@substrat-run/kernel 0.116.0 → 0.118.0

package/dist/capability.d.ts

@@ -0,0 +1,220 @@
+import { type BecomeCapabilityInput, type CapabilityExchange, type CapabilityFilter, type CapabilityId, type CapabilityMintInput, type CapabilityRecord, type CheckSubject, type Decision, type DomainEventInput, type EntityRef, type Instant, type MintedCapability, type PermissionKey, type PlatformActorId, type PrincipalId } from '@substrat-run/contracts';
+import type { ScopedSql, SqlValue } from './scope-host.js';
+/**
+ * The two spine tables, kernel-owned so no vertical carries a migration for them. Shared by
+ * both adapters' `KERNEL_DDL` (interpolated, like `IDEMPOTENCY_DDL`), so the shape
+ * self-host builds and the shape production builds cannot part company.
+ */
+export declare const CAPABILITY_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_capabilities (\n    id TEXT PRIMARY KEY,\n    -- #1672: SHA-256 hex of the secret. The secret itself is stored NOWHERE \u2014 it leaves\n    -- the kernel once, in the mint's return value, and a lookup is this indexed equality.\n    token_hash TEXT NOT NULL UNIQUE,\n    -- 'act': the holder acts AS the capability ({ capability } on the spine), bounded by\n    -- entity + permissions (+ operations). 'become': exchanging it yields `principal`.\n    mode TEXT NOT NULL,\n    label TEXT,\n    entity_type TEXT,\n    entity_id TEXT,\n    -- JSON array of permission keys (act). The capability's whole authority: no\n    -- `capability:` tuple is ever written, so none can be forged through the tuple table.\n    permissions TEXT,\n    -- JSON array of operation names, or NULL = any operation the keys allow (act).\n    operations TEXT,\n    principal TEXT,\n    -- JSON capabilityAuthor: a principal id (a module minted it, and its authority is\n    -- re-checked on every use) or {\"platform\": \u2026} (HostAdmin minted it).\n    minted_by TEXT NOT NULL,\n    minted_at TEXT NOT NULL,\n    expires_at TEXT,\n    -- NULL = unlimited. A use is an EXCHANGE of the secret, never an invocation.\n    max_uses INTEGER,\n    uses INTEGER NOT NULL DEFAULT 0,\n    last_used_at TEXT,\n    -- Tombstone, never a delete: a capability that once admitted someone is evidence\n    -- of why they were admitted (K-4, K-21).\n    revoked_at TEXT,\n    revoked_by TEXT\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_capabilities_entity\n    ON _substrat_capabilities (entity_type, entity_id);\n  -- #1672: what an exchange hands out instead of the secret \u2014 a session token, of which\n  -- again only the hash is kept. Each session acts as its capability until the earlier of\n  -- its own expiry and the capability's; the capability is re-read on every invoke, so\n  -- revoking it ends every session at once \u2014 a revoke touches only the capability row,\n  -- and it is that per-invoke read, not a cascade here, that refuses the next call.\n  -- Expired rows are pruned on exchange, at most CAPABILITY_SESSION_PRUNE_BATCH at a time,\n  -- on the only path that adds one \u2014 so an exchange's write is bounded however many expired.\n  CREATE TABLE IF NOT EXISTS _substrat_capability_sessions (\n    token_hash TEXT PRIMARY KEY,\n    capability_id TEXT NOT NULL,\n    created_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_capability_sessions_expiry\n    ON _substrat_capability_sessions (expires_at);\n";
+/** One capability row as the spine stores it — snake_case, because that is what both adapters `SELECT`. */
+export interface CapabilityRow {
+    id: string;
+    mode: string;
+    label: string | null;
+    entity_type: string | null;
+    entity_id: string | null;
+    permissions: string | null;
+    operations: string | null;
+    principal: string | null;
+    minted_by: string;
+    minted_at: string;
+    expires_at: string | null;
+    max_uses: number | null;
+    uses: number;
+    last_used_at: string | null;
+    revoked_at: string | null;
+    revoked_by: string | null;
+}
+/** Every column a read returns — everything but `token_hash`, which no reader has a use for. */
+export declare const CAPABILITY_COLUMNS: string;
+/** The row the permission checker reads for a capability subject (`ScopeTupleReader.capability`). */
+export declare function capabilityByIdQuery(id: string): {
+    sql: string;
+    params: SqlValue[];
+};
+/**
+ * Is this capability USABLE — not revoked, not expired? The ONE predicate for it: the
+ * permission checker, the session door and the exchange all call this, so the three can
+ * never disagree about whether a revoked or expired capability still acts. Same shape as
+ * the evaluator's `live()` for tuples, and ISO instants compare lexically.
