@7h3/protocol 0.4.0 → 0.5.0

package/sdk/python/protocol_7h3/pq.py

@@ -0,0 +1,244 @@
+"""
+Post-quantum signatures for 7h3 Protocol.
+
+Provides ML-DSA-65 and ML-DSA-87 (formerly Dilithium3 / Dilithium5) via
+the dilithium-py pure-Python library.
+
+Install the dependency:
+    pip install dilithium-py
+
+Mapping:
+    ML-DSA-44  ≈  Dilithium2  (security category 2)
+    ML-DSA-65  ≈  Dilithium3  (security category 3)
+    ML-DSA-87  ≈  Dilithium5  (security category 5)
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import os
+import time
+from typing import Any, Dict, Optional, Tuple
+
+# ---------------------------------------------------------------------------
+# Optional dilithium-py backend
+# ---------------------------------------------------------------------------
+
+try:
+    from dilithium_py.dilithium import Dilithium2, Dilithium3, Dilithium5  # type: ignore[import]
+
+    _HAS_DILITHIUM = True
+except ImportError:
+    _HAS_DILITHIUM = False
+
+
+def _require_dilithium() -> None:
+    if not _HAS_DILITHIUM:
+        raise ImportError(
+            "dilithium-py is required for post-quantum signatures.\n"
+            "Install it with:\n\n"
+            "    pip install dilithium-py\n"
+        )
+
+
+# ---------------------------------------------------------------------------
+# Base64url helpers
+# ---------------------------------------------------------------------------
+
+
+def _to_b64url(data: bytes) -> str:
+    """Encode bytes to base64url without padding."""
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _from_b64url(value: str) -> bytes:
+    """Decode base64url (with or without padding)."""
+    padded = value + "=" * ((-len(value)) % 4)
+    return base64.urlsafe_b64decode(padded)
+
+
+# ---------------------------------------------------------------------------
+# Level → Dilithium implementation mapping
+# ---------------------------------------------------------------------------
+
+_LEVEL_MAP = {
+    44: "Dilithium2",
+    65: "Dilithium3",
+    87: "Dilithium5",
+}
+
+
+def _get_impl(level: int) -> Any:
+    """Return the Dilithium implementation for the given ML-DSA level."""
+    _require_dilithium()
+    if level == 44:
+        return Dilithium2
+    if level == 65:
+        return Dilithium3
+    if level == 87:
+        return Dilithium5
+    raise ValueError(f"Unsupported ML-DSA level: {level}. Use 44, 65, or 87.")
+
+
+def _alg_name(level: int) -> str:
+    if level == 44:
+        return "ML-DSA-44"
+    if level == 65:
+        return "ML-DSA-65"
+    if level == 87:
+        return "ML-DSA-87"
+    raise ValueError(f"Unsupported ML-DSA level: {level}")
+
+
+# ---------------------------------------------------------------------------
+# Canonicalization (mirrors TypeScript canonicalizeEnvelope)
+# ---------------------------------------------------------------------------
+
+
+def _canonicalize_envelope(envelope: Dict[str, Any]) -> str:
+    """Produce the canonical JSON string for signing (matches TS implementation)."""
+    header = envelope["header"]
+    body = envelope["body"]
+
+    # Build canonical header (sorted keys, only defined fields)
+    header_parts: list[str] = [
+        f'"messageId":{json.dumps(header["messageId"])}',
+        f'"nonce":{json.dumps(header["nonce"])}',
+    ]
+    if header.get("recipient") is not None:
+        header_parts.append(f'"recipient":{json.dumps(header["recipient"])}')
+    header_parts.append(f'"sender":{json.dumps(header["sender"])}')
+    header_parts.append(f'"timestampMs":{header["timestampMs"]}')
+    header_parts.append(f'"ttlMs":{header["ttlMs"]}')
+    header_parts.append(f'"version":{json.dumps(header["version"])}')
+    canonical_header = "{" + ",".join(header_parts) + "}"
+
+    # Build canonical body (sorted keys, only defined fields)
