@yielded/auth 0.1.0-beta.1

package/dist/sessions/models.d.mts

@@ -0,0 +1,143 @@
+import { AuthenticationAssurance } from "../operations/context.mjs";
+import { Schema } from "effect";
+//#region src/sessions/models.d.ts
+declare const SessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+type SessionId = typeof SessionId.Type;
+declare const SecurityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+type SecurityRevision = typeof SecurityRevision.Type;
+declare const AuthenticationFlowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+type AuthenticationFlowId = typeof AuthenticationFlowId.Type;
+declare const CredentialRevision: Schema.Struct<{
+  readonly credentialId: Schema.NonEmptyString;
+  readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+}>;
+type CredentialRevision = typeof CredentialRevision.Type;
+/** Captured by the method's authority before cryptographic credential verification begins. */
+declare const AuthenticationRevision: Schema.Struct<{
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly credentials: Schema.$Array<Schema.Struct<{
+    readonly credentialId: Schema.NonEmptyString;
+    readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  }>>;
+}>;
+type AuthenticationRevision = typeof AuthenticationRevision.Type;
+declare const AuthenticationProof: Schema.Struct<{
+  readonly method: Schema.NonEmptyString;
+  /** Distinguishes independently verified credentials without exposing credential material. */
+  readonly credentialId: Schema.NonEmptyString;
+  readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+  readonly userVerified: Schema.Boolean;
+  readonly phishingResistant: Schema.Boolean;
+  readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+}>;
+type AuthenticationProof = typeof AuthenticationProof.Type;
+/** Trusted method evidence. No public endpoint accepts subject/factor assertions as proof. */
+declare const AuthenticationEvidence: Schema.Struct<{
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+  readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+    readonly method: Schema.NonEmptyString;
+    /** Distinguishes independently verified credentials without exposing credential material. */
+    readonly credentialId: Schema.NonEmptyString;
+    readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+    readonly userVerified: Schema.Boolean;
+    readonly phishingResistant: Schema.Boolean;
+    readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+  }>>;
+}>;
+type AuthenticationEvidence = typeof AuthenticationEvidence.Type;
+/** Private authenticated source evidence. Never derive this from public metadata. */
+declare const SessionAuthenticationProvenance: Schema.Struct<{
+  readonly evidence: Schema.Struct<{
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+      readonly method: Schema.NonEmptyString;
+      /** Distinguishes independently verified credentials without exposing credential material. */
+      readonly credentialId: Schema.NonEmptyString;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+    }>>;
+  }>;
+}>;
+type SessionAuthenticationProvenance = typeof SessionAuthenticationProvenance.Type;
+/** Identifies the exact issued credential, independently of storage CAS versions. */
+declare const SessionCredentialVersion: Schema.brand<Schema.String, "effect-auth/SessionCredentialVersion">;
+type SessionCredentialVersion = typeof SessionCredentialVersion.Type;
+declare const AssuranceAlternative: Schema.Struct<{
+  readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+  readonly userVerified: Schema.Boolean;
