usertrust-verify 1.5.0 → 2.0.0

package/README.md

@@ -22,6 +22,38 @@ All hashes: valid (847/847)
 - **Head anchor** — the fsync'd `events.jsonl.meta` sidecar records the last hash and the total event count. The verifier fails if the log has been **truncated or deleted** (a shorter-but-internally-consistent chain no longer passes).
 - **Segment continuity** — a rotated vault (multiple `*.jsonl` segments) is verified as one continuous chain by sequence number; a missing whole segment is detected as a sequence gap.
 - **Merkle root** — recomputes the RFC 6962 root over the event hashes.
+- **External anchors** (optional) — binds the vault to Ed25519-signed checkpoints held in an append-only store the vault operator cannot rewrite. This upgrades the guarantee from *tamper-evident if you trust the operator's files* to **independently verifiable**: even a fully re-hashed, internally-consistent rewrite fails against the externally-held root.
+
+## Verify against external anchors
+
+You fetch the checkpoint(s) from the operator's append-only store yourself (`aws s3 cp`, `git show`, a SIEM export) and pin the vault's public key **out-of-band** — the verifier deliberately never reads trust material from the vault under audit, and works fully offline.
+
+```bash
+# Full checkpoint history (strongest)
+usertrust-verify .usertrust --anchors anchors.jsonl --pubkey root.pem
+
+# Single checkpoint via stdin
+aws s3 cp s3://…/000000000042.json - | usertrust-verify .usertrust --anchor - --pubkey root.pem
+
+# CI gate: externally anchored, fresh, verified — or exit 1
+usertrust-verify .usertrust --anchors anchors.jsonl --pubkey root.pem \
+  --require-anchor --require-external-anchor --max-unanchored-events 5000
+
+# Transparency-log receipts (repeatable; JSON or JSONL; - = stdin)
+usertrust-verify .usertrust --anchors anchors.jsonl --pubkey root.pem \
+  --rekor-receipts .usertrust/audit/anchors/rekor/000000000042.json
+
+# A self-hosted log needs its key pinned too (repeatable — any pinned key may verify)
+usertrust-verify .usertrust --anchors anchors.jsonl --pubkey root.pem \
+  --rekor-receipts receipts.jsonl --rekor-pubkey rekor-internal.pem
+
+# One operator-supplied handoff file: usertrust anchor export-bundle
+usertrust-verify .usertrust --bundle audit-bundle.json --pubkey root.pem
+```
+
+`--rekor-receipts` verification is offline and fail-closed: the signed-note checkpoint and its ECDSA P-256 signature, an RFC 9162 inclusion proof, and the binding of the log entry to your record all have to check out, or you get `ANCHOR_INVALID` (reason `rekor-receipt-invalid`) and exit 1. A verified receipt also makes `--max-anchor-age` measure against the log's attested `integratedTime` instead of the operator's own timestamp. Without `--rekor-pubkey`, the embedded rekor.sigstore.dev key is used **only** for receipts whose log host is `rekor.sigstore.dev`; any other log must be pinned explicitly. `--bundle` takes `{v:1, records, rekorReceipts}` and is parsed strictly — unknown fields, a version other than 1, or oversized lists are errors.
+
+Result states: `ANCHORED_VERIFIED`, `UNANCHORED` (legacy vaults — valid, weaker, labeled), `ANCHOR_UNVERIFIABLE`, `ANCHOR_STALE`, and the hard failures `ANCHOR_INVALID` / `ANCHOR_MISMATCH` (rewrite, rollback, deletion, or fork against the signed checkpoints — always exit 1). After a key rotation, keep pinning the original root key and pass the announced successor fingerprints with `--successor-pin`. See the [anchoring guide](https://github.com/usertools-ai/usertrust/blob/master/docs/anchoring.md) for the operator side.
 
 ## Exit codes (CI-safe)
 
@@ -55,6 +87,18 @@ if (!result.valid) {
 }
 ```
 
+With external anchors:
+
+```typescript
+import { verifyVaultWithAnchors, exitCodeForAnchored } from "usertrust-verify";
+
+const result = verifyVaultWithAnchors(".usertrust", {
+  externalAnchorsRaw: [anchorsJsonl],        // fetched by YOU, not by the verifier
+  trust: { rootPem: pinnedPublicKeyPem },    // pinned out-of-band, never from the vault
+});
+process.exit(exitCodeForAnchored(result, { requireExternalAnchor: true }));
+```
+
 `verifyVault` re-implements canonicalization and hashing independently of `usertrust` and must stay byte-for-byte identical to the writer — a differential test in the repo pins that invariant.
