@moltzap/identity 2026.902.0

package/dist/http-signature.d.ts

@@ -0,0 +1,60 @@
+/** @file RFC 9421 request signing and strict identity-bound verification profiles. */
+import { type HttpClientRequest, type HttpServerRequest } from "@effect/platform";
+import { Effect } from "effect";
+import { AgentSigningAuthority, type Ed25519PublicKey } from "./agent-key.js";
+import { AuthenticationFailedError } from "./http-errors.js";
+declare const AgentSigningError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AgentSigningError";
+} & Readonly<A>;
+/** An agent-owned HTTP request could not be signed. */
+export declare class AgentSigningError extends AgentSigningError_base {
+}
+/** Closed request-signature profile selected by the owning HTTP route. */
+export type HttpSignatureProfile = "normal" | "registration";
+/**
+ * Exact RFC 8941 SHA-256 content-digest field value.
+ *
+ * @param bodyBytes Exact request body octets.
+ * @returns The single supported digest dictionary member.
+ */
+export declare const contentDigest: (bodyBytes: Uint8Array) => string;
+/**
+ * Installs one exact MoltZap HTTP signature profile on a prepared request.
+ *
+ * @param input Request and fixed profile inputs.
+ * @param input.httpRequest Request whose method and URL are already selected.
+ * @param input.bodyBytes Canonical body octets to install and sign.
+ * @param input.signingAuthority Opaque authority for the caller key.
+ * @param input.profile Route-owned signature profile.
+ * @returns The request with its body and exact signed fields installed.
+ */
+export declare const signHttpRequest: (input: {
+    readonly httpRequest: HttpClientRequest.HttpClientRequest;
+    readonly bodyBytes: Uint8Array;
+    readonly signingAuthority: AgentSigningAuthority;
+    readonly profile: HttpSignatureProfile;
+}) => Effect.Effect<HttpClientRequest.HttpClientRequest, AgentSigningError>;
+/** Replay material retained after exact signature verification. */
+export type VerifiedHttpSignature = Readonly<{
+    readonly nonce: string;
+    readonly expires: number;
+    readonly verifiedAt: number;
+}>;
+/**
+ * Verifies the exact profile and returns its replay nonce.
+ *
+ * @param input Request and fixed verification inputs.
+ * @param input.httpRequest Bounded server request at the selected route.
+ * @param input.bodyBytes Copied body octets covered by the digest.
+ * @param input.publicKey Public key selected by the boundary owner.
+ * @param input.profile Route-owned signature profile.
+ * @returns Replay material bound to the exact accepted verification second.
+ */
+export declare const verifyHttpRequestSignature: (input: {
+    readonly httpRequest: HttpServerRequest.HttpServerRequest;
+    readonly bodyBytes: Uint8Array;
+    readonly publicKey: Ed25519PublicKey;
+    readonly profile: HttpSignatureProfile;
+}) => Effect.Effect<VerifiedHttpSignature, AuthenticationFailedError>;
+export {};
+//# sourceMappingURL=http-signature.d.ts.map

package/dist/http-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-signature.d.ts","sourceRoot":"","sources":["../src/http-signature.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAe,MAAM,EAAU,MAAM,QAAQ,CAAC;AAWrD,OAAO,EACL,qBAAqB,EAErB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;;;;AAI7D,uDAAuD;AACvD,qBAAa,iBAAkB,SAAQ,sBAAqC;CAAG;AA4B/E,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,cAAc,CAAC;AAQ7D;;;;;GAKG;AACH,eAAO,MAAM,aAAa,cAAe,UAAU,KAAG,MACkB,CAAC;AAgGzE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,UAAW;IACrC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;IAC1D,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC,KAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,iBAAiB,CAiB3B,CAAC;AAQ9C,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC,CAAC;AAsTH;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,UAAW;IAChD,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;IAC1D,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC,KAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,yBAAyB,CAoCV,CAAC"}

