@open-everywhere/provider-slack 0.1.3 → 0.1.4

package/dist/agent/setup/install-state.js

@@ -0,0 +1,196 @@
+// THE SLACK INSTALL RECORD (OPE-2231) — what a `/setup` run captured, and the ONE predicate the
+// rest of the deployment asks about it.
+//
+// WHERE IT LIVES. Every field sits in the encrypted KV vault (core `credentials/kv-vault.ts`) under
+// the reserved `slack-app:` namespace, so the outbound credential resolver refuses all of it — see
+// `SLACK_APP_REF_NAMESPACE`'s own doc comment for why the bot token is reserved too. Four refs hold
+// SECRET material and one holds the non-secret record:
+//
+//   slack-app:client_secret   the app's OAuth client secret        (apps.manifest.create returned it)
+//   slack-app:signing_secret  the app's request-signing secret     (apps.manifest.create returned it)
+//   slack-app:bot_token       the workspace bot token              (oauth.v2.access returned it)
+//   slack-app:cookie_key      the HMAC key for the claim cookie    (this deployment minted it)
+//   slack-app:install         the record below, as JSON            (ids and timestamps only)
+//
+// 🔴 THE RECORD CARRIES NO SECRET, AND THAT IS WHAT MAKES IT READABLE. {@link slackInstallState} is
+// the seam a STATUS ENDPOINT reads (OPE-2230 builds that endpoint; this function is its whole
+// contract with Slack). A status endpoint is a place where a value gets rendered to whoever can
+// reach it, so the thing it reads must be unable to carry one. Hence the split: ids and timestamps
+// in `slack-app:install`, every secret under its own ref, and no function here that returns both.
+// Adding a field to {@link SlackInstallState} means asking "would I publish this?" — if the answer
+// is no, it belongs in its own ref instead.
+//
+// 🔴 THE RECORD IS THE LOCK. `/setup` is open while no record exists and closed once one does
+// (`agent/setup/claim.ts` reads exactly this). So writing the record is the LAST act of a
+// successful install, after both secrets are stored — a record written first would lock the page
+// against a run that had not finished, with no way back in but the reopen call.
+import { encryptedKvVault, SLACK_APP_REF_NAMESPACE } from "@open-everywhere/core/agent/adapter-api.js";
+/** The ref holding the app's OAuth client secret. SECRET — never rendered, never logged. */
+export const SLACK_CLIENT_SECRET_REF = `${SLACK_APP_REF_NAMESPACE}client_secret`;
+/** The ref holding the app's request-signing secret. SECRET. */
+export const SLACK_SIGNING_SECRET_REF = `${SLACK_APP_REF_NAMESPACE}signing_secret`;
+/** The ref holding the workspace bot token (`xoxb-…`). SECRET. */
+export const SLACK_BOT_TOKEN_REF = `${SLACK_APP_REF_NAMESPACE}bot_token`;
+/**
+ * The ref holding a PENDING app's signing secret, between the create and the OAuth callback.
+ *
+ * 🔴 WHY A SECOND REF AND NOT JUST {@link SLACK_SIGNING_SECRET_REF}. That ref is LIVE — it is what
+ * verifies every inbound Slack request. Writing the new app's secret straight into it at the create
+ * step would swap the running deployment's signing key before the install existed, so an ABANDONED
+ * run (wrong workspace, expired token, closed tab) left an installed deployment unable to verify its
+ * own workspace's requests: every cold start from then on 401s, staggered by the per-process memo, with
+ * nothing in the logs saying a different secret had been picked. The callback promotes this to the live
+ * ref immediately before it records the install, so the live secret changes only when a run COMPLETES.
