@cello-protocol/protocol-types 0.0.2

package/dist/connection-package.d.ts

@@ -0,0 +1,362 @@
+/**
+ * @cello-protocol/protocol-types — CELLO-CONNREQ-001
+ * Connection package wire types, CBOR encoding/decoding, and validation.
+ *
+ * ──── Phase P: Pseudocode ────
+ *
+ * Connection package structure (CBOR map):
+ *   {
+ *     pseudonym_binding: PseudonymBinding,
+ *     endorsements:      Endorsement[],
+ *     attestations:      Attestation[],
+ *   }
+ *
+ * PseudonymBinding construction:
+ *   1. Validate pseudonym_label ≤ 64 UTF-8 bytes
+ *   2. Fetch ml_dsa_pubkey from keyProvider.getPublicKey()
+ *   3. Build TBS positional array:
+ *      [pseudonym_label, k_local_pubkey, primary_pubkey, ml_dsa_pubkey, created_at]
+ *      canonical CBOR per RFC 8949 §4.2.1 (Encoder({tagUint8Array: false}))
+ *   4. ml_dsa_signature = await keyProvider.sign(TBS_bytes)  [ML-DSA, NIST FIPS 204]
+ *   5. Return PseudonymBinding with all six fields
+ *
+ * PseudonymBinding verification:
+ *   1. Rebuild TBS same as above (excluding ml_dsa_signature)
+ *   2. mlDsaVerify(ml_dsa_pubkey, TBS_bytes, ml_dsa_signature) → boolean
+ *
+ * Endorsement TBS = canonical CBOR of all fields except endorser_ml_dsa_signature:
+ *   [endorser_pubkey, endorser_ml_dsa_pubkey, target_pubkey, endorsement_type,
+ *    created_at, expires_at]
+ *
+ * Attestation TBS = canonical CBOR of all fields except attester_ml_dsa_signature:
+ *   [attester_pubkey, attester_ml_dsa_pubkey, attestation_type, attestation_data,
+ *    created_at, expires_at]
+ *
+ * Validation logic:
+ *   1. Verify pseudonym_binding signature → if invalid, return { valid: false, reason: 'pseudonym_binding_invalid' }
+ *   2. Validate pseudonym_label byte length → if > 64, return { valid: false, reason: 'pseudonym_label_too_long' }
+ *      NOTE: label length is checked at build time; but validation also checks in case
+ *      a tampered package is passed directly to validateConnectionPackage.
+ *   3. For each endorsement:
+ *      a. Verify endorser_ml_dsa_signature → if invalid, mark 'signature_invalid'
+ *      b. Else if expires_at <= current_timestamp_ms → mark 'expired'
+ *      c. Else if target_pubkey ≠ sender_k_local_pubkey → mark 'target_mismatch'
+ *      d. Else → mark 'valid'
+ *   4. For each attestation:
+ *      a. Verify attester_ml_dsa_signature → if invalid, mark 'signature_invalid'
+ *      b. Else if expires_at <= current_timestamp_ms → mark 'expired'
+ *      c. Else → mark 'valid'
+ *   5. Return { valid: true, pseudonym_binding, endorsements: [...], attestations: [...] }
+ *
+ * IMPORTANT: Items 3 and 4 are per-item — a bad endorsement does NOT reject the package.
+ *            Only a bad pseudonym_binding rejects the whole package.
+ *
+ * Canonical CBOR encoding (RFC 8949 §4.2.1):
+ *   - All byte arrays as CBOR major-type-2 byte strings (tagUint8Array: false)
+ *   - Integers use shortest encoding; BigInt for timestamps > 0xFFFFFFFF
+ *   - Map keys are text strings in deterministic order (cbor-x preserves insertion order)
+ *
+ * References:
+ *   RFC 8949 §4.2.1 — Core Deterministic Encoding Requirements
+ *   NIST FIPS 204 — Module-Lattice-Based Digital Signature Standard (ML-DSA)
+ */
+/**
+ * ML-DSA-44 key provider interface.
+ *
+ * Defined here (not imported from @cello-protocol/crypto) because protocol-types is a leaf
+ * package that @cello-protocol/crypto will import from, not the reverse.
