happy2 0.0.16 → 0.0.17

package/Dockerfile

@@ -0,0 +1,30 @@
+# Build from the repository root:
+# docker build -t slopus/happy2 .
+FROM node:24-bookworm-slim AS build
+WORKDIR /workspace
+RUN corepack enable
+COPY .npmrc package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY packages/happy2-server/package.json packages/happy2-server/package.json
+COPY packages/happy2-state/package.json packages/happy2-state/package.json
+COPY packages/happy2-ui/package.json packages/happy2-ui/package.json
+COPY packages/happy2-app/package.json packages/happy2-app/package.json
+COPY packages/happy2-web/package.json packages/happy2-web/package.json
+COPY packages/happy2-gym/package.json packages/happy2-gym/package.json
+RUN pnpm install --frozen-lockfile --filter happy2-server --filter happy2-web...
+COPY tsconfig.base.json tsconfig.json ./
+COPY packages/happy2-server packages/happy2-server
+COPY packages/happy2-state packages/happy2-state
+COPY packages/happy2-ui packages/happy2-ui
+COPY packages/happy2-app packages/happy2-app
+COPY packages/happy2-web packages/happy2-web
+RUN pnpm --filter happy2-server build:server \
+  && VITE_HAPPY2_SERVER_URL=/ pnpm --filter happy2-web exec vite build --outDir ../happy2-server/dist/web --emptyOutDir false \
+  && pnpm --filter happy2-server --prod deploy --legacy /app
+
+FROM node:24-bookworm-slim
+ENV NODE_ENV=production
+WORKDIR /app
+COPY --from=build --chown=node:node /app ./
+USER node
+EXPOSE 3000
+ENTRYPOINT ["node", "dist/runner.js"]

package/README.md

@@ -19,6 +19,7 @@
 
 <p>
   <a href="#quick-start">Quick start</a> ·
+  <a href="#configuration">Configuration</a> ·
   <a href="#why-happy-2">Why Happy (2)?</a> ·
   <a href="#how-it-works">How it works</a> ·
   <a href="#project-components">Project components</a> ·
@@ -78,6 +79,175 @@ as its working directory and uses its `.happy2` state. When started through
 `npx`, the generated service runs `npx --yes happy2` instead of depending on an
 evictable `_npx` cache path.
 
