@motebit/crypto 1.1.0 → 1.2.0

package/dist/hardware-attestation.js

@@ -0,0 +1,400 @@
+/**
+ * Hardware attestation — verify that a motebit's Ed25519 identity key
+ * is bound to a hardware-backed ECDSA P-256 key held in a platform
+ * trust anchor (Apple Secure Enclave today; TPM / Play Integrity /
+ * DeviceCheck as future additive adapters).
+ *
+ * ## Why this exists
+ *
+ * Motebit's identity key is Ed25519, stored in the OS keyring on
+ * desktop and in equivalent app-sandboxed stores on mobile/web. That
+ * key is *software-custody*: the private bytes are readable by any
+ * process running as the user. The moat thesis — "accumulated trust
+ * that a third party can verify" — is categorically weaker without a
+ * hardware root. Hardware attestation bridges the gap without forcing
+ * a cryptosuite migration: a separate hardware-native keypair (Apple
+ * Secure Enclave generates ECDSA P-256) signs a canonical claim that
+ * binds itself to the Ed25519 identity. The identity stays where it
+ * is; the hardware signature is *additional* evidence a verifier can
+ * rank against.
+ *
+ * Same shape as FIDO / WebAuthn attestation — the platform root key
+ * is distinct from the user-facing identity, and one attests the
+ * other.
+ *
+ * ## Receipt format (`platform: "secure_enclave"`)
+ *
+ *   attestation_receipt = base64url(canonical_body_json) + "." +
+ *                         base64url(ecdsa_p256_signature_der)
+ *
+ *   canonical_body_json = JCS-canonicalized JSON of:
+ *     {
+ *       version: "1",
+ *       algorithm: "ecdsa-p256-sha256",
+ *       motebit_id: string,
+ *       device_id: string,
+ *       identity_public_key: Ed25519 hex lowercase,
+ *       se_public_key: P-256 compressed-point hex lowercase,
+ *       attested_at: unix ms,
+ *     }
+ *
+ * The P-256 signature is over `SHA-256(canonical_body_json)` — standard
+ * ECDSA-on-SHA256. The verifier recovers the SE public key from
+ * `body.se_public_key` (self-contained; zero relay contact), verifies
+ * the signature, then checks that `body.identity_public_key` equals the
+ * Ed25519 key the credential subject is claimed for.
+ *
+ * ## Non-goals in v1
+ *
+ *   - Other platforms (TPM / DeviceCheck / Play Integrity) — each
+ *     returns `valid: false` + a named-missing-adapter error. Additive
+ *     platform adapters plug in behind the same result shape.
+ *   - Revocation — claims expire with their parent credential's
+ *     expiry. No separate revocation channel.
+ *   - Chain-of-trust verification — the SE public key is the
+ *     self-asserted root in v1. Future platform adapters verify the
+ *     platform's own attestation chain (Apple's root CA, Google's
+ *     verified-boot chain, etc.) as glucose per the metabolic
+ *     principle.
+ *
+ * Permissive floor (Apache-2.0), no I/O, deterministic. Safe to run in any
+ * environment that can parse UTF-8 JSON.
+ */
+import { canonicalJson, fromBase64Url } from "./signing.js";
+import { verifyP256EcdsaSha256 } from "./suite-dispatch.js";
+/**
+ * Verify a hardware-attestation claim.
+ *
+ * - `claim` — the `HardwareAttestationClaim` taken from a credential's
+ *   `credentialSubject.hardware_attestation`.
+ * - `expectedIdentityPublicKeyHex` — the Ed25519 public key (hex) the
+ *   verifier believes owns the credential. Comes from the credential
+ *   issuance path (typically the subject's DID pubkey).
+ * - `verifiers` — optional injection of platform-specific verifiers for
+ *   claims other than `secure_enclave`. Consumers pass
+ *   `{ deviceCheck: deviceCheckVerifier(...) }` from
+ *   `@motebit/crypto-appattest` to enable App Attest verification. When
+ *   a claim's platform has no verifier wired, the dispatcher returns a
+ *   stub `valid: false, errors: [{message:"adapter not yet shipped"}]`
+ *   so verification remains fail-closed by default.
