@sempdev/semp 0.4.3

package/dist/handshake/federation.d.ts

@@ -0,0 +1,365 @@
+/**
+ * Federation handshake (server ↔ server) per HANDSHAKE.md §5.
+ *
+ * Two servers establish a federation session by exchanging four
+ * messages — symmetric in shape to the client handshake but with
+ * domain identity in plaintext on both sides plus a domain-proof
+ * verification step:
+ *
+ *   1. ServerInit (initiator → responder) carrying the initiator's
+ *      domain, ephemeral key, identity proof, and a {@link DomainProof}
+ *      that the responder verifies via DNS / certificate / well-known.
+ *   2. FederationResponse (responder → initiator) carrying the
+ *      responder's identity material, the {@link DomainVerificationResult},
+ *      negotiated capabilities, and the responder's
+ *      {@link FederationPolicy}.
+ *   3. FederationConfirm (initiator → responder) with the
+ *      confirmation hash and a {@link FederationAcceptance} block
+ *      stating whether the initiator accepts the policy.
+ *   4. FederationAccepted (responder → initiator) finalizing the
+ *      session and (optionally) issuing a resumption ticket.
+ *
+ * @module
+ */
+import { type SessionKeys } from "../crypto/index.js";
+import { type Capabilities, type Negotiated, type ResumptionTicket } from "./messages.js";
+/** Wire-level discriminators (shared with the client handshake). */
+export declare const FederationMessageType = "SEMP_HANDSHAKE";
+/**
+ * Federation domain-proof verification methods per HANDSHAKE.md
+ * §5.3.
+ */
+export type DomainProofMethod = "dns-txt" | "certificate" | "well-known"
+/** Test fixture; production deployments MUST NOT accept this method. */
+ | "test-trust";
+/** Domain ownership proof per §5.3. */
+export interface DomainProof {
+    method: DomainProofMethod;
+    /** Verification payload, format determined by `method`. */
+    data: string;
+}
+/** Result of a {@link DomainVerifier} check per §5.4. */
+export interface DomainVerificationResult {
+    /** `"verified"` on success; `"rejected"` or `"unverified"` otherwise. */
+    status: "verified" | "rejected" | "unverified";
+    /** Echoes the verification method that was attempted. */
+    method: DomainProofMethod;
+    /** Optional human-readable detail; operator-facing. */
+    detail?: string;
+}
+/** Operator-defined federation policy per §5.4. */
+export interface FederationPolicy {
+    /** Duration string (e.g. `"7d"`, `"30d"`, `"0"`). */
+    message_retention: string;
+    /** `"allowed"` or `"denied"`. */
+    user_discovery: "allowed" | "denied";
+    /** Whether the responder forwards envelopes on behalf of third parties. */
+    relay_allowed: boolean;
+}
+/**
+ * Initiator's acceptance of the responder's policy per §5.5. When
+ * `accepted === false`, a `reason` is REQUIRED and the responder
+ * MUST treat the handshake as rejected.
+ */
+export interface FederationAcceptance {
+    accepted: boolean;
+    policy_acknowledged: boolean;
+    reason?: string;
+}
+/**
+ * Abbreviated identity proof used inside federation init / response
+ * messages. The signature is over the canonical bytes:
+ *
+ *   - init:     `eph_pub || nonce_bytes`
+ *   - response: `eph_pub || responder_nonce || initiator_nonce`
+ *
+ * with the `SEMP-IDENTITY:` domain-separation prefix. Binds the
+ * long-term domain key to the ephemeral key without depending on
+ * the surrounding message envelope.