package/dist/http-signature.js

@@ -0,0 +1,337 @@
+/** @file RFC 9421 request signing and strict identity-bound verification profiles. */
+import { HttpClientRequest as ClientRequest, } from "@effect/platform";
+import { Clock, Data, Effect, Option } from "effect";
+import { httpbis } from "http-message-signatures";
+import { importJWK } from "jose";
+import { createHash, randomBytes, webcrypto } from "node:crypto";
+import { parseDictionary, serializeDictionary, } from "structured-headers";
+import { AgentSigningAuthority, agentSigningPrivateKey, ed25519PublicKeyThumbprintUri, hasCanonicalEd25519SignatureEncoding, } from "./agent-key.js";
+import { AuthenticationFailedError } from "./http-errors.js";
+import { hasCanonicalBase64UrlLength } from "./identifiers.js";
+import { MOLTZAP_VERSION } from "./version.js";
+/** An agent-owned HTTP request could not be signed. */
+export class AgentSigningError extends Data.TaggedError("AgentSigningError") {
+}
+const SIGNATURE_LABEL = "moltzap";
+const SIGNATURE_INTERVAL_SECONDS = 300;
+const FUTURE_SKEW_SECONDS = 5;
+const SIGNATURE_BYTES = 64;
+const NORMAL_FIELDS = Object.freeze([
+    "@method",
+    "@authority",
+    "@path",
+    "@query",
+    "content-digest",
+    "content-type",
+    "moltzap-version",
+]);
+const REGISTRATION_FIELDS = Object.freeze([...NORMAL_FIELDS, "authorization"]);
+const PARAMETERS = Object.freeze([
+    "created",
+    "expires",
+    "keyid",
+    "nonce",
+    "alg",
+    "tag",
+]);
+const fieldsFor = (profile) => profile === "normal" ? NORMAL_FIELDS : REGISTRATION_FIELDS;
+const tagFor = (profile) => profile === "normal" ? "moltzap-request-v1" : "moltzap-registration-v1";
+/**
+ * Exact RFC 8941 SHA-256 content-digest field value.
+ *
+ * @param bodyBytes Exact request body octets.
+ * @returns The single supported digest dictionary member.
+ */
+export const contentDigest = (bodyBytes) => `sha-256=:${createHash("sha256").update(bodyBytes).digest("base64")}:`;
+const toMessageHeaders = (headers) => Object.fromEntries(Object.entries(headers));
+/*
+ * http-message-signatures requires a Promise-returning signing callback.
+ * The Promise stays inside that standards-library adapter.
+ */
+/* eslint-disable agent-code-guard/promise-type, agent-code-guard/then-chain -- http-message-signatures requires this Promise callback */
+const signBytes = (authority, bytes) => {
+    const copiedBytes = Uint8Array.from(bytes);
+    return webcrypto.subtle
+        .sign("Ed25519", agentSigningPrivateKey(authority), copiedBytes)
+        .then((signature) => Buffer.from(signature)); // #ignore-sloppy-code[then-chain]: WebCrypto exposes its signature result as a Promise at this adapter boundary.
+};
+const makeSigningParameters = (signingAuthority) => Effect.gen(function* () {
+    const createdMilliseconds = yield* Clock.currentTimeMillis;
+    const created = new Date(Math.floor(createdMilliseconds / 1_000) * 1_000);
+    const expires = new Date(created.getTime() + SIGNATURE_INTERVAL_SECONDS * 1_000);
+    const nonce = yield* Effect.try({
+        try: () => randomBytes(16).toString("base64url"),
+        catch: () => new AgentSigningError(),
+    });
+    const keyid = yield* ed25519PublicKeyThumbprintUri(AgentSigningAuthority.publicKey(signingAuthority)).pipe(Effect.catchTag("Ed25519PublicKeyOperationError", () => Effect.fail(new AgentSigningError())));
+    return { created, expires, keyid, nonce };
+});
+const prepareRequest = (input) => input.httpRequest.pipe(ClientRequest.bodyUint8Array(input.bodyBytes, "application/json"), ClientRequest.setHeader("content-digest", contentDigest(input.bodyBytes)), ClientRequest.setHeader("moltzap-version", MOLTZAP_VERSION));
+const signPreparedRequest = (input) => Effect.tryPromise({
+    try: () => httpbis.signMessage({
+        name: SIGNATURE_LABEL,
+        fields: [...fieldsFor(input.profile)],
+        params: [...PARAMETERS],
+        paramValues: {
+            ...input.parameters,
+            alg: "ed25519",
+            tag: tagFor(input.profile),
+        },
+        key: {
+            id: input.parameters.keyid,
+            alg: "ed25519",
+            sign: (bytes) => signBytes(input.signingAuthority, bytes),
+        },
+    }, {
+        method: input.prepared.method,
+        url: input.prepared.url,
+        headers: toMessageHeaders(input.prepared.headers),
+    }),
+    catch: () => new AgentSigningError(),
+});
+/**
+ * Installs one exact MoltZap HTTP signature profile on a prepared request.
+ *
+ * @param input Request and fixed profile inputs.
+ * @param input.httpRequest Request whose method and URL are already selected.
+ * @param input.bodyBytes Canonical body octets to install and sign.
+ * @param input.signingAuthority Opaque authority for the caller key.
+ * @param input.profile Route-owned signature profile.
+ * @returns The request with its body and exact signed fields installed.
+ */
+export const signHttpRequest = (input) => Effect.gen(function* () {
