@elizaos/app-core 2.0.0-alpha.85 → 2.0.0-beta.2

package/api/auth/passwords.js

@@ -0,0 +1,87 @@
+/**
+ * Password hashing + strength gating for the P1 auth path.
+ *
+ * Backed by `@node-rs/argon2` per plan §11 (Rust prebuilt binaries, no
+ * native compile step on Bun/Linux CI). We use argon2id with parameters
+ * lifted from current OWASP Password Storage guidance:
+ *
+ *   memoryCost: 19_456 KiB (≈19 MiB)
+ *   timeCost:   2 iterations
+ *   parallelism: 1
+ *
+ * `verifyPassword` delegates to `@node-rs/argon2`'s `verify`, which is
+ * timing-safe by construction. We never short-circuit on hash shape or
+ * length comparison — every verify runs through the full KDF.
+ *
+ * Hard rule: this module fails closed. Any error during `hash` or `verify`
+ * propagates to the caller. We do NOT swallow exceptions and pretend the
+ * password matched.
+ */
+import { hash, verify } from "@node-rs/argon2";
+// Inline the value of @node-rs/argon2's `Algorithm.Argon2id` const enum.
+// `isolatedModules` cannot read ambient const enum members across module
+// boundaries, so we reference the raw integer here. The Rust side defines
+// Argon2id = 2; if upstream changes that value, hashes minted with the wrong
+// id won't verify and we'll see immediate test failures.
+const ARGON2_ALGO_ID = 2;
+/**
+ * OWASP-aligned argon2id parameters. Tuned conservatively so cold boots on
+ * modest hardware (the desktop app) don't stutter. If these change, write a
+ * migration note — every existing hash in the DB still validates because
+ * argon2 encodes its parameters in the hash string.
+ */
+export const ARGON2_PARAMS = {
+    algorithm: ARGON2_ALGO_ID,
+    memoryCost: 19_456,
+    timeCost: 2,
+    parallelism: 1,
+};
+export const PASSWORD_MIN_LENGTH = 12;
+export class WeakPasswordError extends Error {
+    reason;
+    constructor(reason) {
+        super(`weak_password:${reason}`);
+        this.name = "WeakPasswordError";
+        this.reason = reason;
+    }
+}
+/**
+ * Refuse passwords under {@link PASSWORD_MIN_LENGTH} characters or with
+ * trivially weak composition. We deliberately do not pull in `zxcvbn` to
+ * avoid adding a runtime dep without explicit confirmation; the length +
+ * composition floor is the documented fallback in the task brief.
+ *
+ * Throws {@link WeakPasswordError} on rejection.
+ */
+export function assertPasswordStrong(plain) {
+    if (typeof plain !== "string" || plain.length < PASSWORD_MIN_LENGTH) {
+        throw new WeakPasswordError("too_short");
+    }
+    if (!/[A-Za-z]/.test(plain)) {
+        throw new WeakPasswordError("missing_letter");
+    }
+    if (!/[0-9\W_]/.test(plain)) {
+        throw new WeakPasswordError("missing_digit_or_symbol");
+    }
+}
+/**
+ * Hash `plain` with argon2id. Returns the encoded string (parameters + salt
+ * + tag) suitable for direct DB storage.
+ *
+ * Errors propagate to the caller — fail-fast policy.
+ */
+export async function hashPassword(plain) {
+    return await hash(plain, ARGON2_PARAMS);
+}
+/**
+ * Compare `plain` against a stored argon2id hash. Returns `true` on match,
+ * `false` on mismatch. Always runs the full KDF; never short-circuits.
+ *
+ * If the encoded hash is malformed or hashed with a different algorithm,
+ * `@node-rs/argon2` throws — we propagate. The caller MUST treat a thrown
+ * error as a verification failure (i.e., `await verifyPassword(...).catch(()
+ * => false)` is wrong; let it surface).
+ */
+export async function verifyPassword(plain, encodedHash) {
+    return await verify(encodedHash, plain);
+}

