@cursor/july 0.1.1

package/dist/internal/cursor/backend-client.js

@@ -0,0 +1,477 @@
+/**
+ * Minimal Connect-JSON client for the handful of `aiserver.v1.DashboardService`
+ * RPCs agent-serve needs — `GetMe`, `ListSandMcpTools`, `ExecuteSandMcpTool`,
+ * and the login-time key lifecycle (`CreateUserApiKey`, `ListUserApiKeys`,
+ * `RevokeUserApiKey`).
+ *
+ * Plain `fetch` POSTs with proto-JSON bodies and zod-validated responses:
+ * agent-serve is a published package and should not pull the generated
+ * proto tree in for a few unary calls.
+ *
+ * Auth: the client holds the account API key and exchanges it on demand for
+ * a short-lived access token (`POST /auth/exchange_user_api_key`, ~1h),
+ * cached until shortly before expiry and re-exchanged once on a 401.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { randomUUID } from "node:crypto";
+import { z } from "zod";
+const CLIENT_VERSION = "agent-serve-0.1.0";
+const EXCHANGE_PATH = "/auth/exchange_user_api_key";
+const SERVICE_PREFIX = "/aiserver.v1.DashboardService";
+/** Re-exchange when the cached token is within this window of expiry. */
+const TOKEN_EXPIRY_LEEWAY_MS = 5 * 60 * 1000;
+/** Fallback token lifetime when the JWT `exp` claim cannot be parsed. */
+const FALLBACK_TOKEN_LIFETIME_MS = 30 * 60 * 1000;
+const LIST_TIMEOUT_MS = 60000;
+/** Backend-executed tools call out to third-party servers; be generous. */
+const EXECUTE_TIMEOUT_MS = 120000;
+export class CursorBackendError extends Error {
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "CursorBackendError";
+    }
+}
+// ============================================================================
+// Response schemas (proto-JSON, camelCase; default-valued fields are omitted)
+// ============================================================================
+const getMeResponseSchema = z.object({
+    authId: z.string().optional(),
+    email: z.string().optional(),
+    firstName: z.string().optional(),
+    lastName: z.string().optional(),
+    teamId: z.number().optional(),
+    teamName: z.string().optional(),
+});
+const createUserApiKeyResponseSchema = z.object({
+    apiKey: z.string().min(1),
+});
+const mcpToolSchema = z.object({
+    name: z.string(),
+    providerIdentifier: z.string().optional(),
+    toolName: z.string().optional(),
+    description: z.string().optional(),
+    /** `google.protobuf.Value` — an arbitrary JSON Schema object. */
+    inputSchema: z.unknown().optional(),
+});
+const listSandMcpToolsResponseSchema = z.object({
+    servers: z
+        .array(z.object({
+        serverIdentifier: z.string(),
+        /** "connected" | "needsAuth" | "error" | "loading" */
+        status: z.string(),
+        tools: z.array(mcpToolSchema).optional(),
+    }))
+        .optional(),
+});
+/**
+ * Proto-JSON of `agent.v1.McpResult` (oneof → exactly one field set).
+ * Inner strings default to `""` because proto-JSON omits default-valued
+ * fields — `McpTextContent{text: ""}` arrives as `{"text": {}}`.
+ */
+const mcpResultSchema = z.object({
+    success: z
+        .object({
+        content: z
+            .array(z.object({
+            text: z.object({ text: z.string().default("") }).optional(),
+            image: z
+                .object({
+                data: z.string().default(""),
+                mimeType: z.string().optional(),
+            })
+                .optional(),
+        }))
+            .optional(),
+        isError: z.boolean().optional(),
+        structuredContent: z.record(z.unknown()).optional(),
+    })
+        .optional(),
+    error: z.object({ error: z.string().optional() }).optional(),
+    rejected: z.object({ reason: z.string().optional() }).optional(),
+    permissionDenied: z.object({ error: z.string().optional() }).optional(),
+    toolNotFound: z
+        .object({
+        name: z.string().optional(),
+        availableTools: z.array(z.string()).optional(),
+    })
+        .optional(),
+    serverNotFound: z
+        .object({
+        name: z.string().optional(),
+        availableServers: z.array(z.string()).optional(),
+    })
+        .optional(),
+});
+const executeResponseSchema = z.object({
+    result: mcpResultSchema.optional(),
+});
+// ============================================================================
+// Shared request machinery (used by the client and the login-time mint)
+// ============================================================================
+/** One DashboardService Connect-JSON POST; auth is the caller's bearer. */
+function dashboardRpc(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        try {
+            return yield args.fetchImpl(`${args.backendUrl}${SERVICE_PREFIX}/${args.method}`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    authorization: `Bearer ${args.bearer}`,
+                    "x-ghost-mode": "true",
+                    "x-cursor-client-version": CLIENT_VERSION,
+                    "x-cursor-client-type": "agent-serve",
+                    "x-request-id": randomUUID(),
+                },
+                body: JSON.stringify((_a = args.body) !== null && _a !== void 0 ? _a : {}),
+                signal: AbortSignal.timeout(args.timeoutMs),
+            });
+        }
+        catch (error) {
+            throw new CursorBackendError(`Cursor backend request ${args.method} failed: ${describeError(error)}`);
+        }
+    });
+}
+/** Drain and parse an RPC response; maps non-2xx to a CursorBackendError. */
+function parseRpcResponse(method, response) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const text = yield response.text();
+        if (!response.ok) {
+            throw new CursorBackendError(`Cursor backend ${method} failed (${response.status}): ${connectErrorMessage(text)}`, response.status);
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch (_a) {
+            throw new CursorBackendError(`Cursor backend ${method} returned a non-JSON response.`);
+        }
+    });
+}
+export class CursorBackendClient {
+    constructor(options) {
+        var _a, _b;
+        this.backendUrl = options.backendUrl.endsWith("/")
+            ? options.backendUrl.slice(0, -1)
+            : options.backendUrl;
+        this.apiKey = options.apiKey;
+        this.logger = (_a = options.logger) !== null && _a !== void 0 ? _a : (() => { });
+        this.fetchImpl = (_b = options.fetchImpl) !== null && _b !== void 0 ? _b : fetch;
+    }
+    /** Who this API key acts as. */
+    getMe() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return getMeResponseSchema.parse(yield this.rpc("GetMe", {}));
+        });
+    }
+    /**
+     * The account's MCP connectors with live status and backend-prefixed tool
+     * definitions. `serverIdentifiers` restricts discovery (empty = all
+     * HTTP/SSE servers on the account).