+ */
+export const SLACK_PENDING_SIGNING_SECRET_REF = `${SLACK_APP_REF_NAMESPACE}pending_signing_secret`;
+/** The ref holding the HMAC key for the claim cookie. SECRET, and minted here — see claim.ts. */
+export const SLACK_COOKIE_KEY_REF = `${SLACK_APP_REF_NAMESPACE}cookie_key`;
+/** The ref holding the one-time setup code a human reads out of the deployment's logs. SECRET. */
+export const SLACK_SETUP_CODE_REF = `${SLACK_APP_REF_NAMESPACE}setup_code`;
+/** The ref holding {@link SlackInstallState} as JSON. The ONLY ref here with no secret in it. */
+export const SLACK_INSTALL_REF = `${SLACK_APP_REF_NAMESPACE}install`;
+/** The ref holding the PENDING app record (`agent/setup/page.ts` writes and spends it). Declared here
+ *  so one module owns the ref vocabulary — `reopenSlackSetup` has to clear it, and a ref it could not
+ *  name is a ref it would leave behind. */
+export const SLACK_PENDING_REF = `${SLACK_APP_REF_NAMESPACE}pending`;
+function vaultOf(deps) {
+    return deps.vault ?? encryptedKvVault();
+}
+/**
+ * The recorded Slack install, or `undefined` when this deployment has none.
+ *
+ * 🔴 THIS IS THE SEAM OPE-2230's STATUS ENDPOINT READS, and the only one it should: it returns the
+ * whole non-secret truth about whether Slack is installed and where, and it can return nothing
+ * else. Call it; do not read `slack-app:install` directly, or the status endpoint and the claim lock
+ * end up with two readings of one record.
+ *
+ * FAIL-SOFT TO "NOT INSTALLED". An unreachable vault, a disarmed credential key, a malformed row or
+ * a record of an unknown version all answer `undefined`. For a STATUS READER that is the safe
+ * direction and the honest one: it reports Slack as not installed, which is true as far as this
+ * process can tell, and it cannot report an install that is not there.
+ *
+ * 🔴 THE CLAIM LOCK MUST NOT USE THIS FUNCTION. For the lock, the same collapse is a hole — a store
+ * fault would reopen `/setup`. The lock reads {@link readInstallRecord} instead, which tells the
+ * three cases apart. See its doc comment.
+ */
+export async function slackInstallState(deps = {}) {
+    return (await readInstallRecord(deps)).state;
+}
+/** Read the install record, reporting WHICH of the three outcomes happened. The lock reads this. */
+export async function readInstallRecord(deps = {}) {
+    let raw;
+    try {
+        raw = await vaultOf(deps).read(SLACK_INSTALL_REF);
+    }
+    catch {
+        return { kind: "unreadable", state: undefined };
+    }
+    if (raw === null)
+        return { kind: "absent", state: undefined };
+    const state = parseInstallState(raw);
+    // A row that exists but will not parse is the `unreadable` case, NOT `absent`: something is stored.
+    if (state === undefined)
+        return { kind: "unreadable", state: undefined };
+    return { kind: "present", state };
+}
+/** Parse + validate a stored record. Exported for the suite; `undefined` for anything unreadable. */
+export function parseInstallState(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return undefined;
+    const r = parsed;
+    if (r.v !== 1)
+        return undefined;
+    const str = (k) => (typeof r[k] === "string" && r[k].length > 0 ? r[k] : undefined);
+    const appId = str("appId");
+    const clientId = str("clientId");
+    const teamId = str("teamId");
+    const installerUserId = str("installerUserId");
+    const installedAt = str("installedAt");
+    if (!appId || !clientId || !teamId || !installerUserId || !installedAt)
+        return undefined;
+    const teamName = str("teamName");
+    return {
+        v: 1,
+        appId,
+        clientId,
+        teamId,
+        installerUserId,
+        installedAt,
+        ...(teamName ? { teamName } : {}),
+    };
+}
+/**
+ * Record a completed install. THE LAST WRITE OF A SUCCESSFUL `/setup` RUN — it is what closes the
+ * page, so every secret the install captured must already be stored when this is called.
+ *
+ * Throws whatever the vault throws (a disarmed credential key, an unreachable store). The caller
+ * must NOT swallow it: a run that stored the credentials but failed to record the install has to
+ * say so, because the page is still open and a second run would mint a second Slack app.
+ */
+export async function recordSlackInstall(state, deps = {}) {
+    await vaultOf(deps).write(SLACK_INSTALL_REF, JSON.stringify(state), { connector: "slack", createdBy: "host:slack-setup" });
+}
+/**
+ * REOPEN the setup page: destroy the install record, keeping every stored credential.
+ *
+ * WHY THE LIVE CREDENTIALS STAY. A reopen is "let me run setup again", not "forget this workspace".