+    const parameters = yield* makeSigningParameters(input.signingAuthority);
+    const prepared = prepareRequest(input);
+    const signed = yield* signPreparedRequest({
+        prepared,
+        parameters,
+        profile: input.profile,
+        signingAuthority: input.signingAuthority,
+    });
+    return prepared.pipe(ClientRequest.setHeader("signature-input", String(signed.headers["Signature-Input"])), ClientRequest.setHeader("signature", String(signed.headers.Signature)));
+}).pipe(Effect.withSpan("signHttpRequest"));
+const isItem = (value) => !Array.isArray(value[0]);
+const readCoveredFields = (value) => {
+    if (value === undefined || isItem(value)) {
+        return Option.none();
+    }
+    const [fieldItems, parameters] = value;
+    const fields = [];
+    for (const field of fieldItems) {
+        if (typeof field[0] !== "string" || field[1].size !== 0) {
+            return Option.none();
+        }
+        fields.push(field[0]);
+    }
+    return Option.some({ fields, parameters });
+};
+const readSignatureBytes = (value) => {
+    if (value === undefined ||
+        !isItem(value) ||
+        !(value[0] instanceof ArrayBuffer) ||
+        value[1].size !== 0) {
+        return Option.none();
+    }
+    const signature = new Uint8Array(value[0]);
+    return signature.byteLength === SIGNATURE_BYTES &&
+        hasCanonicalEd25519SignatureEncoding(signature)
+        ? Option.some(signature)
+        : Option.none();
+};
+const isExactSignatureDictionary = (header, dictionary) => serializeDictionary(dictionary) === header &&
+    dictionary.size === 1 &&
+    dictionary.has(SIGNATURE_LABEL);
+const parseExactSignature = (signatureInputHeader, signatureHeader) => {
+    try {
+        const inputDictionary = parseDictionary(signatureInputHeader);
+        const signatureDictionary = parseDictionary(signatureHeader);
+        if (!isExactSignatureDictionary(signatureInputHeader, inputDictionary)) {
+            return Option.none();
+        }
+        if (!isExactSignatureDictionary(signatureHeader, signatureDictionary)) {
+            return Option.none();
+        }
+        const covered = readCoveredFields(inputDictionary.get(SIGNATURE_LABEL));
+        const signature = readSignatureBytes(signatureDictionary.get(SIGNATURE_LABEL));
+        if (Option.isNone(covered) || Option.isNone(signature)) {
+            return Option.none();
+        }
+        return Option.some({
+            fields: covered.value.fields,
+            parameters: covered.value.parameters,
+            signature: signature.value,
+        });
+        // Invalid structured fields are ordinary authentication failures.
+        // eslint-disable-next-line agent-code-guard/bare-catch -- Parser rejection is expected untrusted input. #ignore-sloppy-code-next-line[bare-catch]: The failure is represented by Option.none.
+    }
+    catch {
+        return Option.none();
+    }
+};
+const hasExactSequence = (actual, expected) => actual.length === expected.length &&
+    actual.every((value, index) => value === expected[index]);
+const readInteger = (parameters, name) => {
+    const value = parameters.get(name);
+    return typeof value === "number" && Number.isSafeInteger(value)
+        ? Option.some(value)
+        : Option.none();
+};
+const readParameterValues = (parameters) => {
+    const created = readInteger(parameters, "created");
+    const expires = readInteger(parameters, "expires");
+    const keyid = parameters.get("keyid");
+    const nonce = parameters.get("nonce");
+    if (Option.isNone(created) ||
+        Option.isNone(expires) ||
+        typeof keyid !== "string" ||
+        typeof nonce !== "string") {
+        return Option.none();
+    }
+    return Option.some({
+        created: created.value,
+        expires: expires.value,
+        keyid,
+        nonce,
+        algorithm: Option.fromNullable(parameters.get("alg")),
+        tag: Option.fromNullable(parameters.get("tag")),
+    });
+};
+const hasExpectedIdentityParameters = (values, input) => {
+    const algorithmMatches = Option.isSome(values.algorithm) && values.algorithm.value === "ed25519";
+    const tagMatches = Option.isSome(values.tag) && values.tag.value === tagFor(input.profile);
+    const keyMatches = values.keyid === input.expectedKeyId &&
+        hasCanonicalBase64UrlLength(values.nonce, 16);
+    return algorithmMatches && tagMatches && keyMatches;
+};
+const hasAcceptableTimes = (values, nowSeconds) => values.created <= values.expires &&
+    values.expires - values.created <= SIGNATURE_INTERVAL_SECONDS &&
+    values.created <= nowSeconds + FUTURE_SKEW_SECONDS &&
+    values.expires >= nowSeconds;
+const exactParameters = (parsed, profile, expectedKeyId, nowSeconds) => {
+    if (!hasExactSequence([...parsed.parameters.keys()], PARAMETERS)) {
+        return Option.none();
+    }
+    const values = readParameterValues(parsed.parameters);
+    if (Option.isNone(values) ||
