EAA6E;IAC7E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,wBAAwB;IACzD,IAAI,aAAa,GAAG,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,aAAa,EAAE,CAAC;YAC7C,aAAa,GAAG,KAAK,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,QAAQ,IAAI,kBAAkB,qCAAqC,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,aAAa,GAAG,KAAK,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,aAAa,GAAG,KAAK,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1B,aAAa,GAAG,KAAK,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,CAAC,mBAAmB,GAAG,aAAa,CAAC;IAE3C,6EAA6E;IAC7E,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC,8DAA8D;IACxF,MAAM,cAAc,GAAG,EAAE,CAAC,CAAC,4DAA4D;IACvF,MAAM,gBAAgB,GAAU,EAAE,CAAC;IACnC,IAAI,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC1B,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,4CAA4C;QAC5C,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClF,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,eAAe,yBAAyB,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1C,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,eAAe,eAAe,QAAQ,CAAC,WAAW,0BAA0B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxH,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,2EAA2E;QAC3E,mEAAmE;QACnE,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAC9E,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChC,YAAY,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,eAAe,oCAAoC,CAAC,CAAC;gBACjF,SAAS;YACX,CAAC;YACD,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,eAAe,2DAA2D,CAAC,CAAC;YAC1G,SAAS;QACX,CAAC;QACD,0EAA0E;QAC1E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,eAAe,6BAA6B,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;mBACjD,WAAY,GAAG,WAAW,IAAI,WAAY,GAAG,SAAS,EAAE,CAAC;gBAC9D,YAAY,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,eAAe,+CAA+C,CAAC,CAAC;gBAC9F,SAAS;YACX,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,WAAW,KAAK,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,WAAW,EAAE,CAAC;YACtE,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,eAAe,kDAAkD,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QACD,IAAI,WAAW,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,WAAW,EAAE,CAAC;YACpE,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,eAAe,kDAAkD,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClD,8EAA8E;QAC9E,0EAA0E;QAC1E,0EAA0E;QAC1E,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACxD,IAAI,KAAc,CAAC;QACnB,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG;gBACrB,GAAG,IAAI;gBACP,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC/D,aAAa,EAAE,IAAI,CAAC,qBAAqB,IAAI,SAAS;aACvD,CAAC;YACF,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;gBACtF,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC/E,gBAAgB,CAAC,IAAI,CAAC;gBACpB,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,aAAa,EAAE,cAAc,CAAC,aAAa;gBAC3C,cAAc,EAAE,cAAc,CAAC,aAAa;gBAC5C,KAAK,EAAE,cAAc,CAAC,KAAK,KAAK,IAAI;gBACpC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,KAAK,GAAG,cAAc,CAAC,KAAK,KAAK,IAAI,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,uBAAuB,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,QAAQ,kBAAkB,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC;QAC/E,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpC,oEAAoE;QACpE,2EAA2E;QAC3E,4EAA4E;QAC5E,0DAA0D;QAC1D,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC9D,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,QAAQ,gCAAgC,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,QAAQ,uCAAuC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,MAAM,CAAC,kBAAkB,GAAG,YAAY,CAAC;IACzC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAAE,eAAe,CAAC,iBAAiB,GAAG,gBAAgB,CAAC;IAEtF,6EAA6E;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;IAC3C,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACxF,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACjD,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC9C,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,kBAAkB,cAAc,CAAC,MAAM,yBAAyB,iBAAiB,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;IAEnB,6EAA6E;IAC7E,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAC7B,IAAI,EAAE,EAAE,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;QACvD,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACnC,OAAO,WAAW,CAAC,SAAS,CAAC;QAC7B,OAAO,WAAW,CAAC,mBAAmB,CAAC;QACvC,MAAM,aAAa,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC;QAC9D,6EAA6E;QAC7E,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,uBAAuB;QACvB,IAAI,gBAAgB,GAAG,IAAI,CAAC;QAC5B,IAAI,EAAE,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;gBAClC,gBAAgB,GAAG,yEAAyE,CAAC;YAC/F,CAAC;iBAAM,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;gBAC9D,gBAAgB,GAAG,kEAAkE,CAAC;YACxF,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACvC,2EAA2E;YAC3E,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YACpE,MAAM,CAAC,SAAS,GAAG,aAAa,KAAK,QAAQ;mBACxC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,IAAI,aAAa,KAAK,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;iBACvG,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACnH,CAAC;aAAM,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,IAAI,CAAC,6BAA6B,KAAK,IAAI,EAAE,CAAC;YAC1F,0EAA0E;YAC1E,uEAAuE;YACvE,kCAAkC;YAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;YACvC,MAAM,CAAC,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;QACrH,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;QACnG,CAAC;QAED,IAAI,YAAY,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YAChD,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,gBAAgB,CAAC,aAAa,CAAC;YACtC,MAAM,CAAC,oBAAoB,GAAG,uBAAuB,CACnD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EACzD,WAAW,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,EAC3C,YAAY,CACb,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBAAE,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,EAAE;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,gFAAgF;IAChF,EAAE;IACF,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACnC,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,CAAC;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACvG,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;QACxG,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,2BAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC1G,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,sEAAsE;IACtE,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,4CAA4C;IAC5C,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAC9B,MAAM,UAAU,GAAG,EAAE,EAAE,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClD,eAAe,CAAC,cAAc,GAAG;gBAC/B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;gBAC/C,OAAO,EAAE,CAAC,mDAAmD,CAAC;aAC/D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzC,eAAe,CAAC,cAAc,GAAG;gBAC/B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;gBAC/C,OAAO,EAAE,CAAC,wEAAwE,CAAC;aACpF,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1F,eAAe,CAAC,cAAc,GAAG,GAAG,CAAC;YACrC,MAAM,CAAC,cAAc,GAAG,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,+CAA+C,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,qDAAqD;IACrD,MAAM,yBAAyB,GAAG,IAAI,CAAC,qBAAqB,KAAK,IAAI,CAAC;IACtE,MAAM,mCAAmC,GACvC,gBAAgB,KAAK,SAAS,IAAI,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,iBAAiB,GAAG,yBAAyB,IAAI,mCAAmC,CAAC;IAC3F,IAAI,iBAAiB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,mCAAmC;YAChD,CAAC,CAAC,8EAA8E;YAChF,CAAC,CAAC,8CAA8C,CAAC;QACnD,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,eAAe,CAAC,eAAe,GAAG;YAChC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,MAAM;SACP,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;SAAM,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/B,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAClC,eAAe,CAAC,eAAe,GAAG;gBAChC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;gBACjD,MAAM,EAAE,2EAA2E;aACpF,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAChG,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAQ,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,aAAa,CAAQ,CAAC;YAC5F,eAAe,CAAC,eAAe,GAAG,GAAG,CAAC;YACtC,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,4DAA4D;IAC5D,8DAA8D;IAC9D,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,MAAM,MAAM,GAAG;YACb,WAAW,EAAE,SAAkB;YAC/B,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QACF,MAAM,OAAO,GAAU,EAAE,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,aAAa,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,SAAS,EAAE,WAAW,KAAK,MAAM,CAAC,WAAW;uBACtD,SAAS,EAAE,SAAS,KAAK,MAAM,CAAC,SAAS;uBACzC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjE,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE;oBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,IAAI,MAAM,CAAC,KAAK;oBAAE,OAAO,GAAG,IAAI,CAAC;;oBAC5B,aAAa,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,aAAa;gBACb,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,cAAc;oBACd,CAAC,CAAC,eAAe;oBACjB,CAAC,CAAC,4BAA4B,CAAC;QACrC,eAAe,CAAC,UAAU,GAAG;YAC3B,MAAM;YACN,uBAAuB,EAAE,OAAO,CAAC,MAAM;YACvC,OAAO;YACP,OAAO,EAAE,MAAM,KAAK,4BAA4B;gBAC9C,CAAC,CAAC,uEAAuE;gBACzE,CAAC,CAAC,IAAI;SACT,CAAC;QACF,aAAa,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACzC,MAAM,CAAC,UAAU,GAAG,MAAM,KAAK,4BAA4B,CAAC;QAC5D,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;aAC9F,IAAI,MAAM,KAAK,eAAe;YAAE,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACtG,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,2EAA2E;QAC3E,qEAAqE;QACrE,0EAA0E;QAC1E,6EAA6E;QAC7E,4EAA4E;QAC5E,mBAAmB;QACnB,MAAM,GAAG,GAAG,gBAAgB,CAAC;YAC3B,OAAO;YACP,sBAAsB,EAAE,CAAC,CAAC,sBAAsB,KAAK,IAAI;YACzD,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;YAC1C,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;SACvC,CAAC,CAAC;QACH,eAAe,CAAC,QAAQ,GAAG,GAAG,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,OAAO,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,wCAAwC,GAAG,CAAC,aAAa,CAAC,MAAM,MAAM,GAAG,CAAC,aAAa,CAAC,MAAM,wBAAwB,CAAC,CAAC;QACtI,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,sCAAsC;IACtC,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC1D,eAAe,CAAC,WAAW,GAAG,GAAG,CAAC;QAClC,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,qCAAqC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,aAAa,GAAG,2DAA2D,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,kEAAkE;IAClE,2EAA2E;IAC3E,IAAI,IAAI,CAAC,2BAA2B,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,CAAC,qBAAqB,GAAG,KAAK,CAAC;QACrC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;YAChE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB;YACnC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,eAAe,CAAC,qBAAqB,GAAG;gBACtC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI;gBAC3B,MAAM,EAAE,CAAC,4EAA4E,CAAC;gBACtF,gBAAgB,EAAE,IAAI;aACvB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC9C,eAAe,CAAC,qBAAqB,GAAG,GAAG,CAAC;YAC5C,MAAM,CAAC,qBAAqB,GAAG,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,IAAI,SAAS,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,SAAS,GAAG,KAAK,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,wCAAwC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC;IACtD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,SAAS,GAAG,KAAK,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,IAAI,WAAW,KAAK,IAAI,IAAI,YAAY,CAAC,WAAW,CAAC,GAAG,WAAW,EAAE,CAAC;YACpE,SAAS,GAAG,KAAK,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAC9E,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9D,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;gBACpE,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC;IAE3B,+EAA+E;IAC/E,gFAAgF;IAChF,gFAAgF;IAChF,yEAAyE;IACzE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACjH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC;IACnE,8EAA8E;IAC9E,2EAA2E;IAC3E,OAAO;QACL,KAAK;QACL,MAAM;QACN,MAAM;QACN,WAAW;QACX,MAAM;QACN,cAAc,EAAE,aAAa;QAC7B,GAAG,eAAe;KACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAY,EAAE,WAAgB,EAAE,OAAY,EAAE;IACjF,OAAO,wBAAwB,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AAClF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,OAAY,EAAE,YAAmB,EAAE,OAAY,EAAE;IACvF,OAAO,2BAA2B,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACtF,CAAC;AAED,gFAAgF;AAChF,0EAA0E;AAC1E,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAY,EAAE,OAAY,EAAE;IAC/D,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACrG;;2EAEuE;IACvE,MAAM,GAAG,GAAQ;QACf,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,CAAC;YACX,CAAC,CAAC;gBACE,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD;YACH,CAAC,CAAC,IAAI;QACR,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI;QACpC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI;QACzC,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,UAAU;KACnB,CAAC;IAEF,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,2BAA2B,CAAC;YACzC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,uCAAuC,CAAC;YACrD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,yBAAyB,CAAC;YACvC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,kCAAkC,CAAC;YAChD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;QAClC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAuB,gDAAgD;YACxF,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,uBAAuB,CAAC;QACvC,CAAC;aAAM,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,+BAA+B,GAAG,CAAC,WAAW,cAAc,SAAS,IAAI,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;YACjB,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,+EAA+E;AAC/E,uFAAuF;AACvF,uEAAuE;AACvE,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAEzB,uFAAuF;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,OAAO,EACL,uCAAuC,EACvC,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,EAC5B,4BAA4B,EAC5B,oCAAoC,EACpC,4BAA4B,EAC5B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,uEAAuE;AACvE,8EAA8E;AAC9E,6EAA6E;AAC7E,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,+BAA+B,EAC/B,wCAAwC,EACxC,4BAA4B,EAC5B,4CAA4C,EAC5C,kCAAkC,EAClC,oCAAoC,EACpC,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,oEAAoE"} \ No newline at end of file diff --git a/packages/verify/package.json b/packages/verify/package.json index c9826e728..40b65871b 100644 --- a/packages/verify/package.json +++ b/packages/verify/package.json @@ -119,6 +119,10 @@ "types": "./dist/aeb-crossing-record.d.ts", "import": "./aeb-crossing-record.js" }, + "./aeb-aic-crossing-adapter": { + "types": "./dist/aeb-aic-crossing-adapter.d.ts", + "import": "./aeb-aic-crossing-adapter.js" + }, "./aeb-acceptance-profile": { "types": "./dist/aeb-acceptance-profile.d.ts", "import": "./aeb-acceptance-profile.js" @@ -299,6 +303,7 @@ "authority-program.d.ts", "aeb-adapter-contract.js", "aeb-crossing-record.js", + "aeb-aic-crossing-adapter.js", "aeb-acceptance-profile.js", "aeb-execution-conditions.js", "aeb-aps-adapter.js", @@ -371,7 +376,7 @@ "build": "tsc -p tsconfig.json && node postbuild-ts-nocheck.mjs", "prepack": "npm run build", "pretest": "npm run build", - "test": "node --test test.js hostile-input.test.js web.test.js federation.test.js trust-receipt.test.js trust-receipt-knobs.test.js quorum.test.js revocation.test.js status.test.js time-attestation.test.js no-symmetric.test.js cli.test.js evidence-chain.test.js platform-attestation.test.js memory-projection.test.js agent-binding.test.js agentroa.test.js orprg.test.js outcome-binding.test.js authority-program.test.js aeb-adapter-contract.test.js aeb-crossing-record.test.js aeb-acceptance-profile.test.js aeb-execution-conditions.test.js aeb-aps-adapter.test.js aeb-consequence-conformance.test.js crossing-lab.test.js crossing-lab-cli.test.js aeb-mcgraw-delegation-adapter.test.js aeb-oauth-transaction-challenge-adapter.test.js aeb-wimse-oauth-adapter.test.js authorization-server-confirmation.test.js authorization-bundle.test.js oauth-rar-authorization-binding.test.js aadp-authorization-artifact.test.js policy-decision-evidence.test.js aeb-native-adapters.test.js aeb-oasnt-adapter.test.js aeb-ccs-adapter.test.js aeb-chap-adapter.test.js pedigree-aeb-composition.test.js aeb-psea-adapter.test.js fido-ap2-bridge.test.js discovery-permit-contract.test.js aeb-discovery-permit-adapter.test.js agent-edge-continuity.test.js consistency.test.js witness.test.js timestamp-proof.test.js currency.test.js consumption-proof.test.js initiator-attestation.test.js surface-binding.test.js consent-grant.test.js resolution.test.js document-action-binding.test.js pq-hybrid.test.js pq-signature-agility.test.js evidence-record-reattestation.test.js receipt-selective-disclosure.test.js scitt-statement.test.js fips-mode.test.js revocation-v2.test.js evidence-record-base-agility.test.js receipt-hybrid.test.mjs && tsx --test portable-state-handoff.test.ts ../../examples/portable-state-handoff/roundtrip.test.mts && npm run test:qualification", + "test": "node --test test.js hostile-input.test.js web.test.js federation.test.js trust-receipt.test.js trust-receipt-knobs.test.js quorum.test.js revocation.test.js status.test.js time-attestation.test.js no-symmetric.test.js cli.test.js evidence-chain.test.js platform-attestation.test.js memory-projection.test.js agent-binding.test.js agentroa.test.js orprg.test.js outcome-binding.test.js authority-program.test.js aeb-adapter-contract.test.js aeb-crossing-record.test.js aeb-aic-crossing-adapter.test.js aeb-acceptance-profile.test.js aeb-execution-conditions.test.js aeb-aps-adapter.test.js aeb-consequence-conformance.test.js crossing-lab.test.js crossing-lab-cli.test.js aeb-mcgraw-delegation-adapter.test.js aeb-oauth-transaction-challenge-adapter.test.js aeb-wimse-oauth-adapter.test.js authorization-server-confirmation.test.js authorization-bundle.test.js oauth-rar-authorization-binding.test.js aadp-authorization-artifact.test.js policy-decision-evidence.test.js aeb-native-adapters.test.js aeb-oasnt-adapter.test.js aeb-ccs-adapter.test.js aeb-chap-adapter.test.js pedigree-aeb-composition.test.js aeb-psea-adapter.test.js fido-ap2-bridge.test.js discovery-permit-contract.test.js aeb-discovery-permit-adapter.test.js agent-edge-continuity.test.js consistency.test.js witness.test.js timestamp-proof.test.js currency.test.js consumption-proof.test.js initiator-attestation.test.js surface-binding.test.js consent-grant.test.js resolution.test.js document-action-binding.test.js pq-hybrid.test.js pq-signature-agility.test.js evidence-record-reattestation.test.js receipt-selective-disclosure.test.js scitt-statement.test.js fips-mode.test.js revocation-v2.test.js evidence-record-base-agility.test.js receipt-hybrid.test.mjs && tsx --test portable-state-handoff.test.ts ../../examples/portable-state-handoff/roundtrip.test.mts && npm run test:qualification", "test:qualification": "tsx --test gate-qualification.test.ts gate-qualification-promptfoo.test.ts claim-assurance.test.ts a2a-receipt-binding.test.ts ap2-native-adapter.test.ts a2a-evidence-challenge.test.ts" }, "bin": { diff --git a/packages/verify/src/aeb-aic-crossing-adapter.ts b/packages/verify/src/aeb-aic-crossing-adapter.ts new file mode 100644 index 000000000..0ceefcfb8 --- /dev/null +++ b/packages/verify/src/aeb-aic-crossing-adapter.ts @@ -0,0 +1,1633 @@ +// SPDX-License-Identifier: Apache-2.0 +/** + * AIC native-authority mappings for EP-AEB-CROSSING-RECORD-v1. + * + * The adapter consumes the result of an AIC native verifier. It does not + * reimplement AIC-JWT signature, delegation, capability, constraint, status, + * or X.509 path validation. It keeps the RFC 7638 JWK-thumbprint and X.509 + * SPKI-hash paths separate, derives carrier fingerprints and identifiers from + * supplied raw carrier material, and keeps relying-party policy structurally + * separate from the native verifier result. Authenticating that the native + * verifier saw the same carrier bytes remains the deployment wrapper's + * responsibility. The pinned upstream + * bearer helper returns a bare synthesized X.509 object without authenticated + * provenance, so that object cannot enter the native X.509 mapping: the latter + * requires real agent and principal certificate DER. A deployment still needs + * to preserve this provenance inside its trusted verifier boundary. + * + * The JWT-SVID helper emits only a to-be-signed identity projection. Rewriting + * the protected header would invalidate the AIC-JWT signature, so a deployment + * must issue a new typ=JWT token under a key in its JWT-SVID bundle. The + * projection is never an AIC authority decision. + */ +import crypto, { X509Certificate } from 'node:crypto'; + +import { + canonicalizeAeb, + digestAebTyped, + type AebDigest, +} from './aeb-adapter-contract.js'; +import { + issueAebCrossingRecord, + type AebCrossingRecord, + type AebCrossingRecordDraft, + type AebCrossingRecordIssueOptions, + type CrossingAuthorityMappingResult, + type CrossingNativeAuthority, + type CrossingNativeStatus, + type CrossingNativeVerification, + type CrossingValidity, +} from './aeb-crossing-record.js'; + +export const AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE = + 'EP-AEB-CROSSING-AIC-JWT-JKT-BOUND-v2'; +export const AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE = + 'EP-AEB-CROSSING-AIC-X509-SPKI-BOUND-v2'; +export const AIC_ADMISSION_DOMAIN_VERSION = + 'EP-AIC-ADMISSION-DOMAIN-v1'; +export const AIC_JWT_SVID_PROJECTION_VERSION = + 'EP-AIC-JWT-SVID-PROJECTION-v1'; +export const AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE = + 'EP-AIC-JWT-SVID-SOURCE-VERIFICATION-v1'; +export const AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION = + 'EP-AIC-X509-CREDENTIAL-BUNDLE-v1'; +// The reusable adapter does not load or authenticate the reference mapping- +// profile JSON. Relying-party policy supplies that profile's provenance and +// digest; this constant enforces the v0.2 runtime freshness semantic itself. +export const AIC_CROSSING_MAX_STATUS_AGE_SECONDS = 60; + +export type AicSpkiHashAlgorithm = 'sha-256'; +export type AicJwtDownstreamRepresentation = 'DIRECT' | 'SYNTHESIZED-X509'; + +export type AicPrincipalPublicJwk = + | { kty: 'EC'; crv: string; x: string; y: string } + | { kty: 'RSA'; n: string; e: string } + | { kty: 'OKP'; crv: string; x: string }; + +export interface AicNativeVerifierDescriptor { + id: string; + version: string; + implementation_digest: AebDigest; +} + +export interface AicCrossingRelyingPartyPolicy { + mapping_profile_id: string; + mapping_profile_digest: AebDigest; + action_projection_profile_id: string; + action_projection_profile_digest: AebDigest; + trusted_issuer_trust_anchor_digests: AebDigest[]; + native_verifier: AicNativeVerifierDescriptor; +} + +export interface AicJwtCarrierProvenance { + source_carrier: 'AIC-JWT-COMPACT'; + compact_token: string; + presented_principal_jwk: AicPrincipalPublicJwk; + downstream_representation: AicJwtDownstreamRepresentation; +} + +export interface AicX509CarrierProvenance { + source_carrier: 'AIC-X509-CREDENTIAL-BUNDLE'; + agent_certificate_der: string; + principal_certificate_der: string; +} + +export interface AicRfc7638JktBinding { + kind: 'RFC7638_JKT'; + hash_alg: 'jkt'; + claimed_key_hash: string; + presented_key_hash: string; +} + +export interface AicX509SpkiBinding { + kind: 'X509_SPKI'; + hash_alg: AicSpkiHashAlgorithm; + claimed_key_hash: string; + presented_key_hash: string; +} + +interface AicCrossingCommonInput { + native_verification: CrossingNativeVerification; + native_verifier: AicNativeVerifierDescriptor; + native_verification_evidence_digest: AebDigest; + issuer: string; + subject: string; + artifact_id: string; + artifact_digest: AebDigest; + issuer_trust_anchor_digest: AebDigest; + constraints_digest: AebDigest; + status: CrossingNativeStatus; + validity: CrossingValidity; +} + +export interface AicCrossingExactAction { + caid: string; + action_digest: AebDigest; +} + +export interface AicCrossingAdmissionDomain { + relying_party_id: string; + audience: string; + executor_id: string; + state_domain_id: string; +} + +export interface AicCrossingRequestBinding { + action_projection_profile_id: string; + action_projection_profile_digest: AebDigest; + requested_capability_digest: AebDigest; + projected_action: AicCrossingExactAction; + projected_admission_domain_digest: AebDigest; +} + +export interface AicCrossingRelyingPartyContext { + action: AicCrossingExactAction; + admission_domain: AicCrossingAdmissionDomain; + requested_capability_digest: AebDigest; + evaluated_at: string; + max_status_age_seconds: number; + policy: AicCrossingRelyingPartyPolicy; +} + +export interface AicJwtJktCrossingInput extends AicCrossingCommonInput { + carrier_provenance: AicJwtCarrierProvenance; + principal_binding: AicRfc7638JktBinding; +} + +export interface AicX509SpkiCrossingInput extends AicCrossingCommonInput { + carrier_provenance: AicX509CarrierProvenance; + principal_binding: AicX509SpkiBinding; +} + +export interface AicJwtJktBoundCrossingInput extends AicJwtJktCrossingInput { + request_binding: AicCrossingRequestBinding; +} + +export interface AicX509SpkiBoundCrossingInput extends AicX509SpkiCrossingInput { + request_binding: AicCrossingRequestBinding; +} + +export type AicBoundCrossingInput = + | AicJwtJktBoundCrossingInput + | AicX509SpkiBoundCrossingInput; + +export type AicBoundCrossingRecordDraft = Omit< + AebCrossingRecordDraft, + 'native_authority' +>; + +export type AicBoundCrossingRecordIssueResult = + | { ok: true; record: AebCrossingRecord } + | { ok: false; reason: string }; + +export type AicJwtSvidProjectionPurpose = + | 'WORKLOAD_IDENTITY_ONLY' + | 'AIC_AUTHORITY'; + +export interface AicJwtSvidProjectionInput { + source: AicJwtJktCrossingInput; + purpose: AicJwtSvidProjectionPurpose; + audience: string[]; + issued_at: number; + not_before: number | null; + expires_at: number; + token_id: string; + projected_algorithm: 'ES256' | 'RS256'; + projected_key_id: string; +} + +export interface AicJwtSvidSourceVerificationPolicy { + source_verification_profile_id: + typeof AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE; + source_verification_profile_digest: AebDigest; + trusted_issuer_trust_anchor_digests: AebDigest[]; + native_verifier: AicNativeVerifierDescriptor; +} + +export interface AicJwtSvidProjectionRelyingPartyContext { + source_verification_policy: AicJwtSvidSourceVerificationPolicy; + evaluated_at: string; + max_status_age_seconds: number; +} + +export interface AicStrictJwtSvidProjection { + '@version': typeof AIC_JWT_SVID_PROJECTION_VERSION; + protected_header: { + alg: 'ES256' | 'RS256'; + kid: string; + typ: 'JWT'; + }; + payload: { + sub: string; + aud: string; + iat: number; + exp: number; + nbf?: number; + jti: string; + }; + source: { + typ: 'aic+jwt'; + issuer: string; + token_digest: AebDigest; + source_semantics_digest: AebDigest; + source_evaluation_digest: AebDigest; + }; + purpose: 'WORKLOAD_IDENTITY_ONLY'; + omitted_source_members: string[]; + authority_semantics_preserved: false; + new_signature_required: true; + compact_token: null; + authorization_decision: false; + projection_digest: AebDigest; +} + +export type AicJwtSvidProjectionResult = + | { ok: true; projection: AicStrictJwtSvidProjection } + | { ok: false; reason: string }; + +type Obj = Record; + +const DIGEST_RE = /^sha256:[0-9a-f]{64}$/; +const CAID_RE = /^caid:1:[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)*\.[1-9][0-9]*:jcs-sha256:[A-Za-z0-9_-]{43}$/; +const IDENTIFIER_RE = /^[A-Za-z0-9][A-Za-z0-9:_.@/#-]{0,511}$/; +const BASE64URL_RE = /^[A-Za-z0-9_-]+$/; +const MAX_AIC_JWT_BYTES = 64 * 1024; +const MAX_AIC_CERTIFICATE_BYTES = 64 * 1024; +const COMMON_KEYS = new Set([ + 'native_verification', + 'native_verifier', + 'native_verification_evidence_digest', + 'issuer', + 'subject', + 'artifact_id', + 'artifact_digest', + 'issuer_trust_anchor_digest', + 'constraints_digest', + 'status', + 'validity', +]); +const JWT_INPUT_KEYS = new Set([ + ...COMMON_KEYS, + 'carrier_provenance', + 'principal_binding', +]); +const X509_INPUT_KEYS = new Set([ + ...COMMON_KEYS, + 'carrier_provenance', + 'principal_binding', +]); +const BOUND_JWT_INPUT_KEYS = new Set([...JWT_INPUT_KEYS, 'request_binding']); +const BOUND_X509_INPUT_KEYS = new Set([...X509_INPUT_KEYS, 'request_binding']); +const REQUEST_BINDING_KEYS = new Set([ + 'action_projection_profile_id', + 'action_projection_profile_digest', + 'requested_capability_digest', + 'projected_action', + 'projected_admission_domain_digest', +]); +const ACTION_KEYS = new Set(['caid', 'action_digest']); +const ADMISSION_DOMAIN_KEYS = new Set([ + 'relying_party_id', + 'audience', + 'executor_id', + 'state_domain_id', +]); +const RP_CONTEXT_KEYS = new Set([ + 'action', + 'admission_domain', + 'requested_capability_digest', + 'evaluated_at', + 'max_status_age_seconds', + 'policy', +]); +const RP_POLICY_KEYS = new Set([ + 'mapping_profile_id', + 'mapping_profile_digest', + 'action_projection_profile_id', + 'action_projection_profile_digest', + 'trusted_issuer_trust_anchor_digests', + 'native_verifier', +]); +const VERIFIER_DESCRIPTOR_KEYS = new Set(['id', 'version', 'implementation_digest']); +const JWT_PROVENANCE_KEYS = new Set([ + 'source_carrier', + 'compact_token', + 'presented_principal_jwk', + 'downstream_representation', +]); +const X509_PROVENANCE_KEYS = new Set([ + 'source_carrier', + 'agent_certificate_der', + 'principal_certificate_der', +]); +const BINDING_KEYS = new Set([ + 'kind', + 'hash_alg', + 'claimed_key_hash', + 'presented_key_hash', +]); +const STATUS_KEYS = new Set(['value', 'checked_at', 'source_head_digest']); +const VALIDITY_KEYS = new Set(['not_before', 'not_after']); +const PROJECTION_INPUT_KEYS = new Set([ + 'source', + 'purpose', + 'audience', + 'issued_at', + 'not_before', + 'expires_at', + 'token_id', + 'projected_algorithm', + 'projected_key_id', +]); +const PROJECTION_CONTEXT_KEYS = new Set([ + 'source_verification_policy', + 'evaluated_at', + 'max_status_age_seconds', +]); +const PROJECTION_SOURCE_POLICY_KEYS = new Set([ + 'source_verification_profile_id', + 'source_verification_profile_digest', + 'trusted_issuer_trust_anchor_digests', + 'native_verifier', +]); +const ISSUE_OPTION_KEYS = new Set([ + 'signing_keys', + 'mldsaBackend', + 'mldsaBackendLoader', + 'deterministic', +]); +const ISSUE_SIGNING_KEY_KEYS = new Set([ + 'alg', + 'private_key', + 'key_id', +]); +const NATIVE_VERIFICATIONS = new Set([ + 'VERIFIED', + 'FAILED', + 'INDETERMINATE', +]); +const STATUSES = new Set([ + 'CURRENT', + 'STALE', + 'UNAVAILABLE', + 'REVOKED', + 'INDETERMINATE', +]); + +function isRecord(value: unknown): value is Obj { + if (value === null || typeof value !== 'object' || Array.isArray(value)) return false; + const prototype = Object.getPrototypeOf(value); + return prototype === Object.prototype || prototype === null; +} + +function exactKeys(value: Obj, expected: ReadonlySet): boolean { + const keys = Reflect.ownKeys(value); + return keys.length === expected.size + && keys.every((key) => typeof key === 'string' && expected.has(key)); +} + +function identifier(value: unknown): value is string { + return typeof value === 'string' + && IDENTIFIER_RE.test(value) + && !/[\u0000-\u001f\u007f]/.test(value); +} + +function digest(value: unknown): value is AebDigest { + return typeof value === 'string' && DIGEST_RE.test(value); +} + +function instant(value: unknown): value is string { + return typeof value === 'string' + && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(value) + && Number.isFinite(Date.parse(value)); +} + +function validStatus(value: unknown): value is CrossingNativeStatus { + return isRecord(value) + && exactKeys(value, STATUS_KEYS) + && typeof value.value === 'string' + && STATUSES.has(value.value) + && instant(value.checked_at) + && digest(value.source_head_digest); +} + +function validValidity(value: unknown): value is CrossingValidity { + return isRecord(value) + && exactKeys(value, VALIDITY_KEYS) + && instant(value.not_before) + && instant(value.not_after) + && Date.parse(value.not_before) < Date.parse(value.not_after); +} + +function validAction(value: unknown): value is AicCrossingExactAction { + return isRecord(value) + && exactKeys(value, ACTION_KEYS) + && typeof value.caid === 'string' + && CAID_RE.test(value.caid) + && digest(value.action_digest); +} + +function validAdmissionDomain(value: unknown): value is AicCrossingAdmissionDomain { + return isRecord(value) + && exactKeys(value, ADMISSION_DOMAIN_KEYS) + && identifier(value.relying_party_id) + && identifier(value.audience) + && identifier(value.executor_id) + && identifier(value.state_domain_id); +} + +function validRequestBinding(value: unknown): value is AicCrossingRequestBinding { + return isRecord(value) + && exactKeys(value, REQUEST_BINDING_KEYS) + && identifier(value.action_projection_profile_id) + && digest(value.action_projection_profile_digest) + && digest(value.requested_capability_digest) + && validAction(value.projected_action) + && digest(value.projected_admission_domain_digest); +} + +function validVerifierDescriptor(value: unknown): value is AicNativeVerifierDescriptor { + return isRecord(value) + && exactKeys(value, VERIFIER_DESCRIPTOR_KEYS) + && identifier(value.id) + && identifier(value.version) + && digest(value.implementation_digest); +} + +function validRelyingPartyPolicy( + value: unknown, +): value is AicCrossingRelyingPartyPolicy { + return isRecord(value) + && exactKeys(value, RP_POLICY_KEYS) + && identifier(value.mapping_profile_id) + && digest(value.mapping_profile_digest) + && identifier(value.action_projection_profile_id) + && digest(value.action_projection_profile_digest) + && validTrustSet(value.trusted_issuer_trust_anchor_digests) + && validVerifierDescriptor(value.native_verifier); +} + +function validRelyingPartyContext( + value: unknown, +): value is AicCrossingRelyingPartyContext { + return isRecord(value) + && exactKeys(value, RP_CONTEXT_KEYS) + && validAction(value.action) + && validAdmissionDomain(value.admission_domain) + && digest(value.requested_capability_digest) + && instant(value.evaluated_at) + && Number.isSafeInteger(value.max_status_age_seconds) + && Number(value.max_status_age_seconds) >= 0 + && Number(value.max_status_age_seconds) <= 86_400 + && validRelyingPartyPolicy(value.policy); +} + +function validTrustSet(value: unknown): value is AebDigest[] { + return Array.isArray(value) + && value.length > 0 + && value.length <= 64 + && value.every(digest) + && new Set(value).size === value.length; +} + +function validProjectionSourcePolicy( + value: unknown, +): value is AicJwtSvidSourceVerificationPolicy { + return isRecord(value) + && exactKeys(value, PROJECTION_SOURCE_POLICY_KEYS) + && value.source_verification_profile_id + === AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE + && digest(value.source_verification_profile_digest) + && validTrustSet(value.trusted_issuer_trust_anchor_digests) + && validVerifierDescriptor(value.native_verifier); +} + +function commonValid(value: Obj): value is Obj & AicCrossingCommonInput { + return NATIVE_VERIFICATIONS.has(value.native_verification as CrossingNativeVerification) + && validVerifierDescriptor(value.native_verifier) + && digest(value.native_verification_evidence_digest) + && identifier(value.issuer) + && identifier(value.subject) + && identifier(value.artifact_id) + && digest(value.artifact_digest) + && digest(value.issuer_trust_anchor_digest) + && digest(value.constraints_digest) + && validStatus(value.status) + && validValidity(value.validity); +} + +function expectedHashLength(hashAlg: 'jkt' | AicSpkiHashAlgorithm): number { + return 43; +} + +function keyHash(value: unknown, hashAlg: 'jkt' | AicSpkiHashAlgorithm): value is string { + return typeof value === 'string' + && value.length === expectedHashLength(hashAlg) + && BASE64URL_RE.test(value); +} + +function validJktBinding(value: unknown): value is AicRfc7638JktBinding { + return isRecord(value) + && exactKeys(value, BINDING_KEYS) + && value.kind === 'RFC7638_JKT' + && value.hash_alg === 'jkt' + && keyHash(value.claimed_key_hash, 'jkt') + && keyHash(value.presented_key_hash, 'jkt'); +} + +function validSpkiBinding(value: unknown): value is AicX509SpkiBinding { + if (!isRecord(value) || !exactKeys(value, BINDING_KEYS)) return false; + if (value.kind !