burnledger 0.2.1 → 0.3.0

package/src/web-verifier.ts

@@ -0,0 +1,89 @@
+/**
+ * Entry point for the public browser verifier at `website/verify/`.
+ *
+ * Imports the leaf modules directly rather than re-exporting from
+ * `index.browser.ts`: that entry pulls in the HTTP client, which imports
+ * `node:fs/promises` and cannot be bundled for a browser at all. The page needs
+ * four functions, so this exposes four functions — the surface a relying party's
+ * browser is handed is then something you can read in one screen instead of
+ * inferring from a minified artifact.
+ *
+ * Built by `scripts/build-web-verifier.mjs`. The bundle this replaces was built
+ * by hand once and never regenerated, and had drifted into disagreeing with the
+ * Go reference on 24 of 29 fixture cases — accepting relabelled timestamps and
+ * an unsigned tree_size, and rejecting genuine certificates with a non-UTC
+ * offset (#457). It also contained `ed25519Supported`, which existed in no
+ * source file anywhere in the repository.
+ */
+import { browserCrypto } from "./crypto-browser.js";
+import {
+  verifyCertificate as _verifyCertificate,
+  verifyCertificateWithStatus as _verifyCertificateWithStatus,
+  verifyTransparency as _verifyTransparency,
+  publicKeyFromHex as _publicKeyFromHex,
+} from "./verify.js";
+import type { PublicKeyInfo } from "./verify.js";
+import type { VerificationResult, TransparencyResult } from "./models.js";
+
+type Cert = Record<string, unknown>;
+
+/** Verify all signatures on a deletion certificate offline. */
+export function verifyCertificate(
+  certificate: Cert,
+  publicKeys: Map<string, PublicKeyInfo>,
+): Promise<VerificationResult> {
+  return _verifyCertificate(browserCrypto, certificate, publicKeys);
+}
+
+/**
+ * Verify a certificate and, separately, what a signed statement says about its
+ * revocation. Returns "VALID_REVOCATION_UNKNOWN" when no fresh statement is
+ * supplied — never "VALID", because "not revoked" is not something an offline
+ * check can establish on its own.
+ */
+export function verifyCertificateWithStatus(
+  certificate: Cert,
+  publicKeys: Map<string, PublicKeyInfo>,
+  status?: Record<string, unknown> | null,
+  now?: Date,
+): Promise<string> {
+  return _verifyCertificateWithStatus(browserCrypto, certificate, publicKeys, status, now);
+}
+
+/** Verify the transparency proof embedded in a certificate. */
+export function verifyTransparency(
+  certificate: Cert,
+  publicKeys: Map<string, PublicKeyInfo>,
+): Promise<TransparencyResult> {
+  return _verifyTransparency(browserCrypto, certificate, publicKeys);
+}
+
+/** Construct a PublicKeyInfo from a hex-encoded Ed25519 public key. */
+export function publicKeyFromHex(
+  hexKey: string,
+  opts?: { revoked?: boolean },
+): Promise<PublicKeyInfo> {
+  return _publicKeyFromHex(browserCrypto, hexKey, opts);
+}
+
+/**
+ * Report whether this browser's WebCrypto can verify Ed25519, so the page can
+ * say "your browser cannot check this" rather than failing silently.
+ *
+ * Feature-detected by importing a well-formed SPKI key rather than sniffing the
+ * user agent: support arrived at different versions across engines, and a
+ * capability question deserves a capability answer.
+ */
+export async function ed25519Supported(): Promise<boolean> {
+  try {
+    const spki = new Uint8Array([
+      0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+      1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+      17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32,
+    ]);
+    await crypto.subtle.importKey("spki", spki.buffer as ArrayBuffer, { name: "Ed25519" }, false, ["verify"]);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/webhooks.ts

