@xfuel/verify 0.3.0 → 0.3.3

package/README.md

@@ -31,9 +31,14 @@ console.log(fullResult.receipt_lane.freeze); // unsigned; does not change overal
 ### CLI
 
 ```bash
-# Local binding verification (no network required)
+# Local binding verification.
+# Issuer history is fetched unless you pass --issuer-history-file or --no-issuer-history.
+# A payload v10 receipt fails offline (exit 1) when that fetch cannot run.
 npx xfuel-verify receipt.json
 
+# Explicit offline. --no-issuer-history skips the kid window.
+npx xfuel-verify receipt.json --no-issuer-history
+
 # Hash the canonical object (must match signed payload_hash) and read not_after
 # from a pinned issuer-history snapshot. Both flags are offline.
 npx xfuel-verify receipt.json --canonical-preimage preimage.json --issuer-history-file issuer-history.json
@@ -65,9 +70,10 @@ npx xfuel-verify receipt.json inclusion.json head.json --rpc
 | Output hash | No | Hash is on the receipt |
 | On-chain settlement | Yes | Query Base RPC for tx |
 | Nullifier anchor | Yes | Query ZKVerifierSP1 contract |
-| Anchored receipt root | Yes, with `--rpc` | Inclusion proof, then Solana memo and Base calldata for that root |
+| Tree head and inclusion | No | Head ES256 signature over size and root, then an index-and-size-bound inclusion proof |
+| Anchored receipt root | Yes, with `--rpc` | The offline head and inclusion checks, then Solana memo and fee payer and Base calldata and sender |
 | Canonical preimage | No | SHA-256 of `--canonical-preimage`, or the stored canonical object, matches signed `payload_hash` |
-| Issuer history | No, with `--issuer-history-file` | `iat` is inside the kid's `not_before` / `not_after`. A payload v10 pin must match the snapshot hash |
+| Issuer history | Yes, unless `--no-issuer-history` or `--issuer-history-file` | `iat` is inside the kid's `not_before` / `not_after`. A payload v10 pin must match the snapshot hash. Offline v10 fails if the fetch cannot run |
 
 ## Issuer Signature Verification (ES256)
 
@@ -81,20 +87,28 @@ counts only when the verifying key is trusted:
    production kid `IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q`. Override with
    `--trusted-kid`, or disable with `--no-trusted-kid`.
 
+The epoch record and the tree head use those same sources, with or without `--rpc`. `xfuel-verify receipt.json inclusion.json head.json` checks the head signature and the inclusion proof offline. `--rpc` adds the chain checks. An embedded key still has to match the trusted-kid pin, or the kid has to be in a verified issuer-history entry. The head's signed `anchors.base.from` and `anchors.solana.fee_payer` must be on the anchor-wallet list (the package pin, or a verified `/.well-known/anchor-wallets.json`). The chain sender and fee payer must be those wallets. `--version` prints the package version.
+
+Anchor mode also checks a content-addressed issuer pin when the receipt or the head carries `issuer_key_pin`, or when you pass `--issuer-pin`. The pin is a 40-hex commit plus the SHA-256 of `docs/well-known/issuer-key.json`. A branch name is not fetched. A claimed pin requires `issuer_signature.jws` verified under that key. Unsigned envelope kids do not satisfy the check. The registration self-signature is checked when the file has one. A claimed era with no pin fails `ISSUER_PIN_DOWNGRADE`. Receipts that do not claim the era skip this check. The pin chain is Base Sepolia (`eip155:84532`). See [issuer-key-pin.md](../../docs/product/issuer-key-pin.md).
+
 `issuer_jwk` on the receipt is not a trust root. A copy re-signed with an
 arbitrary P-256 key reports `key untrusted` (`issuer_signature.valid === false`),
 including when `--jwks-file` points at the real JWKS.
 
 ```bash
-# Offline: default production pin, no network
-npx xfuel-verify receipt.json
-
-# Recompute published preimages and check the kid window.
-# A payload v10 receipt pins issuer_history. Hash the stored canonical object:
-curl -sS "https://api.chit402.com/receipt/RECEIPT_ID?format=json" -o receipt.json
-curl -sS "https://api.chit402.com/receipt/RECEIPT_ID/preimage" -o preimage.json
-curl -sS "https://api.chit402.com/.well-known/issuer-history.json?version=1" -o issuer-history.json
-npx xfuel-verify receipt.json --canonical-preimage preimage.json --issuer-history-file issuer-history.json
+# Explicit offline. The default command fetches issuer history.
+npx xfuel-verify receipt.json --no-issuer-history
+
+# Recompute a published canonical preimage and check the kid window.
+# curl -f stops on HTTP errors. Most receipts have no /preimage (a 404).
+# A missing preimage is not a verification failure: omit --canonical-preimage.
