@mikeargento/bitgraph-player 0.5.1 → 0.6.0

package/DOMAIN.md

@@ -0,0 +1,119 @@
+# BitGraph Domain
+
+A BitGraph Domain is a party's own domain publishing the keys that record
+for it. A reader pins the domain once; `bitgraph-play check --from
+<domain>` then answers offline, from the export in hand and the pin on
+disk, whether a file holds a recorded position under a key the domain
+published.
+
+The domain's file is the party speaking for itself, never BitGraph
+speaking about the party. A proof carries a key and nothing else. Which
+domains to pin, and what to make of them, belongs to each reader; a
+domain's file is one source among any number, never an authority.
+
+## The file: `bitgraph-domain/1`
+
+Served over HTTPS at `https://<domain>/.well-known/bitgraph`, at most
+64 KiB:
+
+```json
+{
+  "version": "bitgraph-domain/1",
+  "domain": "acme.com",
+  "party": "Acme Corp",
+  "keys": {
+    "invoices": { "alg": "es256",   "publicKey": "<SPKI DER, base64>" },
+    "press":    { "alg": "ed25519", "publicKey": "<raw 32 bytes, base64>" }
+  }
+}
+```
+
+- `version` is exactly `"bitgraph-domain/1"`. The discriminator field is
+  `version`, as in `bitgraph/1` proofs, because `domain` is the file's own
+  subject field. Unknown fields are a parse error; additions are a new
+  format version.
+- `domain` is a lowercase hostname: no scheme, no port, no path. At pin
+  time it must equal the domain the reader asked for, so a redirect cannot
+  cause one party's file to be stored under another party's name.
+- `party` is the name the domain gives itself. Display only; the domain is
+  the binding.
+- `keys` is a nonempty object. Names follow the trusted-key grammar of
+  SPEC.md section 9.1 (`[A-Za-z0-9_.-]+`, at least one non-digit, unique),
+  and each entry is exactly a section 9.1 trusted-key body: for `es256`
+  the publicKey is SPKI DER in base64, the spelling actor proofs carry;
+  for `ed25519` it is the raw 32-byte key in base64. An entry therefore
+  pastes into a format 2 rule's `trustedKeys` unchanged.
+
+A key's **fingerprint** is the lowercase hex SHA-256 of the decoded
+publicKey bytes. For `es256` keys this is exactly the `keyId` actor proofs
+carry. Fingerprints are always derived and never written in the file, so a
+domain cannot claim a key it does not show.
+
+## Pin
+
+`bitgraph-play pin <domain>` fetches the file, prints the party and every
+key's name, algorithm and fingerprint, and stores the file bytes verbatim
+on the reader's machine after confirmation. Pinning is the only step that
+touches the network, once per domain. Pinning again shows what changed,
+added, removed or replaced keys, before asking again. `pin` alone lists
+stored pins; `pin --forget <domain>` removes one.
+
+A malformed file is refused at the pin, so a check never reads a bad one.
+`check --from` never fetches; `--from` naming a domain with no stored pin
+is an invocation error (exit 3) whose remedy is the pin command, because a
+reader's missing setup is not evidence and gets no verdict.
+
+## The domain line
+
+With `--from <domain>`, one line joins the check report for each
+recording.
+
+TRUE when the recording verifies and either
+
+- its actor's `keyId` equals the fingerprint of an `es256` key in the
+  pinned file, or
+- a `bitgraph-sig/1` file among the bundle's candidate signature files
+  (SPEC.md section 9.4) verifies over the recording's digest under any
+  pinned key.
+
+UNDETERMINED otherwise. **The domain line is never FALSE**, by the same
+open-world rule as `signedBy` (SPEC.md section 9.3): domain evidence can
+exist outside any bundle, so its absence contradicts nothing. Evidence in
+hand that contradicts the recording itself already reads FALSE on the
+existing lines; the domain line does not restate them.
+
+An enclave epoch key listed in a domain's file matches nothing: it is not
+an actor key, and the enclave never signs the domain-separated
+bitgraph-sig message. Exit codes are unchanged; the line joins the
+report's conjunction.
+
+## What it establishes, and the cost
+
+TRUE establishes that a key published by the domain stands behind a
+recording of exactly these bytes at a fixed causal position. Not
+authorship: anyone can record a file they downloaded, under any key they
+hold. Not content. Not exclusivity: the same bytes may hold other
+positions, under other keys or none. The statement is as strong as the
+domain and the keys behind it: a stolen key keeps the domain's standing
+until it is removed and readers pin again.
+
+Publishing a key names it in public, retroactively: every recording the
+key has ever made or will make reads as the party's, positions and volume
+included, and pins outlive the file that provided them. Only digests
+travel, so no content is exposed, and unpublished keys and anonymous
+recordings are untouched. Publish keys dedicated to what you intend to
+stand behind, named for their purpose. A published key is per purpose,
+never per document: the per-document evidence is the signature each
+recording already carries, and a pin only works because the keys it
+stores outlive it. Attribution without public grouping is the other
+posture, and it needs no domain file: record under an unpublished key and
+hand the counterparty the evidence directly; they declare the key in
+their own rule's `trustedKeys`.
+
+## Relation to the specification
+
+Evaluation semantics (SPEC.md sections 1 through 9) are untouched. The
+domain file shares section 9.1's key grammar, section 9.3's open-world
+rule and section 9.4's candidate discipline; `check` remains the section
+8 convenience surface, and its report format adds the domain entry as
+`bitgraph-check/2`.

