@agenttool/telescope 0.1.0

package/CLAUDE.md

@@ -0,0 +1,71 @@
+# @agenttool/telescope
+
+Read-only agent discovery evidence mapper. This package does not own hosted API
+routes, production egress, protocol invocation, npm publication, or the LOVE
+release inventory.
+
+## Commands
+
+```bash
+bun install --frozen-lockfile
+bun run ci
+node dist/cli.js scan api.agenttool.dev --json
+npm pack --ignore-scripts --dry-run
+```
+
+## Invariants
+
+- Keep the core at zero runtime dependencies and compatible with Node 20.19+
+  and Bun 1.3.5+.
+- Default scanning is bounded public HTTPS GET only. Never read ambient bearer,
+  cookie, npm, or project credentials.
+- DNS preflight is not socket pinning. Do not describe the native-fetch client
+  as DNS-rebinding-proof or suitable for a hosted arbitrary-URL scanner.
+- Fixed core probes are `/.well-known/agent.txt`, `/v1/pathways`,
+  `/.well-known/love-packages`, and `/.well-known/agent-card.json`. Follow only
+  a uniquely advertised MCP card and the explicit LOVE index → exact manifest
+  chain. Do not recursively crawl remote locators.
+- Preserve ordered `agent.txt` duplicates. Never silently overwrite or choose a
+  duplicated selected key.
+- Remote documents are tainted publisher assertions. Do not copy remote shell
+  commands, instructions, `latest`, or dist-tags into executable plans.
+- MCP and A2A cards are advertisements. Telescope performs no handshake,
+  initialization, task, tool, auth, feed, payment, or settlement call.
+- npm is a convenience action only when explicitly declared `authority: false`;
+  its exact version comes from the Pathways tutorial selection.
+- LOVE index and mirrors are locators. The manifest supplies an expected size
+  and SHA-256; only checking the same downloaded local file establishes that
+  content identity. Before generating package machinery, the verifier must also
+  reject unsafe/unsupported tar structure and bind embedded package name/version.
+  LOVE v1 does not authenticate a publisher.
+- Returned actions use validated locally reconstructed argv, remain
+  `automatic: false`, and require explicit consent. Telescope never executes
+  them or downloads artifacts during scan. npm plans disable lifecycle scripts,
+  audit submission, and funding output, while naming that dependency resolution
+  may still use caller-configured registry credentials.
+- Generated artifact retrieval has a finite 120-second fetch/body deadline but
+  does not repeat DNS preflight or pin the later connection to an address.
+- DNS-AID and PKARR remain opt-in caller adapters. Core claims neither DNSSEC
+  validation nor PKARR relay/signature behavior.
+- Human formatting must escape terminal and bidi controls. Core JSON reports do
+  not include remote bodies, request headers, caller/ambient credentials, or raw
+  exception text. Caller-owned adapters own their returned report facts and must
+  not put secrets in them; structural validation is not a credential classifier.
+  Rejected/query-bearing remote locators are omitted or explicitly redacted
+  rather than echoed as actionable URLs.
+- Keep the report schema, TypeScript report type, formatter, and tests aligned.
+- Keep the package version, `TOOL_VERSION`, User-Agent, tests, LOVE inventory,
+  and release tag aligned. Published version bytes are immutable: never rebuild
+  or replace an existing manifest/tarball under the same name and version.
+- External publication and deploy remain explicit operator actions. The
+  package implementation does not add a hosted scan route or own production
+  egress merely because its local client is publicly distributed.
+
+## Tests
+
+Hermetic tests inject fetch and DNS. Cover target policy, mixed DNS answers,
+manual redirects, byte/deadline budgets, duplicate `agent.txt`, exact Pathways
+selection, ignored `latest`, invalid manifests, MCP/A2A advertisement boundaries,
+shell-safe reconstruction, deterministic report ordering, CLI exits, and packed
+Node/Bun import/help. Live dogfood is evidence about one observation time, not a
+replacement for fixtures.

