@kya-os/mcp 1.6.1 → 1.9.0

package/dist/middleware/with-kya-os.grants.js

@@ -0,0 +1,145 @@
+/**
+ * KYA-OS Middleware — durable-grant resolution (the no-paste retry).
+ *
+ * Resolves and mints agent-anchored / session-bound authorization grants so a
+ * verified delegation need not be re-pasted on the next call — even on a fresh
+ * instance with empty memory. Extracted from `./with-kya-os.ts`; depends only on
+ * the immutable {@link MiddlewareDeps} (no shared session state).
+ */
+import { getDelegationScopes } from "../delegation/chain-enforcement.js";
+import { assertHolderBinding, isHolderBindingApplicable, toHolderBindingRequest, } from "../delegation/holder-binding.js";
+import { logger } from "../logging/index.js";
+export function createGrantResolution(deps) {
+    const { identity, cryptoProvider, grantStore, holderBindingMode, holderBindingVerifier, } = deps;
+    /**
+     * Deterministic grant id from (agentDid, sessionId, sorted scopes). Stable for
+     * the same tuple so a repeated VC-paste UPSERTS one grant rather than piling
+     * duplicate rows in a durable store.
+     */
+    async function grantId(agentDid, sessionId, scopes) {
+        const key = `${agentDid}|${sessionId ?? ""}|${[...scopes].sort().join(",")}`;
+        const digest = await cryptoProvider.hash(new TextEncoder().encode(key));
+        return `grant_${digest.replace(/^sha256:/, "")}`;
+    }
+    /** Grant expiry (ms epoch) derived from the VC, or undefined for no expiry. */
+    function delegationExpiryMs(vc) {
+        if (vc.expirationDate) {
+            const parsed = Date.parse(vc.expirationDate);
+            if (!Number.isNaN(parsed))
+                return parsed;
+        }
+        const notAfter = vc.credentialSubject?.delegation?.constraints?.notAfter;
+        if (typeof notAfter === "number")
+            return notAfter * 1000;
+        return undefined;
+    }
+    /**
+     * Resolve a durable, agent-anchored grant for a no-delegation call — BUT ONLY
+     * behind a verified holder-of-key proof. The agent DID is taken from the
+     * `_kyaos_proof` and re-proven per request (possession of the subject key over
+     * THIS request), never trusted from a bearer hint. This is the single most
+     * security-sensitive gate of the durable-consent change: without it, any
+     * caller who knows agent A's DID could replay A's grant (confused-deputy
+     * escalation, spec §A.4). Returns undefined unless possession is proven.
+     */
+    async function resolveAgentGrant(toolName, args, sessionId, scopeId) {
+        if (!holderBindingVerifier)
+            return undefined; // inert unless holder binding is on
+        const proofArg = args["_kyaos_proof"];
+        if (proofArg === undefined)
+            return undefined;
+        let parsedProof = proofArg;
+        if (typeof proofArg === "string") {
+            try {
+                parsedProof = JSON.parse(proofArg);
+            }
+            catch {
+                return undefined;
+            }
+        }
+        const proof = parsedProof;
+        const agentDid = proof?.meta?.did;
+        if (typeof agentDid !== "string" || !isHolderBindingApplicable(agentDid)) {
+            return undefined;
+        }
+        const binding = await assertHolderBinding({
+            proof,
+            subjectDid: agentDid,
+            request: toHolderBindingRequest(toolName, args),
+            expectedAudience: identity.did,
+            proofVerifier: holderBindingVerifier,
+        });
+        if (binding.status !== "bound")
+            return undefined;
+        const grants = await grantStore.getByAgent(agentDid, [scopeId]);
+        // A session-bound grant is usable only from its own session; an
+        // agent-anchored (session-less) grant is portable across transports.
+        return grants.find((g) => g.sessionId === undefined || g.sessionId === sessionId);
+    }
+    async function resolveExistingGrant(toolName, args, sessionId, scopeId) {
+        const agentGrant = await resolveAgentGrant(toolName, args, sessionId, scopeId);
+        if (agentGrant)
+            return agentGrant;
+        if (sessionId) {
+            const [sessionGrant] = await grantStore.getBySession(sessionId, [scopeId]);
+            if (sessionGrant)
+                return sessionGrant;
+        }
+        return undefined;
+    }
+    async function bindGrantOnSuccess(vc, delegationArg, isVCJWT, sessionId, scopeId) {
+        try {
+            const agentDid = vc.credentialSubject?.id;
+            if (!agentDid)
+                return;
+            // A session-less grant minted with holder binding OFF is unresolvable on
+            // retry (getByAgent needs a holder-of-key proof; getBySession needs a
+            // sessionId), so DON'T bind it — that would only orphan a row in a durable
+            // store. Durability for such flows comes from re-presenting the delegation,
+            // not from a grant. Enable holderBinding 'enforce' or thread a sessionId to
+            // use the grant-backed no-paste retry.
+            if (holderBindingMode === "off" && sessionId === undefined) {
+                logger.debug(`[kya-os] Skipping an unresolvable session-less grant for scope "${scopeId}" (holderBinding 'off', no sessionId).`);
+                return;
+            }
+            let delegatedScopes;
+            try {
+                delegatedScopes = getDelegationScopes(vc);
+            }
+            catch {
+                delegatedScopes = [];
+            }
+            // Store the EXACT required scope alongside the delegated scopes. The retry
+            // queries by the tool's exact scopeId, but the delegation may have granted
+            // a prefix/regex scope (e.g. "cart:*"); the store's exact `coversScopes`
+            // would never match the wildcard, so the no-paste retry would silently
+            // re-challenge. Including scopeId makes the grant resolvable.
+            const scopes = Array.from(new Set([scopeId, ...delegatedScopes]));
+            const userDid = vc.credentialSubject?.delegation?.controller;
+            const expiresAt = delegationExpiryMs(vc);
+            const grant = {
+                id: await grantId(agentDid, sessionId, scopes),
+                agentDid,
+                ...(userDid !== undefined ? { userDid } : {}),
+                scopes,
+                ...(sessionId !== undefined ? { sessionId } : {}),
+                authorization: { type: "delegation" },
+                ...(isVCJWT && typeof delegationArg === "string"
+                    ? { credentialJwt: delegationArg }
+                    : {}),
+                issuedAt: Date.now(),
+                ...(expiresAt !== undefined ? { expiresAt } : {}),
+                status: "active",
+            };
+            await grantStore.bind(grant);
+        }
+        catch (error) {
+            logger.error("[kya-os] Grant bind failed", {
+                scope: scopeId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return { resolveExistingGrant, bindGrantOnSuccess };
+}
+//# sourceMappingURL=with-kya-os.grants.js.map

