@nexart/cli 0.12.2 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,88 @@
 # @nexart/cli — Changelog
 
+## v0.15.0 (2026-06-17) — `verify-record` (full CER record + timestamp verification)
+
+Additive feature. No breaking changes. `verify-bundle` is byte-for-byte unchanged.
+
+- **New:** `nexart verify-record <file>` verifies a **full CER record** — the
+  self-contained envelope `{ bundle, verification: { receipt, receiptSignature },
+  timestamp?: { token } }` a relying party receives — rather than a bare bundle. It
+  lifts `verification.receipt` / `verification.receiptSignature` onto the bundle and
+  runs the **same** integrity + signature checks as `verify-bundle`, reusing the
+  identical internal verifier (`standaloneVerify.ts`, `node:crypto`-only) — **no
+  duplicated cryptography**.
+- **Timestamp precedence:** a record-level `timestamp.token` is verified in
+  preference to any token embedded in the bundle (`trustedTimestamps[]` / singular
+  `timestamp`); when the record omits it, the embedded token is used.
+- **Strictly additive / non-negotiable invariants (identical to `verify-bundle`):**
+  the optional RFC 3161 timestamp layer never modifies `certificateHash`, is never
+  canonicalised, and **never affects the Integrity/Signature results or the process
+  exit code** — which remains `0` only when integrity passes and the signature is not
+  invalid, `1` otherwise. The ASN.1 stack (`pkijs` / `asn1js`) and the TSA module are
+  loaded **only** under `--verify-timestamp`. TSA operational errors (e.g. an
+  unreadable `--tsa-roots`) are mapped to a timestamp *status* and never crash or
+  change the exit code.
+- **Flags & output:** `--public-key`, `--kid`, `--json`, `--verbose`,
+  `--verify-timestamp`, `--tsa-roots` — all identical to `verify-bundle`, with the
+  same human-readable and `--json` shapes (shared render path).
+- **Tests:** added `record.test.ts` (7 cases) covering integrity pass/fail,
+  signature pass/skipped, the record-vs-bundle timestamp precedence, a verified
+  timestamp, and an operational TSA error leaving Integrity/exit-code untouched.
+- **Docs:** new README section *"Verifying a full CER record (`nexart
+  verify-record`)"*.
+
+## v0.14.0 (2026-06-17) — clearer `verify-bundle` timestamp output
+
+Product polish for the optional RFC 3161 timestamp verification shipped in v0.13.0.
+**Strictly additive and behaviour-preserving:** `certificateHash`, canonicalisation,
+the signature check, the Integrity/Signature results, and the process exit code are
+all byte-for-byte unchanged, and the ASN.1 stack (`pkijs`/`asn1js`) is still loaded
+**only** when `--verify-timestamp` is used.
+
+- **Clearer wording.** The timestamp line now reads `✔ Externally anchored
+  timestamp: valid` (and `invalid (…)` / `untrusted (unknown root)` / `present (not
+  verified)` / `not present`), making explicit that the check proves anchoring to an
+  *independent* time authority rather than an internal clock.
+- **New Timestamp Details block.** When a token is actually verified, the
+  human-readable output now adds a `Timestamp Details:` block showing the **Provider**,
+  the token's **Time** (`genTime`, sub-second precision stripped), and whether the
+  message **Imprint** matched the bundle's `certificateHash`. The block is suppressed
+  when no verification was attempted (flag absent, no token, or an operational error
+  such as an unreadable `--tsa-roots`), so it never reports a misleading imprint state.
+- **Tests:** added an imprint-mismatch case — a real TSA token minted over a
+  *different* digest — at both the verifier and CLI layers, asserting `invalid
+  (imprint mismatch)` while Integrity stays `PASS` and the exit code stays `0`.
+
+## v0.13.0 (2026-06-16) — optional RFC 3161 timestamp verification for `verify-bundle`
+
+Additive feature. No breaking changes. Existing `verify-bundle` behavior is
+byte-for-byte unchanged unless you opt in with `--verify-timestamp`.
+
+- **New:** `nexart verify-bundle --verify-timestamp [--tsa-roots <pem>]` performs
+  an **offline** RFC 3161 TimeStampToken verification when a bundle carries one
+  (in `trustedTimestamps[]` or a singular `timestamp`). It checks, in order: the
+  TSA's CMS signature over the embedded `TSTInfo`; that the token's message
+  imprint equals the bundle's `certificateHash` digest; that the TSA signing
+  certificate chains to a trusted root supplied via `--tsa-roots`; that the
+  certificate is valid at the timestamp; and that the timestamp is at or after
+  `createdAt`.