+     */
+    listAccountMcpTools(serverIdentifiers) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const raw = yield this.rpc("ListSandMcpTools", { serverIdentifiers: [...serverIdentifiers] }, LIST_TIMEOUT_MS);
+            const parsed = listSandMcpToolsResponseSchema.parse(raw);
+            return ((_a = parsed.servers) !== null && _a !== void 0 ? _a : []).map((server) => { var _a; return ({
+                serverIdentifier: server.serverIdentifier,
+                status: server.status,
+                tools: ((_a = server.tools) !== null && _a !== void 0 ? _a : []).map((tool) => { var _a; return ({
+                    name: tool.name,
+                    description: (_a = tool.description) !== null && _a !== void 0 ? _a : "",
+                    inputSchema: normalizeInputSchema(tool.inputSchema),
+                }); }),
+            }); });
+        });
+    }
+    /**
+     * Execute one connector tool **on the Cursor backend** with the account's
+     * stored OAuth credentials. `toolName` is the fully-qualified name from
+     * {@link listAccountMcpTools}.
+     */
+    executeAccountMcpTool(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const raw = yield this.rpc("ExecuteSandMcpTool", {
+                serverIdentifier: args.serverIdentifier,
+                toolName: args.toolName,
+                args: args.args,
+                toolCallId: randomUUID(),
+            }, EXECUTE_TIMEOUT_MS);
+            const parsed = executeResponseSchema.parse(raw);
+            return toCallResult((_a = parsed.result) !== null && _a !== void 0 ? _a : {});
+        });
+    }
+    rpc(method_1, body_1) {
+        return __awaiter(this, arguments, void 0, function* (method, body, timeoutMs = LIST_TIMEOUT_MS) {
+            var _a, _b;
+            const bearer = yield this.getAccessToken();
+            const first = yield dashboardRpc({
+                fetchImpl: this.fetchImpl,
+                backendUrl: this.backendUrl,
+                method,
+                bearer,
+                body,
+                timeoutMs,
+            });
+            if (first.status !== 401) {
+                return parseRpcResponse(method, first);
+            }
+            // The token aged out server-side. Drain the rejected body (keeps the
+            // connection reusable), drop the token — unless a concurrent retry
+            // already minted a newer one — and retry once.
+            yield drainResponseBody(first);
+            if (((_a = this.token) === null || _a === void 0 ? void 0 : _a.value) === bearer) {
+                this.token = undefined;
+            }
+            const retryBearer = yield this.getAccessToken();
+            const second = yield dashboardRpc({
+                fetchImpl: this.fetchImpl,
+                backendUrl: this.backendUrl,
+                method,
+                bearer: retryBearer,
+                body,
+                timeoutMs,
+            });
+            if (second.status === 401 && ((_b = this.token) === null || _b === void 0 ? void 0 : _b.value) === retryBearer) {
+                // The freshly minted token was rejected too; do not keep serving it.
+                this.token = undefined;
+            }
+            return parseRpcResponse(method, second);
+        });
+    }
+    getAccessToken() {
+        if (this.token !== undefined &&
+            Date.now() < this.token.expiresAtMs - TOKEN_EXPIRY_LEEWAY_MS) {
+            return Promise.resolve(this.token.value);
+        }
+        // Single-flight: concurrent tool calls share one exchange.
