@vanaheimr/cose 0.9.0

package/dist/errors.d.ts

@@ -0,0 +1,64 @@
+/**
+ * What goes wrong, and the difference between the two kinds of wrong.
+ *
+ * A malformed message is a programming or transport error and throws. A
+ * signature that does not verify is neither: it is the expected outcome of
+ * checking untrusted data, and a library that throws for it invites the
+ * `catch {}` that swallows the distinction. Verification therefore returns a
+ * result that has to be looked at, and says why when the answer is no.
+ */
+/** A COSE message, key or header bucket that is not well formed. */
+export declare class CoseError extends Error {
+    readonly name = "CoseError";
+    constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * The outcome of a verification.
+ *
+ * `verified: false` carries a reason, because "it did not verify" is rarely
+ * the useful half of the answer — whether the algorithm was refused, the
+ * payload was missing or the signature itself was wrong are three very
+ * different situations.
+ */
+export type Verification = {
+    readonly verified: true;
+} | {
+    readonly verified: false;
+    readonly reason: string;
+};
+/** A successful verification. */
+export declare const VERIFIED: Verification;
+/**
+ * A verification that failed.
+ *
+ * Named because it is the half of {@link Verification} that carries a reason,
+ * and a function returning only this half lets a caller pass it straight on as
+ * its own failure without the type widening back to "or it succeeded".
+ */
+export type NotVerified = Extract<Verification, {
+    verified: false;
+}>;
+/** A failed verification, with the reason it failed. */
+export declare const notVerified: (reason: string) => NotVerified;
+/**
+ * The outcome of a decryption.
+ *
+ * Kept apart from {@link Verification} because the useful half is different: a
+ * verification yields a yes or a no, a decryption yields the plaintext or a
+ * reason. Note that there is no partial plaintext in the failure case and
+ * never can be — an AEAD failure means the whole message is unauthenticated,
+ * and handing back what was decrypted before the tag was checked is the classic
+ * way to build an oracle out of a decryptor.
+ */
+export type Decryption = {
+    readonly decrypted: true;
+    readonly plaintext: Uint8Array;
+} | {
+    readonly decrypted: false;
+    readonly reason: string;
+};
+/** A failed decryption, with the reason it failed. */
+export declare const notDecrypted: (reason: string) => Extract<Decryption, {
+    decrypted: false;
+}>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAMA;;;;;;;;GAQG;AAGH,oEAAoE;AACpE,qBAAa,SAAU,SAAQ,KAAK;IAEhC,SAAyB,IAAI,eAAe;gBAEzB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAI7D;AAGD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAClB;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAG5D,iCAAiC;AACjC,eAAO,MAAM,QAAQ,EAAE,YAAiC,CAAC;AAGzD;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAGrE,wDAAwD;AACxD,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,KAAG,WACZ,CAAC;AAGlC;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,GAChB;IAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAG7D,sDAAsD;AACtD,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC,UAAU,EAAE;IAAE,SAAS,EAAE,KAAK,CAAA;CAAE,CACpD,CAAC"}