+ *
+ * The crypto package's InMemoryMlDsaKeyProvider and FileMlDsaKeyProvider will
+ * implement this interface.
+ *
+ * Key sizes for ML-DSA-44 (NIST FIPS 204):
+ *   - Public key:  1312 bytes
+ *   - Signature:   2420 bytes
+ */
+export interface MlDsaKeyProvider {
+    /** Returns the 1312-byte ML-DSA-44 public key. */
+    getPublicKey(): Promise<Uint8Array>;
+    /** Signs the message; returns a 2420-byte ML-DSA-44 signature. */
+    sign(message: Uint8Array): Promise<Uint8Array>;
+}
+/**
+ * Pseudonym binding: anchors the agent's pseudonym label to their cryptographic identity.
+ *
+ * ML-DSA signature is over canonical CBOR of:
+ *   [pseudonym_label, k_local_pubkey, primary_pubkey, ml_dsa_pubkey, created_at]
+ * (positional array, same pattern as existing TBS arrays in this package)
+ *
+ * NIST FIPS 204 — ML-DSA-44
+ */
+export interface PseudonymBinding {
+    /** Stable human-readable identity label; max 64 UTF-8 bytes. */
+    pseudonym_label: string;
+    /** 32-byte Ed25519 K_local public key of the agent. */
+    k_local_pubkey: Uint8Array;
+    /** FROST group public key of the agent (primary_pubkey from CONTEXT.md). */
+    primary_pubkey: Uint8Array;
+    /** 1312-byte ML-DSA-44 public key. */
+    ml_dsa_pubkey: Uint8Array;
+    /** Unix milliseconds when the binding was created. */
+    created_at: number;
+    /**
+     * 2420-byte ML-DSA-44 signature over canonical CBOR of:
+     * [pseudonym_label, k_local_pubkey, primary_pubkey, ml_dsa_pubkey, created_at]
+     */
+    ml_dsa_signature: Uint8Array;
+}
+/**
+ * Endorsement: a third-party voucher for the agent.
+ *
+ * ML-DSA signature is over canonical CBOR of all fields except endorser_ml_dsa_signature.
+ *
+ * NIST FIPS 204 — ML-DSA-44
+ */
+export interface Endorsement {
+    /** 32-byte Ed25519 public key of the endorser. */
+    endorser_pubkey: Uint8Array;
+    /** 1312-byte ML-DSA-44 public key of the endorser. */
+    endorser_ml_dsa_pubkey: Uint8Array;
+    /**
+     * 32-byte Ed25519 public key this endorsement targets.
+     * Must match the sender's k_local_pubkey for 'valid' status.
+     */
+    target_pubkey: Uint8Array;
+    /** Endorsement type string (e.g. "peer_trust", "organizational"). */
+    endorsement_type: string;
+    /** Unix milliseconds when endorsement was created. */
+    created_at: number;
+    /** Unix milliseconds when endorsement expires. */
+    expires_at: number;
+    /**
+     * 2420-byte ML-DSA-44 signature over canonical CBOR of:
+     * [endorser_pubkey, endorser_ml_dsa_pubkey, target_pubkey, endorsement_type, created_at, expires_at]
+     */
+    endorser_ml_dsa_signature: Uint8Array;
+}
+/**
+ * Attestation: a self-describing claim about the agent.
+ *
+ * ML-DSA signature is over canonical CBOR of all fields except attester_ml_dsa_signature.
+ *
+ * NIST FIPS 204 — ML-DSA-44
+ */
+export interface Attestation {
+    /** 32-byte Ed25519 public key of the attester. */
+    attester_pubkey: Uint8Array;
+    /** 1312-byte ML-DSA-44 public key of the attester. */
+    attester_ml_dsa_pubkey: Uint8Array;
+    /** Attestation type string (e.g. "capability", "audit_log"). */
+    attestation_type: string;
+    /** Opaque attestation payload bytes. */
+    attestation_data: Uint8Array;
+    /** Unix milliseconds when attestation was created. */
+    created_at: number;
+    /** Unix milliseconds when attestation expires. */
+    expires_at: number;
+    /**
+     * 2420-byte ML-DSA-44 signature over canonical CBOR of:
+     * [attester_pubkey, attester_ml_dsa_pubkey, attestation_type, attestation_data, created_at, expires_at]
+     */
+    attester_ml_dsa_signature: Uint8Array;
+}
+/**
+ * Full connection package presented during a connection request.
