@ninelives/agent-governance-sdk 5.0.1

package/dist/encryption/registry-client.js

@@ -0,0 +1,369 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RegistryClient = exports.RegistryError = void 0;
+exports.ed25519AuthSigner = ed25519AuthSigner;
+/**
+ * AgentMesh Registry HTTP client.
+ *
+ * Wraps the registry's REST surface (POST /v1/agents,
+ * PUT/GET /v1/agents/{did}/prekeys, GET /v1/discover, GET/DELETE /v1/agents/{did})
+ * with typed Uint8Array <-> base64url marshalling so callers stay in raw key
+ * material on both sides of the wire.
+ *
+ * Spec: docs/specs/AGENTMESH-WIRE-1.0.md Section 13 (Registry)
+ *
+ * The optional `authSigner` lets callers attach an Ed25519-Timestamp
+ * Authorization header when the registry is configured to require it
+ * (verify_ed25519_timestamp_auth in agent-governance-python). Open
+ * registries leave it unset.
+ */
+const ed25519_js_1 = require("@noble/curves/ed25519.js");
+// ── base64url helpers (browser + node) ────────────────────────────
+function toBase64Url(bytes) {
+    // Node 18+ supports 'base64url' encoding. Fall back to btoa for browsers.
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(bytes).toString("base64url");
+    }
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(s) {
+    if (typeof Buffer !== "undefined") {
+        return new Uint8Array(Buffer.from(s, "base64url"));
+    }
+    const pad = "=".repeat((4 - (s.length % 4)) % 4);
+    const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/") + pad);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+/**
+ * sha256(bytes) → lowercase hex. Used to deterministically derive the
+ * canonical `did:mesh:<hex32>` server DID when a 409 conflict occurs
+ * during POP registration and the server didn't return a body to parse.
+ * Matches `hashlib.sha256(public_key).hexdigest()` on the Python side.
+ */
+async function sha256Hex(bytes) {
+    // Node 18+ exposes Web Crypto via globalThis.crypto.
+    const c = globalThis.crypto;
+    if (c?.subtle) {
+        const ab = bytes.buffer instanceof ArrayBuffer
+            ? bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength)
+            : new Uint8Array(bytes).buffer;
+        const digest = await c.subtle.digest("SHA-256", ab);
+        return Array.from(new Uint8Array(digest))
+            .map((b) => b.toString(16).padStart(2, "0"))
+            .join("");
+    }
+    // Fallback: node:crypto (CommonJS require to keep browser bundlers happy).
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const nodeCrypto = require("node:crypto");
+    return nodeCrypto.createHash("sha256").update(bytes).digest("hex");
+}
+class RegistryError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+        this.name = "RegistryError";
+    }
+}
+exports.RegistryError = RegistryError;
+// ── Implementation ───────────────────────────────────────────────
+class RegistryClient {
+    baseUrl;
+    fetchImpl;
+    authSigner;
+    timeoutMs;
+    maxRetries;
+    retryBaseDelayMs;
+    constructor(opts) {
+        this.baseUrl = opts.baseUrl.replace(/\/$/, "");
+        this.fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
+        this.authSigner = opts.authSigner;
+        this.timeoutMs = opts.timeoutMs ?? 10_000;
+        this.maxRetries = opts.maxRetries ?? 2;
+        this.retryBaseDelayMs = opts.retryBaseDelayMs ?? 250;
+    }
+    // ── Registration ───────────────────────────────────────────────
+    /**
+     * Register the agent in the registry. Idempotent: a 409 response
+     * (already registered) resolves successfully without throwing.
+     *
+     * @param did           Client-supplied DID hint. Ignored when `popSigner`
+     *                      is provided (the server derives the canonical
+     *                      `did:mesh:<sha256(public_key)[:32]>` itself); kept
+     *                      for back-compat with pre-2533 (May-23-2026)
+     *                      registries that accept a body-supplied DID.