== 'X509_SPKI') return false; + if (value.hash_alg !== 'sha-256') return false; + const hashAlg = value.hash_alg as AicSpkiHashAlgorithm; + return keyHash(value.claimed_key_hash, hashAlg) + && keyHash(value.presented_key_hash, hashAlg); +} + +type InspectedJwtCarrier = { + carrierOrigin: 'AIC-JWT'; + representation: AicJwtDownstreamRepresentation; + artifactDigest: AebDigest; + issuer: string; + artifactId: string; + claimedKeyHash: string; + presentedKeyHash: string; + audiences: string[]; + issuedAt: number; + notBefore: number | null; + expiresAt: number; + semantics: { + hasConstraints: boolean; + delegationMode: 'authorized' | 'representative'; + hasDelegationAssertion: boolean; + confirmationKeyPresent: boolean; + }; +}; + +type InspectedX509Carrier = { + carrierOrigin: 'AIC-X509-CERTIFICATE'; + artifactDigest: AebDigest; + certificateSerial: string; + presentedKeyHash: string; +}; + +function canonicalBase64urlBytes(value: unknown, maximumBytes: number): Buffer | null { + if (typeof value !== 'string' + || value.length === 0 + || !BASE64URL_RE.test(value) + || value.length % 4 === 1) return null; + try { + const bytes = Buffer.from(value, 'base64url'); + if (bytes.length === 0 + || bytes.length > maximumBytes + || bytes.toString('base64url') !== value) return null; + return bytes; + } catch { + return null; + } +} + +function jsonObjectFromSegment(segment: string): Obj | null { + const bytes = canonicalBase64urlBytes(segment, MAX_AIC_JWT_BYTES); + if (!bytes) return null; + try { + const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes); + const parsed: unknown = JSON.parse(text); + return isRecord(parsed) ? parsed : null; + } catch { + return null; + } +} + +function jwtNumericDate(value: unknown): number | null { + if (!Number.isSafeInteger(value)) return null; + const milliseconds = Number(value) * 1_000; + return Number.isSafeInteger(milliseconds) && Number.isFinite(new Date(milliseconds).valueOf()) + ? Number(value) + : null; +} + +function inspectPrincipalPublicJwk(value: unknown): { + jwk: AicPrincipalPublicJwk; + thumbprint: string; +} | null { + if (!isRecord(value) || typeof value.kty !== 'string') return null; + let jwk: AicPrincipalPublicJwk; + let canonical: Obj; + if (value.kty === 'EC') { + const keys = new Set(['kty', 'crv', 'x', 'y']); + const { crv, x, y } = value; + if (!exactKeys(value, keys) + || !identifier(crv) + || typeof x !== 'string' + || typeof y !== 'string' + || !canonicalBase64urlBytes(x, 1_024) + || !canonicalBase64urlBytes(y, 1_024)) return null; + jwk = { kty: 'EC', crv, x, y }; + canonical = { crv, kty: 'EC', x, y }; + } else if (value.kty === 'RSA') { + const keys = new Set(['kty', 'n', 'e']); + const { n, e } = value; + if (!exactKeys(value, keys) + || typeof n !== 'string' + || typeof e !== 'string' + || !canonicalBase64urlBytes(n, 16 * 1_024) + || !canonicalBase64urlBytes(e, 16)) return null; + jwk = { kty: 'RSA', n, e }; + canonical = { e, kty: 'RSA', n }; + } else if (value.kty === 'OKP') { + const keys = new Set(['kty', 'crv', 'x']); + const { crv, x } = value; + if (!exactKeys(value, keys) + || !identifier(crv) + || typeof x !== 'string' + || !canonicalBase64urlBytes(x, 1_024)) return null; + jwk = { kty: 'OKP', crv, x }; + canonical = { crv, kty: 'OKP', x }; + } else { + return null; + } + try { + crypto.createPublicKey({ key: jwk, format: 'jwk' }); + } catch { + return null; + } + return { + jwk, + thumbprint: crypto.createHash('sha256') + .update(JSON.stringify(canonical), 'utf8') + .digest('base64url'), + }; +} + +function inspectJwtCarrier(input: AicJwtJktCrossingInput): InspectedJwtCarrier | null { + const provenance = input.carrier_provenance; + if (!isRecord(provenance) + || !exactKeys(provenance, JWT_PROVENANCE_KEYS) + || provenance.source_carrier !== 'AIC-JWT-COMPACT' + || !['DIRECT', 'SYNTHESIZED-X509'].includes( + String(provenance.downstream_representation), + ) + || typeof provenance.compact_token !== 'string' + || Buffer.byteLength(provenance.compact_token, 'utf8') > MAX_AIC_JWT_BYTES) { + return null; + } + const segments = provenance.compact_token.split('.'); + if (segments.length !== 3 + || segments.some((segment) => !canonicalBase64urlBytes(segment, MAX_AIC_JWT_BYTES))) { + return null; + } + const header = jsonObjectFromSegment(segments[0]); + const payload = jsonObjectFromSegment(segments[1]); + if (!header || !payload || header.typ !== 'aic+jwt') return null; + const aic = payload.aic; + const principal = isRecord(aic) ? aic.principal : null; + const presentedPrincipal = inspectPrincipalPublicJwk( + provenance.presented_principal_jwk, + ); + const issuedAt = jwtNumericDate(payload.iat); + const expiresAt = jwtNumericDate(payload.exp); + const notBefore = payload.nbf === undefined ? null : jwtNumericDate(payload.nbf); + if (!isRecord(principal) + || !presentedPrincipal + || issuedAt === null + || issuedAt === 0 + || expiresAt === null + || expiresAt === 0 + || expiresAt <= issuedAt + || (payload.nbf !== undefined && notBefore === null) + || (notBefore !== null && notBefore > expiresAt) + || principal.hash_alg !== 'jkt' + || !keyHash(principal.key_hash, 'jkt') + || payload.iss !== input.issuer + || payload.sub !== input.subject + || payload.jti !== input.artifact_id) return null; + const audiences = typeof payload.aud === 'string' + ? [payload.aud] + : Array.isArray(payload.aud) ? payload.aud : null; + if (!audiences + || audiences.length === 0 + || audiences.length > 64 + || !audiences.every(identifier) + || new Set(audiences).size !== audiences.length) return null; + const delegationMode = isRecord(aic) ? aic.delegation_mode : null; + if (delegationMode !== 'authorized' && delegationMode !== 'representative') { + return null; + } + const constraints = isRecord(aic) ? aic.constraints : undefined; + if (constraints !== undefined && !Array.isArray(constraints)) return null; + const delegationAssertion = payload.da; + if (delegationAssertion !== undefined + && (typeof delegationAssertion !== 'string' || delegationAssertion.length === 0)) { + return null; + } + const confirmation = payload.cnf; + if (confirmation !== undefined + && (!isRecord(confirmation) || !keyHash(confirmation.jkt, 'jkt'))) return null; + return { + carrierOrigin: 'AIC-JWT', + representation: + provenance.downstream_representation as AicJwtDownstreamRepresentation, + artifactDigest: `sha256:${crypto.createHash('sha256') + .update(provenance.compact_token, 'utf8') + .digest('hex')}`, + issuer: payload.iss, + artifactId: payload.jti, + claimedKeyHash: principal.key_hash, + presentedKeyHash: presentedPrincipal.thumbprint, + audiences, + issuedAt, + notBefore, + expiresAt, + semantics: { + hasConstraints: Array.isArray(constraints) && constraints.length > 0, + delegationMode, + hasDelegationAssertion: typeof delegationAssertion === 'string', + confirmationKeyPresent: isRecord(confirmation), + }, + }; +} + +function inspectX509Carrier( + input: AicX509SpkiCrossingInput, +): InspectedX509Carrier | null { + const provenance = input.carrier_provenance; + if (!isRecord(provenance) + || !exactKeys(provenance, X509_PROVENANCE_KEYS) + || provenance.source_carrier !== 'AIC-X509-CREDENTIAL-BUNDLE') return null; + const agentDer = canonicalBase64urlBytes( + provenance.agent_certificate_der, + MAX_AIC_CERTIFICATE_BYTES, + ); + const principalDer = canonicalBase64urlBytes( + provenance.principal_certificate_der, + MAX_AIC_CERTIFICATE_BYTES, + ); + if (!agentDer || !principalDer || agentDer.equals(principalDer)) return null; + try { + const agent = new X509Certificate(agentDer); + const principal = new X509Certificate(principalDer); + if (!agent.raw.equals(agentDer) || !principal.raw.equals(principalDer)) return null; + const principalSpki = principal.publicKey.export({ type: 'spki', format: 'der' }); + if (!Buffer.isBuffer(principalSpki)) return null; + const hashName = input.principal_binding.hash_alg.replace('-', ''); + const serial = agent.serialNumber.replaceAll(':', '').toUpperCase(); + if (!/^[0-9A-F]{2,128}$/.test(serial)) return null; + return { + carrierOrigin: 'AIC-X509-CERTIFICATE', + artifactDigest: digestAebTyped( + { + agent_certificate_der: provenance.agent_certificate_der, + principal_certificate_der: provenance.principal_certificate_der, + }, + AIC_X509_CREDENTIAL_BUNDLE_DIGEST_VERSION, + ), + certificateSerial: serial, + presentedKeyHash: crypto.createHash(hashName) + .update(principalSpki) + .digest('base64url'), + }; + } catch { + return null; + } +} + +function sameVerifier( + left: AicNativeVerifierDescriptor, + right: AicNativeVerifierDescriptor, +): boolean { + return left.id === right.id + && left.version === right.version + && left.implementation_digest === right.implementation_digest; +} + +function nativeVerificationDisposition( + input: AicCrossingCommonInput, +): string | null { + if (input.native_verification === 'FAILED') { + return 'aic_native_verification_failed'; + } + if (input.native_verification === 'INDETERMINATE') { + return 'aic_native_verification_indeterminate'; + } + return null; +} + +function trustDisposition( + input: AicCrossingCommonInput, + policy: AicCrossingRelyingPartyPolicy, + expectedMappingProfileId: string, +): string | null { + const nativeVerification = nativeVerificationDisposition(input); + if (nativeVerification) return nativeVerification; + if (!validRelyingPartyPolicy(policy)) return 'aic_relying_party_policy_invalid'; + if (policy.mapping_profile_id !== expectedMappingProfileId) { + return 'aic_mapping_profile_unpinned'; + } + if (!sameVerifier(input.native_verifier, policy.native_verifier)) { + return 'aic_native_verifier_unpinned'; + } + if (!policy.trusted_issuer_trust_anchor_digests.includes( + input.issuer_trust_anchor_digest, + )) { + return 'aic_issuer_untrusted'; + } + if (input.status.value !== 'CURRENT') return 'aic_status_not_current'; + return null; +} + +function projectionSourceTrustDisposition( + input: AicCrossingCommonInput, + policy: AicJwtSvidSourceVerificationPolicy, +): string | null { + const nativeVerification = nativeVerificationDisposition(input); + if (nativeVerification) return nativeVerification; + if (!validProjectionSourcePolicy(policy)) { + return 'aic_projection_source_policy_invalid'; + } + if (!sameVerifier(input.native_verifier, policy.native_verifier)) { + return 'aic_native_verifier_unpinned'; + } + if (!policy.trusted_issuer_trust_anchor_digests.includes( + input.issuer_trust_anchor_digest, + )) { + return 'aic_issuer_untrusted'; + } + if (input.status.value !