+ * - `deviceCheckContext` — VC-subject fields (motebit_id / device_id /
+ *   attested_at) lifted from the credential subject; threaded to the
+ *   injected `deviceCheck` verifier so it can re-derive the JCS body
+ *   Apple signed over. Ignored for every other platform.
+ *
+ * Zero throws — every failure lands as `valid: false` with a structured
+ * reason so callers can render consistent audit output. The
+ * secure_enclave path remains synchronous; device_check (and any other
+ * injected adapter) may return a Promise, so callers that dispatch
+ * through the `verify()` entrypoint get `await`ed results.
+ */
+export function verifyHardwareAttestationClaim(claim, expectedIdentityPublicKeyHex, verifiers, deviceCheckContext) {
+    const platform = claim.platform;
+    const errors = [];
+    switch (platform) {
+        case "secure_enclave":
+            return verifySecureEnclaveClaim(claim, expectedIdentityPublicKeyHex);
+        case "software":
+            // Truthful "this key is not hardware-backed" claim — valid in
+            // the sense of "no deception," but offers no hardware signal. The
+            // semiring scores it as `0.1` (see `@motebit/semiring`). Report
+            // as `valid: false` for the hardware-verification channel: the
+            // claim doesn't prove hardware, and the caller should score it
+            // via the semiring, not treat it as attested.
+            errors.push({
+                message: "platform `software` is a no-hardware sentinel; no verification channel",
+            });
+            return { valid: false, platform: "software", errors };
+        case "device_check":
+            if (verifiers?.deviceCheck) {
+                return dispatchInjected(platform, verifiers.deviceCheck(claim, expectedIdentityPublicKeyHex, deviceCheckContext));
+            }
+            errors.push({
+                message: `platform \`${platform}\` verifier not wired — pass { deviceCheck: deviceCheckVerifier(...) } from @motebit/crypto-appattest to enable`,
+            });
+            return { valid: false, platform, errors };
+        case "tpm":
+            if (verifiers?.tpm) {
+                return dispatchInjected(platform, verifiers.tpm(claim, expectedIdentityPublicKeyHex, deviceCheckContext));
+            }
+            errors.push({
+                message: `platform \`${platform}\` verifier not wired — pass { tpm: ... } via the verifiers parameter to enable`,
+            });
+            return { valid: false, platform, errors };
+        case "play_integrity":
+            if (verifiers?.playIntegrity) {
+                return dispatchInjected(platform, verifiers.playIntegrity(claim, expectedIdentityPublicKeyHex, deviceCheckContext));
+            }
+            errors.push({
+                message: `platform \`${platform}\` verifier not wired — pass { playIntegrity: ... } via the verifiers parameter to enable`,
+            });
+            return { valid: false, platform, errors };
+        case "webauthn":
+            if (verifiers?.webauthn) {
+                return dispatchInjected(platform, verifiers.webauthn(claim, expectedIdentityPublicKeyHex, deviceCheckContext));
+            }
+            errors.push({
+                message: `platform \`${platform}\` verifier not wired — pass { webauthn: webauthnVerifier(...) } from @motebit/crypto-webauthn to enable`,
+            });
+            return { valid: false, platform, errors };
+        case "android_keystore":
+            if (verifiers?.androidKeystore) {
+                return dispatchInjected(platform, verifiers.androidKeystore(claim, expectedIdentityPublicKeyHex, deviceCheckContext));
+            }
+            errors.push({
+                message: `platform \`${platform}\` verifier not wired — pass { androidKeystore: androidKeystoreVerifier(...) } from @motebit/crypto-android-keystore to enable`,
+            });
+            return { valid: false, platform, errors };
+        default:
+            errors.push({
+                message: `unknown platform \`${claim.platform}\` — not in the declared enum`,
+            });
+            return { valid: false, platform: null, errors };
+    }
+}
+/**
+ * Normalize the injected verifier's return shape into the canonical
+ * `HardwareAttestationVerifyResult`. Injected leaves may return a
+ * richer shape (e.g. `@motebit/crypto-appattest`'s
+ * `DeviceCheckVerifyResult` carries `attestation_detail`); the
+ * canonical fields are lifted out here so the outer VC verify path
+ * always sees the same shape.
