@kanzo-tech/auth 0.29.0 → 0.30.0

package/dist/next.d.ts

@@ -1,55 +1,30 @@
 /**
- * `@kanzo-tech/auth/next` — the Backend For Frontend, in the files an App Router product already
- * has.
+ * `@kanzo-tech/auth/next` — the Backend For Frontend for an App Router product, as one object.
  *
  * ```ts
- * // app/api/auth/[...auth]/route.ts
- * export const { GET, POST } = authRoutes({ issuer, clientId, clientSecret, secret });
+ * // lib/auth.ts
+ * export const auth = kanzoAuth(async () => ({ issuer, clientId, clientSecret, secret, store }));
  *
- * // auth.ts
- * export const getSession = authSession({ issuer, clientId, clientSecret, secret });
- * export const getToken = authToken({ issuer, clientId, clientSecret, secret });
+ * // proxy.ts
+ * export const proxy = (request: NextRequest) => auth.proxy(request);
+ * export const config = { matcher: ["/((?!_next/static|_next/image|favicon.ico|.*\\..*).*)"] };
  *
- * // middleware.ts
- * export const middleware = authMiddleware({ public: ["/health"] });
+ * // app/api/auth/[...auth]/route.ts
+ * export const { GET, POST } = auth.routes;
  * ```
  *
- * **Not one config**: `authRoutes`, `authSession`, `authToken` and `authProxy` share the relying
- * party's, while `authMiddleware` takes neither a secret nor an issuer, because an edge middleware
- * only asks whether the cookie is *there*. Decrypting it at the edge would be the wrong place for
- * the work and a secret in the wrong runtime. `can` and `organizationOf` on the root barrel are
- * how a server component asks about a role, exactly as `Gate` asks in the browser. There is no
- * `requireRole` here: it would have added no new evaluation of a role, only a *throw*, and which
- * throw — `notFound()`, a redirect, a rendered explanation — is a product's answer and not a
- * library's. `next.test.ts` holds the absence.
- *
- * ## Who may be asked what, and why the signatures differ
- *
- * `authSession` reads `next/headers` and answers an identity; `authToken` is handed a `Cookie`
- * header and answers a credential *plus the cookies to set*. The asymmetry is not an oversight —
- * **a React Server Component cannot write cookies in Next**, and a renewal whose `Set-Cookie` is
- * dropped ends the session rather than merely failing, because the refresh token it spent is gone.
- * So the read-only one is the one an RSC can reach for, and the renewing one asks for something
- * only a route handler, a middleware or a server action has. `authProxy` is that pairing already
- * assembled: a route file that forwards to a resource server with the bearer token attached.
+ * **One name.** The proxy, the routes, the resource-server forwarder and the server component's
+ * session are four pieces of one relying party, and `kanzoAuth` is that relying party: one issuer,
+ * one discovery cache, one store, one renewal per session. `can` on the root barrel is how a
+ * server component asks about a role, exactly as `Gate` asks in the browser. There is no
+ * `requireRole`: it would have added no new evaluation of a role, only a *throw*, and which throw —
+ * `forbidden()`, a redirect, a rendered explanation — is a product's answer and not a library's.
+ * `next.test.ts` holds the absence.
  *
  * ## This door must never reach React's client half
  *
  * The modules behind it import `./server` and `./claims` directly and never `./index`, for the
  * reason `server.ts`'s own header gives. `next.test.ts` walks the relative imports from here.
- *
- * ## Why one barrel does not put `openid-client` on the edge
- *
- * `authMiddleware` runs in the edge runtime and must arrive with nothing behind it. It does:
- * `next-middleware.ts` imports only `next/server`, the package is `sideEffects: false`, and the
- * build writes one file per module (`preserveModules`), so a `middleware.ts` importing this barrel
- * is left holding that one module. They are kept in one file each for exactly this reason rather
- * than tidied together.
  */
-export { authMiddleware, type AuthMiddlewareConfig } from './next-middleware';
-export { authProxy, type AuthProxyConfig, type AuthProxyHandlers } from './next-proxy';
-export { authRoutes, type AuthRouteHandlers, type AuthRoutesConfig } from './next-routes';
-export { authSession, type AuthSessionConfig } from './next-session';
-export { authToken } from './next-token';
-export type { Token } from './server';
+export { kanzoAuth, type KanzoAuth, type KanzoAuthConfig } from './next-auth';
 //# sourceMappingURL=next.d.ts.map

package/dist/next.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../src/next.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../src/next.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/next.js