+     * @param identityKey   When `popSigner` is set: the **Ed25519** identity
+     *                      public key (32 bytes). The server verifies the
+     *                      proof against this key.
+     *                      When `popSigner` is unset: legacy X25519 public
+     *                      key path, preserves the old wire shape.
+     * @param capabilities  Capability strings the agent advertises. Include
+     *                      friendly display name here so peers can find this
+     *                      agent via `discover(name)`.
+     * @param metadata      Arbitrary string metadata (e.g. {display_name}).
+     * @param popSigner     Optional Ed25519 signer. When set, the client
+     *                      attaches proof-of-possession (the new wire
+     *                      shape introduced by AGT PR #2533, mandatory on
+     *                      registries built from main after 2026-05-23).
+     *                      Required by `ghcr.io/microsoft/agentmesh/registry:4.0.0+`.
+     * @returns The canonical agent DID (server-derived when popSigner is
+     *          set; falls back to the caller-supplied `did` otherwise).
+     */
+    async register(did, identityKey, capabilities = [], metadata = {}, popSigner) {
+        if (identityKey.length !== 32) {
+            throw new Error(`RegistryClient.register: identityKey must be 32 bytes, got ${identityKey.length}`);
+        }
+        // POP path (new wire shape, AGT PR #2533+).
+        if (popSigner) {
+            const publicKeyB64 = toBase64Url(identityKey);
+            const proofTimestamp = new Date().toISOString();
+            // Server verifies Ed25519(public_key_b64_str || proof_timestamp_str)
+            // — the strings as transmitted, NOT the raw key bytes. See
+            // agent-governance-python/agent-mesh/src/agentmesh/registry/app.py
+            // line ~204: `message = req.public_key.encode() + req.proof_timestamp.encode()`.
+            const popMessage = new TextEncoder().encode(publicKeyB64 + proofTimestamp);
+            const proof = popSigner.sign(popMessage);
+            const body = JSON.stringify({
+                public_key: publicKeyB64,
+                proof: toBase64Url(proof),
+                proof_timestamp: proofTimestamp,
+                capabilities,
+                metadata,
+            });
+            const resp = await this.request("POST", "/v1/agents", body);
+            if (resp.status === 201 || resp.status === 200) {
+                // Parse the server-derived DID out of the response body.
+                try {
+                    const j = JSON.parse(resp.bodyText);
+                    if (j.did)
+                        return { did: j.did };
+                }
+                catch { /* fall through */ }
+                return { did };
+            }
+            if (resp.status === 409) {
+                // Already registered — server didn't necessarily return a DID body.
+                // Re-derive it deterministically the same way the server does so the
+                // caller can use the canonical form for subsequent lookups.
+                const sha256 = await sha256Hex(identityKey);
+                return { did: `did:mesh:${sha256.slice(0, 32)}` };
+            }
+            throw new RegistryError(`register failed: ${resp.status}`, resp.status, resp.bodyText);
+        }
+        // Legacy path (pre-2533 registries that accept body `did` + X25519 key).