package/api/auth/sensitive-rate-limit.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Sensitive-route rate limiter.
+ *
+ * The existing `authAttempts` bucket in `../auth.ts` covers token-auth
+ * failures (20/min/ip). Sensitive auth writes — bootstrap exchange,
+ * password change, machine-token rotation, owner-binding state changes,
+ * SSO callback exchanges — get a stricter bucket sized 5/min/ip, separate
+ * so a normal auth-failure burst doesn't lock out legitimate sensitive
+ * writes.
+ *
+ * Each named route gets its own bucket via `getSensitiveLimiter(name)` so
+ * a flood on `/api/auth/login/sso/start` does not lock out
+ * `/api/auth/owner/bind/start` for the same client. Buckets are created
+ * lazily and tracked centrally so the singleton sweep + reset hooks cover
+ * all of them.
+ *
+ * Caller pattern:
+ *
+ *   const limiter = getSensitiveLimiter("auth.bootstrap.exchange");
+ *   if (!limiter.consume(ip)) {
+ *     sendJsonError(res, 429, "Too many requests");
+ *     return true;
+ *   }
+ */
+export declare const SENSITIVE_RATE_LIMIT_WINDOW_MS: number;
+export declare const SENSITIVE_RATE_LIMIT_MAX = 5;
+declare class SensitiveRateLimiter {
+    private readonly buckets;
+    /**
+     * Returns true when the request is allowed, false when the limit is
+     * exhausted. Each successful call increments the bucket, so repeated
+     * `consume` calls in the same window will eventually return false even
+     * for valid traffic — this is intentional.
+     */
+    consume(ip: string | null, now?: number): boolean;
+    reset(): void;
+    sweep(now?: number): void;
+}
+/**
+ * Look up (or lazily create) the named sensitive-route limiter. Use one
+ * name per logical operation — e.g. `auth.bootstrap.exchange`,
+ * `auth.login.sso.start`, `auth.owner.bind.start`.
+ *
+ * Buckets are kept in a central registry so the sweep timer and the
+ * `_resetSensitiveLimiters` test helper handle them all.
+ */
+export declare function getSensitiveLimiter(name: string): SensitiveRateLimiter;
+/**
+ * Bootstrap exchange limiter — kept as a named export so existing P0
+ * callers don't churn. New code should prefer `getSensitiveLimiter(name)`.
+ */
+export declare const bootstrapExchangeLimiter: SensitiveRateLimiter;
+/** Reset state. Test-only. */
+export declare function _resetSensitiveLimiters(): void;
+export {};
+//# sourceMappingURL=sensitive-rate-limit.d.ts.map

package/api/auth/sensitive-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-rate-limit.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/sensitive-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,eAAO,MAAM,8BAA8B,QAAY,CAAC;AACxD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAO1C,cAAM,oBAAoB;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAE1D;;;;;OAKG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO;IAe7D,KAAK,IAAI,IAAI;IAIb,KAAK,CAAC,GAAG,GAAE,MAAmB,GAAG,IAAI;CAKtC;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAOtE;AAED;;;GAGG;AACH,eAAO,MAAM,wBAAwB,sBAEpC,CAAC;AAcF,8BAA8B;AAC9B,wBAAgB,uBAAuB,IAAI,IAAI,CAI9C"}

package/api/auth/sensitive-rate-limit.js

@@ -0,0 +1,95 @@
+/**
+ * Sensitive-route rate limiter.
+ *
+ * The existing `authAttempts` bucket in `../auth.ts` covers token-auth
+ * failures (20/min/ip). Sensitive auth writes — bootstrap exchange,
+ * password change, machine-token rotation, owner-binding state changes,
+ * SSO callback exchanges — get a stricter bucket sized 5/min/ip, separate
+ * so a normal auth-failure burst doesn't lock out legitimate sensitive
+ * writes.
+ *
+ * Each named route gets its own bucket via `getSensitiveLimiter(name)` so
+ * a flood on `/api/auth/login/sso/start` does not lock out
+ * `/api/auth/owner/bind/start` for the same client. Buckets are created
+ * lazily and tracked centrally so the singleton sweep + reset hooks cover
+ * all of them.
+ *
+ * Caller pattern:
+ *
+ *   const limiter = getSensitiveLimiter("auth.bootstrap.exchange");
+ *   if (!limiter.consume(ip)) {
+ *     sendJsonError(res, 429, "Too many requests");
+ *     return true;
+ *   }
+ */
+export const SENSITIVE_RATE_LIMIT_WINDOW_MS = 60 * 1000;
+export const SENSITIVE_RATE_LIMIT_MAX = 5;
+class SensitiveRateLimiter {
+    buckets = new Map();
+    /**
+     * Returns true when the request is allowed, false when the limit is
+     * exhausted. Each successful call increments the bucket, so repeated
+     * `consume` calls in the same window will eventually return false even
+     * for valid traffic — this is intentional.
+     */
+    consume(ip, now = Date.now()) {
+        const key = ip ?? "unknown";
+        const entry = this.buckets.get(key);
+        if (!entry || now > entry.resetAt) {
+            this.buckets.set(key, {
+                count: 1,
+                resetAt: now + SENSITIVE_RATE_LIMIT_WINDOW_MS,
+            });
+            return true;
+        }
+        if (entry.count >= SENSITIVE_RATE_LIMIT_MAX)
+            return false;
+        entry.count += 1;
+        return true;
+    }
+    reset() {
+        this.buckets.clear();
+    }
+    sweep(now = Date.now()) {
+        for (const [key, entry] of this.buckets) {
+            if (now > entry.resetAt)
+                this.buckets.delete(key);
+        }
+    }
+}
+const limiterRegistry = new Map();
+/**
+ * Look up (or lazily create) the named sensitive-route limiter. Use one
+ * name per logical operation — e.g. `auth.bootstrap.exchange`,
+ * `auth.login.sso.start`, `auth.owner.bind.start`.
+ *
+ * Buckets are kept in a central registry so the sweep timer and the
+ * `_resetSensitiveLimiters` test helper handle them all.
+ */
+export function getSensitiveLimiter(name) {
+    let limiter = limiterRegistry.get(name);
+    if (!limiter) {
+        limiter = new SensitiveRateLimiter();
+        limiterRegistry.set(name, limiter);
+    }
+    return limiter;
+}
+/**
+ * Bootstrap exchange limiter — kept as a named export so existing P0
+ * callers don't churn. New code should prefer `getSensitiveLimiter(name)`.
+ */
+export const bootstrapExchangeLimiter = getSensitiveLimiter("auth.bootstrap.exchange");
+const sweepTimer = setInterval(() => {
+    for (const limiter of limiterRegistry.values()) {
+        limiter.sweep();
+    }
+}, 5 * 60 * 1000);
+if (typeof sweepTimer === "object" && "unref" in sweepTimer) {
+    sweepTimer.unref();
+}
+/** Reset state. Test-only. */
+export function _resetSensitiveLimiters() {
+    for (const limiter of limiterRegistry.values()) {
+        limiter.reset();
+    }
+}