== 'CURRENT') return 'aic_status_not_current'; + return null; +} + +function temporalDisposition( + input: AicCrossingCommonInput, + context: { evaluated_at: string; max_status_age_seconds: number }, +): string | null { + const evaluatedAt = Date.parse(context.evaluated_at); + const observedAt = Date.parse(input.status.checked_at); + if (observedAt > evaluatedAt) return 'aic_status_observation_future'; + if (evaluatedAt - observedAt > context.max_status_age_seconds * 1_000) { + return 'aic_status_observation_stale'; + } + if (evaluatedAt < Date.parse(input.validity.not_before) + || evaluatedAt > Date.parse(input.validity.not_after)) { + return 'aic_validity_window_mismatch'; + } + return null; +} + +function freshnessProfileDisposition(seconds: number): string | null { + return seconds === AIC_CROSSING_MAX_STATUS_AGE_SECONDS + ? null + : 'aic_status_freshness_profile_mismatch'; +} + +function jwtValidityDisposition( + input: AicJwtJktCrossingInput, + carrier: InspectedJwtCarrier, + evaluatedAt: string, +): string | null { + const signedNotBefore = (carrier.notBefore ?? carrier.issuedAt) * 1_000; + const signedExpiration = carrier.expiresAt * 1_000; + if (Date.parse(input.validity.not_before) !== signedNotBefore + || Date.parse(input.validity.not_after) !== signedExpiration) { + return 'aic_jwt_validity_mismatch'; + } + // JWT exp is an exclusive boundary: the token is invalid at the instant + // represented by exp, even though X.509 notAfter remains inclusive here. + if (Date.parse(evaluatedAt) >= signedExpiration) { + return 'aic_validity_window_mismatch'; + } + return null; +} + +function authorityFrom( + input: AicCrossingCommonInput, + policy: AicCrossingRelyingPartyPolicy, + native: { + adapterId: string; + mappingProfile: string; + nativeProfile: string; + binding: AicRfc7638JktBinding | AicX509SpkiBinding; + replayIdentity: Obj; + instanceContext: Obj; + }, +): CrossingNativeAuthority { + return { + adapter_id: native.adapterId, + adapter_version: '1', + mapping_profile_id: native.mappingProfile, + mapping_profile_digest: policy.mapping_profile_digest, + native_profile: native.nativeProfile, + issuer: input.issuer, + subject: input.subject, + authority_instance_digest: digestAebTyped( + { + native_profile: native.nativeProfile, + issuer: input.issuer, + subject: input.subject, + artifact_id: input.artifact_id, + artifact_digest: input.artifact_digest, + issuer_trust_anchor_digest: input.issuer_trust_anchor_digest, + native_verifier: input.native_verifier, + native_verification_evidence_digest: + input.native_verification_evidence_digest, + principal_binding: native.binding, + native: native.instanceContext, + }, + `${native.mappingProfile}:authority-instance`, + ), + evidence_digest: input.artifact_digest, + replay_unit: digestAebTyped( + native.replayIdentity, + `${native.mappingProfile}:replay-unit`, + ), + native_verification: 'VERIFIED', + rp_acceptance: 'ACCEPTED', + status: structuredClone(input.status), + constraints_digest: input.constraints_digest, + validity: structuredClone(input.validity), + }; +} + +function boundDisposition( + input: AicCrossingCommonInput & { request_binding: AicCrossingRequestBinding }, + context: AicCrossingRelyingPartyContext, + expectedMappingProfileId: string, +): string | null { + const trust = trustDisposition(input, context.policy, expectedMappingProfileId); + if (trust) return trust; + if (input.request_binding.action_projection_profile_id + !== context.policy.action_projection_profile_id + || input.request_binding.action_projection_profile_digest + !== context.policy.action_projection_profile_digest) { + return 'aic_action_projection_profile_unpinned'; + } + if (input.request_binding.requested_capability_digest + !== context.requested_capability_digest) { + return 'aic_requested_capability_mismatch'; + } + if (input.status.value !== 'CURRENT') return 'aic_status_not_current'; + const freshnessProfile = freshnessProfileDisposition( + context.max_status_age_seconds, + ); + if (freshnessProfile) return freshnessProfile; + const temporal = temporalDisposition(input, context); + if (temporal) return temporal; + if (input.request_binding.projected_action.caid !== context.action.caid + || input.request_binding.projected_action.action_digest + !== context.action.action_digest) { + return 'aic_action_projection_mismatch'; + } + const expectedAdmissionDomainDigest = digestAebTyped( + context.admission_domain, + AIC_ADMISSION_DOMAIN_VERSION, + ); + if (input.request_binding.projected_admission_domain_digest + !== expectedAdmissionDomainDigest) { + return 'aic_admission_domain_mismatch'; + } + return null; +} + +function boundAuthorityFrom( + input: AicCrossingCommonInput & { request_binding: AicCrossingRequestBinding }, + context: AicCrossingRelyingPartyContext, + native: { + adapterId: string; + mappingProfile: string; + nativeProfile: string; + binding: AicRfc7638JktBinding | AicX509SpkiBinding; + replayIdentity: Obj; + instanceContext: Obj; + }, +): CrossingNativeAuthority { + const actionAndDomain = { + requested_capability_digest: context.requested_capability_digest, + action_projection_profile_id: + input.request_binding.action_projection_profile_id, + action_projection_profile_digest: + input.request_binding.action_projection_profile_digest, + max_status_age_seconds: context.max_status_age_seconds, + action: context.action, + admission_domain: context.admission_domain, + }; + const authority = authorityFrom(input, context.policy, { + ...native, + replayIdentity: { + ...native.replayIdentity, + action_and_domain: actionAndDomain, + }, + instanceContext: { + ...native.instanceContext, + action_and_domain: actionAndDomain, + source_status: input.status, + evaluated_at: context.evaluated_at, + }, + }); + return { + ...authority, + constraints_digest: digestAebTyped( + { + native_constraints_digest: input.constraints_digest, + ...actionAndDomain, + }, + `${native.mappingProfile}:bound-constraints`, + ), + }; +} + +export function mapAicJwtJktBoundCrossingAuthority( + input: AicJwtJktBoundCrossingInput, + context: AicCrossingRelyingPartyContext, +): CrossingAuthorityMappingResult { + if (!isRecord(input) + || !exactKeys(input, BOUND_JWT_INPUT_KEYS) + || !commonValid(input) + || !validRequestBinding(input.request_binding) + || !validRelyingPartyContext(context)) { + return { ok: false, reason: 'mapping_input_invalid' }; + } + if (!validJktBinding(input.principal_binding)) { + return { ok: false, reason: 'aic_native_type_confusion' }; + } + const nativeVerification = nativeVerificationDisposition(input); + if (nativeVerification) return { ok: false, reason: nativeVerification }; + const carrier = inspectJwtCarrier(input); + if (!carrier) return { ok: false, reason: 'aic_carrier_provenance_unverifiable' }; + if (carrier.artifactDigest !== input.artifact_digest) { + return { ok: false, reason: 'aic_carrier_artifact_digest_mismatch' }; + } + if (carrier.claimedKeyHash !== input.principal_binding.claimed_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + if (carrier.presentedKeyHash !== input.principal_binding.presented_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + const jwtValidity = jwtValidityDisposition( + input, + carrier, + context.evaluated_at, + ); + if (jwtValidity) return { ok: false, reason: jwtValidity }; + if (!carrier.audiences.includes(context.admission_domain.audience)) { + return { ok: false, reason: 'aic_audience_mismatch' }; + } + if (input.principal_binding.claimed_key_hash + !== input.principal_binding.presented_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + const disposition = boundDisposition( + input, + context, + AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + ); + if (disposition) return { ok: false, reason: disposition }; + return { + ok: true, + authority: boundAuthorityFrom(input, context, { + adapterId: 'native:aic-jwt-rfc7638-jkt-bound', + mappingProfile: AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + nativeProfile: 'AIC-JWT-RFC7638-JKT', + binding: input.principal_binding, + replayIdentity: { + carrier_origin: carrier.carrierOrigin, + issuer: carrier.issuer, + artifact_id: carrier.artifactId, + }, + instanceContext: { + carrier_origin: carrier.carrierOrigin, + downstream_representation: carrier.representation, + typ: 'aic+jwt', + }, + }), + }; +} + +export function mapAicX509SpkiBoundCrossingAuthority( + input: AicX509SpkiBoundCrossingInput, + context: AicCrossingRelyingPartyContext, +): CrossingAuthorityMappingResult { + if (!isRecord(input) + || !exactKeys(input, BOUND_X509_INPUT_KEYS) + || !commonValid(input) + || !validRequestBinding(input.request_binding) + || !validRelyingPartyContext(context)) { + return { ok: false, reason: 'mapping_input_invalid' }; + } + if (!validSpkiBinding(input.principal_binding)) { + return { ok: false, reason: 'aic_native_type_confusion' }; + } + const nativeVerification = nativeVerificationDisposition(input); + if (nativeVerification) return { ok: false, reason: nativeVerification }; + const carrier = inspectX509Carrier(input); + if (!carrier) return { ok: false, reason: 'aic_carrier_provenance_unverifiable' }; + if (carrier.artifactDigest !== input.artifact_digest) { + return { ok: false, reason: 'aic_carrier_artifact_digest_mismatch' }; + } + if (carrier.presentedKeyHash !== input.principal_binding.presented_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + if (input.principal_binding.claimed_key_hash + !== input.principal_binding.presented_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + const disposition = boundDisposition( + input, + context, + AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + ); + if (disposition) return { ok: false, reason: disposition }; + return { + ok: true, + authority: boundAuthorityFrom(input, context, { + adapterId: 'native:aic-x509-spki-bound', + mappingProfile: AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + nativeProfile: 'AIC-X509-SPKI', + binding: input.principal_binding, + replayIdentity: { + carrier_origin: carrier.carrierOrigin, + artifact_digest: carrier.artifactDigest, + certificate_serial: carrier.certificateSerial, + }, + instanceContext: { + carrier_origin: carrier.carrierOrigin, + certificate_serial: carrier.certificateSerial, + hash_alg: input.principal_binding.hash_alg, + }, + }), + }; +} + +function sameExactAction( + left: AicCrossingExactAction, + right: AicCrossingExactAction, +): boolean { + return left.caid === right.caid + && left.action_digest === right.action_digest; +} + +function sameAdmissionDomain( + left: AicCrossingAdmissionDomain, + right: AicCrossingAdmissionDomain, +): boolean { + return left.relying_party_id === right.relying_party_id + && left.audience === right.audience + && left.executor_id === right.executor_id + && left.state_domain_id === right.state_domain_id; +} + +function snapshotAicJson(value: T): T { + return JSON.parse(canonicalizeAeb(value)) as T; +} + +function dataRecordValues( + value: unknown, + allowed: ReadonlySet, + required: ReadonlySet, +): Obj | null { + if (!isRecord(value)) return null; + const keys = Reflect.ownKeys(value); + if (keys.some((key) => typeof key !== 'string' || !allowed.has(key))) { + return null; + } + const out: Obj = {}; + for (const key of keys as string[]) { + const descriptor = Object.getOwnPropertyDescriptor(value, key); + if (!descriptor || descriptor.enumerable !== true || !('value' in descriptor)) { + return null; + } + out[key] = descriptor.value; + } + return [...required].every((key) => Object.hasOwn(out, key)) ? out : null; +} + +function dataArrayValues(value: unknown): unknown[] | null { + if (!Array.isArray(value)) return null; + const keys = Reflect.ownKeys(value); + const lengthDescriptor = Object.getOwnPropertyDescriptor(value, 'length'); + if (!lengthDescriptor || !('value' in lengthDescriptor) + || !Number.isSafeInteger(lengthDescriptor.value) + || lengthDescriptor.value < 0) { + return null; + } + const length = Number(lengthDescriptor.value); + const expected = new Set([ + 'length', + ...Array.from({ length }, (_, index) => String(index)), + ]); + if (keys.some((key) => typeof key !