@open-everywhere/core 0.1.0

package/dist/agent/connections/connector-auth.d.ts

@@ -0,0 +1,216 @@
+import { type ConnectionAuthResolver, type InteractiveAuthorizationDefinition, type JsonValue, type TokenResult } from "eve/connections";
+import type { ApprovalPolicy } from "eve/tools/approval";
+import { boundConnectorCredential, surfaceContextFromAuth } from "../access/connector-scope.js";
+import { effectiveConnectorOpTier } from "../access/connector-op-gating.js";
+import { appendAudit } from "../audit/audit.js";
+import { type ConsentCarriage } from "./user-auth-flow.js";
+/**
+ * A fixed API key, shared service identity. The secret resolves by ref through its explicit home `broker`
+ * at call time — never a raw process.env read, and it never enters the sandbox.
+ */
+export declare function appStaticToken(opts: {
+    /** The connection's runtime name (its agent/connections/*.ts slug) — the grant key. */
+    readonly connector: string;
+    /** Reference to the secret (env key / db ref / Connect ref), never the value. */
+    readonly secretRef: string;
+    /** The secret's HOME broker ("env" | "db" | ...) — REQUIRED (no selected default). */
+    readonly broker: string;
+}): ConnectionAuthResolver;
+/**
+ * Out-of-band service OAuth — the vault owns refresh, so getToken stays non-interactive. The mint runs
+ * through the registered UserAuthFlowProvider, which throws when no connector-OAuth adapter is wired.
+ */
+export declare function appConnectToken(opts: {
+    readonly connector: string;
+    /** The provider connector ref (a provider connector id, e.g. "oauth/mcp-notion-app"). */
+    readonly vercelConnector: string;
+}): ConnectionAuthResolver;
+/**
+ * Resolves WHICH credential the calling surface is bound to and authorizes with that, so one connection
+ * serves different surfaces different keys. `fallbackSecretRef` covers a raw grant with no bound credential.
+ */
+export declare function appProviderToken(opts: {
+    readonly connector: string;
+    /** Static secret used when the surface has no provider credential bound (raw grant). */
+    readonly fallbackSecretRef?: string;
+    /** The fallback secret's HOME broker ("env" | "db" | ...) — REQUIRED alongside fallbackSecretRef
+     *  (no selected default; an unstamped fallback fails closed at resolution). */
+    readonly fallbackBroker?: string;
+    /** The connection's MCP transport URL (OPE-523) — when present, the bound credential's
+     *  `endpoints.hosts` (if it declares any) is checked against this URL before the token is
+     *  returned. Absent ⇒ no transport check runs (a caller with no URL to check, e.g. a test). */
+    readonly directUrl?: string;
+}): ConnectionAuthResolver;
+/**
+ * RESOLUTION-TIME fallback is ALLOWED — the `!cred` branch, where no credential is bound for this surface.
+ * AUTH-FAILURE fallback is FORBIDDEN: a failure under a resolved credential propagates, never retries.
+ */
+export declare function resolveAppTokenFromCred(opts: {
+    readonly connector: string;
+    readonly fallbackSecretRef?: string;
+    readonly fallbackBroker?: string;
+    readonly directUrl?: string;
+}, cred: import("../access/connector-credentials.js").ResolvedConnectorCredential | null, o: unknown): Promise<TokenResult>;
+/** Params for the per-user token mint (a `{type:"user"}` subject + optional per-call scoping). */
+export interface ConnectUserTokenParams {
+    readonly subject: {
+        readonly type: "user";
+        readonly id: string;
+        readonly issuer?: string;
+    };
+    readonly scopes?: readonly string[];
+    readonly resources?: readonly string[];
+}
+/** Mints a per-user token. Injectable (DI seam) so tests exercise the subject-branch without a live
+ *  auth-flow adapter; the default delegates to the registered {@link UserAuthFlowProvider}. */
+export type ConnectUserTokenMinter = (vercelConnector: string, params: ConnectUserTokenParams) => Promise<TokenResult>;
+/**
+ * Mints an end-user AUTHORIZATION URL — the page a human opens to connect their OWN account, no vendor
+ * dashboard needed. Injectable (DI seam) so the auth-required branch tests offline.