+ */
+export declare const capabilityLive: (row: Pick<CapabilityRow, 'revoked_at' | 'expires_at'>, now: string) => boolean;
+/**
+ * May this capability's secret be EXCHANGED now — usable, and under its use limit? The use
+ * limit bounds exchanges only: a session handed out by an earlier exchange keeps acting
+ * after the limit is reached, until the capability expires or is revoked.
+ */
+export declare const capabilityExchangeable: (row: Pick<CapabilityRow, 'revoked_at' | 'expires_at' | 'max_uses' | 'uses'>, now: string) => boolean;
+/**
+ * What an `act` capability grants, decoded for the checker — or `null` for anything that
+ * cannot act (a `become` capability, a row whose JSON does not decode). Null DENIES: a row
+ * the checker cannot read in full grants nothing, rather than whatever part of it parsed.
+ */
+export interface CapabilityGrantView {
+    entity: EntityRef;
+    permissions: PermissionKey[];
+    /** Null when a platform actor minted it — which an `act` capability never is. */
+    mintedBy: PrincipalId | null;
+}
+export declare function capabilityGrantOf(row: CapabilityRow): CapabilityGrantView | null;
+/** The record a caller reads back — never the secret, never its hash. */
+export declare function capabilityRecordOf(row: CapabilityRow): CapabilityRecord;
+/** A fresh capability secret: 256 bits, base64url, prefixed. Only its hash is ever stored. */
+export declare function mintCapabilitySecret(): string;
+/** A fresh session token — the same construction, its own prefix. */
+export declare function mintCapabilitySessionToken(): string;
+/**
+ * SHA-256 hex of a secret or session token (Web Crypto — the same call in workerd, node and
+ * browsers). Unkeyed on purpose: with 256 bits of entropy there is no dictionary to defend
+ * against, and a key would be one more secret to hold and rotate.
+ */
+export declare function capabilityTokenHash(token: string): Promise<string>;
+/**
+ * How many expired sessions one exchange prunes, at most. An unlimited link can hand out any
+ * number of sessions, so pruning every expired row at once would make one visitor's request
+ * an unbounded write — and a Durable Object's transaction a large one. A fixed batch keeps
+ * each exchange's cost constant, and the table still drains: every exchange takes another
+ * batch, and an expired session acts as nobody whether or not it has been pruned yet.
+ */
+export declare const CAPABILITY_SESSION_PRUNE_BATCH = 100;
+/**
+ * The text a value would persist as — ONE serialization of the COMPLETE record, keys
+ * included, byte values decoded as UTF-8. The guard scans this rather than walking chosen
+ * fields, so a secret used as an entity id, a request kind, an object key or a BLOB
+ * parameter is found exactly as one in a payload value is: there is no field list to
+ * forget a field from. The secret's alphabet (base64url behind `sbcap_`) contains nothing
+ * JSON escapes, so the serialization contains the secret exactly when the value does.
+ */
+export declare function persistedText(value: unknown): string;
+/** Does `value`, serialized as it would persist (`persistedText`), contain any of `secrets`? */
+export declare function carriesSecret(value: unknown, secrets: readonly string[]): boolean;
+/** What a recorded response carries in place of a minted secret. */
+export declare const WITHHELD_SECRET = "[capability secret withheld]";
+/**
+ * `value` with every minted secret replaced by `WITHHELD_SECRET` — what an idempotency
+ * recording stores. A replayed mint therefore returns the placeholder, never the secret:
+ * the caller that lost the first response mints again, which is the honest outcome, since
+ * the alternative is a plaintext secret in a spine table for a day.
+ *
+ * Done on the serialization, like the guard, so a secret in a key is withheld as surely as
+ * one in a value. The recording is JSON already, so round-tripping through it changes
+ * nothing the recording would have kept — and a value carrying no secret is returned as is.
+ */
+export declare function redactSecrets<T>(value: T, secrets: readonly string[]): T;
+/**
+ * The tripwire (see above): refuse a write whose COMPLETE record, as it would persist,
+ * carries a secret this invocation minted. Thrown from `ctx.emit` (the whole parsed event),
+ * `ctx.requestPlatform` (the whole parsed request) and `ctx.sql` (the statement and every
+ * parameter, bytes decoded) while the minting invocation runs.
