@fortytwoservices/ai-universe-setup 1.0.0

package/assets/modules/containerAppsEnv.bicep

@@ -0,0 +1,43 @@
+// The shared Container Apps managed environment. The backend, the control
+// galaxy, and the innovation job all run inside this one environment so they
+// share a log destination and can address each other over the internal
+// environment domain when wired that way.
+
+@description('Short, kebab-case portal name.')
+param portalName string
+
+@description('Azure region.')
+param location string
+
+resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
+  name: '${portalName}-cae-logs'
+  location: location
+  properties: {
+    sku: { name: 'PerGB2018' }
+    retentionInDays: 30
+    workspaceCapping: { dailyQuotaGb: 2 }
+  }
+}
+
+resource environment 'Microsoft.App/managedEnvironments@2024-03-01' = {
+  name: '${portalName}-cae'
+  location: location
+  properties: {
+    appLogsConfiguration: {
+      destination: 'log-analytics'
+      logAnalyticsConfiguration: {
+        customerId: logAnalytics.properties.customerId
+        sharedKey: logAnalytics.listKeys().primarySharedKey
+      }
+    }
+    workloadProfiles: [
+      {
+        name: 'Consumption'
+        workloadProfileType: 'Consumption'
+      }
+    ]
+  }
+}
+
+output environmentId string = environment.id
+output defaultDomain string = environment.properties.defaultDomain

package/assets/modules/controlGalaxyApp.bicep

@@ -0,0 +1,129 @@
+// Control galaxy (admin portal) as a Container App. It serves the admin SPA
+// and runs the BFF proxy that forwards the operator's Entra token to the
+// backend control-plane API (shared-audience passthrough). It keeps its own
+// portal-local database for the galaxy-local domains (connectors, branding,
+// onboarding, users, settings); everything platform/AI-governance-related is
+// owned by the backend and reached over BACKEND_BASE_URL.
+//
+// External ingress: operators reach the admin UI directly. The admin SPA
+// acquires a token for the shared admin audience and the BFF forwards it to
+// the backend; both validate the same audience.
+
+@description('Short, kebab-case portal name.')
+param portalName string
+
+@description('Azure region.')
+param location string
+
+@description('Container Apps managed environment id (containerAppsEnv.bicep).')
+param environmentId string
+
+@description('User-assigned managed identity resource id (platformIdentity.bicep).')
+param identityId string
+
+@description('ACR login server (e.g. acmeacr.azurecr.io).')
+param acrLoginServer string
+
+@description('Fully qualified control-galaxy image reference, including tag.')
+param controlGalaxyImage string
+
+@description('Backend base URL the BFF forwards admin/config calls to (https://<backend fqdn>).')
+param backendBaseUrl string
+
+@description('Key Vault URI (https://<vault>.vault.azure.net/).')
+param keyVaultUri string
+
+@description('Key Vault secret name holding the control-galaxy database connection string.')
+param databaseSecretName string
+
+@description('Key Vault secret name holding the audit HMAC signing key.')