+ */
+async function dispatchInjected(platform, result) {
+    const awaited = await Promise.resolve(result);
+    return {
+        valid: awaited.valid,
+        platform,
+        errors: awaited.errors ?? [],
+    };
+}
+// ── Secure Enclave path ──────────────────────────────────────────────
+function verifySecureEnclaveClaim(claim, expectedIdentityPublicKeyHex) {
+    const errors = [];
+    const platform = "secure_enclave";
+    if (claim.key_exported === true) {
+        // An exported hardware key no longer uniquely holds the material;
+        // the signed receipt is historical evidence only. We still verify
+        // the signature — it's still meaningful — but the result's caller
+        // should score it with the lower semiring value (see
+        // `scoreAttestation` in @motebit/semiring: exported → 0.5). We do
+        // not short-circuit as invalid — that would conflate "key was
+        // exported" with "attestation fraudulent."
+    }
+    if (!claim.attestation_receipt) {
+        errors.push({
+            message: "secure_enclave claim missing `attestation_receipt`",
+        });
+        return { valid: false, platform, errors };
+    }
+    const parts = claim.attestation_receipt.split(".");
+    if (parts.length !== 2) {
+        errors.push({
+            message: `attestation_receipt must be 2 base64url parts separated by '.'; got ${parts.length}`,
+        });
+        return { valid: false, platform, errors };
+    }
+    const [bodyB64, sigB64] = parts;
+    let bodyBytes;
+    let sigBytes;
+    try {
+        bodyBytes = fromBase64Url(bodyB64);
+        sigBytes = fromBase64Url(sigB64);
+    }
+    catch (err) {
+        errors.push({
+            message: `base64url decode failed: ${err instanceof Error ? err.message : String(err)}`,
+        });
+        return { valid: false, platform, errors };
+    }
+    let bodyJson;
+    try {
+        bodyJson = JSON.parse(new TextDecoder().decode(bodyBytes));
+    }
+    catch (err) {
+        errors.push({
+            message: `body JSON parse failed: ${err instanceof Error ? err.message : String(err)}`,
+        });
+        return { valid: false, platform, errors };
+    }
+    const bodyCheck = parseSecureEnclaveBody(bodyJson);
+    if (bodyCheck.kind === "error") {
+        errors.push({ message: bodyCheck.reason });
+        return { valid: false, platform, errors };
+    }
+    const body = bodyCheck.body;
+    if (body.version !== "1") {
+        errors.push({
+            message: `unsupported body version '${body.version}' (expected '1')`,
+        });
+        return { valid: false, platform, errors };
+    }
+    if (body.algorithm !== "ecdsa-p256-sha256") {
+        errors.push({
+            message: `unsupported body algorithm '${body.algorithm}' (expected 'ecdsa-p256-sha256')`,
+        });
+        return { valid: false, platform, errors };
+    }
+    // Re-canonicalize the body and hash — the signed bytes are what the
+    // signer actually signed. The body we parsed is the source of truth
+    // for *fields*, but the signed bytes must match the on-wire body
+    // bytes exactly (JCS is deterministic, but the signer might have
+    // produced the body with trailing whitespace etc. — we verify
+    // against the as-received bytes, not our re-canonicalization).
+    let sigValid;
+    try {
+        sigValid = verifyP256EcdsaSha256(body.se_public_key, bodyBytes, sigBytes);
+    }
+    catch (err) {
+        errors.push({
+            message: `p-256 verification crashed: ${err instanceof Error ? err.message : String(err)}`,
+        });
+        return { valid: false, platform, errors };
+    }
+    if (!sigValid) {
+        errors.push({
+            message: "p-256 signature does not verify against body + se_public_key",
+        });
+        return { valid: false, platform, errors };
+    }
+    // Identity-key binding check — the attestation body names which
+    // Ed25519 key this hardware claim is for. The verifier has the
+    // expected key from the credential's issuance context.
