@sentropic/h2a-runtime 0.98.7-rc.3 → 0.98.7-rc.4

package/dist/cli-seat-materialization.d.ts

@@ -0,0 +1,245 @@
+import type { SeatCli5, SeatScenario, SyntheticSeatBundleV1 } from "./cli-seat-fixtures.js";
+import { type SyntheticCredentialMaterial } from "./cli-seat-codecs.js";
+export declare class SeatMaterializationError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export type SeatSourceMode = "oauth" | "cli" | "token";
+export interface SourceModeManifest {
+    cli: SeatCli5;
+    mode: SeatSourceMode;
+    circuit: "seat" | "product-oauth";
+    labProfile: string;
+}
+/**
+ * Common source-mode contract (§4.2) for all five CLIs. oauth stays available
+ * as the product enrollment but is never the seat-circuit origin.
+ */
+export declare function resolveSourceMode(cli: string, mode: string, labProfile: string): SourceModeManifest;
+/** Static refusal of credential values in argv: the message never echoes the value. */
+export declare function assertArgvClean(argv: readonly string[], secrets: readonly string[]): void;
+export type BundleValidationCode = "schema-mismatch" | "size-exceeded" | "owner-mismatch" | "client-mismatch" | "unknown-field" | "stale-generation" | "generation-conflict" | "epoch-replacement-required" | "authority-escalation" | "refresh-material-present" | "nested-refresh-field" | "invalid-lifecycle";
+export type BundleValidationResult = {
+    ok: true;
+} | {
+    ok: false;
+    code: BundleValidationCode;
+    detail: string;
+};
+export interface SeatValidationContext {
+    ownerScope?: string;
+    trustedAuthority?: "custodian" | "consumer" | "native-store";
+    issuingClientRef?: string;
+    endpointFamily?: string;
+    predecessor?: StreamPredecessor;
+}
+/** Consumer-channel validation: no refresh material, no authority upgrade from bundle data. */
+export declare function validateSeatBundleForMaterialization(bundle: unknown, context?: SeatValidationContext): BundleValidationResult;
+export interface MaterializeSeatOptions {
+    parentDir: string;
+    mode: SeatSourceMode;
+    labProfile: string;
+    /** Only gateway-off is accepted: the native matrix runs direct. */
+    gateway: "off";
+    /** Serialized-stream delegation under §3.4 (sole temporal holder). */
+    delegate?: boolean;
+    canary?: string;
+    /** Set by a verified channel, never inferred from mode, delegate or bundle. */
+    trustedContext?: SeatValidationContext;
+    /** OS-specific adapter owned by L2a; no Gemini OAuth-file substitution. */
+    keyring?: SyntheticSeatKeyring;
+    streamTicket?: StreamTicket;
+}
+export interface SyntheticSeatKeyring {
+    materialize(input: {
+        canary: string;
+        runDir: string;
+        material: SyntheticCredentialMaterial;
+    }): {
+        profileRef: string;
+        childEnv: Record<string, string>;
+        dispose(): void;
+    };
+}
+export interface SeatReceipt {
+    seatRef: string;
+    familyRef: string;
+    cli: SeatCli5;
+    epoch: number;
+    generation: number;
+    operationId: string;
+    mode: SeatSourceMode;
+    capability: "access-only" | "static-key" | "serialized";
+    os: "linux";
+    outcome: string;
+}
+export interface MaterializedSeat {
+    runId: string;
+    runDir: string;
+    homeDir: string;
+    configDir: string;
+    scenarioRoot: string;
+    credentialPaths: string[];
+    mcpConfigPath: string;
+    childEnv: Record<string, string>;
+    mcpEnv: Record<string, string>;
+    launch: {
+        cli: SeatCli5;
+        binary: string;
+        gateway: "off";
+        hostArgs: string[];
+        mcpArgs: string[];
+    };
+    receipt: SeatReceipt;
+}
+/**
+ * Materialize the native representation per actor after environment capture.
+ * Replaces lab copyLogin: only synthetic stand-ins are written, into a
+ * disposable 0700 run dir. Renewable material requires explicit trusted
+ * channel custody AND serialized delegation, independently of source mode;
+ * consumer access never carries refresh authority.