+param auditSecretName string
+
+@description('Key Vault secret name holding the Entra app-registration client secret (connector OBO).')
+param entraClientSecretName string
+
+@description('Application Insights connection string.')
+param insightsConnectionString string
+
+@description('Entra tenant id for token validation.')
+param entraTenantId string
+
+@description('Admin/config-plane Entra app registration client id (shared audience with the backend).')
+param entraAdminClientId string
+
+@description('Portal organization DID.')
+param portalOrgDid string
+
+@description('Portal organization display name.')
+param portalOrgName string
+
+@description('CPU cores.')
+param cpuCores string = '0.5'
+
+@description('Memory.')
+param memorySize string = '1Gi'
+
+// Domain-specific secrets[] and env[]. These literal arrays stay here (rather
+// than in containerApp.bicep) so the infra contract test can parse the env
+// contract from this module. The shared containerApps scaffolding lives in
+// containerApp.bicep.
+var controlGalaxySecrets = [
+  {
+    name: 'database-url'
+    keyVaultUrl: '${keyVaultUri}secrets/${databaseSecretName}'
+    identity: identityId
+  }
+  {
+    name: 'audit-signing-key'
+    keyVaultUrl: '${keyVaultUri}secrets/${auditSecretName}'
+    identity: identityId
+  }
+  {
+    name: 'entra-client-secret'
+    keyVaultUrl: '${keyVaultUri}secrets/${entraClientSecretName}'
+    identity: identityId
+  }
+]
+
+var controlGalaxyEnv = [
+  { name: 'NODE_ENV', value: 'production' }
+  { name: 'HOST', value: '0.0.0.0' }
+  { name: 'PORT', value: '5174' }
+  { name: 'BACKEND_BASE_URL', value: backendBaseUrl }
+  { name: 'DATABASE_URL', secretRef: 'database-url' }
+  { name: 'AUDIT_SIGNING_KEY', secretRef: 'audit-signing-key' }
+  { name: 'APPLICATIONINSIGHTS_CONNECTION_STRING', value: insightsConnectionString }
+  { name: 'KEY_VAULT_URI', value: keyVaultUri }
+  // Foundry OBO (server/agents/external/foundry-deps.ts) reads
+  // AZURE_KEY_VAULT_URL; other code reads KEY_VAULT_URI. Keep both.
+  { name: 'AZURE_KEY_VAULT_URL', value: keyVaultUri }
+  { name: 'ENTRA_TENANT_ID', value: entraTenantId }
+  { name: 'ENTRA_CLIENT_ID', value: entraAdminClientId }
+  // Connector OBO (server/index.ts) reads ENTRA_CLIENT_SECRET.
+  { name: 'ENTRA_CLIENT_SECRET', secretRef: 'entra-client-secret' }
+  { name: 'BACKEND_API_AUDIENCE', value: 'api://${entraAdminClientId}' }
+  { name: 'PORTAL_ORG_DID', value: portalOrgDid }
+  { name: 'PORTAL_ORG_NAME', value: portalOrgName }
+]
+
+module controlGalaxy 'containerApp.bicep' = {
+  name: 'controlGalaxyContainerApp'
+  params: {
+    portalName: portalName
+    appSuffix: 'control-galaxy'
+    location: location
+    environmentId: environmentId
+    identityId: identityId
+    acrLoginServer: acrLoginServer
+    image: controlGalaxyImage
+    port: 5174
+    maxReplicas: 2
+    cpuCores: cpuCores
+    memorySize: memorySize
+    secrets: controlGalaxySecrets
+    env: controlGalaxyEnv
+  }
+}
+
+output appName string = controlGalaxy.outputs.appName
+output fqdn string = controlGalaxy.outputs.fqdn

