attenu-guard 0.7.0 → 0.8.0

package/dist/esm/evidence.d.ts

@@ -32,7 +32,7 @@
  */
 import { type CJson, type Json } from "./canonical.js";
 import { AuditLog, type Anchor, type LedgerEntry } from "./audit.js";
-import type { Signer } from "./wire.js";
+import { type Signer } from "./wire.js";
 /**
  * The COMPLETE set of top-level ledger field names the library emits. Custody
  * guarantee: an exported bundle may carry ONLY these — an unknown field is
@@ -76,6 +76,12 @@ export interface Bundle {
     anchor: Anchor;
     redaction: RedactionReport;
     note: string;
+    /**
+     * Observer envelopes, when the bundle carries any: a witness's signature over the identity of
+     * a ledger entry. Omitted entirely when there are none, so a bundle without them is
+     * byte-for-byte what `exportBundle` has always produced.
+     */
+    envelopes?: Envelope[];
 }
 /**
  * Every top-level field must be in `LEDGER_FIELDS`; if `contextAllowlist` is
@@ -93,6 +99,12 @@ export interface ExportOptions {
     redactTask?: boolean;
     /** Throw `EvidenceLeakError` on any field outside the allow-list. */
     strict?: boolean;
+    /**
+     * Observer envelopes (`signEnvelope`) to carry beside the ledger. Omitted from the bundle
+     * entirely when absent or empty, so a bundle without them is unchanged. Cannot be combined
+     * with `redactTask` in one call: sign over the redacted ledger the export produces.
+     */
+    envelopes?: readonly Envelope[] | null;
 }
 /**
  * A self-contained evidence bundle: the full ledger plus a signed anchor over
@@ -104,6 +116,12 @@ export interface ExportOptions {
  * only ever removes. With `strict`, the bundle is checked against
  * `LEDGER_FIELDS` (and `contextAllowlist` if given) and an `EvidenceLeakError`
  * is thrown on any field outside it.
+ *
+ * ORDER MATTERS with `redactTask`: redaction rewrites every entry hash, so envelopes signed
+ * over the unredacted ledger no longer bind to the entries that ship and would all fail
+ * `envelope_subject_mismatch`. Giving both throws `Error` rather than exporting a bundle that
+ * cannot verify. Export the redacted bundle first, then `signEnvelope` over ITS entries, then
+ * export again with those envelopes.
  */
 export declare function exportBundle(auditLog: AuditLog | readonly LedgerEntry[], signer: Signer, options?: ExportOptions): Bundle;
 /**
@@ -175,7 +193,132 @@ export interface VerifyChecks {
     chain_id: boolean;
     root: boolean;
     expected_anchor: "not checked" | "verified" | "FAILED";
+    /**
+     * `"not present"` on a bundle with no `envelopes` array, which is every bundle written before
+     * observer envelopes existed. Like `anchor`, it is a status string rather than a pass/fail
+     * boolean, and a failed envelope already lands its own entry in `failures`.
+     */
+    envelopes: "not present" | "verified" | "FAILED";
+}
+/**
+ * The only envelope version this build knows. The version commits the exact signed member set of
+ * the WHOLE envelope, the subject included, so a member added anywhere is a new version and the
+ * digest cannot widen silently.
+ */
+export declare const ENVELOPE_VERSION = 1;
+/** The only `typ` at v1. A different one is a different contract, not a different envelope. */
+export declare const ENVELOPE_TYP = "delegation-event-observation";
+/** The envelope's own member set at v1. */
+export declare const ENVELOPE_MEMBERS: ReadonlySet<string>;
+/**
+ * The subject member set, keyed by `event`. v1 defines a subject for `spawn` and `allow` and for
+ * no other event. `entry_hash` is the BINDING member — the only evidence of WHICH entry the
+ * witness signed — and the rest are locators, whose job is to find the entry without hashing
+ * every entry.