package/README.md

@@ -52,6 +52,25 @@ same code. It is not hosted anywhere: the site's own drop box checks a file
 against the public ledger, and a second box that could only say
 "self-consistent" would be two boxes with different meanings.
 
+## Pin a domain
+
+    bitgraph-play pin acme.com
+    bitgraph-play check "BitGraph (invoice-4471.pdf)/" --from acme.com
+
+A domain can publish the keys that record for it: one `bitgraph-domain/1`
+file at `https://<domain>/.well-known/bitgraph` (the format is in
+[DOMAIN.md](./DOMAIN.md)). `pin` fetches it once, shows the party and
+every key's fingerprint, and stores the bytes verbatim on your machine
+after you confirm; it is the only command in this package that touches
+the network, and only when invoked. `check --from` then adds one line per
+recording, offline, from the pin on disk: TRUE when the recording
+verifies and a pinned key stands behind it, as the actor inside the proof
+or as a detached `bitgraph-sig/1` in the bundle; UNDETERMINED otherwise;
+and never FALSE, because domain evidence can exist outside any bundle,
+so its absence contradicts nothing. Pinning again shows what changed
+before you accept it. `pin` alone lists your pins; `pin --forget
+<domain>` removes one.
+
 ## Start a rule
 
     bitgraph-play init po.pdf delivery.jpg approval.pdf --out rule.json
@@ -64,11 +83,12 @@ rule's own security policy and has no default, from the scaffolder or
 anywhere else. Choose the floor, say what each digest means, refine the
 claim, then run it.
 
-`init` is a reserved first word as of 0.2.0. A rule file literally
-named `init` is still reachable: write it as `./init`, or after `--`,
-which ends option parsing (`bitgraph-play -- init bundle/`). When a
-file named `init` exists in the working directory, the bare spelling is
-refused as ambiguous rather than silently picking a mode.
+`init` is a reserved first word as of 0.2.0, `check` as of 0.4.0, and
+`pin` as of 0.6.0. A rule file literally named like one of them is still
+reachable: write it as `./init`, or after `--`, which ends option
+parsing (`bitgraph-play -- init bundle/`). When a file with one of those
+names exists in the working directory, the bare spelling is refused as
+ambiguous rather than silently picking a mode.
 
 ## A rule
 

package/dist/__tests__/domain.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=domain.test.d.ts.map

package/dist/__tests__/domain.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/domain.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/domain.test.js

