twzrd-x402-gate 0.9.7 → 0.9.9

package/QUICKSTART.md

@@ -2,16 +2,17 @@
 
 Refuses payment to a wash-flagged merchant **before your wallet signs**. Free intel, no
 API key, no signup, no config — every `TWZRD_*` env var is an optional override. If intel
-is unreachable the gate never *invents* a wash flag (the wash check fails open); a failed
-preflight blocks the payment by default (`TWZRD_FAIL_OPEN=true` to allow).
+is unreachable the gate never *invents* a wash flag. A failed preflight, or a merchant_card
+outage on a scored path, blocks by default (`TWZRD_FAIL_OPEN=true` to allow). A reachable
+card with no wash signal still proceeds.
 
-**Pin:** `twzrd-x402-gate@0.9.7` + stock PayAI client `x402-solana@3.0.0` (official
+**Pin:** `twzrd-x402-gate@0.9.8` + stock PayAI client `x402-solana@3.0.0` (official
 `beforePayment` seat). `@x402/core` Path E remains supported; refuse script is fallback.
 
 ## 1. Stock PayAI client (default seat — copy-paste)
 
 ```bash
-npm install twzrd-x402-gate@0.9.7 x402-solana@3.0.0
+npm install twzrd-x402-gate@0.9.8 x402-solana@3.0.0
 ```
 
 > **ESM-only.** The package ships `import` conditions only — a CommonJS
@@ -36,7 +37,7 @@ Then: `await client.fetch("https://merchant.example/paid");`
 ## 1b. Official `@x402/core` client (Path E)
 
 ```bash
-npm install twzrd-x402-gate@0.9.7 @x402/core @x402/fetch @x402/svm
+npm install twzrd-x402-gate@0.9.8 @x402/core @x402/fetch @x402/svm
 ```
 
 ```typescript
@@ -76,12 +77,38 @@ The factory itself does not read `TWZRD_AUTO_GATE`; use the AutoGate seat if you
 want the env kill switch re-read per call. You cannot `installTwzrdAutoGate(client)`
 after `createPayKitClient` — PayKit only accepts the hook at construction.
 
+## 1d. Cold-start a foreign diet (0 USDC)
+
+```bash
+npx twzrd-cold-start
+# policy.json: default-deny allowlist of foreign 402 hosts
+# signer_invocation_count: 0, usdc_spent: 0
+```
+
+Probes a pinned foreign GET 402 diet (not `*.twzrd`), scores each `payTo` with
+`evaluate_x402_resource` (wash refuse), writes `policy.json`, hops once from
+the resource join. Does not spend. `--spend` is refused. Seat AutoGate on the
+payer with
+`beforePayment: installTwzrdAutoGate("x402-solana", { refuseWashFlagged: true })`
+using that policy as the host allowlist. Live proof (needs egress):
+`npm run cold-start-live`.
+
 ## 2. Prove it blocked something (spends nothing)
 
+Hello-world that closes from this package (needs a prior **repo-root** `npm ci`
+and `npm run build`; do not `npm ci` in this directory):
+
+```bash
+npm run gate-eval-refuse
+# signer_invocation_count: 0, usdc_spent: 0
+```
+
+Optional seat proofs (live intel; the clean-fixture leg can exit 2 when
+`CLEAN_PAYTO` is wash-flagged — that is not the first demo):
+
 ```bash
-# Stock-client seat proof (beforePayment, signer_invocation_count=0)
-# needs x402-solana@3.0.0 installed - the harness fallback runs but does not
-# clear closure (its negative arm counts a would-be sign)
+# Stock-client seat proof (beforePayment). Needs x402-solana@3.0.0.
+# Harness fallback runs without it but does not clear closure.
 npm run x402-solana-before-payment-proof
 # writes block-proof-<run_id>.json — hook: beforePayment
 

package/README.md

@@ -80,7 +80,7 @@ transfer on-chain. Wash/sybil edges are primarily discounted in TWZRD scoring, n
 revenue refusal.
 
 ```bash
-npm install twzrd-x402-gate@0.9.7
+npm install twzrd-x402-gate@0.9.8
 ```
 
 ```typescript
@@ -125,7 +125,7 @@ Fixture-backed SVM extract tests live in `test/seller-hook.test.ts` +
 Install the published gate and run against wash fixtures:
 
