run402 4.24.1 → 4.26.0

package/sdk/dist/namespaces/gitvault.crypto.d.ts

@@ -0,0 +1,319 @@
+/**
+ * gitvault — `r402s/v0` crypto core (protocol rev 40, §1 + §2; task 5.1).
+ *
+ * Pure, isomorphic (WebCrypto + noble + `@hpke/core`), no I/O. Everything
+ * byte-level the protocol pins lives here ONCE and is replayed against the
+ * frozen vector set (`gitvault.crypto.test.ts`):
+ *
+ *   - JCS (RFC 8785) for the no-JSON-numbers profile + the strict-parse profile
+ *   - the two hash rules: stored bytes (JCS INCLUDING `signature`) and the
+ *     signature preimage `"r402s/v0/" + object_kind + "\n" + JCS(object minus signature)`
+ *   - Ed25519 strict RFC 8032 — noble with `zip215: false` pinned; a
+ *     ZIP215-only signature is REJECTED (vector `zip215-002`)
+ *   - `lp` / `lp_opt` length prefixes + the open-id / open-binding preimages
+ *   - HKDF-SHA-256 `k_obj` / `K_digest` derivations and HMAC keyed commitments
+ *   - the XChaCha20-Poly1305 frame (`"R402S0"` ‖ suite byte ‖ 24-byte nonce ‖ ct‖tag)
+ *     with its seven-member JCS AAD
+ *   - the `key_envelope` HPKE seal/open (Base mode, DHKEM(X25519,HKDF-SHA256) /
+ *     HKDF-SHA256 / ChaCha20-Poly1305) with the EXACT D188 `info` / AAD bytes
+ *   - genesis key-binding + recovery-receipt checks
+ *
+ * Design rules carried from the protocol: HPKE is a NAMED implementation
+ * (`@hpke/core` + `@hpke/chacha20poly1305`), never assembled from primitives
+ * (D38); an envelope's signature is verified BEFORE any open; plain hashes of
+ * plaintext content never leave the client (every server-comparable digest is
+ * keyed); object ids are single-use key labels — callers MUST NOT re-encrypt
+ * under an id (retries read-and-compare).
+ */
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
+import { CipherSuite } from "@hpke/core";
+import type { GitvaultAllocation, GitvaultDigestLabel, GitvaultEncryptedObjectKind, GitvaultEncryptionKeypair, GitvaultEnvelopeAad, GitvaultFrameAad, GitvaultKeyEnvelope, GitvaultKeyEnvelopeReceipt, GitvaultObjectKind, GitvaultRecoveryReceipt, GitvaultSealedFrame, GitvaultSealedKeyEnvelope, GitvaultSignedObject, GitvaultSigningKeypair, GitvaultStrictParseReason, GitvaultVaultGenesis } from "./gitvault.types.js";
+/** Wire format tag (retained by decision D181 across the product rename). */
+export declare const GITVAULT_FORMAT: "r402s/v0";
+/** The one V0 cryptographic suite. */
+export declare const GITVAULT_SUITE: "r402s-1";
+/** Frame magic, bytes 0–5 of every encrypted object. */
+export declare const GITVAULT_FRAME_MAGIC: "R402S0";
+/** Frame suite byte (byte 6) and its two-char AAD spelling. */
+export declare const GITVAULT_FRAME_SUITE_BYTE: 1;
+export declare const GITVAULT_FRAME_SUITE_ID: "01";
+/** Protocol §2: max plaintext per encrypted object (256 MiB). */
+export declare const GITVAULT_MAX_PLAINTEXT_BYTES: number;
+/** The genesis generation / epoch constants (schema consts). */
+export declare const GITVAULT_GENESIS_GENERATION: "0000000000000000";
+export declare const GITVAULT_GENESIS_EPOCH: "0000000000000001";
+/** HPKE `info` label for `key_envelope` (D188). */
+export declare const GITVAULT_ENVELOPE_INFO_LABEL: "r402s/v0/envelope";
+/**
+ * The V0-A terminal-loss sentence — protocol §0 / client-surface spec. Doctor
+ * and status surfaces MUST state it verbatim while V0-A is current. Do not
+ * paraphrase; the wording is a reviewed product commitment.