== 'string' || !expected.has(key)) + || keys.length !== expected.size) { + return null; + } + const out: unknown[] = []; + for (let index = 0; index < length; index += 1) { + const descriptor = Object.getOwnPropertyDescriptor(value, String(index)); + if (!descriptor || descriptor.enumerable !== true || !('value' in descriptor)) { + return null; + } + out.push(descriptor.value); + } + return out; +} + +function snapshotIssueOptions( + options: AebCrossingRecordIssueOptions, +): AebCrossingRecordIssueOptions | null { + const fields = dataRecordValues( + options, + ISSUE_OPTION_KEYS, + new Set(['signing_keys']), + ); + if (!fields) return null; + const presentedKeys = dataArrayValues(fields.signing_keys); + if (!presentedKeys) return null; + const signingKeys: AebCrossingRecordIssueOptions['signing_keys'] = []; + for (const presented of presentedKeys) { + const key = dataRecordValues( + presented, + ISSUE_SIGNING_KEY_KEYS, + new Set(['alg', 'private_key']), + ); + if (!key || typeof key.alg !== 'string') return null; + const presentedPrivateKey = key.private_key; + let privateKey: string | Uint8Array | crypto.KeyObject; + if (presentedPrivateKey instanceof Uint8Array) { + privateKey = new Uint8Array(presentedPrivateKey); + } else if (typeof presentedPrivateKey === 'string' + || presentedPrivateKey instanceof crypto.KeyObject) { + privateKey = presentedPrivateKey; + } else { + return null; + } + if (Object.hasOwn(key, 'key_id') && typeof key.key_id !== 'string') { + return null; + } + signingKeys.push({ + alg: key.alg, + private_key: privateKey, + ...(typeof key.key_id === 'string' ? { key_id: key.key_id } : {}), + }); + } + const snapshot: AebCrossingRecordIssueOptions = { signing_keys: signingKeys }; + if (Object.hasOwn(fields, 'deterministic')) { + if (typeof fields.deterministic !== 'boolean') return null; + snapshot.deterministic = fields.deterministic; + } + if (Object.hasOwn(fields, 'mldsaBackend')) { + if (fields.mldsaBackend !== null + && fields.mldsaBackend !== undefined + && typeof fields.mldsaBackend !== 'object') { + return null; + } + snapshot.mldsaBackend = fields.mldsaBackend as + AebCrossingRecordIssueOptions['mldsaBackend']; + } + if (Object.hasOwn(fields, 'mldsaBackendLoader')) { + if (fields.mldsaBackendLoader !== undefined + && typeof fields.mldsaBackendLoader !== 'function') { + return null; + } + snapshot.mldsaBackendLoader = fields.mldsaBackendLoader as + AebCrossingRecordIssueOptions['mldsaBackendLoader']; + } + return snapshot; +} + +/** + * Maps a bound AIC result and issues its crossing record as one operation. + * The caller-supplied record action and boundary must exactly match the + * relying-party context before the generic signer is reached. + */ +export async function issueAicBoundCrossingRecord( + input: AicBoundCrossingInput, + context: AicCrossingRelyingPartyContext, + draft: AicBoundCrossingRecordDraft, + options: AebCrossingRecordIssueOptions, +): Promise { + let contextSnapshot: AicCrossingRelyingPartyContext; + let draftSnapshot: AicBoundCrossingRecordDraft; + try { + contextSnapshot = snapshotAicJson(context); + draftSnapshot = snapshotAicJson(draft); + } catch { + return { ok: false, reason: 'aic_crossing_issue_input_invalid' }; + } + if (!validRelyingPartyContext(contextSnapshot) + || !isRecord(draftSnapshot) + || !validAction(draftSnapshot.action) + || !validAdmissionDomain(draftSnapshot.boundary)) { + return { ok: false, reason: 'aic_crossing_issue_input_invalid' }; + } + if (!sameExactAction(draftSnapshot.action, contextSnapshot.action)) { + return { ok: false, reason: 'aic_crossing_issue_action_mismatch' }; + } + if (!sameAdmissionDomain( + draftSnapshot.boundary, + contextSnapshot.admission_domain, + )) { + return { + ok: false, + reason: 'aic_crossing_issue_admission_domain_mismatch', + }; + } + let optionsSnapshot: AebCrossingRecordIssueOptions | null; + let inputSnapshot: AicBoundCrossingInput; + try { + optionsSnapshot = snapshotIssueOptions(options); + inputSnapshot = snapshotAicJson(input); + } catch { + return { ok: false, reason: 'aic_crossing_issue_input_invalid' }; + } + if (!optionsSnapshot) { + return { ok: false, reason: 'aic_crossing_issue_input_invalid' }; + } + if (!isRecord(inputSnapshot) || !isRecord(inputSnapshot.principal_binding)) { + return { ok: false, reason: 'mapping_input_invalid' }; + } + let mapped: CrossingAuthorityMappingResult; + if (inputSnapshot.principal_binding.kind === 'RFC7638_JKT') { + mapped = mapAicJwtJktBoundCrossingAuthority( + inputSnapshot as AicJwtJktBoundCrossingInput, + contextSnapshot, + ); + } else if (inputSnapshot.principal_binding.kind === 'X509_SPKI') { + mapped = mapAicX509SpkiBoundCrossingAuthority( + inputSnapshot as AicX509SpkiBoundCrossingInput, + contextSnapshot, + ); + } else { + return { ok: false, reason: 'aic_native_type_confusion' }; + } + if (!mapped.ok) return mapped; + const record = await issueAebCrossingRecord( + { + ...draftSnapshot, + native_authority: mapped.authority, + action: structuredClone(contextSnapshot.action), + boundary: structuredClone(contextSnapshot.admission_domain), + }, + optionsSnapshot, + ); + return { ok: true, record }; +} + +function spiffeId(value: unknown): value is string { + if (typeof value !== 'string') return false; + try { + const parsed = new URL(value); + return parsed.protocol === 'spiffe:' + && parsed.hostname.length > 0 + && parsed.username === '' + && parsed.password === '' + && parsed.port === '' + && parsed.search === '' + && parsed.hash === ''; + } catch { + return false; + } +} + +function validProjectionInput(value: Obj): value is Obj & AicJwtSvidProjectionInput { + return exactKeys(value, PROJECTION_INPUT_KEYS) + && (value.purpose === 'WORKLOAD_IDENTITY_ONLY' || value.purpose === 'AIC_AUTHORITY') + && Array.isArray(value.audience) + && value.audience.every(identifier) + && Number.isSafeInteger(value.issued_at) + && (value.not_before === null || Number.isSafeInteger(value.not_before)) + && Number.isSafeInteger(value.expires_at) + && identifier(value.token_id) + && (value.projected_algorithm === 'ES256' || value.projected_algorithm === 'RS256') + && identifier(value.projected_key_id); +} + +function validProjectionContext( + value: unknown, +): value is AicJwtSvidProjectionRelyingPartyContext { + return isRecord(value) + && exactKeys(value, PROJECTION_CONTEXT_KEYS) + && validProjectionSourcePolicy(value.source_verification_policy) + && instant(value.evaluated_at) + && Number.isSafeInteger(value.max_status_age_seconds) + && Number(value.max_status_age_seconds) >= 0 + && Number(value.max_status_age_seconds) <= 86_400; +} + +type AicJwtProjectionSourceVerificationResult = + | { + ok: true; + carrier: InspectedJwtCarrier; + sourceEvaluationDigest: AebDigest; + } + | { ok: false; reason: string }; + +function verifyAicJwtProjectionSource( + input: AicJwtJktCrossingInput, + context: AicJwtSvidProjectionRelyingPartyContext, +): AicJwtProjectionSourceVerificationResult { + if (!isRecord(input) || !exactKeys(input, JWT_INPUT_KEYS) || !commonValid(input)) { + return { ok: false, reason: 'mapping_input_invalid' }; + } + if (!validJktBinding(input.principal_binding)) { + return { ok: false, reason: 'aic_native_type_confusion' }; + } + const nativeVerification = nativeVerificationDisposition(input); + if (nativeVerification) return { ok: false, reason: nativeVerification }; + const carrier = inspectJwtCarrier(input); + if (!carrier) return { ok: false, reason: 'aic_carrier_provenance_unverifiable' }; + if (carrier.artifactDigest !== input.artifact_digest) { + return { ok: false, reason: 'aic_carrier_artifact_digest_mismatch' }; + } + if (carrier.claimedKeyHash !== input.principal_binding.claimed_key_hash + || carrier.presentedKeyHash !== input.principal_binding.presented_key_hash + || input.principal_binding.claimed_key_hash + !== input.principal_binding.presented_key_hash) { + return { ok: false, reason: 'aic_principal_binding_mismatch' }; + } + const jwtValidity = jwtValidityDisposition( + input, + carrier, + context.evaluated_at, + ); + if (jwtValidity) return { ok: false, reason: jwtValidity }; + const trust = projectionSourceTrustDisposition( + input, + context.source_verification_policy, + ); + if (trust) return { ok: false, reason: trust }; + const freshnessProfile = freshnessProfileDisposition( + context.max_status_age_seconds, + ); + if (freshnessProfile) return { ok: false, reason: freshnessProfile }; + const temporal = temporalDisposition(input, context); + if (temporal) return { ok: false, reason: temporal }; + return { + ok: true, + carrier, + sourceEvaluationDigest: digestAebTyped( + { + source_verification_profile_id: + context.source_verification_policy.source_verification_profile_id, + source_verification_profile_digest: + context.source_verification_policy.source_verification_profile_digest, + trusted_issuer_trust_anchor_digests: [ + ...context.source_verification_policy + .trusted_issuer_trust_anchor_digests, + ].sort(), + native_verification: input.native_verification, + native_verifier: input.native_verifier, + native_verification_evidence_digest: + input.native_verification_evidence_digest, + issuer: input.issuer, + subject: input.subject, + artifact_id: input.artifact_id, + artifact_digest: input.artifact_digest, + issuer_trust_anchor_digest: input.issuer_trust_anchor_digest, + constraints_digest: input.constraints_digest, + status: input.status, + validity: input.validity, + principal_binding: input.principal_binding, + carrier: { + origin: carrier.carrierOrigin, + representation: carrier.representation, + issuer: carrier.issuer, + artifact_id: carrier.artifactId, + artifact_digest: carrier.artifactDigest, + audiences: carrier.audiences, + issued_at: carrier.issuedAt, + not_before: carrier.notBefore, + expires_at: carrier.expiresAt, + semantics: carrier.semantics, + }, + evaluated_at: context.evaluated_at, + max_status_age_seconds: context.max_status_age_seconds, + }, + `${AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE}:accepted-source-evaluation`, + ), + }; +} + +export function projectAicJwtToStrictJwtSvid( + input: AicJwtSvidProjectionInput, + context: AicJwtSvidProjectionRelyingPartyContext, +): AicJwtSvidProjectionResult { + if (!isRecord(input) + || !validProjectionInput(input) + || !validProjectionContext(context)) { + return { ok: false, reason: 'jwt_svid_projection_input_invalid' }; + } + const source = verifyAicJwtProjectionSource(input.source, context); + if (!source.ok) { + if (source.reason === 'aic_status_observation_future') { + return { ok: false, reason: 'jwt_svid_source_status_future' }; + } + if (source.reason === 'aic_status_observation_stale') { + return { ok: false, reason: 'jwt_svid_source_status_stale' }; + } + if (source.reason === 'aic_validity_window_mismatch') { + return { ok: false, reason: 'jwt_svid_source_validity_mismatch' }; + } + return source; + } + const carrier = source.carrier; + const evaluatedAtMillis = Date.parse(context.evaluated_at); + const issuedAtMillis = input.issued_at * 1_000; + if (issuedAtMillis !== evaluatedAtMillis) { + return { ok: false, reason: 'jwt_svid_projection_evaluation_time_mismatch' }; + } + const observedAtMillis = Date.parse(input.source.status.checked_at); + if (observedAtMillis > evaluatedAtMillis) { + return { ok: false, reason: 'jwt_svid_source_status_future' }; + } + if (evaluatedAtMillis - observedAtMillis + > context.max_status_age_seconds * 1_000) { + return { ok: false, reason: 'jwt_svid_source_status_stale' }; + } + const sourceNotBeforeMillis = Date.parse(input.source.validity.not_before); + const sourceNotAfterMillis = Date.parse(input.source.validity.not_after); + const projectedNotBeforeMillis = (input.not_before ?? input.issued_at) * 1_000; + if (issuedAtMillis < sourceNotBeforeMillis + || projectedNotBeforeMillis < sourceNotBeforeMillis + || input.expires_at * 1_000 > sourceNotAfterMillis) { + return { ok: false, reason: 'jwt_svid_source_validity_mismatch' }; + } + if (!spiffeId(input.source.subject)) { + return { ok: false, reason: 'jwt_svid_spiffe_subject_required' }; + } + if (input.audience.length !