 ```bash
-npm install twzrd-x402-gate@0.9.7
+npm install twzrd-x402-gate@0.9.8
 # from package root after install, or from a checkout:
 npm run wash-dogfood
 ```
@@ -273,8 +273,10 @@ Canonical path for every agent that spends USDC on Solana x402:
 | 4 | Pay (or refuse) | resource price | Only if steps 1–2 approved (and any opt-in paid escalate did not block). |
 
 **Fail-open (no invent):**
-- Preflight HTTP/network error → default fail-closed in gate 0.2+ (`TWZRD_FAIL_OPEN=true` restores legacy allow-on-outage).
-- Merchant card unreachable / non-2xx / missing `wash_flagged` → `washFlagged=null` → **do not refuse on wash** (preflight decision stands).
+- Preflight HTTP/network error → default fail-closed (`TWZRD_FAIL_OPEN=true` restores legacy allow-on-outage).
+- Merchant card **outage** on a reputation-scored path (5xx, 429, thrown fetch, non-JSON 200) → same `failOpen` switch; default refuses with `twzrd_card_unreachable_fail_closed`. This is tighten-only: an already-blocked payment keeps its more specific reason.
+- Merchant card **reachable** with no `wash_flagged` (including 4xx, or 200 + `insufficient_evidence`) → `washFlagged=null` → **do not refuse on wash**.
+- Unscored-network `observe`: a card outage keeps the observe allow; `wash_flagged: true` still refuses.
 - Only a successful card with `wash_flagged: true` triggers wash refuse or soft cap.
 
 **Wash policy (exact):**
@@ -295,7 +297,7 @@ Dogfood (one public live proof path):
 ## Install
 
 ```bash
-npm install twzrd-x402-gate@0.9.7
+npm install twzrd-x402-gate@0.9.8
 ```
 
 Do not hardcode a version in this doc — every past pin here (**0.5.4**, **0.7.1**, **0.8.5**,
@@ -561,7 +563,7 @@ Default **ON**. Disable with `TWZRD_AUTO_GATE=0` (env, deploy-time kill switch)
 What happens on every HTTP 402 the raw fetch returns:
 1. Reads the Solana-network entry from `accepts[]` (falls back to first entry) to get the seller wallet.
 2. Calls `POST /v1/intel/preflight` — free, no auth. `decision=block` (or score floor) throws — `payWrap`'s client never signs.
-3. Calls `GET /v1/intel/merchant_card/{payTo}` — free, no auth. `wash_flagged: true` refuses by default (only tightens step 2; fail-open if the card is unreachable — no invent).
+3. Calls `GET /v1/intel/merchant_card/{payTo}` — free, no auth. `wash_flagged: true` refuses by default (only tightens step 2). A reachable card with no wash signal fails open (no invent). A card outage on the scored path honours `failOpen` (default fail-closed).
 4. Otherwise returns the 402 to `payWrap`'s client, which pays normally.
 
 Non-402 responses pass through unchanged.
@@ -656,7 +658,8 @@ What the guard does on HTTP 402:
 1. Reads the Solana-network entry from `accepts[]` (falls back to first entry) to get the seller wallet.
 2. Free `POST /v1/intel/preflight` — `decision=block` / score floor deny.
 3. Free `GET /v1/intel/merchant_card/{payTo}` — `wash_flagged:true` **refuses by default**
-   (`reason: twzrd_wash_flagged`). Fail-open if the card is unreachable (no invent).
+   (`reason: twzrd_wash_flagged`). Reachable + no signal fails open (no invent). A card
+   outage on the scored path honours `failOpen` (default fail-closed).
 4. If approved: returns the original 402 for the x402 client to pay.
 
 Opt out of wash refuse: `withTwzrdGuard(fetch, { refuseWashFlagged: false })` or
@@ -672,14 +675,14 @@ const safeFetch = withTwzrdGuard(x402Fetch, {
   autoReceipt: true,   // on warn or allow, auto-buy the $0.05 TWZRD trust receipt
   x402Fetch,           // the paying fetch — TWZRD earns the fee on-chain
   onReceipt: (receipt, tx) => {
-    // receipt is a twzrd_receipt (V6 + ERC-8004 reputation_credential)
+    // receipt is a twzrd_receipt (V7 + ERC-8004 reputation_credential)
     console.log("Trust receipt captured:", tx);
   },
 });
 ```
 
