@atrib/verify 0.7.10 → 0.8.1

package/LICENSE

@@ -201,7 +201,7 @@
    See the License for the specific language governing permissions and
    limitations under the License.
 
-   Copyright 2025-2026 Atrib contributors
+   Copyright 2025-2026 atrib contributors
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/README.md

@@ -1,8 +1,16 @@
 # `@atrib/verify`
 
-**Independent verification of atrib records and settlement documents. Re-runs the spec [§4.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#46-the-calculation-algorithm) calculation algorithm locally and checks the result against what a recommendation document claims. Verifies any signed record against its creator key. No trust in any intermediary required.**
+**Independent verification for atrib's verifiable action layer. Checks signed records, evidence blocks, handoff packets, and settlement documents. Re-runs the spec [§4.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#46-the-calculation-algorithm) calculation algorithm locally and checks the result against what a recommendation document claims. No trust in any intermediary required.**
 
-This is the **verifier half** of the atrib protocol, used by merchants closing transactions, auditors checking agent activity, regulators querying historical state, and any party that needs to validate atrib data independently. The agent and tool servers produce signed attribution records. The Merkle log stores them. This package answers the questions any verifier has to answer: _given the graph and the policy, is this distribution actually correct? Was this record actually signed by the key it claims? Did this action actually happen at the time it claims?_
+This is the **verifier half** of the atrib protocol, used by merchants closing transactions, auditors checking agent activity, teams accepting handoffs, policy systems reviewing high-impact actions, regulators querying historical state, and any party that needs to validate atrib data independently. The agent and tool servers produce signed attribution records. The Merkle log stores them. This package answers the questions any verifier has to answer: _given the graph and the policy, is this distribution actually correct? Was this record actually signed by the key it claims? Did this action actually happen at the time it claims?_
+
+## Install
+
+```bash
+pnpm add @atrib/verify
+```
+
+Verify a local build with `pnpm --filter @atrib/verify test`.
 
 ## Quick start
 
@@ -15,6 +23,8 @@ const verifier = new AtribVerifier({
   logEndpoint: 'https://log.atrib.dev/v1',
 })
 