+ */
+export declare const GITVAULT_TERMINAL_LOSS_STATEMENT: "whole-machine or whole-keystore loss is terminal for vault history until human envelopes ship";
+/** Protocol §0 sentence in full, as `doctor`/`status` print it. */
+export declare const GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT: string;
+export declare const GITVAULT_HEX16_RE: RegExp;
+export declare const GITVAULT_HEX32_RE: RegExp;
+export declare const GITVAULT_SHA256_RE: RegExp;
+export declare const GITVAULT_OID40_RE: RegExp;
+export declare const GITVAULT_VK_RE: RegExp;
+export declare const GITVAULT_EK_RE: RegExp;
+export declare const GITVAULT_SRC_RE: RegExp;
+export declare const GITVAULT_SERVICE_KEY_ID_RE: RegExp;
+export declare const GITVAULT_SIZE_BYTES_RE: RegExp;
+/** 32 bytes base64url: 43 chars, final char in the 16-value padding class. */
+export declare const GITVAULT_B64U_32_RE: RegExp;
+/** 64 bytes base64url: 86 chars, final char ∈ {A,Q,g,w}. */
+export declare const GITVAULT_B64U_64_RE: RegExp;
+/** The HPKE-sealed K_repo: 48 bytes = exactly 64 base64url chars. */
+export declare const GITVAULT_HPKE_CT_RE: RegExp;
+export declare const GITVAULT_TIMESTAMP_RE: RegExp;
+/** Canonical base64url (no padding, length mod 4 ≠ 1, zero trailing bits): decode→encode round-trips. */
+export declare function isCanonicalBase64url(value: string): boolean;
+/** Decode canonical base64url or throw (`GITVAULT_NONCANONICAL_BASE64URL`). */
+export declare function fromBase64url(value: string, field?: string): Uint8Array;
+export declare function toBase64url(bytes: Uint8Array): string;
+/** RFC 3339 UTC ms `Z` with semantic calendar validation (D187: `2026-02-31` and a non-leap Feb 29 are rejects). */
+export declare function isValidGitvaultTimestamp(value: string): boolean;
+/** Format a Date as the protocol timestamp grammar (RFC 3339 UTC, milliseconds, `Z`). */
+export declare function formatGitvaultTimestamp(date?: Date): string;
+/** `lp(x)` = 4-byte big-endian UTF-8 byte length ‖ UTF-8 bytes (protocol §1). */
+export declare function lp(value: string): Uint8Array;
+/** `lp_opt(null)` = `0x00`; `lp_opt(x)` = `0x01` ‖ `lp(x)`. */
+export declare function lpOpt(value: string | null): Uint8Array;
+export declare function sha256Hex(bytes: Uint8Array): string;
+/** CSPRNG bytes from the platform WebCrypto (protocol §2: all keys/nonces/ephemerals from the OS CSPRNG). */
+export declare function randomBytes(length: number): Uint8Array;
+/** A fresh `<prefix>_<32 lowercase hex>` id (protocol §1: ids are CSPRNG). */
+export declare function newGitvaultId(prefix: string): string;
+/** A fresh 32-lowercase-hex scalar (client_creation_id, capture_id, …). */
+export declare function newHex32(): string;
+/** RFC 8785 canonical JSON (no-numbers profile) as UTF-8 bytes. */
+export declare function jcs(value: unknown): Uint8Array;
+/** RFC 8785 canonical JSON as a string. */
+export declare function jcsString(value: unknown): string;
+/**
+ * The §1 strict-parse profile: reject ANY JSON number, duplicate members,
+ * invalid JSON, and any text that is not byte-for-byte the JCS of its value
+ * (member order, whitespace, escapes). Schema-awareness (unknown members,
+ * hex case, scalar lengths) is the caller's job.
+ */
+export declare function parseGitvaultStrict(text: string): unknown;
+/** Classify a strict-parse failure (for vector replay + diagnostics). */
+export declare function gitvaultStrictParseReason(error: unknown): GitvaultStrictParseReason | null;
+/** Stored bytes of a signed object = JCS of the COMPLETE object including `signature`. */
+export declare function storedBytes(object: GitvaultSignedObject): Uint8Array;
+/** SHA-256 over stored bytes — what every `*_sha256` naming a signed object means. */
+export declare function storedBytesSha256(object: GitvaultSignedObject): string;
+/** Signature preimage = `"r402s/v0/" + object_kind + "\n" + JCS(object without its single top-level signature)`. */
+export declare function signaturePreimage(objectKind: GitvaultObjectKind, objectWithoutSignature: Record<string, unknown>): Uint8Array;
+export declare function ed25519PublicKey(seed: Uint8Array): Uint8Array;
+export declare function ed25519Sign(message: Uint8Array, seed: Uint8Array): Uint8Array;
+/**
+ * Strict RFC 8032 verification: `zip215: false` is PINNED. Non-canonical R or A
+ * encodings, non-canonical S, and wrong-length inputs are all `false` — never
+ * an exception a caller could mistake for a transport error.
