@bumail/mta-sts 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Steve Tsala
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,122 @@
-# Temporary Holding Version
+# @bumail/mta-sts
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+MTA-STS (RFC 8461) and SMTP TLS reporting (RFC 8460) as plain functions: read
+and write the `_mta-sts` and `_smtp._tls` TXT records, read and write the
+policy file, fetch a domain's policy over HTTPS with a `fetch` you give, and
+build the TLS report JSON. Nothing here touches the network on its own, and
+a parser answers a result instead of throwing. No dependency.
+
+**Bun only**, like every `@bumail/*` package: it runs on Bun 1.4.2 or later.
+
+```sh
+bun add @bumail/mta-sts
+```
+
+## The `_mta-sts` record
+
+```ts
+import { formatStsRecord, parseStsRecord } from '@bumail/mta-sts';
+
+parseStsRecord('v=STSv1; id=20160831085700Z');
+// { ok: true, value: { id: '20160831085700Z' } }
+parseStsRecord(['v=spf1 -all', 'v=STSv1; id=1', 'v=STSv1; id=2']);
+// { ok: false, error: { code: 'MULTIPLE_RECORDS', message: '…' } }
+
+formatStsRecord({ id: '20260103' }); // 'v=STSv1; id=20260103'
+```
+
+## The policy file
+
+```ts
+import { formatPolicy, parsePolicy } from '@bumail/mta-sts';
+
+const text = formatPolicy({ mode: 'testing', mx: ['mail.example.com', '*.example.net'], maxAge: 86400 });
+// 'version: STSv1\r\nmode: testing\r\nmx: mail.example.com\r\nmx: *.example.net\r\nmax_age: 86400\r\n'
+
+parsePolicy(text);
+// { ok: true, value: { version: 'STSv1', mode: 'testing', mx: [...], maxAge: 86400 } }
+```
+
+## Fetching a policy
+
+```ts
+import { fetchPolicy } from '@bumail/mta-sts';
+
+const result = await fetchPolicy('gmail.com', {
+	timeoutMs: 10_000, // default 60 000
+	maxAgeCap: 86400, // keep a peer's policy a day at most
+	signal: AbortSignal.timeout(30_000), // optional: give up early
+});
+if (result.ok) {
+	result.policy; // { mode, mx, maxAge (capped), … }
+	result.text; // the file as served, for a report
+} else {
+	result.error.code; // 'STATUS', 'TIMEOUT', 'CERTIFICATE', …
+	result.error.tlsResult; // 'sts-policy-fetch-error' | 'sts-policy-invalid' | 'sts-webpki-invalid'
+}
+```
+
+It reads `https://mta-sts.<domain>/.well-known/mta-sts.txt`, follows no
+redirect, accepts only `200` and `text/plain`, reads at most 64 KiB and gives
+up after 60 seconds. Whatever the network does, it answers a result; only
+an option out of range (`timeoutMs` not from 1 to 2147483647, `maxAgeCap` not a whole
+number from 0 to 31 557 600) throws `MtaStsError`, before any fetch.
+
+## The `_smtp._tls` record
+
+```ts
+import { formatTlsRptRecord, parseTlsRptRecord } from '@bumail/mta-sts';
+
+parseTlsRptRecord('v=TLSRPTv1; rua=mailto:tls@example.com,https://example.com/r');
+// { ok: true, value: { rua: ['mailto:tls@example.com', 'https://example.com/r'] } }
+// An entry of another scheme is left out; the record fails only when none is left.
+
+formatTlsRptRecord({ rua: ['mailto:tls@example.com'] }); // 'v=TLSRPTv1; rua=mailto:tls@example.com'