+ */
+export declare function assertNoSecret(where: string, record: unknown, secrets: readonly string[]): void;
+/** `ctx.sql` with every statement — its text and all its parameters — held to `assertNoSecret`. */
+export declare function guardSecrets(inner: ScopedSql, secrets: readonly string[]): ScopedSql;
+/** What an operation handler sees as `ctx.capabilities`. Nothing here checks a permission for the caller — the operation's own `assertAllowed` comes first. */
+export interface CapabilityVerbs {
+    /**
+     * Mint an `act` capability over one entity and return its secret — the only time the
+     * secret exists outside the caller's hands. Build the link from it (as a URL FRAGMENT,
+     * so it never reaches a server log or a `Referer`) and return it once.
+     *
+     * **Delegation, never elevation, and on every use.** Every key is re-checked here on the
+     * entity with the operation's own check, so a principal can only mint what they hold
+     * there; and the checker re-checks the minter on every later use, so a capability never
+     * grants more than its minter holds NOW. Revoke the minter's access and their links stop
+     * granting it.
+     *
+     * Only a principal may mint — a capability, connection or schedule cannot delegate.
+     * Transactional with the operation: a mint whose operation throws never happened.
+     */
+    mint(input: CapabilityMintInput): Promise<MintedCapability>;
+    /**
+     * Revoke an `act` capability. Takes effect on the very next check, for every session it
+     * handed out. Allowed to anyone who could have minted it — every key it carries, held on
+     * its entity — which is `ctx.revoke`'s rule. Idempotent on an already-revoked one.
+     */
+    revoke(id: CapabilityId): Promise<void>;
+    /** This scope's capabilities, newest first. Revoked ones only when asked for. */
+    list(filter?: CapabilityFilter): CapabilityRecord[];
+}
+export interface CapabilityVerbDeps {
+    /** RAW spine access inside the operation's own transaction — not the guarded `ctx.sql`. */
+    sql: ScopedSql;
+    /** Who is minting. */
+    subject: CheckSubject;
+    /** The operation's instant. */
+    now: Instant;
+    /** The operation's OWN check — the same one `ctx.check` and `ctx.grant` use. */
+    check: (permission: PermissionKey, entity?: EntityRef) => Promise<Decision>;
+    /** `ctx.emit` — stamps the minter as actor, K-34 authorization, the operation. */
+    emit: (event: DomainEventInput) => void;
+    /** Is this an operation registered on this host? An allowlist naming none is a typo. */
+    isOperation: (name: string) => boolean;
+    /** K-42's read-only refusal, for the effecting verbs. */
+    assertWrites: (verb: string) => void;
+    /** This invocation's minted secrets — appended to by `mint`, read by the secret guards. */
+    minted: string[];
+}
+export declare function createCapabilityVerbs(deps: CapabilityVerbDeps): CapabilityVerbs;
+/** The pseudo-operation an exchange's spine event names, on `attachments.upload`'s pattern. */
+export declare const CAPABILITY_EXCHANGE_OPERATION = "capabilities.exchange";
+/**
+ * Trade a secret for what it grants — ONE counted use. Runs inside the scope's
+ * serialization domain and a transaction the adapter opened; `emit` writes the
+ * `capability.exercised` event with the capability as its actor.
+ *
+ * The use is taken with an `UPDATE … WHERE uses = ?` on the row just read, so it is atomic
+ * even without the scope's single-writer guarantee: two exchanges racing for a single-use
+ * capability cannot both see `uses = 0` and both win.
+ *
+ * `null` for an unknown, expired, revoked or used-up secret — one answer for all four, so
+ * a caller probing for secrets learns nothing it can act on. Refused exchanges are not
+ * recorded: their volume is whatever an attacker chooses, and with 256 bits of entropy
+ * there is nothing a record of guesses would ever show (#130 is the rate control).
+ */
+export declare function exchangeCapability(deps: {
+    sql: ScopedSql;
+    now: Instant;
+    emit: (capability: CapabilityId, event: DomainEventInput) => void;
+}, secret: unknown, 
+/**
+ * The only mode the caller can handle. A secret of the OTHER mode answers `null` without
+ * taking a use: a claim link pasted into a share-link exchange must not be spent by a
+ * route that would then throw away the principal it yielded.
