@kya-os/mcp 1.11.0 → 1.12.0

package/CHANGELOG.md

@@ -7,6 +7,26 @@ Versioning: https://semver.org/spec/v2.0.0.html
 
 ## [Unreleased]
 
+## [1.12.0] - 2026-08-04
+
+### Added
+
+- **MCP `2026-07-28` extension binding: `org.kya-os/decentralized-authority`.**
+  Per-request admission via `requireExtension`, capability declaration via
+  `buildExtensionsEntry`, and a hand-rolled `server/discover` advertisement
+  (SEP-2133). Required mode rejects a non-declaring client with the core
+  `-32021` error carrying the `requiredCapabilities` member; discovery and ping
+  are exempt from the gate.
+- **Audit operator read/replay contract and a reference recorder.**
+
+### Changed
+
+- **Terminal proof-key naming.** Role-named `_meta` carriers
+  `org.kya-os/request-proof` and `org.kya-os/response-proof`, with the profile
+  version carried in the `org.kya-os/proof.v1` profile id. The legacy keys and
+  `prf` value (`org.kya-os/proof@1`, `org.kya-os/proof`) are read-accepted for
+  one major version, so existing producers and verifiers keep working.
+
 ## [1.11.0] - 2026-07-22
 
 ### Added

package/CONFORMANCE.md

@@ -416,14 +416,16 @@ so it is reproducible against any implementation without re-signing.
 | `vectors/status-list.json` | StatusList2021 revocation | active (bit unset) | revoked (bit set) |
 | `vectors/did-key-resolution.json` | did:key resolution | valid Ed25519 | malformed multibase, wrong method |
 | `vectors/did-web-resolution.json` | did:web resolution | well-formed id-matched document | document id mismatch, not found |
-| `vectors/card-proof.json` | `org.kya-os/proof@1` holder-of-key proof | valid signed proof, in-window, audience-bound | tampered body, tampered signature, wrong audience, expired, kid⇄did forgery |
+| `vectors/card-proof.json` | `org.kya-os/proof.v1` holder-of-key proof | valid signed proof, in-window, audience-bound | tampered body, tampered signature, wrong audience, expired, kid⇄did forgery |
 | `vectors/entity-card.json` | Entity Card `parseCard` + `verifyCard` | golden card per `entityType`, accountable agent | malformed (unknown field), broken accountability JOIN |
 | `vectors/audit-integrity.json` | Audit JCS + domain-separated hashing + RFC 9162 | fixed Unicode event, leaf/root, inclusion and consistency paths | mutated event/proof relationships are exercised by the audit unit suites |
+| `vectors/negotiation.json` | MCP extension admission gate (`org.kya-os/decentralized-authority`) | declared and malformed-degrades-to-core (optional server); empty-object and initialize-era declarations, `server/discover` exemption (required server) | absent against a required server (`-32021`), present-but-malformed against a required server (`-32602`, malformed_declaration) |
 
 The first five categories exercise the **legacy** session-bound primitives; the
 next two exercise the **Entity Card** layer (see the dedicated section below),
-and `audit-integrity` provides language-neutral bytes and hashes for the audit
-protocol.
+`audit-integrity` provides language-neutral bytes and hashes for the audit
+protocol, and `negotiation` exercises the MCP extension admission gate
+(`org.kya-os/decentralized-authority`, SPEC-MCP-EXTENSION.md §3-§5).
 