+        const body = JSON.stringify({
+            did,
+            public_key: toBase64Url(identityKey),
+            capabilities,
+            metadata,
+        });
+        const resp = await this.request("POST", "/v1/agents", body);
+        if (resp.status === 201 || resp.status === 200)
+            return { did };
+        if (resp.status === 409)
+            return { did }; // already registered — idempotent
+        throw new RegistryError(`register failed: ${resp.status}`, resp.status, resp.bodyText);
+    }
+    /** Look up an agent record. Returns null on 404. */
+    async getAgent(did) {
+        const resp = await this.request("GET", `/v1/agents/${encodeURIComponent(did)}`);
+        if (resp.status === 404)
+            return null;
+        if (!resp.ok) {
+            throw new RegistryError(`getAgent failed: ${resp.status}`, resp.status, resp.bodyText);
+        }
+        const j = JSON.parse(resp.bodyText);
+        return {
+            did: j.did,
+            capabilities: j.capabilities,
+            metadata: j.metadata,
+            registeredAt: new Date(j.registered_at),
+            lastSeen: new Date(j.last_seen),
+            reputationScore: j.reputation_score,
+        };
+    }
+    /** Deregister an agent. */
+    async deleteAgent(did) {
+        const resp = await this.request("DELETE", `/v1/agents/${encodeURIComponent(did)}`);
+        if (resp.status === 204 || resp.status === 404)
+            return;
+        if (!resp.ok) {
+            throw new RegistryError(`deleteAgent failed: ${resp.status}`, resp.status, resp.bodyText);
+        }
+    }
+    // ── Pre-Keys ───────────────────────────────────────────────────
+    /**
+     * Upload a pre-key bundle. Replaces any existing bundle for this DID.
+     *
+     * @param identityKey   X25519 long-term key (32 bytes).
+     * @param identityKeyEd Ed25519 signing key (32 bytes) — REQUIRED for
+     *                      receivers to verify the signed pre-key signature.
+     *                      Pass `keyManager.identityKeyEd`.
+     * @param signedPreKey  Output of X3DHKeyManager.generateSignedPreKey()
+     * @param oneTimePreKeys Output of X3DHKeyManager.generateOneTimePreKeys(N)
+     */
+    async uploadPrekeys(did, identityKey, identityKeyEd, signedPreKey, oneTimePreKeys) {
+        if (identityKey.length !== 32) {
+            throw new Error(`RegistryClient.uploadPrekeys: identityKey must be 32 bytes, got ${identityKey.length}`);
+        }
+        if (identityKeyEd.length !== 32) {
+            throw new Error(`RegistryClient.uploadPrekeys: identityKeyEd must be 32 bytes, got ${identityKeyEd.length}`);
+        }
+        const body = JSON.stringify({
+            identity_key: toBase64Url(identityKey),
+            identity_key_ed: toBase64Url(identityKeyEd),
+            signed_pre_key: {
+                key_id: signedPreKey.keyId,
+                public_key: toBase64Url(signedPreKey.publicKey),
+                signature: toBase64Url(signedPreKey.signature),
+            },
+            one_time_pre_keys: oneTimePreKeys.map((otk) => ({
+                key_id: otk.keyId,
+                public_key: toBase64Url(otk.publicKey),
+            })),
+        });
+        const resp = await this.request("PUT", `/v1/agents/${encodeURIComponent(did)}/prekeys`, body);
+        if (!resp.ok) {
+            throw new RegistryError(`uploadPrekeys failed: ${resp.status}`, resp.status, resp.bodyText);
+        }
+    }
+    /**
+     * Fetch a peer's pre-key bundle for X3DH initiation. Atomically
+     * consumes one OPK on the registry side. Returns null on 404 (no
+     * bundle published).
+     *
+     * The returned PreKeyBundle is shaped for direct use with
+     * SecureChannel.createSender() / X3DHKeyManager.
+     *
+     * `identityKeyEd` (Ed25519, used to verify the signed pre-key
+     * signature) is included when the publisher uploaded it via
+     * `uploadPrekeys()`. Bundles that lack identity_key_ed (older clients)
+     * will fail verifyBundle() — peers must upgrade.