+- **Strictly additive / non-negotiable invariants:** the timestamp layer never
+  modifies `certificateHash`, is never included in canonicalisation, and **never
+  affects the Integrity or Signature results or the process exit code.** The exit
+  code remains a function of integrity + signature alone.
+- **Dependency-light by default:** the ASN.1 stack (`pkijs` / `asn1js`) is
+  dynamically imported **only** when `--verify-timestamp` is used. Ordinary
+  integrity/signature verification loads nothing new, and `standaloneVerify.ts`
+  remains `node:crypto`-only and auditable.
+- **Output:** a new line — `✔ Timestamp (RFC3161): VALID (<tsa>)`, or `INVALID
+  (signature | imprint mismatch | expired | time | malformed token)`, `UNTRUSTED
+  (unknown root)`, `PRESENT (not verified)` (token present, flag absent), or
+  `NOT PRESENT`. `--json` gains an additive, informational `timestamp` object.
+- **Tests:** cross-implementation interop fixtures (OpenSSL-produced token,
+  pkijs-based verifier) cover valid, tampered, wrong-imprint, missing/untrusted
+  root, expired, time-inconsistent, malformed, present-unverified, and not-present
+  cases, plus CLI integration asserting integrity/exit-code are untouched.
+
 ## v0.12.2 (2026-06-15) — bump core to `@nexart/ai-execution@^0.23.0`
 
 Dependency alignment. No command behavior changes, no breaking changes.

package/README.md

@@ -660,6 +660,9 @@ nexart verify-bundle cer.json --public-key node-keys.json --json
 
 # Show every intermediate step (canonical mode, byte counts, hashes)
 nexart verify-bundle cer.json --public-key node-keys.json --verbose
+
+# Additionally verify an embedded RFC 3161 timestamp against trusted TSA roots
+nexart verify-bundle cer.json --verify-timestamp --tsa-roots tsa-roots.pem
 ```
 
 ### What it checks
@@ -687,6 +690,22 @@ nexart verify-bundle cer.json --public-key node-keys.json --verbose
    If a signature is not present, integrity can still pass, but authenticity is
    not established.
 
+3. **Timestamp (RFC 3161)** *(optional, additive — `--verify-timestamp`)* — when
+   the bundle carries an RFC 3161 TimeStampToken (in `trustedTimestamps[]` or a
+   singular `timestamp`), this **offline** check confirms the token anchors the
+   bundle to a point in time. It verifies, in order: (1) the TSA's CMS signature
+   over the embedded `TSTInfo`; (2) that the token's message imprint equals the
+   bundle's `certificateHash` digest; (3) that the TSA signing certificate chains
+   to a root supplied via `--tsa-roots`; (4) that the certificate is valid at the
+   timestamp; and (5) that the timestamp is at or after the bundle's `createdAt`.
+
+   This layer is **strictly additive**: it never modifies `certificateHash`, is
+   never included in canonicalisation, and **never affects the Integrity or
+   Signature results or the exit code**. The ASN.1 stack (`pkijs`) is loaded
+   **only** when `--verify-timestamp` is passed — ordinary verification stays
+   dependency-light. Without the flag, an existing timestamp is reported as
+   `present (not verified)`; with no timestamp at all, `not present`.
+
 ### Output
 
 Human-readable (default):
@@ -695,6 +714,32 @@ Human-readable (default):
 ✔ Integrity: PASS
 ✔ Signature: PASS
 Protocol: 1.3.0
+✔ Externally anchored timestamp: valid
+
+Timestamp Details:
+  Provider: freeTSA
+  Time: 2026-06-17T10:52:12Z
+  Imprint: match
+```
+
+The phrasing — **"externally anchored timestamp"** — reflects that the check
+proves the bundle was anchored to an *independent* time authority, not an internal
+clock. When a token was actually verified, a **Timestamp Details** block follows
+with the provider, the token's `genTime` (sub-second precision stripped), and
+whether the message imprint matched the bundle's `certificateHash`.
