@openvtc/trust-tasks 0.20.7 → 0.21.0

package/dist/auth/step-up/approve-request/0.3/payload.js

@@ -0,0 +1,345 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/step-up/approve-request/0.3/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-request/0.3";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-request/0.3#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/auth/step-up/approve-request/0.3",
+    "title": "Auth — Step-up Approve Request",
+    "description": "A relying party asks an approver (typically a wallet or a VTA) to ratify an AAL elevation for a subject's session, or — bound to one operation — to approve that one act without elevating any session.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "subject",
+        "challenge",
+        "reason"
+    ],
+    "properties": {
+        "subject": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The VID whose session is being elevated, or — for a step-up bound to one operation — the VID whose act that operation is. The approver MUST verify this is a VID it can speak for."
+        },
+        "sessionId": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The session the relying party wants elevated. Opaque to the approver. Absent only when the step-up is bound to one operation that arrived without a session (a signed Trust Task document, for instance); see `boundTo`."
+        },
+        "boundTo": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "description": "Present when the step-up authorizes exactly one operation rather than raising a session's assurance level. An opaque relying-party identifier for that operation — for an operation that arrived as a signed document, a digest of its type and payload salted with `challenge`. Echoed by a `recorded` approve-response acknowledgement. Not a capability: the binding is the relying party's own state."
+        },
+        "challenge": {
+            "type": "string",
+            "minLength": 16,
+            "description": "base64url-encoded nonce the approver will include in the approve-response signature. ≥128 bits entropy."
+        },
+        "reason": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 500,
+            "description": "Human-readable explanation of WHY the relying party is asking (e.g. \"confirm transfer of 1000 USD to bob.example\"). Surfaced to the user by the approver for consent. SHOULD be specific enough that a user can refuse intelligently."
+        },
+        "targetAcr": {
+            "type": "string",
+            "description": "The acr the relying party expects on the elevated session. Approvers MAY refuse if they cannot deliver this level."
+        },
+        "acceptableEvidence": {
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": {
+                "type": "string",
+                "enum": [
+                    "didSigned",
+                    "webauthn"
+                ]
+            },
+            "description": "Which approve-response evidence kinds the relying party will accept (see auth/step-up/approve-response `evidence`). When omitted, the approver MAY use any kind it supports. An approver that cannot satisfy any listed kind SHOULD refuse with `methodUnsupported`."
+        },
+        "webauthn": {
+            "$ref": "#/$defs/CredentialRequestOptions",
+            "description": "Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with."
+        },
+        "ttl": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Seconds within which the relying party expects the approve-response. Approvers SHOULD treat as advisory — the relying party's own expiry policy is authoritative."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Auth Step-up Approve Request — response payload",
+            "description": "Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.3#response.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "status"
+            ],
+            "properties": {
+                "status": {
+                    "type": "string",
+                    "enum": [
+                        "accepted",
+                        "refused"
+                    ],
+                    "description": "`accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set."
+                },
+                "reason": {
+                    "type": "string",
+                    "maxLength": 1024,
+                    "description": "Required when status is `refused`."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "CredentialRequestOptions": {
+            "$anchor": "credentialRequestOptions",
+            "title": "PublicKeyCredentialRequestOptions",
+            "description": "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "challenge"
+            ],
+            "properties": {
+                "extensions": {
+                    "type": "object",
+                    "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+                },
+                "challenge": {
+                    "type": "string",
+                    "description": "base64url-encoded one-time nonce."
+                },
+                "timeout": {
+                    "type": "integer",
+                    "minimum": 1
+                },
+                "rpId": {
+                    "type": "string",
+                    "minLength": 1
+                },
+                "allowCredentials": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/CredentialDescriptor"
+                    }
+                },
+                "userVerification": {
+                    "enum": [
+                        "discouraged",
+                        "preferred",
+                        "required"
+                    ]
+                }
+            }
+        },
+        "CredentialDescriptor": {
+            "$anchor": "credentialDescriptor",
+            "title": "PublicKeyCredentialDescriptor",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "type",
+                "id"
+            ],
+            "properties": {
+                "type": {
+                    "const": "public-key"
+                },
+                "id": {
+                    "type": "string",
+                    "description": "base64url-encoded credential id."
+                },
+                "transports": {
+                    "type": "array",
+                    "items": {
+                        "enum": [
+                            "usb",
+                            "nfc",
+                            "ble",
+                            "internal",
+                            "hybrid"
+                        ]
+                    }
+                }
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "Auth Step-up Approve Request — response payload",
+            "description": "Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.3#response.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "status"
+            ],
+            "properties": {
+                "status": {
+                    "type": "string",
+                    "enum": [
+                        "accepted",
+                        "refused"
+                    ],
+                    "description": "`accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set."
+                },
+                "reason": {
+                    "type": "string",
+                    "maxLength": 1024,
+                    "description": "Required when status is `refused`."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "CredentialRequestOptions": {
+            "$anchor": "credentialRequestOptions",
+            "title": "PublicKeyCredentialRequestOptions",
+            "description": "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "challenge"
+            ],
+            "properties": {
+                "extensions": {
+                    "type": "object",
+                    "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+                },
+                "challenge": {
+                    "type": "string",
+                    "description": "base64url-encoded one-time nonce."