package/dist/middleware/with-kya-os.grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.grants.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.grants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAgC7C,MAAM,UAAU,qBAAqB,CAAC,IAAoB;IACxD,MAAM,EACJ,QAAQ,EACR,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,qBAAqB,GACtB,GAAG,IAAI,CAAC;IAET;;;;OAIG;IACH,KAAK,UAAU,OAAO,CACpB,QAAgB,EAChB,SAA6B,EAC7B,MAAgB;QAEhB,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,SAAS,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,OAAO,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,+EAA+E;IAC/E,SAAS,kBAAkB,CAAC,EAAwB;QAClD,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;QAC3C,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;QACzE,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,GAAG,IAAI,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,iBAAiB,CAC9B,QAAgB,EAChB,IAA6B,EAC7B,SAA6B,EAC7B,OAAe;QAEf,IAAI,CAAC,qBAAqB;YAAE,OAAO,SAAS,CAAC,CAAC,oCAAoC;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,WAAW,GAAY,QAAQ,CAAC;QACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,WAA4B,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;QAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;YACxC,KAAK;YACL,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;YAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;YAC9B,aAAa,EAAE,qBAAqB;SACrC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,gEAAgE;QAChE,qEAAqE;QACrE,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAC9D,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,QAAgB,EAChB,IAA6B,EAC7B,SAA6B,EAC7B,OAAe;QAEf,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,EAAwB,EACxB,aAAsB,EACtB,OAAgB,EAChB,SAA6B,EAC7B,OAAe;QAEf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,uCAAuC;YACvC,IAAI,iBAAiB,KAAK,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,CAAC,KAAK,CACV,mEAAmE,OAAO,wCAAwC,CACnH,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,eAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,2EAA2E;YAC3E,2EAA2E;YAC3E,yEAAyE;YACzE,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,UAAU,CAAC;YAC7D,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAEzC,MAAM,KAAK,GAAU;gBACnB,EAAE,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;gBAC9C,QAAQ;gBACR,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,MAAM;gBACN,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,aAAa,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;gBACrC,GAAG,CAAC,OAAO,IAAI,OAAO,aAAa,KAAK,QAAQ;oBAC9C,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gBACpB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,EAAE,QAAQ;aACjB,CAAC;YACF,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;AACtD,CAAC"}

