agor-live 0.22.0 → 0.23.2

package/dist/daemon/services/branches.js

@@ -191,9 +191,9 @@ import { analyticsLogger } from "@agor/core/analytics";
 import {
   createUserProcessEnvironment,
   ENVIRONMENT,
-  isBranchRbacEnabled,
   loadConfig,
-  PAGINATION
+  PAGINATION,
+  resolveExecutionSecurityMode
 } from "@agor/core/config";
 import {
   BoardRepository,
@@ -209,9 +209,13 @@ import {
   validateManagedEnvLifecyclePolicy,
   validateRenderedManagedEnvUrlFields
 } from "@agor/core/environment/webhook";
-import { BadRequest, Forbidden as Forbidden2, NotAuthenticated as NotAuthenticated2 } from "@agor/core/feathers";
-import { stripGitUrlCredentials } from "@agor/core/git";
-import { getAssistantConfig as getAssistantConfig2, isAssistant as isAssistant3 } from "@agor/core/types";
+import { BadRequest, Forbidden as Forbidden2, NotAuthenticated as NotAuthenticated3 } from "@agor/core/feathers";
+import { stripGitUrlCredentials } from "@agor/core/git/pure";
+import {
+  BRANCH_ENVIRONMENT_CLEARABLE_FIELDS,
+  getAssistantConfig as getAssistantConfig2,
+  isAssistant as isAssistant3
+} from "@agor/core/types";
 import {
   getGidFromGroupName,
   resolveUnixUserForImpersonation,
@@ -237,6 +241,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -328,12 +360,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -345,10 +393,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -360,14 +411,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -383,7 +438,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -397,12 +455,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -412,7 +472,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -426,6 +489,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {
@@ -492,6 +557,27 @@ function shouldUseCloneReferencePath() {
   return (config.execution?.unix_user_mode ?? "simple") !== "strict";
 }
 