package/dist/headers.d.ts

@@ -0,0 +1,77 @@
+import type { CoseAlgorithm } from './algorithm.ts';
+import type { CborEntry, CborValue } from './cbor.ts';
+import type { Verification } from './errors.ts';
+export declare class CoseHeaders {
+    /** The header parameters, in the order they were given or read. */
+    readonly parameters: readonly CborEntry[];
+    constructor(parameters?: readonly CborEntry[]);
+    /**
+     * A bucket without any header parameters. As a protected bucket it is
+     * serialized as a zero-length byte string.
+     */
+    static readonly empty: CoseHeaders;
+    /** How many header parameters this bucket holds. */
+    get count(): number;
+    /** Whether this bucket has no header parameters at all. */
+    get isEmpty(): boolean;
+    /**
+     * The bucket holding the two header parameters almost every signed COSE
+     * message uses.
+     */
+    static create(algorithm?: CoseAlgorithm | null, keyIdentifier?: Uint8Array | null): CoseHeaders;
+    /** Parse the given CBOR map as a bucket of header parameters. */
+    static parse(value: CborValue): CoseHeaders;
+    /**
+     * Parse the serialized protected bucket of a COSE message.
+     *
+     * A zero-length byte string is an empty bucket and *not* an encoded empty
+     * map. It is the one encoding that must never be "repaired" into `A0`,
+     * because the signature covers these exact bytes [RFC 9052, Section 3].
+     *
+     * This is deliberately a separate function rather than an overload: a byte
+     * array is also a perfectly good CBOR byte string, and the two readings of
+     * the same argument mean very different things here.
+     */
+    static parseProtected(protectedBytes: Uint8Array): CoseHeaders;
+    /** The value of the given header parameter, or null. */
+    get(labelValue: CborValue): CborValue | null;
+    /** Whether the given header parameter is present within this bucket. */
+    has(labelValue: CborValue): boolean;
+    /**
+     * Return a copy in which the given header parameter is set, replacing it
+     * in place when it is already present and appending it otherwise.
+     */
+    set(labelValue: CborValue, value: CborValue): CoseHeaders;
+    /** The cryptographic algorithm (label 1), or null when absent. */
+    get algorithm(): CoseAlgorithm | null;
+    /** The key identifier (label 4), or null when absent or not a byte string. */
+    get keyIdentifier(): Uint8Array | null;
+    /** The content type (label 3), or null when absent. */
+    get contentType(): CborValue | null;
+    /** The labels a recipient is required to understand (label 2), or null. */
+    get critical(): readonly CborValue[] | null;
+    /** A CBOR map holding these header parameters, in their own order. */
+    toCbor(): CborValue;
+    /**
+     * The serialization of this bucket for use as the PROTECTED bucket of a
+     * COSE message: a zero-length byte string when the bucket is empty, and
+     * the encoded map otherwise [RFC 9052, Section 3].
+     *
+     * These are the exact bytes a signature is computed over, so they have to
+     * be transmitted and stored verbatim.
+     */
+    toProtectedBytes(): Uint8Array;
+}
+/**
+ * Check the `crit` header parameter of a pair of buckets
+ * [RFC 9052, Section 3.1].
+ *
+ * Every label listed there has to be present within the protected bucket and
+ * has to be understood and processed by whoever is verifying, otherwise the
+ * whole message is rejected. `alsoUnderstood` is how a caller that genuinely
+ * processes a parameter says so — validating a certificate chain, for
+ * instance — because what counts as understood is a property of the
+ * verification being performed rather than of this library.
+ */
+export declare function verifyCriticalHeaderParameters(protectedHeader: CoseHeaders, unprotectedHeader: CoseHeaders, alsoUnderstood?: readonly CborValue[]): Verification;
+//# sourceMappingURL=headers.d.ts.map

package/dist/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAwB,gBAAgB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAiB,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAyB,aAAa,CAAC;AAKnE,qBAAa,WAAW;IAEpB,mEAAmE;IACnE,SAAgB,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;gBAG9B,UAAU,GAAE,SAAS,SAAS,EAAO;IAcxD;;;OAGG;IACH,gBAAuB,KAAK,cAAqB;IAGjD,oDAAoD;IACpD,IAAW,KAAK,IAAI,MAAM,CAEzB;IAED,2DAA2D;IAC3D,IAAW,OAAO,IAAI,OAAO,CAE5B;IAGD;;;OAGG;WACW,MAAM,CAAC,SAAS,CAAC,EAAM,aAAa,GAAG,IAAI,EACpC,aAAa,CAAC,EAAE,UAAU,GAAG,IAAI,GAAG,WAAW;IAepE,iEAAiE;WACnD,KAAK,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW;IAUlD;;;;;;;;;;OAUG;WACW,cAAc,CAAC,cAAc,EAAE,UAAU,GAAG,WAAW;IAUrE,wDAAwD;IACjD,GAAG,CAAC,UAAU,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI;IAWnD,wEAAwE;IACjE,GAAG,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO;IAK1C;;;OAGG;IACI,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,WAAW;IAwBhE,kEAAkE;IAClE,IAAW,SAAS,IAAI,aAAa,GAAG,IAAI,CAS3C;IAED,8EAA8E;IAC9E,IAAW,aAAa,IAAI,UAAU,GAAG,IAAI,CAM5C;IAED,uDAAuD;IACvD,IAAW,WAAW,IAAI,SAAS,GAAG,IAAI,CAEzC;IAED,2EAA2E;IAC3E,IAAW,QAAQ,IAAI,SAAS,SAAS,EAAE,GAAG,IAAI,CAMjD;IAGD,sEAAsE;IAC/D,MAAM,IAAI,SAAS;IAK1B;;;;;;;OAOG;IACI,gBAAgB,IAAI,UAAU;CAIxC;AAGD;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,eAAe,EAAI,WAAW,EAC9B,iBAAiB,EAAE,WAAW,EAC9B,cAAc,GAAK,SAAS,SAAS,EAAO,GAAG,YAAY,CA+BzG"}