@@ -0,0 +1,265 @@
+// Copyright (c) 2024-2026 Mike Argento. Licensed under the MIT License. See LICENSE.
+/**
+ * BitGraph Domain: parseDomainFile, fingerprints, the pin store, the
+ * fetch, and check --from's "domain" line.
+ *
+ * The invariants under test:
+ *   - The domain line is TRUE or UNDETERMINED, never FALSE: absence of
+ *     domain evidence contradicts nothing (SPEC §9.3's open-world rule).
+ *   - Fingerprints are always derived from key material, never read from
+ *     the file; for es256 the fingerprint IS the actor keyId, proved
+ *     against the real declared recording (fixtures/declared-12010).
+ *   - A malformed file is refused at the pin, and a redirect cannot store
+ *     one party's file under another party's name (the `domain` field
+ *     must equal the domain the reader asked for).
+ *   - A report without --from stays bitgraph-check/1 with no `from` key.
+ *
+ * Everything runs in memory or under a temp dir. The fetch is injected;
+ * no network, no ledger writes, ever.
+ */
+import { strict as assert } from "node:assert";
+import { createHash, generateKeyPairSync, sign as cryptoSign } from "node:crypto";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { ingestEntries } from "@mikeargento/bitgraph-audit";
+import { checkIngest } from "../check.js";
+import { checkDomain, diffDomainFiles, DomainFileError, domainKeyRefs, isDomainName, keyFingerprint, parseDomainFile, } from "../domain.js";
+import { fetchDomainFile, forgetPin, listPins, readPin, writePin } from "../pin.js";
+import { sigMessage } from "../sig.js";
+// ---------------------------------------------------------------------------
+// The real declared recording: actor key ee0c6517…, provider passkey
+// ---------------------------------------------------------------------------
+const proofBytes = readFileSync(new URL("../../src/__tests__/fixtures/declared-12010/proof.json", import.meta.url));
+const proofJson = JSON.parse(proofBytes.toString("utf8"));
+const ACTOR_KEY_B64 = proofJson.agency.actor.publicKeyB64;
+const ACTOR_KEY_ID = proofJson.agency.actor.keyId;
+const DIGEST_HEX = Buffer.from(proofJson.artifact.digestB64, "base64").toString("hex");
+function domainText(overrides) {
+    return JSON.stringify({
+        version: "bitgraph-domain/1",
+        domain: "acme.com",
+        party: "Acme Corp",
+        keys: { studio: { alg: "es256", publicKey: ACTOR_KEY_B64 } },
+        ...overrides,
+    });
+}
+async function ingestProof(bytes = proofBytes) {
+    return ingestEntries([{ path: "proof.json", open: () => Promise.resolve(new Uint8Array(bytes)) }]);
+}
+function onlyRecording(report) {
+    assert.equal(report.recordings.length, 1);
+    return report.recordings[0];
+}
+function domainLineOf(recording) {
+    const line = recording.lines.find((l) => l.name === "domain");
+    assert.notEqual(line, undefined, "expected a domain line");
+    return line;
+}
+// ---------------------------------------------------------------------------
+// Parsing and fingerprints
+// ---------------------------------------------------------------------------
+test("parseDomainFile accepts a valid file and derives the party/keys", () => {
+    const file = parseDomainFile(domainText(), "acme.com");
+    assert.equal(file.domain, "acme.com");
+    assert.equal(file.party, "Acme Corp");
+    assert.deepEqual(Object.keys(file.keys), ["studio"]);
+});
+test("isDomainName: lowercase dotted hostnames only", () => {
+    assert.equal(isDomainName("acme.com"), true);
+    assert.equal(isDomainName("sub.acme-corp.co.uk"), true);
+    assert.equal(isDomainName("ACME.com"), false);
+    assert.equal(isDomainName("acme"), false);
+    assert.equal(isDomainName("acme.com/path"), false);
+    assert.equal(isDomainName("https://acme.com"), false);
+    assert.equal(isDomainName("acme.com:443"), false);
+    assert.equal(isDomainName(""), false);
+});
+test("parseDomainFile refuses malformed files with every issue named", () => {
+    const bad = (text, expected) => {
+        try {
+            parseDomainFile(text, expected);
+        }
+        catch (err) {
+            assert.ok(err instanceof DomainFileError);
+            return [...err.issues];
+        }
+        assert.fail("expected DomainFileError");
+    };
+    assert.match(bad(domainText({ version: "bitgraph-domain/2" })).join(" "), /"version" must be exactly/);
+    assert.match(bad(domainText({ extra: 1 })).join(" "), /unknown field "extra"/);
+    assert.match(bad(domainText(), "other.example").join(" "), /refusing to store one party's file/);
+    assert.match(bad(domainText({ party: "  " })).join(" "), /"party" is required/);
+    assert.match(bad(domainText({ keys: {} })).join(" "), /at least one key/);
+    assert.match(bad(domainText({ keys: { "1234": { alg: "es256", publicKey: ACTOR_KEY_B64 } } })).join(" "), /non-digit/);
+    assert.match(bad(domainText({ keys: { studio: { alg: "es256", publicKey: ACTOR_KEY_B64, note: "x" } } })).join(" "), /unknown field "note"/);
