@kya-os/cli 1.7.0 → 2.0.0

package/dist/utils/dco/resolve-agent.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Read-only view of "which agent identity is configured in THIS checkout
+ * right now", surfaced by `dco whoami`.
+ *
+ * This exists because `dco setup` used to bake an agent's name/URL/DID
+ * as literal strings into the CLAUDE.md instructions it writes. That file is
+ * committed, so the literal values only ever reflected whichever agent
+ * happened to run `dco setup` first. Any other agent later working in the
+ * same repo (the common case for a repo that receives dispatched work from
+ * multiple agents) would have its PRs and commit trailers falsely attributed
+ * to that first agent. `resolveAgentIdentity` gives CLAUDE.md's instructions
+ * something to point at instead of a value: "run this, use its output",
+ * so the byline is always whichever identity is actually active locally.
+ */
+export interface ResolvedAgentIdentity {
+    /**
+     * Canonical `did:web:knowthat.ai:agents:<slug>` derived from the validated
+     * slug, NOT `.mcpi/identity.json`'s stored value verbatim. A checkout
+     * registered before the registration-time heal (init.ts/register.ts patch
+     * identity.json's `did` in place at registration) can still hold the
+     * unresolvable placeholder minted at `kya-os init` time
+     * (`did:web:localhost:3000:agents:<8hex>`); this is what actually resolves,
+     * matching the derivation `dco dispatch <slug>` uses.
+     */
+    did: string;
+    name: string;
+    slug: string;
+    url: string;
+    email: string;
+}
+/**
+ * Resolves the current agent identity from local, gitignored `.mcpi/` state.
+ * Returns null when there is nothing complete and trustworthy to report.
+ * Callers (notably `dco whoami`) must treat that as "no agent
+ * identity configured here", not as an error, since it's the ordinary state
+ * for a checkout that never ran `kya-os register`.
+ *
+ * Deliberately independent of `runDcoSetup`'s own identity resolution in
+ * setup.ts: that function additionally prompts, persists, and throws on a
+ * DID mismatch to steer a human through fixing local config, none of which
+ * is safe here: this is invoked live, mid-task, by an LLM composing a PR
+ * or commit, and must always degrade to null rather than prompt or throw.
+ * The whole body runs under a catch-all for exactly that reason: every
+ * individual step is written to fail closed already, but the guarantee that
+ * matters to callers is "never throws", not "every input we thought of is
+ * handled". A caller relying on the latter is one overlooked shape away
+ * from `dco whoami --json` crashing instead of printing
+ * `{"configured": false}`.
+ *
+ * The returned `did` is the canonical slug-derived value, not identity.json's
+ * stored `did` verbatim — see `ResolvedAgentIdentity.did`.
+ */
+export declare function resolveAgentIdentity(cwd: string): Promise<ResolvedAgentIdentity | null>;
+//# sourceMappingURL=resolve-agent.d.ts.map

package/dist/utils/dco/resolve-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-agent.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/resolve-agent.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;OAQG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAiGD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAuDvC"}

