@fuzdev/fuz_app 0.118.0 → 0.120.0

package/dist/actions/register_action_ws.d.ts

@@ -24,6 +24,64 @@
  * runs inside `perform_action` on every message via the same gates HTTP
  * RPC uses.
  *
+ * ## Admission: the revocation race
+ *
+ * The auth middleware resolves the credential before the handshake, and the
+ * socket exists only once `onOpen` fires. Every revocation (session revoke,
+ * logout, password change, token revoke, account delete) closes the sockets
+ * *registered* under what it revoked, so one landing in that gap would close
+ * nothing, and the socket would then be admitted on the dead credential and
+ * keep it: per-message dispatch re-authorizes the *actor*, never the session
+ * or token — and its admission could evict a live socket of the same account
+ * past the cap.
+ *
+ * `onOpen` closes the gap in three steps: register the connection **pending**
+ * (`BackendWebsocketTransport.register_pending` — closeable by every
+ * revocation, inert otherwise), re-read the credential
+ * (`revalidate_resolved_auth`), then `BackendWebsocketTransport.admit`. A
+ * revocation whose close ran after the registration found the pending entry,
+ * so `admit` refuses; one that committed before the re-read is seen by it. The
+ * cap is enforced only by `admit`, so a refused upgrade evicts nothing, and
+ * pending registrations never count toward it.
+ *
+ * That argument needs every revocation to close only after its commit —
+ * otherwise a close could miss the registration while the re-read still sees
+ * the credential alive. Every one does: the revocation handlers queue their
+ * close behind the commit (`queue_connection_close`), and the audit emitter
+ * announces a success row to the listeners behind it too. So no interleaving
+ * admits a revoked credential; `docs/security.md` §Connection Admission says
+ * what that rests on.
+ *
+ * A refused upgrade is closed with `WS_CLOSE_SESSION_REVOKED` (4001, the
+ * reason a revoked socket gets), or `WS_CLOSE_INTERNAL_ERROR` (1011) when the
+ * re-read itself failed — fail closed, never admitted unchecked. The handshake
+ * has already answered `101`, so a refusal can only be a close frame.
+ *
+ * Frames that arrive before admission are queued, not dispatched: nothing runs
+ * on a credential that has not been re-read. They dispatch in arrival order
+ * once the socket is admitted and `on_socket_open` has completed, and are
+ * dropped unread on a refusal. The queue holds at most
+ * `MAX_PRE_ADMISSION_FRAMES` frames and
+ * `PRE_ADMISSION_QUEUE_BYTES_FACTOR` × `max_message_bytes` bytes; past either
+ * the socket is closed.
+ *
+ * The upgrade's role gate is *not* re-read: a role revocation closes no
+ * WebSocket in the first place (per-message dispatch re-reads role grants).
+ *
+ * ## A server-closed socket dispatches nothing
+ *
+ * A runtime adapter can keep delivering inbound frames after the server calls
+ * `ws.close(…)`, until the close handshake completes (`@hono/node-ws` does —
+ * up to the `ws` close timeout when the client withholds its close frame).
+ * So every server-side close — revocation, cap eviction, heartbeat timeout,
+ * an oversized message, a refused admission — removes the connection from the
+ * transport and aborts the socket's signal *at close time*, and `onMessage`
+ * drops any frame on a socket that has ended. A connection the transport no
+ * longer holds though nothing closed its socket (a bare `remove_connection`)
+ * is ended on its next frame (`BackendWebsocketTransport.is_registered`), with
+ * `WS_CLOSE_INTERNAL_ERROR` — it must not linger as a socket that reads
+ * everything and answers nothing.
+ *
  * @module
  */
 import type { Hono } from 'hono';
@@ -33,22 +91,65 @@ import type { Uuid } from '@fuzdev/fuz_util/id.ts';
 import type { RateLimiter } from '../rate_limiter.js';
 import type { Db } from '../db/db.js';
 import { type Action } from './action_types.js';
+import type { RealtimeCloser } from './connection_closer.js';
 import { BackendWebsocketTransport, type ConnectionIdentity } from './transports_ws_backend.js';
 export type { Action };
 /** Default inactivity window before the server closes a silent socket. */
 export declare const DEFAULT_SERVER_HEARTBEAT_TIMEOUT = 60000;
+/**
+ * Max inbound frames one socket may have queued while it is still opening —
+ * between the handshake and the end of the credential re-check plus
+ * `on_socket_open`. One more closes the socket with
+ * `WS_CLOSE_POLICY_VIOLATION`.
+ *
+ * Frames sent before the socket is open wait rather than dispatch (nothing
+ * runs on a credential that has not been re-read), and a runtime adapter hands
+ * them over with no backpressure, so the wait needs a bound. This is the count
+ * half; `PRE_ADMISSION_QUEUE_BYTES_FACTOR` is the byte half.
+ *
+ * Sized so a client flushing its durable queue on reopen never meets it at the
+ * default `DEFAULT_QUEUE_MAX_SIZE` (`actions/socket.svelte.ts`). A consumer
+ * that raises the client's queue above this cap makes a full flush overflow
+ * it: the socket closes with `WS_CLOSE_POLICY_VIOLATION`, the flushed requests
+ * fail, and the client reconnects.