+// recommendationDoc is a §4.7 settlement RecommendationDocument produced by a
+// calculator or merchant (signed distribution over record hashes).
 const result = await verifier.verify(recommendationDoc)
 // {
 //   valid: true,
@@ -83,7 +93,7 @@ const result = await verifyRecord(record, {
   informedByCandidates: [], // optional, for informed_by[] resolution
   identityClaim, // optional, for capability_check (caller does directory lookup)
   resolvedFacts, // optional, caller-resolved facts for capability_check
-  authorizationEvidence, // optional, OAuth/MCP auth evidence blocks
+  authorizationEvidence, // optional, OAuth/MCP, AAuth, or x401 evidence blocks
   ap2ViEvidence, // optional, transaction-only AP2 / VI evidence bundle
   ap2ViEvidenceOptions, // optional, passed to verifyAp2ViEvidenceAsync()
 })
@@ -107,7 +117,7 @@ const result = await verifyRecord(record, {
 - `posture`: `{ timestamp_granularity, timestamp_consistent, timestamp_granularity_explicit, args_commitment_form, result_commitment_form, tool_name_form }` ([D045](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d045-privacy-postures-normative-spec-section) / [D061](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d061-add-tool_name-args_hash-result_hash-fields-to-§121) / [§8.2](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#82-opaque-name-posture) / [§8.3](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#83-salted-commitment-posture) / [§8.4](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#84-coarsened-timing-posture)). Always populated. Surfaces (a) the declared timing granularity, whether the timestamp value structurally matches the spec's trailing-zero invariant, and whether the field was explicitly set vs defaulted; (b) the structurally-detected `args_hash` / `result_hash` commitment scheme: `'salted-sha256'` when `args_salt` / `result_salt` is present, `'plain-sha256'` otherwise (the `'hmac-sha256'` variant from [§8.3](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#83-salted-commitment-posture) is signaled out-of-band and is not structurally detectable); and (c) the [§8.2](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#82-opaque-name-posture) `tool_name_form`: `'hashed'` when `tool_name` matches `^sha256:[0-9a-f]{64}$`, `'plain'` for any other present value, `null` when the field is absent. Per [D061](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d061-add-tool_name-args_hash-result_hash-fields-to-121) the [§8.2](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#82-opaque-name-posture) verbatim-vs-opaque distinction is NOT structurally detectable, both surface as `'plain'`.
 - `capability_check`: `{ envelope, in_envelope, mismatches, unresolvable }` ([D051](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d051-capability-scoped-records-via-directory-published-envelopes) / [§6.7](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#67-capability-declarations)). Populated only when the caller passes a resolved `identityClaim` in options. Checks the record's `event_type` against the envelope's `event_types` allowlist and the record's `timestamp` against `expires_at`. `tool_names`, `max_amount`, and `counterparties` are checked when the caller supplies `resolvedFacts` from the local body or protocol event. Missing facts flag `unresolvable: true` rather than passing silently. Per [§6.7.3](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#673-out-of-envelope-records) out-of-envelope is a signal, not invalidation: mismatches do not flip `valid` to false. The caller is responsible for fetching the active envelope at the record's timestamp via `@atrib/directory`'s `lookup()` (or a cached equivalent); `@atrib/verify` intentionally has no `@atrib/directory` dependency.
 - `cross_attestation`: `{ signers_count, signers_valid, missing }` ([D052](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d052-cross-attestation-requirement-for-transaction-records) / [§1.7.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#176-cross-attestation-requirement-for-transaction-records)). Populated only on transaction records (`event_type = transaction`). Each entry in `signers[]` is verified against the cross-attestation canonical bytes (JCS form with `signers: []` and the top-level `signature` field omitted, per [§1.7.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#176-cross-attestation-requirement-for-transaction-records)). `signatureOk` requires a valid signer entry whose `creator_key` matches the record's top-level `creator_key`; unrelated counterparty signers do not validate the record on behalf of its creator. `missing: true` when fewer than 2 distinct signer keys verify, atrib's normative minimum. Duplicate entries from one key do not inflate `signers_valid`. Per [§1.7.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#176-cross-attestation-requirement-for-transaction-records) missing is a signal, not invalidation: `valid` stays true if the underlying signature path holds. Agent-side Path 2 fallback records usually surface as `signers_count: 1, missing: true` until a counterparty signs the same bytes. Legacy single-signer transaction records (no `signers[]` array, only top-level `signature`) surface as `signers_count: 0, missing: true` so consumers can flag them while accepting the cryptographic validity.
-- `evidence`: generic tiered external authorization evidence blocks ([D109](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d109-mcpoauth-authorization-evidence-uses-generic-tiered-evidence-blocks) / [§5.5.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#556-generic-authorization-evidence-blocks)). Populated when the caller passes `authorizationEvidence` or when AP2 / VI evidence is mirrored into the generic shape. Each block has `{ valid, protocol, issuer, subject, scope, attenuation_ok, delegation_ok, constraints, errors, warnings }`. These blocks do not alter `valid`, `signatureOk`, or `capability_check`.
+- `evidence`: generic tiered external authorization evidence blocks ([D109](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d109-mcpoauth-authorization-evidence-uses-generic-tiered-evidence-blocks) / [§5.5.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#556-generic-authorization-evidence-blocks)). Populated when the caller passes `authorizationEvidence` or when AP2 / VI evidence is mirrored into the generic shape. Each block has `{ valid, protocol, issuer, subject, scope, attenuation_ok, delegation_ok, constraints, errors, warnings }`. Current authorization adapters are MCP/OAuth, AAuth, and x401. These blocks do not alter `valid`, `signatureOk`, or `capability_check`.
 - `ap2_vi_evidence`: the async AP2 / VI verifier result ([D094](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#d094-ap2--vi-evidence-attaches-to-verifier-results-as-a-tiered-block) / [§5.5.4](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#554-ap2--verifiable-intent-evidence-checks)). Populated only when the caller passes `ap2ViEvidence` for a transaction record. It does not alter `valid`, `signatureOk`, or `cross_attestation`; consumers inspect `ap2_vi_evidence.valid` for AP2 authorization evidence.
 
