cursedbelt 2.8.0 → 3.0.0

package/dist/server/guard/sessionSigner.js

@@ -1,304 +0,0 @@
-/**
- * The production session signer (02 §4.2) — Ed25519-signed `CCUserClaims` plus
- * the jti denylist that makes `lock()` mean something.
- *
- * The verify harness ships an HMAC stand-in because a probe suite tests the
- * DECISION table (signature validity, expiry, revocation), not the algorithm.
- * This is the real one, and the differences are the parts a stand-in cannot
- * model:
- *
- *   * **Asymmetric.** Only the server that holds the private key can mint a
- *     session. A verifier can be handed the public key alone, so a read-only
- *     replica or an edge worker can verify without being able to forge.
- *   * **Revocation is bounded, not unbounded.** A denylist that only ever grows
- *     is a memory leak wearing a security hat. An entry is dropped once its
- *     token would have expired anyway, because after `exp` the signature check
- *     already refuses it.
- *   * **Expiry before revocation.** An expired token is expired whether or not
- *     anyone bothered to revoke it — checking in the other order makes the
- *     denylist load-bearing for a case it does not need to cover.
- */
-import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from 'node:crypto';
-import { CCUserClaimsSchema } from '../../core/session/claims';
-import { AppError } from '../errors';
-const b64url = (input) => Buffer.from(input).toString('base64url');
-/** Ceiling on a client-supplied device label — display text, not a payload. */
-const MAX_DEVICE_LABEL = 64;
-let jtiSequence = 0;
-const defaultJti = () => {
-    jtiSequence += 1;
-    return `jti_${Date.now().toString(36)}_${jtiSequence.toString(36)}`;
-};
-export const createSessionSigner = (options = {}) => {
-    const now = options.now ?? (() => Date.now());
-    const mintJti = options.mintJti ?? defaultJti;
-    const ttlSeconds = options.ttlSeconds ?? 30 * 60;
-    let privateKey = null;
-    let publicKey;
-    if (options.privateKey !== undefined) {
-        privateKey =
-            typeof options.privateKey === 'string' || Buffer.isBuffer(options.privateKey)
-                ? createPrivateKey(options.privateKey)
-                : options.privateKey;
-        publicKey =
-            options.publicKey === undefined
-                ? createPublicKey(privateKey)
-                : typeof options.publicKey === 'string' || Buffer.isBuffer(options.publicKey)
-                    ? createPublicKey(options.publicKey)
-                    : options.publicKey;
-    }
-    else if (options.publicKey !== undefined) {
-        publicKey =
-            typeof options.publicKey === 'string' || Buffer.isBuffer(options.publicKey)
-                ? createPublicKey(options.publicKey)
-                : options.publicKey;
-    }
-    else {
-        const pair = generateKeyPairSync('ed25519');
-        privateKey = pair.privateKey;
-        publicKey = pair.publicKey;
-    }
-    /** jti → the epoch-seconds `exp` after which the entry is pointless. */
-    const revoked = new Map();
-    /**
-     * Live jtis this signer minted, per user — the index behind
-     * {@link SessionSigner.revokeUser} (02 §3's role change, 02 §4's "log out
-     * everywhere"). Deliberately NOT the cross-node picture: a node can only
-     * enumerate what it minted, so under saas the authority for "is this token
-     * dead" stays the shared `revocationStore` that `revokeUser` writes through
-     * to. Entries are dropped as they expire (`pruneMinted`), so this is bounded
-     * by live sessions, not by all sessions ever.
-     */
-    const mintedByUser = new Map();
-    /** jti → its minter, so a revoke can drop the record without scanning users. */
-    const userByJti = new Map();
-    const rememberMinted = (record) => {
-        const forUser = mintedByUser.get(record.userId) ?? new Map();
-        forUser.set(record.jti, record);
-        mintedByUser.set(record.userId, forUser);
-        userByJti.set(record.jti, record.userId);
-    };
-    /**
-     * Drop a jti from the live index. Called on every revoke, so a revoked session
-     * stops being a live one for BOTH `sessionsOf` (the panel) and `revokeUser`
-     * (whose count is then "sessions actually closed", not "jtis ever minted").
