@zitadel/config 1.0.0-alpha.21 → 1.0.0-alpha.23

package/meta-schemas/idp-connection.json

@@ -0,0 +1,397 @@
+{
+  "$comment": "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "IdentityProviderConnection",
+  "type": "object",
+  "required": [
+    "slug",
+    "protocol",
+    "display_name"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Editor affordance: path or URL of this schema so editors validate and autocomplete the file (scaffolded connection files point at `.zitadel/meta/idp-connection.json`). Ignored by the platform."
+    },
+    "slug": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9_-]*$",
+      "maxLength": 64,
+      "description": "Stable identifier, referenced by user schemas (x-auth-methods.sso.providers) and flow steps (sso_providers). Unique within the Project.",
+      "examples": [
+        "google",
+        "github",
+        "corp_idp"
+      ]
+    },
+    "protocol": {
+      "type": "string",
+      "enum": [
+        "oidc",
+        "oauth2"
+      ],
+      "description": "The protocol used by the identity provider."
+    },
+    "template": {
+      "type": "string",
+      "examples": [
+        "google",
+        "github",
+        "okta"
+      ],
+      "description": "Template hint for rendering the provider (logo, colors). Carries no protocol behavior: conduct comes only from the protocol blocks."
+    },
+    "display_name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "Shown to the user on the sign-in button."
+    },
+    "subject_claim": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Claim carrying the provider's stable subject identifier. Optional for OIDC (the engine uses `sub` per spec; override where `sub` is pairwise, e.g. Entra `oid`). Required for OAuth2 — no `sub` guarantee."
+    },
+    "claim_mapping": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string",
+        "pattern": "^[^$]"
+      },
+      "description": "Maps user-schema property names (keys) to provider claim names (values). A value is an exact top-level claim key: no path syntax, and a dot is part of the key, so nested claims (OIDC `address`, GitHub `plan`) are not addressable yet. `$`-prefixed strings and non-string values are reserved for future mapping forms. Add properties defined in the user schemas; unmatched entries are ignored."
+    },
+    "verified_claims": {
+      "type": "object",
+      "additionalProperties": {
+        "anyOf": [
+          {
+            "const": true
+          },
+          {
+            "const": "$supplementary_fetch"
+          },
+          {
+            "type": "string",
+            "pattern": "^[^$]"
+          }
+        ]
+      },
+      "description": "Maps a verifiable user-schema property to its verification source: a claim name (read the claim), the literal `true` (trust this provider unconditionally), or the `$`-pointer `\"$supplementary_fetch\"` (verified by the selected supplementary_fetch strategy per its contract - e.g. github_primary_email verifies `email` via primary && verified). Values starting with `$` are reserved; only `$supplementary_fetch` is defined. Distinct from claim_mapping, which carries values, not verification state.",
+      "examples": [
+        {
+          "email": "email_verified"
+        },
+        {
+          "email": true
+        },
+        {
+          "email": "$supplementary_fetch"
+        }
+      ]
+    },
+    "provisioning": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "How far this provider's data is trusted. `creation` defines what happens to a subject that has no account yet. With `disabled`, a user is not created. With `auto`, the user is created without a collection step when the mapped claims fill every required property of the schema. A required property with an `x-unique` scope must also arrive verified according to `verified_claims`. When a required property is missing or such a property is unverified, the collection step is shown instead, prefilled with the claims. Gating on other properties will be added when `x-verify` returns to the dialect. The following are deferred and will be added as additive changes. The `auto_only` value creates the user from complete claims or fails without collecting. The linking policy (`is_linking_allowed`, `auto_linking`), together with the account-linking journey. `is_auto_update`, together with per-property verification state.",
+      "properties": {
+        "creation": {
+          "type": "string",
+          "enum": [
+            "disabled",
+            "auto"
+          ],
+          "default": "auto"
+        }
+      }
+    },
+    "oidc": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "OIDC connection details. Endpoints come from discovery, but any may be supplied to override it, or to serve a provider that exposes no .well-known document.",
+      "required": [
+        "issuer",
+        "client_id",
+        "client_secret",
+        "scopes"
+      ],
+      "properties": {
+        "issuer": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)(/[^\\s?#]*)?$",
+          "description": "Discovery base. Endpoints are resolved from its .well-known document unless overridden below."
+        },
+        "jwks_uri": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+          "description": "Overrides the JWKS endpoint from discovery. Required in practice when the provider exposes no .well-known document, since ID tokens cannot otherwise be validated."
+        },
+        "id_token_mapping": {
+          "type": "boolean",
+          "default": false,
+          "description": "Read user claims from the id_token instead of the userinfo endpoint, for providers that populate only the former."
+        },
+        "authorization_endpoint": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+          "description": "Overrides discovery."
+        },
+        "token_endpoint": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+          "description": "Overrides discovery."
+        },
+        "userinfo_endpoint": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+          "description": "Overrides discovery."
+        },
+        "client_id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "Either a literal in case the same client is used in all environments, or a `${{ NAME }}` reference to a variable in case of separate clients per environment."
+        },
+        "client_secret": {
+          "type": "string",
+          "pattern": "^\\$\\{\\{ *[A-Za-z0-9_]+ *\\}\\}$",
+          "description": "A reference to the variable holding the client secret, never the secret itself. A secret may only be referenced as the entire value: text around the placeholder would be rendered into the resolved credential, so it is rejected. The engine resolves it against the environment serving the request."
+        },
+        "token_endpoint_auth_method": {
+          "type": "string",
+          "enum": [
+            "client_secret_basic",
+            "client_secret_post"