+## Configuration
+
+Happy (2) uses the following configuration precedence:
+
+1. `--config /path/to/happy2.toml`
+2. `HAPPY2_CONFIG=/path/to/happy2.toml`
+3. `./.happy2/happy2.toml`, when it exists
+4. Built-in defaults
+
+TOML configuration is partial. Happy (2) recursively merges the supplied fields
+over the built-in defaults, so this is enough to expose the public listener:
+
+```toml
+[server]
+host = "0.0.0.0"
+```
+
+The managed path is relative to the directory where Happy (2) starts. Relative
+database, file, plugin, key, and agent paths are also resolved from that working
+directory, not from the TOML file's directory. The standalone `happy2` and
+`happy2 backend` commands use this configuration; `happy2 web` has its own CLI
+options because it only serves the SPA and proxies `/v0`.
+
+### Complete TOML reference
+
+All supported keys are shown below. Uncomment optional keys only when needed.
+The active values are equivalent to the built-in local defaults. For readability,
+paths are shown relative to the working directory; generated defaults store those
+same locations as absolute paths.
+
+```toml
+[server]
+# all: authentication + product API; auth: authentication only; api: validation only
+role = "all"
+host = "127.0.0.1"
+port = 3000
+public_url = "http://127.0.0.1:3000"
+# Number of trusted proxies outside Happy (2). Keep 0 for direct connections.
+trusted_proxy_hops = 0
+
+[database]
+url = "file:.happy2/happy2.db"
+# Name of the environment variable containing a remote libSQL auth token.
+# auth_token_env = "HAPPY2_DATABASE_AUTH_TOKEN"
+
+[agents]
+enabled = true
+# These default to the private Rig runtime under .happy2/rig.
+# socket_path = ".happy2/rig/server.sock"
+# token_path = ".happy2/rig/token"
+# command = "/absolute/path/to/rig"
+default_cwd = ".happy2/workspaces"
+
+[files]
+provider = "local"
+directory = ".happy2/files"
+signed_url_expiry_seconds = 300
+max_upload_bytes = 536870912
+resumable_chunk_bytes = 8388608
+# Zero disables the corresponding quota.
+per_user_quota_bytes = 0
+server_quota_bytes = 0
+incomplete_upload_expiry_seconds = 86400
+quarantine_retention_seconds = 2592000
+# malware_scanner_command = "/usr/local/bin/clamscan"
+malware_scanner_arguments = []
+malware_scan_timeout_seconds = 120
+malware_scan_failure_mode = "deny" # deny or allow
+
+[plugins]
+directory = ".happy2/plugins"
+# Capability-only API used by plugin containers. Firewall it from untrusted networks.
+host_api_host = "0.0.0.0"
+host_api_port = 3001
+
+[security]
+# Name of the environment variable containing the integration encryption secret.
+integration_secret_env = "HAPPY2_INTEGRATION_SECRET"
+
+[security.rate_limit]
+enabled = true
+reads_per_minute = 1200
+writes_per_minute = 300
+auth_per_minute = 30
+
+[security.idempotency]
+enabled = true
+lease_seconds = 30
+retention_seconds = 86400
+
+[jwt]
+issuer = "http://127.0.0.1:3000"
+audience = "happy2-desktop"
+key_id = "local-generated"
+expiry_days = 30
+# PEM files may replace environment or generated keys.
+# private_key_path = "/run/secrets/happy2-jwt-private.pem"
+# public_key_path = "/run/secrets/happy2-jwt-public.pem"
+
+# Password is the default. Set it to false before enabling magic link, OIDC,
+# or Cloudflare Access; exactly one authentication method may be enabled.
+[auth.password]
+enabled = true
+
+[auth.dev_tokens]
+# This augments the selected authentication method; it is not a separate method.
+enabled = false
+
+[auth.magic_link]
+enabled = false
+# from = "Happy (2) <noreply@example.com>"
+# redirect_url = "happy2://auth/magic-link"
+
+# Replace "example" with a stable provider ID.
+[auth.oidc.example]
+enabled = false
+# discovery_url = "https://id.example.com/.well-known/openid-configuration"
+# client_id = "happy2"
+# client_secret_env = "HAPPY2_OIDC_EXAMPLE_CLIENT_SECRET"
+# scopes = ["openid", "email", "profile"]
+# redirect_path = "/v0/auth/oidc/example/callback"
+
+[auth.cloudflare_access]
+enabled = false
+# team_domain = "https://team.cloudflareaccess.com"
+# audience = "cloudflare-access-application-aud"
+```
+
+For a reverse-proxied deployment such as `https://happy.example.com`, the
+listener can remain on `127.0.0.1`; set `server.public_url` and `jwt.issuer` to
+the public HTTPS origin and set `server.trusted_proxy_hops` to the exact number
+of trusted proxies in front of Happy (2). Binding `server.host = "0.0.0.0"` is
+only necessary when another machine or container must connect directly.
+
+### Secrets and environment
+
+Real process environment values take precedence over values loaded from the
+private `.env` beside the selected TOML path. If no explicit config is selected,
+that file is `./.happy2/.env`, whether or not `./.happy2/happy2.toml` exists.
+
+For an `all` or `auth` server without configured JWT key files or environment
+keys, Happy (2) generates a 3072-bit RS256 key pair and stores
+`HAPPY2_JWT_PRIVATE_KEY_B64` and `HAPPY2_JWT_PUBLIC_KEY_B64` in that `.env`.
+It also generates `HAPPY2_PASSWORD_PEPPER` when password auth is enabled and the
+configured integration secret when missing. The file is created with mode
+`0600`; back it up and keep it private. Replacing the JWT keys invalidates
+existing session tokens, while replacing the password pepper prevents existing
+password hashes from verifying. An `api`-only server must be given the matching
+public key because it does not generate a signing pair.
+
+Supported server and runner environment settings are:
+
+| Variable | Purpose |
+| --- | --- |
+| `HAPPY2_CONFIG` | Selects a TOML file when `--config` is absent. |
+| `HAPPY2_JWT_PRIVATE_KEY`, `HAPPY2_JWT_PUBLIC_KEY` | PEM keys; literal `\n` sequences are accepted. |
+| `HAPPY2_JWT_PRIVATE_KEY_B64`, `HAPPY2_JWT_PUBLIC_KEY_B64` | Base64-encoded PEM keys used by generated local configuration. |
+| `HAPPY2_PASSWORD_PEPPER` | Server-wide password pepper. |
+| `HAPPY2_INTEGRATION_SECRET` | Default integration encryption secret; the variable name is configurable. |
+| `RIG_HOME` | Absolute path for Happy's private Rig runtime. |
+| `RIG_SERVER_SOCKET_PATH`, `RIG_SERVER_TOKEN_PATH`, `RIG_COMMAND` | Override omitted agent socket, token, and command fields. |
+| `EMAIL_SMTP_HOST`, `EMAIL_SMTP_PORT`, `EMAIL_SMTP_USER`, `EMAIL_SMTP_PASSWORD` | Required SMTP credentials for magic-link auth. |
+| `EMAIL_FROM` | Overrides `auth.magic_link.from`. |
+| `HAPPY2_BACKEND_URL` | Backend origin for the separate `happy2 web` command. |
+| `HAPPY2_WEB_HOST`, `HAPPY2_WEB_PORT`, `HAPPY2_WEB_TRUSTED_PROXY_HOPS` | Listener settings for `happy2 web`. |
+
+`database.auth_token_env`, `security.integration_secret_env`, and each OIDC
+provider's `client_secret_env` may name additional environment variables.
+
 ## Why Happy (2)?
 