package/dist/utils/dco/resolve-agent.js

@@ -0,0 +1,164 @@
+import { execFile } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { promisify } from "util";
+import { readAgentMetadata } from "./agent-metadata.js";
+import { isValidSlug } from "./paths.js";
+const execFileAsync = promisify(execFile);
+const MAX_FIELD_LENGTH = 200;
+const DID_PATTERN = /^did:[a-z0-9]+:[A-Za-z0-9.\-_:%]+$/;
+/**
+ * Strip control characters (including CR/LF) and collapse whitespace. Values
+ * read here end up printed to stdout and copied verbatim into a PR
+ * description or commit trailer by an LLM, so a crafted value with embedded
+ * newlines must not be able to smuggle extra instructions into that text.
+ */
+function singleLine(value) {
+    // eslint-disable-next-line no-control-regex
+    return value.replace(/[\u0000-\u001f\u007f]+/g, " ").trim();
+}
+/**
+ * `readAgentMetadata` only type-asserts its JSON.parse result as
+ * `AgentMetadata`; nothing enforces at runtime that `name`/`slug`/`url` are
+ * actually strings. A field that's a truthy non-string (an array has
+ * `.length` too) would otherwise reach `singleLine`'s `.replace()` call and
+ * throw, which violates this module's whole contract of degrading to null
+ * instead of throwing. Takes `unknown` rather than `string` so every call
+ * site is forced through this runtime check before treating a field as text,
+ * not just past a compile-time type it was never validated against.
+ */
+function isSaneField(value) {
+    return (typeof value === "string" && value.length > 0 && value.length <= MAX_FIELD_LENGTH);
+}
+function isValidDid(value) {
+    return value.length <= MAX_FIELD_LENGTH && DID_PATTERN.test(value);
+}
+/**
+ * The PR byline links to the agent's registry page, so its host must be the
+ * trusted registry. A url from .mcpi/agent.json in an untrusted repo could
+ * otherwise point the byline at an arbitrary off-site (phishing) link.
+ * Mirrors the identical check `dco setup` applies before persisting
+ * agent.json in the first place (packages/cli/src/utils/dco/setup.ts).
+ */
+function isTrustedAgentUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:") {
+            return false;
+        }
+        const host = url.hostname.toLowerCase();
+        return host === "knowthat.ai" || host.endsWith(".knowthat.ai");
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * `dco setup` refuses a `.mcpi/identity.json` that's tracked by git,
+ * because a cloned repo could ship one to make signing use a key its author
+ * controls (see setup.ts's `isIdentityTrackedByGit`). The same threat
+ * applies here for the same reason `ensureGitignored` was added to
+ * `register.ts`: gitignoring `.mcpi/` after the fact does not untrack a
+ * file that was already committed. Without this check, a hostile committed
+ * `.mcpi/identity.json` + `agent.json` pair would resolve as a trustworthy
+ * identity and get echoed into every PR/commit trailer an agent composes
+ * from this repo.
+ */
+async function isMcpiTrackedByGit(cwd) {
+    try {
+        const { stdout } = await execFileAsync("git", ["ls-files", "--", ".mcpi/identity.json", ".mcpi/agent.json"], { cwd, encoding: "utf8" });
+        return stdout.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+function readIdentityDid(cwd) {
+    const path = join(cwd, ".mcpi", "identity.json");
+    if (!existsSync(path)) {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        const did = parsed && typeof parsed === "object" && typeof parsed.did === "string"
+            ? parsed.did
+            : undefined;
+        return did && isValidDid(did) ? did : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Resolves the current agent identity from local, gitignored `.mcpi/` state.
+ * Returns null when there is nothing complete and trustworthy to report.
+ * Callers (notably `dco whoami`) must treat that as "no agent
+ * identity configured here", not as an error, since it's the ordinary state
+ * for a checkout that never ran `kya-os register`.
+ *
+ * Deliberately independent of `runDcoSetup`'s own identity resolution in
+ * setup.ts: that function additionally prompts, persists, and throws on a
+ * DID mismatch to steer a human through fixing local config, none of which
+ * is safe here: this is invoked live, mid-task, by an LLM composing a PR
+ * or commit, and must always degrade to null rather than prompt or throw.
+ * The whole body runs under a catch-all for exactly that reason: every
+ * individual step is written to fail closed already, but the guarantee that
+ * matters to callers is "never throws", not "every input we thought of is
+ * handled". A caller relying on the latter is one overlooked shape away
+ * from `dco whoami --json` crashing instead of printing
+ * `{"configured": false}`.
+ *
+ * The returned `did` is the canonical slug-derived value, not identity.json's
+ * stored `did` verbatim — see `ResolvedAgentIdentity.did`.
+ */
+export async function resolveAgentIdentity(cwd) {
+    try {
+        const did = readIdentityDid(cwd);
+        if (!did) {
+            return null;
+        }
+        if (await isMcpiTrackedByGit(cwd)) {
+            return null;
+        }
+        const metadata = readAgentMetadata(cwd);
+        // Only trust agent.json when it's cryptographically bound to this
+        // identity (same rule setup.ts uses before persisting it) and shaped
+        // like a real slug (same rule signingKeyPath enforces). Unbound or
+        // malformed metadata could be planted in an untrusted repo and must not
+        // be allowed to spoof the reported name/slug/url, or to break out of
+        // the markdown link syntax CLAUDE.md tells an agent to build from these
+        // fields. isSaneField is a real runtime type guard (not just a length
+        // check) because metadata.name/slug/url are only type-asserted as
+        // strings by readAgentMetadata, never validated as one.
+        if (!metadata ||
+            metadata.did !== did ||
+            !isSaneField(metadata.name) ||
+            !isSaneField(metadata.slug) ||
+            !isValidSlug(metadata.slug)) {
+            return null;
+        }
+        const name = singleLine(metadata.name);
+        const slug = metadata.slug;
+        const url = isSaneField(metadata.url) && isTrustedAgentUrl(metadata.url)
+            ? singleLine(metadata.url)
+            : `https://knowthat.ai/agents/${slug}`;
+        // Returned did is the canonical did:web derived from the validated slug,
+        // not identity.json's `did` verbatim: a checkout registered before the
+        // write-time heal (init.ts/register.ts) can still hold the unresolvable
+        // placeholder minted at `kya-os init` time. `did` above is still the trust
+        // anchor that binds metadata.did to identity.json (proves this checkout
+        // came from `kya-os register`), just not what gets reported to a caller
+        // about to embed it in a PR description or commit trailer.
+        return {
+            did: `did:web:knowthat.ai:agents:${slug}`,
+            name,
+            slug,
+            url,
+            email: `${slug}@agents.knowthat.ai`,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=resolve-agent.js.map