 **Pending per-record annotations** (tracked as a Pending decision in [DECISIONS.md P005](https://github.com/creatornader/atrib/blob/main/DECISIONS.md#p005-reconcile-atribverify-readme-per-record-annotations-with-actual-code-surface)):
@@ -259,6 +269,57 @@ The shared endpoint must atomically remember the posted key until `expires_at_se
 
 Producer-side MCP capture lives in `@atrib/mcp` behind the opt-in `authorizationEvidence` option. The producer writes evidence into the local-only sidecar without storing raw bearer tokens by default. Verifiers can pass that sidecar's `authorizationEvidence` and `resolvedFacts` to `verifyRecord()`.
 
+### `verifyX401AuthorizationEvidence(evidence): X401AuthorizationEvidenceVerification`
+
+Verifier-side x401 proof evidence checking. This runs outside the record signature path and does not verify OpenID4VP credentials, fetch remote credential results, call issuers, exchange OAuth tokens, or mint verification tokens. Callers supply decoded x401 objects or base64url JSON header values, then pass `resultVerified: true` or `tokenVerified: true` only after their own credential or token verifier accepts the result.
+
+```typescript
+import { encodeX401HeaderObject, verifyRecord } from '@atrib/verify'
+
+const result = await verifyRecord(record, {
+  authorizationEvidence: [
+    {
+      protocol: 'x401',
+      x401: {
+        headers: {
+          'PROOF-REQUEST': encodeX401HeaderObject(proofRequest),
+          'PROOF-RESPONSE': encodeX401HeaderObject(resultArtifact),
+        },
+        resultVerified: true,
+        expectedRequestId: 'proof-template-financial-customer-v1',
+        expectedAgentId: 'did:web:agent.example',
+        expectedAgentOrigin: 'https://agent.example/origin',
+        agentOrigin: 'https://agent.example/origin',
+        agentOriginVerified: true,
+        issuerTrustVerified: true,
+        issuerTrustRootType: 'proof-trust-list',
+        issuerTrustRootRef: 'https://trust.example/x401.json',
+        proofPaymentBindingVerified: true,
+        proofPaymentBindingRef: 'ap2-receipt:checkout-123',
+        requiredSatisfiedRequirements: ['kyc:basic'],
+      },
+    },
+  ],
+})
+```
+
+Checks performed when evidence is present:
+
+- x401 envelope, version, `credential_requirements.digital.requests[]`, and OAuth token endpoint.
+- Request id and result-artifact binding when both are present.
+- Visible OpenID4VP nonce from the credential request.
+- Result artifact or x401 token object shape.
+- Optional agent id, credential protocol, and satisfied requirement ids.
+- Optional caller-owned agent-origin, issuer-trust, and proof-payment binding verifier facts.
+- `PROOF-RESULT` error objects.
+- Payment separation: x401 `payment` hints are reported as informational and do not satisfy x402, MPP, AP2, ACP, or UCP.
+
+The default verification policy is `require`. A decoded proof response without `resultVerified: true` or `tokenVerified: true` is invalid, because parsing a header is not credential verification. Use `verificationPolicy: "best-effort"` for advisory review or `"off"` when another layer has already enforced the requirement. Optional agent-origin, issuer-trust, and proof-payment binding fields record caller-owned verifier outcomes. Explicit `false` values fail the evidence block. References are hashed in public details. Older draft names such as `PROOF-REQUIRED`, `PROOF-PRESENTATION`, and `presentation_requirements` are accepted with warnings by default; set `allowLegacyHeaders: false` or `allowLegacyFields: false` to reject them.
+
+The returned `details` object is safe for archive projection and Explorer rendering by default. It exposes proof request, response, and result hashes, `proof_gate` status, `payment_separation`, hashed origin, trust-root, and proof-payment binding references, the visible request id, visible nonce, agent id, credential protocol, and whether a `credential_result_uri` was present. It does not expose raw credential payloads, raw proof-response header values, raw verification tokens, trust-list documents, proof-payment binding documents, or fetched result-by-reference bodies.
+
+The offline x401 corpus lives at [`spec/conformance/5.5.6/x401/`](https://github.com/creatornader/atrib/blob/main/spec/conformance/5.5.6/x401/). It covers current headers, result artifacts, token responses, result-by-reference, request-id mismatch, proof-result errors, unverified proof failures, legacy-header strict mode, payment-hint separation, external origin facts, issuer-trust facts, and proof-payment binding facts.
+
 ### `verifyAAuthAuthorizationEvidence(evidence): Promise<AAuthAuthorizationEvidenceVerification>`
 