+ */
+export interface FederationProof {
+    key_id: string;
+    /** Base64 Ed25519 signature. */
+    signature: string;
+}
+/** Reusable ephemeral-key block. */
+export interface FederationEphemeralKey {
+    algorithm: string;
+    /** Base64. */
+    key: string;
+    key_id: string;
+}
+/** Server-init message per §5.2. */
+export interface ServerInit {
+    type: typeof FederationMessageType;
+    step: "init";
+    party: "server";
+    version: string;
+    /** Base64 32-byte initiator nonce. */
+    nonce: string;
+    server_id: string;
+    server_domain: string;
+    server_ephemeral_key: FederationEphemeralKey;
+    server_identity_proof: FederationProof;
+    domain_proof: DomainProof;
+    capabilities: Capabilities;
+    /** Base64 outer Ed25519 signature. */
+    server_signature: string;
+    extensions: Record<string, unknown>;
+}
+/** Responder's response per §5.4. */
+export interface FederationResponse {
+    type: typeof FederationMessageType;
+    step: "response";
+    party: "server";
+    version: string;
+    session_id: string;
+    /** Echo of the initiator's nonce. */
+    client_nonce: string;
+    /** Base64 32-byte responder nonce. */
+    server_nonce: string;
+    server_id: string;
+    server_domain: string;
+    server_ephemeral_key: FederationEphemeralKey;
+    server_identity_proof: FederationProof;
+    domain_verification_result: DomainVerificationResult;
+    negotiated: Negotiated;
+    federation_policy: FederationPolicy;
+    /** Base64 outer Ed25519 signature. */
+    server_signature: string;
+    extensions: Record<string, unknown>;
+}
+/** Initiator's confirm per §5.5. */
+export interface FederationConfirm {
+    type: typeof FederationMessageType;
+    step: "confirm";
+    party: "server";
+    version: string;
+    session_id: string;
+    /** Base64 SHA-256(canonical(init) || canonical(response)). */
+    confirmation_hash: string;
+    federation_acceptance: FederationAcceptance;
+    /** Base64 outer Ed25519 signature. */
+    server_signature: string;
+    extensions: Record<string, unknown>;
+}
+/** Responder's accepted per §5.6 / §2.8.7. */
+export interface FederationAccepted {
+    type: typeof FederationMessageType;
+    step: "accepted";
+    party: "server";
+    version: string;
+    session_id: string;
+    status: "accepted";
+    session_ttl: number;
+    /** Resumption-only fields, present when responding to FederationResume. */
+    server_nonce?: string;
+    server_ephemeral_key?: FederationEphemeralKey;
+    resumption_ticket?: ResumptionTicket;
+    /** Base64 outer Ed25519 signature. */
+    server_signature: string;
+    extensions: Record<string, unknown>;
+}
+/** Initiator-side resume per §2.8.7. */
+export interface FederationResume {
+    type: typeof FederationMessageType;
+    step: "resume";
+    party: "server";
+    version: string;
+    /** Base64 32-byte initiator nonce. */
+    nonce: string;
+    server_id: string;
+    server_domain: string;
+    /** Initiator's discovery cache revision; 0 omits. */
+    peer_configuration_revision?: number;
+    /** Base64 opaque ticket bytes from the prior FederationAccepted. */
+    resumption_ticket: string;
+    client_ephemeral_key: FederationEphemeralKey;
+    transport: string;
+    extensions: Record<string, unknown>;
+}
+/**
+ * Domain-ownership verifier invoked by the responder during the
+ * handshake. `verify` resolves on success; rejects (or throws) on
+ * failure — the rejection reason is surfaced in
+ * {@link DomainVerificationResult.detail}.
+ */
+export interface DomainVerifier {
+    verify(domain: string, proof: DomainProof, initiatorNonce: string): Promise<void>;
+}
+/**
+ * Permissive verifier that accepts every proof. Tests / single-
+ * process deployments only — production MUST NOT use it.
+ */
+export declare class TrustingDomainVerifier implements DomainVerifier {
+    verify(): Promise<void>;
+}
+/**
+ * Decide which of two simultaneously-initiated federation handshakes
+ * proceeds per SESSION.md §2.5.2. Both peers agree on the winner
+ * without external coordination — lexicographic compare provides
+ * exactly this property.
+ *
+ * Returns the winning `session_id` (the one that proceeds).
+ */
+export declare function resolveCollision(idA: string, idB: string): string;
+/** Hook deciding whether to accept a {@link FederationPolicy}. */
+export type PolicyAcceptor = (policy: FederationPolicy) => string | null;
+/** Default acceptor that accepts every policy (tests). */
+export declare const acceptAllPolicies: PolicyAcceptor;
+/** Configuration for {@link FederationInitiator}. */
+export interface FederationInitiatorConfig {
+    /** Algorithm suite. v1: `"x25519-chacha20-poly1305"`. */
+    suite: "x25519-chacha20-poly1305";
+    /** Capability set to advertise. */
+    capabilities: Capabilities;
+    /** Initiator's own domain. */
+    localDomain: string;
+    /**
+     * Stable id of the initiator server instance within `localDomain`.
+     * If empty, callers MUST set one before calling {@link init}.
+     */
+    localServerID: string;
+    /** 32-byte Ed25519 secret seed for the initiator's domain key. */
+    localDomainSeed: Uint8Array;
+    /** Lookup hook returning the responder's published domain pub. */
+    peerDomainPubLookup: (domain: string) => Uint8Array;
+    /** Responder's domain (the one the initiator wants to federate with). */
+    peerDomain: string;
+    /** {@link DomainProof} the initiator presents. */
+    domainProof: DomainProof;
+    /** Defaults to {@link acceptAllPolicies}. */
+    policyAcceptor?: PolicyAcceptor;
+    /** Optional pre-pinned ephemeral private (deterministic tests). */
+    initiatorEphemeralPriv?: Uint8Array;
+    /** Optional pre-pinned 32-byte initiator nonce. */
+    initiatorNonce?: Uint8Array;
+}
+/** Outcome of a successful federation handshake (initiator side). */
+export interface FederationInitiatorSession {
+    sessionId: string;
+    sessionTTL: number;
+    keys: SessionKeys;
+    peerDomain: string;
+    resumptionTicket?: ResumptionTicket;
+    extensions: Record<string, unknown>;
+}
+/**
+ * Stateful federation initiator. Mirror of `semp-go/handshake.Initiator`.