package/dist/hmac.d.ts

@@ -0,0 +1,32 @@
+import type { DigestAlgorithm } from './ecdsa.ts';
+/**
+ * The full HMAC of a message, before any truncation.
+ *
+ * The key is passed through as it is. RFC 9053 says the key SHOULD be as long
+ * as the hash output, which is a recommendation about key management rather
+ * than a rule about the primitive — RFC 2104 accepts any length, and the
+ * published test vectors of RFC 4231 include a four-byte key. Refusing short
+ * keys here would make those vectors unreproducible while protecting nobody
+ * who was not already choosing their own key length.
+ */
+export declare const hmac: (hash: DigestAlgorithm, key: Uint8Array, message: Uint8Array) => Uint8Array;
+/**
+ * The authentication tag of a message: the HMAC, truncated to the width the
+ * algorithm names.
+ *
+ * `tagSize` is in bytes and is the algorithm's, never the caller's — the
+ * whole point of `HMAC 256/64` being a registered identifier rather than a
+ * parameter is that both parties know the width from the message.
+ */
+export declare function macTag(hash: DigestAlgorithm, tagSize: number, key: Uint8Array, message: Uint8Array): Uint8Array;
+/**
+ * Whether two authentication tags are the same, without saying *where* they
+ * first differ.
+ *
+ * The length check in front is not a leak: the width of a tag follows from the
+ * algorithm, which travels in the message and is known to everybody. What must
+ * not leak is the position of the first differing byte, and that is what the
+ * constant-time comparison protects.
+ */
+export declare function tagsEqual(left: Uint8Array, right: Uint8Array): boolean;
+//# sourceMappingURL=hmac.d.ts.map

package/dist/hmac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac.d.ts","sourceRoot":"","sources":["../src/hmac.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAO,YAAY,CAAC;AAGnD;;;;;;;;;GASG;AACH,eAAO,MAAM,IAAI,GAAI,MAAM,eAAe,EAAE,KAAK,UAAU,EAAE,SAAS,UAAU,KAAG,UAC1C,CAAC;AAG1C;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAM,eAAe,EACzB,OAAO,EAAG,MAAM,EAChB,GAAG,EAAO,UAAU,EACpB,OAAO,EAAG,UAAU,GAAG,UAAU,CASvD;AAGD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAetE"}