+    if (body.identity_public_key.toLowerCase() !== expectedIdentityPublicKeyHex.toLowerCase()) {
+        errors.push({
+            message: `identity_public_key mismatch: body names ${body.identity_public_key.slice(0, 16)}…, expected ${expectedIdentityPublicKeyHex.slice(0, 16)}…`,
+        });
+        return { valid: false, platform, errors };
+    }
+    return {
+        valid: true,
+        platform,
+        se_public_key: body.se_public_key,
+        attested_at: body.attested_at,
+        errors: [],
+    };
+}
+function parseSecureEnclaveBody(raw) {
+    if (raw === null || typeof raw !== "object") {
+        return { kind: "error", reason: "body is not a JSON object" };
+    }
+    const r = raw;
+    const fields = [
+        "version",
+        "algorithm",
+        "motebit_id",
+        "device_id",
+        "identity_public_key",
+        "se_public_key",
+        "attested_at",
+    ];
+    for (const f of fields) {
+        if (!(f in r)) {
+            return { kind: "error", reason: `body missing required field '${f}'` };
+        }
+    }
+    if (typeof r.version !== "string" ||
+        typeof r.algorithm !== "string" ||
+        typeof r.motebit_id !== "string" ||
+        typeof r.device_id !== "string" ||
+        typeof r.identity_public_key !== "string" ||
+        typeof r.se_public_key !== "string" ||
+        typeof r.attested_at !== "number") {
+        return { kind: "error", reason: "body field types invalid" };
+    }
+    return {
+        kind: "ok",
+        body: {
+            version: r.version,
+            algorithm: r.algorithm,
+            motebit_id: r.motebit_id,
+            device_id: r.device_id,
+            identity_public_key: r.identity_public_key,
+            se_public_key: r.se_public_key,
+            attested_at: r.attested_at,
+        },
+    };
+}
+// ── Test helper — mint a valid SE receipt from an in-process P-256 key ─
+/**
+ * Test-only helper — encode a canonical body + signature into the
+ * receipt format. Tests that have a P-256 private key (via
+ * `@noble/curves/p256`) can call `signBytes` themselves, then hand the
+ * resulting body + signature to this helper to produce a well-formed
+ * receipt that `verifyHardwareAttestationClaim` will accept. Production
+ * callers MUST mint receipts via the Rust Secure Enclave bridge —
+ * never through this function.
+ */
+export function encodeSecureEnclaveReceiptForTest(bodyBytes, sigBytes) {
+    return `${toBase64Url(bodyBytes)}.${toBase64Url(sigBytes)}`;
+}
+/**
+ * Test-only helper — build a canonical body JSON's bytes. Use with
+ * `encodeSecureEnclaveReceiptForTest` to produce a full receipt for
+ * verification tests. Canonicalization matches what production would
+ * emit.
+ */
+export function canonicalSecureEnclaveBodyForTest(body) {
+    const full = {
+        version: "1",
+        algorithm: "ecdsa-p256-sha256",
+        ...body,
+    };
+    return new TextEncoder().encode(canonicalJson(full));
+}
+/**
+ * Test-only convenience — generate a fresh P-256 keypair, sign the
+ * canonical body bytes with it, and assemble a `HardwareAttestationClaim`
+ * that `verifyHardwareAttestationClaim` accepts. Lets cross-workspace
+ * tests exercise the SE verification path without each caller pulling
+ * `@noble/curves` into their own dep tree.
+ *
+ * Production callers MUST mint receipts via the Rust Secure Enclave
+ * bridge — never through this function.
+ */
+export async function mintSecureEnclaveReceiptForTest(input) {
+    // Lazy import — keeps this helper from being dragged into the
+    // production verifier's import graph any earlier than necessary.
+    const { p256 } = await import("@noble/curves/p256");
+    const privateKey = p256.utils.randomPrivateKey();
+    const sePublicKey = p256.getPublicKey(privateKey, true); // compressed
+    const sePublicKeyHex = bytesToHexLocal(sePublicKey);
+    const bodyBytes = canonicalSecureEnclaveBodyForTest({
+        motebit_id: input.motebit_id,
+        device_id: input.device_id,
+        identity_public_key: input.identity_public_key,
+        se_public_key: sePublicKeyHex,
+        attested_at: input.attested_at,
+    });
+    const digest = await sha256Local(bodyBytes);
+    const sigBytes = p256.sign(digest, privateKey, { prehash: false }).toDERRawBytes();
+    const receipt = encodeSecureEnclaveReceiptForTest(bodyBytes, sigBytes);
+    return {
+        claim: {
+            platform: "secure_enclave",
+            key_exported: false,
+            attestation_receipt: receipt,
+        },
+        sePublicKeyHex,
+    };
+}
+function bytesToHexLocal(bytes) {
+    let hex = "";
+    for (let i = 0; i < bytes.length; i++) {
+        hex += bytes[i].toString(16).padStart(2, "0");
+    }
+    return hex;
+}
+async function sha256Local(bytes) {
+    const buf = await crypto.subtle.digest("SHA-256", bytes);
+    return new Uint8Array(buf);
+}
+function toBase64Url(bytes) {
+    // Match the conventions in signing.ts — base64url, no padding.
