@kya-os/mcp-i-cloudflare 1.12.4 → 1.13.0

package/dist/audit/deployment-binding.d.ts

@@ -0,0 +1,513 @@
+import { type AuditCapabilities, type SignerRef } from "@kya-os/mcp/audit";
+import { type RuntimeAuditConfig } from "@kya-os/mcp-i-runtime";
+import { z } from "zod";
+import type { CloudflareEnv } from "../types";
+import { CloudflareAuditProducerBinding, createCloudflareAuditTrail } from "./durable-producer";
+export declare const KYA_OS_AUDIT_DISCOVERY_PATH: "/.well-known/kya-os-audit";
+export declare const KYA_OS_AUDIT_CANARY_PATH: "/_kya/audit/canary";
+declare const PROBE_FORMAT: "org.kya-os.audit.runtime-capabilities.v1";
+declare const deploymentBindingSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"https://schema.kya-os.org/v1/protocol/audit/deployment-binding/v1.0.0">;
+    config: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        requestedProfile: z.ZodEnum<["AAP-0", "AAP-1", "AAP-2", "AAP-3", "AAP-4"]>;
+        delivery: z.ZodEnum<["best-effort", "buffered", "required"]>;
+        evidenceMode: z.ZodEnum<["none", "encrypted-separate", "encrypted-inline"]>;
+        retentionClass: z.ZodString;
+        retentionDays: z.ZodNumber;
+        residency: z.ZodEnum<["inherit-project", "us", "eu", "global"]>;
+        keyCustody: z.ZodEnum<["none", "checkpoint-managed", "customer-managed-kms"]>;
+        recorderTopology: z.ZodEnum<["none", "self-hosted", "managed", "verified-mirror"]>;
+    }, "strict", z.ZodTypeAny, {
+        enabled: boolean;
+        delivery: "best-effort" | "buffered" | "required";
+        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        evidenceMode: "none" | "encrypted-separate" | "encrypted-inline";
+        retentionClass: string;
+        retentionDays: number;
+        residency: "global" | "eu" | "inherit-project" | "us";
+        keyCustody: "none" | "checkpoint-managed" | "customer-managed-kms";
+        recorderTopology: "none" | "self-hosted" | "managed" | "verified-mirror";
+    }, {
+        enabled: boolean;
+        delivery: "best-effort" | "buffered" | "required";
+        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        evidenceMode: "none" | "encrypted-separate" | "encrypted-inline";
+        retentionClass: string;
+        retentionDays: number;
+        residency: "global" | "eu" | "inherit-project" | "us";
+        keyCustody: "none" | "checkpoint-managed" | "customer-managed-kms";
+        recorderTopology: "none" | "self-hosted" | "managed" | "verified-mirror";
+    }>;
+    readiness: z.ZodObject<{
+        requestedProfile: z.ZodEnum<["AAP-0", "AAP-1", "AAP-2", "AAP-3", "AAP-4"]>;
+        effectiveProfile: z.ZodEnum<["AAP-0", "AAP-1", "AAP-2", "AAP-3", "AAP-4"]>;
+        status: z.ZodEnum<["disabled", "ready", "degraded"]>;
+        reasonCodes: z.ZodArray<z.ZodString, "many">;
+        canary: z.ZodNullable<z.ZodUnknown>;
+    }, "strict", z.ZodTypeAny, {
+        status: "disabled" | "ready" | "degraded";
+        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        effectiveProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        reasonCodes: string[];
+        canary?: unknown;
+    }, {
+        status: "disabled" | "ready" | "degraded";
+        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        effectiveProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        reasonCodes: string[];
+        canary?: unknown;
+    }>;
+    protocolBinding: z.ZodString;
+    tenantRef: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"public_did">;
+        did: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        did: string;
+        kind: "public_did";
+    }, {
+        did: string;
+        kind: "public_did";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"pairwise_did">;
+        did: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        did: string;
+        kind: "pairwise_did";
+    }, {
+        did: string;
+        kind: "pairwise_did";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"keyed_commitment">;
+        value: z.ZodString;
+        keyId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        keyId: string;
+        kind: "keyed_commitment";
+    }, {
+        value: string;
+        keyId: string;
+        kind: "keyed_commitment";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"evidence_ref">;
+        ref: z.ZodObject<{
+            objectId: z.ZodString;
+            ciphertextDigest: z.ZodString;
+            plaintextCommitment: z.ZodOptional<z.ZodString>;
+            mediaType: z.ZodString;
+            size: z.ZodString;
+            encryption: z.ZodObject<{
+                suite: z.ZodLiteral<"A256GCM">;
+                keyId: z.ZodString;
+                nonce: z.ZodString;
+                aadDigest: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            }, {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            }>;
+        }, "strict", z.ZodTypeAny, {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        }, {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        ref: {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        };
+        kind: "evidence_ref";
+    }, {
+        ref: {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        };
+        kind: "evidence_ref";
+    }>]>;