== 1) { + return { ok: false, reason: 'jwt_svid_single_audience_required' }; + } + if (input.expires_at <= input.issued_at + || (input.not_before !== null && input.not_before >= input.expires_at)) { + return { ok: false, reason: 'jwt_svid_projection_time_invalid' }; + } + if (input.purpose !== 'WORKLOAD_IDENTITY_ONLY') { + return { ok: false, reason: 'aic_jwt_svid_semantic_loss' }; + } + + const omittedSourceMembers = [ + 'iss', + 'aic.principal', + 'aic.capabilities', + 'aic.delegation_mode', + ...(carrier.semantics.hasConstraints ? ['aic.constraints'] : []), + ...(carrier.semantics.hasDelegationAssertion ? ['da'] : []), + ...(carrier.semantics.confirmationKeyPresent ? ['cnf'] : []), + ]; + const protectedHeader = { + alg: input.projected_algorithm, + kid: input.projected_key_id, + typ: 'JWT' as const, + }; + const payload: AicStrictJwtSvidProjection['payload'] = { + sub: input.source.subject, + aud: input.audience[0], + iat: input.issued_at, + exp: input.expires_at, + ...(input.not_before === null ? {} : { nbf: input.not_before }), + jti: input.token_id, + }; + const sourceEvidence: AicStrictJwtSvidProjection['source'] = { + typ: 'aic+jwt', + issuer: carrier.issuer, + token_digest: carrier.artifactDigest, + source_semantics_digest: digestAebTyped( + { + principal_binding: input.source.principal_binding, + source_audiences: carrier.audiences, + has_constraints: carrier.semantics.hasConstraints, + delegation_mode: carrier.semantics.delegationMode, + has_delegation_assertion: carrier.semantics.hasDelegationAssertion, + confirmation_key_present: carrier.semantics.confirmationKeyPresent, + }, + `${AIC_JWT_SVID_PROJECTION_VERSION}:source-semantics`, + ), + source_evaluation_digest: source.sourceEvaluationDigest, + }; + const projectionDigest = digestAebTyped( + { + protected_header: protectedHeader, + payload, + source: sourceEvidence, + purpose: input.purpose, + omitted_source_members: omittedSourceMembers, + authority_semantics_preserved: false, + new_signature_required: true, + }, + `${AIC_JWT_SVID_PROJECTION_VERSION}:projection`, + ); + return { + ok: true, + projection: { + '@version': AIC_JWT_SVID_PROJECTION_VERSION, + protected_header: protectedHeader, + payload, + source: sourceEvidence, + purpose: 'WORKLOAD_IDENTITY_ONLY', + omitted_source_members: omittedSourceMembers, + authority_semantics_preserved: false, + new_signature_required: true, + compact_token: null, + authorization_decision: false, + projection_digest: projectionDigest, + }, + }; +} diff --git a/packages/verify/src/index.ts b/packages/verify/src/index.ts index 848c2fe93..39387399e 100644 --- a/packages/verify/src/index.ts +++ b/packages/verify/src/index.ts @@ -2385,6 +2385,22 @@ export { verifyAebCrossingRecord, } from './aeb-crossing-record.js'; +// Native AIC crossing mappings preserve the pure-JSON RFC 7638 JKT and +// X.509 SPKI cases as separate authority systems. The JWT-SVID helper emits a +// new-signature-required identity projection and never authorizes an action. +export { + AIC_CROSSING_MAX_STATUS_AGE_SECONDS, + AIC_JWT_JKT_BOUND_CROSSING_MAPPING_PROFILE, + AIC_JWT_SVID_PROJECTION_VERSION, + AIC_JWT_SVID_SOURCE_VERIFICATION_PROFILE, + AIC_ADMISSION_DOMAIN_VERSION, + AIC_X509_SPKI_BOUND_CROSSING_MAPPING_PROFILE, + mapAicJwtJktBoundCrossingAuthority, + mapAicX509SpkiBoundCrossingAuthority, + issueAicBoundCrossingRecord, + projectAicJwtToStrictJwtSvid, +} from './aeb-aic-crossing-adapter.js'; + // EP-AEC-v1 is available through the explicit `./evidence-chain` package subpath. // It is not re-exported here because evidence-chain.js composes this module and a // main-entry re-export would create a circular initialization path. diff --git a/packages/verify/tsconfig.json b/packages/verify/tsconfig.json index 1582cdad9..801d36f65 100644 --- a/packages/verify/tsconfig.json +++ b/packages/verify/tsconfig.json @@ -56,6 +56,7 @@ "src/authority-program.ts", "src/aeb-adapter-contract.ts", "src/aeb-crossing-record.ts", + "src/aeb-aic-crossing-adapter.ts", "src/aeb-acceptance-profile.ts", "src/aeb-execution-conditions.ts", "src/authorization-server-confirmation.ts", diff --git a/papers/preprint/main.tex b/papers/preprint/main.tex index 9ab341015..4d131d2d8 100644 --- a/papers/preprint/main.tex +++ b/papers/preprint/main.tex @@ -11,7 +11,7 @@ % Every quantitative claim is traceable to a repository artifact: % - conformance 21 suites / 332 vectors -> conformance/conformance-manifest.json % (totals.suites=21, totals.vectors=332) -% manifest_sha256=de00937588feff870bb7b72e5f6b09549a3008142f76136dd6a1bd7cce91e71a +% manifest_sha256=9fb14a40af62b7a94b629021dc316ea6087ba6c2873da23a43e07e71bf7a9200 % - all Tamarin lemma output blocks -> formal/PROOF_STATUS.md (verbatim) % - TLA+ 413,137 states / 45,342 distinct / 26 invariants -> formal/PROOF_STATUS.md % - Alloy 15 + 7 + 6 + 4 = 32 assertions -> formal/PROOF_STATUS.md diff --git a/public/.well-known/emilia-context.json b/public/.well-known/emilia-context.json index b10ae1d82..304a18b1a 100644 --- a/public/.well-known/emilia-context.json +++ b/public/.well-known/emilia-context.json @@ -1,9 +1,9 @@ { "@version": "EMILIA-REPO-CONTEXT-v1", - "evidence_snapshot_at": "2026-09-01T09:44:11.545Z", + "evidence_snapshot_at": "2026-09-01T14:52:23.203Z", "provenance": { "generator": "scripts/generate-llm-context.mts", - "input_digest_sha256": "58ef6ac4a77b5d5dbc19181b45e6f796b0a54a61aace98f77114fa91bcd7a2a8", + "input_digest_sha256": "b532abe6876389a10aac43bd2c66faef2d58c5cc50a644aa7578772e68052845", "generated_from": [ { "path": "docs/ai/context-source.v1.json", @@ -17,12 +17,12 @@ }, { "path": "lib/proof-stats.json", - "sha256": "cab74e79ac95cff9d2747e038ba4d65fc7a9340dbab3e1dd24852592030c063e", + "sha256": "b04c96b5da35b0e52f72d4b4b1abf6c2149143edc8eeb83cb95dde60e5bd484b", "bytes": 4299 }, { "path": "conformance/conformance-manifest.json", - "sha256": "1f0f5a06b90faabab4c4eada8a87380d94a8f0d872af0a56b9391287a83bc3f2", + "sha256": "cb64bb6cf65672d0ee785e92765d7e4028db7e31ce5c94a2c71fb89865c4e8c4", "bytes": 6361 }, { @@ -37,7 +37,7 @@ }, { "path": "security/security-case.json", - "sha256": "c068ea00b3d264f6d2d9cdc7883c7f9302c4008529c2d1190cfabafd5c1ee455", + "sha256": "3e4e62f1bc4c4bba8e56c3e5d2aafb8725cf96f1334b1df7a5c4d92aa3a8cdb4", "bytes": 386020 }, { @@ -307,8 +307,8 @@ ], "current_evidence": { "automated_tests": { - "total": 10609, - "files": 658, + "total": 10611, + "files": 659, "policy": "all platform-applicable cases must pass; platform-specific cases may skip" }, "cross_language_conformance": { @@ -317,7 +317,7 @@ "implementations": 3, "relationship": "same_team_ports", "claim_scope": "current same-team cross-language consistency; not independent implementation evidence", - "manifest_sha256": "de00937588feff870bb7b72e5f6b09549a3008142f76136dd6a1bd7cce91e71a", + "manifest_sha256": "9fb14a40af62b7a94b629021dc316ea6087ba6c2873da23a43e07e71bf7a9200", "vector_bundle_sha256": "ee1021eb36de8e50448d9f12f00d16f3e24561276c9a42241e88178d5daa0d3e" }, "formal": { @@ -349,7 +349,7 @@ "coveredModelActions": 28, "actionCompleteModels": 1, "formalMutationOperators": 51, - "evidenceSha256": "fa7e5e6fc32db8984a2fe54b0593aec925750423692869ddb34cb70a3eb622d6", + "evidenceSha256": "b0906119807c78944e5997913f23f52ee2561edcf9583bf11ef50a97ace2bcf3", "boundary": "selected model/runtime scenarios under explicit projection relations; not a mechanized implementation refinement proof" }, "evidence_taxonomy": { @@ -419,7 +419,7 @@ "status": "passed", "claims": 35, "evidence_files": 259, - "evidence_bundle_sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "evidence_bundle_sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" }, "caid": { "core_vectors": 48, diff --git a/public/llms-full.txt b/public/llms-full.txt index a8d6b5967..7579d1f9f 100644 --- a/public/llms-full.txt +++ b/public/llms-full.txt @@ -2,7 +2,7 @@ > EMILIA is the authority control plane for autonomous work. The plain-language operating picture is a customer-owned authority toll booth at a configured protected boundary, where a human or institution defines a finite operating mandate and agents work unattended inside it. EMILIA Gate verifies the authority and evidence the owner requires for the exact action, reserves accepted authority before provider entry, admits or refuses the crossing, preserves executed or indeterminate outcomes, refuses blind replay, and returns an action-bound receipt packet. EMILIA Host is the private local deployment form of Gate for activated covered HTTP and MCP paths at a credential-owning provider boundary; the current surface is an HTTP local service alpha, HTTP and MCP SDK protection, and governed pilots. Native mandates and credentials from A2A, AP2, OAuth, and hardware-backed approval systems remain attributable to their issuers. EMILIA Protocol is the open Action Receipt Contract underneath Gate; EMILIA Approver captures device-bound exact-action human decisions when the mandate or local policy requires fresh human authority; EMILIA Assurance Plane defines scoped verification, re-performance, conformance-report, and deployment-evidence procedures without acting as an auditor or accredited certifier. The toll-booth metaphor describes the intended cross-stack contract, not current coverage or operation of a central global network. -Generated from repository evidence. Evidence snapshot: 2026-09-01T09:44:11.545Z. Input digest: sha256:58ef6ac4a77b5d5dbc19181b45e6f796b0a54a61aace98f77114fa91bcd7a2a8. +Generated from repository evidence. Evidence snapshot: 2026-09-01T14:52:23.203Z. Input digest: sha256:b532abe6876389a10aac43bd2c66faef2d58c5cc50a644aa7578772e68052845. Do not edit this file directly. Source: [docs/ai/context-source.v1.json](https://github.com/emiliaprotocol/emilia-protocol/blob/main/docs/ai/context-source.v1.json). Freshness check: `npm run check:llm-context`. ## Read This First @@ -15,10 +15,10 @@ When this file conflicts with a quantitative claim elsewhere, use the machine-re ## Current Evidence Snapshot -- Automated tests: 10,609 cases across 658 files; all platform-applicable cases must pass; platform-specific cases may skip. +- Automated tests: 10,611 cases across 659 files; all platform-applicable cases must pass; platform-specific cases may skip. - Cross-language conformance: 21 suites, 332 current vectors, 3 same-team ports (JavaScript, Python, Go). This is consistency evidence, not implementation independence. - External Rust interoperability: pass on the time-pinned 164-vector set evaluated 2026-07-11; the current bundle has 332. The same pinned implementation passes 359 hostility cases. Strict clean-room construction acceptance: false. -- Security case: 35 executable claims, 259 evidence files, execution passed; bundle sha256:947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880. +- Security case: 35 executable claims, 259 evidence files, execution passed; bundle sha256:03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7. - Core formal inventory: 26 TLA+ invariants, 35 Alloy facts, 32 Alloy assertions. The selected-scenario models are reported separately below; formal scope and exclusions remain claim-specific. - Selected model/runtime scenario conformance: 78 content-addressed scenarios across 