viem 3.0.0-next.13 → 3.0.0-next.14

package/src/tempo/internal/relay/feePayer.ts

@@ -150,8 +150,8 @@ export function create(options: Relay.feePayer.Options): Relay.Plugin {
       if (!sponsored) return Request.fill(client, { ...base, feePayer: false })
 
       const defer =
-        typeof normalized.multisigSimulation === 'object' &&
-        normalized.multisigSimulation !== null
+        typeof normalized.accountSimulation === 'object' &&
+        normalized.accountSimulation !== null
 
       const sponsor = sponsored
         ? external
@@ -197,8 +197,8 @@ export function create(options: Relay.feePayer.Options): Relay.Plugin {
         typeof parameters.feePayer === 'string' ||
         parameters.feePayer === false ||
         !result.capabilities?.sponsored ||
-        (typeof parameters.multisigSimulation === 'object' &&
-          parameters.multisigSimulation !== null)
+        (typeof parameters.accountSimulation === 'object' &&
+          parameters.accountSimulation !== null)
       )
         return undefined
       const transaction = Utils.normalizeTempoTransaction(result.tx)
@@ -420,7 +420,7 @@ async function handleRawTransaction(options: handleRawTransaction.Options) {
     })
 
   const transaction = Transaction.deserialize(serialized)
-  // Prefer sender recovered from raw envelope; multisig finalize path supplies fallback sender.
+  // Prefer sender recovered from raw envelope; configurable account finalize path supplies fallback sender.
   const sender = transaction.from ?? options.sender
 
   // Sponsorship only applies after sender has signed original transaction.