 - **People and agents share the same workspace.** Conversations, threads,

package/deploy/config.yaml

@@ -0,0 +1,56 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: happy2-web-config
+data:
+  HAPPY2_BACKEND_URL: http://happy2-server:3000
+  HAPPY2_WEB_HOST: 0.0.0.0
+  HAPPY2_WEB_PORT: "3000"
+  HAPPY2_WEB_TRUSTED_PROXY_HOPS: "1"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: happy2-server-config
+data:
+  happy2.toml: |
+    [server]
+    role = "all"
+    host = "0.0.0.0"
+    port = 3000
+    public_url = "{public_url}"
+    trusted_proxy_hops = 1
+
+    [database]
+    url = "file:/data/happy2.db"
+
+    [agents]
+    enabled = false
+    default_cwd = "/data/workspaces"
+
+    [files]
+    provider = "local"
+    directory = "/data/files"
+
+    [plugins]
+    directory = "/data/plugins"
+    host_api_host = "127.0.0.1"
+    host_api_port = 3001
+
+    [security]
+    integration_secret_env = "HAPPY2_INTEGRATION_SECRET"
+
+    [jwt]
+    issuer = "{public_url}"
+    audience = "happy2-desktop"
+    key_id = "kubernetes"
+    expiry_days = 30
+
+    [auth.password]
+    enabled = true
+
+    [auth.magic_link]
+    enabled = false
+
+    [auth.cloudflare_access]
+    enabled = false

package/deploy/happy2-server.yaml

@@ -0,0 +1,140 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: happy2-server
+spec:
+  serviceName: happy2-server-headless
+  replicas: 1
+  selector:
+    matchLabels:
+      app: happy2-server
+  template:
+    metadata:
+      labels:
+        app: happy2-server
+    spec:
+      securityContext:
+        fsGroup: 1000
+        runAsGroup: 1000
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        - name: copy-config
+          image: {version}
+          command:
+            - sh
+            - -c
+            - mkdir -p /data/config && cp /config-template/happy2.toml /data/config/happy2.toml
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+          volumeMounts:
+            - name: happy2-data
+              mountPath: /data
+            - name: config-template
+              mountPath: /config-template
+              readOnly: true
+      containers:
+        - name: happy2-server
+          image: docker.korshakov.com/happy2:{version}
+          args:
+            - backend
+            - --config
+            - /data/config/happy2.toml
+          ports:
+            - containerPort: 3000
+              name: http
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: happy2-data
+              mountPath: /data
+          livenessProbe:
+            httpGet:
+              path: /v0/health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /v0/health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+          startupProbe:
+            httpGet:
+              path: /v0/health
+              port: http
+            periodSeconds: 10
+            failureThreshold: 12
+      volumes:
+        - name: config-template
+          configMap:
+            name: happy2-server-config
+  volumeClaimTemplates:
+    - metadata:
+        name: happy2-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 10Gi
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: happy2-server
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: happy2-server
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: happy2-server-headless
+spec:
+  clusterIP: None
+  selector:
+    app: happy2-server
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: happy2-server
+spec:
+  selector:
+    app: happy2-server
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+  type: ClusterIP