+    producerRef: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"public_did">;
+        did: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        did: string;
+        kind: "public_did";
+    }, {
+        did: string;
+        kind: "public_did";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"pairwise_did">;
+        did: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        did: string;
+        kind: "pairwise_did";
+    }, {
+        did: string;
+        kind: "pairwise_did";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"keyed_commitment">;
+        value: z.ZodString;
+        keyId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        keyId: string;
+        kind: "keyed_commitment";
+    }, {
+        value: string;
+        keyId: string;
+        kind: "keyed_commitment";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"evidence_ref">;
+        ref: z.ZodObject<{
+            objectId: z.ZodString;
+            ciphertextDigest: z.ZodString;
+            plaintextCommitment: z.ZodOptional<z.ZodString>;
+            mediaType: z.ZodString;
+            size: z.ZodString;
+            encryption: z.ZodObject<{
+                suite: z.ZodLiteral<"A256GCM">;
+                keyId: z.ZodString;
+                nonce: z.ZodString;
+                aadDigest: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            }, {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            }>;
+        }, "strict", z.ZodTypeAny, {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        }, {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        ref: {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        };
+        kind: "evidence_ref";
+    }, {
+        ref: {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        };
+        kind: "evidence_ref";
+    }>]>;
+    recorderSigner: z.ZodObject<{
+        did: z.ZodString;
+        kid: z.ZodString;
+        alg: z.ZodEnum<["EdDSA", "ES256"]>;
+    }, "strict", z.ZodTypeAny, {
+        did: string;
+        kid: string;
+        alg: "EdDSA" | "ES256";
+    }, {
+        did: string;
+        kid: string;
+        alg: "EdDSA" | "ES256";
+    }>;
+    recorderPublicJwk: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnknown>, Record<string, unknown>, Record<string, unknown>>;
+    secretReferences: z.ZodObject<{
+        producerInternalToken: z.ZodLiteral<"KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN">;
+        referenceSecret: z.ZodLiteral<"KYA_OS_AUDIT_REFERENCE_SECRET">;
+        evidenceKey: z.ZodOptional<z.ZodLiteral<"KYA_OS_AUDIT_EVIDENCE_KEY">>;
+    }, "strict", z.ZodTypeAny, {
+        producerInternalToken: "KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN";
+        referenceSecret: "KYA_OS_AUDIT_REFERENCE_SECRET";
+        evidenceKey?: "KYA_OS_AUDIT_EVIDENCE_KEY" | undefined;
+    }, {
+        producerInternalToken: "KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN";
+        referenceSecret: "KYA_OS_AUDIT_REFERENCE_SECRET";
+        evidenceKey?: "KYA_OS_AUDIT_EVIDENCE_KEY" | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    schema: "https://schema.kya-os.org/v1/protocol/audit/deployment-binding/v1.0.0";
+    recorderSigner: {
+        did: string;
+        kid: string;
+        alg: "EdDSA" | "ES256";
+    };
+    recorderPublicJwk: Record<string, unknown>;
+    tenantRef: {
+        did: string;
+        kind: "public_did";
+    } | {
+        did: string;
+        kind: "pairwise_did";
+    } | {
+        value: string;
+        keyId: string;
+        kind: "keyed_commitment";
+    } | {
+        ref: {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        };
+        kind: "evidence_ref";
+    };
+    config: {
+        enabled: boolean;
+        delivery: "best-effort" | "buffered" | "required";
+        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        evidenceMode: "none" | "encrypted-separate" | "encrypted-inline";
+        retentionClass: string;
+        retentionDays: number;
+        residency: "global" | "eu" | "inherit-project" | "us";
+        keyCustody: "none" | "checkpoint-managed" | "customer-managed-kms";
+        recorderTopology: "none" | "self-hosted" | "managed" | "verified-mirror";
+    };
+    readiness: {
+        status: "disabled" | "ready" | "degraded";
+        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        effectiveProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        reasonCodes: string[];
+        canary?: unknown;
+    };
+    protocolBinding: string;
+    producerRef: {
+        did: string;
+        kind: "public_did";
+    } | {
+        did: string;
+        kind: "pairwise_did";
+    } | {
+        value: string;
+        keyId: string;
+        kind: "keyed_commitment";
+    } | {
+        ref: {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        };
+        kind: "evidence_ref";
+    };
+    secretReferences: {
+        producerInternalToken: "KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN";
+        referenceSecret: "KYA_OS_AUDIT_REFERENCE_SECRET";
+        evidenceKey?: "KYA_OS_AUDIT_EVIDENCE_KEY" | undefined;
+    };
+}, {
+    schema: "https://schema.kya-os.org/v1/protocol/audit/deployment-binding/v1.0.0";
+    recorderSigner: {
+        did: string;