package/dist/index.d.ts

@@ -0,0 +1,87 @@
+/**
+ * CBOR Object Signing and Encryption [RFC 9052] in TypeScript.
+ *
+ * The TypeScript counterpart of Vanaheimr Styx's `Illias/COSE`, built on the
+ * same CBOR codec that carries Metrological CBOR — which is the point: the
+ * encoding of a metrological reading is a pure function of its value, unit,
+ * prefix and uncertainty, so the same reading always produces the same bytes
+ * and therefore the same signature. Two implementations that disagree about
+ * one byte of a reading produce signatures that fail at the other, and that is
+ * a conformance failure a test can catch.
+ *
+ * What is implemented: `COSE_Sign1` (tag 18) and `COSE_Sign` (tag 98);
+ * `COSE_Mac0` (tag 17) and `COSE_Mac` (tag 97) with HMAC; `COSE_Encrypt0`
+ * (tag 16) and `COSE_Encrypt` (tag 96) with AES-GCM; recipient structures
+ * carrying a content key by `direct` or AES key wrap; the version 2
+ * countersignatures of RFC 9338; COSE keys of key type EC2, OKP, AKP and
+ * Symmetric with the key thumbprints of RFC 9679; the ECDSA algorithms of
+ * RFC 9053 and RFC 9864, EdDSA of RFC 8032 and ML-DSA of RFC 9964; and the
+ * X.509 chains of RFC 9360, walked to a trust anchor and bound to the key that
+ * signed. Detached payloads, external additional authenticated data and the
+ * `crit` header parameter throughout.
+ *
+ * The three families mean three different things, and the API keeps them
+ * apart. A **signature** says "the holder of that private key produced this",
+ * to anybody. A **MAC** says "someone holding the shared key produced this",
+ * and only to someone holding that key — so it proves nothing to a third
+ * party, and with several recipients nothing to the recipients either.
+ * **Encryption** says even less about origin: AEAD integrity means "whoever
+ * holds this key wrote this". That is why a metrological record is *signed*,
+ * and why a signed payload inside an encrypted envelope is how one gets both.
+ * `signWith` and `macWith` refuse each other's algorithms accordingly.
+ *
+ * What is not, each for a reason. AES-CBC-MAC, whose safety within COSE rests
+ * on the encoding rather than on the primitive, see RFC 9053 Section 3.2.1.
+ * AES-CCM and ChaCha20/Poly1305, as scope rather than judgement: CCM is eight
+ * registered variants of nonce and tag width for a constrained-device world
+ * this library does not live in — and, since the crypto moved to noble, a
+ * primitive without a supplier — while ChaCha earns its keep where there is
+ * no AES hardware; Styx carries neither, so the cross-signing suite would
+ * have nothing to compare. `COSE_Countersignature0`, a bare signature with no
+ * header buckets of its own: which algorithm made it and which key checks it
+ * travel outside the message, by agreement, and everything else here works in
+ * the opposite direction. ECDH-based key agreement and the HKDF key
+ * derivations, which need COSE_KDF_Context, a structure of its own. And the
+ * `x5bag` and `x5u` header parameters: a bag is an unordered heap with no
+ * path to follow, and a URI is a fetch, which a signature library has no
+ * business performing.
+ */
+export { CoseError, notDecrypted, notVerified, VERIFIED } from './errors.ts';
+export type { Decryption, NotVerified, Verification } from './errors.ts';
+export { bytesEqual, cbor, DETERMINISTIC, NO_BYTES, PRESERVE } from './cbor.ts';
+export { canonicalizePayload, isCanonicalPayload } from './payload.ts';
+export type { CborEntry, CborValue } from './cbor.ts';
+export { HeaderLabel, headerLabelName, isUnderstood, label, sameLabel } from './labels.ts';
+export { ALL_CURVES, CoseCurves, curveById, curveByName, KEY_TYPE_EC2, KEY_TYPE_OKP } from './curve.ts';
+export type { CoseCurve } from './curve.ts';
+export { ALL_ALGORITHMS, algorithmById, algorithmByName, algorithmFromCbor, algorithmToCbor, CoseAlgorithms, macWith, resolveCurve, sameAlgorithm, signWith, verifyMacWith, verifyWith } from './algorithm.ts';
+export type { AlgorithmFamily, CoseAlgorithm } from './algorithm.ts';
+export { decompressY, digest, isImplemented, isOnCurve, publicKeyFor } from './ecdsa.ts';
+export type { DigestAlgorithm } from './ecdsa.ts';
+export { eddsaPublicKeyFor, eddsaSign, eddsaSignatureSize, eddsaVerify, isEddsaCurve } from './eddsa.ts';
+export { isMldsaParameterSet, MLDSA_PARAMETER_SETS, MLDSA_SEED_SIZE, MLDSA_SIZES, mldsaPublicKeyFor, mldsaSign, mldsaVerify } from './mldsa.ts';
+export type { MldsaParameterSet } from './mldsa.ts';
+export { CoseHeaders, verifyCriticalHeaderParameters } from './headers.ts';
+export { CoseKey, KEY_TYPE_AKP, KEY_TYPE_SYMMETRIC, KeyLabel } from './key.ts';
+export type { CoseKeyParts } from './key.ts';
+export { CoseSignature } from './signature.ts';