 Verifier-side AAuth authorization evidence checking. This runs outside the record signature path and does not fetch AAuth metadata, fetch JWKS, mint tokens, call a PS, call an AS, or perform user interaction. Callers supply a compact AAuth JWT plus trusted JWKS, caller-verified claims, or decoded claims under an explicit `signaturePolicy`.
@@ -396,6 +457,8 @@ For advanced use (custom calculators, alternative signing flows), the package al
 - `verifyAuthorizationEvidence(evidence)`: generic external authorization evidence dispatch for `verifyRecord()` evidence blocks
 - `verifyOAuthAuthorizationEvidence(evidence)`: OAuth / MCP authorization evidence checks for access-token JWTs or caller-verified claims
 - `verifyAAuthAuthorizationEvidence(evidence)`: AAuth authorization evidence checks for agent, resource, and auth tokens plus caller-verified HTTP signature facts
+- `verifyX401AuthorizationEvidence(evidence)`: x401 proof evidence checks for proof request, proof response, proof result, and caller-verified proof outcomes
+- `encodeX401HeaderObject(value)` / `decodeX401HeaderObject(value)`: base64url JSON helpers for x401 proof headers
 - `introspectOAuthToken(options)`: host-owned OAuth token introspection helper for opaque-token evidence
 - `oauthEvidenceFromIntrospectionResult(result, base?)`: adapter from host-owned introspection result to OAuth evidence input
 - `createFetchDpopReplayCache(options)`: HTTP-backed DPoP replay-cache adapter for fleet-shared replay checks
@@ -428,7 +491,7 @@ The merchant's payment pipeline never crashes because of an atrib problem. It ju
 
 ## Test coverage
 
-The test suite covers the [§4.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#46-the-calculation-algorithm) calculation algorithm, graph endpoint client, JCS canonicalization, Ed25519 signing, settlement recommendations, policy templates, policy builder, calculation edge cases, property-based testing with fast-check, AP2 / VI evidence checking, AP2 / VI crypto conformance, tiered AP2 / VI verifier attachment, and full `verify()` / `calculate()` paths including [§5.8](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#58-degradation-contract) degradation.
+The test suite covers the [§4.6](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#46-the-calculation-algorithm) calculation algorithm, graph endpoint client, JCS canonicalization, Ed25519 signing, settlement recommendations, policy templates, policy builder, calculation edge cases, property-based testing with fast-check, AP2 / VI evidence checking, AP2 / VI crypto conformance, x401 proof evidence checking, x401 authorization evidence conformance, tiered AP2 / VI verifier attachment, and full `verify()` / `calculate()` paths including [§5.8](https://github.com/creatornader/atrib/blob/main/atrib-spec.md#58-degradation-contract) degradation.
 
 Run them with `pnpm --filter @atrib/verify test`.
 
@@ -457,3 +520,7 @@ The full protocol spec is at [`atrib-spec.md`](https://github.com/creatornader/a
 ---
 
 > **A note on documentation links.** The atrib protocol repository is currently private (in-progress public preparation). Links in this README to the spec and sister packages (`atrib-spec.md`, `packages/agent/README.md`, etc.) point at `github.com/creatornader/atrib/blob/main/...` URLs that will resolve once the repository goes public. Until then, see [`atrib.dev`](https://atrib.dev) for the protocol overview.
+
+## Part of atrib
+
+atrib is an open protocol for verifiable agent actions. Every action becomes a signed, chain-linked record that anyone can verify against a public Merkle log, with no operator to trust. This package is one entrypoint. See the [full package family](https://github.com/creatornader/atrib#packages) and the [protocol spec](https://github.com/creatornader/atrib/blob/main/atrib-spec.md).