+ */
+export declare function materializeSeatBundle(bundle: SyntheticSeatBundleV1, options: MaterializeSeatOptions): MaterializedSeat;
+/** Cleanup after capture: stop children first (live), then delete the profile. */
+export declare function destroyMaterializedSeat(seat: MaterializedSeat): void;
+/** Writer/delivery/dispatcher credentials must never reach an h2a/native parent. */
+export declare function assertNoWriterCredentials(env: Readonly<Record<string, string | undefined>>): void;
+/** Redact raw and base64 secret forms; output keeps only static text. */
+export declare function redactSecretsFromText(text: string, secrets: readonly string[]): string;
+/** Strip credential values from env.json material; returns removed names only. */
+export declare function sanitizeEnvJson(env: Readonly<Record<string, string | undefined>>, secrets: readonly string[]): {
+    env: Record<string, string>;
+    removed: string[];
+};
+/** MCP children get an explicit allowlist and closed secret descriptors. */
+export declare function mcpChildEnv(env: Readonly<Record<string, string | undefined>>, secrets?: readonly string[]): Record<string, string>;
+/** Receipts carry metadata only; any credential value fails closed. */
+export declare function assertReceiptClean(receipt: unknown, secrets: readonly string[]): void;
+export declare const SEAT_ALLOWED_MCP_OPS: readonly string[];
+/** Fail-closed tool gate: only h2a MCP scenario operations are allowed. */
+export declare function evaluateToolRequest(cli: SeatCli5, tool: string, scenario?: SeatScenario): "allow" | "deny";
+/** The §6.1 adversarial cell: a peer asking for the credential is refused. */
+export declare function isCredentialRequestText(text: string): boolean;
+export declare function evaluateCredentialRequest(cli: SeatCli5, text: string): {
+    verdict: "refuse" | "unrelated";
+};
+export interface CanaryScan {
+    verdict: "pass" | "fail";
+    checked: string[];
+}
+/**
+ * Synthetic credential-request canary: checks model inputs, transcripts, MCP
+ * traffic and logs for raw/encoded canary forms. Emits pass/fail categories
+ * and surface names only, never intercepted bodies.
+ */
+export declare function scanSurfacesForCanary(surfaces: Readonly<Record<string, string>>, canary: string): CanaryScan;
+export interface StreamPredecessor {
+    epoch: number;
+    generation: number;
+    operationId: string;
+}
+export interface StreamTicket {
+    streamOperationId: string;
+    familyRef: string;
+    predecessor: StreamPredecessor;
+    /** Private ephemeral admission metadata; never included in receipts. */
+    lockDir: string;
+}
+export interface StreamCapture {
+    disposition: "successor-sealed" | "unchanged-validated" | "fenced";
+    scenarioFailed: boolean;
+    requiresWriterJob: boolean;
+    successor?: StreamPredecessor;
+}
+/** §3.4: admit one bounded native process per refresh family. */
+export declare function beginSerializedStream(familyRef: string, predecessor: StreamPredecessor, runtimeDir?: string | undefined): StreamTicket;
+/**
+ * Trusted parent capture after the process and its children stop — including
+ * failed scenarios. Ambiguous provider side effects fence the family.
+ */
+export declare function captureSerializedResult(ticket: StreamTicket, outcome: {
+    failed: boolean;
+    changed: boolean;
+    ambiguous: boolean;
+}): StreamCapture;
+/** The newly queued continuation clears only the exact stream ticket. */
+export declare function validateStreamClearance(ticket: StreamTicket, liveState: {
+    familyRef: string;
+    streamOperationId: string;
+    predecessor: StreamPredecessor;
+    cleanupComplete?: boolean;
+    successorStored?: boolean;
+    successor?: StreamPredecessor;
+}): {
+    cleared: boolean;
+};
+/** Expiry/401 becomes access-unavailable: zero refresh, zero fallback. */
+export declare function classifyAccessFault(fault: {
+    expired?: boolean;
+    status401?: boolean;
+}): "access-unavailable" | "access-ok";
+/** Metadata-only receipt factory (no email, no credential-derived fingerprint). */
+export declare function createSeatReceipt(fields: {
+    seatRef: string;
+    familyRef: string;
+    cli: SeatCli5;
+    epoch: number;
+    generation: number;
+    operationId: string;
+    mode: SeatSourceMode;
+    capability: SeatReceipt["capability"];
+    outcome: string;
+}): SeatReceipt;
+export interface SyntheticCellAdmission {
+    entitlementClass: string;
+    ownerApproved: boolean;
+    q3Approved: boolean;
+    consumedUnits: number;
+    requestedUnits: number;
+}
+/** Offline contract exercise. This function cannot enroll or launch a CLI. */
+export declare function runSyntheticSeatCell(sender: SeatCli5, receiver: SeatCli5, scenario: SeatScenario, options: {