+curl -fsS "https://api.chit402.com/receipt/RECEIPT_ID?format=json" -o receipt.json
+curl -fsS "https://api.chit402.com/.well-known/issuer-history.json?version=1" -o issuer-history.json
+if curl -fsS "https://api.chit402.com/receipt/RECEIPT_ID/preimage" -o preimage.json; then
+  npx xfuel-verify receipt.json --canonical-preimage preimage.json --issuer-history-file issuer-history.json
+else
+  npx xfuel-verify receipt.json --issuer-history-file issuer-history.json
+fi
 
 # Trust the published JWKS instead of (or in addition to) the pin
 curl -o issuer-jwks.json https://api.chit402.com/.well-known/jwks.json
@@ -111,13 +125,20 @@ const result = await verifyReceipt(receipt);
 console.log(result.issuer_signature.valid);      // true only for a trusted key
 console.log(result.issuer_signature.key_trusted);
 console.log(result.amount_usdc);                 // from verified claims, not the outer copy
-console.log(result.claim_mismatches);            // outer payment / caller_binding vs JWS
+console.log(result.claim_mismatches);            // any signed path whose outer copy disagrees
+console.log(result.unsigned_fields);             // outer paths the signature does not cover
+console.log(result.verified_scope);              // 'signed_claims'
 ```
 
 Amount, payer, payee, asset, and tx are read from the verified JWS claims.
-If the unsigned outer `payment` or `caller_binding` disagrees, verification
-fails. `--check-payer` on Base confirms payer, payee, asset, and amount in the
-USDC `Transfer` log.
+Every signed path is compared with the outer receipt. A mismatch fails.
+Paths the signature does not cover are `unsigned_fields` and are printed as
+`UNVERIFIED`. Overall does not verify them. The outer document `schema` is
+not a copy of the JWS `schema`. `--check-payer` on Base confirms payer, payee,
+asset, and amount in the USDC `Transfer` log.
+
+`xfuel-verify receipt.json inclusion.json head.json` also runs those receipt
+checks. A matching inclusion proof does not make a tampered receipt VERIFIED.
 
 A paid USDC receipt whose signed `binding.expected_commitment` is null is
 reported as “No payment-binding commitment”, not as an unmetered or TFUEL receipt.

package/dist/anchor-trust.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Bind an anchored tree head to the issuer.
+ *
+ * Anchor mode trusts a head only when its ES256 `issuer_signature` verifies
+ * under the same rules as a receipt: a JWKS key matched by kid, an embedded
+ * key whose RFC 7638 thumbprint is a pinned kid, or a kid in a verified
+ * issuer-history document. The signed payload must match the outer fields
+ * the anchor check uses.
+ *
+ * The Base sender and the Solana fee payer in that payload must be on the
+ * issuer's anchor-wallet list, and the transactions the RPC returns must
+ * have been sent by those wallets.
+ *
+ * The list is the package pin, plus wallets inside a verified
+ * `chit402.anchor_wallets.v1` document or a verified issuer-history
+ * payload's `anchor_wallets`. Two later sources are named and not read:
+ * the Base `ChitIssuerRoot` registry (draft #485) and the DNS TXT at
+ * `_issuer.chit402.com`. This module does not embed a registry address
+ * and does not resolve DNS.
+ */
+import { type Es256Jwk } from './jws.js';
+import { type IssuerHistoryDocument } from './issuer-history.js';
+/** Confirmed sender of Base tx 0x1d8d7ea255170c8d4b87bef9382e13555dded2072fd877ce35f995f1ab54ee09. */
+export declare const PINNED_BASE_ANCHOR_WALLET = "0x1844D1F5FE42aff1Cce6F776514Fd40374079582";
+/** Fee payer of Solana memo 61RHMsPPseUc35v5oxDEtANEDCvXk5fmxZdrFDMknGWc5m7U8YhMfz4En1eFFj3z9n67ZtMiha1zkwnneL2LUiXk. */
+export declare const PINNED_SOLANA_ANCHOR_FEE_PAYER = "BHTnbPu6UZ7zQZ7Qpkpz4LcUQbMN73YDsMtvaNXpEioD";
+/** A head signed before `anchors.base.from` and `anchors.solana.fee_payer` existed. Never VERIFIED. */
+export declare const LEGACY_HEAD_UNPINNED_SIGNER = "LEGACY_HEAD_UNPINNED_SIGNER";
+export declare const ANCHOR_WALLETS_SCHEMA = "chit402.anchor_wallets.v1";
+export declare const ANCHOR_WALLETS_JWT_TYP = "chit402-anchor-wallets+jwt";
+/** Sources this version does not query. A later build can fill the same list. */
+export declare const ANCHOR_WALLET_SOURCES_NOT_CONSULTED: readonly ["issuer_root", "dns"];
+export declare const HEAD_TRUST_MESSAGES: Record<string, string>;
+interface JwksLike {
+    keys?: Es256Jwk[];
+}
+export interface TreeHeadDocument {
+    schema?: string;
+    payload_version?: number;
+    root?: string | null;
+    tree_size?: number | null;
+    epoch?: number | null;
+    prev_epoch_root?: string | null;
+    prev_epoch_size?: number | null;
+    published_at?: string | null;
+    anchors?: {
+        base?: {
+            status?: string | null;
+            tx?: string | null;
+            calldata?: string | null;
+            chain_id?: number | null;
+            from?: string | null;
+        } | null;
+        solana?: {
+            status?: string | null;
+            signature?: string | null;
+            slot?: number | null;
+            cluster?: string | null;
+            memo?: string | null;
+            fee_payer?: string | null;
+        } | null;
+    } | null;
+    issuer_signature?: {
+        jws?: string;
+        kid?: string;
+        issuer_jwk?: Es256Jwk;
+    };
+}
+export interface HeadTrustResult {
+    ok: boolean;
+    reason: string | null;
+    message: string | null;
+    kid: string | null;
+    trust: 'jwks' | 'pinned_kid' | 'issuer_history' | null;
+    payload: Record<string, unknown> | null;
+}
+export interface AnchorWalletList {
+    base: string[];
+    solana: string[];
+    sources: Array<'pin' | 'well_known' | 'issuer_history'>;
+    not_consulted: readonly ['issuer_root', 'dns'];
+}
+/**
+ * True when a verified head anchors a chain but the signature does not name
+ * that chain's signer. Those fields were added after the epoch-1 head and
+ * after the epoch-2 head signed at 07:43 ET on 2026-10-07. A pending side
+ * is not this case.