+ */
+export declare const ENVELOPE_SUBJECT_MEMBERS: ReadonlyMap<string, ReadonlySet<string>>;
+/**
+ * `observed.result`'s closed vocabulary. `not_matched` requires evidence that CONTRADICTS the
+ * event; `indeterminate` is the residual state, and covers thin or absent evidence. No verifier
+ * decision turns on the result: it is reported next to the state, never instead of it.
+ */
+export declare const ENVELOPE_RESULTS: readonly ["matched", "not_matched", "indeterminate"];
+export type EnvelopeResult = (typeof ENVELOPE_RESULTS)[number];
+/** The JOSE identifier for Ed25519, and the only `witness.alg` v1 defines. */
+export declare const ENVELOPE_ALG = "EdDSA";
+/**
+ * A verifying envelope's state. It says where the signature came from and NOTHING about
+ * authority — the witness is whoever holds the key `witness.kid` names, which nothing in the
+ * envelope makes the delegation parent.
+ */
+export declare const WITNESS_SIGNED = "witness-signed";
+/**
+ * No envelope, or one that does not verify. It covers two facts a bundle does not separate — a
+ * hop nobody undertook to cover, and a hop a witness undertook to cover and never did — and v1
+ * takes the weaker reading of the two.
+ */
+export declare const PROCESS_ASSERTED = "process-asserted";
+export type EnvelopeState = typeof WITNESS_SIGNED | typeof PROCESS_ASSERTED;
+/** The seven named envelope failures, in the order this build checks them. */
+export declare const ENVELOPE_FAILURES: readonly ["envelope_unknown_version", "envelope_unknown_member", "envelope_subject_mismatch", "envelope_duplicate_subject", "envelope_non_canonical", "envelope_unknown_witness", "envelope_bad_signature"];
+/** One observer envelope, as it appears in `bundle.envelopes`. */
+export interface Envelope {
+    v: number;
+    typ: string;
+    subject: Record<string, CJson>;
+    observed: Record<string, CJson>;
+    witness: Record<string, CJson>;
+    sig: string;
+}
+/** One trusted witness key, in the shape the vector file carries. */
+export interface WitnessKey {
+    kid: string;
+    alg: string;
+    public_key_hex: string;
+}
+/**
+ * The bytes a witness signs: `JCS(envelope minus its "sig" member)`.
+ *
+ * The same RFC 8785 canonicalization the ledger has signed with since 0.7.0 — one
+ * implementation, not a second one for envelopes.
+ */
+export declare function envelopeSigningInput(envelope: Record<string, CJson>): Buffer;
+/**
+ * The v1 subject for the entry at `seq`, recomputed from the ledger.
+ *
+ * Throws when `seq` names no entry, or names one whose `event` v1 defines no subject for.
+ */
+export declare function envelopeSubject(entries: readonly LedgerEntry[], seq: number): Record<string, CJson>;
+/** What a witness asserts about the event it signed. */
+export interface Observation {
+    result?: EnvelopeResult;
+    at: string;
+    method: string;
+}
+/**
+ * An observer envelope over the entry at `seq`, signed with the 32-byte Ed25519 `seed`.
+ *
+ * `entries` is the ledger the subject is recomputed from — a witness signs the identity of an
+ * entry that already exists, never a claim it composes itself. That makes the ledger it is
+ * signed over part of the signature: sign over the entries AS THEY WILL SHIP. With
+ * `exportBundle({redactTask: true})` those are the redacted entries, so export first and sign
+ * over the exported bundle's `entries` — `exportBundle` refuses to redact and carry envelopes in
+ * one call for exactly this reason.
+ */
+export declare function signEnvelope(entries: readonly LedgerEntry[], seq: number, seed: Buffer, kid: string, observed: Observation): Envelope;
+/** What `verifyEnvelopes` and `verifyBundle`'s `envelopes` field report. */
+export interface EnvelopeSummary {
+    status: "verified" | "FAILED" | "not present";
+    count: number;
+    /** The seqs a verifying envelope covers, ascending. */
+    witness_signed: number[];
+    /** Every entry's seq -> its state. Coverage is explicit, never assumed dense. */
+    states: Record<string, EnvelopeState>;
+    /** The `observed.result` of each witness-signed entry. */
+    results: Record<string, Json>;
+    /** The report line for each entry: `witness-signed (matched)`, or `process-asserted`. */
+    lines: Record<string, string>;
+    failures: string[];
+}
+export interface VerifyEnvelopesOptions {
+    /** The trust set: the vector file's `witness_keys`, or a `{kid: publicKey}` record. */
+    witnessKeys?: readonly WitnessKey[] | Record<string, Buffer | string> | null;
+    /**
+     * The envelope bytes AS RECEIVED, positionally aligned with `bundle.envelopes` (entries may be
+     * null). Only `envelope_non_canonical` needs them, and only where a deployment kept them.