package/dist/utils/dco/resolve-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-agent.js","sourceRoot":"","sources":["../../../src/utils/dco/resolve-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAiC1C,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,WAAW,GAAG,oCAAoC,CAAC;AAEzD;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,4CAA4C;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,gBAAgB,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,KAAK,EACL,CAAC,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,kBAAkB,CAAC,EAC7D,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAC1B,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GACP,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YACpE,CAAC,CAAC,MAAM,CAAC,GAAG;YACZ,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,kEAAkE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,wDAAwD;QACxD,IACE,CAAC,QAAQ;YACT,QAAQ,CAAC,GAAG,KAAK,GAAG;YACpB,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC3B,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC3B,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC3B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,MAAM,GAAG,GACP,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1D,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,8BAA8B,IAAI,EAAE,CAAC;QAE3C,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,2DAA2D;QAC3D,OAAO;YACL,GAAG,EAAE,8BAA8B,IAAI,EAAE;YACzC,IAAI;YACJ,IAAI;YACJ,GAAG;YACH,KAAK,EAAE,GAAG,IAAI,qBAAqB;SACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/utils/dco/setup.d.ts

@@ -1,11 +1,6 @@
+import { type StepResult, type StepStatus } from "../cli-kit/index.js";
 import { type GitIdentity } from "./git-config.js";
-export type StepStatus = "done" | "skipped" | "failed" | "action-required" | "would-change";
-export interface StepResult {
-    id: string;
-    title: string;
-    status: StepStatus;
-    detail?: string;
-}
+export type { StepStatus, StepResult };
 export interface DcoAgentInfo {
     did: string;
     name: string;
@@ -25,6 +20,14 @@ export interface DcoSetupOptions {
     force?: boolean;
     /** Allow interactive prompts (agent name fallback, scope refresh). */
     interactive?: boolean;
+    /**
+     * Wire signing for this EXISTING registered agent instead of resolving
+     * identity from this checkout's `.mcpi/`. Skips the identity.json preflight
+     * entirely and requires the key to already exist at `signingKeyPath(agent)`
+     * (never generated or converted in this mode). See `dco dispatch <slug>`,
+     * which derives the same did:web/url/email from the slug.
+     */
+    agent?: string;
 }
 export interface DcoSetupResult {
     ok: boolean;

package/dist/utils/dco/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/setup.ts"],"names":[],"mappings":"AAmBA,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAmBzB,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,iBAAiB,GACjB,cAAc,CAAC;AAEnB,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AA2HD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,cAAc,CAAC,CA8oBzB"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/setup.ts"],"names":[],"mappings":"AAYA,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAuBzB,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AAEvC,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAkKD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,cAAc,CAAC,CA4sBzB"}