agor-live 0.23.1 → 0.23.2

package/dist/daemon/utils/realtime-publish.js

@@ -34,6 +34,7 @@ var RealtimeAccessCache = class {
   }
   branchVisibility = /* @__PURE__ */ new Map();
   sessionBranches = /* @__PURE__ */ new Map();
+  sessionOwners = /* @__PURE__ */ new Map();
   branchVisibilityTtlMs;
   sessionBranchTtlMs;
   now;
@@ -50,6 +51,27 @@ var RealtimeAccessCache = class {
     });
     return branchId;
   }
+  /**
+   * Owning user id for a session, cached on the same cadence as the
+   * session→branch map. Used only to offer streaming events to the session
+   * creator's own connections as a fallback when they haven't subscribed to
+   * the per-session stream channel yet.
+   */
+  async getSessionOwnerId(sessionId) {
+    const cached = this.sessionOwners.get(sessionId);
+    const now = this.now();
+    if (cached && cached.expiresAt > now) {
+      return cached.ownerId;
+    }
+    const ownerId = await this.options.sessionsRepository.findCreatedByBySessionId(
+      sessionId
+    ) ?? null;
+    this.sessionOwners.set(sessionId, {
+      ownerId,
+      expiresAt: now + this.sessionBranchTtlMs
+    });
+    return ownerId;
+  }
   async getBranchVisibility(branchId) {
     const cached = this.branchVisibility.get(branchId);
     const now = this.now();
@@ -85,6 +107,7 @@ var RealtimeAccessCache = class {
   }
   invalidateSession(sessionId) {
     this.sessionBranches.delete(sessionId);
+    this.sessionOwners.delete(sessionId);
   }
   clearVisibility() {
     this.branchVisibility.clear();
@@ -92,6 +115,7 @@ var RealtimeAccessCache = class {
   clearAll() {
     this.branchVisibility.clear();
     this.sessionBranches.clear();
+    this.sessionOwners.clear();
   }
   visibilityFromEntry(entry) {
     return entry.mode === "allAuthenticated" ? { mode: "allAuthenticated" } : { mode: "explicitUsers", userIds: entry.userIds };
@@ -102,6 +126,26 @@ var RealtimeAccessCache = class {
 function tenantChannelName(tenantId) {
   return `tenant:${tenantId}`;
 }
+var SESSION_STREAM_CHANNEL_PREFIX = "session-stream:";
+function sessionStreamChannelName(sessionId) {
+  return `${SESSION_STREAM_CHANNEL_PREFIX}${sessionId}`;
+}
+function leaveAllSessionStreamChannels(app, connection) {
+  for (const name of app.channels ?? []) {
+    if (name.startsWith(SESSION_STREAM_CHANNEL_PREFIX)) {
+      app.channel(name).leave(connection);
+    }
+  }
+}
+function existingChannel(app, name) {
+  return (app.channels ?? []).includes(name) ? app.channel(name) : null;
+}
+function joinSessionStreamChannel(app, sessionId, connection) {
+  app.channel(sessionStreamChannelName(sessionId)).join(connection);
+}
+function leaveSessionStreamChannel(app, sessionId, connection) {
+  existingChannel(app, sessionStreamChannelName(sessionId))?.leave(connection);
+}
 var DEBUG_REALTIME_PUBLISH = process.env.AGOR_DEBUG_REALTIME_PUBLISH === "1" || process.env.DEBUG?.includes("realtime-publish");
 function realtimePublishDebug(...args) {
   if (DEBUG_REALTIME_PUBLISH) {
@@ -117,8 +161,27 @@ var SESSION_ID_SCOPED_PATHS = /* @__PURE__ */ new Set([
   "session-env-selections"
 ]);
 var OPTIONAL_BRANCH_OR_SESSION_SCOPED_PATHS = /* @__PURE__ */ new Set(["board-objects", "board-comments"]);
+var MESSAGE_STREAMING_EVENTS = /* @__PURE__ */ new Set([
+  "streaming:start",
+  "streaming:chunk",
+  "streaming:end",
+  "streaming:error",
+  "thinking:start",
+  "thinking:chunk",
+  "thinking:end"
+]);
+var TASK_STREAMING_EVENTS = /* @__PURE__ */ new Set(["thinking:chunk", "tool:start", "tool:complete"]);
