@agentlogin/issuer 0.0.0-stage → 0.2.0-beta.2

package/dist/sqlite-store.js

@@ -0,0 +1,81 @@
+// Durable reference adapter. Mutations use one write transaction; reads never acquire the writer lock.
+import { DatabaseSync } from 'node:sqlite';
+import { READ_METHODS, STORE_METHODS, StoreState } from './store.js';
+/**
+ * A deliberately coarse reference adapter: the complete state is one versioned JSON row, and every method executes
+ * under BEGIN IMMEDIATE for mutations or a read transaction for queries. No state survives between calls, and no
+ * await occurs while a transaction owns the lock. Reads still parse the complete snapshot.
+ * Separate connections and processes therefore see every preceding committed change. Use a local filesystem;
+ * WAL databases must not be shared over a network filesystem. This design favors auditable guarantees over scale.
+ */
+export class SQLiteStore {
+    database;
+    read;
+    write;
+    closed = false;
+    constructor(path, options = {}) {
+        const timeout = options.busyTimeoutMs ?? 5000;
+        if (!Number.isSafeInteger(timeout) || timeout < 0 || timeout > 2_147_483_647)
+            throw new RangeError('busyTimeoutMs must be a nonnegative 32-bit integer');
+        this.database = new DatabaseSync(path, { enableDoubleQuotedStringLiterals: false, allowExtension: false });
+        try {
+            // PRAGMA works on every supported Node 22 release; DatabaseSync's timeout option arrived later.
+            this.database.exec(`PRAGMA busy_timeout = ${timeout}`);
+            this.database.exec('PRAGMA journal_mode = WAL');
+            this.database.exec('PRAGMA synchronous = FULL');
+            this.database.exec('CREATE TABLE IF NOT EXISTS agentlogin_state (id INTEGER PRIMARY KEY CHECK (id = 1), snapshot TEXT NOT NULL)');
+            this.database.prepare('INSERT OR IGNORE INTO agentlogin_state (id, snapshot) VALUES (1, ?)').run(new StoreState().exportSnapshot());
+            this.read = this.database.prepare('SELECT snapshot FROM agentlogin_state WHERE id = 1');
+            this.write = this.database.prepare('UPDATE agentlogin_state SET snapshot = ? WHERE id = 1');
+        }
+        catch (error) {
+            this.database.close();
+            throw error;
+        }
+        return new Proxy(this, {
+            get: (target, property) => {
+                const method = Object.getOwnPropertyDescriptor(StoreState.prototype, property)?.value;
+                if (typeof method === 'function' && STORE_METHODS.includes(property)) {
+                    return async (...args) => target.perform(method, args, READ_METHODS.has(property));
+                }
+                const value = Reflect.get(target, property, target);
+                return typeof value === 'function' ? value.bind(target) : value;
+            },
+        });
+    }
+    perform(method, args, readOnly) {
+        if (this.closed)
+            throw new Error('SQLiteStore is closed');
+        this.database.exec(readOnly ? 'BEGIN' : 'BEGIN IMMEDIATE');
+        try {
+            const snapshot = this.read.get()?.snapshot;
+            if (typeof snapshot !== 'string')
+                throw new Error('Missing issuer store snapshot');
+            const state = new StoreState(snapshot);
+            const result = Reflect.apply(method, state, args);
+            // Enforce the adapter contract if a future StoreState change accidentally introduces an asynchronous method.
+            if (result && typeof result.then === 'function')
+                throw new Error('StoreState operations must be synchronous');
+            if (!readOnly)
+                this.write.run(state.exportSnapshot());
+            this.database.exec('COMMIT');
+            return result;
+        }
+        catch (error) {
+            // Certain SQLite failures already roll the transaction back. A failed ROLLBACK must not hide the cause.
+            try {
+                this.database.exec('ROLLBACK');
+            }
+            catch { /* already rolled back or unusable connection */ }
+            throw error;
+        }
+    }
+    /** Close this connection after requests have drained. Safe to call more than once. */
+    close() {
+        if (this.closed)
+            return;
+        this.database.close();
+        this.closed = true;
+    }
+}
+//# sourceMappingURL=sqlite-store.js.map