+    body_parts: list[str] = []
+    if body.get("capability") is not None:
+        body_parts.append(f'"capability":{json.dumps(body["capability"])}')
+    body_parts.append(f'"content":{json.dumps(body["content"])}')
+    if body.get("correlationId") is not None:
+        body_parts.append(f'"correlationId":{json.dumps(body["correlationId"])}')
+    body_parts.append(f'"intent":{json.dumps(body["intent"])}')
+    canonical_body = "{" + ",".join(body_parts) + "}"
+
+    return '{"body":' + canonical_body + ',"header":' + canonical_header + "}"
+
+
+# ---------------------------------------------------------------------------
+# Public API
+# ---------------------------------------------------------------------------
+
+
+def generate_ml_dsa_keypair(level: int = 65) -> Tuple[str, str]:
+    """
+    Generate a fresh ML-DSA keypair.
+
+    Parameters
+    ----------
+    level : int
+        Security level: 44 (≈ ML-DSA-44), 65 (≈ ML-DSA-65), 87 (≈ ML-DSA-87).
+        Default is 65.
+
+    Returns
+    -------
+    (public_key_b64url, secret_key_b64url) : tuple[str, str]
+        Both keys encoded as base64url without padding.
+    """
+    impl = _get_impl(level)
+    pk, sk = impl.keygen()
+    return _to_b64url(pk), _to_b64url(sk)
+
+
+def sign_envelope_pq(
+    envelope_dict: Dict[str, Any],
+    secret_key_b64url: str,
+    level: int = 65,
+) -> Dict[str, Any]:
+    """
+    Sign a protocol envelope dict with ML-DSA.
+
+    Parameters
+    ----------
+    envelope_dict : dict
+        Envelope with 'header' and 'body' keys. Any existing 'signature' is ignored.
+    secret_key_b64url : str
+        Base64url-encoded secret key (from generate_ml_dsa_keypair).
+    level : int
+        ML-DSA security level (44, 65, or 87). Default 65.
+
+    Returns
+    -------
+    dict
+        Copy of envelope_dict with 'signature' populated.
+    """
+    impl = _get_impl(level)
+    alg = _alg_name(level)
+
+    # Strip existing signature for canonicalization
+    unsigned = {k: v for k, v in envelope_dict.items() if k != "signature"}
+    canonical = _canonicalize_envelope(unsigned)
+    message = canonical.encode("utf-8")
+
+    sk = _from_b64url(secret_key_b64url)
+    sig_bytes = impl.sign(sk, message)
+    sig_b64url = _to_b64url(sig_bytes)
+    key_id = secret_key_b64url[:16]
+
+    return {
+        **unsigned,
+        "signature": {
+            "alg": alg,
+            "keyId": key_id,
+            "value": sig_b64url,
+        },
+    }
+
+
+def verify_envelope_pq(
+    envelope_dict: Dict[str, Any],
+    public_key_b64url: str,
+    level: Optional[int] = None,
+) -> bool:
+    """
+    Verify a ML-DSA-signed protocol envelope.
+
+    Parameters
+    ----------
+    envelope_dict : dict
+        Signed envelope with 'signature' key.
+    public_key_b64url : str
+        Base64url-encoded public key.
+    level : int or None
+        ML-DSA security level. If None, inferred from signature.alg field.
+
+    Returns
+    -------
+    bool
+        True if the signature is valid, False otherwise.
+    """
+    sig = envelope_dict.get("signature")
+    if not sig:
+        return False
+
+    alg: str = sig.get("alg", "")
+    if level is None:
+        # Infer level from alg field
+        _alg_to_level = {"ML-DSA-44": 44, "ML-DSA-65": 65, "ML-DSA-87": 87}
+        level = _alg_to_level.get(alg)
+        if level is None:
+            return False
+
+    impl = _get_impl(level)
+    unsigned = {k: v for k, v in envelope_dict.items() if k != "signature"}
+    canonical = _canonicalize_envelope(unsigned)
+    message = canonical.encode("utf-8")
+
+    pk = _from_b64url(public_key_b64url)
+    try:
+        sig_bytes = _from_b64url(sig["value"])
+        return bool(impl.verify(pk, message, sig_bytes))
+    except Exception:
+        return False