+ * Single-shot — discard after success or error.
+ */
+export declare class FederationInitiator {
+    private readonly cfg;
+    private readonly localDomainPub;
+    private readonly localDomainKeyId;
+    private nonce;
+    private ephPriv;
+    private ephPub;
+    private initCanonical;
+    private respCanonical;
+    private sessionId;
+    private sessionKeys;
+    private finalSession;
+    private resumptionSecret;
+    private resumeNonce;
+    constructor(cfg: FederationInitiatorConfig);
+    /** Build ServerInit bytes (message 1). */
+    init(): Uint8Array;
+    /** Process FederationResponse (message 2) and produce FederationConfirm bytes. */
+    onResponse(data: Uint8Array): Uint8Array;
+    /** Process FederationAccepted (message 4) and finalize the session. */
+    onAccepted(data: Uint8Array): void;
+    /** Final session populated by {@link onAccepted}. */
+    session(): FederationInitiatorSession;
+    /** Load `K_resumption` recovered from a prior session before {@link resume}. */
+    loadResumptionSecret(secret: Uint8Array): void;
+    /**
+     * Build a {@link FederationResume} bytes per §2.8.7. `ticket` is
+     * the opaque value from the prior FederationAccepted's
+     * `resumption_ticket.value` (already base64-decoded). Pass
+     * `peerConfigurationRevision = 0` to omit it.
+     */
+    resume(ticket: Uint8Array, peerConfigurationRevision?: number): Uint8Array;
+    /**
+     * Process the responder's FederationAccepted in response to
+     * {@link resume} and derive resumed session keys per §2.8.3.
+     */
+    onResumeAccepted(data: Uint8Array): {
+        session: FederationInitiatorSession;
+        newTicket: Uint8Array | undefined;
+    };
+    /** Wipe in-memory secret state. */
+    erase(): void;
+}
+/** Configuration for {@link FederationResponder}. */
+export interface FederationResponderConfig {
+    suite: "x25519-chacha20-poly1305";
+    capabilities: Capabilities;
+    /** Responder's own domain. */
+    localDomain: string;
+    /** Stable id of the responder server instance within `localDomain`. */
+    localServerID: string;
+    /** 32-byte Ed25519 secret seed for the responder's domain key. */
+    localDomainSeed: Uint8Array;
+    /** Lookup hook returning the initiator's published domain pub. */
+    peerDomainPubLookup: (domain: string) => Uint8Array;
+    /** Verifier for the initiator's {@link DomainProof}. */
+    verifier?: DomainVerifier;
+    /** Federation policy returned in message 2. */
+    policy: FederationPolicy;
+    /** Session TTL in seconds. Defaults to 3600. */
+    sessionTTL?: number;
+    /** Generator for `session_id`. Required. */
+    generateSessionId: () => string;
+    /** Optional pre-pinned ephemeral private (deterministic tests). */
+    responderEphemeralPriv?: Uint8Array;
+    /** Optional pre-pinned 32-byte responder nonce. */
+    responderNonce?: Uint8Array;
+}
+/** Outcome of a successful federation handshake (responder side). */
+export interface FederationResponderSession {
+    sessionId: string;
+    sessionTTL: number;
+    keys: SessionKeys;
+    peerDomain: string;
+}
+/**
+ * Stateful federation responder. Mirror of `semp-go/handshake.Responder`.
+ * Single-shot — discard after success or error.
+ */
+export declare class FederationResponder {
+    private readonly cfg;
+    private readonly localDomainPub;
+    private readonly localDomainKeyId;
+    private readonly verifier;
+    private readonly sessionTTL;
+    private sessionId;
+    private peerDomain;
+    private peerNonce;
+    private serverNonce;
+    private respEphPriv;
+    private initCanonical;
+    private respCanonical;
+    private sessionKeys;
+    private finalSession;
+    constructor(cfg: FederationResponderConfig);
+    /**
+     * Process ServerInit (message 1) and produce FederationResponse
+     * bytes. Throws on signature, identity-proof, or domain-proof
+     * verification failure.
+     */
+    onInit(data: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Process FederationConfirm (message 3) and produce
+     * FederationAccepted bytes (message 4). Throws if the initiator
+     * rejected the policy or the confirmation hash doesn't match.
