effect 4.0.7 → 4.1.1

package/dist/crypto/KeyWrap.d.ts

@@ -0,0 +1,390 @@
+/**
+ * Key wrapping: AES-KW (RFC 3394) and RSA-OAEP (RFC 8017).
+ *
+ * The {@link KeyWrap} service generates AES-KW keys and RSA-OAEP key pairs,
+ * wraps keys, and unwraps them. The top-level {@link key},
+ * {@link fromCryptoKey}, {@link privateKeyFromCryptoKey},
+ * {@link publicKeyFromCryptoKey}, and {@link toBytes} functions build and
+ * export keys without a service.
+ *
+ * `wrap` takes an `Aead`, `Cipher`, `Mac`, or `KeyWrap` key, never raw bytes,
+ * which keeps RSA-OAEP limited to key transport. `unwrap` returns a typed key
+ * of the algorithm it is given.
+ *
+ * A key-encryption key is the key most worth keeping non-extractable, so in
+ * browsers {@link fromCryptoKey} is the main way to build one.
+ *
+ * Keys are opaque. They hold either bytes or a `CryptoKey`, display only their
+ * algorithm, and compare by reference. The bytes are the AES-KW key, and
+ * PKCS#8 or SPKI DER for RSA-OAEP.
+ *
+ * **Gotchas**
+ *
+ * - AES-KW wraps keys whose length is a multiple of 8 bytes and at least 16
+ *   bytes. Other lengths fail with an `InvalidArgument` reason.
+ * - RSA-OAEP key generation and encryption use WebCrypto's own randomness and
+ *   cannot be seeded through `SecureRandom`.
+ * - Safari rejects RSA-OAEP keys over 4096 bits.
+ *
+ * @stability unstable
+ * @since 4.0.0
+ */
+import * as Context from "../Context.ts";
+import * as Effect from "../Effect.ts";
+import type { Inspectable } from "../Inspectable.ts";
+import * as Layer from "../Layer.ts";
+import * as CryptoError from "./CryptoError.ts";
+import * as Digest from "./Digest.ts";
+import type * as KeyFormat from "./KeyFormat.ts";
+import * as SecureRandom from "./SecureRandom.ts";
+import * as WebCrypto from "./WebCrypto.ts";
+declare const KeyTypeId: "~effect/crypto/KeyWrap/Key";
+declare const PrivateKeyTypeId: "~effect/crypto/KeyWrap/PrivateKey";
+declare const PublicKeyTypeId: "~effect/crypto/KeyWrap/PublicKey";
+/**
+ * AES-KW (RFC 3394), from {@link aes128Kw} or {@link aes256Kw}.
+ *
+ * **Details**
+ *
+ * `keyLength` is in bytes.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export interface AesKw {
+    readonly _tag: "AesKw";
+    readonly name: "aes128Kw" | "aes256Kw";
+    readonly keyLength: 16 | 32;
+}
+/**
+ * RSA-OAEP (RFC 8017), from {@link rsaOaep}.
+ *
+ * **Details**
+ *
+ * MGF1 uses the same hash, and there is no label. `modulusLength` is in bits
+ * and is only read by key generation: an imported key's
+ * `algorithm.modulusLength` is its real size.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export interface RsaOaep {
+    readonly _tag: "RsaOaep";
+    readonly name: string;
+    readonly hash: Digest.Algorithm;
+    readonly modulusLength: number;
+}
+/**
+ * A key wrapping algorithm, such as {@link aes256Kw} or {@link rsaOaepSha256}.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export type Algorithm = AesKw | RsaOaep;
+/**
+ * AES-128-KW (JOSE A128KW), with a 16-byte key.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export declare const aes128Kw: AesKw;
+/**
+ * AES-256-KW (JOSE A256KW), with a 32-byte key.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export declare const aes256Kw: AesKw;
+/**
+ * Builds an RSA-OAEP algorithm for a hash and a modulus length in bits.
+ *
+ * **Details**
+ *
+ * MGF1 uses the same hash. There is no OAEP label.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export declare const rsaOaep: (options: {
+    readonly hash: Digest.Algorithm;
+    readonly modulusLength: number;
+}) => RsaOaep;
+/**
+ * RSA-OAEP with SHA-256 (JOSE RSA-OAEP-256), generating 3072-bit keys. This is
+ * the default RSA-OAEP algorithm.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export declare const rsaOaepSha256: RsaOaep;
+/**
+ * RSA-OAEP with SHA-1 (JOSE RSA-OAEP), generating 3072-bit keys.