+
+The status line is one of:
+
+```
+✔ Externally anchored timestamp: valid
+✖ Externally anchored timestamp: invalid (signature)
+✖ Externally anchored timestamp: invalid (imprint mismatch)
+✖ Externally anchored timestamp: untrusted (unknown root)
+✖ Externally anchored timestamp: invalid (expired)
+✖ Externally anchored timestamp: invalid (time)
+✖ Externally anchored timestamp: invalid (malformed token)
+○ Externally anchored timestamp: present (not verified)   # token present, flag absent
+○ Externally anchored timestamp: not present              # no token in the bundle
 ```
 
 Machine-readable (`--json`):
@@ -704,13 +749,15 @@ Machine-readable (`--json`):
   "status": "verified",
   "integrity": "pass",
   "signature": "pass",
-  "protocolVersion": "1.3.0"
+  "protocolVersion": "1.3.0",
+  "timestamp": { "status": "valid", "tsa": "freeTSA", "genTime": "2026-06-17T10:52:12.000Z" }
 }
 ```
 
 `status` is `verified` when integrity passes and the signature is not invalid
-(`pass` or `skipped`); otherwise it is `failed`. The process exits `0` when
-verified and `1` otherwise, so it is safe to use in CI.
+(`pass` or `skipped`); otherwise it is `failed`. The `timestamp` field is always
+present and purely informational — **it never changes `status` or the exit code.**
+The process exits `0` when verified and `1` otherwise, so it is safe to use in CI.
 
 **Options:**
 | Flag | Default | Description |
@@ -719,6 +766,8 @@ verified and `1` otherwise, so it is safe to use in CI.
 | `--kid` | — | Key id to select when `--public-key` is a `NodeKeysDocument`. Strict — if the requested kid is absent, the signature **fails closed** (no fallback to another key) |
 | `--json` | `false` | Emit a machine-readable result |
 | `--verbose` | `false` | Print intermediate verification steps |
+| `--verify-timestamp` | `false` | Additionally verify an embedded RFC 3161 timestamp (offline; never affects the exit code) |
+| `--tsa-roots` | — | Path to trusted TSA root certificate(s) (PEM) used by `--verify-timestamp`. Without trusted roots, a present token reports `UNTRUSTED` |
 
 > **Note on the command name.** This command is named `verify-bundle` rather than
 > `verify` because `nexart verify <snapshot>` already exists for Code Mode
@@ -731,6 +780,56 @@ verified and `1` otherwise, so it is safe to use in CI.
 
 ---
 
+## Verifying a full CER record (`nexart verify-record`)
+
+`nexart verify-record` verifies a **full CER record** — the self-contained
+envelope a relying party receives — rather than a bare bundle. A record bundles
+the evidentiary payload together with its signed node attestation receipt and an
+optional externally anchored timestamp:
+
+```jsonc
+{
+  "bundle": { /* the cer.ai.execution.v1 bundle */ },
+  "verification": {
+    "receipt": { /* signed node attestation receipt */ },
+    "receiptSignature": "base64url-ed25519-signature"
+  },
+  "timestamp": { "token": "base64-rfc3161-timestamptoken" }  // optional
+}
+```
+
+**How it differs from `verify-bundle`.** `verify-bundle` takes a bundle whose
+receipt and signature are already embedded inside it. `verify-record` accepts the
+record envelope above, lifts `verification.receipt` / `verification.receiptSignature`
+onto the bundle, and then runs the **exact same** integrity + signature checks as
+`verify-bundle` (it reuses the identical internal verifier — no duplicated crypto).
+The record-level `timestamp.token` takes precedence over any token embedded in the
+bundle; if the record omits it, an embedded `trustedTimestamps[]` / `timestamp` is
+used instead. Everything else — flags, output, exit-code semantics — is identical
+to `verify-bundle`.
+
+```bash
+# Integrity + signature of a full record (offline)
+nexart verify-record record.json --public-key node-keys.json
+
+# Machine-readable output
+nexart verify-record record.json --public-key node-keys.json --json
+
+# Additionally verify the record's RFC 3161 timestamp against trusted TSA roots
+nexart verify-record record.json --public-key node-keys.json \
+  --verify-timestamp --tsa-roots tsa-roots.pem
+```
+
+The **Integrity**, **Signature**, **Timestamp** semantics, the human-readable and
+`--json` shapes, and the option table are all exactly as documented for
+[`verify-bundle`](#independent-verification-nexart-verify-bundle) above. The
+timestamp layer is, identically, **strictly additive**: `pkijs` is loaded **only**
+under `--verify-timestamp`, and the timestamp result **never** affects the
+Integrity/Signature outcome or the process exit code (which is `0` only when
+integrity passes and the signature is not invalid, `1` otherwise).