 
 ## License

package/dist/anchor-verify.d.ts

@@ -0,0 +1,229 @@
+/**
+ * External Anchor Verification — Zero-dependency standalone
+ *
+ * INTENTIONAL DUPLICATION: this file exists byte-for-byte in BOTH
+ * packages/verify/src/anchor-verify.ts and
+ * packages/core/src/audit/anchor-verify.ts — only the import paths differ.
+ * The anchor differential/parity tests pin the two together; any change must
+ * land in both packages.
+ *
+ * Verifies signed anchor checkpoints (spec: docs/superpowers/specs/
+ * 2026-07-26-external-anchoring-design.md) against a caller-pinned trust root:
+ *  - strict record parsing (unknown fields / range violations are INVALID)
+ *  - Ed25519 signature verification via node:crypto (ECDSA P-256 helper kept
+ *    alg-agile for Phase 2 transparency-log checkpoints)
+ *  - anchor-chain verification: prevAnchorHash linkage, anchorSeq contiguity,
+ *    key epochs via cross-signed rotation records, fork/duplicate semantics
+ *  - vault binding: Merkle root / head hash at each anchored treeSize, with
+ *    externally-bound consistency proofs between anchors
+ *  - the spec §7.2 state machine (UNANCHORED / ANCHORED_VERIFIED / ANCHOR_STALE
+ *    / ANCHOR_UNVERIFIABLE / ANCHOR_INVALID / ANCHOR_MISMATCH)
+ *
+ * Trust NEVER comes from the vault under audit: the caller pins the genesis
+ * root key (and optional rotation-successor pins) out-of-band.
+ */
+import { type KeyObject } from "node:crypto";
+import { type MerkleInclusionProof } from "./verify.js";
+export interface AnchorRotation {
+    readonly nextKeyId: string;
+    readonly nextPublicKeySpki: string;
+}
+export interface AnchorRecord {
+    readonly v: 1;
+    readonly vaultId: string;
+    readonly anchorSeq: number;
+    readonly prevAnchorHash: string;
+    readonly treeSize: number;
+    readonly lastHash: string;
+    readonly merkleRoot: string;
+    readonly timestamp: string;
+    readonly keyId: string;
+    readonly rotation?: AnchorRotation;
+    readonly sig: string;
+}
+/** Caller-pinned trust material. NEVER read from the vault under audit. */
+export interface AnchorTrust {
+    /** THE pinned genesis root key (PEM). anchorSeq 1 MUST verify under it. */
+    readonly rootPem: string;
+    /** Optional out-of-band pins for rotation successors. */
+    readonly successorPinsPem?: readonly string[];
+}
+export type AnchorState = "UNANCHORED" | "ANCHORED_VERIFIED" | "ANCHOR_STALE" | "ANCHOR_UNVERIFIABLE" | "ANCHOR_INVALID" | "ANCHOR_MISMATCH";
+export type AnchorSource = "external" | "vault-mirror" | "none";
+export type WitnessStatus = "agrees" | "disagrees" | "unreachable" | "not-consulted";
+export interface WitnessInput {
+    readonly requested: boolean;
+    readonly ok?: boolean;
+    readonly error?: string;
+}
+export interface AnchorEvaluationOptions {
+    readonly maxAnchorAgeMs?: number;
+    readonly maxUnanchoredEvents?: number;
+    readonly expectedVaultId?: string;
+    /** Injectable clock for tests. Defaults to Date.now(). */
+    readonly nowMs?: number;
+    /**
+     * Witness-attested integration time (ms) for the NEWEST anchor, from a
+     * transparency-log receipt the caller already verified. When present it
+     * replaces the operator-claimed timestamp as the input to --max-anchor-age:
+     * it is the one time in the record the vault operator cannot choose.