package/dist/sqlite-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-store.js","sourceRoot":"","sources":["../src/sqlite-store.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAc,MAAM,YAAY,CAAC;AAQjF;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACL,QAAQ,CAAe;IACvB,IAAI,CAAgB;IACpB,KAAK,CAAgB;IAC9B,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,IAAY,EAAE,UAA8B,EAAE;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,aAAa;YAAE,MAAM,IAAI,UAAU,CAAC,oDAAoD,CAAC,CAAC;QACzJ,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,gCAAgC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC;YACH,gGAAgG;YAChG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,6GAA6G,CAAC,CAAC;YAClI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,qEAAqE,CAAC,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;YACpI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC;YACxF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;YACrB,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;gBACxB,MAAM,MAAM,GAAG,MAAM,CAAC,wBAAwB,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,KAAgB,CAAC;gBACjG,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAuB,CAAC,EAAE,CAAC;oBACpF,OAAO,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAyC,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,QAAuB,CAAC,CAAC,CAAC;gBAClJ,CAAC;gBACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAY,CAAC;gBAC/D,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAClE,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,MAAuC,EAAE,IAAe,EAAE,QAAiB;QACzF,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC;YAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,6GAA6G;YAC7G,IAAI,MAAM,IAAI,OAAQ,MAA6B,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACtI,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wGAAwG;YACxG,IAAI,CAAC;gBAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;YAClG,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF"}

package/dist/state.d.ts

@@ -0,0 +1,30 @@
+import type { IssuerContext } from './context.js';
+import { type DenyReason, type SubjectFilter, type Transaction, type TransitionEffects } from './store.js';
+/** The transaction as it stands now. Expiry is a function of time, not a stored status (Section 6.2). */
+export declare function effective(ctx: IssuerContext, tx: Transaction): Transaction;
+/** A copy of `tx` in a terminal status. */
+export declare function ended(ctx: IssuerContext, tx: Transaction, status: 'completed' | 'denied', reason?: DenyReason): Transaction;
+/** Writes `next` if the transaction is still at `expectedVersion`. On success `next.version` is the stored version. */
+export declare function commit(ctx: IssuerContext, next: Transaction, expectedVersion: number, effects?: Omit<TransitionEffects, 'now'>): Promise<boolean>;
+/**
+ * Ends a transaction as `denied`, whatever else is happening to it: retried until it is terminal. Returns the
+ * transaction as it ended, which may be an outcome another request reached first.
+ */
+export declare function denyTransaction(ctx: IssuerContext, id: string, reason: DenyReason): Promise<Transaction | undefined>;
+/** Ends every open transaction that matches; `asserted` limits it to transactions past step 7 of Section 6.3. */
+export declare function denyOpenTransactions(ctx: IssuerContext, filter: SubjectFilter, reason: DenyReason, asserted?: boolean): Promise<void>;
+/** What a transaction, code or Access Token is bound to. */
+export interface Subject {
+    handle: string;
+    kid: string;
+    keyEnrollment: string;
+    clientId: string;
+    agentSub: string;
+    agentVersion: number;
+    accountVersion: number;
+}
+/**
+ * Whether the subject still stands (Sections 3.3, 7.4): the asserting key is the same enrollment, active and
+ * unexpired; the Agent exists and is enabled; the Account is not disabled. Otherwise the reason it does not.
+ */
+export declare function subjectState(ctx: IssuerContext, s: Subject): Promise<null | 'key_revoked' | 'access_denied'>;

