@sempdev/semp 0.4.3

package/dist/reputation/sign.js

@@ -0,0 +1,202 @@
+/**
+ * Sign / verify primitives for reputation wire records per
+ * REPUTATION.md §4.2 + §3.5 + §5.
+ *
+ * Reputation records use a NO-PREFIX signing input — the canonical
+ * bytes with `signature.value` elided are signed directly under
+ * Ed25519. Other SEMP records use SEMP-* domain-separation
+ * prefixes (registered in ENVELOPE.md §4.3) but reputation ones do
+ * not in the current spec.
+ *
+ * @module
+ */
+import { marshal as canonicalMarshal } from "../canonical/index.js";
+import { sign as ed25519Sign, verify as ed25519Verify, } from "../keys/index.js";
+import { applyBucketing } from "./bucketize.js";
+import {} from "./types.js";
+/** Only signature algorithm currently defined. */
+export const SignatureAlgorithmEd25519 = "ed25519";
+// ---------------------------------------------------------------------------
+// Observation
+/**
+ * Bucketize metrics in place (per §4.5.1), then Ed25519-sign
+ * `obs.signature` over the canonical bytes with `signature.value`
+ * elided.
+ */
+export function signObservation(obs, observerPriv, observerKeyId) {
+    if (observerKeyId === "") {
+        throw new Error("reputation: empty observer key_id");
+    }
+    if (obs.extensions === undefined) {
+        obs.extensions = {};
+    }
+    applyBucketing(obs.metrics);
+    obs.signature.algorithm = SignatureAlgorithmEd25519;
+    obs.signature.key_id = observerKeyId;
+    obs.signature.value = "";
+    const canonicalBytes = canonicalRecordBytes(obs, "signature");
+    const sig = ed25519Sign(observerPriv, canonicalBytes);
+    const sigB64 = base64Encode(sig);
+    obs.signature.value = sigB64;
+    return sigB64;
+}
+/** Verify `obs.signature` against `observerPub`. */
+export function verifyObservation(obs, observerPub) {
+    if (obs.signature.value === "") {
+        return false;
+    }
+    let sig;
+    try {
+        sig = base64Decode(obs.signature.value);
+    }
+    catch {
+        return false;
+    }
+    const canonicalBytes = canonicalRecordBytes(obs, "signature");
+    return ed25519Verify(observerPub, sig, canonicalBytes);
+}
+// ---------------------------------------------------------------------------
+// TrustObservations envelope
+/** Sign a {@link TrustObservations} response under the observer's signing key. */
+export function signTrustObservations(resp, observerPriv, observerKeyId) {
+    if (observerKeyId === "") {
+        throw new Error("reputation: empty observer key_id");
+    }
+    resp.signature.algorithm = SignatureAlgorithmEd25519;
+    resp.signature.key_id = observerKeyId;
+    resp.signature.value = "";
+    const canonicalBytes = canonicalRecordBytes(resp, "signature");
+    const sig = ed25519Sign(observerPriv, canonicalBytes);
+    const sigB64 = base64Encode(sig);
+    resp.signature.value = sigB64;
+    return sigB64;
+}
+/** Verify a {@link TrustObservations} response. */
+export function verifyTrustObservations(resp, observerPub) {
+    if (resp.signature.value === "") {
+        return false;
+    }
+    let sig;
+    try {
+        sig = base64Decode(resp.signature.value);
+    }
+    catch {
+        return false;
+    }
+    const canonicalBytes = canonicalRecordBytes(resp, "signature");
+    return ed25519Verify(observerPub, sig, canonicalBytes);
+}
+// ---------------------------------------------------------------------------
+// DisclosureAuthorization (embedded inside abuse reports)
+/** Sign a {@link DisclosureAuthorization} under the affected user's identity key. */
+export function signDisclosureAuthorization(auth, userPriv, userKeyId) {
+    if (userKeyId === "") {
+        throw new Error("reputation: empty user key_id");
+    }
+    auth.signature.algorithm = SignatureAlgorithmEd25519;
+    auth.signature.key_id = userKeyId;
+    auth.signature.value = "";
+    const canonicalBytes = canonicalRecordBytes(auth, "signature");
+    const sig = ed25519Sign(userPriv, canonicalBytes);
+    const sigB64 = base64Encode(sig);
