@certrev/cert-block 1.2.1 → 2.0.0

package/dist/builder/card-contract.js

@@ -0,0 +1,262 @@
+/**
+ * ─────────────────────────────────────────────────────────────────────────────
+ * The contract-1 card a Builder block prints (2.0.0): the server's card document, bound by the signed digest
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * CertREV's contract v1 (portal ADR 0001) moves the card to the server: one renderer paints every part of a placement
+ * into a CARD DOCUMENT, and every CMS client prints those parts verbatim. Nothing visual, no string a reader sees and
+ * no layout is computed here. The Builder Delivery response carries the document as an UNSIGNED top-level sibling,
+ * `card`, beside `payload`, `signature`, `renderDef` and `face`. What binds it is the signed
+ * `payload.content.faceDigest`, which for a contract-1 Builder placement is
+ *
+ *   { v: 1, defVersion, html, css, contract: 1, doc }
+ *
+ * where `doc` is the lowercase hex sha256 of the document's RFC 8785 bytes (cert-contract's `canonicalizeJson`) and
+ * `html`/`css` bind 1.3.x's delivered face, which this client no longer reads for such a placement.
+ *
+ * THE SCHEMA IS THE PORTAL'S (`src/lib/cert-delivery/card-document.ts`, `CardDocumentV1`; source read at portal
+ * v1-core d5e459b685). This module mirrors only the fields a client reads, read-only, and never redefines them: the
+ * digest covers the document's exact bytes, so `parseCardDocument` returns the object it was given, never a copy.
+ *
+ * Which path a verified delivery takes is decided by the SIGNED binding alone (`acceptedCardBinding`):
+ *  - no `contract` key in the digest (every brand without CertREV's contract-1 entitlement): the 1.3.1 path, unchanged;
+ *  - a well-formed contract-1 binding: the card, only when the served document hashes to `doc` and names the same
+ *    design version, certificate and placement (`cardBinds`); anything else prints nothing and is reported;
+ *  - a `contract` key that is not a well-formed contract-1 binding (a later contract, a malformed digest): nothing, and
+ *    reported. A client refuses a contract it does not support (ADR 0001, section 2).
+ *
+ * React-free. Hashing uses WebCrypto (`crypto.subtle.digest`), as the kernel and the 1.3.0 face gate do, so it runs
+ * wherever the card verifies (Node SSR, edge runtimes, a browser in a secure context); the card owns the suspension.
+ */
+import { canonicalizeJson } from '../contract/kernel.js';
+import { evictOldestSettled, sha256HexUtf8 } from './delivered-face.js';
+/** The contract this client prints. */
+export const CARD_CONTRACT_VERSION = 1;
+/** The part names a document can hold, by where they go: banner card and memo, the sidebar rail, the floating pill. */
+export const CARD_PART_NAMES = ['top', 'bottom', 'rail', 'pill'];
+const CARD_LAYOUTS = ['banner', 'sidebar', 'floating'];
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+const SRI = /^(?:sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2}(?:\s+(?:sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2})*$/;
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const isString = (v) => typeof v === 'string';
+/**
+ * The signed binding, judged:
+ *  - `null`: the verified content's digest has no `contract` key (or there is no digest): not a contract-1 placement,
+ *    so the card paints what 1.3.1 paints;
+ *  - a `CardBinding`: `{ v: 1, contract: 1 }` with a non-negative integer `defVersion` and a 64-char lowercase hex `doc`
+ *    (`html` and `css` may be there or not; this client does not read them);
+ *  - `'unsupported'`: a `contract` key with anything else (another contract, a malformed binding). Fails closed.
+ */
+export function acceptedCardBinding(content) {
+    const digest = content?.faceDigest;
+    // Own keys via `Object.keys`, not `Object.hasOwn`: this runs for every verified placement, in browsers 1.3.1 painted in
+    // (Safari before 15.4 has no `Object.hasOwn`; break-it B3).
+    if (!isRecord(digest) || !Object.keys(digest).includes('contract'))
+        return null;
+    const { v, contract, defVersion, doc } = digest;
+    if (v !== 1 || contract !== CARD_CONTRACT_VERSION)
+        return 'unsupported';
+    if (typeof defVersion !== 'number' || !Number.isSafeInteger(defVersion) || defVersion < 0)
+        return 'unsupported';
+    if (!isString(doc) || !SHA256_HEX.test(doc))
+        return 'unsupported';
+    return { contract: CARD_CONTRACT_VERSION, defVersion, doc };
+}
+/**
+ * The runtime's `src` must be CertREV's: an `https:` URL on `certrev.com` or one of its subdomains, with no credentials
+ * and no port (the rule the delivery marker's origin follows). Anything else is not a runtime, so no document, even one
+ * planted in a page's record, can make the card load a script from elsewhere (break-it B7).
+ */
+function isCertrevRuntimeUrl(value) {
+    if (!isString(value))
+        return false;
+    try {
+        const url = new URL(value);
+        const host = url.hostname.toLowerCase();
+        return (url.protocol === 'https:' &&
+            !url.username &&
+            !url.password &&
+            !url.port &&
+            (host === 'certrev.com' || host.endsWith('.certrev.com')));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The served document, shape-checked for what this client reads: the object itself when it is a contract-1 card
+ * document, else null. Nothing is copied or normalised (the digest covers the object as served). Parts it does not
+ * know are left in place (they are part of the digest) and never printed.
+ */
+export function parseCardDocument(value) {
+    if (!isRecord(value))
+        return null;
+    const { contract, kind, certId, subject, defVersion, layout, parts, dialogs, assets } = value;
+    if (contract !== CARD_CONTRACT_VERSION || kind !== 'certrev.card' || !isString(certId))
+        return null;
+    if (!isRecord(subject) || !isString(subject.platform) || !isString(subject.externalId))
+        return null;
+    if (typeof defVersion !== 'number' || !Number.isSafeInteger(defVersion) || defVersion < 0)
+        return null;
+    if (!isString(layout) || !CARD_LAYOUTS.includes(layout))
+        return null;
+    if (!isRecord(parts))
+        return null;
+    for (const name of CARD_PART_NAMES)
+        if (parts[name] !== undefined && !isString(parts[name]))
+            return null;
+    if (!isRecord(dialogs))
+        return null;
+    if (dialogs.expert !== undefined && !isString(dialogs.expert))
+        return null;
+    if (dialogs.certificate !== undefined && !isString(dialogs.certificate))