+
+---
+
 ### `nexart ai project-verify` (v0.7.0+)
 
 Verify a **project bundle** (`cer.project.bundle.v1`) locally. No network required. Delegates all verification logic to `verifyProjectBundle()` from `@nexart/ai-execution` — the canonical source of truth for project bundle semantics. The CLI provides the command surface and output formatting.

package/dist/index.d.ts

@@ -214,7 +214,43 @@ export declare function verifyBundleStandaloneCommand(file: string, opts: {
     kid?: string;
     json?: boolean;
     verbose?: boolean;
-}): StandaloneVerifyResult;
+    verifyTimestamp?: boolean;
+    tsaRoots?: string;
+}): Promise<StandaloneVerifyResult>;
+/**
+ * nexart verify-record — Verify a full NexArt CER RECORD offline and independently.
+ *
+ * A "record" is the full verification envelope: { bundle, verification: { receipt,
+ * receiptSignature }, timestamp? }. This command is STRICTLY ADDITIVE alongside
+ * `verify-bundle` and reuses the exact same engine:
+ *   - INTEGRITY + SIGNATURE: the record's `verification.receipt` /
+ *     `verification.receiptSignature` are merged into a SHALLOW copy of `bundle`
+ *     (which never affects the recomputed certificateHash — receipt/signature are
+ *     not part of the certificate payload) and handed to verifyBundleStandalone().
+ *     Behaviour, including --public-key / --kid, is identical to verify-bundle.
+ *   - TIMESTAMP (optional, additive): the record-level `timestamp.token` (or a
+ *     bundle-embedded timestamp) is verified via the same resolveTimestampResult()
+ *     path used by verify-bundle. It NEVER affects integrity, signature, or the
+ *     exit code, and the ASN.1 stack loads only behind --verify-timestamp.
+ */
+export declare function verifyRecordStandaloneCommand(file: string, opts: {
+    publicKey?: string;
+    kid?: string;
+    json?: boolean;
+    verbose?: boolean;
+    verifyTimestamp?: boolean;
+    tsaRoots?: string;
+}): Promise<StandaloneVerifyResult>;
+/**
+ * Render the human-readable timestamp STATUS line WITHOUT importing the ASN.1 stack.
+ * This deliberately mirrors formatTsaLine() in tsaVerify.ts but lives here so the
+ * present-unverified / not-present paths never load pkijs (non-negotiable: ASN.1
+ * libs are only loaded behind --verify-timestamp). The wording — "Externally
+ * anchored timestamp" — reflects that we are proving anchoring to an INDEPENDENT
+ * authority, not running an internal check. Provider/time/imprint are surfaced
+ * separately in the Timestamp Details block (formatTimestampDetails).
+ */
+export declare function formatTimestampLine(status: import('./tsaVerify.js').TsaStatus): string;
 /**
  * nexart ai project-verify — Read a cer.project.bundle.v1 JSON from file or stdin,
  * delegate all verification to verifyProjectBundle() from @nexart/ai-execution,

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAcH,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAGL,cAAc,IAAI,iBAAiB,EAqBpC,MAAM,sBAAsB,CAAC;AAi0B9B;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAerD;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,OAAO,EACb,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,GAAE,OAAO,KAAwB,GACvC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAoB5C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,0BAAoB,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,EAAE,CAwB9D;AAoED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Df;AAqCD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EAChE,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA+Hf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACrB,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7D,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5E,sBAAsB,CAyDxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,EACvB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAwBf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAcH,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAGL,cAAc,IAAI,iBAAiB,EAqBpC,MAAM,sBAAsB,CAAC;AAi0B9B;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAerD;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,OAAO,EACb,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,GAAE,OAAO,KAAwB,GACvC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAoB5C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,0BAAoB,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,EAAE,CAwB9D;AAoED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Df;AAqCD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EAChE,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA+Hf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACrB,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7D,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1H,OAAO,CAAC,sBAAsB,CAAC,CAqCjC;AA2GD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1H,OAAO,CAAC,sBAAsB,CAAC,CAkEjC;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,SAAS,GAAG,MAAM,CAyBtF;AAmDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,EACvB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAwBf"}