 A `fail` vector passes the suite only when the implementation correctly **rejects**
 it. The runner exits non-zero on any mismatch.
@@ -468,7 +470,7 @@ const myAdapter: ConformanceAdapter = {
   async verifyStatusList(input)       { /* ... */ },
   async resolveDidKey(input)          { /* ... */ },
   async resolveDidWeb(input)          { /* ... */ },
-  async verifyCardProof(input)        { /* org.kya-os/proof@1 holder-of-key proof */ },
+  async verifyCardProof(input)        { /* org.kya-os/proof.v1 holder-of-key proof */ },
   async verifyEntityCard(input)       { /* parseCard + verifyCard */ },
   async verifyAuditIntegrity(input)   { /* JCS event digest + RFC 9162 proofs */ },
 };
@@ -514,12 +516,12 @@ The Entity Card is a **distinct, newer layer** on top of the Level 1–3 ladder
 a typed, DID-anchored card plus a stateless, sender-constrained per-request proof.
 It is orthogonal to the legacy session-bound proof — the two coexist, each under
 its OWN distinct `_meta` key (`_meta['org.kya-os/proof']` for the legacy
-session-bound proof, `_meta['org.kya-os/proof@1']` for the stateless card proof),
+session-bound proof, `_meta['org.kya-os/proof.v1']` for the stateless card proof),
 and each verifier reads its own key and ignores the other. Its
 conformance vectors live in the SAME harness under two categories, wired to the two
 adapter methods `verifyCardProof` and `verifyEntityCard`.
 
-### `card-proof` — the `org.kya-os/proof@1` holder-of-key proof
+### `card-proof` — the `org.kya-os/proof.v1` holder-of-key proof
 
 `vectors/card-proof.json` carries fully-formed, pre-signed proofs. Each vector's
 `input` is self-contained: the proof object, the `request` it binds, the DID-keyed
@@ -566,7 +568,7 @@ onto the same ladder:
 