+ */
+export declare function headOmitsPinnedSigner(payload: Record<string, unknown> | null | undefined): boolean;
+/** Signed payload must carry the same root, size, epoch, and anchors the check uses. */
+export declare function headClaimsMatch(outer: TreeHeadDocument, payload: Record<string, unknown>): string | null;
+export declare function verifyTreeHeadTrust(head: TreeHeadDocument | null | undefined, { jwks, trustedKids, issuerHistory, strictIssuerHistory, }?: {
+    jwks?: JwksLike;
+    trustedKids?: readonly string[];
+    issuerHistory?: IssuerHistoryDocument | null;
+    strictIssuerHistory?: boolean;
+}): HeadTrustResult;
+export declare function verifyAnchorWalletDocument(doc: {
+    schema?: string;
+    base?: unknown;
+    solana?: unknown;
+    issuer_signature?: {
+        jws?: string;
+        issuer_jwk?: Es256Jwk;
+    };
+} | null | undefined, { jwks, trustedKids }?: {
+    jwks?: JwksLike;
+    trustedKids?: readonly string[];
+}): {
+    ok: true;
+    base: string[];
+    solana: string[];
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function compileAnchorWallets({ jwks, trustedKids, issuerHistory, published, }?: {
+    jwks?: JwksLike;
+    trustedKids?: readonly string[];
+    issuerHistory?: IssuerHistoryDocument | null;
+    published?: {
+        base: string[];
+        solana: string[];
+    } | null;
+}): AnchorWalletList;
+export declare function walletListed(list: readonly string[], value: string, chain: 'base' | 'solana'): boolean;
+export declare function sameBaseAddress(left: string, right: string): boolean;
+export {};
+//# sourceMappingURL=anchor-trust.d.ts.map

package/dist/anchor-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-trust.d.ts","sourceRoot":"","sources":["../src/anchor-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAQL,KAAK,QAAQ,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAE7B,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,+CAA+C,CAAC;AAEtF,yHAAyH;AACzH,eAAO,MAAM,8BAA8B,iDAAiD,CAAC;AAE7F,uGAAuG;AACvG,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAEzE,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AACjE,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AAEnE,iFAAiF;AACjF,eAAO,MAAM,mCAAmC,iCAAkC,CAAC;AAEnF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAgBtD,CAAC;AAEF,UAAU,QAAQ;IAChB,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE;YACL,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACvB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SACtB,GAAG,IAAI,CAAC;QACT,MAAM,CAAC,EAAE;YACP,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SAC3B,GAAG,IAAI,CAAC;KACV,GAAG,IAAI,CAAC;IACT,gBAAgB,CAAC,EAAE;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,QAAQ,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,gBAAgB,GAAG,IAAI,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,KAAK,CAAC,KAAK,GAAG,YAAY,GAAG,gBAAgB,CAAC,CAAC;IACxD,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;CAChD;AAkHD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAWlG;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAkBxG;AAcD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EACzC,EACE,IAAI,EACJ,WAAW,EACX,aAAoB,EACpB,mBAA2B,GAC5B,GAAE;IACD,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC7C,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B,GACL,eAAe,CAyDjB;AA2CD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACzI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;IAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAC/E;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAchF;AA6BD,wBAAgB,oBAAoB,CAAC,EACnC,IAAI,EACJ,WAAW,EACX,aAAoB,EACpB,SAAgB,GACjB,GAAE;IACD,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC7C,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACpD,GAAG,gBAAgB,CAqBxB;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAMtG;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpE"}

package/dist/anchor-trust.js

@@ -0,0 +1,395 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEAD_TRUST_MESSAGES = exports.ANCHOR_WALLET_SOURCES_NOT_CONSULTED = exports.ANCHOR_WALLETS_JWT_TYP = exports.ANCHOR_WALLETS_SCHEMA = exports.LEGACY_HEAD_UNPINNED_SIGNER = exports.PINNED_SOLANA_ANCHOR_FEE_PAYER = exports.PINNED_BASE_ANCHOR_WALLET = void 0;
+exports.headOmitsPinnedSigner = headOmitsPinnedSigner;
+exports.headClaimsMatch = headClaimsMatch;
+exports.verifyTreeHeadTrust = verifyTreeHeadTrust;
+exports.verifyAnchorWalletDocument = verifyAnchorWalletDocument;
+exports.compileAnchorWallets = compileAnchorWallets;
+exports.walletListed = walletListed;
+exports.sameBaseAddress = sameBaseAddress;
+/**
+ * Bind an anchored tree head to the issuer.