+ */
+export type ConnectAuthorizationStarter = (vercelConnector: string, params: {
+    readonly subject: {
+        readonly type: "user";
+        readonly id: string;
+    };
+}, 
+/** `consent` (OPE-1619) is the opaque record of the request this detour interrupted — the adapter
+ *  persists it beside the pending-authorization row and hands it back at the callback, so the
+ *  return hop can resume that request. Absent ⇒ nothing to resume, and the flow is unchanged. */
+options: {
+    readonly expiresInMs?: number;
+    readonly consent?: ConsentCarriage;
+}) => Promise<{
+    url: string;
+}>;
+/**
+ * The authorization URL is CAPABILITY-BEARING: long enough to complete the third-party OAuth, short enough
+ * not to linger. Exported so connector-card.ts mints with the SAME window — one TTL for every link OE issues.
+ */
+export declare const AUTH_URL_TTL_MS: number;
+/** An OAuth subject the connector card can request a URL for — the clicker's own user account, or the
+ *  shared org service (app) account. `id` is present only for the user subject (the surface principal). */
+export type ConnectorAuthSubject = {
+    readonly type: "user";
+    readonly id: string;
+} | {
+    readonly type: "app";
+};
+/** Mints an authorization URL for EITHER subject shape (see the block above). CAPABILITY-BEARING:
+ *  whoever opens the returned URL binds the named subject's third-party account. NEVER log it. */
+export type ConnectorAuthorizationStarter = (vercelConnector: string, params: {
+    readonly subject: ConnectorAuthSubject;
+}, options: {
+    readonly expiresInMs?: number;
+}) => Promise<{
+    url: string;
+}>;
+/** The default subject-flexible starter — delegates to the registered {@link UserAuthFlowProvider}
+ *  (fail closed when no connector-OAuth adapter is wired). `vercelConnector` doubles as the error label. */
+export declare const defaultConnectorAuthStarter: ConnectorAuthorizationStarter;
+/**
+ * Resolve the DM caller's `{mode, principalId}` from `ctx.session.auth`. Fail-soft: an unresolvable surface
+ * yields `{}`, so the caller fails closed. 🔴 The ACTING principal, never the bound one — a token mints AS it.
+ */
+export declare function resolveDmPrincipal(auth: import("eve/context").SessionAuth): Promise<{
+    mode?: string;
+    principalId?: string;
+    platform?: string;
+    workspace?: string;
+    org?: string;
+    trust?: string;
+    declaredTrust?: string;
+}>;
+/**
+ * The EFFECTIVE user-OAuth vault subject — shared iff the caller is a confirmed link-set member, else their
+ * own QUALIFIED raw subject. The ONE composer (credential-grant-owner.ts calls it too); it THROWS without both.
+ */
+export declare function effectiveUserVaultSubject(connector: string, org: string | undefined, platform: string | undefined, workspace: string | undefined, principalId: string): Promise<string>;
+/**
+ * Provider-routed auth that mints a PER-USER token in a DM and is byte-identical to {@link appProviderToken}
+ * on every other path. Wire it behind connectors.userPrincipal; `mintUser` is injectable for tests.
+ */
+export declare function userAwareProviderToken(opts: {
+    readonly connector: string;
+    readonly fallbackSecretRef?: string;
+    readonly fallbackBroker?: string;
+    readonly directUrl?: string;
+}, deps?: {
+    readonly mintUser?: ConnectUserTokenMinter;
+    readonly startAuth?: ConnectAuthorizationStarter;
+}): ConnectionAuthResolver;
+/**
+ * An `approval` policy: reads open, writes gated once per op, destructive gated per call. 🔴 The read arm
+ * stays SYNCHRONOUS — it is the hot path; only the non-read arm awaits the member-plane credential read.
+ */
+export declare function connectorOpApproval(deps?: ConnectorOpApprovalDeps): ApprovalPolicy;
+/**
+ * Injectable dependencies for {@link connectorOpApproval} — a DI seam because the personal-write decision is
+ * a security gate, and a gate whose only test needs a live eve session is a gate nobody re-tests.