+ * The running deployment is still serving Slack with the stored bot token and signing secret while the
+ * admin walks the page, and a reopen that deleted them would take the agent off Slack the moment it
+ * was called. A COMPLETED second run replaces them, at its callback; an abandoned one leaves the
+ * working install untouched, which is true because the create step stages the new signing secret under
+ * {@link SLACK_PENDING_SIGNING_SECRET_REF} rather than writing the live ref.
+ *
+ * What DOES go, besides the record: the setup code (so the reopened page needs a fresh one — see
+ * below) and any stale pending-app material.
+ *
+ * THROWS on a failure to rotate the setup code or the claim cookie key, and leaves the install record
+ * in place when it does — see the body. A reopen that could not rotate must not open the page.
+ *
+ * NO REOPEN HISTORY SURVIVES THIS, deliberately. The record IS the lock, so reopening means
+ * destroying it, and a field recording "reopened at" would have to live on a record that no longer
+ * exists. The audit row is where the history lives (`slack.setup_reopened`, audit/action-registry.ts)
+ * — a hash-chained row naming the admin who called it, which is a better home for that fact than a
+ * field on a row the next install overwrites.
+ *
+ * Returns true iff a record went (false when the page was already open) — idempotent either way.
+ */
+export async function reopenSlackSetup(deps = {}) {
+    const vault = vaultOf(deps);
+    return vault.withLock(SLACK_INSTALL_REF, async () => {
+        // 🔴 THE CLAIM CREDENTIALS DIE BEFORE THE LOCK DOES, and the order is the whole safety property.
+        //
+        // The record IS the lock, so deleting it is what opens the page. An earlier draft deleted it FIRST
+        // and then rotated these two with `.catch(() => undefined)`, returning `true` either way — the
+        // exact inverse of the rule `setup/page.ts` states for the install path. That left a real hole: if
+        // the setup-code delete failed, or the lambda was cut between the two, the page was OPEN with the
+        // PRE-INSTALL code still matching, and that code is in the deployment's log lines from before the
+        // install. Whoever read them could then claim the run.
+        //
+        // So: rotate first, open second, and let a rotation failure THROW. `vault.delete` answers `false`
+        // for an absent row rather than throwing, so the only thing that propagates here is a real store
+        // failure — and on one the record survives, the page stays shut, and the control verb reports the
+        // error instead of a reopen that left the door open.
+        //
+        // `slackSetupCode` returns the STORED value when one exists, so dropping the ref is what makes the
+        // next boot mint and log a fresh code. The cookie key goes with it: a claim cookie minted before
+        // the reopen is signed with that key, so leaving it would let a browser still holding one walk
+        // straight past the code prompt and undo the rotation.
+        await vault.delete(SLACK_SETUP_CODE_REF);
+        await vault.delete(SLACK_COOKIE_KEY_REF);
+        const reopened = await vault.delete(SLACK_INSTALL_REF);
+        // Stale pending-app material, AFTER the record. These two are not credentials and not the lock:
+        // the worst a leftover does is offer the install screen for an app the previous run abandoned, and
+        // a new run overwrites both. So a failure here is swallowed rather than failing the reopen.