+// A raw ! or , in a URI throws: write them %21 and %2C (RFC 8460 §3).
+```
+
+## A TLS report
+
+```ts
+import { fetchPolicy, serialiseTlsReport, tlsReport } from '@bumail/mta-sts';
+
+const fetched = await fetchPolicy('gmail.com');
+
+const report = tlsReport({
+	organizationName: 'Example Mail',
+	contactInfo: 'tls@example.com',
+	reportId: crypto.randomUUID(),
+	dateRange: { start: new Date('2026-11-02T00:00:00Z'), end: new Date('2026-11-02T23:59:59Z') },
+	policies: [
+		{
+			policy: { type: 'sts', string: fetched.ok ? fetched.text : 'version: STSv1\nmode: none\nmax_age: 0\n', domain: 'gmail.com', mxHost: ['*.google.com'] },
+			summary: { success: 120, failure: 2 },
+			failureDetails: [{ resultType: 'certificate-expired', failedSessionCount: 2 }],
+		},
+	],
+});
+const json = serialiseTlsReport(report); // gzip it and send it to the `rua`: `@bumail/server` does (opt-in)
+```
+
+## API
+
+| Export | What it is |
+| --- | --- |
+| `parseStsRecord(txt)`, `formatStsRecord({ id })`, `StsRecord`, `StsRecordErrorCode`, `TxtAnswer` | the `_mta-sts` TXT record; `txt` is one string, or every TXT string or `@bumail/dns` `TxtRecord` of the name |
+| `parsePolicy(text)`, `formatPolicy(policy)`, `StsPolicy`, `PolicyErrorCode`, `MAX_AGE_LIMIT` | the policy file: `version`, `mode`, `mx`, `max_age` (0 to 31 557 600) |
+| `fetchPolicy(domain, options?)`, `FetchPolicyOptions`, `FetchPolicyResult`, `FetchPolicyError`, `FetchPolicyErrorCode`, `PolicyFetch`, `POLICY_TIMEOUT_MS`, `POLICY_MAX_BYTES` | the policy over HTTPS: `fetch`, `timeoutMs`, `maxAgeCap`, `signal` |
+| `parseTlsRptRecord(txt)`, `formatTlsRptRecord({ rua })`, `TlsRptRecord`, `TlsRptRecordErrorCode` | the `_smtp._tls` TXT record |
+| `tlsReport(input)`, `serialiseTlsReport(report)`, `TlsReportInput`, `TlsReportPolicy`, `TlsFailureDetail`, `TlsReport` | the RFC 8460 §4 report object (hyphenated keys), validated, and its JSON |
+| `TLS_RESULT_TYPES`, `TlsResultType` | the result types of RFC 8460 §4.3, the same union `@bumail/smtp` names |
+| `ParseResult`, `ParseFailure` | what every parser answers |
+| `MtaStsError`, `MtaStsErrorCode` | what a formatter, `tlsReport` or a bad `fetchPolicy` option throws: `INVALID_RECORD`, `INVALID_POLICY`, `INVALID_REPORT`, `INVALID_OPTION` |
+
+Matching an MX host against a policy's `mx` patterns is `matchesMxName` in
+`@bumail/smtp/client`, so there is one copy of that rule.
+
+## Documentation
+
+- [Index](https://github.com/softistx/bumail/blob/develop/packages/mta-sts/docs/README.md): the pages below, and when to read each.
+- [Guide](https://github.com/softistx/bumail/blob/develop/packages/mta-sts/docs/guide.md): publishing a policy, reading a peer's, the fetch rules and the report.
+- [Troubleshooting](https://github.com/softistx/bumail/blob/develop/packages/mta-sts/docs/troubleshooting.md): every error message, and what to do about it.
+- [Roadmap](https://github.com/softistx/bumail/blob/develop/packages/mta-sts/docs/roadmap.md): what is coming, and what is not planned.