+ */
+export interface ConnectorOpApprovalDeps {
+    readonly boundCredential?: typeof boundConnectorCredential;
+    /** The is-DM predicate. THE SAME ONE THE MINT SITE TRUSTS — deliberately not a second reading of
+     *  "is this a channel", so the approval seam and the mint can never disagree about the surface. */
+    readonly dmPrincipal?: typeof resolveDmPrincipal;
+}
+/** The refusal for a qualified name this plane cannot resolve to a connection (OPE-1286). Names the
+ *  tool and says which plane owns the name, so the model reports a routing problem rather than
+ *  concluding the connector is down. */
+export declare function unresolvableConnectionRefusalMessage(toolName: string): string;
+/**
+ * The connection `approval` policy for the arming flag. 🔴 The return MUST stay a BARE FUNCTION: eve's resolver
+ * drops a configuration arm — so this site has NO response half, and an Approve click binds to no requester.
+ */
+export declare function connectorApprovalPolicy(): ApprovalPolicy;
+/**
+ * The approvals plane's `ask-unattended` refusal sentence, VERBATIM. Duplicated rather than imported because
+ * flow.ts drags in the whole card graph; scripts/connector-unattended-fence-test.ts §1 pins the two equal.
+ */
+export declare const ASK_UNATTENDED_SENTENCE = "An unattended run cannot wait on an approval card; arm the permission on the routine's creation card, or ask a person to do this.";
+/**
+ * The plane's sentence for the same refusal on a TAINTED turn, VERBATIM: no standing grant lifts a taint
+ * floor, so the plain advice would be wrong. Duplicated and pinned like {@link ASK_UNATTENDED_SENTENCE}.
+ */
+export declare const TAINTED_ASK_UNATTENDED_SENTENCE = "This turn read external content, so this action needs a person to confirm it \u2014 and this run is unattended, so there is nobody to ask. No standing grant lifts that; ask a person to do this, or raise it again in a turn that has not read anything external.";
+/**
+ * The connector plane's own remedy for a poisoned fire: a fire has no other turn, so the plane's advice is
+ * unactionable here. Only `contentOrigin: "internal"` lifts the taint, and this is advice — no verdict moves.
+ */
+export declare const TAINTED_CONNECTOR_ORIGIN_ADVICE = "A fire has no other turn. A connector read marks every fire untrusted while its grant declares `contentOrigin: \"external\"` or declares nothing. Only `contentOrigin: \"internal\"` changes that, and it asserts that org members author everything the connection returns. Do not declare it to unblock a routine.";
+/**
+ * The refusal a fenced unattended op throws back: it names the op, the tier and the exact declaration to arm.
+ * A TAINTED turn gets the plane's tainted sentence and the origin advice instead — arming lifts nothing.
+ */
+export declare function unattendedConnectorRefusalMessage(connection: string, toolName: string, tier: ReturnType<typeof effectiveConnectorOpTier>, tainted: boolean): string;
+/** Injectable dependencies for {@link withUnattendedConnectorFence} — the surface resolve, the grant
+ *  read and the audit write. A DI seam for the same reason {@link ConnectorOpApprovalDeps} is one:
+ *  this is a security gate, and the defaults reach an operational store and an audit chain. */
+export interface UnattendedConnectorFenceDeps {
+    readonly surfaceContext?: typeof surfaceContextFromAuth;
+    /** Does a live declared permission of `kind` exist under `grantKey` for `org` right now? The dep
+     *  and the `grantKey` field beside it keep their spelling because they mirror the frozen card args
+     *  (OPE-1303); the plane's word for what they name is "declared permission". */
+    readonly grantExists?: (org: string, grantKey: string, kind: string, nowIso: string) => Promise<boolean>;
+    readonly audit?: typeof appendAudit;
+    /**
+     * Has this turn ingested untrusted external content? THE SAME read the approvals plane makes, injectable
+     * because it answers off a per-turn slot a hook seeds. 🔴 A throw is treated as POISONED, never as clean.