+    assert.match(bad(domainText({ keys: { studio: { alg: "rsa", publicKey: ACTOR_KEY_B64 } } })).join(" "), /"alg" must be/);
+    assert.match(bad(domainText({ keys: { studio: { alg: "es256", publicKey: "!!!" } } })).join(" "), /does not decode/);
+    assert.match(bad(domainText({ keys: { press: { alg: "ed25519", publicKey: Buffer.alloc(16).toString("base64") } } })).join(" "), /does not decode/);
+    assert.match(bad(domainText({ domain: "https://acme.com" })).join(" "), /lowercase hostname/);
+    // Oversize input is refused before parsing.
+    const big = new Uint8Array(70_000);
+    assert.throws(() => parseDomainFile(big), DomainFileError);
+});
+test("an es256 fingerprint IS the actor keyId (derived, never assigned)", () => {
+    assert.equal(keyFingerprint({ alg: "es256", publicKey: ACTOR_KEY_B64 }), ACTOR_KEY_ID);
+    const refs = domainKeyRefs(parseDomainFile(domainText()));
+    assert.deepEqual(refs.map((r) => [r.name, r.fingerprint]), [["studio", ACTOR_KEY_ID]]);
+});
+test("checkDomain resolves actor keyIds case-insensitively, es256 only", () => {
+    const from = checkDomain(parseDomainFile(domainText()));
+    assert.equal(from.actorKeyName(ACTOR_KEY_ID), "studio");
+    assert.equal(from.actorKeyName(ACTOR_KEY_ID.toUpperCase()), "studio");
+    assert.equal(from.actorKeyName("00".repeat(32)), undefined);
+    // An ed25519 key never actor-matches: actors are P-256.
+    const edPub = generateKeyPairSync("ed25519").publicKey.export({ type: "spki", format: "der" });
+    const edOnly = parseDomainFile(domainText({ keys: { press: { alg: "ed25519", publicKey: edPub.subarray(edPub.length - 32).toString("base64") } } }));
+    const edFingerprint = keyFingerprint(edOnly.keys["press"]);
+    assert.equal(checkDomain(edOnly).actorKeyName(edFingerprint), undefined);
+});
+// ---------------------------------------------------------------------------
+// check --from: the domain line
+// ---------------------------------------------------------------------------
+test("check --from: the real declared recording reads TRUE under its published key", async () => {
+    const report = await checkIngest(await ingestProof(), { from: checkDomain(parseDomainFile(domainText())) });
+    assert.equal(report.check, "bitgraph-check/2");
+    assert.deepEqual(report.from, { domain: "acme.com", party: "Acme Corp" });
+    const line = domainLineOf(onlyRecording(report));
+    assert.equal(line.result, "TRUE");
+    assert.match(line.detail, /actor key "studio" · published by acme\.com \(Acme Corp\)/);
+    assert.ok(report.notChecked.some((n) => n.includes("pinned")));
+});
+test("check --from: a domain that never published the key reads UNDETERMINED, never FALSE", async () => {
+    const otherKey = generateKeyPairSync("ec", { namedCurve: "P-256" })
+        .publicKey.export({ type: "spki", format: "der" });
+    const from = checkDomain(parseDomainFile(domainText({ keys: { invoices: { alg: "es256", publicKey: otherKey.toString("base64") } } })));
+    const report = await checkIngest(await ingestProof(), { from });
+    const line = domainLineOf(onlyRecording(report));
+    assert.equal(line.result, "UNDETERMINED");
+    assert.match(line.detail, /is not among the 1 key\(s\) acme\.com publishes/);
+});
+test("check --from: a recording that does not verify gets an UNDETERMINED domain line", async () => {
+    const stripped = JSON.parse(proofBytes.toString("utf8"));
+    delete stripped["agency"];
+    const report = await checkIngest(await ingestProof(Buffer.from(JSON.stringify(stripped))), {
+        from: checkDomain(parseDomainFile(domainText())),
+    });
+    const recording = onlyRecording(report);
+    assert.equal(recording.lines.find((l) => l.name === "signature")?.result, "FALSE");
+    const line = domainLineOf(recording);
+    assert.equal(line.result, "UNDETERMINED");
+    assert.match(line.detail, /is not verified here/);
+});
+test("check --from: a detached bitgraph-sig/1 under a published ed25519 key reads TRUE", async () => {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    const spki = publicKey.export({ type: "spki", format: "der" });
+    const rawB64 = spki.subarray(spki.length - 32).toString("base64");
+    const signature = cryptoSign(null, sigMessage(DIGEST_HEX), privateKey).toString("base64");
+    const sigBytes = Buffer.from(JSON.stringify({
+        sig: "bitgraph-sig/1",
+        over: `sha256:${DIGEST_HEX}`,
+        alg: "ed25519",
+        publicKey: rawB64,
+        signature,
+    }));
+    const from = checkDomain(parseDomainFile(domainText({ keys: { press: { alg: "ed25519", publicKey: rawB64 } } })));
+    const sigEvidence = new Map([[createHash("sha256").update(sigBytes).digest("hex"), new Uint8Array(sigBytes)]]);
+    const report = await checkIngest(await ingestProof(), { from, sigEvidence });
+    const line = domainLineOf(onlyRecording(report));