+     */
+    envelopeBytes?: readonly (Buffer | string | null)[] | null;
 }
+/**
+ * Score a bundle's observer envelopes on their own, without the ledger checks.
+ *
+ * Returns `{ok, ...summary, failure_details}`. `states` maps every entry's seq to
+ * `witness-signed` or `process-asserted`; `lines` is the report line for each.
+ */
+export declare function verifyEnvelopes(bundle: Partial<Bundle>, options?: VerifyEnvelopesOptions): EnvelopeSummary & {
+    ok: boolean;
+    failure_details: FailureDetail[];
+};
 export type ExecutionBinding = {
     status: "not applicable";
     failures?: string[];
@@ -200,6 +343,11 @@ export interface VerifyReport {
     actions_checked: number;
     chain_id: Json;
     execution_binding: ExecutionBinding;
+    /**
+     * The observer-envelope layer: the per-entry state for EVERY entry, the result and report line
+     * for each, and the failures (which are also in `failures`/`failure_details`).
+     */
+    envelopes: EnvelopeSummary;
     /** Which anchor mode this verification ran against. */
     verified_against: "expected_anchor" | "bundle_anchor";
 }
@@ -230,6 +378,18 @@ export interface VerifyBundleOptions {
     expectedAnchor?: Record<string, CJson> | Anchor | null;
     /** An independently retained `[seq, hash]` to verify the bundle's actual head against. */
     expectedHead?: readonly [number, string] | null;
+    /**
+     * The trust set for the bundle's observer envelopes, if it carries any: the vector file's
+     * `[{kid, alg, public_key_hex}]` shape, or a `{kid: publicKey}` record. Absent is an EMPTY
+     * trust set, not a skipped check — an envelope naming a key nobody trusts is
+     * `envelope_unknown_witness`.
+     */
+    witnessKeys?: readonly WitnessKey[] | Record<string, Buffer | string> | null;
+    /**
+     * The envelope bytes AS RECEIVED, positionally aligned with `bundle.envelopes`. Only
+     * `envelope_non_canonical` needs them, and only where a deployment kept them.
+     */
+    envelopeBytes?: readonly (Buffer | string | null)[] | null;
 }
 export declare function verifyBundle(bundle: Partial<Bundle>, signer?: Signer | null, options?: VerifyBundleOptions): VerifyReport;
 /** Read a bundle from JSON text, keeping every number's original literal. */

package/dist/esm/evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAML,KAAK,KAAK,EACV,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,QAAQ,EAAiD,KAAK,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAKpH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAuC5C,CAAC;AAEH;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,IAAI,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAAmB,CAAC;AAe9E,MAAM,WAAW,MAAM;IACrB,CAAC,EAAE,MAAM,CAAC;IACV,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AASD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,GACzC,eAAe,CAqBjB;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CACvB,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,MAAM,EAAE,MAAM,EACd,EAAE,GAAE,MAAM,GAAG,MAAU,GACtB,MAAM,CAcR;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3C,qEAAqE;IACrE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,QAAQ,GAAG,SAAS,WAAW,EAAE,EAC3C,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,aAAkB,GAC1B,MAAM,CAqCR;AAaD;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,IAAI,CAAC;IACV,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAqJD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,IAAI,CAAC;IACZ,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,IAAI,CAAC;IACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5C;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,eAAe,CAwCxE;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,IAAI,CAAC;IACZ,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,IAAI,CAAC;IACZ,WAAW,EAAE,IAAI,CAAC;IAClB,MAAM,EAAE,IAAI,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,CAkC5D;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,eAAe,EAAE,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAC;CACxD;AA8ND,MAAM,MAAM,gBAAgB,GAIxB;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACjD;IACE,SAAS,EAAE,OAAO,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC7C,eAAe,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,aAAa,CAAC,CAAC;IACpE,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,SAAS,GAAG,sBAAsB,CAAC,CAAC;IACrG,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAmTN,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,IAAI,CAAC;IACf,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,uDAAuD;IACvD,gBAAgB,EAAE,iBAAiB,GAAG,eAAe,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,mBAAmB;IAClC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;IACvD,0FAA0F;IAC1F,YAAY,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CACjD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EACvB,MAAM,GAAE,MAAM,GAAG,IAAW,EAC5B,OAAO,GAAE,mBAAwB,GAChC,YAAY,CAmOd;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD"}