@@ -1,13 +1,5 @@
-import { authMiddleware as t } from "./next-middleware.js";
-import { authProxy as a } from "./next-proxy.js";
-import { authRoutes as x } from "./next-routes.js";
-import { authSession as h } from "./next-session.js";
-import { authToken as p } from "./next-token.js";
+import { kanzoAuth as t } from "./next-auth.js";
 export {
-  t as authMiddleware,
-  a as authProxy,
-  x as authRoutes,
-  h as authSession,
-  p as authToken
+  t as kanzoAuth
 };
 //# sourceMappingURL=next.js.map

package/dist/next.js.map

@@ -1 +1 @@
-{"version":3,"file":"next.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;"}
+{"version":3,"file":"next.js","sources":[],"sourcesContent":[],"names":[],"mappings":";"}

package/dist/server.d.ts

@@ -6,36 +6,49 @@ export interface Redirect {
     readonly url: string;
     readonly cookies: readonly string[];
 }
-/** What `refresh` answers. */
+/**
+ * A live session after `refresh`: renewed, or still good. `cookies` is empty unless the ticket
+ * itself changed, which only a stateless store's re-seal does.
+ */
 export interface Renewed {
+    readonly ended: false;
     readonly session: Session;
     readonly cookies: readonly string[];
 }
-/** What `complete` answers: a renewal, plus where the person was going before they were asked who they are. */
-export interface SignedIn extends Renewed {
-    readonly returnTo: string;
-}
 /**
- * What `token` answers: the credential a resource server takes, and what to set on the way out.
+ * No live session: none was presented, the store no longer knows it, or the IdP refused to renew
+ * it. The ticket has been dropped, and `cookies` clears the one the browser holds — empty when it
+ * held none.
  *
- * **`cookies` is not optional to attach.** It is empty when nothing was renewed and carries a
- * rotated session when something was, and under the rotation RFC 10017 requires, dropping it
- * throws away the only refresh token still valid — the session does not go stale, it ends. A
- * caller with nowhere to put a `Set-Cookie` is a caller that must not be asking for this.
+ * A result rather than an exception, because the cookies are the point: an ended session that
+ * forgets to clear its cookie is the zombie this replaced, a page drawn for a session the IdP had
+ * already closed.
  */
-export interface Token {
-    readonly accessToken: string;
+export interface Ended {
+    readonly ended: true;
+    /** `token/refused` when the IdP refused to renew it; `session/absent` when there was none to renew. */
+    readonly code: "session/absent" | "token/refused";
+    readonly cookies: readonly string[];
+}
+/** What `complete` answers: the new session, its cookies, and where the person was going. */
+export interface SignedIn {
     readonly session: Session;
     readonly cookies: readonly string[];
+    readonly returnTo: string;
+}
+/** What `token` answers for a live session: the credential a resource server takes, and what to set. */
+export interface Token extends Renewed {
+    readonly accessToken: string;
 }
 export interface RelyingPartyConfig extends IssuerConfig {
-    /** Registered at Keycloak, and where `complete` expects to be called. */
-    readonly redirectUri: string;
     /** Seals the cookies. Any length; generate it. See `sealedCookie`. */
     readonly secret: string | Uint8Array;
-    /** Default `openid profile email`. A multi-tenant product adds `organization:*`. */
+    /**
+     * Default `openid profile email organization:*`. Whatever is given, its organization scope is
+     * `organization:*` — or the one alias a sign-in names.
+     */
     readonly scope?: string;
-    /** Default {@link statelessStore}. Supply one to invalidate a session before it expires. */
+    /** Default {@link statelessStore}. Supply a `ticketStore` to end a session before it expires. */
     readonly store?: SessionStore;
     /** Session cookie lifetime in seconds. Default eight hours. */
     readonly maxAge?: number;
@@ -43,45 +56,54 @@ export interface RelyingPartyConfig extends IssuerConfig {
     readonly postLogoutRedirectUri?: string;
 }
 export interface RelyingParty {
-    /** Leg one: the authorization URL, and the cookie that remembers this attempt. */
-    begin(options?: SignInOptions): Promise<Redirect>;
-    /** Leg two: the callback URL Keycloak returned to, and the `Cookie` header it arrived with. */
+    /**
+     * Leg one: the authorization URL, and the cookie that remembers this attempt.
+     *
+     * `redirectUri` is per call, because it is derived from the request that asked, and one relying
+     * party serves every origin a deployment answers on.
+     */
+    begin(options: SignInOptions & {
+        readonly redirectUri: string;
+    }): Promise<Redirect>;
+    /**
+     * Leg two: the callback URL Keycloak returned to, the `Cookie` header it arrived with, and the
+     * `redirectUri` `begin` was given — which the token request must repeat exactly.
+     */
     complete(request: {
         readonly url: string | URL;
         readonly cookie: string | null;
+        readonly redirectUri: string;
     }): Promise<SignedIn>;
-    /** The session a request carries, or `null`. The read a route handler does on every request. */