+ *
+ * Anchor mode trusts a head only when its ES256 `issuer_signature` verifies
+ * under the same rules as a receipt: a JWKS key matched by kid, an embedded
+ * key whose RFC 7638 thumbprint is a pinned kid, or a kid in a verified
+ * issuer-history document. The signed payload must match the outer fields
+ * the anchor check uses.
+ *
+ * The Base sender and the Solana fee payer in that payload must be on the
+ * issuer's anchor-wallet list, and the transactions the RPC returns must
+ * have been sent by those wallets.
+ *
+ * The list is the package pin, plus wallets inside a verified
+ * `chit402.anchor_wallets.v1` document or a verified issuer-history
+ * payload's `anchor_wallets`. Two later sources are named and not read:
+ * the Base `ChitIssuerRoot` registry (draft #485) and the DNS TXT at
+ * `_issuer.chit402.com`. This module does not embed a registry address
+ * and does not resolve DNS.
+ */
+const jws_js_1 = require("./jws.js");
+const issuer_history_js_1 = require("./issuer-history.js");
+/** Confirmed sender of Base tx 0x1d8d7ea255170c8d4b87bef9382e13555dded2072fd877ce35f995f1ab54ee09. */
+exports.PINNED_BASE_ANCHOR_WALLET = '0x1844D1F5FE42aff1Cce6F776514Fd40374079582';
+/** Fee payer of Solana memo 61RHMsPPseUc35v5oxDEtANEDCvXk5fmxZdrFDMknGWc5m7U8YhMfz4En1eFFj3z9n67ZtMiha1zkwnneL2LUiXk. */
+exports.PINNED_SOLANA_ANCHOR_FEE_PAYER = 'BHTnbPu6UZ7zQZ7Qpkpz4LcUQbMN73YDsMtvaNXpEioD';
+/** A head signed before `anchors.base.from` and `anchors.solana.fee_payer` existed. Never VERIFIED. */
+exports.LEGACY_HEAD_UNPINNED_SIGNER = 'LEGACY_HEAD_UNPINNED_SIGNER';
+exports.ANCHOR_WALLETS_SCHEMA = 'chit402.anchor_wallets.v1';
+exports.ANCHOR_WALLETS_JWT_TYP = 'chit402-anchor-wallets+jwt';
+/** Sources this version does not query. A later build can fill the same list. */
+exports.ANCHOR_WALLET_SOURCES_NOT_CONSULTED = ['issuer_root', 'dns'];
+exports.HEAD_TRUST_MESSAGES = {
+    head_signature_missing: 'Tree head has no issuer_signature. Anchor mode requires a valid ES256 signature from a trusted issuer key.',
+    head_signature_invalid: 'Tree head issuer_signature is not a valid ES256 signature.',
+    head_key_untrusted: 'Tree head kid is not trusted. Trust is the production pin, a verified issuer-history entry, or a JWKS key matched by kid.',
+    head_claims_mismatch: 'Signed tree head does not match the root, size, epoch, or anchors on the head.',
+    head_kid_window: 'Tree head kid is outside its issuer-history window.',
+    published_at_missing: 'Tree head has no published_at. The kid is revoked or has not_after, so the window cannot be checked.',
+    issuer_history_invalid: 'Issuer history did not verify, so the tree head key was not trusted from it.',
+    anchor_wallets_invalid: 'Issuer anchor-wallet list did not verify.',
+    anchor_sender_missing: 'Signed head does not name anchors.base.from. An anchored Base transaction must name its sender.',
+    fee_payer_missing: 'Signed head does not name anchors.solana.fee_payer. An anchored Solana memo must name its fee payer.',
+    LEGACY_HEAD_UNPINNED_SIGNER: 'This tree head was signed before anchor signer pinning. It does not name the Base sender or the Solana fee payer. Use a newer head.',
+    anchor_sender_unlisted: 'Base anchor wallet is not on the issuer anchor-wallet list.',
+    fee_payer_unlisted: 'Solana fee payer is not on the issuer anchor-wallet list.',
+    sender_mismatch: 'Base transaction sender does not match the signed anchor wallet.',
+    fee_payer_mismatch: 'Solana fee payer does not match the signed fee payer.',
+};
+function jwksCandidates(jwks, kid) {
+    const keys = jwks?.keys || [];
+    const es256 = keys.filter((key) => (0, jws_js_1.isEs256PublicJwk)(key) && (key.alg == null || key.alg === 'ES256'));
+    if (!kid)
+        return es256;
+    return es256.filter((key) => key.kid === kid);
+}
+function decodePayload(jws) {
+    const part = jws.split('.')[1];
+    if (!part)
+        return null;
+    try {
+        return JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Same ES256 trust order as `verifyIssuerSignatureWithJwks` for a compact JWS:
+ * JWKS by kid, then an embedded key whose thumbprint is a pinned kid.