+     */
+    async fetchPrekeys(did) {
+        const resp = await this.request("GET", `/v1/agents/${encodeURIComponent(did)}/prekeys`);
+        if (resp.status === 404)
+            return null;
+        if (!resp.ok) {
+            throw new RegistryError(`fetchPrekeys failed: ${resp.status}`, resp.status, resp.bodyText);
+        }
+        const j = JSON.parse(resp.bodyText);
+        const identityKey = fromBase64Url(j.identity_key);
+        if (!j.identity_key_ed) {
+            throw new RegistryError(`Peer ${did} has not published identity_key_ed (Ed25519 signing key). ` +
+                "Their client must upgrade to a version that uploads both X25519 and Ed25519 keys.", 200, resp.bodyText);
+        }
+        const identityKeyEd = fromBase64Url(j.identity_key_ed);
+        const bundle = {
+            identityKey,
+            identityKeyEd,
+            signedPreKey: fromBase64Url(j.signed_pre_key.public_key),
+            signedPreKeySignature: fromBase64Url(j.signed_pre_key.signature),
+            signedPreKeyId: j.signed_pre_key.key_id,
+        };
+        if (j.one_time_pre_key) {
+            bundle.oneTimePreKey = fromBase64Url(j.one_time_pre_key.public_key);
+            bundle.oneTimePreKeyId = j.one_time_pre_key.key_id;
+        }
+        return bundle;
+    }
+    // ── Discovery ──────────────────────────────────────────────────
+    /**
+     * Search agents by capability. Capability matching on the registry
+     * side is exact-string (no globs); to find a friendly name, the agent
+     * must have published that name in its capabilities array at register
+     * time.
+     */
+    async discover(capability, limit = 50) {
+        const path = `/v1/discover?capability=${encodeURIComponent(capability)}&limit=${limit}`;
+        const resp = await this.request("GET", path);
+        if (!resp.ok) {
+            throw new RegistryError(`discover failed: ${resp.status}`, resp.status, resp.bodyText);
+        }
+        const j = JSON.parse(resp.bodyText);
+        return j.results.map((r) => ({
+            did: r.did,
+            capabilities: r.capabilities,
+            reputationScore: r.reputation_score,
+            lastSeen: new Date(r.last_seen),
+        }));
+    }
+    // ── Internal request plumbing ──────────────────────────────────
+    async request(method, path, body) {
+        let lastErr;
+        for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+            try {
+                const result = await this.requestOnce(method, path, body);
+                // Retry on 5xx; succeed/return on 2xx and 4xx.
+                if (result.status >= 500 && result.status < 600 && attempt < this.maxRetries) {
+                    await this.delay(this.retryBaseDelayMs * 2 ** attempt);
+                    continue;
+                }
+                return result;
+            }
+            catch (e) {
+                lastErr = e;
+                if (attempt < this.maxRetries) {
+                    await this.delay(this.retryBaseDelayMs * 2 ** attempt);
+                    continue;
+                }
+                throw e;
+            }
+        }
+        // Unreachable, but keeps TS happy.
+        throw lastErr ?? new Error("RegistryClient.request: exhausted retries");
+    }
+    async requestOnce(method, path, body) {
+        const headers = {};
+        if (body !== undefined)
+            headers["content-type"] = "application/json";
+        if (this.authSigner) {
+            const ts = new Date().toISOString();
+            const sig = this.authSigner.sign(new TextEncoder().encode(ts));
+            headers["authorization"] = `Ed25519-Timestamp ${this.authSigner.did} ${ts} ${toBase64Url(sig)}`;
+        }
+        const ac = new AbortController();
+        const timer = setTimeout(() => ac.abort(), this.timeoutMs);
+        try {
+            const resp = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                method,
+                headers,
+                body,
+                signal: ac.signal,
+            });
+            const bodyText = await resp.text();
+            return { ok: resp.ok, status: resp.status, bodyText };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    delay(ms) {
+        return new Promise((r) => setTimeout(r, ms));
+    }
+}
+exports.RegistryClient = RegistryClient;
+// ── Convenience: build an authSigner from an Ed25519 private key ──
+/**
+ * Build an authSigner suitable for RegistryClientOptions.authSigner
+ * from a 32-byte Ed25519 secret key. This is a thin wrapper around
+ * @noble/curves so callers don't need to import noble themselves.
