burnledger 0.8.0 → 0.9.0

package/dist/esm/status-document.js

@@ -0,0 +1,59 @@
+/** Reading a status statement as the status endpoint serves it, before anything
+ * verifies it. Shared by the CLI and the /verify page's status button, so the two
+ * agree on what counts as a statement: an answer that is not one is silence
+ * about revocation, while a statement that is one and fails is a refusal. */
+/** The API wraps every response in {"data": ...}; a caller may hand over either
+ * the envelope or the document inside it. Mirrors
+ * core.ParseCertificateStatusDocument, so this CLI and the Go one cannot
+ * disagree about which shape the endpoint returns. Exported for testing.
+ *
+ * A document that does not parse THROWS, and the caller turns that into a
+ * warning and a VALID_REVOCATION_UNKNOWN verdict. That is deliberate: an answer
+ * this build cannot read is silence about revocation, not a finding about the
+ * certificate. Handing a half-read document to the verifier instead would
+ * report "status statement signature is invalid" — a claim about the issuer —
+ * when what actually happened is that something returned nonsense.
+ *
+ * `status` itself is NOT validated against a known set. A statement saying
+ * SUSPENDED is a statement this build cannot read, and the verifier already has
+ * the right answer for that: it authenticates the signature first, then reports
+ * VALID_REVOCATION_UNKNOWN. Refusing it here would discard the statement before
+ * anyone authenticated it. */
+export function unwrapStatusStatement(parsed) {
+    if (parsed === null || typeof parsed !== "object") {
+        throw new Error("status statement: response is not a JSON object");
+    }
+    let doc = parsed;
+    if (doc.certificate_id === undefined && doc.data !== null && typeof doc.data === "object") {
+        doc = doc.data;
+    }
+    for (const f of ["certificate_id", "status", "key_id"]) {
+        if (typeof doc[f] !== "string" || doc[f] === "")
+            throw new Error(`status statement: ${f} is missing`);
+    }
+    for (const f of ["statement_issued_at", "statement_expires_at"])
+        requireRfc3339(doc, f);
+    if (doc.revoked_at != null)
+        requireRfc3339(doc, "revoked_at");
+    if (typeof doc.sth_tree_size !== "number")
+        throw new Error("status statement: sth_tree_size is not a number");
+    // Refuse a short or long value rather than letting it through: a truncated
+    // signature or root hash that reaches the verifier is checked against bytes
+    // nobody sent.
+    requireHex(doc, "sth_root_hash", 32);
+    requireHex(doc, "signature", 64);
+    return doc;
+}
+function requireRfc3339(doc, field) {
+    const v = doc[field];
+    if (typeof v !== "string" || Number.isNaN(Date.parse(v))) {
+        throw new Error(`status statement: ${field} is not RFC 3339`);
+    }
+}
+function requireHex(doc, field, bytes) {
+    const v = doc[field];
+    if (typeof v !== "string" || !new RegExp(`^[0-9a-fA-F]{${bytes * 2}}$`).test(v)) {
+        throw new Error(`status statement: ${field} is not ${bytes} bytes of hex`);
+    }
+}
+//# sourceMappingURL=status-document.js.map

package/dist/esm/status-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-document.js","sourceRoot":"","sources":["../../src/status-document.ts"],"names":[],"mappings":"AAAA;;;6EAG6E;AAI7E;;;;;;;;;;;;;;;;8BAgB8B;AAC9B,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,GAAG,MAAyB,CAAC;IACpC,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1F,GAAG,GAAG,GAAG,CAAC,IAAuB,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9G,2EAA2E;IAC3E,4EAA4E;IAC5E,eAAe;IACf,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB,EAAE,KAAa;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,kBAAkB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB,EAAE,KAAa,EAAE,KAAa;IACpE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,KAAK,eAAe,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/esm/verify.d.ts