package/dist/state.js

@@ -0,0 +1,77 @@
+import { isAssertionSubjectError, isAssertionWindowError, isTransactionExpiredError, isTransactionTokenError, TERMINAL } from './store.js';
+import { OAuthError } from './errors.js';
+/** The transaction as it stands now. Expiry is a function of time, not a stored status (Section 6.2). */
+export function effective(ctx, tx) {
+    if (!TERMINAL.has(tx.status) && ctx.now() >= tx.expiresAt)
+        return { ...tx, status: 'expired', terminalAt: tx.expiresAt, challenge: undefined };
+    return tx;
+}
+/** A copy of `tx` in a terminal status. */
+export function ended(ctx, tx, status, reason) {
+    return { ...tx, status, reason: reason ?? tx.reason, terminalAt: ctx.now(), challenge: undefined };
+}
+/** Writes `next` if the transaction is still at `expectedVersion`. On success `next.version` is the stored version. */
+export async function commit(ctx, next, expectedVersion, effects = {}) {
+    let updated;
+    try {
+        updated = await ctx.store.updateTransaction(next, expectedVersion, { ...effects, now: ctx.now() });
+    }
+    catch (error) {
+        // An external adapter can load a separate copy of the issuer package (including source vs dist in tests).
+        if (isAssertionSubjectError(error))
+            throw new OAuthError(401, error.error);
+        if (isTransactionExpiredError(error))
+            throw new OAuthError(410, 'transaction_expired');
+        if (isTransactionTokenError(error))
+            throw new OAuthError(401, 'invalid_token', undefined, { 'WWW-Authenticate': 'Bearer error="invalid_token"' });
+        if (isAssertionWindowError(error)) {
+            throw new OAuthError(400, 'invalid_assertion', 'assertion expired while awaiting acceptance');
+        }
+        throw error;
+    }
+    if (updated)
+        Object.assign(next, updated);
+    return updated !== undefined;
+}
+/**
+ * Ends a transaction as `denied`, whatever else is happening to it: retried until it is terminal. Returns the
+ * transaction as it ended, which may be an outcome another request reached first.
+ */
+export async function denyTransaction(ctx, id, reason) {
+    for (;;) {
+        const stored = await ctx.store.getTransaction(id);
+        if (!stored)
+            return undefined;
+        const cur = effective(ctx, stored);
+        if (TERMINAL.has(cur.status))
+            return cur;
+        const next = ended(ctx, cur, 'denied', reason);
+        if (await commit(ctx, next, stored.version)) {
+            return next;
+        }
+    }
+}
+/** Ends every open transaction that matches; `asserted` limits it to transactions past step 7 of Section 6.3. */
+export async function denyOpenTransactions(ctx, filter, reason, asserted = false) {
+    for (const t of await ctx.store.listOpenTransactions(filter)) {
+        if (!asserted || t.assertedAt !== undefined)
+            await denyTransaction(ctx, t.id, reason);
+    }
+}
+/**
+ * Whether the subject still stands (Sections 3.3, 7.4): the asserting key is the same enrollment, active and
+ * unexpired; the Agent exists and is enabled; the Account is not disabled. Otherwise the reason it does not.
+ */
+export async function subjectState(ctx, s) {
+    const key = await ctx.store.getKey(s.kid, s.handle);
+    if (!key || key.handle !== s.handle || key.enrollment !== s.keyEnrollment || key.agentSub !== s.agentSub || key.status !== 'active' || (await ctx.store.currentTime(ctx.now())) >= key.expiresAt)
+        return 'key_revoked';
+    const agent = await ctx.store.getAgent(s.handle);
+    if (!agent || agent.sub !== s.agentSub || !agent.enabled || agent.authorizationVersion !== s.agentVersion)
+        return 'access_denied';
+    const account = await ctx.store.getAccount(s.handle, s.clientId);
+    if (account?.status === 'disabled' || (account?.authorizationVersion ?? 0) !== s.accountVersion)
+        return 'access_denied';
+    return null;
+}
+//# sourceMappingURL=state.js.map

package/dist/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,QAAQ,EAAiF,MAAM,YAAY,CAAC;AAC1N,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,yGAAyG;AACzG,MAAM,UAAU,SAAS,CAAC,GAAkB,EAAE,EAAe;IAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC/I,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,KAAK,CAAC,GAAkB,EAAE,EAAe,EAAE,MAA8B,EAAE,MAAmB;IAC5G,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACrG,CAAC;AAED,uHAAuH;AACvH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAkB,EAAE,IAAiB,EAAE,eAAuB,EAAE,UAA0C,EAAE;IACvI,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0GAA0G;QAC1G,IAAI,uBAAuB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,yBAAyB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QACvF,IAAI,uBAAuB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAClJ,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,6CAA6C,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO;QAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,OAAO,KAAK,SAAS,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAkB,EAAE,EAAU,EAAE,MAAkB;IACtF,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAkB,EAAE,MAAqB,EAAE,MAAkB,EAAE,QAAQ,GAAG,KAAK;IACxH,KAAK,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAKD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB,EAAE,CAAU;IAC/D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS;QAAE,OAAO,aAAa,CAAC;IACvN,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,CAAC,YAAY;QAAE,OAAO,eAAe,CAAC;IAClI,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU,IAAI,CAAC,OAAO,EAAE,oBAAoB,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc;QAAE,OAAO,eAAe,CAAC;IACxH,OAAO,IAAI,CAAC;AACd,CAAC"}