 `conformance/verify.py` is the **second-language complement** to the adapter contract:
 a pure-Python-stdlib re-implementation that shares no code with the TypeScript
-reference. It verifies the positive `org.kya-os/proof@1` vector and independently
+reference. It verifies the positive `org.kya-os/proof.v1` vector and independently
 re-derives the audit event's RFC 8785 bytes, domain-separated digest, RFC 9162
 root, inclusion path, and consistency path. Ed25519 uses the RFC 8032 reference
 without `pip install`.
@@ -580,7 +582,7 @@ Expected output:
 
 ```
 KYA-OS cross-language verifier (Python 3.x, stdlib-only)
-  proof: org.kya-os/proof@1  did: did:web:example.com:agents:acme-pay
+  proof: org.kya-os/proof.v1  did: did:web:example.com:agents:acme-pay
   [PASS] requestHash JCS+SHA-256 recompute
   [PASS] detached EdDSA JWS over JCS(coveredClaims)
   [PASS] RFC 9421 httpSig over the signature base

package/README.md

@@ -14,7 +14,7 @@
 <p align="center">
   <a href="https://www.npmjs.com/package/@kya-os/mcp"><img src="https://img.shields.io/npm/v/@kya-os/mcp" alt="npm"></a>
   <a href="https://kya-os.org/mcp"><img src="https://img.shields.io/badge/spec-KYA--OS-blue" alt="spec"></a>
-  <a href="https://identity.foundation/working-groups/agent-and-authorization.html"><img src="https://img.shields.io/badge/DIF-TAAWG-purple" alt="DIF TAAWG"></a>
+  <a href="https://identity.foundation/working-groups/trusted-agents.html"><img src="https://img.shields.io/badge/DIF-TAAWG-purple" alt="DIF TAAWG"></a>
   <a href="./LICENSE"><img src="https://img.shields.io/github/license/decentralized-identity/kya-os-mcp" alt="license"></a>
 </p>
 
@@ -432,7 +432,7 @@ publication, status-list backend hosting, and external registry changes.
 
 ## Links
 
-- [Spec](./SPEC.md) | [Card Profile](./SPEC-ENTITY-CARD.md) | [Changelog](./CHANGELOG.md) | [DIF TAAWG](https://identity.foundation/working-groups/agent-and-authorization.html) | [npm](https://www.npmjs.com/package/@kya-os/mcp)
+- [Spec](./SPEC.md) | [Card Profile](./SPEC-ENTITY-CARD.md) | [Changelog](./CHANGELOG.md) | [DIF TAAWG](https://identity.foundation/working-groups/trusted-agents.html) | [npm](https://www.npmjs.com/package/@kya-os/mcp)
 - [CONTRIBUTING.md](./CONTRIBUTING.md) | [CONFORMANCE.md](./CONFORMANCE.md) | [SECURITY.md](./SECURITY.md) | [GOVERNANCE.md](./GOVERNANCE.md)
 
 ## License

package/SPEC.md

@@ -23,7 +23,7 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S
 
 ## Status
 
-**Stable 1.0.0** — Donated to DIF TAAWG (Decentralized Identity Foundation, Trust and Authorization for AI Agents Working Group). Under review for ratification as a DIF standard. The wire format is stable: any future change that breaks compatibility with this version will require a major version bump.
+**Stable 1.0.0** — Donated to DIF TAAWG (Decentralized Identity Foundation, Trusted AI Agents Working Group). Under review for ratification as a DIF standard. The wire format is stable: any future change that breaks compatibility with this version will require a major version bump.
 
 ---
 
@@ -60,7 +60,7 @@ DIDs and Verifiable Credentials are the right fit for this problem:
 | **Responsible Party** | The entity ultimately accountable for the actions of an agent operating under a delegation chain. The Responsible Party is the root issuer of the chain (`issuerDid` of the root `DelegationCredential`). In personal use, the Responsible Party equals the Principal. In organizational use, the Responsible Party is the employing organization or parent entity while the Principal is the immediate human delegator within that organization. Reputation and accountability signals are scoped primarily to the Responsible Party rather than to an agent's ephemeral identity — "can this be trusted?" is ultimately a question about the accountable party. |
 | **Delegation Chain** | An ordered sequence of Delegation Credentials from a root delegator (the Responsible Party) to the current agent, where each credential's subject is the next credential's issuer. |
 | **Delegation Credential** | A W3C Verifiable Credential that grants specific permissions from an issuer (delegator) to a subject (delegate). Contains CRISP constraints defining allowed operations. |
-| **Detached Proof** | A JWS (JSON Web Signature) that cryptographically binds a tool request and response together, enabling non-repudiation and audit. Attached to responses under the reverse-DNS key `org.kya-os/proof` within the MCP `_meta` field (legacy bare `proof` accepted for backward compatibility; see §7.6). |