package/src/tempo/internal/relay/keyAuthorization.ts

@@ -0,0 +1,419 @@
+import { Address, type Hex, RpcResponse } from 'ox'
+import {
+  AccountConfig,
+  AccountOperation,
+  KeyAuthorization,
+  SignatureEnvelope,
+} from 'ox/tempo'
+import { getNumber as getBlockNumber } from '../../../core/actions/block/getNumber.js'
+import type { Client } from '../../../core/Client.js'
+import { BaseError } from '../../../core/Errors.js'
+import { getMetadata } from '../../actions/accessKey/getMetadata.js'
+import { isWitnessBurned } from '../../actions/accessKey/isWitnessBurned.js'
+import type * as Relay from '../../Relay.js'
+import * as Store from '../../Store.js'
+import { selectApprovals, validateConfig } from './accounts.js'
+import * as Plugin from './plugin.js'
+
+/** Maximum compare-and-set attempts before a write is abandoned. */
+const maxWriteAttempts = 32
+
+/** Maximum time a pending key authorization is kept. */
+const maxTtl = 30 * 24 * 60 * 60 * 1_000
+
+/** Creates middleware that stores pending key authorizations and attaches them to fills. @internal */
+export function create(
+  options: Relay.keyAuthorization.Options = {},
+): Relay.keyAuthorization.ReturnType {
+  const { store = Store.memory() } = options
+  if (!store.compareAndSet)
+    throw new RpcResponse.InvalidParamsError({
+      message:
+        'Key authorization storage requires a store with atomic `compareAndSet`.',
+    })
+  return Plugin.keyAuthorization({
+    async handleRequest(context, next) {
+      const { request } = context
+
+      if (request.method === 'relay_saveKeyAuthorization') {
+        const keyAuthorization = parse(request.params?.[0])
+        const chainId = Number(keyAuthorization.chainId)
+        if (
+          context.options.chainId !== undefined &&
+          context.options.chainId !== chainId
+        )
+          throw new RpcResponse.InvalidParamsError({
+            message: 'Conflicting chain ids.',
+          })
+        const client = context.getClient(chainId)
+        const account = await check(client, keyAuthorization)
+        if (!account) return null
+        // Drop an unusable pending authorization so it cannot block this one.
+        await read(client, store, {
+          account,
+          accessKey: keyAuthorization.address,
+          chainId,
+        })
+        if (!(await write(store, { account, keyAuthorization })))
+          throw new RpcResponse.InvalidParamsError({
+            message:
+              'A pending key authorization for this access key expires later.',
+          })
+        return null
+      }
+
+      if (request.method === 'account_approveKeyAuthorization') {
+        await next()
+        const operation = AccountOperation.fromRpc(
+          context.result as AccountOperation.Rpc,
+        )
+        if (
+          operation.type !== 'keyAuthorization' ||
+          operation.status !== 'success'
+        )
+          return
+        const keyAuthorization = deserialize(operation.keyAuthorization)
+        if (!keyAuthorization) return
+        // Quorum may land after expiry, and a stored success may predate a config
+        // rotation. The approval succeeded, so failed checks skip storage instead
+        // of failing it.
+        const chainId = Number(keyAuthorization.chainId)
+        const client = context.getClient(chainId)
+        const account = await check(client, keyAuthorization).catch((error) => {
+          if (error instanceof RpcResponse.InvalidParamsError) return undefined
+          throw error
+        })
+        if (!account) return
+        await read(client, store, {
+          account,
+          accessKey: keyAuthorization.address,
+          chainId,
+        })
+        await write(store, { account, keyAuthorization })
+        return
+      }
+
+      if (request.method !== 'eth_fillTransaction') return next()
+
+      const { chainId } = context.options
+      const parameters = request.params?.[0] as Record<string, unknown>
+      const { from: account, keyId: accessKey } = parameters
+      if (
+        chainId === undefined ||
+        parameters.keyAuthorization ||
+        typeof account !== 'string' ||
+        typeof accessKey !== 'string' ||
+        !Address.validate(account, { strict: false }) ||
+        !Address.validate(accessKey, { strict: false })
+      )
+        return next()
+
+      const pending = await read(context.client, store, {
+        account,
+        accessKey,
+        chainId,
+      })
+      if (!pending) return next()
+      const metadata = await getMetadata(context.client, {
+        account,
+        accessKey,
+      })
+      // The key already landed onchain, so the authorization is spent.
+      if (isActive(metadata, accessKey)) {
+        await remove(store, pending)
+        return next()
+      }
+
+      // Attach before forwarding so gas estimation and later plugins see the authorization.
+      context.request = {
+        ...request,
+        params: [
+          {
+            ...parameters,
+            keyAuthorization: KeyAuthorization.toRpc(pending.keyAuthorization),
+          },
+        ],
+      }
+      return next()
+    },
+  })
+}
+
+/**
+ * Removes a stored authorization only while it still holds the value that was read,
+ * so a concurrently saved replacement survives. The empty value expires immediately.
+ * @internal
+ */
+export async function remove(
+  store: Store.Atomic,
+  options: { key: string; value: string },
+) {
+  const { key, value } = options
+  await store.compareAndSet(key, value, '', { expiresAt: Date.now() })
+}
+
+/**
+ * Stores an authorization unless a pending authorization for the same key expires
+ * later, so a replayed older authorization cannot replace a newer one.
+ * @internal
+ */
+export async function write(
+  store: Store.Atomic,
+  options: {
+    account: Address.Address
+    keyAuthorization: KeyAuthorization.Signed
+  },
+): Promise<boolean> {
+  const { account, keyAuthorization } = options
+  const key = getKey({
+    account,
+    accessKey: keyAuthorization.address,
+    chainId: Number(keyAuthorization.chainId),
+  })
+  const value = KeyAuthorization.serialize(keyAuthorization)
+  const expiresAt = Math.min(
+    Date.now() + maxTtl,
+    getExpiry(keyAuthorization) * 1_000,
+  )
+  for (let attempt = 0; attempt < maxWriteAttempts; attempt++) {
+    const current = (await store.getItem(key)) ?? null
+    const existing = current ? deserialize(current) : undefined
+    if (existing && current?.toLowerCase() === value.toLowerCase()) return true
+    if (existing && getExpiry(existing) >= getExpiry(keyAuthorization))
+      return false
+    // A lost compare-and-set means another writer replaced the value, so compare again.
+    if (await store.compareAndSet(key, current, value, { expiresAt }))
+      return true
+  }
+  throw new StoreConflictError()
+}
+
+/** Parses a signed key authorization from RPC parameters. */
+function parse(value: unknown): KeyAuthorization.Signed {