package/deploy/happy2-web.yaml

@@ -0,0 +1,87 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: happy2-web
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: happy2-web
+  template:
+    metadata:
+      labels:
+        app: happy2-web
+    spec:
+      securityContext:
+        runAsGroup: 1000
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: happy2-web
+          image: docker.korshakov.com/happy2:{version}
+          args:
+            - web
+          envFrom:
+            - configMapRef:
+                name: happy2-web-config
+          ports:
+            - containerPort: 3000
+              name: http
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+          startupProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 10
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: happy2-web
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: happy2-web
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: happy2-web
+spec:
+  selector:
+    app: happy2-web
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+  type: ClusterIP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "happy2",
-  "version": "0.0.16",
+  "version": "0.0.17",
   "description": "Happy (2) desktop web app and server bundle",
   "repository": {
     "type": "git",
@@ -17,7 +17,8 @@
     "packages/happy2-server/happy2.example.toml",
     "packages/happy2-server/README.md",
     "packages/happy2-server/PLUGINS.md",
-    "packages/happy2-server/Dockerfile"
+    "Dockerfile",
+    "deploy"
   ],
   "type": "module",
   "main": "./packages/happy2-server/dist/index.js",

package/packages/happy2-server/README.md

@@ -14,6 +14,10 @@ npx happy2-server --config ./happy2.toml
 # Published all-in-one web app and API on http://127.0.0.1:3000
 npx happy2
 
+# The same package can run only the backend or only the web gateway
+npx happy2 backend --config ./happy2.toml
+npx happy2 web --backend-url http://127.0.0.1:3001 --host 0.0.0.0 --port 3000
+
 # Install or remove automatic startup for the all-in-one app
 npx happy2 service start --config ./happy2.toml
 npx happy2 service stop
@@ -42,17 +46,35 @@ HTTP, uploads, and server-sent events. The configured `trusted_proxy_hops`
 continues to describe only proxies outside Happy (2); the private loopback hop is
 handled internally.
 
-Without a TOML file, the package starts an `all`-role app on `127.0.0.1:3000`
-with SQLite, password authentication, and generated JWT/pepper
-material. Database, files, generated secrets, agent workspaces, and Rig runtime
-state live under `.happy2` in the invoking directory. Add `.happy2` to the
-project's ignore rules and preserve it as private application state. The
-package starts its bundled `@slopus/rig` executable with a private Rig home under
+`happy2 backend` starts the configured API directly without serving web assets.
+`happy2 web` starts only the bundled SPA and a same-origin `/v0` reverse proxy;
+it does not load a TOML file, open a database, or start Rig. Its backend must be
+an HTTP(S) origin supplied by `--backend-url` or `HAPPY2_BACKEND_URL`. The web
+listener can also be set with `--host`/`HAPPY2_WEB_HOST`,
+`--port`/`HAPPY2_WEB_PORT`, and
+`--trusted-proxy-hops`/`HAPPY2_WEB_TRUSTED_PROXY_HOPS`. The backend origin must
+not contain credentials, a path, a query, or a fragment.
+
+When the services are split, set the backend's `server.public_url` to the public
+web origin. If the backend is reachable only through the Happy web gateway, set
+its `server.trusted_proxy_hops` to `1`, because that gateway supplies one
+sanitized forwarding hop. Configure the web gateway's trusted hop count for the
+Ingress or load balancer in front of it.
+
+The package starts an `all`-role app on `127.0.0.1:3000` with SQLite, password
+authentication, and generated JWT/pepper material by default. It reads
+`./.happy2/happy2.toml` when that file exists and recursively merges its fields
+over the built-in defaults; the file may therefore contain only the values that
+need to change. `--config /path/to/happy2.toml` or
+`HAPPY2_CONFIG=/path/to/happy2.toml` selects a different partial configuration.
+
+Database, files, generated secrets, agent workspaces, and Rig runtime state live
+under `.happy2` in the invoking directory by default. Add `.happy2` to the
+project's ignore rules and preserve it as private application state. The package
+starts its bundled `@slopus/rig` executable with a private Rig home under
 `.happy2/rig` by default, containing configuration, runtime settings, session
 state, socket, and token. Set `RIG_HOME` to an absolute path to relocate it. The
-package never connects to the user's global Rig daemon. Provide
-`--config /path/to/happy2.toml` or
-`HAPPY2_CONFIG=/path/to/happy2.toml` to override the defaults.
+package never connects to the user's global Rig daemon.
 