+    auth.signature.value = sigB64;
+    return sigB64;
+}
+/** Verify a {@link DisclosureAuthorization} against the user's identity public key. */
+export function verifyDisclosureAuthorization(auth, userPub) {
+    if (auth.signature.value === "") {
+        return false;
+    }
+    let sig;
+    try {
+        sig = base64Decode(auth.signature.value);
+    }
+    catch {
+        return false;
+    }
+    const canonicalBytes = canonicalRecordBytes(auth, "signature");
+    return ed25519Verify(userPub, sig, canonicalBytes);
+}
+/** Report whether the scope permits disclosing brief content. */
+export function authAllowsBrief(auth) {
+    return auth.scope === "brief_only" || auth.scope === "brief_and_enclosure";
+}
+/** Report whether the scope permits disclosing enclosure content. */
+export function authAllowsEnclosure(auth) {
+    return auth.scope === "enclosure_only" || auth.scope === "brief_and_enclosure";
+}
+// ---------------------------------------------------------------------------
+// AbuseReport — sent over an authenticated session, no own signature
+/** Structural validation of an {@link AbuseReport} per §3.2. Throws on first violation. */
+export function validateAbuseReport(r) {
+    if (r.type !== "SEMP_ABUSE_REPORT") {
+        throw new Error(`reputation: abuse report type ${JSON.stringify(r.type)}, want SEMP_ABUSE_REPORT`);
+    }
+    for (const f of ["id", "reporter", "reported_domain", "category", "timestamp"]) {
+        if (typeof r[f] !== "string" || r[f] === "") {
+            throw new Error(`reputation: abuse report missing ${f}`);
+        }
+    }
+    if (Number.isNaN(Date.parse(r.timestamp))) {
+        throw new Error("reputation: abuse report timestamp is not ISO 8601");
+    }
+    if (r.evidence === undefined || r.evidence === null) {
+        throw new Error("reputation: abuse report missing evidence");
+    }
+    const evType = r.evidence.type;
+    if (evType !== "envelope_metadata" && evType !== "sealed_evidence") {
+        throw new Error(`reputation: abuse report evidence type ${JSON.stringify(evType)} is not valid`);
+    }
+    if (r.evidence.type === "sealed_evidence") {
+        if (!Array.isArray(r.evidence.envelopes) || r.evidence.envelopes.length === 0) {
+            throw new Error("reputation: sealed_evidence requires non-empty envelopes array");
+        }
+        // §3.7 MUST: when disclosed_brief / disclosed_enclosure is
+        // present, disclosure_authorization MUST also be present.
+        for (let i = 0; i < r.evidence.envelopes.length; i++) {
+            const env = r.evidence.envelopes[i];
+            const hasDisclosed = env.disclosed_brief !== undefined || env.disclosed_enclosure !== undefined;
+            if (hasDisclosed && env.disclosure_authorization === undefined) {
+                throw new Error(`reputation: envelopes[${i}]: disclosed content requires disclosure_authorization (§3.7)`);
+            }
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+/**
+ * Canonical bytes with `<topField>.value` elided. The reputation
+ * records sign the canonical bytes directly (no domain-separation
+ * prefix); other SEMP records use SEMP-* prefixes.
+ */
+function canonicalRecordBytes(obj, topField) {
+    const clone = JSON.parse(JSON.stringify(obj));
+    const sig = clone[topField];
+    if (sig === undefined) {
+        throw new Error(`reputation: object has no ${topField} block`);
+    }
+    sig.value = "";
+    return canonicalMarshal(clone);
+}
+function base64Encode(b) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(b).toString("base64");
+    }
+    let bin = "";
+    for (let i = 0; i < b.length; i++) {
+        bin += String.fromCharCode(b[i] ?? 0);
+    }
+    return btoa(bin);
+}
+function base64Decode(s) {
+    if (typeof Buffer !== "undefined") {
+        return new Uint8Array(Buffer.from(s, "base64"));
+    }
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) {
+        out[i] = bin.charCodeAt(i);
+    }
+    return out;
+}
+//# sourceMappingURL=sign.js.map