+ */
+function trustCompactJws(jws, embedded, jwks, trustedKids) {
+    const header = (0, jws_js_1.readJwsHeader)(jws);
+    const kid = header?.kid || embedded?.kid || null;
+    const fromJwks = jwksCandidates(jwks, kid || undefined);
+    for (const key of fromJwks) {
+        const verified = (0, jws_js_1.verifyIssuerJws)(jws, key);
+        if (verified.valid && verified.payload) {
+            return { ok: true, trust: 'jwks', kid: key.kid || kid, payload: verified.payload, reason: '' };
+        }
+    }
+    const pinned = !!(embedded && (0, jws_js_1.isPinnedTrustedJwk)(embedded, trustedKids));
+    if (pinned && embedded) {
+        const verified = (0, jws_js_1.verifyIssuerJws)(jws, embedded);
+        if (verified.valid && verified.payload) {
+            return {
+                ok: true,
+                trust: 'pinned_kid',
+                kid: embedded.kid || (0, jws_js_1.jwkThumbprint)(embedded),
+                payload: verified.payload,
+                reason: '',
+            };
+        }
+        return { ok: false, trust: 'pinned_kid', kid, payload: null, reason: verified.reason || 'head_signature_invalid' };
+    }
+    if (embedded && (0, jws_js_1.verifyIssuerJws)(jws, embedded).valid) {
+        return { ok: false, trust: null, kid: embedded.kid || kid, payload: null, reason: jws_js_1.KEY_UNTRUSTED };
+    }
+    if (fromJwks.length === 0 && !pinned) {
+        return { ok: false, trust: null, kid, payload: null, reason: jws_js_1.KEY_UNTRUSTED };
+    }
+    return { ok: false, trust: null, kid, payload: null, reason: 'head_signature_invalid' };
+}
+function historyEntryMatches(entry, kid) {
+    if (entry.kid === kid)
+        return true;
+    return Boolean(entry.jwk && (0, jws_js_1.isEs256PublicJwk)(entry.jwk) && (0, jws_js_1.jwkThumbprint)(entry.jwk) === kid);
+}
+function historyEntryKey(doc, kid) {
+    if (!kid)
+        return null;
+    for (const entry of doc.entries || []) {
+        if (!entry?.jwk || !(0, jws_js_1.isEs256PublicJwk)(entry.jwk))
+            continue;
+        if (historyEntryMatches(entry, kid))
+            return entry.jwk;
+    }
+    return null;
+}
+function historyEntriesForKid(doc, kid) {
+    return (doc.entries || []).filter((entry) => entry && historyEntryMatches(entry, kid));
+}
+function stable(value) {
+    if (Array.isArray(value))
+        return `[${value.map((item) => stable(item)).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const obj = value;
+        const keys = Object.keys(obj).sort();
+        return `{${keys.map((key) => `${JSON.stringify(key)}:${stable(obj[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value ?? null);
+}
+function normalizeRoot(root) {
+    const hex = String(root || '').replace(/^0x/, '').toLowerCase();
+    return /^[0-9a-f]{64}$/.test(hex) ? hex : null;
+}
+const MATCHED_FIELDS = [
+    'schema',
+    'payload_version',
+    'tree_size',
+    'epoch',
+    'prev_epoch_root',
+    'prev_epoch_size',
+    'published_at',
+    'anchors',
+];
+function signerNamed(value) {
+    return typeof value === 'string' && value.trim() !== '';
+}
+function anchoredSide(side, id) {
+    if (!side || side.status === 'pending')
+        return false;
+    return signerNamed(side[id]);
+}
+/**
+ * True when a verified head anchors a chain but the signature does not name
+ * that chain's signer. Those fields were added after the epoch-1 head and
+ * after the epoch-2 head signed at 07:43 ET on 2026-10-07. A pending side
+ * is not this case.