+ * Each agent decides how many endorsements/attestations to include; receivers
+ * cannot infer how many items were withheld.
+ */
+export interface ConnectionPackage {
+    pseudonym_binding: PseudonymBinding;
+    endorsements: Endorsement[];
+    attestations: Attestation[];
+}
+/** Per-endorsement validation status. */
+export type EndorsementValidationStatus = "valid" | "expired" | "signature_invalid" | "target_mismatch";
+/** Per-attestation validation status. */
+export type AttestationValidationStatus = "valid" | "expired" | "signature_invalid";
+/** Endorsement annotated with its validation result. */
+export interface ValidatedEndorsement extends Endorsement {
+    validation_status: EndorsementValidationStatus;
+}
+/** Attestation annotated with its validation result. */
+export interface ValidatedAttestation extends Attestation {
+    validation_status: AttestationValidationStatus;
+}
+/** Result of validating a full connection package. */
+export type PackageValidationResult = {
+    valid: true;
+    pseudonym_binding: PseudonymBinding;
+    endorsements: ValidatedEndorsement[];
+    attestations: ValidatedAttestation[];
+} | {
+    valid: false;
+    reason: "pseudonym_binding_invalid" | "pseudonym_label_too_long";
+};
+/**
+ * Condition that can be applied to a signal requirement.
+ *
+ * - min_count: the signal must meet or exceed this count
+ * - min_age_days: the signal's age must be >= this many days (boundary-inclusive)
+ * - attestation_type: all listed types must have at least one valid attestation
+ * - from_shared_contact: M6 only — unsatisfiable in M3
+ */
+export type SignalCondition = {
+    type: "min_count";
+    count: number;
+} | {
+    type: "min_age_days";
+    days: number;
+} | {
+    type: "attestation_type";
+    required: string[];
+} | {
+    type: "from_shared_contact";
+    min: number;
+};
+/** A single signal requirement that must be satisfied by an incoming package. */
+export type SignalRequirement = {
+    signal_type: "endorsement";
+    condition: SignalCondition;
+} | {
+    signal_type: "attestation";
+    condition: SignalCondition;
+} | {
+    signal_type: "pseudonym_age";
+    condition: SignalCondition;
+} | {
+    signal_type: "registration_age";
+    condition: SignalCondition;
+};
+/**
+ * Policy governing how the agent evaluates incoming connection requests.
+ *
+ * mode:
+ *   'open'      — accept all packages that pass structural validation (requirements ignored)
+ *   'closed'    — reject all packages
+ *   'selective' — accept only packages that satisfy all requirements
+ *   'guarded'   — identical to 'selective' in M3; M6 adds endorsement-from-shared-contact default
+ *
+ * review_mode:
+ *   'deterministic' — engine evaluates automatically; no agent involvement
+ *   'inference'     — engine produces a ConnectionReport; agent makes the final decision
+ */
+export interface ConnectionPolicy {
+    mode: "open" | "closed" | "selective" | "guarded";
+    review_mode: "deterministic" | "inference";
+    requirements: SignalRequirement[];
+    whitelist?: string[];
+}
+/**
+ * Context about the connection requester from the directory.
+ *
+ * Appended by the connection request flow (CONNREQ-001).
+ * In M3: conversation_count always 0, clean_close_rate always 1.0.
+ */
+export interface DirectoryContext {
+    /** Unix ms timestamp when the agent registered with the directory. */
+    registered_at: number;
+    /** If true, the agent is provisional and cannot receive connections. */
+    is_provisional: boolean;
+    /** Number of completed conversations (always 0 in M3). */
+    conversation_count: number;
+    /** Rate of clean closes (always 1.0 in M3). */
+    clean_close_rate: number;
+}
+export type BuildPseudonymBindingResult = {
+    ok: true;
+    binding: PseudonymBinding;
+} | {
+    ok: false;
+    reason: "pseudonym_label_too_long";
+};
+/** Maximum pseudonym_label size in UTF-8 bytes (AC-007, AC-008). */
+export declare const MAX_PSEUDONYM_LABEL_BYTES = 64;
+/** Expected ML-DSA-44 public key size in bytes (NIST FIPS 204). */
+export declare const ML_DSA_PUBKEY_BYTES = 1312;
+/** Expected ML-DSA-44 signature size in bytes (NIST FIPS 204). */
+export declare const ML_DSA_SIGNATURE_BYTES = 2420;
+/**
+ * Verify an ML-DSA-44 signature.