package/dist/reputation/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/reputation/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,IAAI,IAAI,WAAW,EACnB,MAAM,IAAI,aAAa,GACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAMN,MAAM,YAAY,CAAC;AAEpB,kDAAkD;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAEnD,8EAA8E;AAC9E,cAAc;AAEd;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAgB,EAChB,YAAwB,EACxB,aAAqB;IAErB,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;IACtB,CAAC;IACD,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE5B,GAAG,CAAC,SAAS,CAAC,SAAS,GAAG,yBAAyB,CAAC;IACpD,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;IAEzB,MAAM,cAAc,GAAG,oBAAoB,CACzC,GAAyC,EACzC,WAAW,CACZ,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,MAAM,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,iBAAiB,CAC/B,GAAgB,EAChB,WAAuB;IAEvB,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,cAAc,GAAG,oBAAoB,CACzC,GAAyC,EACzC,WAAW,CACZ,CAAC;IACF,OAAO,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAE7B,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CACnC,IAAuB,EACvB,YAAwB,EACxB,aAAqB;IAErB,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,yBAAyB,CAAC;IACrD,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG,oBAAoB,CACzC,IAA0C,EAC1C,WAAW,CACZ,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,MAAM,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,uBAAuB,CACrC,IAAuB,EACvB,WAAuB;IAEvB,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,cAAc,GAAG,oBAAoB,CACzC,IAA0C,EAC1C,WAAW,CACZ,CAAC;IACF,OAAO,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAE1D,qFAAqF;AACrF,MAAM,UAAU,2BAA2B,CACzC,IAA6B,EAC7B,QAAoB,EACpB,SAAiB;IAEjB,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,yBAAyB,CAAC;IACrD,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG,oBAAoB,CACzC,IAA0C,EAC1C,WAAW,CACZ,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,MAAM,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAC3C,IAA6B,EAC7B,OAAmB;IAEnB,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,cAAc,GAAG,oBAAoB,CACzC,IAA0C,EAC1C,WAAW,CACZ,CAAC;IACF,OAAO,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;AACrD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,IAA6B;IAC3D,OAAO,IAAI,CAAC,KAAK,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,KAAK,qBAAqB,CAAC;AAC7E,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,OAAO,IAAI,CAAC,KAAK,KAAK,gBAAgB,IAAI,IAAI,CAAC,KAAK,KAAK,qBAAqB,CAAC;AACjF,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AAErE,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,CAAc;IAChD,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAClF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,CAAU,EAAE,CAAC;QACxF,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAI,CAAC,CAAC,QAA6B,CAAC,IAAI,CAAC;IACrD,IAAI,MAAM,KAAK,mBAAmB,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,2DAA2D;QAC3D,0DAA0D;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC;YACrC,MAAM,YAAY,GAChB,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC;YAC7E,IAAI,YAAY,IAAI,GAAG,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CACb,yBAAyB,CAAC,+DAA+D,CAC1F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AAEV;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,GAA4B,EAC5B,QAAgB;IAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAA4B,CAAC;IACzE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAwC,CAAC;IACnE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,QAAQ,CAAC,CAAC;IACjE,CAAC;IACD,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;IACf,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAKD,SAAS,YAAY,CAAC,CAAa;IACjC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/reputation/types.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Wire-record types for SEMP reputation per REPUTATION.md.
+ *
+ * @module
+ */
+/** `type` discriminators per REPUTATION.md. */
+export declare const ObservationType = "SEMP_TRUST_OBSERVATION";
+export declare const ObservationsEnvelopeType = "SEMP_TRUST_OBSERVATIONS";
+export declare const AbuseReportType = "SEMP_ABUSE_REPORT";
+export declare const Version = "1.0.0";
+/** Reputation publication path per §5. */
+export declare const PublicationPath = "/.well-known/semp/reputation/";
+/** Assessment classification per §4.6. */
+export type Assessment = "trusted" | "neutral" | "suspicious" | "hostile";
+/** Abuse category per §3.4 + ERRORS.md §9. */
+export type AbuseCategory = "spam" | "harassment" | "phishing" | "malware" | "protocol_abuse" | "impersonation" | "other";
+/**
+ * Report whether `c` is one of the categories defined in §3.4.
+ * Unknown categories are permitted for forward compatibility.
+ */
+export declare function isKnownAbuseCategory(c: string): c is AbuseCategory;
+/** Reusable signature block. */
+export interface ReputationSignature {
+    algorithm: string;
+    key_id: string;
+    value: string;
+}
+/** Time window of an Observation per §4.4. */
+export interface Window {
+    /** ISO 8601 UTC. */
+    start: string;
+    /** ISO 8601 UTC. */