package/assets/modules/entraClientSecret.bicep

@@ -0,0 +1,31 @@
+// Entra app-registration client secret for connector OBO (on-behalf-of) flows.
+// apps/control-galaxy/server/index.ts reads process.env.ENTRA_CLIENT_SECRET to
+// exchange the operator token for a connector access token. Without it, every
+// enabled connector fails at its first OBO call. Written here (not in
+// keyVault.bicep) so the @secure() value stays inside a module that references
+// the vault by name param, keeping it out of the orchestration deployment graph
+// as an output. Mirrors auditSecret.bicep.
+
+@description('Name of the existing Key Vault to write the secret into.')
+param keyVaultName string
+
+@secure()
+@description('Entra app-registration client secret value.')
+param entraClientSecret string
+
+@description('Secret name.')
+param secretName string = 'entra-client-secret'
+
+resource vault 'Microsoft.KeyVault/vaults@2024-04-01-preview' existing = {
+  name: keyVaultName
+}
+
+resource secret 'Microsoft.KeyVault/vaults/secrets@2024-04-01-preview' = {
+  parent: vault
+  name: secretName
+  properties: {
+    value: entraClientSecret
+  }
+}
+
+output secretName string = secret.name

package/assets/modules/innovationJob.bicep

@@ -0,0 +1,91 @@
+// The Innovation Implementer as a Container Apps Job, on the SHARED
+// environment and SHARED platform identity (no longer its own env/logs/identity).
+//
+// When an admin approves an innovation proposal, the control galaxy triggers
+// this short-lived job. The agent reads the proposal, generates code following
+// the galaxy's CLAUDE.md + brain/wisdom/ conventions, opens a PR, then dies.
+// Jobs scale to zero with per-second billing; each run is a fresh container so
+// state cannot leak between proposals.
+//
+// Credentials (Anthropic key, GitHub PAT, callback HMAC) are read from Key
+// Vault at job start over the shared user-assigned identity. No long-lived
+// secret is baked into the image.
+
+@description('Short name prefix (matches main.bicep).')
+param portalName string
+
+@description('Azure region.')
+param location string
+
+@description('Shared Container Apps managed environment id.')
+param environmentId string
+
+@description('Shared user-assigned managed identity resource id (already granted Key Vault Secrets User + AcrPull).')
+param identityId string
+
+@description('Identity client id, surfaced to the container so it can authenticate to Azure as the managed identity.')
+param identityClientId string
+
+@description('Key Vault name the job reads its run secrets from.')
+param keyVaultName string
+
+@description('Container image for the implementer agent.')
+param implementerImage string = 'ghcr.io/fortytwoservices/ai-universe-innovation-implementer:v1'
+
+@description('CPU cores. Decimal allowed.')
+param cpuCores string = '1.0'
+
+@description('Memory.')
+param memorySize string = '2Gi'
+
+@description('Replica timeout in seconds. Hard upper bound on agent runtime.')
+param replicaTimeoutSeconds int = 1800
+
+resource keyVault 'Microsoft.KeyVault/vaults@2024-04-01-preview' existing = {
+  name: keyVaultName
+}
+
+resource implementerJob 'Microsoft.App/jobs@2024-03-01' = {
+  name: '${portalName}-innovation-implementer'
+  location: location
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: {
+      '${identityId}': {}
+    }
+  }
+  properties: {
+    environmentId: environmentId
+    workloadProfileName: 'Consumption'
+    configuration: {
+      triggerType: 'Manual'
+      replicaTimeout: replicaTimeoutSeconds
+      replicaRetryLimit: 1
+      manualTriggerConfig: {
+        replicaCompletionCount: 1
+        parallelism: 1
+      }
+      secrets: []
+    }
+    template: {
+      containers: [
+        {
+          name: 'implementer'
+          image: implementerImage
+          resources: {
+            cpu: json(cpuCores)
+            memory: memorySize
+          }
+          env: [
+            { name: 'KEY_VAULT_NAME', value: keyVault.name }
+            { name: 'KEY_VAULT_URI', value: keyVault.properties.vaultUri }
+            { name: 'PORTAL_NAME', value: portalName }
+            { name: 'AZURE_CLIENT_ID', value: identityClientId }
+          ]
+        }
+      ]
+    }
+  }
+}
+
+output jobName string = implementerJob.name

package/assets/modules/insights.bicep

@@ -0,0 +1,29 @@
+// Application Insights resource (Log Analytics workspace-backed, the modern variant).
+
+@description('Short name prefix for the portal.')
+param portalName string
+
+@description('Azure region.')
+param location string
+
+resource logWorkspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
+  name: '${portalName}-logs'
+  location: location
+  properties: {
+    sku: { name: 'PerGB2018' }
+    retentionInDays: 30
+  }
+}
+
+resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
+  name: '${portalName}-insights'
+  location: location
+  kind: 'web'
+  properties: {
+    Application_Type: 'web'
+    WorkspaceResourceId: logWorkspace.id
+    IngestionMode: 'LogAnalytics'
+  }
+}
+
+output connectionString string = appInsights.properties.ConnectionString