+  const keyAuthorization = (() => {
+    try {
+      if (typeof value === 'string') return deserialize(value)
+      return KeyAuthorization.fromRpc(value as KeyAuthorization.Rpc)
+    } catch {
+      return undefined
+    }
+  })()
+  if (!keyAuthorization?.signature)
+    throw new RpcResponse.InvalidParamsError({
+      message: 'Expected a signed key authorization.',
+    })
+  return keyAuthorization
+}
+
+/** Deserializes a signed key authorization, or returns `undefined` when malformed or unsigned. */
+function deserialize(value: string): KeyAuthorization.Signed | undefined {
+  try {
+    const { signature, ...rest } = KeyAuthorization.deserialize(
+      value as Hex.Hex,
+    )
+    if (!signature) return undefined
+    return { ...rest, signature }
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Validates an authorization and returns the account it authorizes, or `undefined`
+ * when the access key is already active onchain.
+ */
+async function check(
+  client: Client,
+  keyAuthorization: KeyAuthorization.Signed,
+): Promise<Address.Address | undefined> {
+  if (isExpired(keyAuthorization))
+    throw new RpcResponse.InvalidParamsError({
+      message: 'Key authorization has expired.',
+    })
+  const account = await verify(client, keyAuthorization)
+  if (await isBurned(client, { account, keyAuthorization }))
+    throw new RpcResponse.InvalidParamsError({
+      message: 'Key authorization witness has been burned.',
+    })
+  // Authorizations for keys that are already active would only be removed on the next fill.
+  const metadata = await getMetadata(client, {
+    account,
+    accessKey: keyAuthorization.address,
+  })
+  if (isActive(metadata, keyAuthorization.address)) return undefined
+  return account
+}
+
+/** Verifies the authorization signature and returns the account it authorizes. */
+async function verify(
+  client: Client,
+  keyAuthorization: KeyAuthorization.Signed,
+): Promise<Address.Address> {
+  const { signature, ...unsigned } = keyAuthorization
+  const payload = KeyAuthorization.getSignPayload(unsigned)
+
+  if (signature.type === 'configurable') {
+    if (
+      !keyAuthorization.account ||
+      !Address.isEqual(keyAuthorization.account, signature.account)
+    )
+      throw new RpcResponse.InvalidParamsError({
+        message:
+          'Configurable account key authorization account does not match its signature.',
+      })
+    const config = AccountConfig.from(signature.config)
+    await validateConfig({
+      account: signature.account,
+      blockNumber: await getBlockNumber(client, { cacheTime: 0 }),
+      client,
+      config,
+    })
+    const approvals = await selectApprovals({
+      account: signature.account,
+      approvals: signature.signatures.map((signature) =>
+        SignatureEnvelope.serialize(signature),
+      ),
+      config,
+      hash: AccountConfig.getSignPayload({
+        account: signature.account,
+        config,
+        payload,
+      }),
+    })
+    if (approvals.weight < approvals.threshold)
+      throw new RpcResponse.InvalidParamsError({
+        message:
+          'Configurable account key authorization has not reached quorum.',
+      })
+    return signature.account
+  }
+
+  const signer = (() => {
+    try {
+      const signer = SignatureEnvelope.extractAddress({ payload, signature })
+      if (SignatureEnvelope.verify(signature, { address: signer, payload }))
+        return signer
+    } catch {}
+    throw new RpcResponse.InvalidParamsError({
+      message: 'Invalid key authorization signature.',
+    })
+  })()
+
+  // Admin-signed authorizations can only be submitted by the admin key itself,
+  // so only authorizations signed by the account can be attached for the new key.
+  if (
+    keyAuthorization.account &&
+    !Address.isEqual(keyAuthorization.account, signer)
+  )
+    throw new RpcResponse.InvalidParamsError({
+      message: 'Key authorization must be signed by its account.',
+    })
+  return signer
+}
+
+/**
+ * Reads the pending authorization for an access key. Entries that are malformed,
+ * expired, no longer verify, or whose witness has been burned are removed.
+ */
+async function read(
+  client: Client,
+  store: Store.Atomic,
+  options: {
+    account: Address.Address
+    accessKey: Address.Address
+    chainId: number
+  },
+) {
+  const { account } = options
+  const key = getKey(options)
+  const value = await store.getItem(key)
+  if (!value) return undefined
+  const keyAuthorization = deserialize(value)
+  if (
+    keyAuthorization &&
+    !isExpired(keyAuthorization) &&
+    (await isVerified(client, keyAuthorization)) &&
+    !(await isBurned(client, { account, keyAuthorization }))
+  )
+    return { key, keyAuthorization, value }
+  await remove(store, { key, value })
+  return undefined
+}
+
+/** Returns whether the authorization still verifies. Operational failures propagate. */
+async function isVerified(
+  client: Client,
+  keyAuthorization: KeyAuthorization.Signed,
+) {
+  try {
+    await verify(client, keyAuthorization)
+    return true
+  } catch (error) {
+    if (error instanceof RpcResponse.InvalidParamsError) return false
+    throw error
+  }
+}
+
+/** Returns whether the authorization's witness has been burned onchain. */
+async function isBurned(
+  client: Client,
+  options: {
+    account: Address.Address
+    keyAuthorization: KeyAuthorization.Signed
+  },
+) {
+  const { account, keyAuthorization } = options
+  if (!keyAuthorization.witness) return false
+  return isWitnessBurned(client, {
+    account,
+    witness: keyAuthorization.witness,
+  })
+}
+
+/** Returns the authorization expiry in seconds, treating no expiry as unbounded. */
+function getExpiry(keyAuthorization: KeyAuthorization.KeyAuthorization) {
+  const { expiry } = keyAuthorization
+  return expiry === undefined || expiry === null
+    ? Number.POSITIVE_INFINITY
+    : Number(expiry)
+}
+
+/** Returns whether the access key is active onchain. */
+function isActive(
+  metadata: getMetadata.ReturnType,
+  accessKey: Address.Address,
+) {
+  return (
+    Address.isEqual(metadata.address, accessKey) &&
+    !metadata.isRevoked &&
+    metadata.expiry > BigInt(Math.floor(Date.now() / 1000))
+  )
+}
+
+function isExpired(keyAuthorization: KeyAuthorization.KeyAuthorization) {
+  return getExpiry(keyAuthorization) <= Math.floor(Date.now() / 1000)
+}
+
+function getKey(options: {
+  account: Address.Address
+  accessKey: Address.Address
+  chainId: number
+}) {
+  const { account, accessKey, chainId } = options
+  return [
+    'keyAuthorization',
+    chainId,
+    account.toLowerCase(),
+    accessKey.toLowerCase(),
+  ].join(':')
+}
+
+/** Thrown when a pending key authorization cannot be written after repeated conflicts. */
+class StoreConflictError extends BaseError {
+  override name = 'Relay.KeyAuthorization.StoreConflictError'
+  constructor() {
+    super(
+      'Pending key authorization could not be written after repeated conflicts.',
+    )
+  }
+}