-     */
-    const forgetMinted = (jti) => {
-        const userId = userByJti.get(jti);
-        if (userId === undefined)
-            return;
-        userByJti.delete(jti);
-        const forUser = mintedByUser.get(userId);
-        forUser?.delete(jti);
-        if (forUser && forUser.size === 0)
-            mintedByUser.delete(userId);
-    };
-    const pruneMinted = () => {
-        const cutoff = Math.floor(now() / 1000);
-        for (const [userId, sessions] of mintedByUser) {
-            for (const [jti, record] of sessions)
-                if (record.exp <= cutoff) {
-                    sessions.delete(jti);
-                    userByJti.delete(jti);
-                }
-            if (sessions.size === 0)
-                mintedByUser.delete(userId);
-        }
-    };
-    // ── the cross-node denylist (03 §4a) ────────────────────────────────────────
-    const store = options.revocationStore;
-    const cacheTtlMs = options.revocationCacheTtlMs ?? 5000;
-    const onStoreError = options.onRevocationStoreError ?? (() => undefined);
-    /** jti → the last store verdict and when it was read, so `verify` stays sync. */
-    const storeCache = new Map();
-    /** In-flight async work, so `flushRevocations` (and shutdown) can await it. */
-    const pending = new Set();
-    /** Reads in flight per jti, so a burst of verifies coalesces into one store read. */
-    const inflightReads = new Map();
-    const track = (work) => {
-        pending.add(work);
-        void work.finally(() => pending.delete(work));
-    };
-    /** Read the store for `jti` off the hot path and fold the verdict into the cache. */
-    const refreshFromStore = (jti) => {
-        if (!store || inflightReads.has(jti))
-            return;
-        const read = store
-            .get(jti)
-            .then((exp) => {
-            storeCache.set(jti, { exp, readAtMs: now() });
-            // A confirmed revocation is promoted into the authoritative Map so every
-            // later verify is instant and `activeRevocations()` (the handover set)
-            // includes jtis this node learned about from its peers.
-            if (exp !== null) {
-                revoked.set(jti, exp);
-                // A peer revoked it, so it is no longer a live session here either.
-                forgetMinted(jti);
-            }
-        })
-            .catch((error) => onStoreError('get', error))
-            .finally(() => inflightReads.delete(jti));
-        inflightReads.set(jti, read);
-        track(read);
-    };
-    /**
-     * Is `jti` revoked, per the shared store? Answered synchronously from the cache;
-     * a stale or missing entry schedules a refresh but does NOT block. The bound on
-     * how stale the answer can be is `cacheTtlMs` — the cross-node latency the seam
-     * documents.
-     */
-    const storeSaysRevoked = (jti) => {
-        if (!store)
-            return false;
-        const cached = storeCache.get(jti);
-        if (cached === undefined || now() - cached.readAtMs >= cacheTtlMs)
-            refreshFromStore(jti);
-        // A fresh cached exp that is still in the future ⇒ revoked. An expired cached
-        // exp is treated as not-revoked: the signature check already refuses the
-        // token past `exp`, so the denylist has nothing left to add.
-        return cached?.exp != null && cached.exp * 1000 > now();
-    };
-    /**
-     * The one revocation write path — a free function rather than a method so
-     * `revokeUser` cannot depend on `this` (a destructured `const { revokeUser } =
-     * signer` would silently lose it, and losing a revocation is the one bug this
-     * seam must not have).
-     */
-    const revokeJti = (jti) => {
-        pruneRevocations();
-        // An unknown jti is still recorded: `lock()` may revoke a token this
-        // process never minted (another node in the fleet did), and refusing to
-        // remember it would let that token keep working here.
-        const exp = Math.floor(now() / 1000) + ttlSeconds;
-        revoked.set(jti, exp);
-        forgetMinted(jti);
-        // Write through so every OTHER node sees it too. Fire-and-forget: `revoke`
-        // is called on the request path (a `lock`), and the local Map already
-        // refuses the token HERE the instant this returns — propagation is what the
-        // store adds, and `flushRevocations`/the error hook cover its durability.