 function isStreamingEvent(context) {
-  return context.path === "messages/streaming" || context.path === "messages" && context.event?.startsWith("streaming:") === true;
+  if (context.path === "messages/streaming") return true;
+  const event = context.event;
+  if (!event) return false;
+  if (context.path === "messages") {
+    return event.startsWith("streaming:") || MESSAGE_STREAMING_EVENTS.has(event);
+  }
+  if (context.path === "tasks") {
+    return TASK_STREAMING_EVENTS.has(event);
+  }
+  return false;
 }
 function asRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -254,6 +317,47 @@ async function resolvePublishScope(data, context, accessCache) {
 function filterToServiceConnections(authenticated) {
   return authenticated.filter((connection) => isServiceConnection(connection));
 }
+async function resolveStreamingDelivery(app, data, tenantScoped, accessCache, branchRbacEnabled, allowSuperadmin) {
+  const serviceConnections = filterToServiceConnections(tenantScoped);
+  const sessionId = extractSessionId(data);
+  if (!sessionId) return serviceConnections;
+  const tenantConnections = new Set(
+    tenantScoped.connections
+  );
+  const existingRoom = existingChannel(app, sessionStreamChannelName(sessionId));
+  const room = existingRoom ? existingRoom.filter((connection) => tenantConnections.has(connection)) : null;
+  let ownerId = null;
+  try {
+    ownerId = await accessCache.getSessionOwnerId(sessionId);
+  } catch {
+  }
+  const ownerChannel = () => tenantScoped.filter(
+    (connection) => userFromConnection(connection)?.user_id === ownerId
+  );
+  if (!branchRbacEnabled) {
+    const channels2 = [serviceConnections];
+    if (room) channels2.push(room);
+    if (ownerId) channels2.push(ownerChannel());
+    return channels2;
+  }
+  const branchId = await accessCache.getBranchIdForSession(sessionId);
+  const visibility = branchId ? await accessCache.getBranchVisibility(branchId) : null;
+  if (!visibility) return serviceConnections;
+  if (visibility.mode === "allAuthenticated") {
+    const channels2 = [serviceConnections];
+    if (room) channels2.push(room);
+    if (ownerId) channels2.push(ownerChannel());
+    return channels2;
+  }
+  const channels = [serviceConnections];
+  if (room) {
+    channels.push(filterToUserIdsOrSuperadmins(room, visibility.userIds, allowSuperadmin));
+  }
+  if (ownerId && visibility.userIds.has(ownerId)) {
+    channels.push(ownerChannel());
+  }
+  return channels;
+}
 function filterToUserIdsOrAdmins(authenticated, userIds, allowSuperadmin) {
   return authenticated.filter((connection) => {
     if (isServiceConnection(connection) || isAdminConnection(connection, allowSuperadmin)) {
@@ -327,6 +431,16 @@ function configureRealtimePublish(options) {
         throw error;
       }
     }
+    if (isStreamingEvent(context)) {
+      return resolveStreamingDelivery(
+        app,
+        data,
+        tenantScoped,
+        accessCache,
+        branchRbacEnabled,
+        allowSuperadmin
+      );
+    }
     if (!branchRbacEnabled) return tenantScoped;
     const scope = await resolvePublishScope(data, context, accessCache);
     if (scope.kind === "global") return tenantScoped;
@@ -358,5 +472,9 @@ function configureRealtimePublish(options) {
   });
 }
 export {
-  configureRealtimePublish
+  configureRealtimePublish,
+  joinSessionStreamChannel,
+  leaveAllSessionStreamChannels,
+  leaveSessionStreamChannel,
+  sessionStreamChannelName
 };