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,4 @@
+AgentTool
+Copyright 2026 AgentTool contributors
+
+This product includes software developed by AgentTool contributors.

package/README.md

@@ -0,0 +1,230 @@
+# @agenttool/telescope
+
+> A read-only evidence mapper for agent-facing discovery surfaces.
+
+Telescope accepts a public domain or HTTPS origin, performs a small bounded set
+of discovery GETs, and reports what was observed separately from what the
+publisher claims. It can reconstruct exact npm and LOVE install/verification
+commands from validated fields. It never executes those commands.
+
+The `0.1.0` release is distributed as an exact `love-package/v1` artifact and
+may be mirrored through GitHub Releases and npm. The LOVE manifest records the
+expected byte size and SHA-256; each mirror can be independently absent, so
+query the exact version instead of inferring availability from source or a
+mutable dist-tag. Telescope remains a local client—there is no hosted
+arbitrary-target scan route.
+
+Install an exact registry mirror when convenience matters:
+
+```bash
+npm install --save-exact @agenttool/telescope@0.1.0
+```
+
+Or use the release manifest and immutable LOVE tarball from
+<https://docs.agenttool.dev/packages> when explicit byte verification matters.
+
+## Try it locally
+
+```bash
+cd packages/telescope
+bun install --frozen-lockfile
+bun run ci
+node dist/cli.js scan api.agenttool.dev
+node dist/cli.js scan api.agenttool.dev --json
+```
+
+The domain shorthand is equivalent to an HTTPS origin:
+
+```bash
+agenttool-telescope agenttool.dev
+agenttool-telescope scan https://agenttool.dev --timeout-ms 10000
+```
+
+Verify an already-downloaded file without loading it all into memory:
+
+```bash
+agenttool-telescope verify-package ./package.tgz \
+  --size 120540 \
+  --sha256 defbed905af240503da6bad6f171d8e08159eeb16502c0abe0f603a12da09567 \
+  --name @agenttool/sdk \
+  --version 0.13.0
+```
+
+Exit `0` means a scan found at least one valid core surface, or a local file
+matched. Exit `1` means a scan was inconclusive, a verification mismatched, or
+a requested local operation failed. Exit `2` is invalid usage or target input.
+
+## What it observes
+
+The core performs these fixed root-origin probes:
+
+| Surface        | Probe                                               | Meaning of presence                                                                    |
+| -------------- | --------------------------------------------------- | -------------------------------------------------------------------------------------- |
+| agent manifest | `/.well-known/agent.txt`                            | Publisher-provided key/value discovery assertions                                      |
+| pathways       | `/v1/pathways`                                      | A publisher-scoped tutorial/release selection, when the supported shape is present     |
+| LOVE           | `/.well-known/love-packages`                        | A registry-neutral locator; the index and exact selected manifest may be followed      |
+| A2A            | `/.well-known/agent-card.json`                      | A card advertisement at the standard path, not proof of a working task transport       |
+| MCP            | the unique card URL advertised by valid `agent.txt` | Experimental publisher metadata, not proof of initialization, tools, or authentication |
+
+Telescope does not query WebFinger without an exact DID. It reports advertised
+WebFinger and Offer Bus locators but does not fetch feeds, invoke actions,
+settle offers, make payments, initialize MCP, or contact an A2A endpoint.
+
+`agent.txt` is parsed at the first colon. Ordered entries and duplicates are
+preserved by the parser; a duplicated selected key is reported as ambiguous and
+is not silently overwritten. Remote instructions and command templates are
+never executed or copied into action argv.
+
+## npm and LOVE plans
+
+When a supported Pathways response selects an exact SDK SemVer, Telescope
+reconstructs an npm convenience command from the validated package name and
+version. It does not consult `latest`, npm dist-tags, or an implicit registry
+query. The generated action is marked non-authoritative and says that npm does
+not independently check the LOVE manifest's size and SHA-256. Generated npm
+commands include `--ignore-scripts`, `--no-audit`, and `--no-fund`; importing or
+running installed package code is still execution and remains a separate trust
+decision. npm may still use caller-configured registry credentials to retrieve
+the selected package or declared dependencies; Telescope itself reads none.
+
+Telescope validates the manifest's runtime-engine field shape but does not
+evaluate the selected project's runtime compatibility. LOVE install actions
+carry `runtime_engine_compatibility_not_evaluated`; check the declared engine
+constraint in the target environment before installing or importing code.
+
+When LOVE discovery, the exact index entry, and its manifest all validate,
+Telescope emits three separate commands:
+
+1. Download one declared public-HTTPS mirror to the manifest's safe filename.
+2. Stream that same local file, check its exact byte length and SHA-256, reject
+   unsafe/unsupported tar entries, and bind embedded `package/package.json`
+   name/version to the manifest selection.
+3. Install that integrity- and archive-checked local tarball with lifecycle
+   scripts disabled.
+
+The manifest digest is only an expected content commitment until the artifact
+bytes match it. LOVE v1 does not itself authenticate a publisher, and a mirror