package/sdk/python/protocol_7h3/replay.py

@@ -0,0 +1,98 @@
+"""
+Redis-backed replay store for the 7h3 Protocol Python SDK.
+
+Provides atomic nonce deduplication using Redis SET NX PX semantics.
+The ``redis`` package is optional — an ImportError is raised at construction
+time (not at module import) when it is absent, so the rest of the SDK remains
+usable without installing Redis dependencies.
+"""
+
+from __future__ import annotations
+
+from typing import Optional, Any
+
+
+class RedisReplayStore:
+    """
+    Atomic replay detection backed by Redis.
+
+    Uses ``SET key value NX PX ttl_ms`` so the first caller atomically claims
+    the nonce and all subsequent callers are identified as replays — safe
+    across multiple horizontally-scaled gateway instances.
+
+    Parameters
+    ----------
+    redis_url:
+        Redis connection URL passed to ``redis.from_url()``.  Ignored when
+        *client* is provided.
+    key_prefix:
+        Namespace prefix prepended to every nonce key. Default ``'7h3:nonce:'``.
+    client:
+        Pre-constructed Redis client (any object that exposes ``set`` and
+        ``close``).  When supplied, *redis_url* is ignored.
+
+    Raises
+    ------
+    ImportError
+        At construction time when *redis_url* is provided but the ``redis``
+        package is not installed.
+    """
+
+    def __init__(
+        self,
+        redis_url: Optional[str] = None,
+        key_prefix: str = "7h3:nonce:",
+        client: Optional[Any] = None,
+    ) -> None:
+        self.key_prefix = key_prefix
+
+        if client is not None:
+            self._client = client
+        else:
+            try:
+                import redis  # type: ignore[import]
+            except ImportError as exc:
+                raise ImportError(
+                    "The 'redis' package is required to use RedisReplayStore. "
+                    "Install it with: pip install redis"
+                ) from exc
+
+            url = redis_url or "redis://localhost:6379"
+            self._client = redis.from_url(url, decode_responses=True)
+
+    def check(self, key: str, ttl_ms: int) -> bool:
+        """
+        Atomically check and register a nonce.
+
+        Returns
+        -------
+        bool
+            ``False`` if the nonce is fresh (first time seen — the key was set
+            in Redis), or ``True`` if the nonce is a replay (the key already
+            existed in Redis and SET NX was blocked).
+        """
+        redis_key = f"{self.key_prefix}{key}"
+        px = max(1, ttl_ms)
+        result = self._client.set(redis_key, "1", nx=True, px=px)
+        # redis-py returns True when the key was set, None when NX blocked it
+        return result is None
+
+    def close(self) -> None:
+        """Close the underlying Redis connection."""
+        close = getattr(self._client, "close", None)
+        if close is not None:
+            close()
+
+
+def create_redis_replay_store(redis_url: str, key_prefix: str = "7h3:nonce:") -> RedisReplayStore:
+    """
+    Convenience factory — create a :class:`RedisReplayStore` from a Redis URL.
+
+    Parameters
+    ----------
+    redis_url:
+        Redis connection URL, e.g. ``'redis://localhost:6379'``.
+    key_prefix:
+        Key namespace prefix. Default ``'7h3:nonce:'``.
+    """
+    return RedisReplayStore(redis_url=redis_url, key_prefix=key_prefix)

package/sdk/python/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "7h3-protocol"
-version = "0.4.0"
+version = "0.5.0"
 description = "7h3 Protocol — Python SDK. Deterministic, signed, replay-safe AI-to-AI messaging. Wire version 7h3/0.1."
 readme = "README.md"
 license = { text = "MIT" }