+  readonly phishingResistant: Schema.Boolean;
+  readonly minimumCredentials: Schema.Int;
+}>;
+declare const AuthenticationRequirement: Schema.Struct<{
+  readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+    readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+    readonly userVerified: Schema.Boolean;
+    readonly phishingResistant: Schema.Boolean;
+    readonly minimumCredentials: Schema.Int;
+  }>>;
+  readonly maximumAgeMillis: Schema.Int;
+}>;
+type AuthenticationRequirement = typeof AuthenticationRequirement.Type;
+declare const SessionMetadata: Schema.Struct<{
+  readonly sessionId: Schema.brand<Schema.NonEmptyString, "effect-auth/SessionId">;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly assurance: typeof AuthenticationAssurance;
+  readonly issuedAt: Schema.DateTimeUtcFromMillis;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  readonly absoluteExpiresAt: Schema.DateTimeUtcFromMillis;
+}>;
+type SessionMetadata = typeof SessionMetadata.Type;
+interface SessionInspection<Claims> {
+  readonly session: SessionMetadata & {
+    readonly claims: Claims;
+  };
+  readonly provenance: SessionAuthenticationProvenance;
+  readonly credentialVersion: SessionCredentialVersion;
+}
+declare const PendingConsumption: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+  readonly digest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly version: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+}>;
+type PendingConsumption = typeof PendingConsumption.Type;
+declare const SessionSignOut: Schema.Struct<{
+  readonly clearCredential: Schema.Literal<true>;
+  readonly invalidation: Schema.Literals<readonly ["revoked", "already-invalid", "client-only"]>;
+}>;
+type SessionSignOut = typeof SessionSignOut.Type;
+declare const SessionCapabilities: Schema.Struct<{
+  readonly mode: Schema.Literals<readonly ["stateful", "stateless", "state-assisted"]>;
+  readonly listing: Schema.Boolean;
+  readonly perSessionRevocation: Schema.Boolean;
+  readonly subjectInvalidation: Schema.Literals<readonly ["immediate", "absolute-expiry"]>;
+  readonly renewal: Schema.Literals<readonly ["single-winner", "replayable"]>;
+  /** Default authoritative checks never reuse positive authorization caches. */
+  readonly positiveCacheMillis: Schema.Literal<0>;
+}>;
+type SessionCapabilities = typeof SessionCapabilities.Type;
+//#endregion
+export { AssuranceAlternative, AuthenticationEvidence, AuthenticationFlowId, AuthenticationProof, AuthenticationRequirement, AuthenticationRevision, CredentialRevision, PendingConsumption, SecurityRevision, SessionAuthenticationProvenance, SessionCapabilities, SessionCredentialVersion, SessionId, SessionInspection, SessionMetadata, SessionSignOut };
+//# sourceMappingURL=models.d.mts.map

package/dist/sessions/models.mjs

@@ -0,0 +1,94 @@
+import { SubjectId, TokenDigest } from "../Schema.mjs";
+import { AuthenticationAssurance, AuthenticationFactor } from "../operations/context.mjs";
+import { Schema } from "effect";
+//#region src/sessions/models.ts
+const SessionId = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/SessionId"));
+const SecurityRevision = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/SecurityRevision"));
+const AuthenticationFlowId = Schema.NonEmptyString.pipe(Schema.brand("effect-auth/AuthenticationFlowId"));
+const CredentialRevision = Schema.Struct({
+	credentialId: Schema.NonEmptyString,
+	revision: SecurityRevision
+});
+/** Captured by the method's authority before cryptographic credential verification begins. */
+const AuthenticationRevision = Schema.Struct({