+ */
+export declare function ed25519VerifyStrict(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
+/** Sign an object under its `object_kind` domain; returns the complete signed object. */
+export declare function signGitvaultObject<T extends {
+    object_kind: GitvaultObjectKind;
+}>(objectWithoutSignature: T & {
+    signature?: never;
+}, seed: Uint8Array): T & {
+    signature: string;
+};
+/**
+ * Verify a signed object against a raw public key. Exact scalar lengths are
+ * checked FIRST (an 85-char signature or a 42-char key is a schema reject,
+ * never a decode-time surprise), then strict Ed25519 under the object's domain.
+ */
+export declare function verifyGitvaultObject(object: GitvaultSignedObject, publicKey: Uint8Array | string): boolean;
+/** Verify or throw `GITVAULT_SIGNATURE_INVALID`. */
+export declare function assertGitvaultSignature(object: GitvaultSignedObject, publicKey: Uint8Array | string, context?: string): void;
+/** First 16 bytes of SHA-256(raw pubkey), lowercase hex (32 chars). */
+export declare function keyFingerprintHex(rawPublicKey: Uint8Array): string;
+/** `vk_` fingerprint of a raw Ed25519 public key. */
+export declare function vkFingerprint(rawPublicKey: Uint8Array): string;
+/** `ek_` fingerprint of a raw X25519 public key. */
+export declare function ekFingerprint(rawPublicKey: Uint8Array): string;
+export declare function generateSigningKeypair(seed?: Uint8Array): GitvaultSigningKeypair;
+export declare function generateEncryptionKeypair(privateKey?: Uint8Array): GitvaultEncryptionKeypair;
+/** `k_obj` info = lp("r402s/v0") ‖ lp(suite) ‖ lp(repo_id) ‖ lp(epoch) ‖ lp(object_kind) ‖ lp(object_id) ‖ lp("L=32"). */
+export declare function objectKeyInfo(repoId: string, epoch: string, objectKind: GitvaultEncryptedObjectKind, objectId: string): Uint8Array;
+/** `k_obj = HKDF-SHA-256(ikm=K_repo, salt=∅, info, L=32)`. */
+export declare function deriveObjectKey(kRepo: Uint8Array, repoId: string, epoch: string, objectKind: GitvaultEncryptedObjectKind, objectId: string): Uint8Array;
+/** `K_digest` info = lp("r402s/v0") ‖ lp("r402s-1") ‖ lp(repo_id) ‖ lp(epoch) ‖ lp("digest") ‖ lp(label) ‖ lp("L=32"). */
+export declare function digestKeyInfo(repoId: string, epoch: string, label: GitvaultDigestLabel): Uint8Array;
+export declare function deriveDigestKey(kRepo: Uint8Array, repoId: string, epoch: string, label: GitvaultDigestLabel): Uint8Array;
+/** Commitment = HMAC-SHA-256(K_digest(label), JCS(content)), lowercase hex. */
+export declare function keyedCommitment(kDigest: Uint8Array, content: unknown): string;
+/** The `"objectset"` content shape: `{oids:[sorted unique lowercase 40-hex]}`. */
+export declare function objectsetContent(oids: Iterable<string>): {
+    oids: string[];
+};
+/** True iff an `objectset` content is already in canonical (sorted-unique) order. */
+export declare function isCanonicalObjectset(content: {
+    oids: string[];
+}): boolean;
+/** The `"snapshot_oid"` content shape. */
+export declare function snapshotOidContent(oid: string): {
+    oid: string;
+    format: "sha1";
+};
+/** `"r402s/v0/open-id" ‖ lp(org_id) ‖ lp(repo_id) ‖ lp(client_open_id)`. */
+export declare function openIdPreimage(orgId: string, repoId: string, clientOpenId: string): Uint8Array;
+/** `"r402s/v0/open-binding" ‖ lp(client_open_id) ‖ lp(base_head_sha256) ‖ lp_opt(prior) ‖ lp(requested_r2_cap_size_bytes)`. */
+export declare function openBindingPreimage(clientOpenId: string, baseHeadSha256: string, priorCheckpointClaimSetSha256: string | null, requestedR2CapSizeBytes: string): Uint8Array;
+/** The seven-member frame AAD, as the object JCS serializes. */
+export declare function frameAad(repoId: string, objectKind: GitvaultEncryptedObjectKind, objectId: string, epoch: string): GitvaultFrameAad;
+export interface GitvaultSealFrameInput {
+    /** The per-object key — derive with {@link deriveObjectKey}. */
+    k_obj: Uint8Array;
+    repo_id: string;
+    object_kind: GitvaultEncryptedObjectKind;
+    object_id: string;
+    epoch: string;
+    plaintext: Uint8Array;
+    /** 24-byte nonce; CSPRNG when omitted. Vectors inject it for determinism. */
+    nonce?: Uint8Array;
+}
+/**
+ * Seal a plaintext into the §2 frame: `"R402S0"` ‖ `0x01` ‖ nonce(24) ‖ ct‖tag.