@@ -28,6 +28,9 @@ import type { TransparencyResult, VerificationResult } from "./models.js";
  * script on the page could otherwise push a version onto it.
  */
 export declare const KNOWN_FORMAT_VERSIONS: readonly string[];
+/** Decode hex: whole bytes, digits in either case, nothing else. Anything else
+ * throws TypeError. It is exported, so its input is a boundary: reading a stray
+ * character as 0, as it once did, turned a typo into different bytes. */
 export declare function hexToBytes(hex: string): Uint8Array;
 export declare function bytesToHex(bytes: Uint8Array): string;
 /** A signing key's disposition (ADR-017 §1).
@@ -110,8 +113,90 @@ export declare function evaluateKey(pki: PublicKeyInfo, anchor: number | null):
  */
 export declare function certificateAnchor(certificate: Record<string, unknown>): number | null;
 type Cert = Record<string, unknown>;
+/**
+ * Require what ADR-025 lets a record prove: that a key group you name signed the
+ * registration the enclave checked each system against before measuring it.
+ *
+ * A pass means each required system is `certified` under one of
+ * `customerKeyIds`, in a record from an enclave image of wire protocol 12 or
+ * later — the first that registers a system only with that key group's
+ * signatures. A record from an earlier image (PRE_PROTOCOL_12_IMAGES), or one
+ * that names no image, fails: those images could say `certified` with no
+ * customer signature at all.
+ *
+ * Off unless asked for, because a record that says `authorization: none` is
+ * still a genuine record. Whoever relays requests to the enclave can always
+ * leave a registration out (ADR-025 §5, §8), and the enclave cannot refuse that
+ * for want of durable state. So "my systems must be certified" can be enforced
+ * in one place only: here, by the party relying on the record.
+ */
+export interface AuthorizationPolicy {
+    /** The system_ids that must be certified. Omitted: every system the record covers. */
+    readonly systems?: readonly string[];
+    /**
+     * The key groups you accept. Required: `certified` under a key id you did not
+     * name proves nothing to you, because the relay can enroll a key group of its
+     * own and the record would name that one.
+     */
+    readonly customerKeyIds: readonly string[];
+}
+export interface VerifyOptions {
+    /**
+     * Refuse the record, with a VerificationError whose code is
+     * AUTHORIZATION_POLICY_FAILED, unless it meets this policy. Omitted: no
+     * requirement, and `authorization: none` verifies as it always has.
+     */
+    readonly requireAuthorization?: AuthorizationPolicy;
+}
+/**
+ * The enclave images that issued format 9.0 while running wire protocol 11 or
+ * earlier, by PCR0, as the published measurement history records them
+ * (website/docs/enclave-measurements/, docs/CONNECTOR-STATUS.md).
+ *
+ * Their `certified` is not evidence of a customer signature. Before protocol 12
+ * the enclave enrolled a key group with no proof that anyone held its keys, and
+ * registered a system for whoever relayed the authorization — so the host could
+ * make a genuine 9.0 record say `certified`, under a key id it chose, with no
+ * customer signature anywhere (reproduced by an independent re-review,
+ * 2026-09-13).
+ *
+ * THE SET IS CLOSED BY POLICY, NOT BY ENFORCEMENT: the release runbook forbids
+ * admitting or rolling back to an image of protocol 11 or earlier once any
+ * customer key is enrolled, and admitting one takes a KMS re-pin, which ADR-027
+ * leaves to the owner. The protocol-12 cutover's KMS tighten drops every
+ * measurement here from the signing key's policy, after which none of them can
+ * sign. v42 ran for seven minutes and is recorded as issuing nothing; it is here
+ * because it held the signing key while it ran.
+ *
+ * The Python SDK carries the same list, in _verify.py.
+ */
+export declare const PRE_PROTOCOL_12_IMAGES: ReadonlyMap<string, string>;
+/**
+ * What a record's signed issuer.enclave_pcr0 makes of `certified`: whether the
+ * image that signed it could mark a system certified without the customer's
+ * signature. "protocol-12-or-later" is the inference the closed list licenses:
+ * a genuine 9.0 record under any other measurement was signed by a later image.
+ */
+export type IssuingImage = {
+    readonly kind: "unnamed";
+} | {
+    readonly kind: "before-protocol-12";
+    readonly name: string;
+    readonly pcr0: string;
+} | {
+    readonly kind: "protocol-12-or-later";
+    readonly pcr0: string;
+};
+export declare function issuingImage(certificate: Cert): IssuingImage;
+/**
+ * What `certified` is evidence of, given the image that signed the record: the
+ * words every verifier prints after "certified under <key id> —". The Go CLI
+ * (cmd/cli/registration_image.go), both SDK CLIs and the /verify page state it
+ * identically, and testdata/registration_line_cases.json holds them to it.
+ */
+export declare function registrationQualifier(image: IssuingImage): string;
 /** Verify all signatures on a deletion certificate offline. */
-export declare function verifyCertificate(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>): Promise<VerificationResult>;
+export declare function verifyCertificate(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, options?: VerifyOptions): Promise<VerificationResult>;
 /** Verify the transparency proof embedded in a certificate. */
 export declare function verifyTransparency(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>): Promise<TransparencyResult>;
 /** Reconstruct the certificate JSON as it existed at issuance time.
@@ -125,6 +210,10 @@ export declare function verifyTransparency(crypto: CryptoOps, certificate: Cert,
  * verification (#C-01).
  */
 export declare function issuanceBytes(certificate: Cert): Uint8Array;
+/** Exported for tests/verify.test.ts, which keeps a second implementation of
+ * this and must be able to prove the two agree. Not re-exported from index.ts,
+ * so it stays off the published API. */
+export declare function canonicalJson(obj: unknown): Uint8Array;
 /** Normalize a certificate timestamp to the UTC form Go signs.
  *
  * Go builds every payload timestamp as `t.UTC().Format("2006-01-02T15:04:05Z")`
@@ -145,8 +234,11 @@ export declare function issuanceBytes(certificate: Cert): Uint8Array;
  * Exported from this module so the timestamp_vectors.json suite can diff it
  * against Go directly. It is deliberately not re-exported from index.ts, so it
  * is not part of the published package surface.
+ *
+ * `field` names the value in a refusal. It defaults to the word these messages
+ * always used, for callers normalizing a time that is not a field of a document.
  */
-export declare function formatTimestamp(ts: unknown): string;
+export declare function formatTimestamp(ts: unknown, field?: string): string;
 /**
  * Port of Go's BuildTreeHeadPayload.
  *
@@ -207,7 +299,24 @@ export declare const VALID_REVOCATION_UNKNOWN = "VALID_REVOCATION_UNKNOWN";
  *
  * The third row is the point: `verifyCertificate` answers VALID there, which
  * reads as "not revoked" and is not something it checked.
+ *
+ * `options` is passed to {@link verifyCertificate} unchanged.
+ */
+export declare function verifyCertificateWithStatus(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, status?: Record<string, unknown> | null, now?: Date, options?: VerifyOptions): Promise<string>;
+/**
+ * The statement half of {@link verifyCertificateWithStatus}: authenticate a
+ * status statement about `certificateId` against the published keys, and read
+ * it at `now`. The /verify page's QR lookup has a record id and no record, and
+ * uses this so it shows what a signed, fresh statement says, never what the
+ * status endpoint claims.
+ *
+ * | input | result |
+ * |---|---|
+ * | fresh, REVOKED | throws VerificationError, code CERTIFICATE_REVOKED |
+ * | fresh, ACTIVE | the statement key's verdict: `"VALID"`, or a soft one |
+ * | stale, or a status this SDK does not know | `"VALID_REVOCATION_UNKNOWN"` |
+ * | unknown or unusable key, bad signature, another certificate | throws VerificationError |
  */
-export declare function verifyCertificateWithStatus(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, status?: Record<string, unknown> | null, now?: Date): Promise<string>;
+export declare function verifyStatusStatement(crypto: CryptoOps, status: Record<string, unknown>, publicKeys: Map<string, PublicKeyInfo>, certificateId: unknown, now?: Date): Promise<string>;
 export {};
 //# sourceMappingURL=verify.d.ts.map