package/dist/anchor-plurality.d.ts

@@ -0,0 +1,142 @@
+/** §2.11.10 domain-separation prefix for the anchoring-claim artifact. */
+export declare const ANCHOR_CLAIM_PREFIX = "atrib-anchor/v1:";
+/** Registered non-atrib-log anchor types per the §2.11.8 v1 registry. */
+export declare const REGISTERED_NON_LOG_ANCHOR_TYPES: ReadonlySet<string>;
+/**
+ * One `log_proofs` element. Legacy elements (absent `anchor_type`) carry
+ * the atrib-log triple; discriminated elements carry `anchor_id` + `proof`.
+ * The corpus additionally carries `log_index` and `entry_bytes_b64` on
+ * atrib-log elements so the inclusion proof and the §2.11.4 step-4 leaf
+ * comparison are independently checkable.
+ */
+export interface AnchorProofElement {
+    anchor_type?: string;
+    anchor_id?: string;
+    proof?: Record<string, unknown>;
+    log_id?: string;
+    log_index?: number;
+    checkpoint?: string;
+    inclusion_proof?: string[];
+    entry_bytes_b64?: string;
+}
+/** A proof bundle whose `log_proofs` array is the wire shape for all anchors. */
+export interface AnchorProofBundle {
+    record_hash: string;
+    log_proofs: AnchorProofElement[];
+}
+/** Trust material for one log-shaped anchor (atrib log or Rekor instance). */
+export interface AnchorTrustEntry {
+    /** §2.4 origin string the checkpoint's first line must match. */
+    origin: string;
+    /** The anchor service's Ed25519 public key, standard base64. */
+    pubkey_b64: string;
+}
+/** Declared operator grouping for independence counting (§2.11.11). */
+export interface AnchorOperatorGroup {
+    group: string;
+    members: Array<{
+        anchor_type: string;
+        anchor_id: string;
+    }>;
+}
+/**
+ * Verifier trust configuration. `trust_material` maps anchor identities to
+ * their published keys; `trusted_logs` and `threshold_m` drive the
+ * unchanged §2.11.4 hard conditions; `required_anchors` (default 2) drives
+ * the §2.11.11 `plurality_met` tier; `operator_groups` declares operator
+ * identity for independence counting (default: one group per distinct
+ * `(anchor_type, anchor_id)` pair).
+ */
+export interface AnchorTrustConfig {
+    trust_material: {
+        logs: Record<string, AnchorTrustEntry>;
+        rekor?: Record<string, AnchorTrustEntry>;
+    };
+    trusted_logs?: string[];
+    threshold_m?: number;
+    required_anchors?: number;
+    operator_groups?: AnchorOperatorGroup[];
+}
+/**
+ * A "record not found" response from a trusted log inside the bundle's
+ * epoch window — the censorship-shaped equivocation input of §2.11.4.
+ */
+export interface AnchorNotFoundResponse {
+    log_id: string;
+    status: string;
+    epoch_window_ms: [number, number];
+}
+/** The §2.11.11 `anchor_plurality` annotation, exact field set. */
+export interface AnchorPluralityAnnotation {
+    proof_count: number;
+    verified_count: number;
+    pending_count: number;
+    malformed_count: number;
+    unknown_types: string[];
+    independent_count: number;
+    plurality_met: boolean;
+    single_anchor: boolean;
+    equivocation_detected: boolean;
+    anchored_at_range_ms: [number, number] | null;
+}
+/** The disagreeing pair surfaced on §2.11.4 equivocation detection. */
+export interface AnchorDisagreeingPair {
+    log_id_a: string;
+    leaf_hash_a_hex: string;
+    log_id_b: string;
+    leaf_hash_b_hex: string;
+}
+/**
+ * Full verifier verdict: the `anchor_plurality` annotation plus the
+ * unchanged §2.11.4 hard-condition facts. `hard_reject` is true only for
+ * the §2.11.4 conditions; `single_anchor` is a tier, never a failure.
+ */
+export interface AnchorPluralityVerdict {
+    anchor_plurality: AnchorPluralityAnnotation;
+    malformed_indices: number[];
+    invalid_indices: number[];
+    trusted_verified_count: number;
+    cross_log_threshold_not_met: boolean;
+    cross_log_equivocation_detected: boolean;
+    cross_log_censorship_suspected: boolean;
+    silent_log: string | null;
+    untrusted_surfaced: string[];
+    disagreeing_pair: AnchorDisagreeingPair | null;
+    hard_reject: boolean;
+}
+/** Per-element verification status. */
+export type AnchorElementStatus = 'verified' | 'pending' | 'invalid' | 'malformed' | 'unknown';
+/** Per-element verification result (exported for unit-level assertions). */
+export interface AnchorElementResult {
+    status: AnchorElementStatus;
+    anchorType: string;
+    anchorId: string;
+    attestedTimeMs: number | null;
+    /** Committed entry bytes (atrib-log elements only), for §2.11.4 step 4. */
+    entryBytesB64: string | null;
+}
+/**
+ * Verify one `log_proofs` element against the bundle's `record_hash` and
+ * the caller's trust material. Pure: no network, no clock, no randomness.
+ * Never throws; unexpected failures surface as `invalid` (§5.8).
+ */
+export declare function verifyAnchorProofElement(el: AnchorProofElement, recordHash: string, trust: AnchorTrustConfig): Promise<AnchorElementResult>;
+/**
+ * Operator-group key for independence counting (§2.11.11): the declared
+ * group when the trust config names one, else one group per distinct
+ * `(anchor_type, anchor_id)` pair (the default grouping).
+ */
+export declare function anchorOperatorGroup(anchorType: string, anchorId: string, trust: AnchorTrustConfig): string;
+/**
+ * Compute the `anchor_plurality` annotation and the unchanged §2.11.4 hard
+ * conditions for a proof bundle. Deterministic: identical bundle + trust
+ * config + not-found responses in, identical verdict out. Never throws;
+ * a structurally hopeless bundle degrades to zero counts (§5.8).
+ *
+ * `single_anchor: true` is a TIER: the record stays valid, `hard_reject`
+ * stays false. Hard rejection is reserved for `cross_log_threshold_not_met`
+ * and `cross_log_equivocation_detected`; `cross_log_censorship_suspected`
+ * is a flag, not a rejection.
+ */
+export declare function verifyAnchorPlurality(bundle: AnchorProofBundle, trust: AnchorTrustConfig, notFoundResponses?: AnchorNotFoundResponse[]): Promise<AnchorPluralityVerdict>;
+//# sourceMappingURL=anchor-plurality.d.ts.map