package/dist/middleware/with-kya-os.helpers.d.ts

@@ -0,0 +1,24 @@
+/**
+ * KYA-OS Middleware — pure, dependency-free helpers.
+ *
+ * Referentially-transparent utilities used by `createKyaOsMiddleware`, split out
+ * of `./with-kya-os.ts` so the factory module stays focused on wiring. No shared
+ * mutable state, no I/O — safe to unit test in isolation.
+ */
+/**
+ * Strip control characters and cap length on caller-derived values before they
+ * are interpolated into client-facing reasons or log lines. A hostile
+ * credential could otherwise embed newlines / control chars in an id or scope to
+ * forge or corrupt log entries (log injection) or break a terminal. The fixed
+ * parts of a reason contain no control chars, so sanitizing the whole assembled
+ * string at the emission boundary is equivalent to sanitizing each interpolated
+ * value, and is idempotent.
+ */
+export declare function sanitizeForMessage(value: unknown, maxLen?: number): string;
+/** Best-effort projection of a delegation VC into policy principal facts. */
+export declare function extractPolicyPrincipal(del: unknown): {
+    agentDid: string;
+    responsibleParty?: string;
+    delegatedScopes: string[];
+};
+//# sourceMappingURL=with-kya-os.helpers.d.ts.map

package/dist/middleware/with-kya-os.helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.helpers.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,MAAM,CAWvE;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,CA0BA"}

package/dist/middleware/with-kya-os.helpers.js

@@ -0,0 +1,57 @@
+/**
+ * KYA-OS Middleware — pure, dependency-free helpers.
+ *
+ * Referentially-transparent utilities used by `createKyaOsMiddleware`, split out
+ * of `./with-kya-os.ts` so the factory module stays focused on wiring. No shared
+ * mutable state, no I/O — safe to unit test in isolation.
+ */
+import { getDelegationScopes } from "../delegation/chain-enforcement.js";
+/**
+ * Strip control characters and cap length on caller-derived values before they
+ * are interpolated into client-facing reasons or log lines. A hostile
+ * credential could otherwise embed newlines / control chars in an id or scope to
+ * forge or corrupt log entries (log injection) or break a terminal. The fixed
+ * parts of a reason contain no control chars, so sanitizing the whole assembled
+ * string at the emission boundary is equivalent to sanitizing each interpolated
+ * value, and is idempotent.
+ */
+export function sanitizeForMessage(value, maxLen = 256) {
+    const s = typeof value === "string" ? value : String(value);
+    // Replace C0/C1 control chars (incl. CR, LF, TAB, ESC, DEL) with U+FFFD so a
+    // hostile id/scope cannot forge log lines or break a terminal. Filtered by
+    // code point to keep this source ASCII-only (no literal control chars).
+    let out = "";
+    for (const ch of s) {
+        const code = ch.codePointAt(0) ?? 0;
+        out += code <= 0x1f || (code >= 0x7f && code <= 0x9f) ? "\uFFFD" : ch;
+    }
+    return out.length > maxLen ? `${out.slice(0, maxLen)}\u2026` : out;
+}
+/** Best-effort projection of a delegation VC into policy principal facts. */
+export function extractPolicyPrincipal(del) {
+    if (!del || typeof del !== "object") {
+        return { agentDid: "unknown", delegatedScopes: [] };
+    }
+    try {
+        const vc = del;
+        const subject = vc.credentialSubject;
+        const agentDid = subject?.delegation?.subjectDid ?? subject?.id ?? "unknown";
+        const responsibleParty = subject?.delegation?.controller;
+        let delegatedScopes = [];
+        try {
+            delegatedScopes = getDelegationScopes(vc);
+        }
+        catch {
+            delegatedScopes = [];
+        }
+        return {
+            agentDid,
+            ...(responsibleParty ? { responsibleParty } : {}),
+            delegatedScopes,
+        };
+    }
+    catch {
+        return { agentDid: "unknown", delegatedScopes: [] };
+    }
+}
+//# sourceMappingURL=with-kya-os.helpers.js.map

package/dist/middleware/with-kya-os.helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.helpers.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,MAAM,GAAG,GAAG;IAC7D,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;AACrE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,GAAY;IAKjD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,GAA2B,CAAC;QACvC,MAAM,OAAO,GAAG,EAAE,CAAC,iBAGlB,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,UAAU,IAAI,OAAO,EAAE,EAAE,IAAI,SAAS,CAAC;QAC7E,MAAM,gBAAgB,GAAG,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC;QACzD,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,OAAO;YACL,QAAQ;YACR,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,eAAe;SAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;AACH,CAAC"}