+        return null;
+    if (!isRecord(assets) || !isString(assets.head))
+        return null;
+    if (assets.runtime !== undefined) {
+        const runtime = assets.runtime;
+        if (!isRecord(runtime) ||
+            !isCertrevRuntimeUrl(runtime.src) ||
+            !isString(runtime.integrity) ||
+            !SRI.test(runtime.integrity)) {
+            return null;
+        }
+    }
+    return value;
+}
+/** Lowercase hex sha256 of a document's RFC 8785 bytes; null when it cannot be canonicalized or hashed. */
+export async function cardDocumentDigest(card) {
+    let canonical;
+    try {
+        canonical = canonicalizeJson(card);
+    }
+    catch {
+        return null;
+    }
+    try {
+        return await sha256HexUtf8(canonical);
+    }
+    catch {
+        return null;
+    }
+}
+/** How many documents' digests are kept (insertion order; the oldest goes first). A page holds one or a few. */
+const CARD_DIGEST_MEMO_MAX = 32;
+const cardDigestMemo = new Map();
+/**
+ * The memoized digest of one document, keyed by its canonical bytes (a seed parsed afresh from the page and the
+ * server's cached read of the same document share one entry). A document that cannot be canonicalized settles to null
+ * at once, without a key.
+ */
+export function cardDigestFor(card) {
+    let key;
+    try {
+        key = canonicalizeJson(card);
+    }
+    catch {
+        const failed = { pending: Promise.resolve(null), settled: { digest: null } };
+        return failed;
+    }
+    const known = cardDigestMemo.get(key);
+    if (known)
+        return known;
+    const fresh = {
+        pending: sha256HexUtf8(key).then((digest) => {
+            fresh.settled = { digest };
+            return digest;
+        }, () => {
+            fresh.settled = { digest: null };
+            return null;
+        }),
+    };
+    evictOldestSettled(cardDigestMemo, CARD_DIGEST_MEMO_MAX);
+    cardDigestMemo.set(key, fresh);
+    return fresh;
+}
+/** Test seam: forget every document's digest (a new process). */
+export function forgetCardDigestsForTests() {
+    cardDigestMemo.clear();
+}
+/**
+ * The synchronous half of the check: the document binds this binding, payload and placement in everything but its
+ * bytes (contract, design version, certificate, and the Builder placement it was painted for).
+ */
+export function cardMatchesPlacement(card, binding, payload, externalId) {
+    return (card.contract === binding.contract &&
+        card.defVersion === binding.defVersion &&
+        card.certId === payload.certId &&
+        card.subject.platform === 'builder' &&
+        card.subject.externalId === externalId);
+}
+/** The asynchronous half's verdict: the document's own digest is the signed one. */
+export function cardDigestMatches(digest, binding) {
+    return digest !== null && digest === binding.doc;
+}
+/** Both halves at once (for callers outside React): the served document is the one the verified envelope signs. */
+export async function cardBinds(card, binding, payload, externalId) {
+    if (!cardMatchesPlacement(card, binding, payload, externalId))
+        return false;
+    return cardDigestMatches(await cardDigestFor(card).pending, binding);
+}
+/**
+ * The parts one Builder block prints, in page order. The saved design decides the layout (the block's `mode` is not
+ * read). A banner block prints its card (`top`) and its memo (`bottom`); a block whose `part` is `'header'` prints the
+ * card only, and one whose `part` is `'memo'` the memo only, so a split banner prints each part once. Outside the
+ * banner a `'memo'` block prints nothing and any other block the design's one part (the rail, the pill): a page that
+ * kept its split header and memo blocks after the brand chose a sidebar design shows one sidebar card, not two.
+ */
+export function cardPartsFor(card, part) {
+    let names;
+    if (card.layout === 'banner') {
+        names = part === 'header' ? ['top'] : part === 'memo' ? ['bottom'] : ['top', 'bottom'];
+    }
+    else if (part === 'memo') {
+        names = [];
+    }
+    else {
+        names = card.layout === 'sidebar' ? ['rail'] : ['pill'];
+    }
+    return names.filter((name) => typeof card.parts[name] === 'string');
+}
+function escapeAttribute(value) {
+    return value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+/** The runtime's tag, or '' when the document names none. */
+export function cardRuntimeTag(card) {
+    const runtime = card.assets.runtime;
+    if (!runtime)
+        return '';
+    return `<script src="${escapeAttribute(runtime.src)}" integrity="${escapeAttribute(runtime.integrity)}" crossorigin="anonymous" defer></script>`;
+}
+/** Which of the document's parts is its first, in this order: the block holding it prints the page's assets. */
+const CARD_FIRST_PART_ORDER = ['top', 'rail', 'pill', 'bottom'];
+/**
+ * The document's first part: `top`, else `rail`, else `pill`, from the document's own parts (the lead's ruling on ADR
+ * 0001's head-once-per-page, relay 074dbd2c8ef3); `bottom` only for a document with none of those, so its head and
+ * dialogs always have a block to print them. Null for a document with no part.
+ */
+export function cardFirstPart(card) {
+    return CARD_FIRST_PART_ORDER.find((name) => typeof card.parts[name] === 'string') ?? null;
+}
+/** Whether the block printing `names` prints the page's head fragment, dialogs and runtime: it holds the first part. */
+export function cardCarriesAssets(card, names) {
+    const first = cardFirstPart(card);
+    return first !== null && names.includes(first);
+}
+/**
+ * Exactly what a block prints inside its wrapper: its parts in page order and, only in the block holding the document's
+ * first part (`cardCarriesAssets`), the head fragment before them and both dialogs (expert, then certificate) and the
+ * runtime's tag after. So a split banner (a header block and a memo block) prints the head, the dialogs and the runtime
+ * once, in the header block, with no coordination between the blocks and with JavaScript off; the runtime finds a
+ * control's dialog anywhere on the page by its placement. Every byte but the runtime tag is the document's own.
+ */
+export function cardHtml(card, names) {
+    let parts = '';
+    for (const name of names)
+        parts += card.parts[name] ?? '';
+    if (!cardCarriesAssets(card, names))
+        return parts;
+    const dialogs = (card.dialogs.expert ?? '') + (card.dialogs.certificate ?? '');
+    return card.assets.head + parts + dialogs + cardRuntimeTag(card);
+}
+//# sourceMappingURL=card-contract.js.map