+ */
+mode?: 'act' | 'become'): Promise<CapabilityExchange | null>;
+/**
+ * The session door's decision, re-made on EVERY invoke inside the operation's transaction
+ * (impersonation's per-invoke re-read, for the same reason): a stub is a capability of its
+ * own and nothing takes it away, so a revocation checked only when the stub was minted
+ * would stop everyone except the one caller holding it.
+ *
+ * Refuses an unknown or expired session and a revoked or expired capability as
+ * `unauthenticated` — the credential no longer works, and re-opening a live link is the
+ * remedy — and an operation outside the capability's allowlist as `forbidden`. None of
+ * these is a K-35 denial: no permission key was checked, and the denial log records
+ * enforced checks. The handler's own checks, once it runs, are.
+ */
+export declare function resolveCapabilitySession(sql: ScopedSql, sessionHash: string, now: Instant, operation: string): CapabilityId;
+/** Is `token` shaped like a session token at all? Checked before it is hashed or sent anywhere. */
+export declare const plausibleSessionToken: (token: unknown) => token is string;
+/**
+ * The platform's mint (`HostAdmin.mintCapability`) — a `become` capability, which is the
+ * only kind the platform mints and the only way one is minted in this first cut (see
+ * `becomeCapabilityInput`). No spine event: a platform actor's act is the admin log's to
+ * record, and the adapter records it there.
+ */
+/**
+ * A platform mint's input, parsed and held to its one rule beyond the shape: an expiry in
+ * the future. Its own function so a host whose storage sits across an RPC boundary can run
+ * it on the near side, where a typed refusal still reaches the caller as one — the same
+ * check `mintBecomeCapability` makes, not a second copy of it.
+ */
+export declare function checkBecomeInput(raw: BecomeCapabilityInput, now: Instant): BecomeCapabilityInput;
+export declare function mintBecomeCapability(sql: ScopedSql, raw: BecomeCapabilityInput, actor: PlatformActorId, now: Instant): Promise<MintedCapability>;
+/**
+ * The platform's revoke (`HostAdmin.revokeCapability`) — of any capability in the scope,
+ * the operator's lever for a leaked link. Returns the row as it stood before, for the admin
+ * log, or `undefined` when there is no such capability. Idempotent.
+ */
+export declare function revokeCapabilityAsPlatform(sql: ScopedSql, rawId: string, actor: PlatformActorId, now: Instant): CapabilityRecord | undefined;
+//# sourceMappingURL=capability.d.ts.map

package/dist/capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAgBL,KAAK,qBAAqB,EAE1B,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EAExB,KAAK,gBAAgB,EAErB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA2C3D;;;;GAIG;AACH,eAAO,MAAM,cAAc,6hFAiD1B,CAAC;AAEF,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,QAEgD,CAAC;AAEhF,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAKnF;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QACpB,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC,OAChD,MAAM,KACV,OAAuF,CAAC;AAE3F;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAC5B,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC,OACtE,MAAM,KACV,OAAyF,CAAC;AAE7F;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,mBAAmB,GAAG,IAAI,CAehF;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB,CAwBvE;AAQD,8FAA8F;AAC9F,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,qEAAqE;AACrE,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKxE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AA8BlD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQpD;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIjF;AAED,oEAAoE;AACpE,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,CAKxE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAS/F;AAED,mGAAmG;AACnG,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAWpF;AAMD,+JAA+J;AAC/J,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5D;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;CACrD;AAED,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,GAAG,EAAE,SAAS,CAAC;IACf,sBAAsB;IACtB,OAAO,EAAE,YAAY,CAAC;IACtB,+BAA+B;IAC/B,GAAG,EAAE,OAAO,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,kFAAkF;IAClF,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACxC,wFAAwF;IACxF,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,yDAAyD;IACzD,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAgBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAiJ/E;AAMD,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IACJ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACnE,EACD,MAAM,EAAE,OAAO;AACf;;;;GAIG;AACH,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,GACtB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0EpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,GAChB,YAAY,CAyBd;AAED,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,UAAW,OAAO,KAAG,KAAK,IAAI,MACnB,CAAC;AAE9C;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAShG;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,qBAAqB,EAC1B,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,gBAAgB,CAAC,CAsB3B;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,gBAAgB,GAAG,SAAS,CAY9B"}