+ */
+function ed25519AuthSigner(did, ed25519PrivateKey) {
+    const sk = ed25519PrivateKey.length === 64 ? ed25519PrivateKey.slice(0, 32) : ed25519PrivateKey;
+    return {
+        did,
+        sign: (msg) => ed25519_js_1.ed25519.sign(msg, sk),
+    };
+}
+//# sourceMappingURL=registry-client.js.map

package/dist/encryption/registry-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-client.js","sourceRoot":"","sources":["../../src/encryption/registry-client.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAgelC,8CASC;AAveD;;;;;;;;;;;;;;GAcG;AAEH,yDAAmD;AAGnD,qEAAqE;AAErE,SAAS,WAAW,CAAC,KAAiB;IACpC,0EAA0E;IAC1E,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAC,KAAiB;IACxC,qDAAqD;IACrD,MAAM,CAAC,GAAI,UAAqD,CAAC,MAAM,CAAC;IACxE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QACd,MAAM,EAAE,GAAgB,KAAK,CAAC,MAAM,YAAY,WAAW;YACzD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;YAC3E,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IACD,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;IAC1E,OAAO,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAyCD,MAAa,aAAc,SAAQ,KAAK;IAGpB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AATD,sCASC;AAED,oEAAoE;AAEpE,MAAa,cAAc;IACR,OAAO,CAAS;IAChB,SAAS,CAAe;IACxB,UAAU,CAAuC;IACjD,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,gBAAgB,CAAS;IAE1C,YAAY,IAA2B;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC;IACvD,CAAC;IAED,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,QAAQ,CACZ,GAAW,EACX,WAAuB,EACvB,eAAyB,EAAE,EAC3B,WAAmC,EAAE,EACrC,SAAqD;QAErD,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,8DAA8D,WAAW,CAAC,MAAM,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,4CAA4C;QAC5C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,YAAY,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAChD,qEAAqE;YACrE,2DAA2D;YAC3D,mEAAmE;YACnE,iFAAiF;YACjF,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,GAAG,cAAc,CAAC,CAAC;YAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC1B,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;gBACzB,eAAe,EAAE,cAAc;gBAC/B,YAAY;gBACZ,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC/C,yDAAyD;gBACzD,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAqB,CAAC;oBACxD,IAAI,CAAC,CAAC,GAAG;wBAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;gBACnC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC9B,OAAO,EAAE,GAAG,EAAE,CAAC;YACjB,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,oEAAoE;gBACpE,qEAAqE;gBACrE,4DAA4D;gBAC5D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;gBAC5C,OAAO,EAAE,GAAG,EAAE,YAAY,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,CAAC;YACD,MAAM,IAAI,aAAa,CACrB,oBAAoB,IAAI,CAAC,MAAM,EAAE,EACjC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,GAAG;YACH,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC;YACpC,YAAY;YACZ,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,kCAAkC;QAC3E,MAAM,IAAI,aAAa,CACrB,oBAAoB,IAAI,CAAC,MAAM,EAAE,EACjC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAOjC,CAAC;QACF,OAAO;YACL,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,YAAY,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;YACvC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/B,eAAe,EAAE,CAAC,CAAC,gBAAgB;SACpC,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,WAAW,CAAC,GAAW;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QACvD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CAAC,uBAAuB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,kEAAkE;IAElE;;;;;;;;;OASG;IACH,KAAK,CAAC,aAAa,CACjB,GAAW,EACX,WAAuB,EACvB,aAAyB,EACzB,YAA6E,EAC7E,cAAuE;QAEvE,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,mEAAmE,WAAW,CAAC,MAAM,EAAE,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,qEAAqE,aAAa,CAAC,MAAM,EAAE,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,YAAY,EAAE,WAAW,CAAC,WAAW,CAAC;YACtC,eAAe,EAAE,WAAW,CAAC,aAAa,CAAC;YAC3C,cAAc,EAAE;gBACd,MAAM,EAAE,YAAY,CAAC,KAAK;gBAC1B,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC;gBAC/C,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC;aAC/C;YACD,iBAAiB,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC9C,MAAM,EAAE,GAAG,CAAC,KAAK;gBACjB,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;aACvC,CAAC,CAAC;SACJ,