+export { COSE_SIGN1_TAG, COUNTERSIGNATURE_CONTEXT, CoseSign1, SIGNATURE_CONTEXT } from './sign1.ts';
+export type { CertificateChainVerification, CertificateChainVerifyOptions, Sign1Options, VerifyOptions } from './sign1.ts';
+export { COSE_SIGN_TAG, CoseSign } from './sign.ts';
+export { COSE_MAC0_TAG, CoseMac0, MAC0_CONTEXT } from './mac0.ts';
+export type { Mac0Options, Mac0VerifyOptions } from './mac0.ts';
+export { hmac, macTag, tagsEqual } from './hmac.ts';
+export { aesGcmDecrypt, aesGcmEncrypt, aesKeyUnwrap, aesKeyWrap, GCM_NONCE_SIZE, GCM_TAG_SIZE } from './aes.ts';
+export { CoseRecipient, keyWrapAlgorithmFor } from './recipient.ts';
+export type { RecipientOptions } from './recipient.ts';
+export { COSE_MAC_TAG, CoseMac, MAC_CONTEXT } from './mac.ts';
+export type { MacOptions, MacVerifyOptions } from './mac.ts';
+export { COSE_ENCRYPT0_TAG, COSE_ENCRYPT_TAG, CoseEncrypt, CoseEncrypt0, encStructure, ENCRYPT0_CONTEXT, ENCRYPT_CONTEXT } from './encrypt.ts';
+export type { DecryptOptions, EncryptOptions } from './encrypt.ts';
+export { contentsOf, contextTag, derBitString, derBitStringRaw, derBoolean, derInteger, derObjectIdentifier, derString, derTime, DerReader, Tag } from './asn1.ts';
+export type { Asn1Node } from './asn1.ts';
+export { curveByOid, KeyUsage, oidOfCurve, signatureAlgorithmByOid, X509Certificate, X509Name } from './x509.ts';
+export type { BasicConstraints, NameAttribute } from './x509.ts';
+export { CoseCertificateChain, CoseCertificateHash } from './x5chain.ts';
+export type { ChainValidationOptions } from './x5chain.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EACpC,QAAQ,EAAE,MAAsC,aAAa,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EACvB,YAAY,EAAE,MAA6B,aAAa,CAAC;AAEvE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAC/B,QAAQ,EAAE,QAAQ,EAAE,MAA4B,WAAW,CAAC;AAErE,OAAO,EAAE,mBAAmB,EACnB,kBAAkB,EAAE,MAA4B,cAAc,CAAC;AACxE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAqB,WAAW,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,eAAe,EAC5B,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,MAAgB,aAAa,CAAC;AAEvE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EACjC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAO,YAAY,CAAC;AACtE,YAAY,EAAE,SAAS,EAAE,MAAgC,YAAY,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,aAAa,EAC7B,eAAe,EAAE,iBAAiB,EAClC,eAAe,EAAE,cAAc,EAC/B,OAAO,EAAE,YAAY,EAAE,aAAa,EACpC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAW,gBAAgB,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAW,gBAAgB,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAClC,SAAS,EAAE,YAAY,EAAE,MAAuB,YAAY,CAAC;AACtE,YAAY,EAAE,eAAe,EAAE,MAA0B,YAAY,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAC5B,kBAAkB,EAAE,WAAW,EAC/B,YAAY,EAAE,MAAkC,YAAY,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EACzC,eAAe,EAAE,WAAW,EAC5B,iBAAiB,EAAE,SAAS,EAC5B,WAAW,EAAE,MAAmC,YAAY,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAwB,YAAY,CAAC;AAEtE,OAAO,EAAE,WAAW,EACX,8BAA8B,EAAE,MAAgB,cAAc,CAAC;AAExE,OAAO,EAAE,OAAO,EAAE,YAAY,EACrB,kBAAkB,EAAE,QAAQ,EAAE,MAAkB,UAAU,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,MAA6B,UAAU,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAiC,gBAAgB,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,wBAAwB,EACxC,SAAS,EAAE,iBAAiB,EAAE,MAAkB,YAAY,CAAC;AACtE,YAAY,EAAE,4BAA4B,EAC5B,6BAA6B,EAC7B,YAAY,EAAE,aAAa,EAAE,MAAc,YAAY,CAAC;AAEtE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAuB,WAAW,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAU,WAAW,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAW,WAAW,CAAC;AAErE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAuB,WAAW,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAC1C,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,MAAO,UAAU,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAY,gBAAgB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,MAAyB,gBAAgB,CAAC;AAE1E,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,MAAY,UAAU,CAAC;AACpE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAa,UAAU,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EACnC,WAAW,EAAE,YAAY,EAAE,YAAY,EACvC,gBAAgB,EAAE,eAAe,EAAE,MAAa,cAAc,CAAC;AACxE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAW,cAAc,CAAC;AAExE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EACpC,eAAe,EAAE,UAAU,EAAE,UAAU,EACvC,mBAAmB,EAAE,SAAS,EAAE,OAAO,EACvC,SAAS,EAAE,GAAG,EAAE,MAAgC,WAAW,CAAC;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAiC,WAAW,CAAC;AAErE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAChC,uBAAuB,EAAE,eAAe,EACxC,QAAQ,EAAE,MAAsC,WAAW,CAAC;AACrE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAU,WAAW,CAAC;AAErE,OAAO,EAAE,oBAAoB,EACpB,mBAAmB,EAAE,MAA2B,cAAc,CAAC;AACxE,YAAY,EAAE,sBAAsB,EAAE,MAAmB,cAAc,CAAC"}