package/api/auth/sessions.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Session lifecycle on top of `AuthStore`.
+ *
+ * This module owns:
+ *   - browser session creation + sliding-TTL math
+ *   - machine session creation (absolute TTL)
+ *   - session lookup with sliding-window refresh
+ *   - revoke (single + all-but-current)
+ *   - CSRF derive / verify (HMAC-SHA256 over `session.csrfSecret`)
+ *   - cookie serialize / parse for the `eliza_session` cookie
+ *
+ * Hard rule: every helper fails closed. A malformed cookie returns null;
+ * a CSRF mismatch returns false; a session lookup error propagates. We do
+ * NOT pretend bad input is good input.
+ */
+import type http from "node:http";
+import { type RuntimeEnvRecord } from "@elizaos/shared";
+import type { AuthSessionRow, AuthStore } from "../../services/auth-store";
+/** Browser session sliding window: 12h. */
+export declare const BROWSER_SESSION_TTL_MS: number;
+/** Browser session absolute cap when `rememberDevice=true`: 30 days. */
+export declare const BROWSER_SESSION_REMEMBER_CAP_MS: number;
+/** Machine session absolute TTL: 90 days. */
+export declare const MACHINE_SESSION_TTL_MS: number;
+export declare const SESSION_COOKIE_NAME = "eliza_session";
+export declare const CSRF_COOKIE_NAME = "eliza_csrf";
+export declare const CSRF_HEADER_NAME = "x-eliza-csrf";
+export interface CreateBrowserSessionOptions {
+    identityId: string;
+    ip: string | null;
+    userAgent: string | null;
+    rememberDevice: boolean;
+    /** Override `Date.now()` for tests. */
+    now?: number;
+}
+export interface CreateMachineSessionOptions {
+    identityId: string;
+    scopes: string[];
+    /** Optional human label, persisted into `userAgent` for the security UI. */
+    label?: string | null;
+    ip?: string | null;
+    /** Override `Date.now()` for tests. */
+    now?: number;
+}
+export interface SessionWithCsrf {
+    session: AuthSessionRow;
+    csrfToken: string;
+}
+export interface SerializeSessionCookieOptions {
+    /** Loopback drop the `Secure` attribute. Detected via runtime-env helpers. */
+    env?: RuntimeEnvRecord;
+    /** Override absolute Max-Age (ms). Defaults to `expiresAt - now`. */
+    maxAgeMs?: number;
+}
+/**
+ * Mint a browser session. Uses sliding TTL (`BROWSER_SESSION_TTL_MS`) capped
+ * at 30 days when `rememberDevice` is set; otherwise the cap equals the
+ * sliding window.
+ *
+ * Returns the persisted session and a derived CSRF token suitable for the
+ * `eliza_csrf` cookie.
+ */
+export declare function createBrowserSession(store: AuthStore, options: CreateBrowserSessionOptions): Promise<SessionWithCsrf>;
+/**
+ * Mint a machine session. Absolute TTL (`MACHINE_SESSION_TTL_MS`); no sliding
+ * refresh on access. Scopes are persisted exactly as supplied — caller is
+ * responsible for shaping them.
+ */
+export declare function createMachineSession(store: AuthStore, options: CreateMachineSessionOptions): Promise<SessionWithCsrf>;
+/**
+ * Look up an active session by id and slide its expiry forward when it is a
+ * browser session. Machine sessions get `lastSeenAt` updated but no expiry
+ * extension (absolute TTL by spec).
+ *
+ * Returns `null` for missing / expired / revoked sessions. Errors propagate;
+ * we do NOT silently treat a DB error as "session valid".
+ */
+export declare function findActiveSession(store: AuthStore, sessionId: string, now?: number): Promise<AuthSessionRow | null>;
+export interface RevokeSessionOptions {
+    store: AuthStore;
+    reason: string;
+    actorIdentityId: string | null;
+    ip: string | null;
+    userAgent: string | null;
+    now?: number;
+}
+export declare function revokeSession(sessionId: string, options: RevokeSessionOptions): Promise<boolean>;
+export interface RevokeAllSessionsOptions {
+    store: AuthStore;
+    identityId: string;
+    exceptSessionId?: string;
+    reason: string;
+    ip: string | null;
+    userAgent: string | null;
+    now?: number;
+}