+ */
+function headOmitsPinnedSigner(payload) {
+    const anchors = payload?.anchors;
+    if (!anchors || typeof anchors !== 'object')
+        return false;
+    const base = anchors.base;
+    const solana = anchors.solana;
+    if (anchoredSide(base, 'tx') && !signerNamed(base?.from))
+        return true;
+    if (anchoredSide(solana, 'signature') && !signerNamed(solana?.fee_payer))
+        return true;
+    return false;
+}
+/** Signed payload must carry the same root, size, epoch, and anchors the check uses. */
+function headClaimsMatch(outer, payload) {
+    const outerRoot = normalizeRoot(outer.root);
+    const signedRoot = normalizeRoot(payload.root);
+    if (!outerRoot || outerRoot !== signedRoot)
+        return 'root';
+    for (const field of MATCHED_FIELDS) {
+        const hasPayload = Object.prototype.hasOwnProperty.call(payload, field);
+        const hasOuter = Object.prototype.hasOwnProperty.call(outer, field);
+        if (!hasPayload && !hasOuter)
+            continue;
+        if (hasPayload !== hasOuter)
+            return field;
+        const signed = payload[field];
+        const claimed = outer[field];
+        if (field === 'tree_size' || field === 'epoch' || field === 'prev_epoch_size' || field === 'payload_version') {
+            if (Number(signed) !== Number(claimed))
+                return field;
+            continue;
+        }
+        if (stable(signed) !== stable(claimed))
+            return field;
+    }
+    return null;
+}
+function fail(reason, detail) {
+    const base = exports.HEAD_TRUST_MESSAGES[reason] || reason;
+    return {
+        ok: false,
+        reason,
+        message: detail ? `${base} (${detail})` : base,
+        kid: null,
+        trust: null,
+        payload: null,
+    };
+}
+function verifyTreeHeadTrust(head, { jwks, trustedKids, issuerHistory = null, strictIssuerHistory = false, } = {}) {
+    const jws = head?.issuer_signature?.jws;
+    if (!jws)
+        return fail('head_signature_missing');
+    const pins = trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
+    const embedded = head?.issuer_signature?.issuer_jwk;
+    const direct = trustCompactJws(jws, embedded, jwks, pins);
+    let trust = direct.trust;
+    let payload = direct.payload;
+    let kid = direct.kid;
+    const historyKeys = jwks?.keys ? { keys: jwks.keys } : undefined;
+    let historyOk = false;
+    if (issuerHistory) {
+        const verified = (0, issuer_history_js_1.verifyIssuerHistoryDocument)(issuerHistory, { jwks: historyKeys, trustedKids: pins });
+        if (!verified.valid) {
+            return { ...fail('issuer_history_invalid', verified.reason), kid };
+        }
+        historyOk = true;
+        if (!payload) {
+            const headerKid = (0, jws_js_1.readJwsHeader)(jws)?.kid || head?.issuer_signature?.kid || null;
+            const entryKey = historyEntryKey(issuerHistory, headerKid);
+            if (entryKey) {
+                const checked = (0, jws_js_1.verifyIssuerJws)(jws, entryKey);
+                if (checked.valid && checked.payload) {
+                    trust = 'issuer_history';
+                    payload = checked.payload;
+                    kid = headerKid;
+                }
+            }
+        }
+    }
+    else if (strictIssuerHistory) {
+        return { ...fail('issuer_history_invalid', 'issuer history was required and was not loaded'), kid };
+    }
+    if (!payload || !trust) {
+        if (direct.reason === jws_js_1.KEY_UNTRUSTED)
+            return { ...fail('head_key_untrusted'), kid };
+        return { ...fail('head_signature_invalid', direct.reason === 'head_signature_invalid' ? undefined : direct.reason), kid };
+    }
+    const mismatch = headClaimsMatch(head || {}, payload);
+    if (mismatch) {
+        return { ...fail('head_claims_mismatch', mismatch), kid, payload };
+    }
+    if (historyOk && issuerHistory && kid) {
+        const publishedAt = Object.prototype.hasOwnProperty.call(head || {}, 'published_at')
+            ? head?.published_at
+            : payload.published_at;
+        const window = headHistoryWindow(issuerHistory, kid, publishedAt);
+        if (!window.ok) {
+            const reason = window.reason === 'published_at_missing' ? 'published_at_missing' : 'head_kid_window';
+            const detail = reason === 'head_kid_window' ? (window.reason || undefined) : undefined;
+            return { ...fail(reason, detail), kid, trust, payload };
+        }
+    }
+    return { ok: true, reason: null, message: null, kid, trust, payload };
+}
+/**
+ * A signed published_at is checked with the receipt window rules.
+ * v1 heads omit the field, and a closed head with no observed chain time
+ * signs null. That is not issued_at_missing. An active kid with an open
+ * window still verifies. A revoked kid, or one with not_after, fails closed
+ * because the missing time cannot show the head was signed inside the window.