@@ -0,0 +1,76 @@
+/** Webhook signature verification for incoming BurnLedger events.
+ *
+ * The server signs webhook payloads with HMAC-SHA256 using the webhook secret.
+ * The signature is sent in the X-BurnLedger-Signature header as a hex string,
+ * and the timestamp in the X-BurnLedger-Timestamp header as an RFC3339 string.
+ *
+ * CR-M01: the signed preimage is `timestamp + "." + body`, where `timestamp` is
+ * the exact RFC3339 string from the X-BurnLedger-Timestamp header. Binding the
+ * timestamp into the MAC prevents a captured delivery from being replayed under
+ * a different timestamp. Receivers MUST also verify the timestamp is fresh (see
+ * isTimestampFresh) — the signature proves authenticity, freshness prevents
+ * replay of an old-but-validly-signed delivery.
+ *
+ * Node-only — webhooks are received server-side.
+ */
+
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+/**
+ * Verify that a webhook payload was signed by the expected secret.
+ *
+ * @param secret  The webhook secret (raw UTF-8, as returned by the API)
+ * @param timestamp The RFC3339 timestamp from the X-BurnLedger-Timestamp header
+ * @param body    The raw request body bytes
+ * @param signature The hex-encoded HMAC-SHA256 signature from the X-BurnLedger-Signature header
+ * @returns true if the signature is valid
+ */
+export function verifyWebhookSignature(
+  secret: string,
+  timestamp: string,
+  body: Uint8Array | string,
+  signature: string,
+): boolean {
+  if (secret.length === 0) return false;
+  if (timestamp.length === 0) return false;
+  if (signature.length === 0) return false;
+
+  // Preimage: timestamp + "." + body. An RFC3339 timestamp never contains a
+  // ".", so the field boundary is unambiguous.
+  const bodyBytes =
+    typeof body === "string" ? Buffer.from(body, "utf-8") : Buffer.from(body);
+  const expected = createHmac("sha256", secret)
+    .update(Buffer.from(`${timestamp}.`, "utf-8"))
+    .update(bodyBytes)
+    .digest();
+
+  let received: Buffer;
+  try {
+    received = Buffer.from(signature, "hex");
+  } catch {
+    return false;
+  }
+
+  if (received.length !== expected.length) return false;
+
+  return timingSafeEqual(expected, received);
+}
+
+/**
+ * Verify that the webhook timestamp is within an acceptable freshness window.
+ * Receivers MUST call this (in addition to verifyWebhookSignature) to prevent
+ * replay of an old-but-validly-signed delivery.
+ *
+ * @param timestamp The RFC3339 timestamp from the X-BurnLedger-Timestamp header
+ * @param toleranceSeconds Maximum accepted age/skew in seconds (default 300)
+ * @returns true if the timestamp parses and is within +/- tolerance of now
+ */
+export function isTimestampFresh(
+  timestamp: string,
+  toleranceSeconds: number = 300,
+): boolean {
+  const parsed = Date.parse(timestamp);
+  if (Number.isNaN(parsed)) return false;
+  const ageSeconds = Math.abs(Date.now() - parsed) / 1000;
+  return ageSeconds <= toleranceSeconds;
+}

package/dist/cjs/cli.d.ts

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-/** burnledger check — offline certificate verification.
- * Exit codes: 0=valid, 1=invalid, 2=usage error */
-type Cert = Record<string, unknown>;
-/** The pass/fail decision behind the exit code. A signature failure, a
- * transparency FAILURE (thrown, not NOT_AVAILABLE), or an online-confirmed
- * revocation all make the certificate invalid. Exported for testing. */
-export declare function certVerdict(sigResult: string, transparencyFailed: boolean, online: boolean, revocation: {
-    status: string;
-} | undefined): boolean;
-export declare function formatOutput(cert: Cert, sigResult: string, transparency: string, transparencyFailed: boolean, revocation: {
-    status: string;
-    reason?: string;
-} | undefined, online: boolean): string;
-export {};
-//# sourceMappingURL=cli.d.ts.map

package/dist/cjs/cli.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAQnD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAiEpC;;wEAEwE;AACxE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,OAAO,EAC3B,MAAM,EAAE,OAAO,EACf,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACzC,OAAO,CAMT;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAChF,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,GAC3E,MAAM,CAmCR"}