 `autoReceipt` is **off by default** — it spends the **buyer's** USDC, so you opt in. When on,
-every warn/allow verdict settles $0.05 USDC to TWZRD and returns a signed V6 trust credential
+every warn/allow verdict settles $0.05 USDC to TWZRD and returns a signed V7 trust credential
 for the counterparty before you pay the resource.
 
 **`x402Fetch` is yours to supply** (this package is dependency-free). Wire the proven
@@ -698,7 +701,7 @@ is the next step.
 ### Quick tier ($0.001) — cheap paid qualify
 
 The reputation ladder has three rungs: **free** preflight (`allow/warn/block`), **$0.001**
-`quickCheck` (tier + score, no receipt), **$0.05** `autoReceipt` (full intel + signed V6
+`quickCheck` (tier + score, no receipt), **$0.05** `autoReceipt` (full intel + signed V7
 receipt). When the free preflight is inconclusive (`warn` / unknown seller) and you want a
 cheap *paid* confirmation before committing — without paying 50× for the portable receipt —
 use `quickCheck`:

package/bin/twzrd-cold-start.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+/**
+ * Cold-start buyer loop — zero spend.
+ *
+ * Probe a pinned foreign x402 diet, run AutoGate (refuse wash) before any
+ * signer, write default-deny policy.json, hop once from the resource join.
+ * Nothing here signs or spends. Self-serve transcript, not EXTERNAL_RUN.
+ *
+ * Usage (after npm run build, or from the published package):
+ *   npx twzrd-cold-start
+ *   node node_modules/twzrd-x402-gate/bin/twzrd-cold-start.js --no-hop
+ */
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { existsSync } from "node:fs";
+
+const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+async function loadCli() {
+  const dist = join(pkgRoot, "dist", "cold-start.js");
+  if (existsSync(dist)) return import(pathToFileURL(dist).href);
+  console.error(
+    "twzrd-cold-start: run `npm run build` in twzrd-x402-gate or install the published package",
+  );
+  process.exit(2);
+}
+
+async function main() {
+  const { parseArgs, runColdStart, USAGE, HelpError } = await loadCli();
+  let args;
+  try {
+    args = parseArgs(process.argv.slice(2));
+  } catch (e) {
+    if (e instanceof HelpError || (e instanceof Error && e.name === "HelpError")) {
+      console.log(e.message);
+      process.exit(0);
+    }
+    console.error(`twzrd-cold-start: ${e instanceof Error ? e.message : e}`);
+    console.error(USAGE);
+    process.exit(2);
+  }
+  const { log, info } = console;
+  console.log = (...a) => console.error(...a);
+  console.info = (...a) => console.error(...a);
+  let run;
+  try {
+    run = await runColdStart(args);
+  } finally {
+    console.log = log;
+    console.info = info;
+  }
+  const { transcript, exitCode } = run;
+  console.log(JSON.stringify(transcript, null, 2));
+  if (transcript.ok) {
+    console.error(
+      `OK: cold-start ${transcript.allowlisted_count} allowlisted, signer_invocation_count=0, usdc_spent=0 — self-serve, not EXTERNAL_RUN`,
+    );
+  } else {
+    console.error(
+      "FAIL: no diet host scored a 402 (signer_invocation_count=0, usdc_spent=0) — self-serve, not EXTERNAL_RUN",
+    );
+  }
+  process.exit(exitCode);
+}
+
+main().catch((e) => {
+  console.error("twzrd-cold-start FAILED", e instanceof Error ? e.message : e);
+  process.exit(1);
+});