+    end: string;
+}
+/** Quantitative payload of an Observation per §4.5. */
+export interface Metrics {
+    envelopes_received: number;
+    envelopes_rejected: number;
+    abuse_reports: number;
+    abuse_categories?: AbuseCategory[];
+    unique_senders_observed?: number;
+    handshakes_completed?: number;
+    handshakes_rejected?: number;
+}
+/** Cap applied by Bucketize: counts at/above this clamp here. */
+export declare const MaxMetricBucket: number;
+/** Single signed observation record per §4.2. */
+export interface Observation {
+    type: typeof ObservationType;
+    version: string;
+    id: string;
+    observer: string;
+    subject: string;
+    window: Window;
+    metrics: Metrics;
+    assessment: Assessment;
+    evidence_available: boolean;
+    evidence_uri?: string;
+    /** ISO 8601 UTC. */
+    timestamp: string;
+    /** ISO 8601 UTC hard expiry. */
+    expires: string;
+    signature: ReputationSignature;
+    /** Always emitted (even when empty) so canonical bytes are stable. */
+    extensions: Record<string, unknown>;
+}
+/** Publication envelope carrying a list of observations per §5.1. */
+export interface TrustObservations {
+    type: typeof ObservationsEnvelopeType;
+    version: string;
+    /** Observer domain. */
+    observer: string;
+    /** Subject domain (or empty when the response is a per-observer index). */
+    subject: string;
+    observations: Observation[];
+    /** ISO 8601 UTC. */
+    timestamp: string;
+    signature: ReputationSignature;
+}
+/** Publishable hash summary per §5. */
+export interface GossipHash {
+    domain: string;
+    /** Lowercase hex SHA-256. */
+    hash: string;
+    algorithm: string;
+    /** ISO 8601 UTC. */
+    as_of: string;
+}
+/** Disclosure scope per §3.5. */
+export type DisclosureScope = "brief_only" | "enclosure_only" | "brief_and_enclosure";
+/** Affected user's signed permission to include decrypted content per §3.5 + §3.7. */
+export interface DisclosureAuthorization {
+    user: string;
+    /** ISO 8601 UTC. */
+    authorized_at: string;
+    scope: DisclosureScope;
+    signature: ReputationSignature;
+}
+/** Sealed-evidence envelope-shaped record per §3.5. */
+export interface SealedEnvelopeEvidence {
+    postmark: Record<string, unknown>;
+    seal: Record<string, unknown>;
+    disclosed_brief?: Record<string, unknown>;
+    disclosed_enclosure?: Record<string, unknown>;
+    disclosure_authorization?: DisclosureAuthorization;
+}
+/** Polymorphic evidence payload per §3.5. */
+export type Evidence = {
+    type: "envelope_metadata";
+    postmark_ids?: string[];
+    count?: number;
+    /** ISO 8601 interval string. */
+    window?: string;
+} | {
+    type: "sealed_evidence";
+    envelopes: SealedEnvelopeEvidence[];
+};
+/** SEMP_ABUSE_REPORT message per §3.2. */
+export interface AbuseReport {
+    type: typeof AbuseReportType;
+    version: string;
+    id: string;
+    reporter: string;
+    reported_domain: string;
+    reported_address?: string;
+    category: AbuseCategory | string;
+    /** ISO 8601 UTC. */
+    timestamp: string;
+    evidence: Evidence;
+    description?: string;
+    extensions: Record<string, unknown>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/reputation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/reputation/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,eAAe,2BAA2B,CAAC;AACxD,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAClE,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,0CAA0C;AAC1C,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAE/D,0CAA0C;AAC1C,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAE1E,8CAA8C;AAC9C,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,YAAY,GACZ,UAAU,GACV,SAAS,GACT,gBAAgB,GAChB,eAAe,GACf,OAAO,CAAC;AAEZ;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,aAAa,CAalE;AAED,gCAAgC;AAChC,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,8CAA8C;AAC9C,MAAM,WAAW,MAAM;IACrB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAO;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC;IACnC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,iEAAiE;AACjE,eAAO,MAAM,eAAe,QAAU,CAAC;AAEvC,iDAAiD;AACjD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,eAAe,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,wBAAwB,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,mBAAmB,CAAC;CAChC;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,iCAAiC;AACjC,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,gBAAgB,GAChB,qBAAqB,CAAC;AAE1B,sFAAsF;AACtF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,mBAAmB,CAAC;CAChC;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,wBAAwB,CAAC,EAAE,uBAAuB,CAAC;CACpD;AAED,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAChB;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC,CAAC;AAEN,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,eAAe,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,aAAa,GAAG,MAAM,CAAC;IACjC,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC"}