package/src/tempo/internal/relay/plugin.ts

@@ -1,13 +1,26 @@
 import type * as Relay from '../../Relay.js'
 
-const multisigPlugins = new WeakSet<Relay.Plugin>()
+const accountsPlugins = new WeakSet<Relay.Plugin>()
+const keyAuthorizationPlugins = new WeakSet<Relay.Plugin>()
 
-/** Registers the built-in multisig plugin for transport capability detection. */
-export function multisig(plugin: Relay.Plugin): Relay.multisig.ReturnType {
-  multisigPlugins.add(plugin)
-  return plugin as Relay.multisig.ReturnType
+/** Registers the built-in accounts plugin for transport capability detection. */
+export function accounts(plugin: Relay.Plugin): Relay.accounts.ReturnType {
+  accountsPlugins.add(plugin)
+  return plugin as Relay.accounts.ReturnType
 }
 
-export function isMultisig(plugin: Relay.Plugin): boolean {
-  return multisigPlugins.has(plugin)
+export function isAccounts(plugin: Relay.Plugin): boolean {
+  return accountsPlugins.has(plugin)
+}
+
+/** Registers the built-in key authorization plugin for transport capability detection. */
+export function keyAuthorization(
+  plugin: Relay.Plugin,
+): Relay.keyAuthorization.ReturnType {
+  keyAuthorizationPlugins.add(plugin)
+  return plugin as Relay.keyAuthorization.ReturnType
+}
+
+export function isKeyAuthorization(plugin: Relay.Plugin): boolean {
+  return keyAuthorizationPlugins.has(plugin)
 }

package/src/utils/RpcClient.ts

@@ -140,8 +140,9 @@ export function http<schema extends RpcSchema.Schema = RpcSchema.Default>(
       const { headers, method, signal: signal_ } = fetchOptions
 
       try {
-        const response = await promise.withTimeout(
+        const { response, responseBody } = await promise.withTimeout(
           async ({ signal }) => {
+            const timeoutSignal = timeout > 0 ? signal : null
             const init: RequestInit = {
               ...fetchOptions,
               body: stringify(body),
@@ -151,14 +152,24 @@ export function http<schema extends RpcSchema.Schema = RpcSchema.Default>(
                 ...headers,
               },
               method: method || 'POST',
-              signal: signal_ || (timeout > 0 ? signal : null),
+              // A caller `signal` must not disable the timeout.
+              signal:
+                signal_ && timeoutSignal
+                  ? AbortSignal.any([signal_, timeoutSignal])
+                  : (signal_ ?? timeoutSignal),
             }
             const request = new Request(url, init)
             const overrides = (await onRequest?.(request, init)) ?? {
               ...init,
               url,
             }
-            return fetchFn(overrides.url ?? url, overrides)
+            const response = await fetchFn(overrides.url ?? url, overrides)
+            if (onResponse) await onResponse(response)
+            // Read the body within the timeout so a stalled body cannot hang.
+            const responseBody = await readResponseBody(response, {
+              maxResponseBodySize,
+            })
+            return { response, responseBody }
           },
           {
             errorInstance: new TimeoutError({ body: errorBody, url }),
@@ -167,12 +178,7 @@ export function http<schema extends RpcSchema.Schema = RpcSchema.Default>(
           },
         )
 