package/dist/builder/card-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-contract.js","sourceRoot":"","sources":["../../src/builder/card-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAsC,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC5F,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEvE,uCAAuC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAEtC,uHAAuH;AACvH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAU,CAAA;AAKzE,MAAM,YAAY,GAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAgCzE,MAAM,UAAU,GAAG,gBAAgB,CAAA;AACnC,MAAM,GAAG,GAAG,sGAAsG,CAAA;AAElH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACvH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAA;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAuC;IAC1E,MAAM,MAAM,GAAa,OAAuD,EAAE,UAAU,CAAA;IAC5F,wHAAwH;IACxH,4DAA4D;IAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/E,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC/C,IAAI,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,qBAAqB;QAAE,OAAO,aAAa,CAAA;IACvE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,aAAa,CAAA;IAC/G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAA;IACjE,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAA;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QACvC,OAAO,CACN,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,IAAI;YACT,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CACzD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IAC7F,IAAI,QAAQ,KAAK,qBAAqB,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACnG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IACnG,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,eAAe;QAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;IACxG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1E,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5D,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC9B,IACC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAClB,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;YACjC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YAC5B,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAC3B,CAAC;YACF,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IACD,OAAO,KAAkC,CAAA;AAC1C,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAa;IACrD,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACJ,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,MAAM,aAAa,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAQD,gHAAgH;AAChH,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAA;AAExD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa;IAC1C,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,MAAM,GAAmB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAA;QAC5F,OAAO,MAAM,CAAA;IACd,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,KAAK,GAAmB;QAC7B,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,CAC/B,CAAC,MAAM,EAAE,EAAE;YACV,KAAK,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,CAAA;YAC1B,OAAO,MAAM,CAAA;QACd,CAAC,EACD,GAAG,EAAE;YACJ,KAAK,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;YAChC,OAAO,IAAI,CAAA;QACZ,CAAC,CACD;KACD,CAAA;IACD,kBAAkB,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAA;IACxD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9B,OAAO,KAAK,CAAA;AACb,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,yBAAyB;IACxC,cAAc,CAAC,KAAK,EAAE,CAAA;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CACnC,IAAoB,EACpB,OAAoB,EACpB,OAAoB,EACpB,UAAkB;IAElB,OAAO,CACN,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QAClC,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QACtC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAC9B,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;QACnC,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,CACtC,CAAA;AACF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,OAAoB;IAC5E,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,OAAO,CAAC,GAAG,CAAA;AACjD,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,IAAoB,EACpB,OAAoB,EACpB,OAAoB,EACpB,UAAkB;IAElB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3E,OAAO,iBAAiB,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAoB,EAAE,IAAa;IAC/D,IAAI,KAAqB,CAAA;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACvF,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,KAAK,GAAG,EAAE,CAAA;IACX,CAAC;SAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACxG,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,IAAoB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAA;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,OAAO,gBAAgB,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,2CAA2C,CAAA;AACjJ,CAAC;AAED,gHAAgH;AAChH,MAAM,qBAAqB,GAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAExF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoB;IACjD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAA;AAC1F,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,iBAAiB,CAAC,IAAoB,EAAE,KAA8B;IACrF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACjC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAoB,EAAE,KAA8B;IAC5E,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACzD,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACjD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAC9E,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,GAAG,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;AACjE,CAAC"}