package/dist/cold-start.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Cold-start buyer loop — no spend.
+ *
+ * Probe a pinned foreign x402 diet, score each payTo with evaluate_x402_resource
+ * (same policy AutoGate uses), write a default-deny policy.json, hop once from
+ * the resource join. Never pays. Never lists a TWZRD-operated seller as diet.
+ * Seat AutoGate on the real payer with the snippet on the transcript.
+ */
+import { type GateAdoptionLineage } from "./adoption-proof.js";
+export declare const COLD_START_TRANSCRIPT_SCHEMA: "twzrd.cold_start_transcript.v1";
+export declare const COLD_START_POLICY_SCHEMA: "twzrd.cold_start_policy.v1";
+/** Owned refuse dogfood — never a diet/hop target. */
+export declare const REFUSE_FIXTURE_PAYTO = "CnTmHDXVEafkc8sFSzNky9w5zwk63Bk2mHZZodorjhvR";
+/**
+ * Pinned foreign GET 402s. Independently controlled sellers, not `*.twzrd`.
+ * Live drift is recorded as a probe miss; it does not invent a catalog.
+ */
+export declare const DEFAULT_COLD_START_DIET: readonly string[];
+export declare const DEFAULT_MAX_PER_CALL_USDC = 0.05;
+export declare const DEFAULT_MAX_PER_DAY_USDC = 0.5;
+export declare const AUTOGATE_INSTALL_SNIPPET = "beforePayment: installTwzrdAutoGate(\"x402-solana\", { refuseWashFlagged: true })";
+export declare const USAGE = "usage: twzrd-cold-start [--diet-url <https url>]... [--no-hop]\n         [--integration <id>] [--run-id <uuid>] [--policy-out policy.json] [--out transcript.json]\n         [--intel-base https://intel.twzrd.xyz] [--max-per-call-usdc 0.05] [--max-per-day-usdc 0.50]\n\n  Probe a pinned foreign x402 diet (not *.twzrd), score each payTo with\n  evaluate_x402_resource (wash refuse), write a default-deny policy.json, then hop\n  once from GET /v1/intel/resources. Default is no spend. --spend is refused.\n  Seat AutoGate on the payer with the snippet on the transcript.\n\n  Exit 0: at least one diet host scored (allowlisted|refused|over_cap).\n  Exit 1: no diet host scored a 402. Exit 2: bad invocation.\n  Self-serve is dogfood, not EXTERNAL_RUN.";
+export type ColdStartHostStatus = "allowlisted" | "refused" | "over_cap" | "not_402" | "no_payto" | "forbidden" | "probe_error" | "no_eligible_hop" | "directory_error";
+export type ColdStartHostRow = {
+    role: "diet" | "hop";
+    resource_url: string;
+    host: string | null;
+    pay_to: string | null;
+    network: string | null;
+    price_usdc: number | null;
+    http_status: number | null;
+    decision: string | null;
+    approved: boolean;
+    reason: string;
+    wash_flagged: boolean | null;
+    status: ColdStartHostStatus;
+    abort: boolean;
+};
+export type ColdStartPolicyHost = {
+    host: string;
+    resource_url: string;
+    pay_to: string;
+    network: string | null;
+    price_usdc: number | null;
+};
+export type ColdStartPolicy = {
+    schema: typeof COLD_START_POLICY_SCHEMA;
+    mode: "default_deny";
+    refuse_wash_flagged: true;
+    max_per_call_usdc: number;
+    /** Advisory for the payer; this CLI does not enforce a daily cap. */
+    max_per_day_usdc: number;
+    autogate: {
+        refuseWashFlagged: true;
+        install: string;
+    };
+    hosts: ColdStartPolicyHost[];
+};
+export type ColdStartTranscript = {
+    schema: typeof COLD_START_TRANSCRIPT_SCHEMA;
+    package: "twzrd-x402-gate";
+    packageVersion: string;
+    mode: "no_spend";
+    integration: string;
+    runId: string;
+    lineage: GateAdoptionLineage;
+    clientHeader: string;
+    autogate: {
+        refuseWashFlagged: true;
+        install: string;
+    };
+    signer_invocation_count: 0;
+    payment_retry_count: 0;
+    usdc_spent: 0;
+    diet_urls: string[];
+    hop: boolean;
+    hosts: ColdStartHostRow[];
+    allowlisted_count: number;
+    policy: ColdStartPolicy;
+    policy_path: string | null;
+    exportedAt: string;
+    notExternalRunProof: string[];
+    /** True when at least one diet host was scored (allowlisted|refused|over_cap). */
+    ok: boolean;
+};
+export type ColdStartArgs = {
+    dietUrls: string[];
+    hop: boolean;
+    integration: string;
+    runId: string;
+    policyOut: string;
+    out: string | null;
+    intelBase: string;
+    maxPerCallUsdc: number;
+    maxPerDayUsdc: number;
+};
+export declare function hostnameOf(url: string): string | null;
+export declare function isForbiddenHost(host: string | null): boolean;
+export declare function isForbiddenUrl(url: string): boolean;
+export declare function isForbiddenPayTo(payTo: string | null | undefined): boolean;
+export declare function parseArgs(argv: string[]): ColdStartArgs;
+export declare class HelpError extends Error {
+    constructor(message: string);
+}
+export declare function buildPolicy(input: {
+    maxPerCallUsdc: number;
+    maxPerDayUsdc: number;
+    hosts: ColdStartHostRow[];
+}): ColdStartPolicy;
+export declare function runColdStart(args: ColdStartArgs): Promise<{
+    transcript: ColdStartTranscript;
+    policy: ColdStartPolicy;
+    exitCode: 0 | 1;
+}>;
+//# sourceMappingURL=cold-start.d.ts.map