+        kid: string;
+        alg: "EdDSA" | "ES256";
+    };
+    recorderPublicJwk: Record<string, unknown>;
+    tenantRef: {
+        did: string;
+        kind: "public_did";
+    } | {
+        did: string;
+        kind: "pairwise_did";
+    } | {
+        value: string;
+        keyId: string;
+        kind: "keyed_commitment";
+    } | {
+        ref: {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        };
+        kind: "evidence_ref";
+    };
+    config: {
+        enabled: boolean;
+        delivery: "best-effort" | "buffered" | "required";
+        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        evidenceMode: "none" | "encrypted-separate" | "encrypted-inline";
+        retentionClass: string;
+        retentionDays: number;
+        residency: "global" | "eu" | "inherit-project" | "us";
+        keyCustody: "none" | "checkpoint-managed" | "customer-managed-kms";
+        recorderTopology: "none" | "self-hosted" | "managed" | "verified-mirror";
+    };
+    readiness: {
+        status: "disabled" | "ready" | "degraded";
+        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        effectiveProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        reasonCodes: string[];
+        canary?: unknown;
+    };
+    protocolBinding: string;
+    producerRef: {
+        did: string;
+        kind: "public_did";
+    } | {
+        did: string;
+        kind: "pairwise_did";
+    } | {
+        value: string;
+        keyId: string;
+        kind: "keyed_commitment";
+    } | {
+        ref: {
+            objectId: string;
+            ciphertextDigest: string;
+            mediaType: string;
+            size: string;
+            encryption: {
+                suite: "A256GCM";
+                keyId: string;
+                nonce: string;
+                aadDigest: string;
+            };
+            plaintextCommitment?: string | undefined;
+        };
+        kind: "evidence_ref";
+    };
+    secretReferences: {
+        producerInternalToken: "KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN";
+        referenceSecret: "KYA_OS_AUDIT_REFERENCE_SECRET";
+        evidenceKey?: "KYA_OS_AUDIT_EVIDENCE_KEY" | undefined;
+    };
+}>;
+export type AuditDeploymentBinding = z.infer<typeof deploymentBindingSchema>;
+export type AuditRuntimeCapabilities = Omit<AuditCapabilities, "profile">;
+export interface AuditRuntimeProbe {
+    format: typeof PROBE_FORMAT;
+    configured: boolean;
+    enabled: boolean;
+    capabilities: AuditRuntimeCapabilities;
+    canaryEndpoint: typeof KYA_OS_AUDIT_CANARY_PATH;
+}
+export interface AuditRuntimeCanaryResult {
+    passed: boolean;
+    observedAt: number;
+    capabilities: AuditRuntimeCapabilities;
+    checks: Array<{
+        id: string;
+        passed: boolean;
+    }>;
+    bundleHash?: string;
+}
+interface ConfiguredAuditRuntime {
+    binding: AuditDeploymentBinding;
+    capabilities: AuditCapabilities;
+    auditTrail: RuntimeAuditConfig;
+    trail: ReturnType<typeof createCloudflareAuditTrail>;
+    producer: CloudflareAuditProducerBinding;
+}
+export declare function resolveAuditRuntimeProbe(env: CloudflareEnv): AuditRuntimeProbe;
+export declare function createCloudflareAuditRuntimeFromEnv(env: CloudflareEnv): ConfiguredAuditRuntime | undefined;
+export declare function runAuditRuntimeCanary(request: Request, env: CloudflareEnv): Promise<Response>;
+export declare function handleAuditRuntimeControlRequest(request: Request, env: CloudflareEnv): Promise<Response | null>;
+export declare function recorderConfigurationFromBinding(binding: AuditDeploymentBinding): {
+    signer: SignerRef;
+    publicJwk: Record<string, unknown>;
+};
+export {};
+//# sourceMappingURL=deployment-binding.d.ts.map

package/dist/audit/deployment-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-binding.d.ts","sourceRoot":"","sources":["../../src/audit/deployment-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EAOtB,KAAK,SAAS,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,oBAAoB,CAAC;AAE5B,eAAO,MAAM,2BAA2B,EAAG,2BAAoC,CAAC;AAChF,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAItE,QAAA,MAAM,YAAY,EAAG,0CAAmD,CAAC;AA8CzE,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBlB,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC7E,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;AAE1E,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,YAAY,CAAC;IAC5B,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,wBAAwB,CAAC;IACvC,cAAc,EAAE,OAAO,wBAAwB,CAAC;CACjD;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,wBAAwB,CAAC;IACvC,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,sBAAsB;IAC9B,OAAO,EAAE,sBAAsB,CAAC;IAChC,YAAY,EAAE,iBAAiB,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,KAAK,EAAE,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC;IACrD,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAsFD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,aAAa,GAAG,iBAAiB,CAU9E;AAED,wBAAgB,mCAAmC,CACjD,GAAG,EAAE,aAAa,GACjB,sBAAsB,GAAG,SAAS,CA0CpC;AA4ED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,QAAQ,CAAC,CA4FnB;AAED,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAS1B;AAED,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,sBAAsB,GAAG;IACjF,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAQA"}