+ *
+ * **When to use**
+ *
+ * Use to interoperate with JOSE `RSA-OAEP`. Otherwise prefer
+ * {@link rsaOaepSha256}.
+ *
+ * @stability unstable
+ * @category algorithms
+ * @since 4.0.0
+ */
+export declare const rsaOaepSha1: RsaOaep;
+/**
+ * An opaque AES-KW key-encryption key for the algorithm `A`, which both wraps
+ * and unwraps.
+ *
+ * **Details**
+ *
+ * The key holds either key bytes or a `CryptoKey` from {@link fromCryptoKey}.
+ * `toString`, `toJSON`, and `inspect` show only the algorithm. Keys compare by
+ * reference and do not implement `Equal`.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export interface Key<out A extends AesKw = AesKw> extends Inspectable {
+    readonly [KeyTypeId]: typeof KeyTypeId;
+    readonly algorithm: A;
+}
+/**
+ * An opaque RSA-OAEP private key for the algorithm `A`, which unwraps.
+ *
+ * **Details**
+ *
+ * The key holds either PKCS#8 bytes or a `CryptoKey` from
+ * {@link privateKeyFromCryptoKey}. `toString`, `toJSON`, and `inspect` show
+ * only the algorithm. Keys compare by reference and do not implement `Equal`.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export interface PrivateKey<out A extends RsaOaep = RsaOaep> extends Inspectable {
+    readonly [PrivateKeyTypeId]: typeof PrivateKeyTypeId;
+    readonly algorithm: A;
+}
+/**
+ * An opaque RSA-OAEP public key for the algorithm `A`, which wraps.
+ *
+ * **Details**
+ *
+ * The key holds either SPKI bytes or a `CryptoKey` from
+ * {@link publicKeyFromCryptoKey}. Keys compare by reference and do not
+ * implement `Equal`.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export interface PublicKey<out A extends RsaOaep = RsaOaep> extends Inspectable {
+    readonly [PublicKeyTypeId]: typeof PublicKeyTypeId;
+    readonly algorithm: A;
+}
+/**
+ * An RSA-OAEP private key and its public key.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export interface KeyPair<out A extends RsaOaep = RsaOaep> {
+    readonly privateKey: PrivateKey<A>;
+    readonly publicKey: PublicKey<A>;
+}
+/**
+ * A key that wraps: an AES-KW key or an RSA-OAEP public key.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export type WrapKey<A extends Algorithm = Algorithm> = (A extends AesKw ? Key<A> : never) | (A extends RsaOaep ? PublicKey<A> : never);
+/**
+ * A key that unwraps: an AES-KW key or an RSA-OAEP private key.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.0.0
+ */
+export type UnwrapKey<A extends Algorithm = Algorithm> = (A extends AesKw ? Key<A> : never) | (A extends RsaOaep ? PrivateKey<A> : never);
+/**
+ * Checks whether a value is an AES-KW {@link Key}.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.0.0
+ */
+export declare const isKey: (u: unknown) => u is Key;
+/**
+ * Checks whether a value is an RSA-OAEP {@link PrivateKey}.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.0.0
+ */
+export declare const isPrivateKey: (u: unknown) => u is PrivateKey;
+/**
+ * Checks whether a value is an RSA-OAEP {@link PublicKey}.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.0.0
+ */
+export declare const isPublicKey: (u: unknown) => u is PublicKey;
+declare const KeyWrap_base: Context.ServiceClass<KeyWrap, "effect/crypto/KeyWrap", {
+    /**
+     * Generates an AES-KW key from `SecureRandom` bytes.
+     */
+    readonly generateKey: <A extends AesKw>(algorithm: A) => Effect.Effect<Key<A>, CryptoError.CryptoError>;
+    /**
+     * Generates an RSA-OAEP key pair with WebCrypto's own randomness, exported
+     * to PKCS#8 and SPKI.
+     */
+    readonly generateKeyPair: <A extends RsaOaep>(algorithm: A) => Effect.Effect<KeyPair<A>, CryptoError.CryptoError>;
+    /**
+     * Wraps an `Aead`, `Cipher`, `Mac`, or `KeyWrap` key. A non-extractable
+     * `CryptoKey`-backed key fails with a `NotExtractable` reason. A key that
+     * AES-KW or the RSA-OAEP modulus cannot take fails with an
+     * `InvalidArgument` reason.
+     */
+    readonly wrap: (wrapKey: WrapKey, key: KeyFormat.SecretKey) => Effect.Effect<Uint8Array, CryptoError.CryptoError>;
+    /**
+     * Unwraps a key and builds it as a key of `algorithm`. Wrapped bytes that
+     * fail the integrity check fail with a `DecryptionFailed` reason.