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,cAAc,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAC/C,IAAI,CACL,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,yBAAyB,IAAI,CAAC,MAAM,EAAE,EACtC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,cAAc,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAChD,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,wBAAwB,IAAI,CAAC,MAAM,EAAE,EACrC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAKjC,CAAC;QACF,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CACrB,QAAQ,GAAG,4DAA4D;gBACvE,mFAAmF,EACnF,GAAG,EACH,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,MAAM,GAAiB;YAC3B,WAAW;YACX,aAAa;YACb,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC;YACxD,qBAAqB,EAAE,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC;YAChE,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,MAAM;SACxC,CAAC;QACF,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACvB,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACpE,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kEAAkE;IAElE;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,KAAK,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAG,2BAA2B,kBAAkB,CAAC,UAAU,CAAC,UAAU,KAAK,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CAAC,oBAAoB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAQjC,CAAC;QACF,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,gBAAgB;YACnC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,kEAAkE;IAE1D,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAa;QAEb,IAAI,OAAgB,CAAC;QACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC1D,+CAA+C;gBAC/C,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC7E,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;oBACvD,SAAS;gBACX,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,CAAC;gBACZ,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;oBACvD,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,CAAC;YACV,CAAC;QACH,CAAC;QACD,mCAAmC;QACnC,MAAM,OAAO,IAAI,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,IAAY,EACZ,IAAa;QAEb,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACrE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,eAAe,CAAC,GAAG,qBAAqB,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBAC1D,MAAM;gBACN,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,EAAE,CAAC,MAAM;aAClB,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;CACF;AA/VD,wCA+VC;AAED,qEAAqE;AAErE;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,GAAW,EACX,iBAA6B;IAE7B,MAAM,EAAE,GAAG,iBAAiB,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAChG,OAAO;QACL,GAAG;QACH,IAAI,EAAE,CAAC,GAAe,EAAE,EAAE,CAAC,oBAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;KACjD,CAAC;AACJ,CAAC"}

package/dist/encryption/x3dh.d.ts

@@ -0,0 +1,80 @@
+export interface X25519KeyPair {
+    privateKey: Uint8Array;
+    publicKey: Uint8Array;
+}
+export interface PreKeyBundle {
+    identityKey: Uint8Array;
+    /** Ed25519 signing public key — required for signature verification. */
+    identityKeyEd: Uint8Array;
+    signedPreKey: Uint8Array;
+    signedPreKeySignature: Uint8Array;
+    signedPreKeyId: number;
+    oneTimePreKey?: Uint8Array;
+    oneTimePreKeyId?: number;
+}
+export interface X3DHResult {
+    sharedSecret: Uint8Array;
+    ephemeralPublicKey: Uint8Array;
+    usedOneTimeKeyId?: number;
+    associatedData: Uint8Array;
+}
+export declare function generateX25519KeyPair(): X25519KeyPair;
+export declare function ed25519ToX25519(ed25519Private: Uint8Array, ed25519Public: Uint8Array): X25519KeyPair;
+/**
+ * X3DH key-derivation function.
+ *
+ * Computes `HKDF-SHA256(salt = 0x00 × 32, IKM = F ‖ dhConcat,
+ * info = "AgentMesh_X3DH_v1", L = 32)` where `F` is `0xFF × 32`, per the
+ * Signal X3DH spec (§2.2). Callers pass `dhConcat` (the concatenation of the
+ * DH outputs) as `ikm`; the F prefix is prepended here so every code path
+ * (initiator + responder) applies it exactly once.
+ *
+ * Exported so the test suite can pin the exact derived key against a
+ * cross-runtime known-answer vector shared with the AGT Python SDK, which
+ * guards against silent salt/IKM regressions that pass intra-runtime
+ * consistency checks but break Python↔TypeScript interop.