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+//# sourceMappingURL=hardware-attestation.js.map

package/dist/hardware-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardware-attestation.js","sourceRoot":"","sources":["../src/hardware-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAIH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAkK5D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAA+B,EAC/B,4BAAoC,EACpC,SAAwC,EACxC,kBAA+C;IAE/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,MAAM,MAAM,GAA+B,EAAE,CAAC;IAE9C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,gBAAgB;YACnB,OAAO,wBAAwB,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;QACvE,KAAK,UAAU;YACb,8DAA8D;YAC9D,kEAAkE;YAClE,gEAAgE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,8CAA8C;YAC9C,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,wEAAwE;aAClF,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxD,KAAK,cAAc;YACjB,IAAI,SAAS,EAAE,WAAW,EAAE,CAAC;gBAC3B,OAAO,gBAAgB,CACrB,QAAQ,EACR,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,4BAA4B,EAAE,kBAAkB,CAAC,CAC/E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,cAAc,QAAQ,iHAAiH;aACjJ,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC5C,KAAK,KAAK;YACR,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC;gBACnB,OAAO,gBAAgB,CACrB,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,4BAA4B,EAAE,kBAAkB,CAAC,CACvE,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,cAAc,QAAQ,iFAAiF;aACjH,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC5C,KAAK,gBAAgB;YACnB,IAAI,SAAS,EAAE,aAAa,EAAE,CAAC;gBAC7B,OAAO,gBAAgB,CACrB,QAAQ,EACR,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,4BAA4B,EAAE,kBAAkB,CAAC,CACjF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,cAAc,QAAQ,2FAA2F;aAC3H,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC5C,KAAK,UAAU;YACb,IAAI,SAAS,EAAE,QAAQ,EAAE,CAAC;gBACxB,OAAO,gBAAgB,CACrB,QAAQ,EACR,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,4BAA4B,EAAE,kBAAkB,CAAC,CAC5E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,cAAc,QAAQ,0GAA0G;aAC1I,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC5C,KAAK,kBAAkB;YACrB,IAAI,SAAS,EAAE,eAAe,EAAE,CAAC;gBAC/B,OAAO,gBAAgB,CACrB,QAAQ,EACR,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,4BAA4B,EAAE,kBAAkB,CAAC,CACnF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,cAAc,QAAQ,gIAAgI;aAChK,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC5C;YACE,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,sBAAsB,KAAK,CAAC,QAAQ,+BAA+B;aAC7E,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAA6B,EAC7B,MAOM;IAEN,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,SAAS,wBAAwB,CAC/B,KAA+B,EAC/B,4BAAoC;IAEpC,MAAM,MAAM,GAA+B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAwB,gBAAgB,CAAC;IAEvD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAChC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,qDAAqD;QACrD,kEAAkE;QAClE,8DAA8D;QAC9D,2CAA2C;IAC7C,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,uEAAuE,KAAK,CAAC,MAAM,EAAE;SAC/F,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,KAAyB,CAAC;IAEpD,IAAI,SAAqB,CAAC;IAC1B,IAAI,QAAoB,CAAC;IACzB,IAAI,CAAC;QACH,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACnC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACxF,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAY,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACvF,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAE5B,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,6BAA6B,IAAI,CAAC,OAAO,kBAAkB;SACrE,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,mBAAmB,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,+BAA+B,IAAI,CAAC,SAAS,kCAAkC;SACzF,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,iEAAiE;IACjE,iEAAiE;IACjE,8DAA8D;IAC9D,+DAA+D;IAC/D,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3F,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,8DAA8D;SACxE,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,gEAAgE;IAChE,+DAA+D;IAC/D,uDAAuD;IACvD,IAAI,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,4BAA4B,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1F,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,4CAA4C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