+        !hasExpectedIdentityParameters(values.value, {
+            profile,
+            expectedKeyId,
+        }) ||
+        !hasAcceptableTimes(values.value, nowSeconds)) {
+        return Option.none();
+    }
+    return Option.some({
+        nonce: values.value.nonce,
+        expires: values.value.expires,
+        verifiedAt: nowSeconds,
+    });
+};
+const serverRequestUrl = (request) => {
+    const authority = request.headers.host ?? "";
+    if (!authority) {
+        return Option.none();
+    }
+    try {
+        return Option.some(new URL(request.url, `http://${authority}`));
+        // Invalid authority or request-target text is an authentication failure.
+        // eslint-disable-next-line agent-code-guard/bare-catch -- Invalid authority is expected untrusted input. #ignore-sloppy-code-next-line[bare-catch]: The failure is represented by Option.none.
+    }
+    catch {
+        return Option.none();
+    }
+};
+const readSignatureEnvelope = (input) => {
+    const signatureInput = input.httpRequest.headers["signature-input"];
+    const signature = input.httpRequest.headers.signature;
+    const url = serverRequestUrl(input.httpRequest);
+    if (typeof signatureInput !== "string" ||
+        typeof signature !== "string" ||
+        Option.isNone(url) ||
+        input.httpRequest.headers["content-digest"] !==
+            contentDigest(input.bodyBytes)) {
+        return Option.none();
+    }
+    return Option.some({
+        signatureInput,
+        signature,
+        url: url.value,
+    });
+};
+const makeVerifyingKey = (keyid, publicKey) => ({
+    id: keyid,
+    algs: ["ed25519"],
+    verify: (bytes, candidate) => {
+        const copiedSignature = Uint8Array.from(candidate);
+        const copiedBytes = Uint8Array.from(bytes);
+        return webcrypto.subtle.verify("Ed25519", publicKey, copiedSignature, copiedBytes);
+    },
+});
+const acceptSignatureParameters = (input) => Effect.gen(function* () {
+    const keyid = yield* ed25519PublicKeyThumbprintUri(input.publicKey).pipe(Effect.catchTag("Ed25519PublicKeyOperationError", () => Effect.fail(new AuthenticationFailedError())));
+    const nowSeconds = Math.floor((yield* Clock.currentTimeMillis) / 1_000);
+    const signature = exactParameters(input.parsed, input.profile, keyid, nowSeconds);
+    if (Option.isNone(signature)) {
+        return yield* new AuthenticationFailedError();
+    }
+    return { keyid, signature: signature.value };
+});
+const verifyWithLibrary = (input) => {
+    const key = makeVerifyingKey(input.keyid, input.publicKey);
+    return Effect.tryPromise({
+        try: () => httpbis.verifyMessage({
+            all: true,
+            requiredFields: [...fieldsFor(input.profile)],
+            requiredParams: [...PARAMETERS],
+            // Effect Clock applies the exact time law before this call.
+            tolerance: Number.MAX_SAFE_INTEGER,
+            keyLookup: () => Promise.resolve(key),
+        }, {
+            method: input.httpRequest.method,
+            url: input.url,
+            headers: toMessageHeaders(input.httpRequest.headers),
+        }),
+        catch: () => new AuthenticationFailedError(),
+    });
+};
+/**
+ * Verifies the exact profile and returns its replay nonce.
+ *
+ * @param input Request and fixed verification inputs.
+ * @param input.httpRequest Bounded server request at the selected route.
+ * @param input.bodyBytes Copied body octets covered by the digest.
+ * @param input.publicKey Public key selected by the boundary owner.
+ * @param input.profile Route-owned signature profile.
+ * @returns Replay material bound to the exact accepted verification second.
+ */
+export const verifyHttpRequestSignature = (input) => Effect.gen(function* () {
+    const envelope = readSignatureEnvelope(input);
+    if (Option.isNone(envelope)) {
+        return yield* new AuthenticationFailedError();
+    }
+    const parsed = parseExactSignature(envelope.value.signatureInput, envelope.value.signature);
+    if (Option.isNone(parsed) ||
+        !hasExactSequence(parsed.value.fields, fieldsFor(input.profile))) {
+        return yield* new AuthenticationFailedError();
+    }
+    const accepted = yield* acceptSignatureParameters({
+        parsed: parsed.value,
+        profile: input.profile,
+        publicKey: input.publicKey,
+    });
+    const publicKey = yield* Effect.tryPromise({
+        try: () => importJWK(input.publicKey, "Ed25519"),
+        catch: () => new AuthenticationFailedError(),
+    });
+    const verified = yield* verifyWithLibrary({
+        httpRequest: input.httpRequest,
+        profile: input.profile,
+        url: envelope.value.url,
+        keyid: accepted.keyid,
+        publicKey,
+    });
+    if (verified !== true) {
+        return yield* new AuthenticationFailedError();
+    }
+    return accepted.signature;
+}).pipe(Effect.withSpan("verifyHttpRequestSignature"));
+//# sourceMappingURL=http-signature.js.map