+// src/utils/emit-service-event.ts
+var DEFAULT_EVENT_METHOD = {
+  created: "create",
+  updated: "update",
+  patched: "patch",
+  removed: "remove"
+};
+function emitServiceEvent(app, event) {
+  const service = app.service(event.path);
+  service.emit?.(event.event, event.data, {
+    app,
+    service,
+    path: event.path,
+    method: event.method ?? DEFAULT_EVENT_METHOD[event.event] ?? "patch",
+    event: event.event,
+    id: event.id,
+    result: event.data,
+    params: event.params ?? {}
+  });
+}
+
 // src/utils/git-impersonation.ts
 async function resolveDaemonUserForGroupRefresh() {
   const { getDaemonUser: getDaemonUser2, isUnixGroupRefreshNeeded } = await import("@agor/core/config");
@@ -632,6 +718,13 @@ function generateTaskId() {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function findExecutorPath() {
+  const configuredPath = process.env.AGOR_EXECUTOR_PATH;
+  if (configuredPath) {
+    if (!existsSync(configuredPath)) {
+      throw new Error(`Configured AGOR_EXECUTOR_PATH does not exist: ${configuredPath}`);
+    }
+    return configuredPath;
+  }
   const dirname = typeof __dirname !== "undefined" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
   const possiblePaths = [
     path.join(dirname, "../executor/cli.js"),
@@ -742,6 +835,12 @@ function spawnExecutorLocal(payload, options) {
     options.onExit?.(127);
     return;
   }
+  let reportedExit = false;
+  const reportExit = (code) => {
+    if (reportedExit) return;
+    reportedExit = true;
+    options.onExit?.(code);
+  };
   const executorProcess = spawn(cmd, args, {
     cwd,
     env: asUser ? void 0 : { ...envWithDaemonUrl },
@@ -755,6 +854,7 @@ function spawnExecutorLocal(payload, options) {
   onSpawn?.(executorProcess);
   executorProcess.on("error", (error) => {
     console.error(`${logPrefix} Spawn error:`, error.message);
+    reportExit(127);
   });
   executorProcess.on("exit", (code) => {
     if (code === 0) {
@@ -762,7 +862,7 @@ function spawnExecutorLocal(payload, options) {
     } else {
       console.error(`${logPrefix} Executor exited with code ${code}`);
     }
-    options.onExit?.(code);
+    reportExit(code);
   });
   executorProcess.stdin?.write(JSON.stringify(payload));
   executorProcess.stdin?.end();
@@ -775,6 +875,12 @@ function spawnExecutorWithTemplate(payload, options) {
   console.log(`${logPrefix} Task ID: ${templateVariables.task_id}`);
   console.log(`${logPrefix} Command: ${payload.command}`);
   console.log(`${logPrefix} Template command (first 200 chars): ${command.slice(0, 200)}...`);
+  let reportedExit = false;
+  const reportExit = (code) => {
+    if (reportedExit) return;
+    reportedExit = true;
+    options.onExit?.(code);
+  };
   const executorProcess = spawn("sh", ["-c", command], {
     env: { ...process.env, LOG_LEVEL: logLevel },
     stdio: ["pipe", "pipe", "pipe"]
@@ -788,6 +894,7 @@ function spawnExecutorWithTemplate(payload, options) {
   });
   executorProcess.on("error", (error) => {
     console.error(`${logPrefix} Spawn error:`, error.message);
+    reportExit(127);
   });
   executorProcess.on("exit", (code) => {
     if (code === 0) {
@@ -799,7 +906,7 @@ function spawnExecutorWithTemplate(payload, options) {
         `${logPrefix} Executor exited with code ${code} (task: ${templateVariables.task_id})`
       );
     }
-    options.onExit?.(code);
+    reportExit(code);
   });
   executorProcess.stdin?.write(JSON.stringify(payload));
   executorProcess.stdin?.end();
@@ -1079,12 +1186,67 @@ function createServiceToken(jwtSecret, expiresIn, scope = {}) {
     expiresIn || "5m"
   );
 }
-function generateSessionToken(app) {
+function serviceTokenScopeForParams(params) {
+  const tenantId = params?.tenant?.tenant_id ?? params?.tenant_id ?? params?.user?.tenant_id;
+  return tenantId ? { tenant_id: tenantId } : {};
+}
+function generateSessionToken(app, scope = {}) {
   const jwtSecret = app.settings.authentication?.secret;
   if (!jwtSecret) {
     throw new Error("JWT secret not configured in app settings");
   }
-  return createServiceToken(jwtSecret);
+  return createServiceToken(jwtSecret, void 0, scope);
+}
+function generateScopedServiceToken(app, params) {
+  return generateSessionToken(app, serviceTokenScopeForParams(params));
+}
+
+// src/utils/tenant-db-scope.ts
+import {
+  resolveMultiTenancyConfig,
+  resolveTenantContext,
+  TenantResolutionError
+} from "@agor/core/config";
+import {
+  enqueueTenantDatabasePostCommitCallback,
+  getCurrentTenantId,
+  runWithoutTenantDatabaseScope,
+  runWithTenantDatabaseScope
+} from "@agor/core/db";
+import { NotAuthenticated as NotAuthenticated2 } from "@agor/core/feathers";
+import jwt2 from "jsonwebtoken";
+function resolveTenantIdForDeferredScope(params) {
+  const scopedParams = params;
+  return scopedParams?.tenant?.tenant_id ?? getCurrentTenantId();
+}
+function deferWithTenantDatabaseScope(db, params, work, onError) {
+  const tenantId = resolveTenantIdForDeferredScope(params);
+  if (!tenantId) {
+    const error = new Error("Missing tenant context for deferred tenant-scoped work");
+    if (onError) {
+      onError(error);
+    } else {
+      console.error("[tenant-db-scope] Deferred tenant-scoped work skipped:", error);
+    }
+    return;
+  }
+  const schedule = () => {
+    runWithoutTenantDatabaseScope(() => {
+      setImmediate(() => {
+        void runWithTenantDatabaseScope(db, tenantId, work).catch((error) => {
+          if (onError) {
+            onError(error);
+            return;
+          }
+          console.error("[tenant-db-scope] Deferred tenant-scoped work failed:", error);
+        });
+      });
+    });
+  };
+  if (enqueueTenantDatabasePostCommitCallback(async () => schedule())) {
+    return;
+  }
+  schedule();
 }
 