+| **Detached Proof** | A JWS (JSON Web Signature) that cryptographically binds a tool request and response together, enabling non-repudiation and audit. Attached to responses under the reverse-DNS key `org.kya-os/response-proof` within the MCP `_meta` field (prior keys `org.kya-os/proof` and bare `proof` accepted for backward compatibility; see §7.6). |
 | **CRISP Constraints** | **C**onstraints, **R**esources, **I**dentity, **S**cope, **P**olicy — a structured envelope defining what operations a delegation permits: allowed scopes, budget caps, temporal bounds, and audience restrictions. |
 | **Session** | An OPTIONAL, validated, time-bounded convenience context established via the `_kyaos_handshake` tool. Sessions aid replay prevention and provide a stable context for proof generation, but are **not** the durable authority — the per-request detached-JWS proof (§7) and DID-anchored grant (§6) are (see §5 preamble). KYA-OS sessions are independent of MCP's session, which was removed in MCP 2026-07-28 (SEP-2567/SEP-2575). |
 | **Handshake Nonce** | A cryptographically random value provided by the client during session establishment. Used once; prevents replay attacks. |
@@ -120,7 +120,7 @@ The following diagram illustrates the KYA-OS protocol flow:
          │  │ 4. TOOL CALL RESPONSE                    │  │
          │  │    content: [ { type: "text", ... } ]    │  │
          │  │    _meta:                                │  │
-         │  │      org.kya-os/proof:                   │  │
+         │  │      org.kya-os/response-proof:          │  │
          │  │        jws: "eyJhbGciOiJFZERTQSI..."     │  │
          │  │        meta:                             │  │
          │  │          did: "did:web:srv"              │  │
@@ -966,7 +966,7 @@ substitution — and `outcome: "needs_authorization"`:
 ### 7.5 _meta Attachment
 
 The proof is attached to tool responses under the reverse-DNS key
-`org.kya-os/proof` inside the standard MCP `_meta` field. Other `_meta` keys
+`org.kya-os/response-proof` inside the standard MCP `_meta` field. Other `_meta` keys
 (e.g. `io.modelcontextprotocol/*`, `traceparent`) MAY coexist and are ignored by
 the verifier (§7.6):
 
@@ -974,7 +974,7 @@ the verifier (§7.6):
 {
   "content": [{ "type": "text", "text": "File contents..." }],
   "_meta": {
-    "org.kya-os/proof": {
+    "org.kya-os/response-proof": {
       "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6Ii4uLiJ9.eyJhdWQiOi4uLn0.c2ln...",
       "meta": {
         "did": "did:web:server.example.com",
@@ -1007,31 +1007,29 @@ Context propagation keys (`traceparent`, `tracestate`, `baggage`). KYA-OS
 therefore namespaces its own payload and MUST NOT assume exclusive ownership of
 `_meta`.
 
-**Canonical key.** KYA-OS attaches its detached proof under the reverse-DNS key
-`org.kya-os/proof` (the `proofMetaKey`). This key SHOULD be configurable (e.g., a
+**Canonical key.** KYA-OS attaches its detached response proof under the
+reverse-DNS key `org.kya-os/response-proof` (the `proofMetaKey`). The key is
+named for its role, pairing with the request proof's `org.kya-os/request-proof`
+(SPEC-ENTITY-CARD §8); the two keys carry different objects, and neither carries
+a version - the request proof's profile version lives inside the object (`prf`). This key SHOULD be configurable (e.g., a
 single build-time constant rather than a value scattered through the code), so
 that if and when KYA-OS is registered as an MCP Extension (SEP-2133), its
 reverse-DNS extension id — and hence this key — can be re-pointed without a wire
 change.
 
-> **Editorial note — open for discussion.** The reverse-DNS key `org.kya-os/proof`
-> (and the corresponding proposed MCP Extension id `org.kya-os.identity`; see
-> §15.2) are **proposed** and not yet ratified. They remain open for
-> working-group discussion and MAY change before this revision is finalized.
-> Because the key is configurable (above), pinning the final id later does not
-> require a code change.
-
-**Backward compatibility.** For one major version, verifiers MUST also accept a
-proof published under the legacy bare key `proof`. Producers SHOULD emit
-`org.kya-os/proof`; producers targeting pre-1.1 verifiers MAY additionally
-mirror the proof under bare `proof`. When both are present and disagree, the
-namespaced key wins.
+**Backward compatibility.** Two prior keys carried this proof: bare `proof`
+(pre-1.1) and `org.kya-os/proof` (1.1 until the role-named rename). For one
+major version, verifiers MUST also accept a proof published under either prior
+key. Producers emit `org.kya-os/response-proof` and MAY additionally mirror the
+proof under a prior key when targeting older verifiers. When several keys are
+present, the newest canonical form wins (`org.kya-os/response-proof`, then
+`org.kya-os/proof`, then `proof`).
 