package/dist/builder/card-report.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The Builder card's fallback report (2.0.0): one structured event every time a placement does not print the card
+ * CertREV served, so no fallback is silent.
+ *
+ *  - In the browser: `CustomEvent('certrev:card-fallback', { detail })` on `document`, once per placement and reason per
+ *    page. A brand (or CertREV's own replica) listens for it; the card itself sends nothing anywhere: no beacon, no
+ *    request, no storage.
+ *  - On a server: one `console.warn` line, `[certrev] card_fallback {json}`, per render that takes the fallback.
+ *
+ * The same reason rides the placement's `'none'` record on the page (`ssr-seed.ts`), so a capture can read it too.
+ *
+ * Reasons:
+ *  - `card_missing`: a contract-1 placement (the signed binding says `contract: 1`) with no card in the response;
+ *  - `card_verify_failed`: a card that is malformed, or does not hash to the signed digest, or names another design
+ *    version, certificate or placement;
+ *  - `card_unsupported_contract`: a signed binding with a `contract` this client does not print;
+ *  - `card_pin_mismatch`: CertREV's replica pinned a design version the signed card was not painted for;
+ *  - `unknown_key`: the envelope's kid is neither baked nor in the origin's signed published key set;
+ *  - `delivery_unreachable`: CertREV could not be reached, so the block's own options face was painted (1.2.0's
+ *    deliberate fallback, unchanged, now reported).
+ */
+export declare const CARD_FALLBACK_EVENT = "certrev:card-fallback";
+export type CardFallbackReason = 'card_missing' | 'card_verify_failed' | 'card_unsupported_contract' | 'card_pin_mismatch' | 'unknown_key' | 'delivery_unreachable';
+export interface CardFallbackDetail {
+    readonly reason: CardFallbackReason;
+    readonly platform: 'builder';
+    readonly externalId: string;
+    /** The certificate, when the envelope verified far enough to name it. */
+    readonly certId?: string;
+}
+/** Report one fallback in the browser: the event, once per placement and reason per page. */
+export declare function reportCardFallbackInBrowser(detail: CardFallbackDetail): void;
+/** Report one fallback on a server: one structured console line. */
+export declare function reportCardFallbackOnServer(detail: CardFallbackDetail): void;
+/** Test seam: forget what this page reported (a new page). */
+export declare function forgetCardReportsForTests(): void;
+//# sourceMappingURL=card-report.d.ts.map