 // src/services/assistant-knowledge.ts
@@ -1379,15 +1541,39 @@ var BranchesService = class extends DrizzleService {
     };
   }
   async dispatchEnvironmentExecutor(options) {
-    const { branch, action } = options;
+    const { branch, action, params } = options;
     const { payload, asUser, env } = await this.createEnvironmentExecutorPayload(options);
-    spawnExecutor(payload, {
-      logPrefix: `[Environment.${action} ${branch.name}]`,
-      asUser,
-      preparedEnv: env,
-      templateVariables: {
-        branch_id: branch.branch_id
+    const logPrefix = `[Environment.${action} ${branch.name}]`;
+    const spawnLifecycleExecutor = async () => {
+      try {
+        spawnExecutor(payload, {
+          logPrefix,
+          asUser,
+          preparedEnv: env,
+          templateVariables: {
+            branch_id: branch.branch_id
+          }
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Failed to spawn environment executor";
+        await this.updateEnvironment(
+          branch.branch_id,
+          {
+            status: "error",
+            last_health_check: {
+              timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              status: "unhealthy",
+              message
+            },
+            last_error: message
+          },
+          params
+        );
+        throw error;
       }
+    };
+    deferWithTenantDatabaseScope(this.db, params, spawnLifecycleExecutor, (error) => {
+      console.error(`${logPrefix} Failed to dispatch executor:`, error);
     });
   }
   async runEnvironmentExecutor(options) {
@@ -1561,7 +1747,7 @@ var BranchesService = class extends DrizzleService {
     if (params?.provider) {
       const caller = params?.user;
       if (!caller) {
-        throw new NotAuthenticated2("Authentication required");
+        throw new NotAuthenticated3("Authentication required");
       }
       const isService = !!caller._isServiceAccount;
       if (!isService) {
@@ -1645,7 +1831,7 @@ var BranchesService = class extends DrizzleService {
     const user = params?.user;
     const userId = user?.user_id;
     if (isKnowledgeAdmin(user)) return;
-    if (!userId) throw new NotAuthenticated2("Authentication required");
+    if (!userId) throw new NotAuthenticated3("Authentication required");
     if (branch.created_by === userId) return;
     if (await this.branchRepo.isOwner(branch.branch_id, userId)) {
       return;
@@ -1708,7 +1894,7 @@ var BranchesService = class extends DrizzleService {
     const user = params?.user;
     if (isKnowledgeAdmin(user)) return;
     const userId = user?.user_id;
-    if (!userId) throw new NotAuthenticated2("Authentication required");
+    if (!userId) throw new NotAuthenticated3("Authentication required");
     const permission = await namespaces.resolveNamespacePermission(namespace.namespace_id, userId);
     if (permission !== "write" && permission !== "own") {
       throw new Forbidden2(
@@ -1899,6 +2085,42 @@ var BranchesService = class extends DrizzleService {
     }
     return withZone;
   }
+  /**
+   * Push the list read's high-selectivity predicates into SQL.
+   *
+   * The generic adapter would read the entire branches table and filter in
+   * memory, so the cost scaled with total branch count rather than the scoped
+   * result. `branches` is the highest-cardinality entity fetched during initial
+   * app load, so we narrow the read to the board scope, archived state,
+   * explicit/zone-derived branch ids, and any RBAC SQL visibility marker before
+   * rows leave the database. `find` still re-applies every query filter
+   * in memory, so this only ever returns a superset of the matching rows and the
+   * downstream sort/pagination/enrichment is unaffected.
+   *
+   * `zone_id` is deliberately not pushed here — it is virtual (backed by
+   * board_objects, not a branches column) and is already resolved to a
+   * `branch_id` filter in `find` before this runs.
+   *
+   * A `{ $in }` is only pushed when every element is a string. `branches.branch_id`
+   * is non-null so it can't diverge today, but the guard keeps the superset
+   * invariant unconditional and avoids handing a malformed element to SQL.
+   */
+  async fetchData(query, params) {
+    const filter = {};
+    if (typeof query.repo_id === "string") filter.repo_id = query.repo_id;
+    if (typeof query.board_id === "string") filter.board_id = query.board_id;
+    if (typeof query.archived === "boolean") filter.archived = query.archived;
+    if (params?._agorSqlBranchAccessUserId) {
+      filter.visibleToUserId = params._agorSqlBranchAccessUserId;
+    }
+    const branchId = query.branch_id;
+    if (typeof branchId === "string") {
+      filter.branchIds = [branchId];
+    } else if (branchId && typeof branchId === "object" && Array.isArray(branchId.$in) && branchId.$in.every((el) => typeof el === "string")) {
+      filter.branchIds = branchId.$in;
+    }
+    return this.branchRepo.findAll(filter);
+  }
   /**
    * Override find to enrich with zone information only
    *
@@ -2145,7 +2367,7 @@ var BranchesService = class extends DrizzleService {
       await this.patch(id, { filesystem_status: "creating" }, { provider: void 0 });
       const reposService = this.app.service("repos");
       const repo = await reposService.get(branch.repo_id);