+URL is only a locator. Declared package dependencies may still resolve through
+the package manager's configured registry or cache.
+
+The generated Node download command does not follow redirects and applies a
+120-second fetch/body deadline. It also does not repeat Telescope's
+public-address DNS preflight or pin an address at later execution time, so DNS
+may have changed since the report. The exact size/SHA check remains mandatory;
+use a connection-pinned retrieval tool when that network boundary matters. Run
+the download in a caller-controlled directory. Its helper writes to an
+exclusively created random sibling, syncs complete bytes, then publishes the
+exact manifest filename with a no-overwrite hard link. A pre-existing file or
+symlink is refused; handled failures remove only the random partial. A hard
+process interruption can leave a random `.part-*` sibling, never a partial
+final filename.
+`verify-package` requires `agenttool-telescope` on `PATH` (use
+`node dist/cli.js verify-package ...` in a source checkout). Protect the
+file from replacement between verification and install, or re-run verification
+immediately before package machinery. The verifier opens one local file,
+checks its complete outer commitment before decompression, then re-hashes that
+same opened file while parsing the archive and requires stable file metadata.
+This is a point-in-time check, not a file lock or a guarantee about what a later
+package-manager process opens.
+
+Every action is returned as `{ executable, argv, display, display_shell }` with
+`automatic: false` and `requires_explicit_consent: true`. Programmatic callers
+should use `executable` plus `argv`. `display_shell: "posix"` names the quoting
+contract; the display string is not Windows `cmd.exe`/PowerShell syntax.
+
+## Network boundary
+
+Core requests are public HTTPS GETs with credentials omitted, manual redirects,
+per-document and aggregate byte limits, a total deadline, `Accept-Encoding:
+identity`, and DNS preflight that fails closed if any answer is private, local,
+documentation-only, or otherwise non-global.
+
+This is a local-client safety boundary, **not a universal SSRF guarantee**.
+Native `fetch` can resolve DNS again before connecting, so Telescope does not
+pin the validated address to the socket or verify the connected peer address.
+It also does not claim isolation from ambient proxy configuration. Do not expose
+the default transport as a hosted arbitrary-URL scanner. A hosted service would
+need connection-pinned egress enforcement, abuse controls, and a separate
+security review.
+
+Only public DNS names on standard HTTPS are accepted. Userinfo, IP literals,
+paths, queries, fragments, local/reserved names, and non-standard ports are
+rejected as scan targets. Response bodies are hashed for provenance but are not
+included in reports.
+
+## Evidence model
+
+The JSON schema is
+[`schema/agenttool-telescope-report-v0.1.schema.json`](schema/agenttool-telescope-report-v0.1.schema.json).
+Reports keep these ideas separate:
+
+- HTTPS transport observation versus publisher assertion.
+- A locator versus release selection versus expected content identity.
+- An advertised card versus a successfully invoked protocol.
+- Discovery versus authentication, authorization, consent, payment, or safety.
+
+There is deliberately no `trusted` boolean and no numeric trust score. HTTPS
+authenticates the connected domain under WebPKI; it does not prove that remote
+claims are true or benevolent.
+
+## Library
+
+```typescript
+import {
+  formatTelescopeReport,
+  inspectTarget,
+  verifyArtifact,
+} from "@agenttool/telescope";
+
+const report = await inspectTarget("api.agenttool.dev");
+console.log(formatTelescopeReport(report));
+
+const check = verifyArtifact(bytes, {
+  size: expectedSize,
+  sha256: expectedSha256,
+});
+```
+
+HTTP fetch, DNS lookup, time, abort signals, limits, and optional discovery
+adapters are injectable for deterministic or environment-specific operation.
+Reports name whether the native or an injected transport/resolver was selected.
+Injected transports, resolvers, and adapters are caller-owned code and own the
+behavior of their I/O seams. Adapter facts are included in the report after
+bounded structural validation; adapters must not return credentials or other
+secrets because Telescope cannot universally classify secret-looking content.
+
+## DNS-AID and PKARR
+
+Both are extension seams in the 0.1 release, not bundled protocol
+implementations:
+
+- Core Node/Bun DNS lookup does not establish DNSSEC validation, and DNS-AID is
+  still a changing draft. A future adapter must report secure, insecure, bogus,
+  and indeterminate validation states rather than treating a record as proof of
+  safe behavior.
+- The available PKARR JavaScript binding is pre-1.0 and contacts public relays
+  by default. Telescope therefore does not silently add it, contact relays,
+  generate keys, hold private keys, or publish packets. A valid PKARR signature
+  would bind bytes to a public key, not a person, DID, domain, benign service,
+  or consent.
+
+No discovery result grants installation, invocation, bearer use, settlement,
+payment, or consent.
+
+## Development
+
+```bash
+bun install --frozen-lockfile
+bun run typecheck
+bun test
+bun run build
+npm pack --ignore-scripts --dry-run
+```
+
+The package has no runtime dependencies or install lifecycle scripts. Unit
+tests inject all network behavior; live scanning is a separate dogfood check.
+The report schema is exported as
+`@agenttool/telescope/report.schema.json` for tooling that needs the exact
+bundled JSON Schema.
+
+Apache-2.0. See `LICENSE` and `NOTICE`.