,4BAA4B,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;SACtJ,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,QAAQ;QACR,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAID,SAAS,sBAAsB,CAAC,GAAY;IAC1C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,MAAM,GAAmC;QAC7C,SAAS;QACT,WAAW;QACX,YAAY;QACZ,WAAW;QACX,qBAAqB;QACrB,eAAe;QACf,aAAa;KACd,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,CAAC,GAAG,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,mBAAmB,KAAK,QAAQ;QACzC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,IAAI,EAAE;YACJ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;YAC1C,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAE1E;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,SAAqB,EACrB,QAAoB;IAEpB,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAAC,IAMjD;IACC,MAAM,IAAI,GAAsB;QAC9B,OAAO,EAAE,GAAG;QACZ,SAAS,EAAE,mBAAmB;QAC9B,GAAG,IAAI;KACR,CAAC;IACF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAKrD;IACC,8DAA8D;IAC9D,iEAAiE;IACjE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa;IACtE,MAAM,cAAc,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,iCAAiC,CAAC;QAClD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,aAAa,EAAE,cAAc;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACnF,MAAM,OAAO,GAAG,iCAAiC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvE,OAAO;QACL,KAAK,EAAE;YACL,QAAQ,EAAE,gBAAgB;YAC1B,YAAY,EAAE,KAAK;YACnB,mBAAmB,EAAE,OAAO;SAC7B;QACD,cAAc;KACf,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAiB;IAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAqB,CAAC,CAAC;IACzE,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,+DAA+D;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/index.d.ts

@@ -107,6 +107,8 @@ export interface ExecutionReceipt {
 }
 export type { DataIntegrityProof, VerifiableCredential, VerifiablePresentation, } from "./credentials.js";
 import type { VerifiableCredential, VerifiablePresentation } from "./credentials.js";
+import type { SkillEnvelope } from "@motebit/protocol";
+import type { SkillVerifyReason } from "./skills.js";
 export { verifyHardwareAttestationClaim, canonicalSecureEnclaveBodyForTest, encodeSecureEnclaveReceiptForTest, mintSecureEnclaveReceiptForTest, } from "./hardware-attestation.js";
 export type { AttestationPlatform, HardwareAttestationError, HardwareAttestationVerifyResult, HardwareAttestationVerifiers, DeviceCheckVerifierContext, } from "./hardware-attestation.js";
 import type { HardwareAttestationVerifiers, HardwareAttestationVerifyResult } from "./hardware-attestation.js";
@@ -158,7 +160,68 @@ export interface PresentationVerifyResult extends BaseResult {
     holder?: string;
     credentials?: CredentialVerifyResult[];
 }
-export type VerifyResult = IdentityVerifyResult | ReceiptVerifyResult | CredentialVerifyResult | PresentationVerifyResult;
+/**
+ * Per-file verification outcome inside a `SkillVerifyResult`. Each entry
+ * cross-checks `envelope.files[].hash` against `sha256(<file bytes>)`.
+ * `actual === null` means the verifier had no on-disk bytes to compare —
+ * either the bundle didn't ship the file or a directory walker couldn't
+ * locate it. Distinct shape from envelope-signature failure: a missing
+ * file is an unverifiable claim, not a forged one.
+ */
+export interface SkillFileVerifyResult {
+    readonly path: string;
+    readonly valid: boolean;
+    readonly expected: string;
+    readonly actual: string | null;
+    /** `"ok" | "hash_mismatch" | "missing"`. */
+    readonly reason: "ok" | "hash_mismatch" | "missing";
+}
+/**
+ * Verification outcome for a `SkillEnvelope` (per `spec/skills-v1.md` §5)
+ * with optional on-disk body + file cross-checks.
+ *
+ * Three independent verification axes:
+ *   - `steps.envelope` — Ed25519 signature over canonical envelope bytes.
+ *     Always populated; the primitive lives in this package.
+ *   - `steps.body_hash` — `sha256(LF-normalized SKILL.md bytes)` cross-
+ *     checked against `envelope.body_hash`. Populated by callers that
+ *     read the body from disk (the `@motebit/verifier` directory walker
+ *     does this); `null` when this layer was called with bare envelope
+ *     JSON and had no body bytes to compare.