+          ],
+          "default": "client_secret_basic",
+          "description": "How the client authenticates at the token endpoint."
+        },
+        "scopes": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true,
+          "minItems": 1,
+          "contains": {
+            "const": "openid"
+          },
+          "default": [
+            "openid",
+            "profile",
+            "email"
+          ],
+          "description": "Must contain `openid` - without it the provider returns no id_token and the connection is not OIDC. Enforced by `required` + `contains`; the `default` is a UI-prefill hint only - validators never inject it, so an omitted `scopes` is rejected regardless."
+        },
+        "pkce_enabled": {
+          "type": "boolean",
+          "default": true,
+          "description": "Send PKCE (code_challenge/code_verifier). Providers that do not support PKCE typically ignore the parameters, so `true` is safe and future-proofs; set `false` only for a provider whose token endpoint rejects them."
+        },
+        "static_authorize_parameters": {
+          "type": "object",
+          "propertyNames": {
+            "minLength": 1,
+            "not": {
+              "enum": [
+                "client_id",
+                "redirect_uri",
+                "response_type",
+                "scope",
+                "state",
+                "nonce",
+                "code_challenge",
+                "code_challenge_method",
+                "response_mode",
+                "request",
+                "request_uri",
+                "client_secret",
+                "client_assertion"
+              ]
+            }
+          },
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Extra provider-specific authorize parameters (for example `prompt`). Engine-owned protocol parameters are reserved and rejected by `propertyNames`: the engine composes them itself, and an override of `state` or `nonce` would silently defeat CSRF and token binding. `client_secret` and `client_assertion` are rejected as they could be appended to the public authorize URL."
+        }
+      }
+    },
+    "oauth2": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "OAuth 2.0 connection details.",
+      "required": [
+        "authorization_endpoint",
+        "token_endpoint",
+        "userinfo_endpoint",
+        "client_id",
+        "client_secret"
+      ],
+      "properties": {
+        "authorization_endpoint": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+          "description": "Where the user is sent to authorize."
+        },
+        "token_endpoint": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+          "description": "Where the authorization code is exchanged."
+        },
+        "userinfo_endpoint": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+          "description": "Where the authenticated user's profile is fetched."
+        },
+        "client_id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "Either a literal in case the same client is used in all environments, or a `${{ NAME }}` reference to a variable in case of separate clients per environment."
+        },
+        "client_secret": {
+          "type": "string",
+          "pattern": "^\\$\\{\\{ *[A-Za-z0-9_]+ *\\}\\}$",
+          "description": "A reference to the variable holding the client secret, never the secret itself. A secret may only be referenced as the entire value: text around the placeholder would be rendered into the resolved credential, so it is rejected. The engine resolves it against the environment serving the request."
+        },
+        "token_endpoint_auth_method": {
+          "type": "string",
+          "enum": [
+            "client_secret_basic",
+            "client_secret_post"
+          ],
+          "default": "client_secret_basic",
+          "description": "How the client authenticates at the token endpoint."
+        },
+        "scopes": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true,
+          "description": "Provider-specific; OAuth 2.0 defines no universal scope."
+        },
+        "pkce_enabled": {
+          "type": "boolean",
+          "default": true,
+          "description": "Send PKCE (code_challenge/code_verifier). Providers that do not support PKCE typically ignore the parameters, so `true` is safe and future-proofs; set `false` only for a provider whose token endpoint rejects them."
+        },
+        "static_authorize_parameters": {
+          "type": "object",
+          "propertyNames": {
+            "minLength": 1,
+            "not": {
+              "enum": [
+                "client_id",
+                "redirect_uri",
+                "response_type",
+                "scope",
+                "state",
+                "nonce",
+                "code_challenge",
+                "code_challenge_method",
+                "response_mode",
+                "request",
+                "request_uri",
+                "client_secret",
+                "client_assertion"
+              ]
+            }
+          },
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Extra provider-specific authorize parameters (for example `prompt`). Engine-owned protocol parameters are reserved and rejected by `propertyNames`: the engine composes them itself, and an override of `state` or `nonce` would silently defeat CSRF and token binding. `client_secret` and `client_assertion` are rejected as they could be appended to the public authorize URL."
+        },
+        "supplementary_fetch": {
+          "type": "string",
+          "enum": [
+            "github_primary_email"
+          ],
+          "description": "Provider-specific follow-up call after userinfo. New values are non-breaking."
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "supplementary_fetch": {
+                "const": "github_primary_email"
+              }
+            },
+            "required": [
+              "supplementary_fetch"
+            ]
+          },
+          "then": {
+            "required": [
+              "scopes"
+            ],
+            "properties": {
+              "scopes": {
+                "contains": {
+                  "const": "user:email"
+                }
+              }
+            }
+          }
+        }
+      ]
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "protocol": {
+            "const": "oidc"
+          }
+        },
+        "required": [
+          "protocol"
+        ]
+      },
+      "then": {
+        "required": [
+          "oidc"
+        ],
+        "properties": {
+          "oauth2": false
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "protocol": {
+            "const": "oauth2"
+          }
+        },
+        "required": [
+          "protocol"
+        ]
+      },
+      "then": {
+        "required": [
+          "oauth2",
+          "subject_claim"
+        ],
+        "properties": {
+          "oidc": false
+        }
+      }
+    }
+  ]
+}