+    parentDir: string;
+    admission: SyntheticCellAdmission;
+    bundles?: readonly (SyntheticSeatBundleV1 | undefined)[];
+}): {
+    sender: SeatCli5;
+    receiver: SeatCli5;
+    scenario: SeatScenario;
+    outcome: string;
+    reason: string;
+    gateway: string;
+    q1ConsumedUnits: number;
+    actors: (SeatReceipt & {
+        runId: string;
+    })[];
+    seatRef: string;
+    peerRef: string;
+    familyRef: string;
+    peerFamilyRef: string;
+} | {
+    sender: SeatCli5;
+    receiver: SeatCli5;
+    scenario: SeatScenario;
+    outcome: string;
+    gateway: string;
+    q1ConsumedUnits: number;
+    actors: {
+        runId: string;
+        seatRef: string;
+        familyRef: string;
+        cli: SeatCli5;
+        epoch: number;
+        generation: number;
+        operationId: string;
+        mode: SeatSourceMode;
+        capability: "access-only" | "static-key" | "serialized";
+        os: "linux";
+        outcome: string;
+    }[];
+    seatRef: string;
+    peerRef: string;
+    familyRef: string;
+    peerFamilyRef: string;
+};
+//# sourceMappingURL=cli-seat-materialization.d.ts.map

package/dist/cli-seat-materialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-seat-materialization.d.ts","sourceRoot":"","sources":["../src/cli-seat-materialization.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE5F,OAAO,EAUL,KAAK,2BAA2B,EACjC,MAAM,sBAAsB,CAAC;AAE9B,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAK1C;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,QAAQ,CAAC;IACd,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,eAAe,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAanG;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAQzF;AAED,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,qBAAqB,GACrB,4BAA4B,GAC5B,sBAAsB,GACtB,0BAA0B,GAC1B,sBAAsB,GACtB,mBAAmB,CAAC;AAExB,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAe9D,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAkBD,+FAA+F;AAC/F,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,sBAAsB,CAmExB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,cAAc,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,OAAO,EAAE,KAAK,CAAC;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,2BAA2B,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,IAAI,IAAI,CAAA;KAAE,CAAC;CAC1K;AAGD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,QAAQ,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,cAAc,CAAC;IACrB,UAAU,EAAE,aAAa,GAAG,YAAY,GAAG,YAAY,CAAC;IACxD,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE;QAAE,GAAG,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjG,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,sBAAsB,GAC9B,gBAAgB,CAoIlB;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAKpE;AAED,oFAAoF;AACpF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,IAAI,CAMjG;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQtF;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAC7B,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACjD,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcpD;AAaD,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOtI;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAOrF;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAsD,CAAC;AAEzG,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,GAAG,MAAM,CAI1G;AAKD,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,QAAQ,GAAG,WAAW,CAAA;CAAE,CAG1G;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC1C,MAAM,EAAE,MAAM,GACb,UAAU,CAQZ;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,kBAAkB,GAAG,qBAAqB,GAAG,QAAQ,CAAC;IACnE,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAaD,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,qBAA8B,GAAG,YAAY,CA4B/I;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GACjE,aAAa,CAef;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,iBAAiB,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAAE,GAC/K;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAoBtB;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,GAAG,WAAW,CAEzH;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,QAAQ,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,cAAc,CAAC;IACrB,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,WAAW,CAEd;AAED,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE;IAC1G,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,sBAAsB,CAAC;IAClC,OAAO,CAAC,EAAE,SAAS,CAAC,qBAAqB,GAAG,SAAS,CAAC,EAAE,CAAC;CAC1D;;;;;;;;YAIsJ,CAAC,WAAW,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE;;;;;;;;;;;;;;iBA5b/K,MAAM;mBACJ,MAAM;aACZ,QAAQ;eACN,MAAM;oBACD,MAAM;qBACL,MAAM;cACb,cAAc;oBACR,aAAa,GAAG,YAAY,GAAG,YAAY;YACnD,OAAO;iBACF,MAAM;;;;;;EA8ehB"}