+ *   - `steps.files` — per-file `sha256` cross-checks. Empty array when
+ *     no file bytes were provided to compare; otherwise one entry per
+ *     `envelope.files[]` declaration.
+ *
+ * `valid` reflects "every attempted axis passed AND every declared
+ * cross-check was attempted." Calling crypto's `verify(envelope)`
+ * directly returns `valid: false` with `body_hash: null` and `files:
+ * []` because the bare envelope can only be sig-verified — full
+ * verification requires the on-disk bytes. The
+ * `@motebit/verifier::verifySkillDirectory` library completes the
+ * other two axes; that's the canonical full-verify entry point for
+ * skills.
+ */
+export interface SkillVerifyResult extends BaseResult {
+    type: "skill";
+    envelope: SkillEnvelope | null;
+    /** Compact identifier — `<name>@<version>` from `envelope.skill`. */
+    skill?: string;
+    /** Echoed from `envelope.signature.public_key`. */
+    signer?: string;
+    steps: {
+        envelope: {
+            valid: boolean;
+            reason: SkillVerifyReason;
+        };
+        body_hash: {
+            valid: boolean;
+            expected: string;
+            actual: string;
+        } | null;
+        files: ReadonlyArray<SkillFileVerifyResult>;
+    };
+}
+export type VerifyResult = IdentityVerifyResult | ReceiptVerifyResult | CredentialVerifyResult | PresentationVerifyResult | SkillVerifyResult;
 export type ArtifactType = VerifyResult["type"];
 export interface VerifyOptions {
     expectedType?: ArtifactType;
@@ -205,6 +268,58 @@ export declare function parse(content: string): {
     signature: string;
     rawFrontmatter: string;
 };
+/**
+ * Bundle-shape input for `verifySkillBundle`. The full-verify
+ * primitive — envelope signature + body hash + per-file hashes — runs
+ * pure on these bytes, no I/O, no environment-specific shape.
+ *
+ * Body bytes are LF-normalized SKILL.md content (the exact bytes the
+ * envelope's `body_hash` was computed over at sign time). Files map
+ * each path declared in `envelope.files[]` to its raw bytes. Callers
+ * with base64-encoded inputs (relay-served `SkillRegistryBundle`,
+ * tarball decoders) decode to `Uint8Array` before calling.
+ *
+ * Single canonical primitive across surfaces:
+ *   - `motebit-verify` CLI / `@motebit/verifier::verifySkillDirectory`
+ *     reads from disk → builds this shape → calls `verifySkillBundle`.
+ *   - Browser consumers (`motebit.com/skills`, third-party registries,
+ *     CI pipelines) decode from base64 → builds this shape → calls
+ *     `verifySkillBundle`.
+ *
+ * Both paths produce the same `SkillVerifyResult` with the same step
+ * semantics. Same primitive, swap the I/O.
+ */
+export interface SkillBundleInput {
+    readonly envelope: SkillEnvelope;
+    /** LF-normalized SKILL.md body bytes — the exact bytes signed at envelope-sign time. */
+    readonly body: Uint8Array;
+    /** Per-path raw bytes for every entry in `envelope.files[]`. Omit a path to mark it missing. */
+    readonly files?: Readonly<Record<string, Uint8Array>>;
+}
+/**
+ * Verify a skill bundle end-to-end. Pure function — no I/O. Performs
+ * the three independent verification axes:
+ *
+ *   1. Envelope signature — Ed25519 over the canonical envelope bytes.
+ *   2. Body hash — `sha256(body)` cross-checked against `envelope.body_hash`.
+ *   3. Per-file hashes — for each entry in `envelope.files[]`,
+ *      `sha256(files[path])` cross-checked against `entry.hash`. A
+ *      missing path (envelope declared it; bundle didn't ship bytes)
+ *      surfaces as `valid: false` with `reason: "missing"`.
+ *
+ * `valid: true` iff every axis passed AND every declared file was
+ * provided. The detailed step shape lets callers render per-axis
+ * outcomes — the canonical doctrine is "every routing-input claim
+ * MUST be visible to the user", and the same applies to verification:
+ * a one-bit valid/invalid throws away which axis failed.