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAQL,KAAK,KAAK,EACV,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,QAAQ,EAAiD,KAAK,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAKpH,OAAO,EAAkC,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAuC5C,CAAC;AAEH;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,IAAI,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAAmB,CAAC;AAe9E,MAAM,WAAW,MAAM;IACrB,CAAC,EAAE,MAAM,CAAC;IACV,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;CACxB;AASD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,GACzC,eAAe,CAqBjB;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CACvB,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,MAAM,EAAE,MAAM,EACd,EAAE,GAAE,MAAM,GAAG,MAAU,GACtB,MAAM,CAcR;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3C,qEAAqE;IACrE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,QAAQ,GAAG,SAAS,WAAW,EAAE,EAC3C,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,aAAkB,GAC1B,MAAM,CA8CR;AAaD;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,IAAI,CAAC;IACV,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAqJD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,IAAI,CAAC;IACZ,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,IAAI,CAAC;IACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5C;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,eAAe,CAwCxE;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,IAAI,CAAC;IACZ,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,IAAI,CAAC;IACZ,WAAW,EAAE,IAAI,CAAC;IAClB,MAAM,EAAE,IAAI,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,CAkC5D;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,eAAe,EAAE,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAC;IACvD;;;;OAIG;IACH,SAAS,EAAE,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAC;CAClD;AAoCD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,+FAA+F;AAC/F,eAAO,MAAM,YAAY,iCAAiC,CAAC;AAC3D,2CAA2C;AAC3C,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAO/C,CAAC;AACH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAG5E,CAAC;AAGH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,sDAAuD,CAAC;AACrF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/D,8EAA8E;AAC9E,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC;;;;GAIG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,MAAM,MAAM,aAAa,GAAG,OAAO,cAAc,GAAG,OAAO,gBAAgB,CAAC;AAE5E,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,6MAQpB,CAAC;AAEX,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAI5E;AA2BD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAgBnG;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,WAAW,GACpB,QAAQ,CAcV;AA4GD,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtC,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9B,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,uFAAuF;IACvF,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7E;;;OAGG;IACH,aAAa,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;CAC5D;AAyVD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EACvB,OAAO,GAAE,sBAA2B,GACnC,eAAe,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,aAAa,EAAE,CAAA;CAAE,CAQrE;AAsND,MAAM,MAAM,gBAAgB,GAIxB;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACjD;IACE,SAAS,EAAE,OAAO,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC7C,eAAe,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,aAAa,CAAC,CAAC;IACpE,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,SAAS,GAAG,sBAAsB,CAAC,CAAC;IACrG,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAmTN,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,IAAI,CAAC;IACf,iBAAiB,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,SAAS,EAAE,eAAe,CAAC;IAC3B,uDAAuD;IACvD,gBAAgB,EAAE,iBAAiB,GAAG,eAAe,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,mBAAmB;IAClC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;IACvD,0FAA0F;IAC1F,YAAY,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAChD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7E;;;OAGG;IACH,aAAa,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;CAC5D;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EACvB,MAAM,GAAE,MAAM,GAAG,IAAW,EAC5B,OAAO,GAAE,mBAAwB,GAChC,YAAY,CAsPd;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD"}