+ * `ciphertext_sha256` covers the COMPLETE frame. Callers own the single-use
+ * rule: one object id, one seal — never re-encrypt under an id.
+ */
+export declare function sealFrame(input: GitvaultSealFrameInput): GitvaultSealedFrame;
+export interface GitvaultOpenFrameInput {
+    k_obj: Uint8Array;
+    repo_id: string;
+    object_kind: GitvaultEncryptedObjectKind;
+    object_id: string;
+    epoch: string;
+    frame: Uint8Array;
+    /** When given, the frame's SHA-256 must equal the receipt BEFORE any decryption (the header is authenticated twice: by the receipt and by the AAD). */
+    expected_ciphertext_sha256?: string;
+}
+/**
+ * Open a §2 frame: header checked (magic, suite byte, length), receipt
+ * compared when supplied, then the AEAD opened under the seven-member AAD.
+ * No unverified streaming release — the whole plaintext or nothing.
+ */
+export declare function openFrame(input: GitvaultOpenFrameInput): Uint8Array;
+/**
+ * The AEAD half of {@link openFrame} with the AAD supplied verbatim — the
+ * vector replay uses it to prove every one of the seven AAD members is
+ * authenticated (including the constant `suite`/`magic`/`suite_id` members
+ * that {@link openFrame}'s typed input cannot vary). Header already checked.
+ */
+export declare function openFrameWithAad(kObj: Uint8Array, frame: Uint8Array, aad: Uint8Array, objectId?: string): Uint8Array;
+/** The one `r402s-1` HPKE suite: Base mode, DHKEM(X25519,HKDF-SHA256) 0x0020 / HKDF-SHA256 0x0001 / ChaCha20-Poly1305 0x0003. */
+export declare function gitvaultHpkeSuite(): CipherSuite;
+/** HPKE `info` (D188): lp("r402s/v0/envelope") ‖ lp("r402s-1") ‖ lp(lowerhex(SHA-256(recipient raw X25519 pubkey))) ‖ lp(created_by). */
+export declare function envelopeInfo(recipientPublicKeyRaw: Uint8Array, createdBy: string): Uint8Array;
+/** HPKE AAD (D188): JCS of exactly `{repo_id, epoch, recipient_kind:"principal", recipient_fingerprint}`. */
+export declare function envelopeAad(repoId: string, epoch: string, recipientFingerprint: string): GitvaultEnvelopeAad;
+export interface GitvaultHpkeSealInput {
+    recipient_public_key: Uint8Array;
+    info: Uint8Array;
+    aad: Uint8Array;
+    plaintext: Uint8Array;
+    /** RFC 9180 §7.1.3 `DeriveKeyPair(ikmE)` injection — TEST/vector determinism only; production seals use the OS CSPRNG. */
+    ikm_e?: Uint8Array;
+}
+/** Single-shot HPKE seal (Base mode) returning `{enc, ct}`. */
+export declare function hpkeSeal(input: GitvaultHpkeSealInput): Promise<{
+    enc: Uint8Array;
+    ct: Uint8Array;
+}>;
+export interface GitvaultHpkeOpenInput {
+    recipient_private_key: Uint8Array;
+    enc: Uint8Array;
+    info: Uint8Array;
+    aad: Uint8Array;
+    ct: Uint8Array;
+}
+/** Single-shot HPKE open; any failure is `GITVAULT_HPKE_OPEN_FAILED` (never garbage plaintext). */
+export declare function hpkeOpen(input: GitvaultHpkeOpenInput): Promise<Uint8Array>;
+export interface GitvaultSealKeyEnvelopeInput {
+    /** The raw 32-byte K_repo — the ENTIRE plaintext. */
+    k_repo: Uint8Array;
+    repo_id: string;
+    epoch: string;
+    /** The recipient's raw X25519 public key. */
+    recipient_public_key: Uint8Array;
+    /** The creator's signing keypair; its `vk_` fingerprint becomes `created_by`. */
+    signer: GitvaultSigningKeypair;
+    created_at: string;
+    /** Vector determinism only. */
+    ikm_e?: Uint8Array;
+}