package/sdk/python/tests/test_encryption.py

@@ -0,0 +1,206 @@
+"""Tests for protocol_7h3.encryption — X25519 + ChaCha20-Poly1305 E2E encryption."""
+from __future__ import annotations
+
+import base64
+import json
+import time
+import unittest
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives import serialization
+
+from protocol_7h3.encryption import (
+    generate_x25519_keypair,
+    seal_envelope,
+    open_envelope,
+    _encrypt_body,
+    _decrypt_body,
+)
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _b64url_encode(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).decode("ascii").rstrip("=")
+
+
+def _generate_ed25519_keypair():
+    """Generate Ed25519 keypair in PKCS8/SPKI DER format (base64url) — matches TS protocol.ts."""
+    priv = Ed25519PrivateKey.generate()
+    pub = priv.public_key()
+    priv_der = priv.private_bytes(
+        serialization.Encoding.DER,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption(),
+    )
+    pub_der = pub.public_bytes(
+        serialization.Encoding.DER,
+        serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+    return _b64url_encode(priv_der), _b64url_encode(pub_der)
+
+
+def _make_envelope(body: dict) -> dict:
+    now_ms = int(time.time() * 1000)
+    return {
+        "header": {
+            "version": "7h3/0.1",
+            "messageId": f"msg-{now_ms}-test",
+            "timestampMs": now_ms,
+            "ttlMs": 60_000,
+            "sender": "agent-alice",
+            "recipient": "agent-bob",
+            "nonce": _b64url_encode(__import__("os").urandom(12)),
+        },
+        "body": body,
+    }
+
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+
+
+class TestGenerateX25519Keypair(unittest.TestCase):
+    """Test 1: generate_x25519_keypair returns 32-byte base64url keys."""
+
+    def test_key_format(self):
+        pub, priv = generate_x25519_keypair()
+        # base64url of 32 bytes = 43 chars (no padding)
+        self.assertRegex(pub, r"^[A-Za-z0-9_-]{43}$")
+        self.assertRegex(priv, r"^[A-Za-z0-9_-]{43}$")
+        # Decoded must be exactly 32 bytes
+        padding = "=" * ((4 - (len(pub) % 4)) % 4)
+        self.assertEqual(len(base64.urlsafe_b64decode(pub + padding)), 32)
+        padding = "=" * ((4 - (len(priv) % 4)) % 4)
+        self.assertEqual(len(base64.urlsafe_b64decode(priv + padding)), 32)
+
+
+class TestSealAndOpenEnvelope(unittest.TestCase):
+    """Test 2: sealEnvelope + openEnvelope round-trip recovers original body exactly."""
+
+    def test_round_trip(self):
+        recipient_pub, recipient_priv = generate_x25519_keypair()
+        sender_priv_ed, sender_pub_ed = _generate_ed25519_keypair()
+
+        original_body = {
+            "intent": "TASK",
+            "content": "Hello encrypted world!",
+            "capability": "some-cap",
+            "correlationId": "corr-123",
+        }
+        envelope = _make_envelope(original_body)
+
+        sealed = seal_envelope(envelope, recipient_pub, sender_priv_ed)
+        result = open_envelope(sealed, recipient_priv, sender_pub_ed)
+        body = result["body"]
+
+        self.assertEqual(body["intent"], original_body["intent"])
+        self.assertEqual(body["content"], original_body["content"])
+        self.assertEqual(body.get("capability"), original_body["capability"])
+        self.assertEqual(body.get("correlationId"), original_body["correlationId"])
+
+
+class TestWrongRecipientKey(unittest.TestCase):
+    """Test 3: fails with wrong recipient private key (AEAD tag mismatch)."""
+
+    def test_wrong_key_fails(self):
+        recipient_pub, _ = generate_x25519_keypair()
+        _, wrong_priv = generate_x25519_keypair()
+        sender_priv_ed, sender_pub_ed = _generate_ed25519_keypair()
+
+        envelope = _make_envelope({"intent": "PING", "content": "secret"})