package/dist/builder/card-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-report.d.ts","sourceRoot":"","sources":["../../src/builder/card-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,MAAM,MAAM,kBAAkB,GAC3B,cAAc,GACd,oBAAoB,GACpB,2BAA2B,GAC3B,mBAAmB,GACnB,aAAa,GACb,sBAAsB,CAAA;AAEzB,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAKD,6FAA6F;AAC7F,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAM5E;AAED,oEAAoE;AACpE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAE3E;AAED,8DAA8D;AAC9D,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD"}

package/dist/builder/card-report.js

@@ -0,0 +1,43 @@
+/**
+ * The Builder card's fallback report (2.0.0): one structured event every time a placement does not print the card
+ * CertREV served, so no fallback is silent.
+ *
+ *  - In the browser: `CustomEvent('certrev:card-fallback', { detail })` on `document`, once per placement and reason per
+ *    page. A brand (or CertREV's own replica) listens for it; the card itself sends nothing anywhere: no beacon, no
+ *    request, no storage.
+ *  - On a server: one `console.warn` line, `[certrev] card_fallback {json}`, per render that takes the fallback.
+ *
+ * The same reason rides the placement's `'none'` record on the page (`ssr-seed.ts`), so a capture can read it too.
+ *
+ * Reasons:
+ *  - `card_missing`: a contract-1 placement (the signed binding says `contract: 1`) with no card in the response;
+ *  - `card_verify_failed`: a card that is malformed, or does not hash to the signed digest, or names another design
+ *    version, certificate or placement;
+ *  - `card_unsupported_contract`: a signed binding with a `contract` this client does not print;
+ *  - `card_pin_mismatch`: CertREV's replica pinned a design version the signed card was not painted for;
+ *  - `unknown_key`: the envelope's kid is neither baked nor in the origin's signed published key set;
+ *  - `delivery_unreachable`: CertREV could not be reached, so the block's own options face was painted (1.2.0's
+ *    deliberate fallback, unchanged, now reported).
+ */
+export const CARD_FALLBACK_EVENT = 'certrev:card-fallback';
+/** Placement and reason pairs already reported on this page (browser only). */
+const reportedOnPage = new Set();
+/** Report one fallback in the browser: the event, once per placement and reason per page. */
+export function reportCardFallbackInBrowser(detail) {
+    if (typeof document === 'undefined' || typeof CustomEvent !== 'function')
+        return;
+    const key = `${detail.externalId}|${detail.reason}`;
+    if (reportedOnPage.has(key))
+        return;
+    reportedOnPage.add(key);
+    document.dispatchEvent(new CustomEvent(CARD_FALLBACK_EVENT, { detail }));
+}
+/** Report one fallback on a server: one structured console line. */
+export function reportCardFallbackOnServer(detail) {
+    console.warn(`[certrev] card_fallback ${JSON.stringify(detail)}`);
+}
+/** Test seam: forget what this page reported (a new page). */
+export function forgetCardReportsForTests() {
+    reportedOnPage.clear();
+}
+//# sourceMappingURL=card-report.js.map