package/dist/body.d.ts

@@ -0,0 +1,4 @@
+/** A policy is a few lines; RFC 8461 §3.2 caps it at 64 KiB. */
+export declare const POLICY_MAX_BYTES: number;
+export declare function readBody(response: Response): Promise<string>;
+//# sourceMappingURL=body.d.ts.map

package/dist/body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../src/body.ts"],"names":[],"mappings":"AAEA,gEAAgE;AAChE,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAE1C,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CA6ClE"}

package/dist/deadline.d.ts

@@ -0,0 +1,15 @@
+import { type Failure } from './fetch-error';
+export declare function aborted(): Failure;
+/**
+ * A deadline over one fetch: `signal` to give the injected `fetch`,
+ * `stopped`, which rejects with a `TIMEOUT` failure after `timeoutMs` or with
+ * the abort of the caller's `outer` signal, and `dispose`, which clears the
+ * timer and removes the listener. Race the work against `stopped`, so a
+ * `fetch` that ignores its signal is still cut off.
+ */
+export declare function withDeadline(outer: AbortSignal | undefined, timeoutMs: number): {
+    signal: AbortSignal;
+    stopped: Promise<never>;
+    dispose: () => void;
+};
+//# sourceMappingURL=deadline.d.ts.map

package/dist/deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.d.ts","sourceRoot":"","sources":["../src/deadline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAW,MAAM,eAAe,CAAC;AAEtD,wBAAgB,OAAO,IAAI,OAAO,CAEjC;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC3B,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,SAAS,EAAE,MAAM,GACf;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CA2BvE"}

package/dist/errors.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Why a formatter or the report builder refused its input. A parser never
+ * throws: it answers a {@link ParseResult}.
+ *
+ * - `INVALID_OPTION`: an option of `fetchPolicy` out of range;
+ * - `INVALID_RECORD`: a record to write that RFC 8461 §3.1 or RFC 8460 §3 cannot hold;
+ * - `INVALID_POLICY`: a policy to write that RFC 8461 §3.2 cannot hold;
+ * - `INVALID_REPORT`: a TLS report that RFC 8460 §4 cannot hold.
+ */
+export type MtaStsErrorCode = 'INVALID_OPTION' | 'INVALID_RECORD' | 'INVALID_POLICY' | 'INVALID_REPORT';
+export declare class MtaStsError extends Error {
+    readonly name = "MtaStsError";
+    readonly code: MtaStsErrorCode;
+    constructor(code: MtaStsErrorCode, message: string);
+}
+/** A parse that failed: a stable `code` to branch on and a `message` to log. */
+export interface ParseFailure<Code extends string> {
+    readonly code: Code;
+    readonly message: string;
+}
+/** What a parser answers: the value, or why the text is not one. */
+export type ParseResult<T, Code extends string> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: ParseFailure<Code>;
+};
+export declare function fail<Code extends string>(code: Code, message: string): {
+    readonly ok: false;
+    readonly error: ParseFailure<Code>;
+};
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACxB,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,CAAC;AAEpB,qBAAa,WAAY,SAAQ,KAAK;IACrC,SAAkB,IAAI,iBAAiB;IACvC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;gBAEnB,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAIlD;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY,CAAC,IAAI,SAAS,MAAM;IAChD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,oEAAoE;AACpE,MAAM,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,SAAS,MAAM,IAC3C;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AAE9D,wBAAgB,IAAI,CAAC,IAAI,SAAS,MAAM,EACvC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,GACb;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;CAAE,CAE5D"}

package/dist/fetch-error.d.ts

@@ -0,0 +1,17 @@
+import type { TlsResultType } from './tls-result';
+/** Why a policy could not be had; each maps to a result type of RFC 8460 §4.3 through {@link FetchPolicyError.tlsResult}. */
+export type FetchPolicyErrorCode = 'INVALID_DOMAIN' | 'NETWORK' | 'TIMEOUT' | 'CERTIFICATE' | 'REDIRECT' | 'STATUS' | 'CONTENT_TYPE' | 'TOO_LARGE' | 'NOT_UTF8' | 'INVALID_POLICY';
+export interface FetchPolicyError {
+    readonly code: FetchPolicyErrorCode;
+    readonly message: string;
+    /** The `result-type` a TLS report names this failure with. */
+    readonly tlsResult: Extract<TlsResultType, 'sts-policy-fetch-error' | 'sts-policy-invalid' | 'sts-webpki-invalid'>;
+}
+export declare class Failure extends Error {
+    readonly detail: FetchPolicyError;
+    constructor(detail: FetchPolicyError);
+}
+export declare function failure(code: FetchPolicyErrorCode, message: string): Failure;
+/** Whether a fetch rejection is a certificate refusal (Bun and Node put the code on the error or its cause). */
+export declare function isCertificateError(error: unknown): boolean;
+//# sourceMappingURL=fetch-error.d.ts.map

package/dist/fetch-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-error.d.ts","sourceRoot":"","sources":["../src/fetch-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,6HAA6H;AAC7H,MAAM,MAAM,oBAAoB,GAC7B,gBAAgB,GAChB,SAAS,GACT,SAAS,GACT,aAAa,GACb,UAAU,GACV,QAAQ,GACR,cAAc,GACd,WAAW,GACX,UAAU,GACV,gBAAgB,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAC1B,aAAa,EACb,wBAAwB,GAAG,oBAAoB,GAAG,oBAAoB,CACtE,CAAC;CACF;AAED,qBAAa,OAAQ,SAAQ,KAAK;IACrB,QAAQ,CAAC,MAAM,EAAE,gBAAgB;gBAAxB,MAAM,EAAE,gBAAgB;CAG7C;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ5E;AAcD,gHAAgH;AAChH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAe1D"}