14 bounded models and 21 public claims; 51 negative controls pair a formal counterexample with a safe-runtime refusal. They do not mutate the runtime implementation. Boundary: selected model/runtime scenarios under explicit projection relations; not a mechanized implementation refinement proof. - Formal evidence taxonomy: 2 claims with verified formal obligations; 21 with bounded runtime-traced evidence; 1 with bounded formal evidence but no governed runtime bridge; 0 with partial symbolic coverage; 11 with executable or operational evidence only. diff --git a/public/llms.txt b/public/llms.txt index d025d00d6..075fc096c 100644 --- a/public/llms.txt +++ b/public/llms.txt @@ -2,13 +2,13 @@ > EMILIA is the authority control plane for autonomous work. The plain-language operating picture is a customer-owned authority toll booth at a configured protected boundary, where a human or institution defines a finite operating mandate and agents work unattended inside it. EMILIA Gate verifies the authority and evidence the owner requires for the exact action, reserves accepted authority before provider entry, admits or refuses the crossing, preserves executed or indeterminate outcomes, refuses blind replay, and returns an action-bound receipt packet. EMILIA Host is the private local deployment form of Gate for activated covered HTTP and MCP paths at a credential-owning provider boundary; the current surface is an HTTP local service alpha, HTTP and MCP SDK protection, and governed pilots. Native mandates and credentials from A2A, AP2, OAuth, and hardware-backed approval systems remain attributable to their issuers. EMILIA Protocol is the open Action Receipt Contract underneath Gate; EMILIA Approver captures device-bound exact-action human decisions when the mandate or local policy requires fresh human authority; EMILIA Assurance Plane defines scoped verification, re-performance, conformance-report, and deployment-evidence procedures without acting as an auditor or accredited certifier. The toll-booth metaphor describes the intended cross-stack contract, not current coverage or operation of a central global network. -This is a generated discovery index following the llms.txt proposal. Evidence snapshot: 2026-09-01T09:44:11.545Z. For substantive analysis, load the full or machine-readable context below before drawing conclusions from individual repository files. +This is a generated discovery index following the llms.txt proposal. Evidence snapshot: 2026-09-01T14:52:23.203Z. For substantive analysis, load the full or machine-readable context below before drawing conclusions from individual repository files. Prevention boundary: Gate prevents only on action paths under complete mediation. It does not constrain a path that bypasses the deployed enforcement point. ## Engineering Evidence -EMILIA is implemented security infrastructure, not architecture-only: 10,609 automated tests across 658 files; 35 executable security claims over 259 hashed evidence files; 20 verified obligations across 2 composed Tamarin models, with 8 deliberately weakened variants producing concrete attack traces; and 78 content-addressed selected model/runtime scenarios across 14 bounded models and 21 claims, including 51 paired formal-counterexample/runtime-refusal controls. +EMILIA is implemented security infrastructure, not architecture-only: 10,611 automated tests across 659 files; 35 executable security claims over 259 hashed evidence files; 20 verified obligations across 2 composed Tamarin models, with 8 deliberately weakened variants producing concrete attack traces; and 78 content-addressed selected model/runtime scenarios across 14 bounded models and 21 claims, including 51 paired formal-counterexample/runtime-refusal controls. Interoperability evidence: 21 conformance suites and 332 current vectors across three same-team ports; external Rust evidence covers a time-pinned 164-vector set plus 359 hostility cases. Strict clean-room construction acceptance remains false. diff --git a/scripts/verify-clean-room-submission-v2.mjs b/scripts/verify-clean-room-submission-v2.mjs index 0855654fd..450976f8f 100644 --- a/scripts/verify-clean-room-submission-v2.mjs +++ b/scripts/verify-clean-room-submission-v2.mjs @@ -11,8 +11,8 @@ import { isDeepStrictEqual } from 'node:util'; import { fileURLToPath } from 'node:url'; const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); const BUNDLE_RELATIVE_PATH = 'conformance/clean-room/v2/bundle.v2.json'; -const EXPECTED_MANIFEST_SHA256 = '1f0f5a06b90faabab4c4eada8a87380d94a8f0d872af0a56b9391287a83bc3f2'; -const EXPECTED_MANIFEST_CLAIM_SHA256 = 'de00937588feff870bb7b72e5f6b09549a3008142f76136dd6a1bd7cce91e71a'; +const EXPECTED_MANIFEST_SHA256 = 'cb64bb6cf65672d0ee785e92765d7e4028db7e31ce5c94a2c71fb89865c4e8c4'; +const EXPECTED_MANIFEST_CLAIM_SHA256 = '9fb14a40af62b7a94b629021dc316ea6087ba6c2873da23a43e07e71bf7a9200'; const EXPECTED_AUTHORITY_COMPANION_SHA256 = '121a358459ffed223a41a79570cc5307693eaa89a59b3ad330710c5e2f286959'; const SHA256_PATTERN = /^[0-9a-f]{64}$/; const GIT_OID_PATTERN = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/; diff --git a/scripts/verify-clean-room-submission-v2.mts b/scripts/verify-clean-room-submission-v2.mts index aab34d430..685702ec5 100644 --- a/scripts/verify-clean-room-submission-v2.mts +++ b/scripts/verify-clean-room-submission-v2.mts @@ -11,9 +11,9 @@ import { fileURLToPath } from 'node:url'; const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); const BUNDLE_RELATIVE_PATH = 'conformance/clean-room/v2/bundle.v2.json'; const EXPECTED_MANIFEST_SHA256 = - '1f0f5a06b90faabab4c4eada8a87380d94a8f0d872af0a56b9391287a83bc3f2'; + 'cb64bb6cf65672d0ee785e92765d7e4028db7e31ce5c94a2c71fb89865c4e8c4'; const EXPECTED_MANIFEST_CLAIM_SHA256 = - 'de00937588feff870bb7b72e5f6b09549a3008142f76136dd6a1bd7cce91e71a'; + '9fb14a40af62b7a94b629021dc316ea6087ba6c2873da23a43e07e71bf7a9200'; const EXPECTED_AUTHORITY_COMPANION_SHA256 = '121a358459ffed223a41a79570cc5307693eaa89a59b3ad330710c5e2f286959'; const SHA256_PATTERN = /^[0-9a-f]{64}$/; diff --git a/security/security-case.json b/security/security-case.json index 5970648d8..c4eb7af2f 100644 --- a/security/security-case.json +++ b/security/security-case.json @@ -1,7 +1,7 @@ { "@version": "EP-SECURITY-CASE-RESOLVED-v2", "source": "security/claims.v1.json", - "evidence_bundle_sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880", + "evidence_bundle_sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7", "claim_count": 35, "evidence_file_count": 259, "execution": { @@ -1092,7 +1092,7 @@ "security-evidence": { "kind": "content-addressed-evidence-bundle", "filename": "security-case-evidence.v1", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880", + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7", "file_count": 259 }, "verify-sdk": { @@ -1100,8 +1100,8 @@ "package": "@emilia-protocol/verify", "version": "3.21.0", "filename": "emilia-protocol-verify-3.21.0.tgz", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e", - "file_count": 462 + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40", + "file_count": 468 } }, "claims": [ @@ -1252,11 +1252,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -1515,11 +1515,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -1624,11 +1624,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -1790,11 +1790,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -1914,11 +1914,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -2113,7 +2113,7 @@ "release_artifact_hashes": [ { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -2474,7 +2474,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -2671,11 +2671,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -2854,11 +2854,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -3074,11 +3074,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -3308,11 +3308,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -3537,7 +3537,7 @@ "release_artifact_hashes": [ { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -3642,11 +3642,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -3860,7 +3860,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -4002,7 +4002,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -4419,7 +4419,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -4580,7 +4580,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -4827,7 +4827,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -4961,7 +4961,7 @@ "release_artifact_hashes": [ { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -5080,11 +5080,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -5220,7 +5220,7 @@ "release_artifact_hashes": [ { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -5451,7 +5451,7 @@ "release_artifact_hashes": [ { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -5666,7 +5666,7 @@ "release_artifact_hashes": [ { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -5882,7 +5882,7 @@ "release_artifact_hashes": [ { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -6186,7 +6186,7 @@ "release_artifact_hashes": [ { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -6394,11 +6394,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -6560,11 +6560,11 @@ "release_artifact_hashes": [ { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -6739,11 +6739,11 @@ }, { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -6918,7 +6918,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -7064,11 +7064,11 @@ }, { "artifact_id": "verify-sdk", - "sha256": "7734c87d3e597f26f5a64530b4c9b45d372af3618194b973709beb95a650b70e" + "sha256": "46cdab1361af1f6dbf7a6ede4706a82ce3f1e5da05a4a594bca787a4ac443c40" }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -7209,7 +7209,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -7408,7 +7408,7 @@ "release_artifact_hashes": [ { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -7822,7 +7822,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -8203,7 +8203,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] }, @@ -8406,7 +8406,7 @@ }, { "artifact_id": "security-evidence", - "sha256": "947a0f8612dcc9a67520637a100d9ca3137193d5db78b882e3bbf98b82528880" + "sha256": "03e23262bf2e778608daeaadb3c24b3a451d3d7a21d80498966b236e71aae9e7" } ] } @@ -8774,7 +8774,7 @@ }, { "path": "formal/results/formal-runtime-scenario-conformance.v2.json", - "sha256": "fa7e5e6fc32db8984a2fe54b0593aec925750423692869ddb34cb70a3eb622d6" + "sha256": "b0906119807c78944e5997913f23f52ee2561edcf9583bf11ef50a97ace2bcf3" }, { "path": "formal/results/outcome-authority-join.summary.txt", @@ -9238,7 +9238,7 @@ }, { "path": "packages/verify/src/index.ts", - "sha256": "b98f02b992726287f0a692845991035ec203693e8dbd2e8a53009164ae21705d" + "sha256": "7b188727aaf526a9bff1f4677c2037b60fda1755d83e29e3b64d2972b246b2b4" }, { "path": "packages/verify/src/outcome-binding.ts", diff --git a/tests/clean-room-v2.test.ts b/tests/clean-room-v2.test.ts index cddbff1b7..d627e8d99 100644 --- a/tests/clean-room-v2.test.ts +++ b/tests/clean-room-v2.test.ts @@ -154,9 +154,9 @@ describe('current-bundle clean-room v2', () => { const kit = loadPinnedKitV2(); expect(kit.bundle.totals).toEqual({ suites: 21, vectors: 332 }); expect(kit.sourceManifestSha256) - .toBe('1f0f5a06b90faabab4c4eada8a87380d94a8f0d872af0a56b9391287a83bc3f2'); + .toBe('cb64bb6cf65672d0ee785e92765d7e4028db7e31ce5c94a2c71fb89865c4e8c4'); expect(kit.sourceManifestClaimSha256) - .toBe('de00937588feff870bb7b72e5f6b09549a3008142f76136dd6a1bd7cce91e71a'); + .toBe('9fb14a40af62b7a94b629021dc316ea6087ba6c2873da23a43e07e71bf7a9200'); expect(kit.authorityExecutionCompanionSha256) .toBe('121a358459ffed223a41a79570cc5307693eaa89a59b3ad330710c5e2f286959'); const authority = kit.contracts.find((entry) =>