package/dist/archive.d.ts

@@ -0,0 +1,22 @@
+import type { ArtifactExpectation } from "./verify.js";
+export interface NpmTarballExpectation extends ArtifactExpectation {
+    name: string;
+    version: string;
+}
+export interface NpmTarballInspectionResult {
+    ok: boolean;
+    code: "verified_npm_tarball" | "integrity_mismatch" | "invalid_or_unsupported_npm_tarball" | "embedded_package_identity_mismatch";
+    expected: NpmTarballExpectation;
+    actual: {
+        size: number | null;
+        sha256: string | null;
+    };
+    archive: {
+        entries: number | null;
+        package_name: string | null;
+        package_version: string | null;
+        install_lifecycle_scripts_present: boolean | null;
+    };
+}
+export declare function verifyNpmTarballFile(path: string, expected: NpmTarballExpectation): Promise<NpmTarballInspectionResult>;
+//# sourceMappingURL=archive.d.ts.map

package/dist/archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../src/archive.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAYvD,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EACA,sBAAsB,GACtB,oBAAoB,GACpB,oCAAoC,GACpC,oCAAoC,CAAC;IACzC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;IACF,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,iCAAiC,EAAE,OAAO,GAAG,IAAI,CAAC;KACnD,CAAC;CACH;AAyWD,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,0BAA0B,CAAC,CA2KrC"}