package/dist/daemon/utils/session-queue-tenant-scope.d.ts

@@ -0,0 +1,24 @@
+import { type AgorConfig } from '@agor/core/config';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
+import type { Params, SessionID, TenantContext } from '@agor/core/types';
+type QueueTenantParams = Params & {
+    tenant?: Pick<TenantContext, 'tenant_id' | 'source'>;
+};
+export interface SessionQueueTenantScopeOptions {
+    db: TenantScopeAwareDatabase;
+    config: AgorConfig;
+    sessionId: SessionID;
+    params?: Params;
+    /**
+     * Trusted tenant id from an already-loaded tenant-owned row (for example a
+     * Postgres sessions/tasks patch result). Do not populate this from request
+     * payloads or request-less tenant discovery reads.
+     */
+    tenantIdHint?: string;
+    label: string;
+}
+export declare function queueTenantParams(params: Params | undefined, tenantId: string, source?: TenantContext['source']): QueueTenantParams;
+export declare function runWithSessionQueueTenantScope<T>(options: SessionQueueTenantScopeOptions, work: (params: QueueTenantParams) => Promise<T>): Promise<T | undefined>;
+export declare function deferWithSessionQueueTenantScope(options: SessionQueueTenantScopeOptions, work: (params: QueueTenantParams) => Promise<void>, onError?: (error: unknown) => void): void;
+export {};
+//# sourceMappingURL=session-queue-tenant-scope.d.ts.map

package/dist/daemon/utils/session-queue-tenant-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-queue-tenant-scope.d.ts","sourceRoot":"","sources":["../../src/utils/session-queue-tenant-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAA6B,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAA8B,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAY,MAAM,kBAAkB,CAAC;AAMnF,KAAK,iBAAiB,GAAG,MAAM,GAAG;IAChC,MAAM,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,QAAQ,CAAC,CAAC;CACtD,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,wBAAwB,CAAC;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAYD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,aAAa,CAAC,QAAQ,CAAc,GAC3C,iBAAiB,CAUnB;AAED,wBAAsB,8BAA8B,CAAC,CAAC,EACpD,OAAO,EAAE,8BAA8B,EACvC,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9C,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAwBxB;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,8BAA8B,EACvC,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,EAClD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,IAAI,CAiCN"}

package/dist/daemon/utils/session-queue-tenant-scope.js

@@ -0,0 +1,133 @@
+// src/utils/session-queue-tenant-scope.ts
+import { resolveMultiTenancyConfig as resolveMultiTenancyConfig2 } from "@agor/core/config";
+import { runWithTenantDatabaseScope as runWithTenantDatabaseScope2 } from "@agor/core/db";
+
+// src/utils/tenant-db-scope.ts
+import {
+  resolveMultiTenancyConfig,
+  resolveTenantContext,
+  TenantResolutionError
+} from "@agor/core/config";
+import {
+  enqueueTenantDatabasePostCommitCallback,
+  getCurrentTenantId,
+  runWithoutTenantDatabaseScope,
+  runWithTenantDatabaseScope
+} from "@agor/core/db";
+import { NotAuthenticated } from "@agor/core/feathers";
+import jwt2 from "jsonwebtoken";
+
+// src/auth/runtime-tokens.ts
+import jwt from "jsonwebtoken";
+
+// src/utils/tenant-db-scope.ts
+function resolveTenantIdForDeferredScope(params) {
+  const scopedParams = params;
+  return scopedParams?.tenant?.tenant_id ?? getCurrentTenantId();
+}
+function deferWithTenantDatabaseScope(db, params, work, onError) {
+  const tenantId = resolveTenantIdForDeferredScope(params);
+  if (!tenantId) {
+    const error = new Error("Missing tenant context for deferred tenant-scoped work");