package/dist/http-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-signature.js","sourceRoot":"","sources":["../src/http-signature.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EACL,iBAAiB,IAAI,aAAa,GAGnC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,OAAO,EAAqB,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAkB,SAAS,EAAE,MAAM,MAAM,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAIL,eAAe,EACf,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EAEtB,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,uDAAuD;AACvD,MAAM,OAAO,iBAAkB,SAAQ,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC;CAAG;AAE/E,MAAM,eAAe,GAAG,SAAS,CAAC;AAClC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,SAAS;IACT,YAAY;IACZ,OAAO;IACP,QAAQ;IACR,gBAAgB;IAChB,cAAc;IACd,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;AAE/E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,SAAS;IACT,SAAS;IACT,OAAO;IACP,OAAO;IACP,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAKH,MAAM,SAAS,GAAG,CAAC,OAA6B,EAAqB,EAAE,CACrE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC;AAE7D,MAAM,MAAM,GAAG,CAAC,OAA6B,EAAU,EAAE,CACvD,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAqB,EAAU,EAAE,CAC7D,YAAY,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;AAEzE,MAAM,gBAAgB,GAAG,CACvB,OAAyC,EACjB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,yIAAyI;AACzI,MAAM,SAAS,GAAG,CAChB,SAAgC,EAChC,KAAa,EAEI,EAAE;IACnB,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC,MAAM;SACpB,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;SAC/D,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iHAAiH;AACnK,CAAC,CAAC;AAUF,MAAM,qBAAqB,GAAG,CAC5B,gBAAuC,EACc,EAAE,CACvD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,IAAI,CACtB,OAAO,CAAC,OAAO,EAAE,GAAG,0BAA0B,GAAG,KAAK,CACvD,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9B,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,EAAE;KACrC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,6BAA6B,CAChD,qBAAqB,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAClD,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE,CACrD,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAAC,CACrC,CACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEL,MAAM,cAAc,GAAG,CAAC,KAGvB,EAAuC,EAAE,CACxC,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,CAAC,EACjE,aAAa,CAAC,SAAS,CAAC,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EACzE,aAAa,CAAC,SAAS,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAC5D,CAAC;AAEJ,MAAM,mBAAmB,GAAG,CAAC,KAK5B,EAAE,EAAE,CACH,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,GAAG,EAAE,CACR,OAAO,CAAC,WAAW,CACjB;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC;QACvB,WAAW,EAAE;YACX,GAAG,KAAK,CAAC,UAAU;YACnB,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;SAC3B;QACD,GAAG,EAAE;YACH,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;YAC1B,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC;SAC1D;KACF,EACD;QACE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;QAC7B,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;QACvB,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;KAClD,CACF;IACH,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,EAAE;CACrC,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAK/B,EAAyE,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;QACxC,QAAQ;QACR,UAAU;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAClB,aAAa,CAAC,SAAS,CACrB,iBAAiB,EACjB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAC1C,EACD,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAe9C,MAAM,MAAM,GAAG,CAAC,KAAuB,EAAiB,EAAE,CACxD,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3B,MAAM,iBAAiB,GAAG,CACxB,KAAwB,EAMxB,EAAE;IACF,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,KAAwB,EACG,EAAE;IAC7B,IACE,KAAK,KAAK,SAAS;QACnB,CAAC,MAAM,CAAC,KAAK,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,WAAW,CAAC;QAClC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EACnB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC,UAAU,KAAK,eAAe;QAC7C,oCAAoC,CAAC,SAAS,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CACjC,MAAc,EACd,UAA8C,EACrC,EAAE,CACX,mBAAmB,CAAC,UAAU,CAAC,KAAK,MAAM;IAC1C,UAAU,CAAC,IAAI,KAAK,CAAC;IACrB,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAElC,MAAM,mBAAmB,GAAG,CAC1B,oBAA4B,EAC5B,eAAuB,EACS,EAAE;IAClC,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,eAAe,CAAC,oBAAoB,CAAC,CAAC;QAC9D,MAAM,mBAAmB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,CAAC,0BAA0B,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,CAAC;YACvE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,eAAe,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACtE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,kBAAkB,CAClC,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC,CACzC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;YACjB,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU;YACpC,SAAS,EAAE,SAAS,CAAC,KAAK;SAC3B,CAAC,CAAC;QACH,kEAAkE;QAClE,8LAA8L;IAChM,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,MAAyB,EACzB,QAA2B,EAClB,EAAE,CACX,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;IACjC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAE5D,MAAM,WAAW,GAAG,CAClB,UAAyC,EACzC,IAAY,EACW,EAAE;IACzB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC7D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC,CAAC;AAWF,MAAM,mBAAmB,GAAG,CAC1B,UAAyC,EACA,EAAE;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,IACE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtB,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;QACjB,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,KAAK;QACL,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KAChD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,6BAA6B,GAAG,CACpC,MAAgC,EAChC,KAGC,EACQ,EAAE;IACX,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC;IAC1E,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,UAAU,GACd,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,aAAa;QACpC,2BAA2B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,gBAAgB,IAAI,UAAU,IAAI,UAAU,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,MAAgC,EAChC,UAAkB,EACT,EAAE,CACX,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO;IAChC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,0BAA0B;IAC7D,MAAM,CAAC,OAAO,IAAI,UAAU,GAAG,mBAAmB;IAClD,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC;AAE/B,MAAM,eAAe,GAAG,CACtB,MAAuB,EACvB,OAA6B,EAC7B,aAAqB,EACrB,UAAkB,EACoB,EAAE;IACxC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtD,IACE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QACrB,CAAC,6BAA6B,CAAC,MAAM,CAAC,KAAK,EAAE;YAC3C,OAAO;YACP,aAAa;SACd,CAAC;QACF,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,EAC7C,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QACzB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;QAC7B,UAAU,EAAE,UAAU;KACvB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,OAA4C,EACxB,EAAE;IACtB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,SAAS,EAAE,CAAC,CAAC,CAAC;QAChE,yEAAyE;QACzE,+LAA+L;IACjM,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAQF,MAAM,qBAAqB,GAAG,CAAC,KAG9B,EAAoC,EAAE;IACrC,MAAM,cAAc,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;IACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,IACE,OAAO,cAAc,KAAK,QAAQ;QAClC,OAAO,SAAS,KAAK,QAAQ;QAC7B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAClB,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACzC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAChC,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;QACjB,cAAc;QACd,SAAS;QACT,GAAG,EAAE,GAAG,CAAC,KAAK;KACf,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,KAAa,EACb,SAAoB,EACN,EAAE,CAAC,CAAC;IAClB,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,CAAC,SAAS,CAAC;IACjB,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAC3B,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAC5B,SAAS,EACT,SAAS,EACT,eAAe,EACf,WAAW,CACZ,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAOH,MAAM,yBAAyB,GAAG,CAAC,KAIlC,EAAyE,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CACtE,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE,CACrD,MAAM,CAAC,IAAI,CAAC,IAAI,yBAAyB,EAAE,CAAC,CAC7C,CACF,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,eAAe,CAC/B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,OAAO,EACb,KAAK,EACL,UAAU,CACX,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,CAAC,KAM1B,EAA4D,EAAE;IAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,GAAG,EAAE,CACR,OAAO,CAAC,aAAa,CACnB;YACE,GAAG,EAAE,IAAI;YACT,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7C,cAAc,EAAE,CAAC,GAAG,UAAU,CAAC;YAC/B,4DAA4D;YAC5D,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;SACtC,EACD;YACE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;YAChC,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC;SACrD,CACF;QACH,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,yBAAyB,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,KAK1C,EAAmE,EAAE,CACpE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAChC,QAAQ,CAAC,KAAK,CAAC,cAAc,EAC7B,QAAQ,CAAC,KAAK,CAAC,SAAS,CACzB,CAAC;IACF,IACE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QACrB,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAChE,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC;QAChD,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACzC,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC;QAChD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,yBAAyB,EAAE;KAC7C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG;QACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS;KACV,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC;AAC5B,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC"}