+    assert.equal(line.result, "TRUE");
+    assert.match(line.detail, /signature by "press" · published by acme\.com/);
+});
+test("without --from the report stays bitgraph-check/1 with no from key and no domain line", async () => {
+    const report = await checkIngest(await ingestProof());
+    assert.equal(report.check, "bitgraph-check/1");
+    assert.equal("from" in report, false);
+    assert.equal(onlyRecording(report).lines.some((l) => l.name === "domain"), false);
+});
+// ---------------------------------------------------------------------------
+// The pin store
+// ---------------------------------------------------------------------------
+test("pin store: write, read, list, forget; malformed pins are refused at read", () => {
+    const dir = mkdtempSync(join(tmpdir(), "bitgraph-pins-"));
+    try {
+        const path = writePin("acme.com", Buffer.from(domainText()), dir);
+        assert.ok(path.endsWith("acme.com"));
+        const pin = readPin("acme.com", dir);
+        assert.equal(pin?.file.party, "Acme Corp");
+        assert.equal(pin?.bytes.toString("utf8"), domainText());
+        // A stored file naming a different domain is refused: the store binds
+        // name to statement, so a bad write cannot impersonate.
+        writePin("evil.example", Buffer.from(domainText()), dir);
+        assert.throws(() => readPin("evil.example", dir), DomainFileError);
+        writePin("broken.example", Buffer.from("{"), dir);
+        assert.throws(() => readPin("broken.example", dir), DomainFileError);
+        const listed = listPins(dir);
+        assert.deepEqual(listed.map((p) => [p.domain, p.malformed]), [
+            ["acme.com", false],
+            ["broken.example", true],
+            ["evil.example", true],
+        ]);
+        assert.equal(listed[0]?.party, "Acme Corp");
+        assert.equal(listed[0]?.keyCount, 1);
+        assert.equal(forgetPin("acme.com", dir), true);
+        assert.equal(readPin("acme.com", dir), undefined);
+        assert.equal(forgetPin("acme.com", dir), false);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+// ---------------------------------------------------------------------------
+// The fetch (injected; the only networked verb)
+// ---------------------------------------------------------------------------
+function fakeFetch(body, status = 200) {
+    const urls = [];
+    const impl = (url) => {
+        urls.push(url);
+        return Promise.resolve({
+            ok: status >= 200 && status < 300,
+            status,
+            headers: { get: () => null },
+            arrayBuffer: () => {
+                const buf = Buffer.from(body);
+                return Promise.resolve(buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength));
+            },
+        });
+    };
+    return { impl, urls };
+}
+test("fetchDomainFile: fixed well-known path, verbatim bytes, strict domain binding", async () => {
+    const { impl, urls } = fakeFetch(domainText());
+    const fetched = await fetchDomainFile("acme.com", impl);
+    assert.deepEqual(urls, ["https://acme.com/.well-known/bitgraph"]);
+    assert.equal(fetched.file.party, "Acme Corp");
+    assert.equal(fetched.bytes.toString("utf8"), domainText());
+    // The served file names acme.com; pinning it as another.example must
+    // refuse: a redirect cannot repoint the name.
+    await assert.rejects(fetchDomainFile("another.example", fakeFetch(domainText()).impl), DomainFileError);
+    await assert.rejects(fetchDomainFile("acme.com", fakeFetch("nope", 404).impl), /HTTP 404/);
+    await assert.rejects(fetchDomainFile("acme.com", fakeFetch(Buffer.alloc(70_000)).impl), /the cap is/);
+    await assert.rejects(fetchDomainFile("https://acme.com", fakeFetch(domainText()).impl), /bare hostname/);
+});
+// ---------------------------------------------------------------------------
+// Re-pin diffs
+// ---------------------------------------------------------------------------
+test("diffDomainFiles reports added, removed, changed, and a renamed party", () => {
+    const edPub = generateKeyPairSync("ed25519").publicKey.export({ type: "spki", format: "der" });
+    const edB64 = edPub.subarray(edPub.length - 32).toString("base64");
+    const before = parseDomainFile(domainText());
+    const after = parseDomainFile(domainText({
+        party: "Acme Corporation",
+        keys: {
+            studio: { alg: "ed25519", publicKey: edB64 },
+            press: { alg: "ed25519", publicKey: edB64 },
+        },
+    }));
+    const diff = diffDomainFiles(before, after);
+    assert.deepEqual(diff.partyChanged, { before: "Acme Corp", after: "Acme Corporation" });
+    assert.deepEqual(diff.added.map((r) => r.name), ["press"]);
+    assert.deepEqual(diff.removed.map((r) => r.name), []);
+    assert.deepEqual(diff.changed.map((c) => c.name), ["studio"]);
+    assert.equal(diff.unchanged, 0);
+});
+//# sourceMappingURL=domain.test.js.map