+        sealed = seal_envelope(envelope, recipient_pub, sender_priv_ed)
+
+        # Use _decrypt_body directly to bypass signature check (wrong key scenario)
+        with self.assertRaises(Exception):
+            _decrypt_body(sealed["body"]["content"], wrong_priv)
+
+
+class TestTamperedSignature(unittest.TestCase):
+    """Test 4: fails if envelope signature is tampered."""
+
+    def test_tampered_signature(self):
+        recipient_pub, recipient_priv = generate_x25519_keypair()
+        sender_priv_ed, sender_pub_ed = _generate_ed25519_keypair()
+
+        envelope = _make_envelope({"intent": "PING", "content": "secret"})
+        sealed = seal_envelope(envelope, recipient_pub, sender_priv_ed)
+
+        # Tamper with signature
+        tampered = dict(sealed)
+        tampered["signature"] = dict(sealed["signature"])
+        tampered["signature"]["value"] = "A" * 86  # wrong Ed25519 sig
+
+        with self.assertRaises(ValueError) as ctx:
+            open_envelope(tampered, recipient_priv, sender_pub_ed)
+        self.assertIn("signature", str(ctx.exception).lower())
+
+
+class TestTamperedCiphertext(unittest.TestCase):
+    """Test 5: fails if ciphertext tampered (AEAD auth tag fails)."""
+
+    def test_tampered_ciphertext(self):
+        recipient_pub, recipient_priv = generate_x25519_keypair()
+
+        body = {"intent": "PING", "content": "secret"}
+        encrypted_payload_dict = _encrypt_body(body, recipient_pub)
+
+        # Flip bits in ciphertext
+        import base64
+        ct_bytes = bytearray(base64.urlsafe_b64decode(
+            encrypted_payload_dict["ciphertext"] + "=" * ((4 - len(encrypted_payload_dict["ciphertext"]) % 4) % 4)
+        ))
+        ct_bytes[0] ^= 0xFF
+        encrypted_payload_dict["ciphertext"] = base64.urlsafe_b64encode(bytes(ct_bytes)).decode().rstrip("=")
+
+        # Re-encode payload
+        tampered_content = _b64url_encode(
+            json.dumps(encrypted_payload_dict, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+        )
+
+        with self.assertRaises(Exception):
+            _decrypt_body(tampered_content, recipient_priv)
+
+
+class TestEphemeralRandomness(unittest.TestCase):
+    """Test 6: Two seal calls on same body produce different ciphertexts."""
+
+    def test_different_ciphertexts(self):
+        recipient_pub, _ = generate_x25519_keypair()
+        sender_priv_ed, _ = _generate_ed25519_keypair()
+
+        envelope1 = _make_envelope({"intent": "PING", "content": "same content"})
+        envelope2 = _make_envelope({"intent": "PING", "content": "same content"})
+
+        sealed1 = seal_envelope(envelope1, recipient_pub, sender_priv_ed)
+        sealed2 = seal_envelope(envelope2, recipient_pub, sender_priv_ed)
+
+        self.assertNotEqual(sealed1["body"]["content"], sealed2["body"]["content"])
+
+
+class TestEncryptedContentOpaque(unittest.TestCase):
+    """Test 7: Encrypted content is opaque (does not contain original body.content)."""
+
+    def test_content_is_opaque(self):
+        recipient_pub, _ = generate_x25519_keypair()
+        sender_priv_ed, _ = _generate_ed25519_keypair()
+
+        original_content = "super-secret-data-12345"
+        envelope = _make_envelope({"intent": "TASK", "content": original_content})
+
+        sealed = seal_envelope(envelope, recipient_pub, sender_priv_ed)
+
+        # The encrypted content (as JSON) should not reveal the original string
+        encrypted_content_decoded = base64.urlsafe_b64decode(
+            sealed["body"]["content"] + "=" * ((4 - len(sealed["body"]["content"]) % 4) % 4)
+        ).decode("utf-8")
+        self.assertNotIn(original_content, encrypted_content_decoded)
+        self.assertNotIn(original_content, sealed["body"]["content"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/sdk/rust/Cargo.lock