package/dist/anchor-plurality.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-plurality.d.ts","sourceRoot":"","sources":["../src/anchor-plurality.ts"],"names":[],"mappings":"AAiEA,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,qBAAqB,CAAA;AAErD,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,EAAE,WAAW,CAAC,MAAM,CAI9D,CAAA;AAIF;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,kBAAkB,EAAE,CAAA;CACjC;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE;QACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;QACtC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;KACzC,CAAA;IACD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAA;CACxC;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAClC;AAID,mEAAmE;AACnE,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,OAAO,CAAA;IACtB,aAAa,EAAE,OAAO,CAAA;IACtB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;CAC9C;AAED,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,sBAAsB,EAAE,MAAM,CAAA;IAC9B,2BAA2B,EAAE,OAAO,CAAA;IACpC,+BAA+B,EAAE,OAAO,CAAA;IACxC,8BAA8B,EAAE,OAAO,CAAA;IACvC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,gBAAgB,EAAE,qBAAqB,GAAG,IAAI,CAAA;IAC9C,WAAW,EAAE,OAAO,CAAA;CACrB;AAED,uCAAuC;AACvC,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;AAE9F,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAuFD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,kBAAkB,EACtB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAiB9B;AAoND;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,iBAAiB,GACvB,MAAM,CAOR;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,iBAAiB,EACxB,iBAAiB,GAAE,sBAAsB,EAAO,GAC/C,OAAO,CAAC,sBAAsB,CAAC,CAmHjC"}