 `happy2 service start` keeps the all-in-one app running across restarts. On
 macOS it installs `~/Library/LaunchAgents/com.slopus.happy2.plist` without
@@ -197,13 +219,44 @@ environment variable named by `database.auth_token_env`.
 Build the image from the repository root:
 
 ```sh
-docker build -f packages/happy2-server/Dockerfile -t slopus/happy2 .
+docker build -t slopus/happy2 .
 docker run --rm -p 3000:3000 -v "$PWD/happy2.toml:/app/happy2.toml:ro" slopus/happy2 --config /app/happy2.toml
 ```
 
 Mount a writable directory containing `happy2.toml` when using generated key
 material, because the adjacent `.env` file is the durable key store.
 
+The image contains the same three runtime modes as the `happy2` executable. For
+example, an independently deployed backend and web gateway can use:
+
+```sh
+docker run --rm -p 3001:3001 -v "$PWD/happy2.toml:/app/happy2.toml:ro" \
+  slopus/happy2 backend --config /app/happy2.toml
+docker run --rm -p 3000:3000 slopus/happy2 web \
+  --backend-url http://host.docker.internal:3001 --host 0.0.0.0
+```
+
+## Kubernetes deployment
+
+The top-level manifests follow the deployment layout used by Happy. Replace
+`{version}` in both workload files and `{public_url}` in the shared config, then
+apply the configuration, server, and web resources:
+
+```sh
+kubectl apply -f deploy/config.yaml
+kubectl apply -f deploy/happy2-server.yaml
+kubectl apply -f deploy/happy2-web.yaml
+```
+
+The server runs as a one-replica StatefulSet because its SQLite database, files,
+generated signing material, and plugin state share one `ReadWriteOnce` volume.
+The checked-in configuration disables local coding-agent execution because the
+pod does not receive a Docker or Podman sandbox provider. The stateless web
+Deployment runs three replicas. Each serves the bundled SPA and proxies `/v0`,
+including uploads and SSE, to the internal `happy2-server` Service. Add an
+Ingress for the `happy2-web` Service according to the cluster's ingress and TLS
+conventions.
+
 ## Authentication
 
 Choose exactly one of password, magic-link, OIDC, or Cloudflare Access in `happy2.toml`; startup
@@ -278,11 +331,13 @@ reuse Cloudflare's HttpOnly application cookie.
 On initial startup, external environment values win. If an auth-capable server
 has no JWT private key configured, it generates a 3072-bit RS256 key pair and
 adds base64-encoded `HAPPY2_JWT_PRIVATE_KEY_B64` and
-`HAPPY2_JWT_PUBLIC_KEY_B64` to the `.env` file beside its TOML file. It likewise
-adds `HAPPY2_PASSWORD_PEPPER` when password auth is enabled. Preserve that file
-as a secret; replacing it invalidates existing passwords and sessions. You may
-instead supply those variables through the deployment environment or mount PEM
-key files via the `jwt` config.
+`HAPPY2_JWT_PUBLIC_KEY_B64` to the `.env` file beside the selected TOML path.
+For the managed default path this is `./.happy2/.env`, whether or not
+`./.happy2/happy2.toml` exists. It likewise adds `HAPPY2_PASSWORD_PEPPER` when
+password auth is enabled. Preserve that file as a secret; replacing it
+invalidates existing passwords and sessions. You may instead supply those
+variables through the deployment environment or mount PEM key files via the
+`jwt` config.
 
 Sessions are signed JWTs with a 30-day default lifetime and a stable `sid`.
 `POST /v0/auth/refresh` re-signs the same session ID and advances the database

package/packages/happy2-server/dist/backend.d.ts

@@ -0,0 +1,12 @@
+import type { ServerConfig } from "./modules/config/type.js";
+export interface RunningHappy2 extends AsyncDisposable {
+    /** Actual bound URL. This differs from config.server.publicUrl when port 0 is used. */
+    url: string;
+    close(): Promise<void>;
+}
+export interface BackendOptions {
+    logger?: boolean;
+}
+/** Starts only the Happy (2) backend, without serving or proxying the web application. */
+export declare function startBackendHappy2(config: ServerConfig, options?: BackendOptions): Promise<RunningHappy2>;
+//# sourceMappingURL=backend.d.ts.map

package/packages/happy2-server/dist/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../sources/backend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAI7D,MAAM,WAAW,aAAc,SAAQ,eAAe;IAClD,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,0FAA0F;AAC1F,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,cAAmB,GAC7B,OAAO,CAAC,aAAa,CAAC,CAsCxB"}