-        if (store) {
-            storeCache.set(jti, { exp, readAtMs: now() });
-            track(store.set(jti, exp).catch((error) => onStoreError('set', error)));
-        }
-    };
-    const pruneRevocations = () => {
-        const cutoff = Math.floor(now() / 1000);
-        for (const [jti, exp] of revoked)
-            if (exp <= cutoff)
-                revoked.delete(jti);
-        for (const [jti, cached] of storeCache)
-            if (cached.exp !== null && cached.exp <= cutoff)
-                storeCache.delete(jti);
-    };
-    return {
-        mint(input, meta) {
-            if (privateKey === null)
-                throw new AppError('This session signer holds only a public key and cannot mint tokens.', {
-                    code: 'GUARD_SIGNER_READONLY',
-                    status: 500,
-                    category: 'security',
-                    isOperational: false,
-                });
-            const claims = CCUserClaimsSchema.parse({
-                ...input,
-                exp: input.exp ?? Math.floor(now() / 1000) + ttlSeconds,
-                jti: input.jti ?? mintJti(),
-            });
-            const payload = b64url(JSON.stringify(claims));
-            const signature = b64url(sign(null, Buffer.from(payload), privateKey));
-            pruneMinted();
-            rememberMinted({
-                jti: claims.jti,
-                userId: claims.userId,
-                tenantId: claims.tenantId,
-                // A label is truncated rather than rejected: it is display text, and a
-                // login must never fail because a browser sent a long device string.
-                ...(meta?.deviceLabel ? { deviceLabel: meta.deviceLabel.slice(0, MAX_DEVICE_LABEL) } : {}),
-                issuedAt: Math.floor(now() / 1000),
-                exp: claims.exp,
-            });
-            return { token: `${payload}.${signature}`, claims };
-        },
-        verify(token) {
-            if (!token)
-                return { ok: false, failure: 'missing' };
-            const dot = token.indexOf('.');
-            if (dot <= 0 || dot === token.length - 1)
-                return { ok: false, failure: 'malformed' };
-            const payload = token.slice(0, dot);
-            const signature = token.slice(dot + 1);
-            let valid = false;
-            try {
-                valid = verify(null, Buffer.from(payload), publicKey, Buffer.from(signature, 'base64url'));
-            }
-            catch {
-                // A signature that is not even decodable is malformed, not merely wrong.
-                return { ok: false, failure: 'malformed' };
-            }
-            if (!valid)
-                return { ok: false, failure: 'invalid-signature' };
-            let parsedJson;
-            try {
-                parsedJson = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
-            }
-            catch {
-                return { ok: false, failure: 'malformed' };
-            }
-            const parsed = CCUserClaimsSchema.safeParse(parsedJson);
-            // `.strict()`: an unknown claim key is a forged or version-skewed token,
-            // and silently ignoring it is how a `permissions` typo becomes a grant.
-            if (!parsed.success)
-                return { ok: false, failure: 'malformed' };
-            if (parsed.data.exp * 1000 <= now())
-                return { ok: false, failure: 'expired' };
-            // Local Map first (this node's own revokes, and peers' revokes it has
-            // already learned) — always authoritative and free. Then the shared store,
-            // consulted through the sync cache, for a jti revoked on another node.
-            if (revoked.has(parsed.data.jti) || storeSaysRevoked(parsed.data.jti))
-                return { ok: false, failure: 'revoked' };
-            return { ok: true, claims: parsed.data };
-        },
-        revoke(jti) {
-            revokeJti(jti);
-        },
-        revokeUser(userId) {
-            pruneMinted();
-            const jtis = [...(mintedByUser.get(userId)?.keys() ?? [])];
-            for (const jti of jtis)
-                revokeJti(jti);
-            mintedByUser.delete(userId);
-            return jtis;
-        },
-        sessionsOf(userId) {
-            pruneMinted();
-            pruneRevocations();
-            return [...(mintedByUser.get(userId)?.values() ?? [])]
-                // A revoked-but-unexpired jti is a dead session; listing it would invite
-                // "log this device out" on a device that is already out.
-                .filter((record) => !revoked.has(record.jti) && !storeSaysRevoked(record.jti))
-                .sort((left, right) => right.issuedAt - left.issuedAt);
-        },
-        isRevoked(jti) {
-            pruneRevocations();
-            return revoked.has(jti) || storeSaysRevoked(jti);
-        },
-        activeRevocations() {
-            pruneRevocations();
-            return [...revoked.keys()];
-        },
-        async flushRevocations() {
-            // Settle in-flight work, then whatever it scheduled (a read can resolve
-            // after we snapshot), so the caller sees a fully-quiesced state.