package/dist/__tests__/domain.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.test.js","sourceRoot":"","sources":["../../src/__tests__/domain.test.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,aAAa,EACb,YAAY,EACZ,cAAc,EACd,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEpF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,wDAAwD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACpH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAGvD,CAAC;AACF,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;AAC1D,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;AAClD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEvF,SAAS,UAAU,CAAC,SAAmC;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE;QAC5D,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAoB,UAAU;IACvD,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB;IACxC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,CAAmB,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,SAAyB;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC9D,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC3D,OAAO,IAAgC,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACtC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;IACzD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,QAAiB,EAAY,EAAE;QACxD,IAAI,CAAC;YACH,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,eAAe,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACvG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,oCAAoC,CAAC,CAAC;IACjG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACvH,MAAM,CAAC,KAAK,CACV,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EACtG,sBAAsB,CACvB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;IACzH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACrH,MAAM,CAAC,KAAK,CACV,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAClH,iBAAiB,CAClB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC9F,4CAA4C;IAC5C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,aAAa,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5D,wDAAwD;IACxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACzG,MAAM,MAAM,GAAG,eAAe,CAC5B,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CACrH,CAAC;IACF,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAA0C,CAAC,CAAC;IACpG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,aAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;AACrF,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,IAAI,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;IAC9F,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5G,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC/C,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,2DAA2D,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;IACrG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;SAChE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IAC/D,MAAM,IAAI,GAAG,WAAW,CACtB,eAAe,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAC9G,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IACpF,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACzF,IAAI,EAAE,WAAW,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC;KACjD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAClG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,IAAI,CAAC,SAAS,CAAC;QACb,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,UAAU,UAAU,EAAE;QAC5B,GAAG,EAAE,SAAS;QACd,SAAS,EAAE,MAAM;QACjB,SAAS;KACV,CAAC,CACH,CAAC;IACF,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAClH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACtG,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAExD,sEAAsE;QACtE,wDAAwD;QACxD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;QAEnE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE;YAC3D,CAAC,UAAU,EAAE,KAAK,CAAC;YACnB,CAAC,gBAAgB,EAAE,IAAI,CAAC;YACxB,CAAC,cAAc,EAAE,IAAI,CAAC;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAErC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,SAAS,SAAS,CAAC,IAAqB,EAAE,MAAM,GAAG,GAAG;IACpD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAc,CAAC,GAAG,EAAE,EAAE;QAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;YACjC,MAAM;YACN,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;YAC5B,WAAW,EAAE,GAAG,EAAE;gBAChB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5F,CAAC;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,IAAI,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC/F,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,uCAAuC,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3D,qEAAqE;IACrE,8CAA8C;IAC9C,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;IACxG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3F,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IACtG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;AAC3G,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACzG,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,eAAe,CAC3B,UAAU,CAAC;QACT,KAAK,EAAE,kBAAkB;QACzB,IAAI,EAAE;YACJ,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE;YAC5C,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE;SAC5C;KACF,CAAC,CACH,CAAC;IACF,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACxF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC"}