+ */
+export declare const MAX_PRE_ADMISSION_FRAMES = 256;
+/**
+ * The byte budget of one socket's pre-admission queue, as a multiple of the
+ * endpoint's `max_message_bytes`: the frames queued while the socket is still
+ * opening may total at most this many maximum-size messages. The frame that
+ * would pass it closes the socket with `WS_CLOSE_POLICY_VIOLATION`.
+ *
+ * The count cap alone (`MAX_PRE_ADMISSION_FRAMES`) would let each pending
+ * socket hold that many full-size messages, and pending sockets are not
+ * capped per account — a registration that is never admitted must not be able
+ * to pin that much memory. Small requests, which is what a client flushes on
+ * reopen, meet the count cap long before this one.
+ *
+ * A client whose queued requests total more than this budget and flushes
+ * them all on reopen overflows it: the socket closes, the flushed requests
+ * fail, and the client reconnects.
+ */
+export declare const PRE_ADMISSION_QUEUE_BYTES_FACTOR = 4;
+/**
+ * The close reason sent with `WS_CLOSE_POLICY_VIOLATION` when a socket
+ * overflows its pre-admission queue, by count or by bytes.
+ */
+export declare const WS_CLOSE_PRE_ADMISSION_OVERFLOW_REASON = "too much sent before the socket opened";
 /**
  * Context passed to the `on_socket_open` hook.
  *
- * Fires after the transport has registered the new connection (so
- * `connection_id` is valid) but before any client message can dispatch.
- * Consumers use this to bootstrap per-socket domain state — e.g.
- * spawning a per-account unit and pushing an initial state snapshot.
+ * Fires once the connection is **admitted** — registered in the transport and
+ * its credential re-checked (so `connection_id` is valid, and broadcasts reach
+ * it) — and before any client message dispatches. A socket refused at
+ * admission never reaches it. Consumers use this to bootstrap per-socket
+ * domain state — e.g. spawning a per-account unit and pushing an initial state
+ * snapshot.
  */
 export interface SocketOpenContext {
     /** The raw WebSocket context — exposed for edge cases; prefer `notify` for sends. */
     ws: WSContext;
-    /** Connection id assigned by `BackendWebsocketTransport.add_connection`. */
+    /** Connection id assigned by `BackendWebsocketTransport.register_pending`. */
     connection_id: Uuid;
     /** Auth identity registered for this connection. */
     identity: ConnectionIdentity;
@@ -57,23 +158,36 @@ export interface SocketOpenContext {
      * on per-message handler contexts — same socket-scoped semantics.
      */
     notify: (method: string, params: unknown) => void;
-    /** Fires when this socket closes — threaded through to every handler's `ctx.signal`. */
+    /**
+     * Fires when this socket ends — the client closed it, or the server did
+     * (revocation, cap eviction, heartbeat timeout), at the moment the server
+     * closes rather than when the close handshake lands. Threaded through to
+     * every handler's `ctx.signal`.
+     */
     signal: AbortSignal;
 }
 /**
  * Context passed to the `on_socket_close` hook.
  *
- * Fires before `transport.remove_connection` runs, so consumer cleanup can
- * still read identity before it's torn down. Fires for both client-initiated
- * closes (Hono onClose) and server-initiated closes via audit revocation
- * (the audit guard calls `ws.close()`, which triggers Hono's onClose).
+ * Fires after the transport has removed the connection — `connection_id` and
+ * `identity` are the values captured at open, so consumer cleanup reads them
+ * from here, not from the transport. Fires for both client-initiated closes
+ * (Hono onClose) and server-initiated closes — a revocation, the per-account
+ * connection cap's eviction, and a heartbeat timeout all call `ws.close()`,
+ * which triggers Hono's onClose. Fires only for a socket that was admitted: one
+ * refused at admission never ran `on_socket_open`, so it has no close hook
+ * either.
  */
 export interface SocketCloseContext {
-    /** The raw WebSocket context at close time. */
+    /**
+     * The WebSocket context the close event carried. Not necessarily the object
+     * `on_socket_open` received — an adapter may build one per event — so key
+     * per-socket state on `connection_id`.
+     */
     ws: WSContext;
     /** Connection id captured at open time. */
     connection_id: Uuid;
-    /** Auth identity captured at open time — still valid even if the transport already cleaned up. */
+    /** Auth identity captured at open time — the transport no longer holds it. */
     identity: ConnectionIdentity;
 }
 export interface ServerHeartbeatOptions {
@@ -119,6 +233,27 @@ export interface RegisterActionWsOptions {
      * handle for `create_ws_auth_guard` and `send_to`/`broadcast`.
      */
     transport?: BackendWebsocketTransport;
+    /**
+     * The backend's closer — `deps.connection_closer`. This endpoint's
+     * transport is added to it, so every revocation handler's close reaches
+     * the sockets opened here. Required so it can't be forgotten: left out of
+     * the closer, a transport's sockets close only through the audit listener,
+     * which a failed audit write or a session / token cap eviction never
+     * reaches. Pass `null` only when no revocation has to reach this transport
+     * (a harness driving the dispatcher directly), or when the transport was
+     * added by hand.