package/dist/builder/card-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-report.js","sourceRoot":"","sources":["../../src/builder/card-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA;AAkB1D,+EAA+E;AAC/E,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;AAExC,6FAA6F;AAC7F,MAAM,UAAU,2BAA2B,CAAC,MAA0B;IACrE,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,WAAW,KAAK,UAAU;QAAE,OAAM;IAChF,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,CAAA;IACnD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAM;IACnC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,QAAQ,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACpE,OAAO,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,yBAAyB;IACxC,cAAc,CAAC,KAAK,EAAE,CAAA;AACvB,CAAC"}

package/dist/builder/cert-review-card.d.ts

@@ -63,11 +63,13 @@ export interface CertReviewCardProps extends Partial<BuilderCertChromeData> {
         } | null;
     } | null;
     /**
-     * 1.2.0: opt in to a Delivery read FROM THE BROWSER for a card the server did not render (a client-side navigation,
-     * Builder's editor). Off by default: the card then never makes a request from the browser, so a brand's
-     * Content-Security-Policy needs no CertREV origin, and such a card paints the block's own options face. Turning it
-     * on needs the Delivery API's origin in the page's `connect-src`. Not a Builder input: a brand sets it in code, on
-     * a wrapper of this component.
+     * A Delivery read FROM THE BROWSER for a card the server did not render (a client-side navigation, Builder's editor).
+     * 2.0.0: ON by default (absent or `true`): it is the only way CertREV's server-rendered card exists after an in-app
+     * navigation, and it needs the Delivery API's origin (`https://portal.certrev.com`) in the page's `connect-src`, one
+     * of the four CSP sources 2.0 asks for. A read the policy blocks is a read that did not reach CertREV: the block's
+     * own options face, as 1.3.1 painted it (and a reported `delivery_unreachable`). `false` restores 1.2.0 to 1.3.1's
+     * behaviour: no request from the browser, and such a card paints the block's options face. Not a Builder input: a
+     * brand sets it in code, on a wrapper of this component.
      */
     clientRead?: boolean;
 }

package/dist/builder/cert-review-card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cert-review-card.d.ts","sourceRoot":"","sources":["../../src/builder/cert-review-card.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAG9B,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,oCAAoC,CAAA;AAWxF,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,uBAAuB,CAAA;AAmBvF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,iBAAiB,CAAA;AAEjD,MAAM,WAAW,mBAAoB,SAAQ,OAAO,CAAC,qBAAqB,CAAC;IAC1E;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAC3B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE;QAChB,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;QACnD,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KACjE,GAAG,IAAI,CAAA;IACR;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACpB;AAsCD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe1F;AAoBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,QAKjC,CAAA;AA6YJ,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,4BAiCxD;AAoFD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACpE,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC3B;AA6CD;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,YAAY,EAO5C,CAAA;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,YAAY,EA2BnD,CAAA;AAED,gGAAgG;AAChG,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,cAAc,CAAA;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,yBAAyB,EAAE;QAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAA;KAAE,CAAA;CACrE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,4BAKlC,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IACjD,SAAS,EAAE,OAAO,cAAc,CAAA;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB;;;;OAIG;IACH,yBAAyB,EAAE;QAAE,cAAc,EAAE,OAAO,CAAA;KAAE,CAAA;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,iCAOlC,CAAA"}
+{"version":3,"file":"cert-review-card.d.ts","sourceRoot":"","sources":["../../src/builder/cert-review-card.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAG9B,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,oCAAoC,CAAA;AA6BxF,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,uBAAuB,CAAA;AA4BvF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,iBAAiB,CAAA;AAEjD,MAAM,WAAW,mBAAoB,SAAQ,OAAO,CAAC,qBAAqB,CAAC;IAC1E;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;IAC3B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE;QAChB,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;QACnD,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KACjE,GAAG,IAAI,CAAA;IACR;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACpB;AAsCD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe1F;AAkCD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,QAKjC,CAAA;AAopBJ,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,4BAiCxD;AAoFD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACpE,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC3B;AA6CD;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,YAAY,EAO5C,CAAA;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,YAAY,EA2BnD,CAAA;AAED,gGAAgG;AAChG,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,cAAc,CAAA;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,yBAAyB,EAAE;QAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAA;KAAE,CAAA;CACrE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,4BAKlC,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IACjD,SAAS,EAAE,OAAO,cAAc,CAAA;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB;;;;OAIG;IACH,yBAAyB,EAAE;QAAE,cAAc,EAAE,OAAO,CAAA;KAAE,CAAA;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,iCAOlC,CAAA"}