+	subjectId: SubjectId,
+	securityRevision: SecurityRevision,
+	credentials: Schema.Array(CredentialRevision).check(Schema.isMaxLength(64))
+});
+const AuthenticationProof = Schema.Struct({
+	method: Schema.NonEmptyString,
+	/** Distinguishes independently verified credentials without exposing credential material. */
+	credentialId: Schema.NonEmptyString,
+	factors: Schema.Array(AuthenticationFactor),
+	userVerified: Schema.Boolean,
+	phishingResistant: Schema.Boolean,
+	verifiedAt: Schema.DateTimeUtcFromMillis
+});
+/** Trusted method evidence. No public endpoint accepts subject/factor assertions as proof. */
+const AuthenticationEvidence = Schema.Struct({
+	revision: AuthenticationRevision,
+	flowId: AuthenticationFlowId,
+	bindingDigest: TokenDigest,
+	proofs: Schema.NonEmptyArray(AuthenticationProof).check(Schema.isMaxLength(64))
+});
+/** Private authenticated source evidence. Never derive this from public metadata. */
+const SessionAuthenticationProvenance = Schema.Struct({ evidence: Schema.Struct({
+	...AuthenticationEvidence.fields,
+	revision: Schema.Struct({
+		...AuthenticationRevision.fields,
+		credentials: Schema.Array(CredentialRevision).check(Schema.isMaxLength(64))
+	}),
+	proofs: Schema.NonEmptyArray(AuthenticationProof).check(Schema.isMaxLength(64))
+}) });
+/** Identifies the exact issued credential, independently of storage CAS versions. */
+const SessionCredentialVersion = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("effect-auth/SessionCredentialVersion"));
+const AssuranceAlternative = Schema.Struct({
+	factors: Schema.Array(AuthenticationFactor),
+	userVerified: Schema.Boolean,
+	phishingResistant: Schema.Boolean,
+	minimumCredentials: Schema.Int.check(Schema.isGreaterThan(0))
+});
+const AuthenticationRequirement = Schema.Struct({
+	alternatives: Schema.NonEmptyArray(AssuranceAlternative),
+	maximumAgeMillis: Schema.Int.check(Schema.isGreaterThan(0))
+});
+const SessionMetadata = Schema.Struct({
+	sessionId: SessionId,
+	subjectId: SubjectId,
+	securityRevision: SecurityRevision,
+	assurance: AuthenticationAssurance,
+	issuedAt: Schema.DateTimeUtcFromMillis,
+	expiresAt: Schema.DateTimeUtcFromMillis,
+	absoluteExpiresAt: Schema.DateTimeUtcFromMillis
+});
+const PendingConsumption = Schema.Struct({
+	flowId: AuthenticationFlowId,
+	digest: TokenDigest,
+	bindingDigest: TokenDigest,
+	version: SecurityRevision
+});
+const SessionSignOut = Schema.Struct({
+	clearCredential: Schema.Literal(true),
+	invalidation: Schema.Literals([
+		"revoked",
+		"already-invalid",
+		"client-only"
+	])
+});
+const SessionCapabilities = Schema.Struct({
+	mode: Schema.Literals([
+		"stateful",
+		"stateless",
+		"state-assisted"
+	]),
+	listing: Schema.Boolean,
+	perSessionRevocation: Schema.Boolean,
+	subjectInvalidation: Schema.Literals(["immediate", "absolute-expiry"]),
+	renewal: Schema.Literals(["single-winner", "replayable"]),
+	/** Default authoritative checks never reuse positive authorization caches. */
+	positiveCacheMillis: Schema.Literal(0)
+});
+//#endregion
+export { AssuranceAlternative, AuthenticationEvidence, AuthenticationFlowId, AuthenticationProof, AuthenticationRequirement, AuthenticationRevision, CredentialRevision, PendingConsumption, SecurityRevision, SessionAuthenticationProvenance, SessionCapabilities, SessionCredentialVersion, SessionId, SessionMetadata, SessionSignOut };
+
+//# sourceMappingURL=models.mjs.map