package/dist/reputation/types.js

@@ -0,0 +1,33 @@
+/**
+ * Wire-record types for SEMP reputation per REPUTATION.md.
+ *
+ * @module
+ */
+/** `type` discriminators per REPUTATION.md. */
+export const ObservationType = "SEMP_TRUST_OBSERVATION";
+export const ObservationsEnvelopeType = "SEMP_TRUST_OBSERVATIONS";
+export const AbuseReportType = "SEMP_ABUSE_REPORT";
+export const Version = "1.0.0";
+/** Reputation publication path per §5. */
+export const PublicationPath = "/.well-known/semp/reputation/";
+/**
+ * Report whether `c` is one of the categories defined in §3.4.
+ * Unknown categories are permitted for forward compatibility.
+ */
+export function isKnownAbuseCategory(c) {
+    switch (c) {
+        case "spam":
+        case "harassment":
+        case "phishing":
+        case "malware":
+        case "protocol_abuse":
+        case "impersonation":
+        case "other":
+            return true;
+        default:
+            return false;
+    }
+}
+/** Cap applied by Bucketize: counts at/above this clamp here. */
+export const MaxMetricBucket = 1 << 20;
+//# sourceMappingURL=types.js.map

package/dist/reputation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/reputation/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AACnD,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,0CAA0C;AAC1C,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAe/D;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAS;IAC5C,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,MAAM,CAAC;QACZ,KAAK,YAAY,CAAC;QAClB,KAAK,UAAU,CAAC;QAChB,KAAK,SAAS,CAAC;QACf,KAAK,gBAAgB,CAAC;QACtB,KAAK,eAAe,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AA4BD,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,CAAC"}