 **`metaPolicy` semantics.** The `session.metaPolicy` setting governs how a
 verifier treats `_meta` keys that are *not* KYA-OS's proof key:
 
 - `strict` (the default) — the verifier processes **only** the KYA-OS proof key
-  (`org.kya-os/proof`, or legacy `proof`). All other keys are **ignored**: never
+  (`org.kya-os/response-proof`, or a prior key `org.kya-os/proof` / `proof`). All other keys are **ignored**: never
   hashed, never trusted, and — critically — **never a cause for rejection**. In
   particular a `strict` verifier MUST NOT reject a response merely because
   `_meta` also carries `io.modelcontextprotocol/*`, `traceparent`, `tracestate`,
@@ -1047,7 +1045,7 @@ never covers `_meta` (§7.3).
 
 > **Note.** The proof object's shape is normatively defined by
 > `schemas/detached-proof.json` (`$schema: draft/2020-12`). The *placement* key
-> inside `_meta` is `org.kya-os/proof`; the schema describes the value
+> inside `_meta` is `org.kya-os/response-proof`; the schema describes the value
 > (`{ jws, meta }`), not the key.
 
 ### 7.7 Delegation Chain Audit Example
@@ -1092,7 +1090,7 @@ The `parentDelegation` field links this record back to the User → Agent A cred
 {
   "content": [{ "type": "text", "text": "file contents..." }],
   "_meta": {
-    "org.kya-os/proof": {
+    "org.kya-os/response-proof": {
       "jws": "eyJhbGciOiJFZERTQSJ9...",
       "meta": {
         "did": "did:web:tool-server.example.com",
@@ -1592,8 +1590,8 @@ KYA-OS is designed to layer cleanly on the MCP 2026-07-28 Release Candidate.
   and DID-anchored grant (§6). The KYA-OS session (§5) is an optional KYA-OS-owned
   convenience layer delivered via the `_kyaos_handshake` tool (§14) and is
   independent of MCP's removed session.
-- **`_meta` reserved-namespace coexistence.** KYA-OS publishes its proof under the
-  reverse-DNS key `org.kya-os/proof` and ignores all other `_meta` keys, including
+- **`_meta` reserved-namespace coexistence.** KYA-OS publishes its response proof
+  under the reverse-DNS key `org.kya-os/response-proof` and ignores all other `_meta` keys, including
   the MCP-reserved `io.modelcontextprotocol/*` and W3C Trace Context keys
   `traceparent`/`tracestate`/`baggage` (SEP-414). See §7.6.
 - **Routing headers.** KYA-OS gateways MAY use `Mcp-Method`/`Mcp-Name` (SEP-2243)
@@ -1601,17 +1599,12 @@ KYA-OS is designed to layer cleanly on the MCP 2026-07-28 Release Candidate.
 - **JSON Schema 2020-12.** Tool `inputSchema`/`outputSchema` and KYA-OS schemas use
   JSON Schema 2020-12 (SEP-2106); see §6.2.
 - **Extensions Track intent (SEP-2133).** KYA-OS intends to register as an MCP
-  Extension under the proposed reverse-DNS extension id `org.kya-os.identity`,
+  Extension under the proposed reverse-DNS extension id `org.kya-os/decentralized-authority`,
   with an `ext-*` repository, independent versioning, and negotiation via the
   `extensions` capability map. Once registered, the canonical proof key (§7.6
   `proofMetaKey`) and capability advertisement (§10) will use that extension id;
   the key is configurable for this reason. KYA-OS targets the SEP-2133
   Standards-Track path.
-
-  > **Editorial note — open for discussion.** The extension id `org.kya-os.identity`
-  > and the proof key `org.kya-os/proof` (§7.6) are **proposed** and not yet
-  > ratified; both remain open for working-group discussion and MAY change before
-  > this revision is finalized.
 - **Deprecations are zero-impact.** SEP-2577 deprecates MCP **Roots**, **Sampling**,
   and **Logging** on 12-month windows. KYA-OS uses **none** of these features, so
   the deprecations have **no impact** on KYA-OS implementations.

package/dist/audit/index.d.ts

@@ -14,6 +14,9 @@ export * from './replay-bundle.js';
 export * from './service.js';
 export * from './mirror-service.js';
 export * from './recorder-service.js';
+export * from './read-service.js';
+export * from './read-contract.js';
+export * from './reference-recorder.js';
 export * from './providers/evidence.js';
 export * from './providers/journal.js';
 export * from './providers/memory-journal.js';

package/dist/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC"}

package/dist/audit/index.js

@@ -14,6 +14,9 @@ export * from './replay-bundle.js';
 export * from './service.js';
 export * from './mirror-service.js';
 export * from './recorder-service.js';
+export * from './read-service.js';
+export * from './read-contract.js';
+export * from './reference-recorder.js';
 export * from './providers/evidence.js';
 export * from './providers/journal.js';
 export * from './providers/memory-journal.js';

package/dist/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC"}