package/dist/cjs/cli.js

@@ -1,168 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-/** burnledger check — offline certificate verification.
- * Exit codes: 0=valid, 1=invalid, 2=usage error */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.certVerdict = certVerdict;
-exports.formatOutput = formatOutput;
-const promises_1 = require("node:fs/promises");
-const crypto_node_js_1 = require("./crypto-node.js");
-const verify_js_1 = require("./verify.js");
-const keys_js_1 = require("./keys.js");
-const USAGE = "Usage: burnledger check --cert <file> --keys <file> [--online --api-url <url> --api-key <key>]\n";
-function die(msg) { process.stderr.write(msg); process.exit(2); }
-function parseArgs(argv) {
-    const args = argv.slice(2);
-    if (args[0] !== "check")
-        die(USAGE);
-    let certPath = "", keysPath = "", online = false, apiUrl = "", apiKey = "";
-    for (let i = 1; i < args.length; i++) {
-        const a = args[i];
-        if (a === "--cert") {
-            certPath = args[++i] ?? die("--cert requires a value\n");
-        }
-        else if (a === "--keys") {
-            keysPath = args[++i] ?? die("--keys requires a value\n");
-        }
-        else if (a === "--online") {
-            online = true;
-        }
-        else if (a === "--api-url") {
-            apiUrl = args[++i] ?? die("--api-url requires a value\n");
-        }
-        else if (a === "--api-key") {
-            apiKey = args[++i] ?? die("--api-key requires a value\n");
-        }
-        else
-            die(`Unknown argument: ${a}\n`);
-    }
-    if (!certPath || !keysPath)
-        die("Both --cert and --keys are required.\n");
-    if (online && (!apiUrl || !apiKey))
-        die("--online requires --api-url and --api-key.\n");
-    return { certPath, keysPath, online, apiUrl, apiKey };
-}
-async function loadKeys(path) {
-    let entries;
-    try {
-        entries = (0, keys_js_1.parseKeyEntries)(JSON.parse(await (0, promises_1.readFile)(path, "utf-8")));
-    }
-    catch (e) {
-        die(e.message + "\n");
-    }
-    const map = new Map();
-    for (const e of entries) {
-        // Fail closed: trust a key only if it explicitly declares active/retired.
-        const revoked = !(e.key_status === "active" || e.key_status === "retired");
-        let pki;
-        try {
-            pki = await (0, verify_js_1.publicKeyFromHex)(crypto_node_js_1.nodeCrypto, e.public_key, { revoked });
-        }
-        catch (err) {
-            die(`invalid public_key: ${err.message}\n`);
-        }
-        // Key-substitution defense: a declared key_id must match the id derived from
-        // the public key (dp_k_ + sha256(key)), and the map is keyed on the DERIVED
-        // id so a lying key_id cannot shadow a genuine one.
-        if (e.key_id !== undefined && e.key_id !== pki.keyId) {
-            die(`key_id ${e.key_id} does not match sha256(public_key) (${pki.keyId})\n`);
-        }
-        const existing = map.get(pki.keyId);
-        if (existing !== undefined && existing.revoked !== pki.revoked) {
-            die(`conflicting key_status for duplicate key ${pki.keyId}\n`);
-        }
-        map.set(pki.keyId, pki);
-    }
-    return map;
-}
-async function checkRevocation(apiUrl, apiKey, certId) {
-    const res = await fetch(`${apiUrl}/v1/certificates/${certId}/revocation-status`, {
-        headers: { Authorization: `Bearer ${apiKey}` },
-    });
-    if (!res.ok)
-        throw new Error(`Revocation check failed: HTTP ${res.status}`);
-    return (await res.json()).data;
-}
-/** The pass/fail decision behind the exit code. A signature failure, a
- * transparency FAILURE (thrown, not NOT_AVAILABLE), or an online-confirmed
- * revocation all make the certificate invalid. Exported for testing. */
-function certVerdict(sigResult, transparencyFailed, online, revocation) {
-    return (sigResult === "VALID" &&
-        !transparencyFailed &&
-        !(online && revocation?.status === "REVOKED"));
-}
-function formatOutput(cert, sigResult, transparency, transparencyFailed, revocation, online) {
-    const id = cert.certificate_id.slice(0, 6);
-    const sub = cert.subject.identifier_hash;
-    const att = cert.attestation;
-    const ver = cert.verification;
-    const L = [];
-    if (sigResult !== "VALID")
-        return `Certificate dc_${id}: INVALID (${sigResult})\n`;
-    if (transparencyFailed)
-        return `Certificate dc_${id}: INVALID (transparency: ${transparency})\n`;
-    if (online && revocation?.status === "REVOKED") {
-        L.push(`Certificate dc_${id}: INVALID (REVOKED)`);
-        if (revocation.reason)
-            L.push(`  Revocation reason: ${revocation.reason}`);
-        return L.join("\n") + "\n";
-    }
-    const tag = online ? "" : " (offline — revocation status not checked)";
-    L.push(`Certificate dc_${id}: VALID${tag}`);
-    L.push(`  Subject: sha256:${sub.slice(0, 6)}...`);
-    L.push(`  Canonical version: ${cert.certificate_format_version}`);
-    const sys = att.systems;
-    L.push(`  Systems: ${sys.length} (${sys.map((s) => `${s.connector_type} [${s.hash_scope}]`).join(", ")})`);
-    L.push(`  Records before: ${sys.reduce((n, s) => n + s.record_count, 0)}`);
-    L.push(`  Records after: ${ver.systems.reduce((n, s) => n + s.record_count, 0)}`);
-    L.push(`  Committed: ${att.attested_at}`);
-    L.push(`  Verified: ${ver.verified_at}`);
-    if (transparency === "INCLUDED") {
-        const t = cert.transparency;
-        L.push(`  Transparency log: entry #${t.entry_index}, inclusion proof VALID`);
-    }
-    else {
-        L.push(`  Transparency log: ${transparency === "NOT_AVAILABLE" ? "not included" : transparency}`);
-    }
-    if (online && revocation)
-        L.push(`  Revocation status: ${revocation.status}`);
-    return L.join("\n") + "\n";
-}
-async function main() {
-    const args = parseArgs(process.argv);
-    const cert = JSON.parse(await (0, promises_1.readFile)(args.certPath, "utf-8"));
-    const keys = await loadKeys(args.keysPath);
-    let sigResult = "VALID";
-    try {
-        await (0, verify_js_1.verifyCertificate)(crypto_node_js_1.nodeCrypto, cert, keys);
-    }
-    catch (e) {
-        sigResult = e instanceof Error ? e.message : "unknown error";
-    }
-    // NOT_AVAILABLE (no proof) is a legitimate result; only a thrown error is a
-    // transparency FAILURE and must fail the verdict + exit code.
-    let transparency = "NOT_AVAILABLE";
-    let transparencyFailed = false;
-    try {
-        transparency = await (0, verify_js_1.verifyTransparency)(crypto_node_js_1.nodeCrypto, cert, keys);
-    }
-    catch (e) {
-        transparency = e instanceof Error ? e.message : "unknown error";
-        transparencyFailed = true;
-    }
-    let revocation;
-    if (args.online)
-        revocation = await checkRevocation(args.apiUrl, args.apiKey, cert.certificate_id);
-    const valid = certVerdict(sigResult, transparencyFailed, args.online, revocation);
-    process.stdout.write(formatOutput(cert, sigResult, transparency, transparencyFailed, revocation, args.online));
-    process.exit(valid ? 0 : 1);
-}
-// Only run as a CLI entry point — importing this module (e.g. from tests) must
-// not execute main(). argv[1] is the script path when invoked as the binary.
-if (process.argv[1]?.endsWith("cli.js")) {
-    main().catch((e) => {
-        process.stderr.write(`Error: ${e instanceof Error ? e.message : String(e)}\n`);
-        process.exit(2);
-    });
-}
-//# sourceMappingURL=cli.js.map