+     */
+    connection_closer: RealtimeCloser | null;
+    /**
+     * Per-account connection cap for the transport this call creates — see
+     * `BackendWebsocketTransportOptions.max_connections_per_account`
+     * (evict-oldest, closing with `WS_CLOSE_CONNECTION_LIMIT`; `null`
+     * disables). Rejected alongside `transport`: a supplied transport carries
+     * its own cap, set where it was constructed.
+     *
+     * @default DEFAULT_MAX_CONNECTIONS_PER_ACCOUNT
+     */
+    max_connections_per_account?: number | null;
     /**
      * Server-side heartbeat policy. Default-on (receive-silence detection,
      * 60s timeout). `false` disables the timer entirely — only do this if
@@ -144,17 +279,24 @@ export interface RegisterActionWsOptions {
     /** Optional logger; defaults to `[ws]` namespace. */
     log?: LoggerType;
     /**
-     * Called once per socket, after the transport registers the connection.
-     * Awaited before any message is dispatched. Throwing logs an error and
-     * closes the socket with an `internal_error` frame — a failing bootstrap
-     * should not leave a partially-initialized socket alive.
+     * Called once per socket, after the connection is admitted (module doc,
+     * "Admission"). Awaited before any inbound frame is dispatched — every
+     * frame the client sends meanwhile waits in arrival order, replies to
+     * server-initiated requests included: a hook that awaits
+     * `transport.request_connection` on its own connection gets no reply until
+     * it returns, so start such a request without awaiting it. Throwing logs an
+     * error and closes the socket with an `internal_error` frame and
+     * `WS_CLOSE_INTERNAL_ERROR` — a failing bootstrap should not leave a
+     * partially-initialized socket alive.
      */
     on_socket_open?: (ctx: SocketOpenContext) => void | Promise<void>;
     /**
-     * Called once per socket on close, *before* the transport removes the
-     * connection. Receives `connection_id` and `identity` captured at open
-     * time, so it is safe to read even when the audit guard has already torn
-     * down the transport's internal state. Errors are logged and swallowed.
+     * Called once per admitted socket on close, *after* the transport has
+     * removed the connection — a slow hook never holds a dead entry that
+     * broadcasts still target and the per-account cap still counts. Receives
+     * `connection_id` and `identity` captured at open time, the same whether the
+     * close came from the client, a revocation, or a connection-cap eviction.
+     * Errors are logged and swallowed.
      */
     on_socket_close?: (ctx: SocketCloseContext) => void | Promise<void>;
     /**
@@ -193,14 +335,24 @@ export interface RegisterActionWsResult {
  *   wrap iff `spec.side_effects: true`) → DEV output validation.
  * - Authorization phase runs **per message** — role_grant changes during a
  *   connection lifetime are picked up on the next message without any
- *   in-place refresh. Authentication invalidation closes the socket via
- *   `create_ws_auth_guard`.
+ *   in-place refresh. Authentication invalidation closes the socket: the
+ *   revocation handlers through `connection_closer`, and `create_ws_auth_guard`
+ *   on the audit row.
+ * - Admission re-reads the credential once, after the handshake: a socket
+ *   whose session or token was revoked while it was upgrading closes with
+ *   `WS_CLOSE_SESSION_REVOKED`, and one whose re-check failed with
+ *   `WS_CLOSE_INTERNAL_ERROR`. Frames sent before admission wait for it.
+ * - A socket the server has closed dispatches nothing more, whether or not
+ *   its client answers the close.
  *
  * @returns the transport (supplied or freshly created) — retain it to wire
  *   `create_ws_auth_guard` or broadcast on audit events.
  * @mutates options.app - registers a `GET path` route via `upgradeWebSocket`
- * @mutates options.transport - on every message, adds/removes connections
- *   in the transport's internal maps via `add_connection` / `remove_connection`
+ * @mutates options.transport - per socket, registers, admits, and removes a
+ *   connection via `register_pending` / `admit` / `remove_connection`
+ * @mutates options.connection_closer - adds the endpoint's transport
+ * @throws Error when `max_connections_per_account` is passed alongside
+ *   `transport`, or is neither `null` nor a positive integer
  */
 export declare const register_action_ws: (options: RegisterActionWsOptions) => RegisterActionWsResult;
 //# sourceMappingURL=register_action_ws.d.ts.map

package/dist/actions/register_action_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAWnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAyBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAShD,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,YAAY,EAAE,MAAM,EAAE,CAAC;AAEvB,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAsCvD;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,EAAE,EAAE,SAAS,CAAC;IACd,4EAA4E;IAC5E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,wFAAwF;IACxF,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAClC,+CAA+C;IAC/C,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,kGAAkG;IAClG,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACjD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAybrE,CAAC"}
+{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAWnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAa7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,YAAY,EAAE,MAAM,EAAE,CAAC;AAEvB,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAsC/F;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;OASG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACjD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAksBrE,CAAC"}