@@ -201,7 +201,7 @@ dependencies = [
 
 [[package]]
 name = "protocol-7h3"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "base64",
  "ed25519-dalek",

package/sdk/rust/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "protocol-7h3"
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
 description = "7h3 Protocol — Rust SDK. Deterministic, signed, replay-safe AI-to-AI messaging with TypeScript/Python parity. Wire version 7h3/0.1."
 license = "MIT"

package/sdk/threshold/index.d.ts

@@ -0,0 +1,68 @@
+export interface ProtocolHeader {
+    version: string;
+    messageId: string;
+    timestampMs: number;
+    ttlMs: number;
+    sender: string;
+    recipient?: string;
+    nonce: string;
+}
+export interface ProtocolBody {
+    intent: string;
+    content: string;
+    capability?: string;
+    correlationId?: string;
+}
+export interface ProtocolEnvelope {
+    header: ProtocolHeader;
+    body: ProtocolBody;
+}
+export interface BlsKeyPair {
+    publicKey: string;
+    privateKey: string;
+}
+export interface ThresholdConfig {
+    m: number;
+    n: number;
+}
+export interface ThresholdSignature {
+    alg: 'BLS-G2-2';
+    keyId: string;
+    value: string;
+    signerIds: string[];
+    threshold: ThresholdConfig;
+}
+export interface ThresholdEnvelope extends ProtocolEnvelope {
+    thresholdSignature: ThresholdSignature;
+}
+/**
+ * Canonical serialization of a protocol envelope for signing.
+ * Must match the canonical format in @7h3/protocol.
+ */
+export declare function canonicalizeEnvelopeForBls(envelope: ProtocolEnvelope): string;
+export declare function generateBlsKeyPair(): BlsKeyPair;
+export declare function signEnvelopeBls(envelope: ProtocolEnvelope, privateKeyBase64Url: string, signerId: string): Promise<{
+    signerId: string;
+    partialSig: string;
+    canonicalHash: string;
+}>;
+export declare function aggregateSignatures(partialSigs: Array<{
+    signerId: string;
+    partialSig: string;
+}>, publicKeys: Record<string, string>, // signerId → BLS public key (base64url)
+envelope: ProtocolEnvelope, config: ThresholdConfig): Promise<ThresholdEnvelope>;
+export declare function verifyThresholdEnvelope(envelope: ThresholdEnvelope, participantPublicKeys: Record<string, string>, config: ThresholdConfig): Promise<boolean>;
+/**
+ * Split a BLS private key into N shares using Shamir's Secret Sharing.
+ * Any M shares can reconstruct the original key.
+ * Returns N shares as base64url strings.
+ * Share format: 1 byte index (1-based) || 32 bytes value
+ */
+export declare function splitPrivateKey(privateKeyBase64Url: string, m: number, n: number): string[];
+/**
+ * Reconstruct a BLS private key from M or more shares using Lagrange interpolation.
+ * @param shares - array of share strings (base64url, at least m of them)
+ * @param m - minimum number of shares required (used for validation only)
+ */
+export declare function reconstructPrivateKey(shares: string[], m: number): string;
+//# sourceMappingURL=index.d.ts.map

package/sdk/threshold/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["src/index.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,IAAI,EAAE,YAAY,CAAA;CACnB;AAID,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;CACV;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,UAAU,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,kBAAkB,EAAE,kBAAkB,CAAA;CACvC;AAuBD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAyB7E;AAID,wBAAgB,kBAAkB,IAAI,UAAU,CAO/C;AAID,wBAAsB,eAAe,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAW1E;AAID,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5D,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAG,wCAAwC;AAC7E,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAkC5B;AAID,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,iBAAiB,EAC3B,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7C,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,OAAO,CAAC,CA2BlB;AA+DD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,mBAAmB,EAAE,MAAM,EAC3B,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,GACR,MAAM,EAAE,CA6BV;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAqCzE"}