package/dist/check.d.ts

@@ -65,7 +65,7 @@ export declare const KNOWN_ENCLAVE_MEASUREMENTS: ReadonlyArray<{
 }>;
 /** One checked property, three-valued, with a plain-language reason. */
 export interface CheckLine {
-    name: "file" | "signature" | "attestation" | "enclave" | "witness" | "contradiction";
+    name: "file" | "signature" | "attestation" | "enclave" | "witness" | "contradiction" | "domain";
     result: ThreeValued;
     detail: string;
 }
@@ -115,7 +115,13 @@ export interface CheckAnchor {
     result: ThreeValued;
 }
 export interface CheckReport {
-    check: "bitgraph-check/1";
+    /** /2 exactly when the report was built against a pinned domain (`from`). */
+    check: "bitgraph-check/1" | "bitgraph-check/2";
+    /** The pinned domain this report was checked against, when one was. */
+    from?: {
+        domain: string;
+        party: string;
+    };
     result: ThreeValued;
     /** One-sentence plain-language conclusion, deterministic. */
     summary: string;
@@ -134,6 +140,30 @@ export interface CheckReport {
     };
     network: "none";
 }
+/**
+ * A pinned BitGraph Domain, as the report builder consults it: one line
+ * per recording, TRUE or UNDETERMINED, never FALSE (absence of domain
+ * evidence contradicts nothing; the open-world rule of SPEC §9.3).
+ *
+ * An interface here rather than an import from domain.ts, deliberately:
+ * this module is also built into the browser verifier, and the crypto the
+ * adapter needs (key decoding, signature verification) stays behind it.
+ * domain.ts's `checkDomain(file)` is the implementation; embedders may
+ * supply their own.
+ */
+export interface CheckDomain {
+    domain: string;
+    party: string;
+    keyCount: number;
+    /** Key name for an actor keyId (es256 fingerprint match), if published. */
+    actorKeyName(keyId: string): string | undefined;
+    /**
+     * Key name of the first pinned key a candidate bitgraph-sig/1 file
+     * verifies under, over this digest (lowercase hex). Deterministic:
+     * candidates ascending by content hash, keys in name order.
+     */
+    signatureKeyName(targetSha256Hex: string, evidence: ReadonlyMap<string, Uint8Array>): string | undefined;
+}
 export interface CheckOptions {
     /**
      * False when the environment cannot run the attestation's ECDSA P-384
@@ -141,6 +171,19 @@ export interface CheckOptions {
      * with that reason instead of a false FALSE. Defaults to true.
      */
     webCryptoAvailable?: boolean;
+    /**
+     * Check against a pinned domain: adds one "domain" line per recording
+     * and stamps the report bitgraph-check/2. The check itself stays
+     * offline; the pin was the one fetch, and it already happened.
+     */
+    from?: CheckDomain;
+    /**
+     * Candidate signature bytes by content sha256 hex, for the domain
+     * line's detached-signature path (SPEC §9.4 discipline). checkIngest
+     * collects this from the bundle's matched artifacts when absent;
+     * embedders may supply additional candidates.
+     */
+    sigEvidence?: ReadonlyMap<string, Uint8Array>;
 }
 /**
  * Check an already-ingested bundle: runs the audit's pure tail (no

package/dist/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAEV,WAAW,EAEX,YAAY,EAKb,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQ9C;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqBrG,CAAC;AAMF,wEAAwE;AACxE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,CAAC;IACrF,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,YAAY,GAAG,eAAe,CAAC;IACzC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,YAAY,CAAC;IACvE,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,kFAAkF;IAClF,cAAc,EAAE,SAAS,EAAE,CAAC;IAC5B,gFAAgF;IAChF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE;QAAE,IAAI,EAAE,iBAAiB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAwBD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAGpG;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW,CAuExF;AAqgBD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAuC3D;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEhE"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAEV,WAAW,EAEX,YAAY,EAKb,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAS9C;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqBrG,CAAC;AAMF,wEAAwE;AACxE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,QAAQ,CAAC;IAChG,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,YAAY,GAAG,eAAe,CAAC;IACzC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,YAAY,CAAC;IACvE,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,KAAK,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,uEAAuE;IACvE,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,kFAAkF;IAClF,cAAc,EAAE,SAAS,EAAE,CAAC;IAC5B,gFAAgF;IAChF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE;QAAE,IAAI,EAAE,iBAAiB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAChD;;;;OAIG;IACH,gBAAgB,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;CAC1G;AAED,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC/C;AAwBD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAepG;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW,CA4ExF;AAmlBD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CA0C3D;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEhE"}