-        if (onResponse) await onResponse(response)
-
         let data: any
-        const responseBody = await readResponseBody(response, {
-          maxResponseBodySize,
-        })
         if (
           response.headers.get('Content-Type')?.startsWith('application/json')
         )
@@ -556,6 +562,19 @@ export async function fromSocket<
           else errorQueue.push(error)
         }
 
+        // Reassigned when a reconnect re-subscribes with a new id.
+        let subscriptionId: Hex.Hex | undefined
+        let unsubscribed = false
+        function unsubscribe() {
+          unsubscribed = true
+          return new Promise<Socket.Response>((resolve) =>
+            requestInternal({
+              body: { method: 'eth_unsubscribe', params: [subscriptionId] },
+              onResponse: resolve,
+            }),
+          ) as Promise<RpcResponse.RpcResponse<boolean>>
+        }
+
         return new Promise<Socket.subscribe.ReturnType>((resolve, reject) => {
           requestInternal({
             body: { method: 'eth_subscribe', params },
@@ -571,9 +590,17 @@ export async function fromSocket<
                 return
               }
               if (typeof response.id === 'number') {
-                const subscriptionId = response.result as Hex.Hex
+                const resubscribed = subscriptionId !== undefined
+                subscriptionId = response.result as Hex.Hex
+                if (resubscribed) {
+                  // Re-subscribed while an unsubscribe was in flight.
+                  if (unsubscribed) unsubscribe()
+                  return
+                }
                 resolve({
-                  subscriptionId,
+                  get subscriptionId() {
+                    return subscriptionId!
+                  },
                   onData(listener) {
                     onDataFn = listener
                     while (dataQueue.length) listener(dataQueue.shift()!)
@@ -582,17 +609,7 @@ export async function fromSocket<
                     onErrorFn = listener
                     while (errorQueue.length) listener(errorQueue.shift()!)
                   },
-                  unsubscribe() {
-                    return new Promise<Socket.Response>((resolve) =>
-                      requestInternal({
-                        body: {
-                          method: 'eth_unsubscribe',
-                          params: [subscriptionId],
-                        },
-                        onResponse: resolve,
-                      }),
-                    ) as Promise<RpcResponse.RpcResponse<boolean>>
-                  },
+                  unsubscribe,
                 })
                 return
               }

package/src/version.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export const version = '3.0.0-next.13'
+export const version = '3.0.0-next.14'

package/dist/tempo/actions/multisig/getConfig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getConfig.d.ts","sourceRoot":"","sources":["../../../../src/tempo/actions/multisig/getConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACzC,OAAO,KAAK,KAAK,MAAM,MAAM,yBAAyB,CAAA;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EACrB,UAAU,EAAE,SAAS,CAAC,OAAO,GAC5B,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAM/B;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,wCAAwC;IACxC,KAAY,OAAO,GAAG;QACpB,gCAAgC;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;KACzB,CAAA;IAED,0CAA0C;IAC1C,KAAY,UAAU,GAAG,cAAc,CAAC,MAAM,GAAG,IAAI,CAAA;IAErD,wCAAwC;IACxC,KAAY,SAAS,GAAG,MAAM,CAAC,eAAe,CAAA;CAC/C"}

package/dist/tempo/actions/multisig/getConfig.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"getConfig.js","sourceRoot":"","sources":["../../../../src/tempo/actions/multisig/getConfig.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAGzC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,UAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,MAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7E,CAAC"}

package/dist/tempo/actions/multisig/getOperation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"getOperation.js","sourceRoot":"","sources":["../../../../src/tempo/actions/multisig/getOperation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAG5C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,UAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACrC,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;KAC1B,CAAC,CAAA;IACF,OAAO,SAAS;QACd,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAkC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAA;AACV,CAAC"}

package/dist/tempo/internal/relay/multisig.d.ts

@@ -1,4 +0,0 @@
-import type * as Relay from '../../Relay.js';
-/** Creates middleware for multisig approval coordination. @internal */
-export declare function create(options: Relay.multisig.Options): Relay.multisig.ReturnType;
-//# sourceMappingURL=multisig.d.ts.map

package/dist/tempo/internal/relay/multisig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"multisig.d.ts","sourceRoot":"","sources":["../../../../src/tempo/internal/relay/multisig.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,KAAK,KAAK,MAAM,gBAAgB,CAAA;AAO5C,uEAAuE;AACvE,wBAAgB,MAAM,CACpB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,GAC9B,KAAK,CAAC,QAAQ,CAAC,UAAU,CAiL3B"}