package/dist/sessions/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../src/sessions/models.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { AuthenticationAssurance, AuthenticationFactor } from \"../operations/context\";\nimport { SubjectId, TokenDigest } from \"../Schema\";\n\nexport const SessionId = Schema.NonEmptyString.pipe(Schema.brand(\"effect-auth/SessionId\"));\nexport type SessionId = typeof SessionId.Type;\n\nexport const SecurityRevision = Schema.NonEmptyString.pipe(\n  Schema.brand(\"effect-auth/SecurityRevision\"),\n);\n\nexport type SecurityRevision = typeof SecurityRevision.Type;\n\nexport const AuthenticationFlowId = Schema.NonEmptyString.pipe(\n  Schema.brand(\"effect-auth/AuthenticationFlowId\"),\n);\n\nexport type AuthenticationFlowId = typeof AuthenticationFlowId.Type;\n\nexport const CredentialRevision = Schema.Struct({\n  credentialId: Schema.NonEmptyString,\n  revision: SecurityRevision,\n});\n\nexport type CredentialRevision = typeof CredentialRevision.Type;\n\n/** Captured by the method's authority before cryptographic credential verification begins. */\nexport const AuthenticationRevision = Schema.Struct({\n  subjectId: SubjectId,\n  securityRevision: SecurityRevision,\n  credentials: Schema.Array(CredentialRevision).check(Schema.isMaxLength(64)),\n});\n\nexport type AuthenticationRevision = typeof AuthenticationRevision.Type;\n\nexport const AuthenticationProof = Schema.Struct({\n  method: Schema.NonEmptyString,\n  /** Distinguishes independently verified credentials without exposing credential material. */\n  credentialId: Schema.NonEmptyString,\n  factors: Schema.Array(AuthenticationFactor),\n  userVerified: Schema.Boolean,\n  phishingResistant: Schema.Boolean,\n  verifiedAt: Schema.DateTimeUtcFromMillis,\n});\n\nexport type AuthenticationProof = typeof AuthenticationProof.Type;\n\n/** Trusted method evidence. No public endpoint accepts subject/factor assertions as proof. */\nexport const AuthenticationEvidence = Schema.Struct({\n  revision: AuthenticationRevision,\n  flowId: AuthenticationFlowId,\n  bindingDigest: TokenDigest,\n  proofs: Schema.NonEmptyArray(AuthenticationProof).check(Schema.isMaxLength(64)),\n});\n\nexport type AuthenticationEvidence = typeof AuthenticationEvidence.Type;\n\n/** Private authenticated source evidence. Never derive this from public metadata. */\nexport const SessionAuthenticationProvenance = Schema.Struct({\n  evidence: Schema.Struct({\n    ...AuthenticationEvidence.fields,\n    revision: Schema.Struct({\n      ...AuthenticationRevision.fields,\n      credentials: Schema.Array(CredentialRevision).check(Schema.isMaxLength(64)),\n    }),\n    proofs: Schema.NonEmptyArray(AuthenticationProof).check(Schema.isMaxLength(64)),\n  }),\n});\n\nexport type SessionAuthenticationProvenance = typeof SessionAuthenticationProvenance.Type;\n\n/** Identifies the exact issued credential, independently of storage CAS versions. */\nexport const SessionCredentialVersion = Schema.String.check(\n  Schema.isPattern(/^[A-Za-z0-9_-]{43}$/),\n).pipe(Schema.brand(\"effect-auth/SessionCredentialVersion\"));\n\nexport type SessionCredentialVersion = typeof SessionCredentialVersion.Type;\n\nexport const AssuranceAlternative = Schema.Struct({\n  factors: Schema.Array(AuthenticationFactor),\n  userVerified: Schema.Boolean,\n  phishingResistant: Schema.Boolean,\n  minimumCredentials: Schema.Int.check(Schema.isGreaterThan(0)),\n});\n\nexport const AuthenticationRequirement = Schema.Struct({\n  alternatives: Schema.NonEmptyArray(AssuranceAlternative),\n  maximumAgeMillis: Schema.Int.check(Schema.isGreaterThan(0)),\n});\n\nexport type AuthenticationRequirement = typeof AuthenticationRequirement.Type;\n\nexport const