+     */
+    readonly unwrap: <A extends KeyFormat.SecretAlgorithm>(unwrapKey: UnwrapKey, algorithm: A, wrapped: Uint8Array) => Effect.Effect<KeyFormat.SecretKey<A>, CryptoError.CryptoError>;
+}>;
+/**
+ * Service that generates keys, wraps keys, and unwraps them.
+ *
+ * **Example** (Wrapping an AES-GCM key with AES-KW)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer } from "effect"
+ * import { Aead, KeyWrap, SecureRandom } from "effect/crypto"
+ *
+ * const program = Effect.gen(function*() {
+ *   const keyWrap = yield* KeyWrap.KeyWrap
+ *   const kek = yield* keyWrap.generateKey(KeyWrap.aes256Kw)
+ *   const key = yield* Aead.key(Aead.aes256Gcm, new Uint8Array(32))
+ *   const wrapped = yield* keyWrap.wrap(kek, key)
+ *   const unwrapped = yield* keyWrap.unwrap(kek, Aead.aes256Gcm, wrapped)
+ *   return [wrapped.length, unwrapped.algorithm.name]
+ * })
+ *
+ * const layer = KeyWrap.layerWebCrypto.pipe(Layer.provide(SecureRandom.layerWebCrypto))
+ * await Effect.runPromise(program.pipe(Effect.provide(layer))) // => [40, "aes256Gcm"]
+ * ```
+ *
+ * @stability unstable
+ * @category services
+ * @since 4.0.0
+ */
+export declare class KeyWrap extends KeyWrap_base {
+}
+/**
+ * Layer that provides `KeyWrap` on the `WebCrypto` reference.
+ *
+ * **Details**
+ *
+ * The layer imports a byte-backed key on first use and caches the
+ * `CryptoKey`. AES-KW keys come from `SecureRandom`, so a seeded
+ * `SecureRandom` reproduces them.
+ *
+ * WebCrypto's AES-KW only wraps `CryptoKey`s, so the layer imports the target
+ * bytes as a temporary extractable HMAC key and wraps that. RSA-OAEP uses
+ * `encrypt` and `decrypt` when the key allows them, and otherwise the same
+ * route through `wrapKey` and `unwrapKey`. Both give the same ciphertext.
+ *
+ * @stability unstable
+ * @category layers
+ * @since 4.0.0
+ */
+export declare const layerWebCrypto: Layer.Layer<KeyWrap, never, SecureRandom.SecureRandom>;
+/**
+ * Builds an AES-KW key from its bytes.
+ *
+ * **Details**
+ *
+ * The bytes are copied. A length other than the algorithm's key length fails
+ * with an `InvalidKey` reason. RSA-OAEP keys have no raw form, so passing
+ * them is a type error.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.0.0
+ */
+export declare const key: <A extends AesKw>(algorithm: A, bytes: Uint8Array) => Effect.Effect<Key<A>, CryptoError.CryptoError>;
+/**
+ * Builds an AES-KW key from an existing `CryptoKey`, such as a
+ * non-extractable one.
+ *
+ * **Details**
+ *
+ * The `CryptoKey` must be a secret AES-KW key of the algorithm's length with
+ * both the `wrapKey` and `unwrapKey` usages, since a key reaches both
+ * operations. Otherwise the constructor fails with an `InvalidKey` reason. It
+ * must come from the `Crypto` object of the `WebCrypto` reference.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.0.0
+ */
+export declare const fromCryptoKey: <A extends AesKw>(algorithm: A, cryptoKey: WebCrypto.CryptoKey) => Effect.Effect<Key<A>, CryptoError.CryptoError>;
+/**
+ * Builds an RSA-OAEP private key from an existing `CryptoKey`, such as a
+ * non-extractable one.
+ *
+ * **Details**
+ *
+ * The `CryptoKey` must be an RSA-OAEP private key with the algorithm's hash
+ * and the `decrypt` or `unwrapKey` usage. Otherwise the constructor fails
+ * with an `InvalidKey` reason. The modulus length is not checked. The key must
+ * come from the `Crypto` object of the `WebCrypto` reference.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.0.0
+ */
+export declare const privateKeyFromCryptoKey: <A extends RsaOaep>(algorithm: A, cryptoKey: WebCrypto.CryptoKey) => Effect.Effect<PrivateKey<A>, CryptoError.CryptoError>;
+/**
+ * Builds an RSA-OAEP public key from an existing `CryptoKey`.