+ *
+ * This function is a thin wrapper that enables real ML-DSA verification once
+ * a native binding is available. Currently delegates to the provided verifier
+ * function — this indirection is necessary because protocol-types cannot import
+ * @cello-protocol/crypto (direction of the dependency would be inverted).
+ *
+ * Callers that need verification MUST supply a verifier. The default throws to
+ * prevent silent acceptance if the caller forgets to wire one in.
+ *
+ * For tests, pass the real node-oqs verify function directly.
+ */
+export type MlDsaVerifier = (publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array) => boolean;
+/**
+ * Build a PseudonymBinding by signing with the MlDsaKeyProvider.
+ *
+ * SI-003 enforcement: callers supply a provider, not raw signature bytes.
+ * The type signature makes it impossible to inject a pre-computed signature.
+ *
+ * @param params - Binding fields (pseudonym_label, keys, created_at)
+ * @param mlDsaKeyProvider - ML-DSA key provider (private key never leaves the provider)
+ */
+export declare function buildPseudonymBinding(params: {
+    pseudonym_label: string;
+    k_local_pubkey: Uint8Array;
+    primary_pubkey: Uint8Array;
+    ml_dsa_pubkey: Uint8Array;
+    created_at: number;
+}, mlDsaKeyProvider: MlDsaKeyProvider): Promise<BuildPseudonymBindingResult>;
+/**
+ * Verify a PseudonymBinding signature standalone.
+ *
+ * Exported so endorsement stripping tests (SI-002 pattern) can verify items
+ * outside of a full package.
+ */
+export declare function verifyPseudonymBinding(binding: PseudonymBinding, mlDsaVerify: MlDsaVerifier): boolean;
+/**
+ * Verify an Endorsement signature standalone.
+ *
+ * SI-002: each item independently verifiable outside of a package.
+ */
+export declare function verifyEndorsement(endorsement: Endorsement, mlDsaVerify: MlDsaVerifier): boolean;
+/**
+ * Verify an Attestation signature standalone.
+ *
+ * SI-002: each item independently verifiable outside of a package.
+ */
+export declare function verifyAttestation(attestation: Attestation, mlDsaVerify: MlDsaVerifier): boolean;
+/**
+ * Validate a ConnectionPackage.
+ *
+ * Validation rules:
+ *   - Invalid pseudonym binding → whole package rejected, reason: 'pseudonym_binding_invalid'
+ *   - Label > 64 UTF-8 bytes → whole package rejected, reason: 'pseudonym_label_too_long'
+ *   - Per-endorsement: signature_invalid | expired | target_mismatch | valid
+ *   - Per-attestation: signature_invalid | expired | valid
+ *
+ * SI-001: invalid pseudonym binding always rejects the package,
+ *         regardless of endorsement/attestation validity.
+ *
+ * @param pkg - The connection package to validate
+ * @param sender_k_local_pubkey - Sender's K_local pubkey (for endorsement target check)
+ * @param current_timestamp_ms - Current time (for expiry checks)
+ * @param mlDsaVerify - ML-DSA verify function (injected to avoid circular deps)
+ */
+export declare function validateConnectionPackage(pkg: ConnectionPackage, sender_k_local_pubkey: Uint8Array, current_timestamp_ms: number, mlDsaVerify: MlDsaVerifier): PackageValidationResult;
+/**
+ * Encode a ConnectionPackage to canonical CBOR bytes.
+ *
+ * Wire format: CBOR map with keys: pseudonym_binding, endorsements, attestations.
+ * Each PseudonymBinding/Endorsement/Attestation is also a CBOR map.
+ * Timestamps use minimal encoding per RFC 8949 §4.2.1.