package/dist/reputation/whois.d.ts

@@ -0,0 +1,25 @@
+/**
+ * WHOIS hooks per REPUTATION.md §2.1.
+ *
+ * Operators supply their own WHOIS implementation — there is no de
+ * facto WHOIS library that is both reliable and free of rate limits,
+ * so this is intentionally pluggable.
+ *
+ * @module
+ */
+/**
+ * Recommended minimum domain registration age before a domain
+ * receives baseline trust per REPUTATION.md §2.1: 30 days, in
+ * milliseconds.
+ */
+export declare const MinDomainAgeMs: number;
+/**
+ * Pluggable WHOIS lookup. {@link domainAgeMs} returns the age in
+ * milliseconds since the domain was first registered.
+ */
+export interface WHOIS {
+    domainAgeMs(domain: string): Promise<number>;
+}
+/** Whether `ageMs` meets the {@link MinDomainAgeMs} floor. */
+export declare function meetsMinAge(ageMs: number): boolean;
+//# sourceMappingURL=whois.d.ts.map

package/dist/reputation/whois.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whois.d.ts","sourceRoot":"","sources":["../../src/reputation/whois.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAA0B,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD"}

package/dist/reputation/whois.js

@@ -0,0 +1,20 @@
+/**
+ * WHOIS hooks per REPUTATION.md §2.1.
+ *
+ * Operators supply their own WHOIS implementation — there is no de
+ * facto WHOIS library that is both reliable and free of rate limits,
+ * so this is intentionally pluggable.
+ *
+ * @module
+ */
+/**
+ * Recommended minimum domain registration age before a domain
+ * receives baseline trust per REPUTATION.md §2.1: 30 days, in
+ * milliseconds.
+ */
+export const MinDomainAgeMs = 30 * 24 * 3_600 * 1_000;
+/** Whether `ageMs` meets the {@link MinDomainAgeMs} floor. */
+export function meetsMinAge(ageMs) {
+    return ageMs >= MinDomainAgeMs;
+}
+//# sourceMappingURL=whois.js.map

package/dist/reputation/whois.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whois.js","sourceRoot":"","sources":["../../src/reputation/whois.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,GAAG,KAAK,CAAC;AAUtD,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,KAAK,IAAI,cAAc,CAAC;AACjC,CAAC"}

package/dist/seal/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Seal layer per ENVELOPE.md §4.4. Per-recipient key wrap +
+ * eventual signature/MAC over the canonical envelope bytes.
+ *
+ * @module
+ */
+export { type Suite, type WrapRandomness, WrapInfo, unwrap, wrap, wrapWithRandomness, } from "./wrap.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/seal/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/seal/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,KAAK,KAAK,EACV,KAAK,cAAc,EACnB,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,kBAAkB,GACnB,MAAM,WAAW,CAAC"}

package/dist/seal/index.js

@@ -0,0 +1,8 @@
+/**
+ * Seal layer per ENVELOPE.md §4.4. Per-recipient key wrap +
+ * eventual signature/MAC over the canonical envelope bytes.
+ *
+ * @module
+ */
+export { WrapInfo, unwrap, wrap, wrapWithRandomness, } from "./wrap.js";
+//# sourceMappingURL=index.js.map

package/dist/seal/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/seal/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAGL,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,kBAAkB,GACnB,MAAM,WAAW,CAAC"}