package/dist/cold-start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cold-start.d.ts","sourceRoot":"","sources":["../src/cold-start.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAY/E,eAAO,MAAM,4BAA4B,EAAG,gCAAyC,CAAC;AACtF,eAAO,MAAM,wBAAwB,EAAG,4BAAqC,CAAC;AAE9E,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,iDAAiD,CAAC;AAEnF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAIpD,CAAC;AAEF,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAc5C,eAAO,MAAM,wBAAwB,sFAC8C,CAAC;AAEpF,eAAO,MAAM,KAAK,kvBAWyB,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAC3B,aAAa,GACb,SAAS,GACT,UAAU,GACV,SAAS,GACT,UAAU,GACV,WAAW,GACX,aAAa,GACb,iBAAiB,GACjB,iBAAiB,CAAC;AAQtB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,OAAO,wBAAwB,CAAC;IACxC,IAAI,EAAE,cAAc,CAAC;IACrB,mBAAmB,EAAE,IAAI,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE;QAAE,iBAAiB,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,OAAO,4BAA4B,CAAC;IAC5C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,mBAAmB,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE;QACR,iBAAiB,EAAE,IAAI,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,uBAAuB,EAAE,CAAC,CAAC;IAC3B,mBAAmB,EAAE,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,kFAAkF;IAClF,EAAE,EAAE,OAAO,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,EAAE,OAAO,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAuCF,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMrD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAO5D;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWnD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE1E;AAuBD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAkDvD;AAED,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAmDD,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B,GAAG,eAAe,CA2BlB;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IAAE,UAAU,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;CAAE,CAAC,CAyLxF"}