+                },
+                "timeout": {
+                    "type": "integer",
+                    "minimum": 1
+                },
+                "rpId": {
+                    "type": "string",
+                    "minLength": 1
+                },
+                "allowCredentials": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/CredentialDescriptor"
+                    }
+                },
+                "userVerification": {
+                    "enum": [
+                        "discouraged",
+                        "preferred",
+                        "required"
+                    ]
+                }
+            }
+        },
+        "CredentialDescriptor": {
+            "$anchor": "credentialDescriptor",
+            "title": "PublicKeyCredentialDescriptor",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "type",
+                "id"
+            ],
+            "properties": {
+                "type": {
+                    "const": "public-key"
+                },
+                "id": {
+                    "type": "string",
+                    "description": "base64url-encoded credential id."
+                },
+                "transports": {
+                    "type": "array",
+                    "items": {
+                        "enum": [
+                            "usb",
+                            "nfc",
+                            "ble",
+                            "internal",
+                            "hybrid"
+                        ]
+                    }
+                }
+            }
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/auth/step-up/approve-request/0.3/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/auth/step-up/approve-request/0.3/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,8DAAuE,CAAC;AAKhG,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,uEAAgF,CAAC;AAKlH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,8DAA8D;IACrE,OAAO,EAAE,gCAAgC;IACzC,aAAa,EAAE,yMAAyM;IACxN,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,SAAS;QACT,WAAW;QACX,QAAQ;KACT;IACD,YAAY,EAAE;QACZ,SAAS,EAAE;YACT,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,oLAAoL;SACpM;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,0NAA0N;SAC1O;QACD,SAAS,EAAE;YACT,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,2YAA2Y;SAC3Z;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,yGAAyG;SACzH;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,yOAAyO;SACzP;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,oHAAoH;SACpI;QACD,oBAAoB,EAAE;YACpB,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE;oBACN,WAAW;oBACX,UAAU;iBACX;aACF;YACD,aAAa,EAAE,sQAAsQ;SACtR;QACD,UAAU,EAAE;YACV,MAAM,EAAE,kCAAkC;YAC1C,aAAa,EAAE,kXAAkX;SAClY;QACD,KAAK,EAAE;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,mKAAmK;SACnL;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,iDAAiD;YAC1D,aAAa,EAAE,mPAAmP;YAClQ,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;aACT;YACD,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,UAAU;wBACV,SAAS;qBACV;oBACD,aAAa,EAAE,qKAAqK;iBACrL;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,oCAAoC;iBACpD;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,0BAA0B,EAAE;YAC1B,SAAS,EAAE,0BAA0B;YACrC,OAAO,EAAE,mCAAmC;YAC5C,aAAa,EAAE,4EAA4E;YAC3F,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,gtBAAgtB;iBAChuB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mCAAmC;iBACnD;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;iBACb;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;iBACf;gBACD,kBAAkB,EAAE;oBAClB,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,8BAA8B;qBACvC;iBACF;gBACD,kBAAkB,EAAE;oBAClB,MAAM,EAAE;wBACN,aAAa;wBACb,WAAW;wBACX,UAAU;qBACX;iBACF;aACF;SACF;QACD,sBAAsB,EAAE;YACtB,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,+BAA+B;YACxC,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,MAAM;gBACN,IAAI;aACL;YACD,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,OAAO,EAAE,YAAY;iBACtB;gBACD,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kCAAkC;iBAClD;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE;4BACN,KAAK;4BACL,KAAK;4BACL,KAAK;4BACL,UAAU;4BACV,QAAQ;yBACT;qBACF;iBACF;aACF;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,iDAAiD;YAC1D,aAAa,EAAE,mPAAmP;YAClQ,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;aACT;YACD,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,UAAU;wBACV,SAAS;qBACV;oBACD,aAAa,EAAE,qKAAqK;iBACrL;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,oCAAoC;iBACpD;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,0BAA0B,EAAE;YAC1B,SAAS,EAAE,0BAA0B;YACrC,OAAO,EAAE,mCAAmC;YAC5C,aAAa,EAAE,4EAA4E;YAC3F,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,gtBAAgtB;iBAChuB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mCAAmC;iBACnD;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;iBACb;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;iBACf;gBACD,kBAAkB,EAAE;oBAClB,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,8BAA8B;qBACvC;iBACF;gBACD,kBAAkB,EAAE;oBAClB,MAAM,EAAE;wBACN,aAAa;wBACb,WAAW;wBACX,UAAU;qBACX;iBACF;aACF;SACF;QACD,sBAAsB,EAAE;YACtB,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,+BAA+B;YACxC,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,MAAM;gBACN,IAAI;aACL;YACD,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,OAAO,EAAE,YAAY;iBACtB;gBACD,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kCAAkC;iBAClD;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE;4BACN,KAAK;4BACL,KAAK;4BACL,KAAK;4BACL,UAAU;4BACV,QAAQ;yBACT;qBACF;iBACF;aACF;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}