+     */
+    onConfirm(data: Uint8Array, opts?: {
+        issueResumptionTicket?: (keys: SessionKeys) => ResumptionTicket;
+    }): Uint8Array;
+    /** Final session populated by {@link onConfirm}. */
+    session(): FederationResponderSession;
+    /** Wipe in-memory secret state. */
+    erase(): void;
+}
+//# sourceMappingURL=federation.d.ts.map

package/dist/handshake/federation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/handshake/federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EACL,KAAK,WAAW,EAKjB,MAAM,oBAAoB,CAAC;AAW5B,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,gBAAgB,EAGtB,MAAM,eAAe,CAAC;AAEvB,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,aAAa,GACb,YAAY;AACd,wEAAwE;GACtE,YAAY,CAAC;AAEjB,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACvC,yEAAyE;IACzE,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;IAC/C,yDAAyD;IACzD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,cAAc,EAAE,SAAS,GAAG,QAAQ,CAAC;IACrC,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oCAAoC;AACpC,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,sBAAsB,CAAC;IAC7C,qBAAqB,EAAE,eAAe,CAAC;IACvC,YAAY,EAAE,WAAW,CAAC;IAC1B,YAAY,EAAE,YAAY,CAAC;IAC3B,sCAAsC;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,sBAAsB,CAAC;IAC7C,qBAAqB,EAAE,eAAe,CAAC;IACvC,0BAA0B,EAAE,wBAAwB,CAAC;IACrD,UAAU,EAAE,UAAU,CAAC;IACvB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,sCAAsC;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,sCAAsC;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;IACrC,sCAAsC;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,oEAAoE;IACpE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,sBAAsB,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,cAAc;IACrD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAG9B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,kEAAkE;AAClE,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,GAAG,IAAI,CAAC;AAEzE,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,EAAE,cAA2B,CAAC;AAM5D,qDAAqD;AACrD,MAAM,WAAW,yBAAyB;IACxC,yDAAyD;IACzD,KAAK,EAAE,0BAA0B,CAAC;IAClC,mCAAmC;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,eAAe,EAAE,UAAU,CAAC;IAC5B,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;IACpD,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,WAAW,EAAE,WAAW,CAAC;IACzB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,mEAAmE;IACnE,sBAAsB,CAAC,EAAE,UAAU,CAAC;IACpC,mDAAmD;IACnD,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,qEAAqE;AACrE,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA4B;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAa;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAE1C,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,OAAO,CAA2B;IAC1C,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,aAAa,CAA2B;IAChD,OAAO,CAAC,aAAa,CAA2B;IAChD,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,YAAY,CAA2C;IAC/D,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,WAAW,CAA2B;gBAElC,GAAG,EAAE,yBAAyB;IA6B1C,0CAA0C;IAC1C,IAAI,IAAI,UAAU;IAgDlB,kFAAkF;IAClF,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU;IAqHxC,uEAAuE;IACvE,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAwDlC,qDAAqD;IACrD,OAAO,IAAI,0BAA0B;IAOrC,gFAAgF;IAChF,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;IAO9C;;;;;OAKG;IACH,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,yBAAyB,SAAI,GAAG,UAAU;IAsCrE;;;OAGG;IACH,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG;QAClC,OAAO,EAAE,0BAA0B,CAAC;QACpC,SAAS,EAAE,UAAU,GAAG,SAAS,CAAC;KACnC;IAwFD,mCAAmC;IACnC,KAAK,IAAI,IAAI;CAed;AAMD,qDAAqD;AACrD,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,0BAA0B,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,aAAa,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,eAAe,EAAE,UAAU,CAAC;IAC5B,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;IACpD,wDAAwD;IACxD,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,+CAA+C;IAC/C,MAAM,EAAE,gBAAgB,CAAC;IACzB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,mEAAmE;IACnE,sBAAsB,CAAC,EAAE,UAAU,CAAC;IACpC,mDAAmD;IACnD,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,qEAAqE;AACrE,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA4B;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAa;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,UAAU,CAAM;IACxB,OAAO,CAAC,SAAS,CAA2B;IAC5C,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,aAAa,CAA2B;IAChD,OAAO,CAAC,aAAa,CAA2B;IAChD,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,YAAY,CAA2C;gBAEnD,GAAG,EAAE,yBAAyB;IAmB1C;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IA0InD;;;;OAIG;IACH,SAAS,CACP,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE;QACJ,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,gBAAgB,CAAC;KAC5D,GACL,UAAU;IA4Eb,oDAAoD;IACpD,OAAO,IAAI,0BAA0B;IASrC,mCAAmC;IACnC,KAAK,IAAI,IAAI;CAed"}