package/assets/modules/keyVault.bicep

@@ -0,0 +1,42 @@
+// Key Vault — owned and provisioned by this module. Domain-specific
+// secret writes (postgres connection strings, audit HMAC signing key,
+// app-reg secrets) live in the modules that own those domains and
+// reference this vault by name, so secret values never travel through
+// this orchestration layer as outputs. RBAC-only authorization model;
+// the shared platform managed identity gets `Key Vault Secrets User`
+// in platformIdentity.bicep.
+
+@description('Short name prefix for the portal.')
+param portalName string
+
+@description('Azure region.')
+param location string
+
+@description('Entra ID tenant for RBAC.')
+param tenantId string
+
+// Collision-resistant, deterministic vault name. A plain take('${portalName}-kv', 24)
+// drops the '-kv' suffix for long portalNames (~22 chars) and can collide across
+// resource groups. Appending a stable uniqueString(resourceGroup().id) segment
+// keeps the name unique and reconstructible. uniqueString is deterministic per RG,
+// so app.bicep rebuilds the SAME name as an existing reference. Keep both name
+// expressions (here and in app.bicep) in lock-step. Max length 24:
+// take(portalName, 9) + '-kv-' (4) + take(unique, 6) = up to 19 chars.
+var vaultName = '${take(portalName, 9)}-kv-${take(uniqueString(resourceGroup().id), 6)}'
+
+resource vault 'Microsoft.KeyVault/vaults@2024-04-01-preview' = {
+  name: vaultName
+  location: location
+  properties: {
+    tenantId: tenantId
+    sku: { family: 'A', name: 'standard' }
+    enableRbacAuthorization: true
+    enableSoftDelete: true
+    softDeleteRetentionInDays: 7
+    enablePurgeProtection: true
+    publicNetworkAccess: 'Enabled'
+  }
+}
+
+output vaultName string = vault.name
+output vaultUri string = vault.properties.vaultUri

package/assets/modules/platformIdentity.bicep

@@ -0,0 +1,69 @@
+// One user-assigned managed identity shared by the platform Container Apps
+// (backend, control galaxy) and the innovation job. Using a user-assigned
+// identity avoids the chicken-and-egg of system-assigned identities needing
+// AcrPull before the first image pull: the identity and its role assignments
+// exist before any app references it.
+//
+// Grants:
+//   - AcrPull on the customer registry (pull images with no registry secret)
+//   - Key Vault Secrets Officer on the vault. Read is needed to resolve
+//     DATABASE_URL, HMAC keys, and app-reg secrets as Container Apps secret
+//     references. WRITE is needed because the control galaxy persists provider
+//     secrets at runtime: apps/control-galaxy/server/config/router.ts calls
+//     client.setSecret(...). Secrets User is read-only and would 403 on that
+//     write, silently dropping provider secrets. Officer includes read access.
+
+@description('Short, kebab-case portal name.')
+param portalName string
+
+@description('Azure region.')
+param location string
+
+@description('Registry name (from registry.bicep) to grant AcrPull on.')
+param registryName string
+
+@description('Key Vault name (from keyVault.bicep) to grant Secrets User on.')
+param keyVaultName string
+
+resource identity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
+  name: '${portalName}-platform-id'
+  location: location
+}
+
+resource registry 'Microsoft.ContainerRegistry/registries@2023-11-01-preview' existing = {
+  name: registryName
+}
+
+resource keyVault 'Microsoft.KeyVault/vaults@2024-04-01-preview' existing = {
+  name: keyVaultName
+}
+
+// Built-in role definition ids.
+var acrPullRoleId = '7f951dda-4ed3-4680-a7ca-43fe172d538d'
+// Key Vault Secrets Officer (read + write). Write is required so the control
+// galaxy can persist provider secrets via setSecret(...) at runtime.
+var keyVaultSecretsOfficerRoleId = 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7'
+
+resource acrPull 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  scope: registry
+  name: guid(registry.id, identity.id, acrPullRoleId)
+  properties: {
+    principalId: identity.properties.principalId
+    principalType: 'ServicePrincipal'
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', acrPullRoleId)
+  }
+}
+
+resource kvSecretsOfficer 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  scope: keyVault
+  name: guid(keyVault.id, identity.id, keyVaultSecretsOfficerRoleId)
+  properties: {
+    principalId: identity.properties.principalId
+    principalType: 'ServicePrincipal'
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', keyVaultSecretsOfficerRoleId)
+  }
+}
+
+output identityId string = identity.id
+output clientId string = identity.properties.clientId
+output principalId string = identity.properties.principalId