package/dist/identifiers.d.ts

@@ -0,0 +1,32 @@
+/** @file Canonical branded identity identifiers and their exact encodings. */
+import { Schema } from "effect";
+/**
+ * Tests whether a string is the unique base64url encoding of a fixed byte length.
+ *
+ * @param value Candidate unpadded base64url text.
+ * @param byteLength Required decoded byte length.
+ * @returns Whether the candidate has the one canonical encoding for that length.
+ */
+export declare const hasCanonicalBase64UrlLength: (value: string, byteLength: number) => boolean;
+/**
+ * Constructs one exact prefixed identity Schema for its semantic owner.
+ *
+ * @param name Nominal Schema and brand name.
+ * @param prefix Fixed representation prefix.
+ * @param byteLength Required decoded payload length.
+ * @returns The exact branded string Schema.
+ */
+export declare const canonicalIdentifier: <const Name extends string>(name: Name, prefix: string, byteLength: number) => Schema.brand<Schema.filter<typeof Schema.String>, Name>;
+/** Canonical network identity minted by the Registry. */
+export declare const AgentId: Schema.brand<Schema.filter<typeof Schema.String>, "AgentId">;
+/** Validated nominal value decoded by {@link AgentId}. */
+export type AgentId = typeof AgentId.Type;
+/** Opaque identity of the principal represented by an agent. */
+export declare const PrincipalId: Schema.brand<Schema.filter<typeof Schema.String>, "PrincipalId">;
+/** Validated nominal value decoded by {@link PrincipalId}. */
+export type PrincipalId = typeof PrincipalId.Type;
+/** Immutable Registry-wide human-facing agent handle. */
+export declare const AgentName: Schema.brand<Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>, "AgentName">;
+/** Validated nominal value decoded by {@link AgentName}. */
+export type AgentName = typeof AgentName.Type;
+//# sourceMappingURL=identifiers.d.ts.map

package/dist/identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.d.ts","sourceRoot":"","sources":["../src/identifiers.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,OAAO,EAAoB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAYlD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,UAC/B,MAAM,cACD,MAAM,KACjB,OAAqE,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,CAAC,IAAI,SAAS,MAAM,QACrD,IAAI,UACF,MAAM,cACF,MAAM,4DAsBjB,CAAC;AAMJ,yDAAyD;AACzD,eAAO,MAAM,OAAO,8DAInB,CAAC;AACF,0DAA0D;AAC1D,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,CAAC;AAE1C,gEAAgE;AAChE,eAAO,MAAM,WAAW,kEAIvB,CAAC;AACF,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,SAAS,8FASrB,CAAC;AACF,4DAA4D;AAC5D,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAC"}

package/dist/identifiers.js

@@ -0,0 +1,55 @@
+/** @file Canonical branded identity identifiers and their exact encodings. */
+import { Either, Encoding, Schema } from "effect";
+const IDENTIFIER_BYTE_LENGTH = 16;
+const decodeCanonicalBase64Url = (value) => {
+    return Either.match(Encoding.decodeBase64Url(value), {
+        onLeft: () => undefined,
+        onRight: (decoded) => Encoding.encodeBase64Url(decoded) === value ? decoded : undefined,
+    });
+};
+/**
+ * Tests whether a string is the unique base64url encoding of a fixed byte length.
+ *
+ * @param value Candidate unpadded base64url text.
+ * @param byteLength Required decoded byte length.
+ * @returns Whether the candidate has the one canonical encoding for that length.
+ */
+export const hasCanonicalBase64UrlLength = (value, byteLength) => decodeCanonicalBase64Url(value)?.byteLength === byteLength;
+/**
+ * Constructs one exact prefixed identity Schema for its semantic owner.
+ *
+ * @param name Nominal Schema and brand name.
+ * @param prefix Fixed representation prefix.
+ * @param byteLength Required decoded payload length.
+ * @returns The exact branded string Schema.
+ */
+export const canonicalIdentifier = (name, prefix, byteLength) => Schema.String.pipe(Schema.filter((value) => {
+    const hasPrefix = value.startsWith(prefix);
+    if (!hasPrefix) {
+        return false;
+    }
+    const payload = value.slice(prefix.length);
+    return hasCanonicalBase64UrlLength(payload, byteLength);
+}, {
+    identifier: name,
+    description: `${name} canonical representation`,
+}), Schema.brand(name), Schema.annotations({
+    identifier: name,
+    description: `${name} canonical representation`,
+}));
+/* eslint-disable @typescript-eslint/naming-convention, @typescript-eslint/no-redeclare --
+ * Named Effect Schemas share their domain names with the nominal types they decode.
+ */
+/** Canonical network identity minted by the Registry. */
+export const AgentId = canonicalIdentifier("AgentId", "agt_", IDENTIFIER_BYTE_LENGTH);
+/** Opaque identity of the principal represented by an agent. */
+export const PrincipalId = canonicalIdentifier("PrincipalId", "prn_", IDENTIFIER_BYTE_LENGTH);
+/** Immutable Registry-wide human-facing agent handle. */
+export const AgentName = Schema.String.pipe(Schema.minLength(3), Schema.maxLength(32), Schema.pattern(/^[a-z0-9]+(-[a-z0-9]+)*$/), Schema.brand("AgentName"), Schema.annotations({
+    identifier: "AgentName",
+    description: "Registry-wide immutable agent handle",
+}));
+/* eslint-enable @typescript-eslint/naming-convention, @typescript-eslint/no-redeclare --
+ * Restore the general naming rules after the public Schema/type pairs.
+ */
+//# sourceMappingURL=identifiers.js.map