package/dist/cjs/cli.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;AACA;mDACmD;;AA4EnD,kCAWC;AAED,oCAsCC;AA7HD,+CAA4C;AAC5C,qDAA8C;AAC9C,2CAAsF;AACtF,uCAA2D;AAI3D,MAAM,KAAK,GAAG,kGAAkG,CAAC;AAEjH,SAAS,GAAG,CAAC,GAAW,IAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,SAAS,SAAS,CAAC,IAAc;IAG/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aAC5E,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aACjF,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;aACxC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;aACrF,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;;YACrF,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1E,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACxF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,yBAAe,EAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,0EAA0E;QAC1E,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;QAC3E,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAA,4BAAgB,EAAC,2BAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;YAC/D,GAAG,CAAC,4CAA4C,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IAC3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,oBAAoB,MAAM,oBAAoB,EAAE;QAC/E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAoD,CAAA,CAAC,IAAI,CAAC;AAClF,CAAC;AAED;;wEAEwE;AACxE,SAAgB,WAAW,CACzB,SAAiB,EACjB,kBAA2B,EAC3B,MAAe,EACf,UAA0C;IAE1C,OAAO,CACL,SAAS,KAAK,OAAO;QACrB,CAAC,kBAAkB;QACnB,CAAC,CAAC,MAAM,IAAI,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAC1B,IAAU,EAAE,SAAiB,EAAE,YAAoB,EAAE,kBAA2B,EAChF,UAA2D,EAAE,MAAe;IAE5E,MAAM,EAAE,GAAI,IAAI,CAAC,cAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAI,IAAI,CAAC,OAAmC,CAAC,eAAyB,CAAC;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAsC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAuC,CAAC;IACzD,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,kBAAkB,EAAE,cAAc,SAAS,KAAK,CAAC;IACnF,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,EAAE,4BAA4B,YAAY,KAAK,CAAC;IACjG,IAAI,MAAM,IAAI,UAAU,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM;YAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4CAA4C,CAAC;IACvE,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,0BAAoC,EAAE,CAAC,CAAC;IAE5E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAoC,CAAC;IACrD,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,YAAuB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC,IAAI,CAAC,oBAAqB,GAAG,CAAC,OAAqC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,YAAuB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,WAAqB,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,WAAqB,EAAE,CAAC,CAAC;IAEnD,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAuC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,WAAqB,yBAAyB,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,uBAAuB,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAM,IAAI,UAAU;QAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAS,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE3C,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,CAAC;QAAC,MAAM,IAAA,6BAAiB,EAAC,2BAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxD,OAAO,CAAC,EAAE,CAAC;QAAC,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IAAC,CAAC;IAE3E,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,YAAY,GAAG,eAAe,CAAC;IACnC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QAAC,YAAY,GAAG,MAAM,IAAA,8BAAkB,EAAC,2BAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxE,OAAO,CAAC,EAAE,CAAC;QAAC,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAAC,kBAAkB,GAAG,IAAI,CAAC;IAAC,CAAC;IAEzG,IAAI,UAA2D,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM;QAAE,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAwB,CAAC,CAAC;IAE7G,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAElF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/G,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}