+ *
+ * **Details**
+ *
+ * The `CryptoKey` must be an RSA-OAEP public key with the algorithm's hash and
+ * the `encrypt` or `wrapKey` usage. Otherwise the constructor fails with an
+ * `InvalidKey` reason. The key must come from the `Crypto` object of the
+ * `WebCrypto` reference.
+ *
+ * @stability unstable
+ * @category constructors
+ * @since 4.0.0
+ */
+export declare const publicKeyFromCryptoKey: <A extends RsaOaep>(algorithm: A, cryptoKey: WebCrypto.CryptoKey) => Effect.Effect<PublicKey<A>, CryptoError.CryptoError>;
+/**
+ * Exports a key's stored bytes.
+ *
+ * **Details**
+ *
+ * Returns a fresh `Uint8Array`: the AES-KW key, or PKCS#8 or SPKI DER for
+ * RSA-OAEP. A `CryptoKey`-backed key is exported on the `WebCrypto`
+ * reference, and fails with a `NotExtractable` reason when the `CryptoKey` is
+ * not extractable.
+ *
+ * @stability unstable
+ * @category converting
+ * @since 4.0.0
+ */
+export declare const toBytes: (key: Key | PrivateKey | PublicKey) => Effect.Effect<Uint8Array, CryptoError.CryptoError>;
+export {};
+//# sourceMappingURL=KeyWrap.d.ts.map

package/dist/crypto/KeyWrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyWrap.d.ts","sourceRoot":"","sources":["../../src/crypto/KeyWrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AAIpC,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAC/C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAIrC,OAAO,KAAK,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAEhD,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AACjD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAE3C,QAAA,MAAM,SAAS,EAAG,4BAAqC,CAAA;AACvD,QAAA,MAAM,gBAAgB,EAAG,mCAA4C,CAAA;AACrE,QAAA,MAAM,eAAe,EAAG,kCAA2C,CAAA;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,CAAA;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,OAAO,CAAA;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,EAAE,KAA0D,CAAA;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,EAAE,KAA0D,CAAA;AAEjF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,YAAa;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B,KAAG,OAKF,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,OAA+D,CAAA;AAE3F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,EAAE,OAA6D,CAAA;AAEvF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,CAAE,SAAQ,WAAW;IACnE,QAAQ,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,CAAE,SAAQ,WAAW;IAC9E,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,CAAA;IACpD,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,CAAE,SAAQ,WAAW;IAC7E,QAAQ,CAAC,CAAC,eAAe,CAAC,EAAE,OAAO,eAAe,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO;IACtD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAC/C,CAAC,CAAC,SAAS,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAClC,CAAC,CAAC,SAAS,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IACjD,CAAC,CAAC,SAAS,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAClC,CAAC,CAAC,SAAS,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAA;AAM/C;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,MAAO,OAAO,KAAG,CAAC,IAAI,GAA0C,CAAA;AAElF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,MAAO,OAAO,KAAG,CAAC,IAAI,UAAwD,CAAA;AAEvG;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,MAAO,OAAO,KAAG,CAAC,IAAI,SAAsD,CAAA;;IA2FlG;;OAEG;0BACmB,CAAC,CAAC,SAAS,KAAK,EAAE,SAAS,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC;IACvG;;;OAGG;8BACuB,CAAC,CAAC,SAAS,OAAO,EAAE,SAAS,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC;IACjH;;;;;OAKG;mBACY,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC;IACjH;;;OAGG;qBACc,CAAC,CAAC,SAAS,SAAS,CAAC,eAAe,EACnD,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,CAAC,EACZ,OAAO,EAAE,UAAU,KAChB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC;;AAnDrE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,OAAQ,SAAQ,YA0BA;CAAG;AAEhC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,YAAY,CAsGjF,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,GAAG,GAAI,CAAC,SAAS,KAAK,aACtB,CAAC,SACL,UAAU,KAChB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CACsD,CAAA;AAEtG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,SAAS,KAAK,aAChC,CAAC,aACD,SAAS,CAAC,SAAS,KAC7B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CAO5C,CAAA;AAmBJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,GAAI,CAAC,SAAS,OAAO,aAC5C,CAAC,aACD,SAAS,CAAC,SAAS,KAC7B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CACwC,CAAA;AAE/F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,OAAO,aAC3C,CAAC,aACD,SAAS,CAAC,SAAS,KAC7B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CACsC,CAAA;AAE5F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,OAAO,QAAS,GAAG,GAAG,UAAU,GAAG,SAAS,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,WAAW,CACR,CAAA"}