package/dist/identifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.js","sourceRoot":"","sources":["../src/identifiers.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAElD,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC,MAAM,wBAAwB,GAAG,CAAC,KAAa,EAA0B,EAAE;IACzE,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE;QACnD,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;QACvB,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CACnB,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KACpE,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,KAAa,EACb,UAAkB,EACT,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,UAAU,KAAK,UAAU,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,IAAU,EACV,MAAc,EACd,UAAkB,EAClB,EAAE,CACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAChB,MAAM,CAAC,MAAM,CACX,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,2BAA2B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC,EACD;IACE,UAAU,EAAE,IAAI;IAChB,WAAW,EAAE,GAAG,IAAI,2BAA2B;CAChD,CACF,EACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAClB,MAAM,CAAC,WAAW,CAAC;IACjB,UAAU,EAAE,IAAI;IAChB,WAAW,EAAE,GAAG,IAAI,2BAA2B;CAChD,CAAC,CACH,CAAC;AAEJ;;GAEG;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,OAAO,GAAG,mBAAmB,CACxC,SAAS,EACT,MAAM,EACN,sBAAsB,CACvB,CAAC;AAIF,gEAAgE;AAChE,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAC5C,aAAa,EACb,MAAM,EACN,sBAAsB,CACvB,CAAC;AAIF,yDAAyD;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACzC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EACnB,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EACpB,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAC1C,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EACzB,MAAM,CAAC,WAAW,CAAC;IACjB,UAAU,EAAE,WAAW;IACvB,WAAW,EAAE,sCAAsC;CACpD,CAAC,CACH,CAAC;AAIF;;GAEG"}