+/** Seal + sign a `key_envelope` for one principal; returns the object with its stored-bytes identity + genesis receipt. */
+export declare function sealKeyEnvelope(input: GitvaultSealKeyEnvelopeInput): Promise<GitvaultSealedKeyEnvelope>;
+export interface GitvaultOpenKeyEnvelopeInput {
+    envelope: GitvaultKeyEnvelope;
+    /** The recipient's raw X25519 keypair (the public half feeds `info`; the fingerprint must match the path identity). */
+    recipient: GitvaultEncryptionKeypair;
+    /** The creator's raw Ed25519 public key — the envelope signature is verified BEFORE any open. */
+    signer_public_key: Uint8Array | string;
+}
+/**
+ * Open a `key_envelope`: exact-scalar checks → signature (strict, domain
+ * `key_envelope`) → path identity (recipient fingerprint = ours) → HPKE open
+ * with the D188 info/AAD. Returns the raw 32-byte K_repo.
+ */
+export declare function openKeyEnvelope(input: GitvaultOpenKeyEnvelopeInput): Promise<Uint8Array>;
+export interface GitvaultBuildGenesisInput {
+    repo_id: string;
+    org_id: string;
+    project_id: string;
+    allocation_nonce: string;
+    creator_signing: GitvaultSigningKeypair;
+    creator_encryption_public_key: Uint8Array;
+    envelope_receipt: GitvaultKeyEnvelopeReceipt;
+    created_at: string;
+}
+/** Build + sign a `vault_genesis` (generation 0, epoch 1, the creator's single envelope). */
+export declare function buildVaultGenesis(input: GitvaultBuildGenesisInput): GitvaultVaultGenesis;
+/** A named genesis key-binding failure (semantic constraints `genesis-key-bindings` / `envelope-receipt-binding`). */
+export type GitvaultGenesisBindingProblem = "envelope_count" | "envelope_epoch" | "envelope_recipient_fingerprint" | "writer_key_id" | "stored_envelope_hash" | "stored_envelope_size" | "stored_envelope_repo_id" | "stored_envelope_epoch" | "stored_envelope_recipient_fingerprint" | "stored_envelope_created_by";
+/**
+ * The genesis key bindings (round-10 A6): exactly one envelope at epoch 1 whose
+ * `recipient_fingerprint` is the creator's `ek_`; `writer_key_id` is the
+ * creator's `vk_`; and, when the stored envelope is supplied, the receipt's
+ * hash/size name its stored bytes and its path identity + `created_by` equal
+ * the genesis values. Schema-valid-but-protocol-invalid objects surface here.
+ */
+export declare function checkGenesisKeyBindings(genesis: GitvaultVaultGenesis, storedEnvelope?: GitvaultKeyEnvelope): GitvaultGenesisBindingProblem[];
+export interface GitvaultBuildRecoveryReceiptInput {
+    repo_id: string;
+    org_id: string;
+    project_id: string;
+    genesis_sha256: string;
+    creator_signing: GitvaultSigningKeypair;
+    creator_encryption_public_key: Uint8Array;
+}
+/** Build + sign the creator's `recovery_receipt` (emitted at ACTIVE; integrity data, not a secret). */
+export declare function buildRecoveryReceipt(input: GitvaultBuildRecoveryReceiptInput): GitvaultRecoveryReceipt;
+export type GitvaultRecoveryReceiptProblem = "signature" | "genesis_sha256" | "repo_id" | "org_id" | "project_id" | "creator_signing_fingerprint" | "creator_encryption_fingerprint";
+/**
+ * Check a recovery receipt against a genesis it claims to pin: the receipt's
+ * signature (under the genesis's creator key), the genesis stored-bytes hash,
+ * and every identity field. A substituted, internally consistent vault fails
+ * on `genesis_sha256` — exactly the fabricated-vault scenario.