package/assets/modules/postgres.bicep

@@ -0,0 +1,116 @@
+// PostgreSQL Flexible Server. One server hosts two databases on its own
+// schema: `backend` (the headless kernel: providers, models, policies, agents,
+// galaxy registry, audit, spend) and `control_galaxy` (the admin portal's
+// galaxy-local domains: connectors, branding, onboarding, users, settings).
+// v1 ships with public-access + Azure-services allowlist for simplicity.
+// Production should switch to private endpoint.
+//
+// SECURITY: the admin password never crosses a module boundary as an output.
+// The module writes each runtime connection string directly into the existing
+// Key Vault, keeping the secret value inside @secure() context for its entire
+// lifetime. Outputs expose only the FQDN and the secret names.
+//
+// AAD-only auth is the recommended next step (flexibleServers/administrators
+// with the platform managed identity) and removes the password entirely.
+
+@description('Short name prefix for the portal.')
+param portalName string
+
+@description('Azure region.')
+param location string
+
+@description('Administrator login name.')
+param administratorLogin string
+
+@secure()
+@description('Administrator password. Written straight to Key Vault, never surfaced as a module output.')
+param administratorPassword string
+
+@description('Compute SKU.')
+param sku string
+
+@description('Storage in GB.')
+param storageGb int
+
+@description('Postgres major version.')
+param version string = '16'
+
+@description('Name of the existing Key Vault to write the connection-string secrets into. Must be in the same resource group.')
+param keyVaultName string
+
+// Each entry becomes a database on the server and a connection-string secret
+// in the vault. Backend and control galaxy keep separate schemas.
+var databases = [
+  { name: 'backend', secret: 'postgres-connection-string-backend' }
+  { name: 'control_galaxy', secret: 'postgres-connection-string-control' }
+]
+
+var serverName = '${portalName}-pg'
+
+resource server 'Microsoft.DBforPostgreSQL/flexibleServers@2024-03-01-preview' = {
+  name: serverName
+  location: location
+  sku: {
+    name: sku
+    tier: startsWith(sku, 'Standard_B') ? 'Burstable' : 'GeneralPurpose'
+  }
+  properties: {
+    version: version
+    administratorLogin: administratorLogin
+    administratorLoginPassword: administratorPassword
+    storage: {
+      storageSizeGB: storageGb
+      autoGrow: 'Enabled'
+    }
+    backup: {
+      backupRetentionDays: 7
+      geoRedundantBackup: 'Disabled'
+    }
+    highAvailability: { mode: 'Disabled' }
+    network: {
+      publicNetworkAccess: 'Enabled'
+    }
+  }
+}
+
+resource allowAzureServices 'Microsoft.DBforPostgreSQL/flexibleServers/firewallRules@2024-03-01-preview' = {
+  parent: server
+  name: 'AllowAllAzureIps'
+  properties: {
+    startIpAddress: '0.0.0.0'
+    endIpAddress: '0.0.0.0'
+  }
+}
+
+resource pgDatabases 'Microsoft.DBforPostgreSQL/flexibleServers/databases@2024-03-01-preview' = [
+  for db in databases: {
+    parent: server
+    name: db.name
+    properties: {
+      charset: 'UTF8'
+      collation: 'en_US.utf8'
+    }
+  }
+]
+
+// Existing-vault reference + secret write. The vault is provisioned by
+// modules/keyVault.bicep before this module runs (main.bicep wires the order).
+// The secret values are interpolated INSIDE this module's @secure() scope,
+// never crossing into an output.
+resource vault 'Microsoft.KeyVault/vaults@2024-04-01-preview' existing = {
+  name: keyVaultName
+}
+
+resource connectionStringSecrets 'Microsoft.KeyVault/vaults/secrets@2024-04-01-preview' = [
+  for db in databases: {
+    parent: vault
+    name: db.secret
+    properties: {
+      value: 'postgresql://${administratorLogin}:${administratorPassword}@${server.properties.fullyQualifiedDomainName}:5432/${db.name}?sslmode=require'
+    }
+  }
+]
+
+output fqdn string = server.properties.fullyQualifiedDomainName
+output backendConnectionSecretName string = databases[0].secret
+output controlConnectionSecretName string = databases[1].secret