+     */
+    readonly attestedTimeMs?: number;
+}
+export interface AnchorEvaluationInput {
+    /** Globally sequence-ordered stored event hashes (verifyVault ordering). */
+    readonly orderedHashes: readonly string[];
+    /** Caller-fetched external anchor records (already parsed). */
+    readonly externalAnchors: readonly AnchorRecord[];
+    /** Parse errors from caller-supplied artifacts (fail-closed). */
+    readonly externalErrors: readonly string[];
+    /** Records from the vault-local mirror — CACHE, never a trust root alone. */
+    readonly mirrorAnchors: readonly AnchorRecord[];
+    readonly mirrorErrors: readonly string[];
+    readonly trust: AnchorTrust | null;
+    readonly witness: WitnessInput;
+    readonly opts?: AnchorEvaluationOptions;
+}
+export interface AnchorEvaluation {
+    anchorState: AnchorState;
+    /** false only on ANCHOR_INVALID / ANCHOR_MISMATCH. */
+    anchorsValid: boolean;
+    anchorSource: AnchorSource;
+    anchorCount: number;
+    latestAnchor: {
+        anchorSeq: number;
+        treeSize: number;
+        lastHash: string;
+        keyId: string;
+        timestamp: string;
+    } | null;
+    unanchoredTail: {
+        events: number;
+        sinceTimestampMs: number | null;
+    };
+    witness: {
+        requested: boolean;
+        status: WitnessStatus;
+        error?: string;
+    };
+    reasons: string[];
+    warnings: string[];
+    errors: string[];
+}
+/**
+ * Strict parse of a single anchor record. Unknown fields, missing fields, and
+ * range violations are all rejected (fail-closed — spec §3 strict-parse rules;
+ * range checks run BEFORE any Merkle primitive so a validly-signed-but-
+ * degenerate record yields a deterministic verdict, never a throw).
+ * Returns `{ record }` or `{ error }` with a code-prefixed message.
+ */
+export declare function parseAnchorRecord(raw: string): {
+    record: AnchorRecord | null;
+    error: string | null;
+};
+/** Parse a JSONL (or single-JSON) anchors artifact. Every line must parse. */
+export declare function parseAnchorsContent(content: string): {
+    records: AnchorRecord[];
+    errors: string[];
+};
+/** Signing pre-image = canonicalize(record − sig). Spec §3. */
+export declare function anchorSigningPreimage(record: AnchorRecord): string;
+/** sha256 hex of the signing pre-image — what the successor's prevAnchorHash carries. */
+export declare function anchorPayloadHash(record: AnchorRecord): string;
+export declare function keyIdFromSpkiDer(der: Buffer): string;
+export declare function publicKeyFromPem(pem: string): KeyObject | null;
+export declare function publicKeyFromSpkiBase64(b64: string): KeyObject | null;
+export declare function keyIdFromKeyObject(key: KeyObject): string;
+/**
+ * Raw signature verification over UTF-8 data. Ed25519 for usertrust anchor
+ * records; ECDSA P-256 kept alg-agile for Phase 2 transparency-log checkpoints
+ * (Rekor signs with ECDSA — spec reconciliation R2). Never throws.
+ */
+export declare function verifySignatureRaw(alg: "ed25519" | "ecdsa-p256", dataUtf8: string, publicKey: KeyObject, sigBase64: string): boolean;
+/**
+ * Verify one record's Ed25519 signature against explicit candidate keys.
+ * The candidate whose keyId matches the record's keyId is used; a record whose
+ * keyId matches none of the candidates fails with a distinct error.
+ */
+export declare function verifyAnchorSignature(record: AnchorRecord, candidateKeysPem: readonly string[]): {
+    ok: boolean;
+    keyId: string;
+    errors: string[];
+};
+/** Committed-field equality: everything except timestamp and sig. */
+export declare function committedFieldsEqual(a: AnchorRecord, b: AnchorRecord): boolean;
+/**
+ * Collapse same-anchorSeq records WITHIN one stream (store or mirror):
+ * identical committed content = benign duplicate (warn, keep first);
+ * divergent committed content = fork evidence (MISMATCH).
+ */
+export declare function dedupeAnchorSet(records: readonly AnchorRecord[]): {
+    unique: AnchorRecord[];
+    /** Committed-equal twins collapsed out — still signature-checked by the walk. */
+    dropped: AnchorRecord[];
+    warnings: string[];
+    errors: string[];
+    mismatchReasons: string[];
+};
+export interface AnchorChainResult {
+    /** anchorSeq-ordered records that entered the walk. */
+    records: AnchorRecord[];
+    errors: string[];
+    /** ANCHOR_INVALID-class reason codes. */
+    invalidReasons: string[];
+    /** ANCHOR_MISMATCH-class reason codes. */
+    mismatchReasons: string[];
+    warnings: string[];
+}
+/**
+ * Verify the anchor stream as its own hash chain under the pinned trust root:
+ * signatures per key epoch (rotations walked forward from the root),
+ * prevAnchorHash linkage from GENESIS, anchorSeq contiguity from 1, treeSize
+ * monotonicity, single vaultId, and — when event hashes are supplied —
+ * consistency binding between consecutive anchored roots. The proof's
+ * firstRoot/secondRoot are compared to the SIGNED roots before
+ * verifyConsistencyProof is called: the bare call checks only internal proof
+ * consistency and passes unconditionally on locally generated proofs
+ * (spec §7.2 — omitting the binding recreates F1).