+ */
+export declare function kdf(ikm: Uint8Array): Uint8Array;
+export declare class X3DHKeyManager {
+    readonly identityKey: X25519KeyPair;
+    private readonly ed25519Private;
+    private readonly ed25519Public;
+    private signedPreKeyPair;
+    private oneTimePreKeys;
+    private nextSpkId;
+    private nextOtkId;
+    constructor(ed25519Private: Uint8Array, ed25519Public: Uint8Array);
+    /**
+     * Ed25519 public key used to sign pre-keys. Distinct from
+     * `identityKey.publicKey` (X25519). Peers MUST be given this key to
+     * verify the signature on the signed pre-key (`verifyBundle`).
+     */
+    get identityKeyEd(): Uint8Array;
+    /**
+     * Sign an arbitrary message with the Ed25519 identity private key.
+     *
+     * Used for registry registration proof-of-possession (the server
+     * verifies `Ed25519(public_key || proof_timestamp)` against
+     * `identityKeyEd`) and for the relay's `connect` frame Ed25519
+     * timestamp signature.
+     */
+    signMessage(message: Uint8Array): Uint8Array;
+    generateSignedPreKey(): {
+        keyId: number;
+        publicKey: Uint8Array;
+        signature: Uint8Array;
+    };
+    generateOneTimePreKeys(count: number): Array<{
+        keyId: number;
+        publicKey: Uint8Array;
+    }>;
+    getPublicBundle(otkId?: number): PreKeyBundle;
+    initiate(peerBundle: PreKeyBundle): X3DHResult;
+    respond(peerIdentityKey: Uint8Array, ephemeralPublicKey: Uint8Array, usedOneTimeKeyId?: number): X3DHResult;
+    get signedPreKey(): {
+        keyPair: X25519KeyPair;
+        signature: Uint8Array;
+        keyId: number;
+    } | null;
+}
+//# sourceMappingURL=x3dh.d.ts.map

package/dist/encryption/x3dh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x3dh.d.ts","sourceRoot":"","sources":["../../src/encryption/x3dh.ts"],"names":[],"mappings":"AA0CA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,UAAU,CAAC;IACxB,wEAAwE;IACxE,aAAa,EAAE,UAAU,CAAC;IAC1B,YAAY,EAAE,UAAU,CAAC;IACzB,qBAAqB,EAAE,UAAU,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,UAAU,CAAC;IACzB,kBAAkB,EAAE,UAAU,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,UAAU,CAAC;CAC5B;AAED,wBAAgB,qBAAqB,IAAI,aAAa,CAIrD;AAED,wBAAgB,eAAe,CAC7B,cAAc,EAAE,UAAU,EAC1B,aAAa,EAAE,UAAU,GACxB,aAAa,CAgBf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAE/C;AAaD,qBAAa,cAAc;IACzB,SAAgB,WAAW,EAAE,aAAa,CAAC;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAa;IAC5C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAa;IAC3C,OAAO,CAAC,gBAAgB,CAAiF;IACzG,OAAO,CAAC,cAAc,CAAyC;IAC/D,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,SAAS,CAAK;gBAEV,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU;IAMjE;;;;OAIG;IACH,IAAI,aAAa,IAAI,UAAU,CAE9B;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU;IAI5C,oBAAoB,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE;IAQvF,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC;IAWtF,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,YAAY;IAqB7C,QAAQ,CAAC,UAAU,EAAE,YAAY,GAAG,UAAU;IA6B9C,OAAO,CACL,eAAe,EAAE,UAAU,EAC3B,kBAAkB,EAAE,UAAU,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GACxB,UAAU;IAgCb,IAAI,YAAY;iBAzIqB,aAAa;mBAAa,UAAU;eAAS,MAAM;aA2IvF;CACF"}