+ */
+function headHistoryWindow(doc, kid, publishedAt) {
+    const matches = historyEntriesForKid(doc, kid);
+    if (matches.length === 0)
+        return { ok: false, reason: 'kid_not_in_history' };
+    if (matches.length !== 1)
+        return { ok: false, reason: 'kid_ambiguous' };
+    const entry = matches[0];
+    const hasTime = publishedAt != null && publishedAt !== '';
+    if (hasTime)
+        return (0, issuer_history_js_1.issuerEntryWindow)(entry, publishedAt);
+    const notBefore = entry.not_before ? Date.parse(entry.not_before) : NaN;
+    if (!Number.isFinite(notBefore))
+        return { ok: false, reason: 'not_before_missing' };
+    if (notBefore > Date.now())
+        return { ok: false, reason: 'issued_before_not_before' };
+    if (entry.status === 'revoked' || entry.not_after != null) {
+        return { ok: false, reason: 'published_at_missing' };
+    }
+    return { ok: true, reason: null };
+}
+function asAddressList(value, chain) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    for (const item of value) {
+        if (typeof item !== 'string')
+            continue;
+        if (chain === 'base') {
+            if (/^0x[0-9a-fA-F]{40}$/.test(item))
+                out.push(item);
+        }
+        else if (/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(item)) {
+            out.push(item);
+        }
+    }
+    return out;
+}
+function verifyAnchorWalletDocument(doc, { jwks, trustedKids } = {}) {
+    const jws = doc?.issuer_signature?.jws;
+    if (!doc || doc.schema !== exports.ANCHOR_WALLETS_SCHEMA || !jws) {
+        return { ok: false, reason: 'anchor_wallets_invalid' };
+    }
+    const pins = trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
+    const trusted = trustCompactJws(jws, doc.issuer_signature?.issuer_jwk, jwks, pins);
+    if (!trusted.ok || !trusted.payload)
+        return { ok: false, reason: 'anchor_wallets_invalid' };
+    if (trusted.payload.schema !== exports.ANCHOR_WALLETS_SCHEMA)
+        return { ok: false, reason: 'anchor_wallets_invalid' };
+    const base = asAddressList(trusted.payload.base, 'base');
+    const solana = asAddressList(trusted.payload.solana, 'solana');
+    if (stable(base) !== stable(asAddressList(doc.base, 'base')))
+        return { ok: false, reason: 'anchor_wallets_invalid' };
+    if (stable(solana) !== stable(asAddressList(doc.solana, 'solana')))
+        return { ok: false, reason: 'anchor_wallets_invalid' };
+    return { ok: true, base, solana };
+}
+function walletsFromHistory(doc, jwks, trustedKids) {
+    if (!doc?.issuer_signature?.jws)
+        return null;
+    const verified = (0, issuer_history_js_1.verifyIssuerHistoryDocument)(doc, { jwks: jwks?.keys ? { keys: jwks.keys } : undefined, trustedKids });
+    if (!verified.valid)
+        return null;
+    const payload = decodePayload(doc.issuer_signature.jws);
+    const listed = payload?.anchor_wallets;
+    if (!listed || typeof listed !== 'object')
+        return { base: [], solana: [] };
+    const row = listed;
+    return { base: asAddressList(row.base, 'base'), solana: asAddressList(row.solana, 'solana') };
+}
+function unique(values, chain) {
+    const seen = new Set();
+    const out = [];
+    for (const value of values) {
+        const key = chain === 'base' ? value.toLowerCase() : value;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(value);
+    }
+    return out;
+}
+function compileAnchorWallets({ jwks, trustedKids, issuerHistory = null, published = null, } = {}) {
+    const base = [exports.PINNED_BASE_ANCHOR_WALLET];
+    const solana = [exports.PINNED_SOLANA_ANCHOR_FEE_PAYER];
+    const sources = ['pin'];
+    const fromHistory = walletsFromHistory(issuerHistory, jwks, trustedKids);
+    if (fromHistory && (fromHistory.base.length || fromHistory.solana.length)) {
+        base.push(...fromHistory.base);
+        solana.push(...fromHistory.solana);
+        sources.push('issuer_history');
+    }
+    if (published) {
+        base.push(...published.base);
+        solana.push(...published.solana);
+        sources.push('well_known');
+    }
+    return {
+        base: unique(base, 'base'),
+        solana: unique(solana, 'solana'),
+        sources,
+        not_consulted: exports.ANCHOR_WALLET_SOURCES_NOT_CONSULTED,
+    };
+}
+function walletListed(list, value, chain) {
+    if (chain === 'base') {
+        const needle = value.toLowerCase();
+        return list.some((item) => item.toLowerCase() === needle);
+    }
+    return list.includes(value);
+}
+function sameBaseAddress(left, right) {
+    return left.toLowerCase() === right.toLowerCase();
+}
+//# sourceMappingURL=anchor-trust.js.map

package/dist/anchor-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-trust.js","sourceRoot":"","sources":["../src/anchor-trust.ts"],"names":[],"mappings":";;;AAgPA,sDAWC;AAGD,0CAkBC;AAcD,kDAsEC;AA2CD,gEAiBC;AA6BD,oDA+BC;AAED,oCAMC;AAED,0CAEC;AAxeD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qCASkB;AAClB,2DAI6B;AAE7B,sGAAsG;AACzF,QAAA,yBAAyB,GAAG,4CAA4C,CAAC;AAEtF,yHAAyH;AAC5G,QAAA,8BAA8B,GAAG,8CAA8C,CAAC;AAE7F,uGAAuG;AAC1F,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAE5D,QAAA,qBAAqB,GAAG,2BAA2B,CAAC;AACpD,QAAA,sBAAsB,GAAG,4BAA4B,CAAC;AAEnE,iFAAiF;AACpE,QAAA,mCAAmC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAU,CAAC;AAEtE,QAAA,mBAAmB,GAA2B;IACzD,sBAAsB,EAAE,4GAA4G;IACpI,sBAAsB,EAAE,4DAA4D;IACpF,kBAAkB,EAAE,2HAA2H;IAC/I,oBAAoB,EAAE,gFAAgF;IACtG,eAAe,EAAE,qDAAqD;IACtE,oBAAoB,EAAE,sGAAsG;IAC5H,sBAAsB,EAAE,8EAA8E;IACtG,sBAAsB,EAAE,2CAA2C;IACnE,qBAAqB,EAAE,iGAAiG;IACxH,iBAAiB,EAAE,sGAAsG;IACzH,2BAA2B,EAAE,qIAAqI;IAClK,sBAAsB,EAAE,6DAA6D;IACrF,kBAAkB,EAAE,2DAA2D;IAC/E,eAAe,EAAE,kEAAkE;IACnF,kBAAkB,EAAE,uDAAuD;CAC5E,CAAC;AAuDF,SAAS,cAAc,CAAC,IAA0B,EAAE,GAAuB;IACzE,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,yBAAgB,EAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC;IACtG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAW,EACX,QAA8B,EAC9B,IAA0B,