+ *
+ * Callers pass a set already deduped per stream (dedupeAnchorSet); same-seq
+ * survivors here are treated as forks.
+ */
+export declare function verifyAnchorChain(records: readonly AnchorRecord[], trust: AnchorTrust, eventHashes?: readonly string[]): AnchorChainResult;
+/**
+ * Gather the globally sequence-ordered stored event hashes of a vault, using
+ * the exact segment-gathering and ordering semantics of verifyVault
+ * (events.jsonl first, then every other *.jsonl sorted; order by persisted
+ * global `sequence` when every event has one, else file order). Malformed
+ * lines are skipped here — chain-level errors are verifyVault's job, not the
+ * anchor evaluator's.
+ */
+export declare function gatherOrderedEventHashes(vaultPath: string): string[];
+/** Read the vault-local anchor mirror (cache, never a trust root alone). */
+export declare function readAnchorMirror(vaultPath: string): {
+    records: AnchorRecord[];
+    errors: string[];
+};
+/**
+ * The more severe of two states. Exported so callers layering evidence ON TOP
+ * of the state machine (the glue's Rekor receipts) escalate by the SAME
+ * severity ordering the machine itself uses, rather than hardcoding one.
+ */
+export declare function worseAnchorState(a: AnchorState, b: AnchorState): AnchorState;
+/**
+ * The spec §7.2 state machine. Pure function over gathered inputs so both
+ * packages (and the differential test) evaluate identically. Evaluation order
+ * per constraints §4.2: discover → trust check → parse/signature → content
+ * cross-checks → freshness; worst state wins. The witness-fetch-failure rule
+ * (AC-2.4) caps the state below ANCHORED_VERIFIED without discarding
+ * caller-supplied artifacts.
+ */
+export declare function evaluateAnchoredVault(input: AnchorEvaluationInput): AnchorEvaluation;
+/**
+ * Verify a Merkle inclusion proof against a SIGNED EXTERNAL anchor record —
+ * root and treeSize come from the record, never recomputed from the events
+ * under check (spec §7.1; closes F1). The record must verify under the pinned
+ * root or a supplied successor pin.
+ */
+export declare function verifyInclusionAgainstAnchor(proof: MerkleInclusionProof, record: AnchorRecord, trust: AnchorTrust): boolean;
+//# sourceMappingURL=anchor-verify.d.ts.map

package/dist/anchor-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-verify.d.ts","sourceRoot":"","sources":["../src/anchor-verify.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAuD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAKlG,OAAO,EAGN,KAAK,oBAAoB,EAGzB,MAAM,aAAa,CAAC;AAIrB,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED,MAAM,MAAM,WAAW,GACpB,YAAY,GACZ,mBAAmB,GACnB,cAAc,GACd,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,CAAC;AAErB,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,cAAc,GAAG,MAAM,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,GAAG,eAAe,CAAC;AAErF,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,EAAE,SAAS,YAAY,EAAE,CAAC;IAClD,iEAAiE;IACjE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,uBAAuB,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAChC,WAAW,EAAE,WAAW,CAAC;IACzB,sDAAsD;IACtD,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KAClB,GAAG,IAAI,CAAC;IACT,cAAc,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpE,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB;AAuDD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG;IAC/C,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,CAoFA;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG;IACrD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB,CAgBA;AAID,+DAA+D;AAC/D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAGlE;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAE9D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAM9D;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAMrE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,SAAS,GAAG,YAAY,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,MAAM,GACf,OAAO,CAeT;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,YAAY,EACpB,gBAAgB,EAAE,SAAS,MAAM,EAAE,GACjC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAiBlD;AAID,qEAAqE;AACrE,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,GAAG,OAAO,CAM9E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG;IAClE,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,iFAAiF;IACjF,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC1B,CAyBA;AAID,MAAM,WAAW,iBAAiB;IACjC,uDAAuD;IACvD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yCAAyC;IACzC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,0CAA0C;IAC1C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,KAAK,EAAE,WAAW,EAClB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,iBAAiB,CAqNnB;AAID;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CA4CpE;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG;IACpD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB,CAQA;AAaD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,GAAG,WAAW,CAE5E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,gBAAgB,CAgPpF;AAID;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC3C,KAAK,EAAE,oBAAoB,EAC3B,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,GAChB,OAAO,CAIT"}