package/meta-schemas/property-name.json

@@ -1,4 +1,5 @@
 {
+  "$comment": "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "title": "PropertyName",
   "type": "string",

package/meta-schemas/sso-auth-method.json

@@ -0,0 +1,54 @@
+{
+  "$comment": "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "SSOAuthMethod",
+  "type": "object",
+  "required": [
+    "enabled"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "enabled": {
+      "type": "boolean",
+      "description": "Whether the authentication method is enabled or not"
+    },
+    "providers": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[a-z0-9][a-z0-9_-]*$",
+        "maxLength": 64,
+        "examples": [
+          "google",
+          "github",
+          "corp_idp"
+        ]
+      },
+      "description": "Slugs of the Project-level identity provider connections available to users of this schema. Each entry must match the `slug` of a connection under `.zitadel/idps/`; a connection existing does not by itself make it available here."
+    }
+  },
+  "if": {
+    "properties": {
+      "enabled": {
+        "const": true
+      }
+    },
+    "required": [
+      "enabled"
+    ]
+  },
+  "then": {
+    "required": [
+      "providers"
+    ]
+  },
+  "else": {
+    "not": {
+      "required": [
+        "providers"
+      ]
+    }
+  }
+}

package/meta-schemas/user-property.json

@@ -1,19 +1,11 @@
 {
+  "$comment": "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "title": "UserProperty",
   "type": "object",
-  "allOf": [
-    {
-      "$ref": "https://json-schema.org/draft/2020-12/schema"
-    }
-  ],
+  "description": "The meta-schema one property of a customer's user schema is validated\nagainst. The generated `user-property.json` adds\n`allOf: [{$ref: draft-2020-12}]`, which cannot live here because code\ngenerators choke on it.\n\nNative JSON Schema keywords such as `type`, `format`, `title` and `writeOnly`\nare accepted without being listed below. `writeOnly: true` is reserved for a\nvalue that may be written but is never returned by the read API; nothing\nenforces it today, so responses still include write-only properties.\n",
   "additionalProperties": true,
   "properties": {
-    "$schema": {
-      "type": "string",
-      "const": "https://json-schema.org/draft/2020-12/schema",
-      "description": "The JSON Schema version used for this schema."
-    },
     "x-unique": {
       "oneOf": [
         {
@@ -44,11 +36,11 @@
     "x-audit": {
       "type": "boolean",
       "default": false,
-      "description": "Whether this property's value may appear in audit event payloads. Audit payloads are deny-by-default: a property without this annotation contributes its key but never its value."
+      "description": "Whether this property's value may appear in audit event payloads. Audit\npayloads are deny-by-default: a property without this annotation\ncontributes its key but never its value.\n"
     },
     "properties": {
       "type": "object",
-      "description": "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
+      "description": "A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n",
       "propertyNames": {
         "$ref": "property-name.json"
       },
@@ -56,5 +48,10 @@
         "$ref": "user-property.json"
       }
     }
-  }
+  },
+  "allOf": [
+    {
+      "$ref": "https://json-schema.org/draft/2020-12/schema"
+    }
+  ]
 }

package/meta-schemas/user-schema.json

@@ -1,17 +1,14 @@
 {
-  "title": "UserSchema",
+  "$comment": "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "UserSchema",
   "type": "object",
+  "description": "The meta-schema a customer's user schema document is validated against.\nThe generated `user-schema.json` adds `allOf: [{$ref: draft-2020-12}]`,\nwhich cannot live here because code generators choke on it.\n",
   "required": [
     "metaSchema",
     "kind",
     "x-auth-methods"
   ],
-  "allOf": [
-    {
-      "$ref": "https://json-schema.org/draft/2020-12/schema"
-    }
-  ],
   "additionalProperties": true,
   "properties": {
     "$schema": {
@@ -22,8 +19,10 @@
     "objectType": {
       "type": "string",
       "maxLength": 256,
-      "description": "The type of user this schema describes. This is a customer chosen name.",