+ */
+export declare function checkRecoveryReceipt(receipt: GitvaultRecoveryReceipt, genesis: GitvaultVaultGenesis): GitvaultRecoveryReceiptProblem[];
+/**
+ * Field-level checks on an `allocation` for THIS creation attempt (the
+ * control-plane signature itself is verified through the service-key registry,
+ * which task 5.4 wires; pass `service_public_key` once it is pinned).
+ */
+export declare function checkAllocation(allocation: GitvaultAllocation, expected: {
+    client_creation_id: string;
+    creator_signing_fingerprint: string;
+    creator_encryption_fingerprint: string;
+    org_id: string;
+    project_id: string;
+}, servicePublicKey?: Uint8Array | string): string[];
+export { bytesToHex, hexToBytes };
+//# sourceMappingURL=gitvault.crypto.d.ts.map

package/sdk/dist/namespaces/gitvault.crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitvault.crypto.d.ts","sourceRoot":"","sources":["../../src/namespaces/gitvault.crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAQH,OAAO,EAAE,UAAU,EAAE,UAAU,EAA4B,MAAM,wBAAwB,CAAC;AAG1F,OAAO,EAAE,WAAW,EAAqC,MAAM,YAAY,CAAC;AAG5E,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAI7B,6EAA6E;AAC7E,eAAO,MAAM,eAAe,EAAG,UAAmB,CAAC;AACnD,sCAAsC;AACtC,eAAO,MAAM,cAAc,EAAG,SAAkB,CAAC;AACjD,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,EAAG,QAAiB,CAAC;AACtD,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,EAAG,CAAa,CAAC;AACvD,eAAO,MAAM,uBAAuB,EAAG,IAAa,CAAC;AACrD,iEAAiE;AACjE,eAAO,MAAM,4BAA4B,QAAoB,CAAC;AAC9D,gEAAgE;AAChE,eAAO,MAAM,2BAA2B,EAAG,kBAA2B,CAAC;AACvE,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAClE,mDAAmD;AACnD,eAAO,MAAM,4BAA4B,EAAG,mBAA4B,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAC3C,+FAAwG,CAAC;AAE3G,mEAAmE;AACnE,eAAO,MAAM,kCAAkC,QAI6B,CAAC;AAQ7E,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,kBAAkB,QAAmB,CAAC;AACnD,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,cAAc,QAAsB,CAAC;AAClD,eAAO,MAAM,cAAc,QAAsB,CAAC;AAClD,eAAO,MAAM,eAAe,QAAuB,CAAC;AACpD,eAAO,MAAM,0BAA0B,QAAyB,CAAC;AACjE,eAAO,MAAM,sBAAsB,QAA2B,CAAC;AAC/D,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,QAA0C,CAAC;AAC3E,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,QAA8B,CAAC;AAC/D,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,QACyE,CAAC;AAM5G,yGAAyG;AACzG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAO3D;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAU,GAAG,UAAU,CAKxE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAErD;AAED,oHAAoH;AACpH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ/D;AAED,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,IAAiB,GAAG,MAAM,CAEvE;AAID,iFAAiF;AACjF,wBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAM5C;AAED,+DAA+D;AAC/D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,UAAU,CAEtD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEnD;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAItD;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAyBD,mEAAmE;AACnE,wBAAgB,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAG9C;AAED,2CAA2C;AAC3C,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGhD;AA6BD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAazD;AAED,yEAAyE;AACzE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,GAAG,IAAI,CAM1F;AAID,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,MAAM,EAAE,oBAAoB,GAAG,UAAU,CAEpE;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAEtE;AAQD,oHAAoH;AACpH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAK7H;AAID,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAE7D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,CAE7E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAO9G;AAED,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,WAAW,EAAE,kBAAkB,CAAA;CAAE,EAC9E,sBAAsB,EAAE,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,EACjD,IAAI,EAAE,UAAU,GACf,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAG3B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAW1G;AAED,oDAAoD;AACpD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,EAAE,OAAO,SAAiC,GAAG,IAAI,CAIpJ;AAID