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @file Public Identity contracts: immutable agent cards, identifiers,
+ * signing, and request authentication. Identity sits at the root of the
+ * product dependency graph and imports no other workspace package.
+ */
+/**
+ * The sole MoltZap wire compatibility value. Every MoltZap-owned network
+ * schema carries exactly this value; there is no range negotiation or
+ * per-layer wire version. `version.ts` is its source of truth: the
+ * architecture boundary check reads the literal from there, and
+ * `scripts/docs/moltzap-version.ts` reads it for the documentation
+ * constants generator and its gate tests.
+ *
+ * The npm package version, the MCP revision, simulator definition ID,
+ * EventCatalog schema, and RunLedger storage version are independent
+ * namespaces and never imply compatibility with this value.
+ */
+export { MOLTZAP_VERSION } from "./version.js";
+/** Canonical refined values shared by identity and its consumers. */
+export { AgentId, AgentName, PrincipalId } from "./identifiers.js";
+/** Exact immutable public-key representation used by identity artifacts. */
+export { AgentSigningAuthority, Ed25519PublicKey, InvalidAgentPrivateKeyError, } from "./agent-key.js";
+/** Immutable Registry attestation and its pinned verification boundary. */
+export { AgentCard, AgentCardDigest, AgentCardVerificationError, type VerifiedAgentCard, } from "./agent-card.js";
+/** Opaque attributed payload and endpoint-owned signing operations. */
+export { MessageId, SignedMessage, SignedMessageSigningError, SignedMessageVerificationError, type VerifiedSignedMessage, } from "./signed-message.js";
+/** Registered-agent HTTP authentication and its opaque verified proof. */
+export { AuthenticatedHttp, type VerifiedAgentRequest, } from "./authenticated-http.js";
+/** Shared closed HTTP-envelope failures. */
+export { AuthenticationFailedError, InternalServerError, MalformedRequestError, MethodNotAllowedError, OverloadedError, PayloadTooLargeError, RouteNotFoundError, UnavailableError, UnsupportedMediaTypeError, VersionMismatchError, } from "./http-errors.js";
+/** HTTP request signing failure without implementation detail. */
+export { AgentSigningError } from "./http-signature.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,qEAAqE;AACrE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACnE,4EAA4E;AAC5E,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,2EAA2E;AAC3E,OAAO,EACL,SAAS,EACT,eAAe,EACf,0BAA0B,EAC1B,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,uEAAuE;AACvE,OAAO,EACL,SAAS,EACT,aAAa,EACb,yBAAyB,EACzB,8BAA8B,EAC9B,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,0EAA0E;AAC1E,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,4CAA4C;AAC5C,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,kEAAkE;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,34 @@
+/**
+ * @file Public Identity contracts: immutable agent cards, identifiers,
+ * signing, and request authentication. Identity sits at the root of the
+ * product dependency graph and imports no other workspace package.
+ */
+// safer-arch-ignore no-folder-cycle: This facade re-exports cohesive identity modules that depend on sibling identity contracts; those modules never import the facade.
+/**
+ * The sole MoltZap wire compatibility value. Every MoltZap-owned network
+ * schema carries exactly this value; there is no range negotiation or
+ * per-layer wire version. `version.ts` is its source of truth: the
+ * architecture boundary check reads the literal from there, and
+ * `scripts/docs/moltzap-version.ts` reads it for the documentation
+ * constants generator and its gate tests.
+ *
+ * The npm package version, the MCP revision, simulator definition ID,
+ * EventCatalog schema, and RunLedger storage version are independent
+ * namespaces and never imply compatibility with this value.
+ */
+export { MOLTZAP_VERSION } from "./version.js";
+/** Canonical refined values shared by identity and its consumers. */
+export { AgentId, AgentName, PrincipalId } from "./identifiers.js";
+/** Exact immutable public-key representation used by identity artifacts. */
+export { AgentSigningAuthority, Ed25519PublicKey, InvalidAgentPrivateKeyError, } from "./agent-key.js";
+/** Immutable Registry attestation and its pinned verification boundary. */
+export { AgentCard, AgentCardDigest, AgentCardVerificationError, } from "./agent-card.js";
+/** Opaque attributed payload and endpoint-owned signing operations. */
+export { MessageId, SignedMessage, SignedMessageSigningError, SignedMessageVerificationError, } from "./signed-message.js";
+/** Registered-agent HTTP authentication and its opaque verified proof. */
+export { AuthenticatedHttp, } from "./authenticated-http.js";
+/** Shared closed HTTP-envelope failures. */
+export { AuthenticationFailedError, InternalServerError, MalformedRequestError, MethodNotAllowedError, OverloadedError, PayloadTooLargeError, RouteNotFoundError, UnavailableError, UnsupportedMediaTypeError, VersionMismatchError, } from "./http-errors.js";
+/** HTTP request signing failure without implementation detail. */
+export { AgentSigningError } from "./http-signature.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wKAAwK;AAExK;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,qEAAqE;AACrE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACnE,4EAA4E;AAC5E,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,2EAA2E;AAC3E,OAAO,EACL,SAAS,EACT,eAAe,EACf,0BAA0B,GAE3B,MAAM,iBAAiB,CAAC;AACzB,uEAAuE;AACvE,OAAO,EACL,SAAS,EACT,aAAa,EACb,yBAAyB,EACzB,8BAA8B,GAE/B,MAAM,qBAAqB,CAAC;AAC7B,0EAA0E;AAC1E,OAAO,EACL,iBAAiB,GAElB,MAAM,yBAAyB,CAAC;AACjC,4CAA4C;AAC5C,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,kEAAkE;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/registry/admission.d.ts

@@ -0,0 +1,27 @@
+/** @file Registry-owned bootstrap admission before private dispatch. */
+import type { HttpServerRequest } from "@effect/platform";
+import { Effect, Redacted } from "effect";
+import type { RegistryStorage } from "./storage.js";
+import { AuthenticationFailedError, type InternalServerError, MalformedRequestError, OverloadedError, type UnavailableError, VersionMismatchError } from "../http-errors.js";
+import { type RegistryRegisterRequest as RegistryRegisterRequestValue } from "./contract.js";
+type BootstrapRegistrationInput = Readonly<{
+    httpRequest: HttpServerRequest.HttpServerRequest;
+    bodyBytes: Uint8Array;
+    admissionCredential: Redacted.Redacted;
+    nonceCapacity: number;
+    storage: RegistryStorage;
+}>;
+/**
+ * Verifies Registry-owned bootstrap admission through its durable replay step.
+ *
+ * @param input Bootstrap boundary dependencies and request.
+ * @param input.httpRequest Server request carrying signed framing.
+ * @param input.bodyBytes Bounded body octets covered by the signature.
+ * @param input.admissionCredential Configured bootstrap secret.
+ * @param input.nonceCapacity Maximum live bootstrap nonces.
+ * @param input.storage Durable nonce store.
+ * @returns The complete registration request after every admission check.
+ */
+export declare function verifyBootstrapRegistration(input: BootstrapRegistrationInput): Effect.Effect<RegistryRegisterRequestValue, MalformedRequestError | AuthenticationFailedError | OverloadedError | VersionMismatchError | UnavailableError | InternalServerError>;
+export {};
+//# sourceMappingURL=admission.d.ts.map

package/dist/registry/admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.d.ts","sourceRoot":"","sources":["../../src/registry/admission.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAU,MAAM,QAAQ,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EACL,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,eAAe,EACf,KAAK,gBAAgB,EACrB,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAEL,KAAK,uBAAuB,IAAI,4BAA4B,EAC7D,MAAM,eAAe,CAAC;AAmBvB,KAAK,0BAA0B,GAAG,QAAQ,CAAC;IACzC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;IACjD,SAAS,EAAE,UAAU,CAAC;IACtB,mBAAmB,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,eAAe,CAAC;CAC1B,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,0BAA0B,GAChC,MAAM,CAAC,MAAM,CACd,4BAA4B,EAC1B,qBAAqB,GACrB,yBAAyB,GACzB,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,CACtB,CA4BA"}