package/assets/modules/registry.bicep

@@ -0,0 +1,38 @@
+// Azure Container Registry — the per-customer registry the platform images
+// are pulled from at runtime. Fortytwo CI builds and pushes the backend (and
+// control-galaxy) images to a central Fortytwo ACR; at deploy time those
+// images are imported into this customer-owned registry (`az acr import`) so
+// the Container Apps pull them over a managed identity with no stored secret.
+//
+// Admin user is disabled on purpose: pulls are identity-based (AcrPull granted
+// in platformIdentity.bicep), never username/password.
+
+@description('Short, kebab-case portal name. Used as a prefix; ACR names are alphanumeric only so the prefix is sanitized.')
+@minLength(2)
+param portalName string
+
+@description('Azure region.')
+param location string
+
+@description('Registry SKU. Standard is the floor for production (webhooks, larger storage); Premium adds geo-replication + private link.')
+@allowed([
+  'Standard'
+  'Premium'
+])
+param sku string = 'Standard'
+
+// ACR names: 5-50 chars, alphanumeric only, globally unique. Strip dashes.
+var registryName = take('${replace(portalName, '-', '')}acr', 50)
+
+resource registry 'Microsoft.ContainerRegistry/registries@2023-11-01-preview' = {
+  name: registryName
+  location: location
+  sku: { name: sku }
+  properties: {
+    adminUserEnabled: false
+    publicNetworkAccess: 'Enabled'
+  }
+}
+
+output registryName string = registry.name
+output loginServer string = registry.properties.loginServer

package/assets/modules/storage.bicep

@@ -0,0 +1,30 @@
+// Storage account for future blob uploads (attachments, exports, audit-log archives).
+
+@description('Short name prefix for the portal.')
+param portalName string
+
+@description('Azure region.')
+param location string
+
+// Collision-resistant, deterministic storage account name. The old
+// take(...'${portalName}storage'..., 24) truncated the 'storage' suffix for long
+// portalNames and could collide (account names are globally unique). Storage
+// account names are 3-24 chars, lowercase alphanumeric only; uniqueString already
+// returns lowercase alphanumeric. take(clean, 11) + 'st' (2) + take(unique, 11) = up to 24.
+var portalNameClean = toLower(replace(portalName, '-', ''))
+var accountName = '${take(portalNameClean, 11)}st${take(uniqueString(resourceGroup().id), 11)}'
+
+resource storage 'Microsoft.Storage/storageAccounts@2024-01-01' = {
+  name: accountName
+  location: location
+  sku: { name: 'Standard_LRS' }
+  kind: 'StorageV2'
+  properties: {
+    minimumTlsVersion: 'TLS1_2'
+    supportsHttpsTrafficOnly: true
+    allowBlobPublicAccess: false
+    defaultToOAuthAuthentication: true
+  }
+}
+
+output accountName string = storage.name

package/bin/setup.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { runSetup } from '../dist/index.js';
+
+runSetup(process.argv).catch((err) => {
+  process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+  process.exit(1);
+});

package/dist/azure/bicep.d.ts

@@ -0,0 +1,9 @@
+import type { EntraConfig } from './entra.js';
+import type { AzureConfig } from './prompts.js';
+export type BicepOutputs = {
+    backendUrl: string;
+    controlGalaxyUrl: string;
+};
+export declare function parseBicepOutputs(raw: string): BicepOutputs;
+export declare function deployBicep(config: AzureConfig, entra: EntraConfig, githubInstallationId: string): Promise<BicepOutputs>;
+//# sourceMappingURL=bicep.d.ts.map

package/dist/azure/bicep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bicep.d.ts","sourceRoot":"","sources":["../../src/azure/bicep.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKhD,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAWF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAc3D;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,WAAW,EAClB,oBAAoB,EAAE,MAAM,GAC3B,OAAO,CAAC,YAAY,CAAC,CAqCvB"}