package/dist/esm/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAO7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAwE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAQjD,CAAC;AAqIH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CASlD;AAYD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQpD;AAoCD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;2DAEuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;8CAE0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CAqBxB;AAED,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AACzE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAoBnE;;;sEAGsE;AACtE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAyB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAUrF;AAiFD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,+DAA+D;AAC/D,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CA0H7B;AAKD,+DAA+D;AAC/D,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAwF7B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAK3D;AAoFD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,GAAG,MAAM,CAMnD;AAyaD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAW9E;AAqFD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAwDlB;AAGD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,UAAU,CAoBZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAqB5E;AAED,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CA8FjB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAQjD,CAAC;AAqIH;;yEAEyE;AACzE,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAQlD;AAaD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQpD;AAoCD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;2DAEuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;8CAE0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AACzE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAoBnE;;;sEAGsE;AACtE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAyB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAUrF;AAuFD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,mBAAmB,CAAC;CACrD;AAoCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAQ7D,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,wBAAgB,YAAY,CAAC,WAAW,EAAE,IAAI,GAAG,YAAY,CAQ5D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAmBjE;AA0ED,+DAA+D;AAC/D,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,kBAAkB,CAAC,CA+H7B;AAKD,+DAA+D;AAC/D,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAuF7B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAK3D;AAMD;;wCAEwC;AACxC,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAEtD;AA4HD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,SAAc,GAAG,MAAM,CAMxE;AAybD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAW9E;AAqFD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAwDlB;AAGD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,UAAU,CAuBZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAqB5E;AAED,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,EACV,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,aAAa,EAAE,OAAO,EACtB,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAoFjB"}