package/dist/fetch.d.ts

@@ -0,0 +1,40 @@
+import { type FetchPolicyError } from './fetch-error';
+import { type StsPolicy } from './policy';
+export type FetchPolicyResult = {
+    readonly ok: true;
+    readonly policy: StsPolicy;
+    /** The policy file as served, for a report's `policy-string`. */
+    readonly text: string;
+} | {
+    readonly ok: false;
+    readonly error: FetchPolicyError;
+};
+/** The smallest `fetch` this package calls, so `globalThis.fetch` and a fake both fit. */
+export type PolicyFetch = (url: string, init: {
+    readonly redirect: 'manual';
+    readonly signal: AbortSignal;
+    readonly headers: Record<string, string>;
+}) => Promise<Response>;
+export interface FetchPolicyOptions {
+    /** Defaults to `globalThis.fetch`. */
+    readonly fetch?: PolicyFetch;
+    /** The whole fetch, body included: a number of milliseconds, above 0 and at most 2147483647. Default {@link POLICY_TIMEOUT_MS}. */
+    readonly timeoutMs?: number;
+    /** The most `max_age` the returned policy keeps: a whole number of seconds, 0 to {@link MAX_AGE_LIMIT}. Default {@link MAX_AGE_LIMIT}. */
+    readonly maxAgeCap?: number;
+    /** Gives up when it aborts: the answer is a `NETWORK` failure that says "aborted". */
+    readonly signal?: AbortSignal;
+}
+/** RFC 8461 §3.3 asks for a bounded fetch and fixes no figure; a 60-second default. */
+export declare const POLICY_TIMEOUT_MS = 60000;
+/**
+ * Fetch and read the policy of `domain` (RFC 8461 §3.3):
+ * `GET https://mta-sts.<domain>/.well-known/mta-sts.txt` over HTTPS with a
+ * valid certificate, no redirect followed, status 200, `text/plain`, at
+ * most 64 KiB, within `timeoutMs`. Whatever the network, the host or the
+ * injected `fetch` does, the answer is `{ ok: false, error }`, whose
+ * `tlsResult` is the type to report; only an option out of range (a
+ * programming error) throws `MtaStsError` `INVALID_OPTION`, before any fetch.
+ */
+export declare function fetchPolicy(domain: string, options?: FetchPolicyOptions): Promise<FetchPolicyResult>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAGA,OAAO,EAEN,KAAK,gBAAgB,EAGrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAA8B,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAEtE,MAAM,MAAM,iBAAiB,GAC1B;IACA,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACrB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE5D,0FAA0F;AAC1F,MAAM,MAAM,WAAW,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACL,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,KACG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IAClC,sCAAsC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B,mIAAmI;IACnI,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0IAA0I;IAC1I,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC9B;AAED,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAyFxC;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAqD5B"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { POLICY_MAX_BYTES } from './body';
+export { MtaStsError, type MtaStsErrorCode, type ParseFailure, type ParseResult, } from './errors';
+export { type FetchPolicyOptions, type FetchPolicyResult, fetchPolicy, POLICY_TIMEOUT_MS, type PolicyFetch, } from './fetch';
+export type { FetchPolicyError, FetchPolicyErrorCode } from './fetch-error';
+export { formatPolicy, MAX_AGE_LIMIT, type PolicyErrorCode, parsePolicy, type StsPolicy, } from './policy';
+export { serialiseTlsReport, type TlsFailureDetail, type TlsReport, type TlsReportInput, type TlsReportPolicy, tlsReport, } from './report';
+export { formatStsRecord, parseStsRecord, type StsRecord, type StsRecordErrorCode, } from './sts-record';
+export { TLS_RESULT_TYPES, type TlsResultType } from './tls-result';
+export { formatTlsRptRecord, parseTlsRptRecord, type TlsRptRecord, type TlsRptRecordErrorCode, } from './tls-rpt-record';
+export type { TxtAnswer } from './txt';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EACN,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,WAAW,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,WAAW,EACX,iBAAiB,EACjB,KAAK,WAAW,GAChB,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EACN,YAAY,EACZ,aAAa,EACb,KAAK,eAAe,EACpB,WAAW,EACX,KAAK,SAAS,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,SAAS,GACT,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,eAAe,EACf,cAAc,EACd,KAAK,SAAS,EACd,KAAK,kBAAkB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EACN,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,qBAAqB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC"}