-            while (pending.size > 0)
-                await Promise.allSettled([...pending]);
-            if (store)
-                track(store.prune(Math.floor(now() / 1000)).catch((error) => onStoreError('prune', error)));
-            while (pending.size > 0)
-                await Promise.allSettled([...pending]);
-        },
-        publicKeyPem() {
-            return publicKey.export({ type: 'spki', format: 'pem' }).toString();
-        },
-    };
-};
-//# sourceMappingURL=sessionSigner.js.map

package/dist/server/guard/sessionSigner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sessionSigner.js","sourceRoot":"","sources":["../../../src/server/guard/sessionSigner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAkB,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACnH,OAAO,EAAqB,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAsHrC,MAAM,MAAM,GAAG,CAAC,KAAmC,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEzG,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,WAAW,IAAI,CAAC,CAAC;IACjB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,UAAgC,EAAE,EAAiB,EAAE;IACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,GAAG,EAAE,CAAC;IAEjD,IAAI,UAAU,GAAqB,IAAI,CAAC;IACxC,IAAI,SAAoB,CAAC;IAEzB,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,UAAU;YACR,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC3E,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC;gBACtC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACzB,SAAS;YACP,OAAO,CAAC,SAAS,KAAK,SAAS;gBAC7B,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC;gBAC7B,CAAC,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;oBAC3E,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC;oBACpC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC5B,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3C,SAAS;YACP,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;gBACzE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC;gBACpC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC5C,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7B,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7B,CAAC;IAED,wEAAwE;IACxE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C;;;;;;;;OAQG;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsC,CAAC;IACnE,gFAAgF;IAChF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAQ,EAAE;QACrD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAyB,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF;;;;OAIG;IACH,MAAM,YAAY,GAAG,CAAC,GAAW,EAAQ,EAAE;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO;QACjC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,QAAQ;gBAClC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC;oBACzB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACrB,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;YACH,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;gBAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC;IAEF,+EAA+E;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC;IACxD,MAAM,YAAY,GAAG,OAAO,CAAC,sBAAsB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzE,iFAAiF;IACjF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC/E,+EAA+E;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,qFAAqF;IACrF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEvD,MAAM,KAAK,GAAG,CAAC,IAAsB,EAAQ,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,qFAAqF;IACrF,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAQ,EAAE;QAC7C,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC7C,MAAM,IAAI,GAAG,KAAK;aACf,GAAG,CAAC,GAAG,CAAC;aACR,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9C,yEAAyE;YACzE,uEAAuE;YACvE,wDAAwD;YACxD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACtB,oEAAoE;gBACpE,YAAY,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aAC5C,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAW,EAAE;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,IAAI,UAAU;YAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACzF,8EAA8E;QAC9E,yEAAyE;QACzE,6DAA6D;QAC7D,OAAO,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;IAC1D,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,SAAS,GAAG,CAAC,GAAW,EAAQ,EAAE;QACtC,gBAAgB,EAAE,CAAC;QACnB,qEAAqE;QACrE,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,GAAS,EAAE;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO;YAAE,IAAI,GAAG,IAAI,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,UAAU;YAAE,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM;gBAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClH,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,CAAC,KAAK,EAAE,IAAI;YACd,IAAI,UAAU,KAAK,IAAI;gBACrB,MAAM,IAAI,QAAQ,CAAC,qEAAqE,EAAE;oBACxF,IAAI,EAAE,uBAAuB;oBAC7B,MAAM,EAAE,GAAG;oBACX,QAAQ,EAAE,UAAU;oBACpB,aAAa,EAAE,KAAK;iBACrB,CAAC,CAAC;YAEL,MAAM,MAAM,GAAiB,kBAAkB,CAAC,KAAK,CAAC;gBACpD,GAAG,KAAK;gBACR,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU;gBACvD,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,EAAE;aAC5B,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;YACvE,WAAW,EAAE,CAAC;YACd,cAAc,CAAC;gBACb,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,uEAAuE;gBACvE,qEAAqE;gBACrE,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAClC,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,CAAC,KAAyB;YAC9B,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YACrF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACpC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAEvC,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7F,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;YAE/D,IAAI,UAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YAC7C,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACxD,yEAAyE;YACzE,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YAEhE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC9E,sEAAsE;YACtE,2EAA2E;YAC3E,uEAAuE;YACvE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAChH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,CAAC,GAAW;YAChB,SAAS,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QAED,UAAU,CAAC,MAAc;YACvB,WAAW,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC;YACvC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,UAAU,CAAC,MAAc;YACvB,WAAW,EAAE,CAAC;YACd,gBAAgB,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpD,yEAAyE;gBACzE,yDAAyD;iBACxD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;iBAC7E,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;QAED,SAAS,CAAC,GAAW;YACnB,gBAAgB,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,iBAAiB;YACf,gBAAgB,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,gBAAgB;YACpB,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAChE,IAAI,KAAK;gBAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACvG,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,YAAY;YACV,OAAO,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/server/incidents/channels.d.ts

@@ -1,162 +0,0 @@
-/**
- * How an incident reaches the owner. Three channels, and a hard rule about which
- * incidents are allowed which.