+     */
+    readonly tainted?: () => boolean;
+}
+/** Wrap a connector-op approval policy so an UNATTENDED run never parks on a card — see the block above. */
+export declare function withUnattendedConnectorFence(policy: ApprovalPolicy, deps?: UnattendedConnectorFenceDeps): ApprovalPolicy;
+/**
+ * Interactive OAuth on behalf of the end user — the DM/personal universe. Pins `principalType: "user"` and
+ * runs the hard gate in getToken. NEVER grant a user-principal connector to a domain binding.
+ */
+export declare function userInteractiveOAuth<Resume extends JsonValue = JsonValue>(opts: {
+    readonly connector: string;
+    readonly getToken: InteractiveAuthorizationDefinition<Resume>["getToken"];
+    readonly startAuthorization: InteractiveAuthorizationDefinition<Resume>["startAuthorization"];
+    readonly completeAuthorization: InteractiveAuthorizationDefinition<Resume>["completeAuthorization"];
+    readonly displayName?: string;
+    readonly evict?: InteractiveAuthorizationDefinition<Resume>["evict"];
+}): ConnectionAuthResolver;
+//# sourceMappingURL=connector-auth.d.ts.map

package/dist/agent/connections/connector-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-auth.d.ts","sourceRoot":"","sources":["../../../agent/connections/connector-auth.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,kCAAkC,EACvC,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAYzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAEL,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAAE,wBAAwB,EAAwB,MAAM,kCAAkC,CAAC;AAsBlG,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AA8B7B;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,sBAAsB,CAQzB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,GAAG,sBAAsB,CAQzB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;mFAC+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;mGAE+F;IAC/F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,sBAAsB,CAYzB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACxI,IAAI,EAAE,OAAO,oCAAoC,EAAE,2BAA2B,GAAG,IAAI,EACrF,CAAC,EAAE,OAAO,GACT,OAAO,CAAC,WAAW,CAAC,CA8BtB;AAKD,kGAAkG;AAClG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;+FAC+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAEvH;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG,CACxC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE;AAC5E;;iGAEiG;AACjG,OAAO,EAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CAAE,KAC3E,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE9B;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAiB,CAAC;AAqB9C;2GAC2G;AAC3G,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAE7B;kGACkG;AAClG,MAAM,MAAM,6BAA6B,GAAG,CAC1C,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,EAClD,OAAO,EAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,KACvC,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE9B;4GAC4G;AAC5G,eAAO,MAAM,2BAA2B,EAAE,6BACiD,CAAC;AAsB5F;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,OAAO,aAAa,EAAE,WAAW,GACtC,OAAO,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAW/I;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAUjB;AA0FD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACxI,IAAI,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAA;CAAO,GAC1G,sBAAsB,CA6JxB;AAKD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,uBAA4B,GAAG,cAAc,CAWtF;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,wBAAwB,CAAC;IAC3D;uGACmG;IACnG,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,kBAAkB,CAAC;CAClD;AAED;;wCAEwC;AACxC,wBAAgB,oCAAoC,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM7E;AA+CD;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,cAAc,CAQxD;AAOD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,sIACiG,CAAC;AAEtI;;;GAGG;AACH,eAAO,MAAM,+BAA+B,uQACqN,CAAC;AAElQ;;;GAGG;AACH,eAAO,MAAM,+BAA+B,yTAC4Q,CAAC;AAEzT;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,EACjD,OAAO,EAAE,OAAO,GACf,MAAM,CAWR;AAED;;+FAE+F;AAC/F,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACxD;;oFAEgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,WAAW,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC;CAClC;AA0FD,4GAA4G;AAC5G,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,4BAAiC,GACtC,cAAc,CAmHhB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,SAAS,SAAS,GAAG,SAAS,EAAE,IAAI,EAAE;IAC/E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,kCAAkC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1E,QAAQ,CAAC,kBAAkB,EAAE,kCAAkC,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAC9F,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACpG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,kCAAkC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;CACtE,GAAG,sBAAsB,CAczB"}