+ */
+export declare function encodeConnectionPackage(pkg: ConnectionPackage): Uint8Array;
+/**
+ * Decode a ConnectionPackage from CBOR bytes.
+ *
+ * Performs structural validation (field presence, types, sizes).
+ * Does NOT verify signatures — call validateConnectionPackage for that.
+ *
+ * @throws Error if the bytes cannot be decoded or are structurally invalid.
+ */
+export declare function decodeConnectionPackage(bytes: Uint8Array): ConnectionPackage;
+//# sourceMappingURL=connection-package.d.ts.map

package/dist/connection-package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-package.d.ts","sourceRoot":"","sources":["../src/connection-package.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAKH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACpC,kEAAkE;IAClE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,cAAc,EAAE,UAAU,CAAC;IAC3B,4EAA4E;IAC5E,cAAc,EAAE,UAAU,CAAC;IAC3B,sCAAsC;IACtC,aAAa,EAAE,UAAU,CAAC;IAC1B,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,gBAAgB,EAAE,UAAU,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,eAAe,EAAE,UAAU,CAAC;IAC5B,sDAAsD;IACtD,sBAAsB,EAAE,UAAU,CAAC;IACnC;;;OAGG;IACH,aAAa,EAAE,UAAU,CAAC;IAC1B,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,yBAAyB,EAAE,UAAU,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,eAAe,EAAE,UAAU,CAAC;IAC5B,sDAAsD;IACtD,sBAAsB,EAAE,UAAU,CAAC;IACnC,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,CAAC;IACzB,wCAAwC;IACxC,gBAAgB,EAAE,UAAU,CAAC;IAC7B,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,yBAAyB,EAAE,UAAU,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B;AAID,yCAAyC;AACzC,MAAM,MAAM,2BAA2B,GACnC,OAAO,GACP,SAAS,GACT,mBAAmB,GACnB,iBAAiB,CAAC;AAEtB,yCAAyC;AACzC,MAAM,MAAM,2BAA2B,GACnC,OAAO,GACP,SAAS,GACT,mBAAmB,CAAC;AAExB,wDAAwD;AACxD,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,iBAAiB,EAAE,2BAA2B,CAAC;CAChD;AAED,wDAAwD;AACxD,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,iBAAiB,EAAE,2BAA2B,CAAC;CAChD;AAED,sDAAsD;AACtD,MAAM,MAAM,uBAAuB,GAC/B;IACE,KAAK,EAAE,IAAI,CAAC;IACZ,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,YAAY,EAAE,oBAAoB,EAAE,CAAC;CACtC,GACD;IACE,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,2BAA2B,GAAG,0BAA0B,CAAC;CAClE,CAAC;AAIN;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GACzB;IAAE,WAAW,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GAC1D;IAAE,WAAW,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GAC1D;IAAE,WAAW,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GAC5D;IAAE,WAAW,EAAE,kBAAkB,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;IAClD,WAAW,EAAE,eAAe,GAAG,WAAW,CAAC;IAC3C,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,aAAa,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,cAAc,EAAE,OAAO,CAAC;IACxB,0DAA0D;IAC1D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAID,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,0BAA0B,CAAA;CAAE,CAAC;AAUtD,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,kEAAkE;AAClE,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAyE3C;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,KAClB,OAAO,CAAC;AAIb;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IACN,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,UAAU,CAAC;IAC3B,cAAc,EAAE,UAAU,CAAC;IAC3B,aAAa,EAAE,UAAU,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,EACD,gBAAgB,EAAE,gBAAgB,GACjC,OAAO,CAAC,2BAA2B,CAAC,CA2BtC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,gBAAgB,EACzB,WAAW,EAAE,aAAa,GACzB,OAAO,CAST;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,aAAa,GACzB,OAAO,CAOT;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,aAAa,GACzB,OAAO,CAOT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,iBAAiB,EACtB,qBAAqB,EAAE,UAAU,EACjC,oBAAoB,EAAE,MAAM,EAC5B,WAAW,EAAE,aAAa,GACzB,uBAAuB,CA8CzB;AAID;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,GAAG,UAAU,CAM1E;AAyCD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,UAAU,GAAG,iBAAiB,CA6B5E"}