package/dist/seal/wrap.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Seal-layer key wrap per ENVELOPE.md §4.4.1.
+ *
+ * The wrap protects a fresh symmetric key (K_brief or K_enclosure)
+ * for one recipient. The construction is HPKE-Base style:
+ *
+ *   1. KEM: encapsulate against the recipient's public key. For
+ *      X25519 the encapsulation generates a fresh ephemeral and
+ *      computes ECDH; for Kyber768+X25519 hybrid both halves run
+ *      in parallel.
+ *   2. KDF: HKDF-SHA-512 over the shared secret with salt
+ *      `kemCt || recipientPub` and info "SEMP-v1-wrap".
+ *   3. AEAD: zero nonce, recipient pub as AAD, plaintext = the
+ *      symmetric key being wrapped. The zero nonce is safe because
+ *      the wrap key is unique per call (fresh ephemeral feeds
+ *      into the KDF).
+ *
+ * Output: `kemCt || aeadCt`, base64-encoded.
+ *
+ * @module
+ */
+/** HKDF info context for the wrap-key expansion. */
+export declare const WrapInfo = "SEMP-v1-wrap";
+/** Algorithm suite identifiers used on the wire. */
+export type Suite = "x25519-chacha20-poly1305" | "pq-kyber768-x25519";
+/**
+ * Unwrap a wrapped symmetric key per §4.4.1. Reverses the wrap
+ * computation: split kemCt from aeadCt by AEAD-overhead size,
+ * decapsulate, derive wrap_key, AEAD-open.
+ *
+ * @param suite negotiated suite that produced the wrap.
+ * @param recipientPrivateKey for X25519: 32 bytes; for hybrid:
+ *   2432 bytes (kyberPriv || x25519Priv per §4.4.1).
+ * @param recipientPublicKey for X25519: 32 bytes; for hybrid:
+ *   1216 bytes (kyberPub || x25519Pub per §4.4.1).
+ * @param wrappedB64 base64 of (kemCt || aeadCt).
+ */
+export declare function unwrap(suite: Suite, recipientPrivateKey: Uint8Array, recipientPublicKey: Uint8Array, wrappedB64: string): Uint8Array;
+/**
+ * Wrap `symmetricKey` for the given recipient under the negotiated
+ * suite. Production code path: uses the platform CSPRNG to generate
+ * a fresh ephemeral every call, which is what the §4.4.1 wrap
+ * construction requires — wrap-key uniqueness is what makes the
+ * zero-nonce AEAD safe.
+ *
+ * For deterministic byte-level reproducibility (vectors, audits),
+ * use {@link wrapWithRandomness} instead and pass pinned
+ * ephemeral inputs.
+ */
+export declare function wrap(suite: Suite, recipientPublicKey: Uint8Array, symmetricKey: Uint8Array): string;
+/**
+ * Inputs to a deterministic wrap. The fields a caller must pin to
+ * reproduce the exact wrap bytes a previous run produced.
+ */
+export interface WrapRandomness {
+    /** 32-byte X25519 ephemeral private key. Required for both suites. */
+    ephemeralX25519Priv: Uint8Array;
+    /**
+     * 32-byte ML-KEM-768 encapsulation randomness (FIPS 203 `m`).
+     * Required for the PQ suite, ignored for baseline.
+     */
+    kyberEncapsRandomnessM?: Uint8Array;
+}
+/**
+ * Deterministic wrap for vector reproduction and audits. Production
+ * code MUST use {@link wrap} (which sources fresh entropy) — a
+ * deterministic wrap that leaks `ephemeralX25519Priv` reduces to
+ * "the adversary has the wrap key". Exposed here only because
+ * cross-language vectors pin these inputs.
+ *
+ * Returns base64(kemCt || aeadCt) per ENVELOPE.md §4.4.1.
+ */
+export declare function wrapWithRandomness(suite: Suite, recipientPublicKey: Uint8Array, symmetricKey: Uint8Array, randomness: WrapRandomness): string;
+//# sourceMappingURL=wrap.d.ts.map

package/dist/seal/wrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../src/seal/wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAgBH,oDAAoD;AACpD,eAAO,MAAM,QAAQ,iBAAiB,CAAC;AAEvC,oDAAoD;AACpD,MAAM,MAAM,KAAK,GAAG,0BAA0B,GAAG,oBAAoB,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CACpB,KAAK,EAAE,KAAK,EACZ,mBAAmB,EAAE,UAAU,EAC/B,kBAAkB,EAAE,UAAU,EAC9B,UAAU,EAAE,MAAM,GACjB,UAAU,CAqCZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,IAAI,CAClB,KAAK,EAAE,KAAK,EACZ,kBAAkB,EAAE,UAAU,EAC9B,YAAY,EAAE,UAAU,GACvB,MAAM,CAiBR;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,mBAAmB,EAAE,UAAU,CAAC;IAChC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,UAAU,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,KAAK,EACZ,kBAAkB,EAAE,UAAU,EAC9B,YAAY,EAAE,UAAU,EACxB,UAAU,EAAE,cAAc,GACzB,MAAM,CA2BR"}