-      const rbacEnabled = isBranchRbacEnabled();
+      const initUnixGroup = resolveExecutionSecurityMode().shouldInitUnixGroups;
       const { getDaemonUser: getDaemonUser2 } = await import("@agor/core/config");
       const daemonUser = getDaemonUser2();
       const storageMode = branch.storage_mode ?? "worktree";
@@ -2161,8 +2383,9 @@ var BranchesService = class extends DrizzleService {
       }
       const safeRemoteUrl = repo.remote_url ? stripGitUrlCredentials(repo.remote_url) : void 0;
       try {
-        const sessionToken = generateSessionToken(
-          this.app
+        const sessionToken = generateScopedServiceToken(
+          this.app,
+          params
         );
         spawnExecutor(
           {
@@ -2185,7 +2408,7 @@ var BranchesService = class extends DrizzleService {
               restoreMode: true,
               sourceBranch: branch.base_ref || repo.default_branch || "main",
               // Unix group isolation
-              initUnixGroup: rbacEnabled,
+              initUnixGroup,
               othersAccess: branch.others_fs_access || "read",
               daemonUser,
               repoUnixGroup: repo.unix_group,
@@ -2324,6 +2547,11 @@ var BranchesService = class extends DrizzleService {
       ...existing.environment_instance,
       ...environmentUpdate
     };
+    for (const key of BRANCH_ENVIRONMENT_CLEARABLE_FIELDS) {
+      if (Object.hasOwn(environmentUpdate, key) && (environmentUpdate[key] === void 0 || environmentUpdate[key] === null)) {
+        delete updatedEnvironment[key];
+      }
+    }
     const oldState = { ...existing.environment_instance };
     const newState = { ...updatedEnvironment };
     if (oldState?.last_health_check) {
@@ -2346,6 +2574,13 @@ var BranchesService = class extends DrizzleService {
       },
       resolvedParams
     );
+    emitServiceEvent(this.app, {
+      path: "branches",
+      event: "patched",
+      data: branch,
+      params: resolvedParams,
+      id
+    });
     return branch;
   }
   /**
@@ -2593,7 +2828,8 @@ var BranchesService = class extends DrizzleService {
     const branch = await this.get(id, params);
     const _repo = await this.app.service("repos").get(branch.repo_id, params);
     const currentStatus = branch.environment_instance?.status;
-    if (currentStatus !== "running" && currentStatus !== "starting") {
+    const canProbeHealth = currentStatus === "running" || currentStatus === "starting" || currentStatus === "error";
+    if (!canProbeHealth) {
       return branch;
     }
     if (!branch.health_check_url) {
@@ -2642,11 +2878,9 @@ var BranchesService = class extends DrizzleService {
           `\u{1F3E5} Health status changed for ${branch.name}: ${previousHealthStatus || "unknown"} \u2192 ${newHealthStatus} (HTTP ${response.status})`
         );
       }
-      const shouldTransitionToRunning = isHealthy && currentStatus === "starting";
+      const shouldTransitionToRunning = isHealthy && (currentStatus === "starting" || currentStatus === "error");
       if (shouldTransitionToRunning) {
-        console.log(
-          `\u2705 First successful health check for ${branch.name} - transitioning to 'running'`
-        );
+        console.log(`\u2705 Successful health check for ${branch.name} - transitioning to 'running'`);
       }
       return await this.updateEnvironment(
         id,
@@ -2781,7 +3015,9 @@ var BranchesService = class extends DrizzleService {
         path: branch.path,
         custom_context: branch.custom_context,
         unix_gid: unixGid,
-        host_ip_address: hostIpAddress
+        host_ip_address: hostIpAddress,
+        base_ref: branch.base_ref,
+        ref_type: branch.ref_type
       },
       requestedVariant
     );

package/dist/daemon/services/card-types.d.ts

@@ -4,14 +4,14 @@
  * Provides REST + WebSocket API for card type management.
  * CardTypes are global (org-level) definitions for card categories.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { CardType, QueryParams } from '@agor/core/types';
 import { DrizzleService } from '../adapters/drizzle';
 export type CardTypeParams = QueryParams<{
     name?: string;
 }>;
 export declare class CardTypesService extends DrizzleService<CardType, Partial<CardType>, CardTypeParams> {
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
 }
-export declare function createCardTypesService(db: Database): CardTypesService;
+export declare function createCardTypesService(db: TenantScopeAwareDatabase): CardTypesService;
 //# sourceMappingURL=card-types.d.ts.map

package/dist/daemon/services/card-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"card-types.d.ts","sourceRoot":"","sources":["../../src/services/card-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAsB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAEH,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;gBACnF,EAAE,EAAE,QAAQ;CAUzB;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,GAAG,gBAAgB,CAErE"}
+{"version":3,"file":"card-types.d.ts","sourceRoot":"","sources":["../../src/services/card-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAsB,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAEH,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;gBACnF,EAAE,EAAE,wBAAwB;CAUzC;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,wBAAwB,GAAG,gBAAgB,CAErF"}