-      "example": "human-user"
+      "description": "The type of user this schema describes. This is a customer chosen name.\n",
+      "examples": [
+        "human-user"
+      ]
     },
     "kind": {
       "type": "string",
@@ -32,8 +31,8 @@
     },
     "metaSchema": {
       "type": "string",
-      "maxLength": 1024,
       "format": "uri",
+      "maxLength": 1024,
       "description": "The user Schema version used for this schema."
     },
     "x-auth-methods": {
@@ -42,7 +41,10 @@
     "x-identifier": {
       "type": "string",
       "minLength": 1,
-      "description": "Path of the leaf property whose value identifies a user (nested leaves are addressed by their dot-joined attribute path). The property must carry x-unique \"project\". Required when an auth method needing identifier-first dispatch (password) is enabled. Passkey is exempt: discoverable credentials identify the user through the assertion itself, so passkey-only and API-managed schemas may designate nothing; flows using identifier-first passkey are validated at the flow level instead."
+      "description": "Path of the leaf property whose value identifies a user (nested leaves\nare addressed by their dot-joined attribute path). The property must\ncarry `x-unique` \"project\". Required when an auth method needing\nidentifier-first dispatch (password) is enabled. Passkey is exempt:\ndiscoverable credentials identify the user through the assertion\nitself, so passkey-only and API-managed schemas may designate nothing;\nflows using identifier-first passkey are validated at the flow level\ninstead.\n",
+      "examples": [
+        "email"
+      ]
     },
     "x-display": {
       "type": "array",
@@ -51,11 +53,11 @@
         "type": "string",
         "minLength": 1
       },
-      "description": "Ordered leaf property paths whose values, joined with a space, render the user's display name."
+      "description": "Ordered leaf property paths whose values, joined with a space, render\nthe user's display name.\n"
     },
     "properties": {
       "type": "object",
-      "description": "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
+      "description": "A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n",
       "propertyNames": {
         "$ref": "property-name.json"
       },
@@ -63,5 +65,10 @@
         "$ref": "user-property.json"
       }
     }
-  }
+  },
+  "allOf": [
+    {
+      "$ref": "https://json-schema.org/draft/2020-12/schema"
+    }
+  ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zitadel/config",
-  "version": "1.0.0-alpha.21",
+  "version": "1.0.0-alpha.23",
   "description": "Versioned Zitadel local config schemas and defaults",
   "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/config#readme",
   "bugs": {
@@ -43,6 +43,16 @@
       "types": "./dist/branding-url.d.mts",
       "import": "./dist/branding-url.mjs"
     },
+    "./branding-contrast": {
+      "@zitadel/source": "./src/branding-contrast.ts",
+      "types": "./dist/branding-contrast.d.mts",
+      "import": "./dist/branding-contrast.mjs"
+    },
+    "./css-color": {
+      "@zitadel/source": "./src/css-color.ts",
+      "types": "./dist/css-color.d.mts",
+      "import": "./dist/css-color.mjs"
+    },
     "./normalize": {
       "@zitadel/source": "./src/normalize.ts",
       "types": "./dist/normalize.d.mts",
@@ -71,20 +81,23 @@
     "access": "public"
   },
   "dependencies": {
+    "culori": "^4.0.2",
     "liquidjs": "^10.27.2",
     "zod": "^4.3.6",
-    "@zitadel/api": "1.0.0-alpha.21"
+    "@zitadel/api": "1.0.0-alpha.23"
   },
   "devDependencies": {
+    "@types/culori": "^4.0.1",
     "ajv": "^8.20.0",
     "tsdown": "^0.21.10",
     "tslib": "^2.8.1",
     "vitest": "^4.1.9"
   },
   "scripts": {
-    "build": "tsdown",
-    "typecheck": "tsc --build tsconfig.json",
-    "test": "vitest run --passWithNoTests",
+    "sync-schemas": "node scripts/sync-meta-schemas.mjs",
+    "build": "node scripts/sync-meta-schemas.mjs && tsdown",
+    "typecheck": "node scripts/sync-meta-schemas.mjs && tsc --build tsconfig.json",
+    "test": "node scripts/sync-meta-schemas.mjs && vitest run --passWithNoTests",
     "lint": "oxlint ."
   }
 }