- *
- * ── The severity split is the feature ───────────────────────────────────────
- * The owner asked for "an email and a text message about blocking issues like
- * these (can't deploy, can't ingest files)". A warning that texts him is a
- * warning that gets the channel muted, and a muted channel puts him back where
- * this whole unit started — finding out days later, by accident. So: in-app for
- * everything, email + text for `blocking` only, and `notifier.ts` is the only
- * place that decision is made.
- *
- * ── 🔴 "Sent" is a claim; this module deals in evidence ─────────────────────
- * `fleet/rules/automation-over-documentation.md` — *"treat 'I could not prove it
- * worked' as a failure rather than a pass"*. Both remote channels here can
- * succeed loudly and deliver nothing:
- *
- *  - **iMessage.** `osascript` exits 0 the moment Messages accepts the string.
- *    Whether anything left the machine is a separate question, and the answer is
- *    in `~/Library/Messages/chat.db` — so {@link createTextChannel} reads back
- *    an outgoing row with `is_sent = 1` before it will call the send delivered.
- *    Without that read it is `unproven`, which is NOT success.
- *  - **Email.** The fleet's mailer is best-effort by contract and returns
- *    `false` on both "mail is off here" and "SES refused". That is right for a
- *    signup mail and wrong for an outage alert, so the result is carried, not
- *    swallowed, and the console shows it on the incident.
- *
- * ── Why the text channel is AppleScript and not an SMS API ──────────────────
- * Measured on this Mac, 2026-08-20, while building this: neither IAM user the
- * console holds can call SES (`satellite-cloud` and `satellite-console-prod`
- * both answer `AccessDenied` on `ses:GetSendQuota`), and the Gmail refresh token
- * in `openclaw-digest.env` is revoked (`invalid_grant`). Messages.app is signed
- * in, has an enabled iMessage account, and its Automation grant is already in
- * place — one `osascript` reached the owner's phone in under a second with
- * `is_sent = 1, is_delivered = 1` in `chat.db`. It costs nothing, needs no
- * credential, and — the property that decides it — **it does not depend on the
- * prod box**, which is exactly the thing most likely to be down when an alert
- * matters. An SMS provider would have been a new bill and a new secret to reach
- * the same phone less reliably.
- */
-/** What a channel did. `unproven` is deliberately distinct from `delivered`. */
-export type ChannelOutcome = "delivered" | "unproven" | "skipped" | "failed";
-export interface ChannelResult {
-    channel: string;
-    outcome: ChannelOutcome;
-    /** One line, for the incident row and the console. Never carries the message body. */
-    detail: string;
-}
-/** One line of a notification. Channels render it themselves — see `notifier.ts`. */
-export interface ChannelMessage {
-    subject: string;
-    /** Plain text. Short enough for a phone; the console holds the full record. */
-    text: string;
-    /** Longer HTML, for email only. Optional — a channel may ignore it. */
-    html?: string;
-    /** `blocking` or `warning`, so a channel may refuse what it is not for. */
-    severity: "blocking" | "warning";
-    /**
-     * Channels this message must NOT use, by key. The notifier sets it when the
-     * message is ABOUT a channel being broken — telling somebody down a wire that
-     * the wire is down is the loop this field exists to cut. **Enforced in
-     * `notifier.ts`, once**, so a channel added later cannot forget it.
-     */
-    avoid?: readonly string[];
-}
-export interface IncidentChannel {
-    readonly key: string;
-    /** Human name for the console's channel-health row. */
-    readonly label: string;
-    send: (message: ChannelMessage) => Promise<ChannelResult>;
-}
-export interface TextChannelOptions {
-    /** The handle to text — a phone number in E.164, or an iMessage address. */
-    handle: string;
-    /** Overridable for tests. Default: run `osascript`. */
-    send?: (handle: string, body: string) => Promise<{
-        ok: boolean;
-        detail: string;
-    }>;
-    /**
-     * Overridable for tests. Default: read `~/Library/Messages/chat.db` for an
-     * outgoing row newer than `sinceAppleTime`. Returns null when the database
-     * cannot be read at all — which is `unproven`, not `failed`.