+    if (onError) {
+      onError(error);
+    } else {
+      console.error("[tenant-db-scope] Deferred tenant-scoped work skipped:", error);
+    }
+    return;
+  }
+  const schedule = () => {
+    runWithoutTenantDatabaseScope(() => {
+      setImmediate(() => {
+        void runWithTenantDatabaseScope(db, tenantId, work).catch((error) => {
+          if (onError) {
+            onError(error);
+            return;
+          }
+          console.error("[tenant-db-scope] Deferred tenant-scoped work failed:", error);
+        });
+      });
+    });
+  };
+  if (enqueueTenantDatabasePostCommitCallback(async () => schedule())) {
+    return;
+  }
+  schedule();
+}
+
+// src/utils/session-queue-tenant-scope.ts
+function staticTenantId(config) {
+  const multiTenancy = resolveMultiTenancyConfig2(config);
+  return multiTenancy.mode === "static" ? multiTenancy.static_tenant_id : void 0;
+}
+function trustedTenantIdHint(options) {
+  const hint = options.tenantIdHint?.trim();
+  return hint || void 0;
+}
+function queueTenantParams(params, tenantId, source = "explicit") {
+  const currentTenant = params?.tenant;
+  return {
+    ...params ?? {},
+    tenant: {
+      ...currentTenant,
+      tenant_id: tenantId,
+      source: currentTenant?.source ?? source
+    }
+  };
+}
+async function runWithSessionQueueTenantScope(options, work) {
+  const capturedTenantId = resolveTenantIdForDeferredScope(options.params);
+  if (capturedTenantId) {
+    const scopedParams2 = queueTenantParams(options.params, capturedTenantId, "explicit");
+    return runWithTenantDatabaseScope2(options.db, capturedTenantId, () => work(scopedParams2));
+  }
+  const tenantIdHint = trustedTenantIdHint(options);
+  if (tenantIdHint) {
+    const scopedParams2 = queueTenantParams(options.params, tenantIdHint, "explicit");
+    return runWithTenantDatabaseScope2(options.db, tenantIdHint, () => work(scopedParams2));
+  }
+  const configuredStaticTenantId = staticTenantId(options.config);
+  if (!configuredStaticTenantId) {
+    console.error(
+      `\u274C [Queue] ${options.label} skipped for session ${options.sessionId}: missing tenant context`
+    );
+    return void 0;
+  }
+  const scopedParams = queueTenantParams(options.params, configuredStaticTenantId, "static");
+  return runWithTenantDatabaseScope2(options.db, configuredStaticTenantId, () => work(scopedParams));
+}
+function deferWithSessionQueueTenantScope(options, work, onError) {
+  const handleError = (error) => {
+    if (onError) {
+      onError(error);
+      return;
+    }
+    console.error(`\u274C [Queue] ${options.label} failed:`, error);
+  };
+  const capturedTenantId = resolveTenantIdForDeferredScope(options.params);
+  if (capturedTenantId) {
+    const scopedParams2 = queueTenantParams(options.params, capturedTenantId, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const tenantIdHint = trustedTenantIdHint(options);
+  if (tenantIdHint) {
+    const scopedParams2 = queueTenantParams(options.params, tenantIdHint, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const configuredStaticTenantId = staticTenantId(options.config);
+  if (!configuredStaticTenantId) {
+    handleError(
+      new Error(`${options.label} skipped for session ${options.sessionId}: missing tenant context`)
+    );
+    return;
+  }
+  const scopedParams = queueTenantParams(options.params, configuredStaticTenantId, "static");
+  deferWithTenantDatabaseScope(options.db, scopedParams, () => work(scopedParams), handleError);
+}
+export {
+  deferWithSessionQueueTenantScope,
+  queueTenantParams,
+  runWithSessionQueueTenantScope
+};