EAC1B,WAA8B;IAE9B,MAAM,MAAM,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,GAAG,IAAI,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACjG,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAA,2BAAkB,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,YAAY;gBACnB,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,IAAA,sBAAa,EAAC,QAAQ,CAAC;gBAC5C,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,EAAE;aACX,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,IAAI,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAa,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAa,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAuC,EAAE,GAAW;IAC/E,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,IAAA,yBAAgB,EAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAA,sBAAa,EAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,eAAe,CAAC,GAA0B,EAAE,GAAkB;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,IAAA,yBAAgB,EAAC,KAAK,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1D,IAAI,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA0B,EAAE,GAAW;IACnE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,QAAQ;IACR,iBAAiB;IACjB,WAAW;IACX,OAAO;IACP,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,SAAS;CACD,CAAC;AAEX,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,IAAsF,EAAE,EAAsB;IAClI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,OAAmD;IACvF,MAAM,OAAO,GAAG,OAAO,EAAE,OAGL,CAAC;IACrB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wFAAwF;AACxF,SAAgB,eAAe,CAAC,KAAuB,EAAE,OAAgC;IACvF,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;YAAE,SAAS;QACvC,IAAI,UAAU,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAI,KAA4C,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAC7G,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,MAAe;IAC3C,MAAM,IAAI,GAAG,2BAAmB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IACnD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM;QACN,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI;QAC9C,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,mBAAmB,CACjC,IAAyC,EACzC,EACE,IAAI,EACJ,WAAW,EACX,aAAa,GAAG,IAAI,EACpB,mBAAmB,GAAG,KAAK,MAMzB,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,WAAW,IAAI,oCAA2B,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,EAAE,gBAAgB,EAAE,UAAU,CAAC;IACpD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,KAAK,GAA6B,MAAM,CAAC,KAAK,CAAC;IACnD,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACrB,MAAM,WAAW,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAA,+CAA2B,EAAC,aAAa,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,EAAE,GAAG,IAAI,CAAC,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;QACrE,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,EAAE,gBAAgB,EAAE,GAAG,IAAI,IAAI,CAAC;YACjF,MAAM,QAAQ,GAAG,eAAe,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAC3D,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC/C,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrC,KAAK,GAAG,gBAAgB,CAAC;oBACzB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;oBAC1B,GAAG,GAAG,SAAS,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,mBAAmB,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,IAAI,CAAC,wBAAwB,EAAE,gDAAgD,CAAC,EAAE,GAAG,EAAE,CAAC;IACtG,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,MAAM,KAAK,sBAAa;YAAE,OAAO,EAAE,GAAG,IAAI,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC;QACnF,OAAO,EAAE,GAAG,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,MAAM,KAAK,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAC5H,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,IAAI,SAAS,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,cAAc,CAAC;YAClF,CAAC,CAAC,IAAI,EAAE,YAAY;YACpB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACrG,MAAM,MAAM,GAAG,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,GAA0B,EAC1B,GAAW,EACX,WAAoB;IAEpB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,WAAW,IAAI,IAAI,IAAI,WAAW,KAAK,EAAE,CAAC;IAC1D,IAAI,OAAO;QAAE,OAAO,IAAA,qCAAiB,EAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACpF,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACrF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAwB;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,0BAA0B,CACxC,GAAyI,EACzI,EAAE,IAAI,EAAE,WAAW,KAA2D,EAAE;IAEhF,MAAM,GAAG,GAAG,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC;IACvC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,6BAAqB,IAAI,CAAC,GAAG,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,IAAI,oCAA2B,CAAC;IACxD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC5F,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,6BAAqB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC7G,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACrH,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC3H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,kBAAkB,CACzB,GAA6C,EAC7C,IAA0B,EAC1B,WAA0C;IAE1C,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAA,+CAA2B,EAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;IACvH,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,EAAE,cAAc,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAG,MAA8C,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB,EAAE,KAAwB;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,oBAAoB,CAAC,EACnC,IAAI,EACJ,WAAW,EACX,aAAa,GAAG,IAAI,EACpB,SAAS,GAAG,IAAI,MAMd,EAAE;IACJ,MAAM,IAAI,GAAG,CAAC,iCAAyB,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,sCAA8B,CAAC,CAAC;IAChD,MAAM,OAAO,GAAgC,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,kBAAkB,CAAC,aAAa,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACzE,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;QAChC,OAAO;QACP,aAAa,EAAE,2CAAmC;KACnD,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,IAAuB,EAAE,KAAa,EAAE,KAAwB;IAC3F,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAgB,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,OAAO,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;AACpD,CAAC"}