package/dist/defaults-Bh4_xVbh.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaults-Bh4_xVbh.d.mts","names":[],"sources":["../src/readmes.ts","../src/defaults.ts"],"mappings":";;;;;;AAQA;;iBAAgB,oBAAA,CAAA;;;AAQhB;;iBAAgB,kBAAA,CAAA;;;AAShB;;;iBAAgB,qBAAA,CAAA;;;cCFH,2BAAA;AAAA,cACA,uBAAA;AAAA,cACA,0BAAA;AAAA,cACA,wBAAA;AAAA,cACA,4BAAA;AAAA,cACA,8BAAA;ADZb;;;;;AASA;;AATA,cCqBa,aAAA;AAAA,KAED,WAAA,WAAsB,aAAA;AAAA,cAErB,oBAAA,EAAsB,WAAA;;;;AAlBnC;;;;cAkDa,gBAAA;AAAA,KAED,cAAA,WAAyB,gBAAA;AAAA,cAExB,uBAAA,EAAyB,cAAA;AAAA,KAW1B,qBAAA;EAhEwB,8EAkElC,QAAA;IACE,MAAA;IACA,oBAAA;EAAA,GAnEmC;EAsErC,QAAA;AAAA;;;;;AApEF;iBA4EgB,wBAAA,CACd,MAAA,YACC,qBAAA;;;;AA7EH;;;;;cAgHa,eAAA;AAAA,KAED,YAAA,WAAuB,eAAA;AAAA,cAEtB,sBAAA,EAAwB,YAAA;AAAA,KA0GzB,0BAAA;EACV,iBAAA;EACA,aAAA,WArNqB;EAuNrB,MAAA,WAvNgC;EAyNhC,OAAA;AAAA;AAAA,iBAGc,yBAAA,CACd,iBAAA;AAAA,iBAKc,yBAAA,CACd,OAAA,GAAS,0BAAA,GACR,gBAAA;AAAA,iBAca,mBAAA,CACd,OAAA,GAAS,0BAAA,GACR,sCAAA"}