-     */
-    proveSent?: (sinceAppleTime: number) => Promise<boolean | null>;
-    /** How long to wait for the proof row. Default 8s; one arrived in <1s when measured. */
-    proofTimeoutMs?: number;
-}
-/**
- * Text the owner from this Mac, and prove it left. Mac-only by construction; the
- * prod deployment of the console never registers it (see `notifier.ts`).
- */
-export declare function createTextChannel(options: TextChannelOptions): IncidentChannel;
-/** The one thing this module needs from a mail sender. Matches the fleet's `Mailer`. */
-export type SendEmail = (params: {
-    to: string;
-    subject: string;
-    text: string;
-    html: string;
-    template?: string;
-}) => Promise<boolean>;
-export interface EmailChannelOptions {
-    to: string;
-    send: SendEmail;
-    /**
-     * Why this deployment might not be able to send — surfaced verbatim when the
-     * send returns false, because "false" from a best-effort mailer means both
-     * "mail is off on this host" and "SES refused" and the owner needs to know
-     * which. E.g. "MAIL_ON is unset on the local-mac console".
-     */
-    unavailableHint?: string;
-}
-export declare function createEmailChannel(options: EmailChannelOptions): IncidentChannel;
-/**
- * Email, sent by SOMEBODY ELSE. The Mac cannot reach SES (see the module
- * header), and the prod box can — so the local console hands the message to the
- * prod console over the wire the two already share.
- *
- * 🔴 It is a fallback and never the only path. The failure mode it cannot cover
- * is the one where prod is down, which is precisely when an alert matters most —
- * that case belongs to the text channel, which runs entirely on this Mac.
- */
-export declare function createRelayEmailChannel(options: {
-    /** e.g. `https://admin.cursedalchemy.com/api/station/incidents/mail/relay-email`. */
-    url: string;
-    /** Shared bearer — the console's existing sync token. */
-    token: string;
-    /**
-     * 🔴 Headers the EDGE needs, distinct from the bearer the app needs.
-     *
-     * The prod console sits behind a Cloudflare Access application, so a plain
-     * bearer request never reaches the origin at all — Access answers 302 to its
-     * own login page. Measured 2026-08-21: `fetch` FOLLOWED that redirect, got a
-     * 200 of HTML, and this channel reported "the prod console accepted the
-     * request but its mailer declined". Every word of that was wrong and it named
-     * the wrong host's component. The caller supplies the service-token headers
-     * (satellite-kit's `accessHeadersForUrl`); this package must not know about
-     * Cloudflare.
-     */
-    edgeHeaders?: () => Record<string, string>;
-    fetchImpl?: typeof fetch;
-    timeoutMs?: number;
-}): IncidentChannel;
-/**
- * The in-app channel is the fleet's EXISTING notification primitive
- * (`cursedbelt/server/notifications` over `cwip/notifications`), not a second
- * inbox. Pass its `notify` and the incident's fingerprint becomes the
- * notification's `groupKey`, so the database's partial unique index coalesces
- * repeats for free — the same guarantee the store makes, enforced a second time
- * one layer down.
- */
-export declare function createInAppChannel(options: {
-    notify: (input: {
-        title: string;
-        body: string;
-        groupKey: string;
-        severity: "blocking" | "warning";
-    }) => Promise<void> | void;
-    /** The fingerprint of the incident being announced. Set per-message by the notifier. */
-    groupKeyOf: (message: ChannelMessage) => string;
-}): IncidentChannel;
-//# sourceMappingURL=channels.d.ts.map

package/dist/server/incidents/channels.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../../../src/server/incidents/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE7E,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,cAAc,CAAC;IACxB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;CACf;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1D;AAyED,MAAM,WAAW,kBAAkB;IAClC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAChE,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AA6ED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,eAAe,CAsC9E;AAID,wFAAwF;AACxF,MAAM,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,eAAe,CAgChF;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAChD,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,eAAe,CAqElB;AAID;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,CAAC,KAAK,EAAE;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B,wFAAwF;IACxF,UAAU,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CAChD,GAAG,eAAe,CAsBlB"}