+export declare function revokeAllSessionsForIdentity(options: RevokeAllSessionsOptions): Promise<number>;
+/**
+ * Derive the CSRF token for a session. HMAC-SHA256 over the literal
+ * `csrf:<sessionId>` payload using the per-session `csrfSecret` as the key.
+ * The derivation is stable, so repeated calls return the same token until
+ * the session is rotated.
+ */
+export declare function deriveCsrfToken(session: {
+    id: string;
+    csrfSecret: string;
+}): string;
+/**
+ * Timing-safe compare of an incoming CSRF header against the expected
+ * derived token. Empty / missing headers fail closed.
+ */
+export declare function verifyCsrfToken(session: {
+    id: string;
+    csrfSecret: string;
+}, provided: string | null | undefined): boolean;
+/**
+ * Serialize the `eliza_session` cookie. The value is the opaque session id;
+ * attributes follow plan §4.1.
+ *
+ * Returns the full `Set-Cookie` header value (without the leading
+ * `Set-Cookie:` token). Caller is responsible for `res.setHeader`.
+ */
+export declare function serializeSessionCookie(session: {
+    id: string;
+    expiresAt: number;
+}, options?: SerializeSessionCookieOptions): string;
+/**
+ * Serialize the readable companion CSRF cookie. Same lifetime as the
+ * session cookie. NOT `HttpOnly` so the SPA can mirror it into the
+ * `x-eliza-csrf` header.
+ */
+export declare function serializeCsrfCookie(session: {
+    id: string;
+    csrfSecret: string;
+    expiresAt: number;
+}, options?: SerializeSessionCookieOptions): string;
+/** Build the cookie that destroys the session client-side (logout). */
+export declare function serializeSessionExpiryCookie(options?: SerializeSessionCookieOptions): string;
+/** Companion expiry cookie for `eliza_csrf`. */
+export declare function serializeCsrfExpiryCookie(options?: SerializeSessionCookieOptions): string;
+/**
+ * Parse a raw `Cookie:` header into a typed map. Returns `Map<string,string>`
+ * — keys are cookie names, values are URL-decoded raw values. Invalid or
+ * empty cookies are dropped silently (per RFC 6265 §5.2 step 1).
+ */
+export declare function parseCookieHeader(headerValue: string | null): Map<string, string>;
+/**
+ * Read the eliza session id from the request cookie header. Returns null
+ * when the cookie is absent or empty.
+ */
+export declare function parseSessionCookie(req: Pick<http.IncomingMessage, "headers">): string | null;
+//# sourceMappingURL=sessions.d.ts.map

package/api/auth/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAEV,cAAc,EACd,SAAS,EACV,MAAM,2BAA2B,CAAC;AAMnC,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAC1D,wEAAwE;AACxE,eAAO,MAAM,+BAA+B,QAA2B,CAAC;AACxE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB,QAA2B,CAAC;AAI/D,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AACnD,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAC7C,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAI/C,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,cAAc,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,8EAA8E;IAC9E,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAgBD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CAmB1B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CAmB1B;AAID;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,SAAS,EAChB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAyBhC;AAID,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAelB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAKT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC3C,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAIT;AAcD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1C,OAAO,GAAE,6BAAkC,GAC1C,MAAM,CAcR;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAC9D,OAAO,GAAE,6BAAkC,GAC1C,MAAM,CAcR;AAED,uEAAuE;AACvE,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,6BAAkC,GAC1C,MAAM,CAWR;AAED,gDAAgD;AAChD,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,6BAAkC,GAC1C,MAAM,CAKR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBrB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GACzC,MAAM,GAAG,IAAI,CAMf"}