package/dist/daemon/widgets/gateway-token/index.d.ts

@@ -0,0 +1,114 @@
+/**
+ * gateway_token widget — registry entry and registration.
+ *
+ * Concrete widget type: an admin supplies a gateway channel's platform
+ * credentials (Slack bot/app tokens, GitHub private key, Teams app password)
+ * through an inline form. The values flow browser → daemon via
+ * `POST /widgets/:widget_id/submit` and land in the channel's encrypted
+ * `config` through the gateway-channels service — never through the agent's
+ * MCP context. Setting a channel's tokens is admin-only, so `applySubmit`
+ * gates on `ROLES.ADMIN` before touching anything.
+ *
+ * See §4 + §7 of `docs/internal/in-conversation-widgets-design-2026-05-19.md`.
+ */
+import { type ChannelType, type SlackTestResult } from '@agor/core/types';
+import { z } from 'zod';
+import { type WidgetRegistryEntry } from '../registry.js';
+export declare function isSupportedGatewayTokenChannelType(channelType: string): boolean;
+/**
+ * Agent-provided params (validated when the MCP tool fires). All non-secret:
+ * the channel identity, its type/name, and the field NAMES to collect. Stored
+ * at `metadata.widget.params` on the widget message row.
+ */
+export declare const gatewayTokenParamsSchema: z.ZodObject<{
+    gatewayChannelId: z.ZodString;
+    channelType: z.ZodEnum<{
+        slack: "slack";
+        discord: "discord";
+        whatsapp: "whatsapp";
+        telegram: "telegram";
+        github: "github";
+        teams: "teams";
+    }>;
+    channelName: z.ZodString;
+    fields: z.ZodArray<z.ZodEnum<{
+        app_token: "app_token";
+        private_key: "private_key";
+        app_password: "app_password";
+        bot_token: "bot_token";
+        signing_secret: "signing_secret";
+        webhook_secret: "webhook_secret";
+    }>>;
+    reason: z.ZodString;
+}, z.core.$strict>;
+export type GatewayTokenParams = z.infer<typeof gatewayTokenParamsSchema>;
+/**
+ * Browser → daemon submit payload. Direct HTTP, never reaches the agent. The
+ * keys are constrained to the sensitive field names; the values are the raw
+ * credentials that get encrypted by the gateway-channels service.
+ */
+export declare const gatewayTokenSubmitSchema: z.ZodObject<{
+    tokens: z.ZodRecord<z.ZodEnum<{
+        app_token: "app_token";
+        private_key: "private_key";
+        app_password: "app_password";
+        bot_token: "bot_token";
+        signing_secret: "signing_secret";
+        webhook_secret: "webhook_secret";
+    }> & z.core.$partial, z.ZodString>;
+}, z.core.$strict>;
+export type GatewayTokenSubmit = z.infer<typeof gatewayTokenSubmitSchema>;
+/**
+ * Sanitized post-resolution data written to the message row and fed into the
+ * auto-resume prompt. Carries the channel identity, which fields were set, and
+ * the enable/test outcome — but NEVER a token value, prefix, length, or
+ * last-four.
+ */
+export interface GatewayTokenResultMeta {
+    channelId: string;
+    channelName: string;
+    channelType: ChannelType;
+    fieldsSet: string[];
+    enabled: boolean;
+    /**
+     * True when the tokens were saved but the channel type has no probe, so the
+     * credentials could NOT be validated and the channel was left disabled
+     * pending manual confirmation. Distinct from an enable-blocking hard failure.
+     */
+    unverified: boolean;
+    test: {
+        ok: boolean;
+        summary: string;
+    };
+}
+/**
+ * Decide whether the probe result permits enabling the channel, a `status`
+ * discriminator, and a short human summary. Three outcomes:
+ *   - `failed` (enable:false) — a hard credential failure (bad token) or an
+ *     unbuildable connector (`config` capability — malformed config).
+ *   - `unverifiable` (enable:false) — the channel type has no probe at all
+ *     (`connector` capability); tokens are saved but the channel stays disabled
+ *     until the credentials are confirmed manually, never enabled off an unrun
+ *     probe.
+ *   - `verified` (enable:true) — the probe ran and surfaced no hard failure;
+ *     the credentials are usable even if more setup remains.
+ *
+ * `appTokenExpected` is Socket-Mode / inbound intent for THIS channel (the
+ * widget collected an app_token, i.e. `getRequiredSecretFields` asked for it).
+ * When true, a missing/failed app-level token is ALSO a hard blocker: the
+ * listener requires it (`hasListeningConfig` in services/gateway.ts), so an
+ * enabled inbound channel without a working app_token could never receive
+ * messages. When false (outbound-only — send via bot_token, no listener), the
+ * Slack probe still emits an `app_token` capability failure / `appTokenValid:
+ * false` because no app token exists, but that must NOT block enabling — the
+ * channel does not use Socket Mode.
+ */
+export declare function classifyGatewayTokenTest(result: SlackTestResult, appTokenExpected: boolean): {
+    enable: boolean;
+    status: 'verified' | 'unverifiable' | 'failed';
+    summary: string;
+};
+export declare const gatewayTokenWidget: WidgetRegistryEntry<GatewayTokenParams, GatewayTokenSubmit, GatewayTokenResultMeta>;
+/** Idempotent registration helper, safe to call at every daemon boot. */
+export declare function registerGatewayTokenWidget(): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/daemon/widgets/gateway-token/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/widgets/gateway-token/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,KAAK,WAAW,EAIhB,KAAK,eAAe,EAErB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,KAAK,mBAAmB,EAAwB,MAAM,gBAAgB,CAAC;AAahG,wBAAgB,kCAAkC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE/E;AASD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;kBA+B1B,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;kBAY1B,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACxC;AAoCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,gBAAgB,EAAE,OAAO,GACxB;IACD,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB,CAkDA;AAiID,eAAO,MAAM,kBAAkB,EAAE,mBAAmB,CAClD,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,CA+CvB,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}