,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,UAAU,GAAG,MAAM,CAElE;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,YAAY,EAAE,UAAU,GAAG,MAAM,CAE9D;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,YAAY,EAAE,UAAU,GAAG,MAAM,CAE9D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,GAAE,UAA4B,GAAG,sBAAsB,CAGjG;AAED,wBAAgB,yBAAyB,CAAC,UAAU,GAAE,UAA4B,GAAG,yBAAyB,CAG7G;AAID,0HAA0H;AAC1H,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAElI;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAEvJ;AAED,0HAA0H;AAC1H,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAEnG;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAExH;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAE7E;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAM3E;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAGzE;AAED,0CAA0C;AAC1C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAG/E;AAID,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU,CAE9F;AAED,+HAA+H;AAC/H,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EACtB,6BAA6B,EAAE,MAAM,GAAG,IAAI,EAC5C,uBAAuB,EAAE,MAAM,GAC9B,UAAU,CAQZ;AAID,gEAAgE;AAChE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAEnI;AAED,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,2BAA2B,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,UAAU,CAAC;IACtB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,sBAAsB,GAAG,mBAAmB,CAW5E;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,2BAA2B,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,uJAAuJ;IACvJ,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,sBAAsB,GAAG,UAAU,CAanE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,SAAM,GAAG,UAAU,CAWjH;AAMD,iIAAiI;AACjI,wBAAgB,iBAAiB,IAAI,WAAW,CAG/C;AAQD,yIAAyI;AACzI,wBAAgB,YAAY,CAAC,qBAAqB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAE7F;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,GAAG,mBAAmB,CAE5G;AAED,MAAM,WAAW,qBAAqB;IACpC,oBAAoB,EAAE,UAAU,CAAC;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,UAAU,CAAC;IAChB,SAAS,EAAE,UAAU,CAAC;IACtB,0HAA0H;IAC1H,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,+DAA+D;AAC/D,wBAAsB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,UAAU,CAAA;CAAE,CAAC,CAOzG;AAED,MAAM,WAAW,qBAAqB;IACpC,qBAAqB,EAAE,UAAU,CAAC;IAClC,GAAG,EAAE,UAAU,CAAC;IAChB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,UAAU,CAAC;IAChB,EAAE,EAAE,UAAU,CAAC;CAChB;AAED,mGAAmG;AACnG,wBAAsB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAShF;AAED,MAAM,WAAW,4BAA4B;IAC3C,qDAAqD;IACrD,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,oBAAoB,EAAE,UAAU,CAAC;IACjC,iFAAiF;IACjF,MAAM,EAAE,sBAAsB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,2HAA2H;AAC3H,wBAAsB,eAAe,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAmC7G;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,uHAAuH;IACvH,SAAS,EAAE,yBAAyB,CAAC;IACrC,iGAAiG;IACjG,iBAAiB,EAAE,UAAU,GAAG,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,UAAU,CAAC,CAmB9F;AAID,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,sBAAsB,CAAC;IACxC,6BAA6B,EAAE,UAAU,CAAC;IAC1C,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,oBAAoB,CAmBxF;AAED,sHAAsH;AACtH,MAAM,MAAM,6BAA6B,GACrC,gBAAgB,GAChB,gBAAgB,GAChB,gCAAgC,GAChC,eAAe,GACf,sBAAsB,GACtB,sBAAsB,GACtB,yBAAyB,GACzB,uBAAuB,GACvB,uCAAuC,GACvC,4BAA4B,CAAC;AAEjC;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,EAAE,cAAc,CAAC,EAAE,mBAAmB,GAAG,6BAA6B,EAAE,CAmB5I;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,sBAAsB,CAAC;IACxC,6BAA6B,EAAE,UAAU,CAAC;CAC3C;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iCAAiC,GAAG,uBAAuB,CAatG;AAED,MAAM,MAAM,8BAA8B,GACtC,WAAW,GACX,gBAAgB,GAChB,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,6BAA6B,GAC7B,gCAAgC,CAAC;AAErC;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,oBAAoB,GAAG,8BAA8B,EAAE,CAWtI;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,2BAA2B,EAAE,MAAM,CAAC;IAAC,8BAA8B,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EACzJ,gBAAgB,CAAC,EAAE,UAAU,GAAG,MAAM,GACrC,MAAM,EAAE,CAeV;AAED,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC"}