+ *
+ * Faithful to `services/relay/CLAUDE.md` rule 6 ("relay is a
+ * convenience layer, not a trust root"): any consumer with a bundle
+ * — from any source, motebit-served or not — answers "is this signed
+ * AND do the bytes match what the publisher signed?" using only this
+ * primitive, no relay or runtime contact required.
+ */
+export declare function verifySkillBundle(input: SkillBundleInput): Promise<SkillVerifyResult>;
 /**
  * Verify any Motebit artifact: identity file, execution receipt,
  * verifiable credential, or verifiable presentation.
@@ -262,4 +377,8 @@ export * from "./signing.js";
 export * from "./artifacts.js";
 export { signVerifiableCredential, verifyVerifiableCredential, signVerifiablePresentation, verifyVerifiablePresentation, issueGradientCredential, issueReputationCredential, issueTrustCredential, createPresentation, type GradientCredentialSubject, type ReputationCredentialSubject, type TrustCredentialSubject, } from "./credentials.js";
 export { computeCredentialLeaf, verifyCredentialAnchor, verifyRevocationAnchor, type CredentialAnchorVerifyResult, type CredentialAnchorProofFields, type ChainAnchorVerifier, type RevocationAnchorVerifyResult, type RevocationAnchorProof, } from "./credential-anchor.js";
+export { SKILL_SIGNATURE_SUITE, canonicalizeSkillManifestBytes, canonicalizeSkillEnvelopeBytes, signSkillManifest, signSkillEnvelope, verifySkillManifest, verifySkillManifestDetailed, verifySkillEnvelope, verifySkillEnvelopeDetailed, decodeSkillSignaturePublicKey, type SkillVerifyReason, type SkillVerifyDetail, } from "./skills.js";
+export { DELETION_CERTIFICATE_SUITE, WITNESS_OMISSION_DISPUTE_WINDOW_MS, canonicalizeMultiSignatureCert, canonicalizeHorizonCert, canonicalizeHorizonCertForWitness, signCertAsSubject, signCertAsOperator, signCertAsDelegate, signCertAsGuardian, signHorizonCertAsIssuer, signHorizonWitness, canonicalizeHorizonWitnessRequestBody, signHorizonWitnessRequestBody, verifyHorizonWitnessRequestSignature, verifyDeletionCertificate, verifyRetentionManifest, type DeletionCertificateVerifyResult, type DeletionCertificateVerifyContext, type RetentionManifestVerifyResult, } from "./deletion-certificate.js";
+export { canonicalizeWitnessOmissionDispute, signWitnessOmissionDispute, verifyWitnessOmissionDispute, type WitnessOmissionDisputeVerifyResult, type WitnessOmissionDisputeVerifyContext, } from "./witness-omission-dispute.js";
+export { verifyMerkleInclusion } from "./merkle.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAYH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE;QACR,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,OAAO,EAAE;QACP,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IAEH,UAAU,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,4BAA4B,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EACV,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,2BAA2B,CAAC;AAMnC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CACxD;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACxC;AAED,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,sBAAsB,GACtB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;CACpD;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AA+TD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,CAgCA;AA0jBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAgE9F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASrF;AAOD,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAYH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE;QACR,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,OAAO,EAAE;QACP,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IAEH,UAAU,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,4BAA4B,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKrD,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EACV,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,2BAA2B,CAAC;AAMnC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CACxD;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,eAAe,GAAG,SAAS,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QACL,QAAQ,EAAE;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,iBAAiB,CAAA;SAAE,CAAC;QACxD,SAAS,EAAE;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QACvE,KAAK,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,sBAAsB,GACtB,wBAAwB,GACxB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;CACpD;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAqVD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,CAgCA;AA8aD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+F3F;AAgND;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAgG9F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASrF;AAOD,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,8BAA8B,EAC9B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,EAClC,8BAA8B,EAC9B,uBAAuB,EACvB,iCAAiC,EACjC,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,qCAAqC,EACrC,6BAA6B,EAC7B,oCAAoC,EACpC,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,+BAA+B,EACpC,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,0BAA0B,EAC1B,4BAA4B,EAC5B,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,GACzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}