SessionMetadata = Schema.Struct({\n  sessionId: SessionId,\n  subjectId: SubjectId,\n  securityRevision: SecurityRevision,\n  assurance: AuthenticationAssurance,\n  issuedAt: Schema.DateTimeUtcFromMillis,\n  expiresAt: Schema.DateTimeUtcFromMillis,\n  absoluteExpiresAt: Schema.DateTimeUtcFromMillis,\n});\n\nexport type SessionMetadata = typeof SessionMetadata.Type;\n\nexport interface SessionInspection<Claims> {\n  readonly session: SessionMetadata & { readonly claims: Claims };\n  readonly provenance: SessionAuthenticationProvenance;\n  readonly credentialVersion: SessionCredentialVersion;\n}\n\nexport const PendingConsumption = Schema.Struct({\n  flowId: AuthenticationFlowId,\n  digest: TokenDigest,\n  bindingDigest: TokenDigest,\n  version: SecurityRevision,\n});\n\nexport type PendingConsumption = typeof PendingConsumption.Type;\n\nexport const SessionSignOut = Schema.Struct({\n  clearCredential: Schema.Literal(true),\n  invalidation: Schema.Literals([\"revoked\", \"already-invalid\", \"client-only\"]),\n});\n\nexport type SessionSignOut = typeof SessionSignOut.Type;\n\nexport const SessionCapabilities = Schema.Struct({\n  mode: Schema.Literals([\"stateful\", \"stateless\", \"state-assisted\"]),\n  listing: Schema.Boolean,\n  perSessionRevocation: Schema.Boolean,\n  subjectInvalidation: Schema.Literals([\"immediate\", \"absolute-expiry\"]),\n  renewal: Schema.Literals([\"single-winner\", \"replayable\"]),\n  /** Default authoritative checks never reuse positive authorization caches. */\n  positiveCacheMillis: Schema.Literal(0),\n});\n\nexport type SessionCapabilities = typeof SessionCapabilities.Type;\n"],"mappings":";;;;AAKA,MAAa,YAAY,OAAO,eAAe,KAAK,OAAO,MAAM,uBAAuB,CAAC;AAGzF,MAAa,mBAAmB,OAAO,eAAe,KACpD,OAAO,MAAM,8BAA8B,CAC7C;AAIA,MAAa,uBAAuB,OAAO,eAAe,KACxD,OAAO,MAAM,kCAAkC,CACjD;AAIA,MAAa,qBAAqB,OAAO,OAAO;CAC9C,cAAc,OAAO;CACrB,UAAU;AACZ,CAAC;;AAKD,MAAa,yBAAyB,OAAO,OAAO;CAClD,WAAW;CACX,kBAAkB;CAClB,aAAa,OAAO,MAAM,kBAAkB,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;AAC5E,CAAC;AAID,MAAa,sBAAsB,OAAO,OAAO;CAC/C,QAAQ,OAAO;;CAEf,cAAc,OAAO;CACrB,SAAS,OAAO,MAAM,oBAAoB;CAC1C,cAAc,OAAO;CACrB,mBAAmB,OAAO;CAC1B,YAAY,OAAO;AACrB,CAAC;;AAKD,MAAa,yBAAyB,OAAO,OAAO;CAClD,UAAU;CACV,QAAQ;CACR,eAAe;CACf,QAAQ,OAAO,cAAc,mBAAmB,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;AAChF,CAAC;;AAKD,MAAa,kCAAkC,OAAO,OAAO,EAC3D,UAAU,OAAO,OAAO;CACtB,GAAG,uBAAuB;CAC1B,UAAU,OAAO,OAAO;EACtB,GAAG,uBAAuB;EAC1B,aAAa,OAAO,MAAM,kBAAkB,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAC5E,CAAC;CACD,QAAQ,OAAO,cAAc,mBAAmB,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;AAChF,CAAC,EACH,CAAC;;AAKD,MAAa,2BAA2B,OAAO,OAAO,MACpD,OAAO,UAAU,qBAAqB,CACxC,CAAC,CAAC,KAAK,OAAO,MAAM,sCAAsC,CAAC;AAI3D,MAAa,uBAAuB,OAAO,OAAO;CAChD,SAAS,OAAO,MAAM,oBAAoB;CAC1C,cAAc,OAAO;CACrB,mBAAmB,OAAO;CAC1B,oBAAoB,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AAC9D,CAAC;AAED,MAAa,4BAA4B,OAAO,OAAO;CACrD,cAAc,OAAO,cAAc,oBAAoB;CACvD,kBAAkB,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AAC5D,CAAC;AAID,MAAa,kBAAkB,OAAO,OAAO;CAC3C,WAAW;CACX,WAAW;CACX,kBAAkB;CAClB,WAAW;CACX,UAAU,OAAO;CACjB,WAAW,OAAO;CAClB,mBAAmB,OAAO;AAC5B,CAAC;AAUD,MAAa,qBAAqB,OAAO,OAAO;CAC9C,QAAQ;CACR,QAAQ;CACR,eAAe;CACf,SAAS;AACX,CAAC;AAID,MAAa,iBAAiB,OAAO,OAAO;CAC1C,iBAAiB,OAAO,QAAQ,IAAI;CACpC,cAAc,OAAO,SAAS;EAAC;EAAW;EAAmB;CAAa,CAAC;AAC7E,CAAC;AAID,MAAa,sBAAsB,OAAO,OAAO;CAC/C,MAAM,OAAO,SAAS;EAAC;EAAY;EAAa;CAAgB,CAAC;CACjE,SAAS,OAAO;CAChB,sBAAsB,OAAO;CAC7B,qBAAqB,OAAO,SAAS,CAAC,aAAa,iBAAiB,CAAC;CACrE,SAAS,OAAO,SAAS,CAAC,iBAAiB,YAAY,CAAC;;CAExD,qBAAqB,OAAO,QAAQ,CAAC;AACvC,CAAC"}