+    /** The session a request carries, or `null`. One store read; nothing is renewed. */
     read(cookie: string | null | undefined): Promise<Session | null>;
     /**
-     * The access token a request carries, renewed when it is about to expire — or `null` when there
-     * is no session at all.
+     * The access token a request carries, renewed in place when it is within `renewWithin` seconds
+     * of expiry (default 60) — or {@link Ended} when there is no live session.
      *
      * This is the *token-mediating backend*: the browser holds a cookie, the resource server is
-     * given a bearer token, and the two never meet. {@link read} is its sibling for identity, and
-     * the difference in the signature is the whole of the difference in what they may be called
-     * from — this one can answer with a `Set-Cookie` and therefore must be called somewhere that can
-     * send one.
-     *
-     * Renewal is single-flight per ticket, so a page that fires eight requests at an expiring token
-     * spends it once.
+     * given a bearer token, and the two never meet. Renewal is single-flight per ticket, so a page
+     * that fires eight requests at an expiring token spends it once.
      */
     token(cookie: string | null | undefined, options?: {
         readonly renewWithin?: number;
-    }): Promise<Token | null>;
-    /**
-     * Spend the refresh token, take the new one, and reissue the cookie.
-     *
-     * Single-flight per ticket across the whole process: a second concurrent call joins the first
-     * rather than replaying a token it already spent. See `renewals`.
-     */
-    refresh(cookie: string | null | undefined): Promise<Renewed>;
+    }): Promise<Token | Ended>;
+    /** Spend the refresh token now, whatever the access token's expiry. See {@link token}. */
+    refresh(cookie: string | null | undefined): Promise<Renewed | Ended>;
     /** RP-initiated logout: forget the record here, clear the cookie, and end it at the IdP too. */
     end(cookie: string | null | undefined, options?: {
         readonly returnTo?: string;
     }): Promise<Redirect>;
+    /**
+     * Back-channel logout, OpenID Connect Back-Channel Logout 1.0 §2.6: verify the logout token
+     * Keycloak posted, and drop every session it names.
+     *
+     * Rejects with `token/refused` for a token that does not verify, and `session/irrevocable` for a
+     * store that cannot end a session from here.
+     */
+    logout(logoutToken: string): Promise<void>;
 }
 export declare function relyingParty(config: RelyingPartyConfig): RelyingParty;
 export { issuer, rewriteOrigin, type Issuer, type IssuerConfig } from './issuer';
 export { sealedCookie, cookieValue, type SealedCookie, type SealedCookieConfig } from './cookie-session';
-export { statelessStore, ticketStore, type SessionRecord, type SessionStore, type TicketAdapter, type TicketStoreConfig, } from './store';
+export { statelessStore, ticketStore, type SessionRecord, type SessionStore, type SessionSubject, type TicketAdapter, type TicketStoreConfig, } from './store';
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAcA,OAAO,EAAU,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAErD,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAChF,OAAO,EAAiC,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAiL1F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,8BAA8B;AAC9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,+GAA+G;AAC/G,MAAM,WAAW,QAAS,SAAQ,OAAO;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAeD,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,kFAAkF;IAClF,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrG,gGAAgG;IAChG,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACjE;;;;;;;;;;;;OAYG;IACH,KAAK,CACH,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACzB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,gGAAgG;IAChG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrG;AAkBD,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CA0QrE;AAED,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzG,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAeA,OAAO,EAAU,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAErD,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAChF,OAAO,EAAiC,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAsN1F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,uGAAuG;IACvG,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,eAAe,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,6FAA6F;AAC7F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wGAAwG;AACxG,MAAM,WAAW,KAAM,SAAQ,OAAO;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAeD,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpF;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB,oFAAoF;IACpF,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACjE;;;;;;;OAOG;IACH,KAAK,CACH,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;IAC1B,0FAA0F;IAC1F,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;IACrE,gGAAgG;IAChG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpG;;;;;;OAMG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAkBD,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAqVrE;AAED,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzG,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,SAAS,CAAC"}