+        await vault.delete(SLACK_PENDING_SIGNING_SECRET_REF).catch(() => undefined);
+        await vault.delete(SLACK_PENDING_REF).catch(() => undefined);
+        return reopened;
+    });
+}
+//# sourceMappingURL=install-state.js.map

package/dist/agent/setup/install-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-state.js","sourceRoot":"","sources":["../../../agent/setup/install-state.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,wCAAwC;AACxC,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,uDAAuD;AACvD,EAAE;AACF,sGAAsG;AACtG,sGAAsG;AACtG,iGAAiG;AACjG,+FAA+F;AAC/F,6FAA6F;AAC7F,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,gGAAgG;AAChG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,4CAA4C;AAC5C,EAAE;AACF,8FAA8F;AAC9F,0FAA0F;AAC1F,iGAAiG;AACjG,gFAAgF;AAEhF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAyB,MAAM,4CAA4C,CAAC;AAE9H,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,uBAAuB,eAAe,CAAC;AACjF,gEAAgE;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,uBAAuB,gBAAgB,CAAC;AACnF,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,uBAAuB,WAAW,CAAC;AACzE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,uBAAuB,wBAAwB,CAAC;AACnG,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,uBAAuB,YAAY,CAAC;AAC3E,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,uBAAuB,YAAY,CAAC;AAC3E,iGAAiG;AACjG,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,uBAAuB,SAAS,CAAC;AACrE;;2CAE2C;AAC3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,uBAAuB,SAAS,CAAC;AA6BrE,SAAS,OAAO,CAAC,IAA2B;IAC1C,OAAO,IAAI,CAAC,KAAK,IAAI,gBAAgB,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAI,GAA0B,EAAE;IACtE,OAAO,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC;AAyBD,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAI,GAA0B,EAAE;IACtE,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,oGAAoG;IACpG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACzE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,CAAC,CAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxI,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,eAAe,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACzF,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,KAAK;QACL,QAAQ;QACR,MAAM;QACN,eAAe;QACf,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAwB,EAAE,IAAI,GAA0B,EAAE;IACjG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAC7H,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAI,GAA0B,EAAE;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;QAClD,iGAAiG;QACjG,EAAE;QACF,mGAAmG;QACnG,+FAA+F;QAC/F,mGAAmG;QACnG,kGAAkG;QAClG,kGAAkG;QAClG,uDAAuD;QACvD,EAAE;QACF,kGAAkG;QAClG,iGAAiG;QACjG,kGAAkG;QAClG,qDAAqD;QACrD,EAAE;QACF,mGAAmG;QACnG,iGAAiG;QACjG,+FAA+F;QAC/F,uDAAuD;QACvD,MAAM,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACzC,MAAM,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAEvD,gGAAgG;QAChG,mGAAmG;QACnG,4FAA4F;QAC5F,MAAM,KAAK,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/setup/page.d.ts

@@ -0,0 +1,29 @@
+import { type EncryptedKvVault } from "@open-everywhere/core/agent/adapter-api.js";
+import { type SlackClaimDeps } from "./claim.js";
+import { createSlackApp, exchangeSlackOauthCode } from "./slack-api-setup.js";
+/** The page's route path. */
+export declare const SLACK_SETUP_PATH = "/setup";
+/** The OAuth install redirect's path. Declared in the shipped manifest's `oauth_config.redirect_urls`. */
+export declare const SLACK_SETUP_CALLBACK_PATH = "/setup/callback";
+/** Injectable seams for the suite. */
+export interface SlackSetupPageDeps extends SlackClaimDeps {
+    readonly vault?: EncryptedKvVault;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly createApp?: typeof createSlackApp;
+    readonly exchangeCode?: typeof exchangeSlackOauthCode;
+    readonly keyArmed?: () => boolean;
+}
+/** Render whichever screen this deployment is up to. Every refusal is {@link notAvailable}. */
+export declare function handleSlackSetupGet(req: Request, deps?: SlackSetupPageDeps): Promise<Response>;
+/** Screen 1 and screen 2's submits. */
+export declare function handleSlackSetupPost(req: Request, deps?: SlackSetupPageDeps): Promise<Response>;
+/**
+ * Slack's install redirect. Takes `code` + `state`, exchanges the code, records the install, and
+ * renders screen 4.
+ *
+ * This is the ONE render that happens after the lock closes, and it has to be: recording the install
+ * IS closing the page, and the operator still needs the two config lines. So the handler does its
+ * work and renders, rather than redirecting to a `/setup` that would now 404.
+ */
+export declare function handleSlackSetupCallback(req: Request, deps?: SlackSetupPageDeps): Promise<Response>;
+//# sourceMappingURL=page.d.ts.map

package/dist/agent/setup/page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../agent/setup/page.ts"],"names":[],"mappings":"AA4CA,OAAO,EAWL,KAAK,gBAAgB,EACtB,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAQL,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAYpB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAsB,MAAM,sBAAsB,CAAC;AAElG,6BAA6B;AAC7B,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,0GAA0G;AAC1G,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAoC3D,sCAAsC;AACtC,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC;CACnC;AAsMD,+FAA+F;AAC/F,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoBxG;AAID,uCAAuC;AACvC,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuFzG;AAID;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+H7G"}