+        if (this.tokenExchange === undefined) {
+            this.tokenExchange = this.exchangeApiKey().finally(() => {
+                this.tokenExchange = undefined;
+            });
+        }
+        return this.tokenExchange;
+    }
+    exchangeApiKey() {
+        return __awaiter(this, void 0, void 0, function* () {
+            let response;
+            try {
+                response = yield this.fetchImpl(`${this.backendUrl}${EXCHANGE_PATH}`, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/json",
+                        authorization: `Bearer ${this.apiKey}`,
+                    },
+                    body: "{}",
+                    signal: AbortSignal.timeout(30000),
+                });
+            }
+            catch (error) {
+                throw new CursorBackendError(`Could not reach the Cursor backend at ${this.backendUrl}: ${describeError(error)}`);
+            }
+            const text = yield response.text();
+            if (!response.ok) {
+                throw new CursorBackendError(response.status === 401
+                    ? "The Cursor API key was rejected. Run `agent-serve login` again or update CURSOR_API_KEY."
+                    : `Cursor API key exchange failed (${response.status}).`, response.status);
+            }
+            const body = accessTokenResponseSchema.safeParse(safeJsonParse(text));
+            if (!body.success || body.data.accessToken === "") {
+                throw new CursorBackendError("Cursor API key exchange returned no access token.");
+            }
+            this.token = {
+                value: body.data.accessToken,
+                expiresAtMs: jwtExpiryMs(body.data.accessToken),
+            };
+            this.logger("[agent-serve] cursor account: minted a fresh access token");
+            return body.data.accessToken;
+        });
+    }
+}
+/**
+ * Mint a named user API key from a short-lived login session token. Used
+ * exactly once per `agent-serve login`; the session token is then discarded.
+ */
+export function createUserApiKeyWithSessionToken(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const response = yield dashboardRpc({
+            fetchImpl: (_a = args.fetchImpl) !== null && _a !== void 0 ? _a : fetch,
+            backendUrl: args.backendUrl.endsWith("/")
+                ? args.backendUrl.slice(0, -1)
+                : args.backendUrl,
+            method: "CreateUserApiKey",
+            bearer: args.sessionToken,
+            body: { name: args.keyName },
+            timeoutMs: 30000,
+        });
+        const raw = yield parseRpcResponse("CreateUserApiKey", response);
+        return createUserApiKeyResponseSchema.parse(raw).apiKey;
+    });
+}
+const API_KEY_PREFIX = "crsr_";
+/** Matches dashboard `maskApiKey` (`crsr_...abcd`). */
+function maskApiKey(apiKey) {
+    return `${API_KEY_PREFIX}...${apiKey.slice(-4)}`;
+}
+const listUserApiKeysResponseSchema = z.object({
+    apiKeys: z
+        .array(z.object({
+        id: z.number(),
+        name: z.string(),
+        maskedKey: z.string().optional(),
+    }))
+        .optional(),
+});
+/**
+ * Best-effort cleanup when `login` mints a key but fails before storing it,
+ * authenticated with the browser session token that minted it. The key is
+ * identified by its masked suffix in `ListUserApiKeys` — never by name alone,
+ * so replica lag after `CreateUserApiKey` can only skip the cleanup, not
+ * revoke an older same-named key.
+ */
+export function revokeMintedUserApiKey(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const fetchImpl = (_a = args.fetchImpl) !== null && _a !== void 0 ? _a : fetch;
+        const backendUrl = args.backendUrl.endsWith("/")
+            ? args.backendUrl.slice(0, -1)
+            : args.backendUrl;
+        const listResponse = yield dashboardRpc({
+            fetchImpl,
+            backendUrl,
+            method: "ListUserApiKeys",
+            bearer: args.sessionToken,
+            body: {},
+            timeoutMs: 30000,
+        });
+        const listed = listUserApiKeysResponseSchema.parse(yield parseRpcResponse("ListUserApiKeys", listResponse));
+        const masked = maskApiKey(args.apiKey);
+        const match = ((_b = listed.apiKeys) !== null && _b !== void 0 ? _b : []).find((key) => key.name === args.keyName && key.maskedKey === masked);
+        if (match === undefined) {
+            // CreateUserApiKey writes the primary while ListUserApiKeys may read a
+            // lagging replica — skip rather than touch any other key.
+            return;
+        }
+        const revokeResponse = yield dashboardRpc({
+            fetchImpl,
+            backendUrl,
+            method: "RevokeUserApiKey",
+            bearer: args.sessionToken,
+            body: { id: match.id },
+            timeoutMs: 30000,
+        });
+        yield drainResponseBody(revokeResponse);
+    });
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+const accessTokenResponseSchema = z.object({ accessToken: z.string() });
+function safeJsonParse(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+function normalizeInputSchema(schema) {
+    if (typeof schema === "object" && schema !== null && !Array.isArray(schema)) {
+        return schema;
+    }
+    return { type: "object", properties: {} };
+}
+function toCallResult(result) {
+    var _a;
+    if (result.success !== undefined) {
+        const content = [];
+        for (const item of (_a = result.success.content) !== null && _a !== void 0 ? _a : []) {
+            if (item.text !== undefined) {
+                content.push({ type: "text", text: item.text.text });
+            }
+            else if (item.image !== undefined) {
+                content.push(Object.assign({ type: "image", data: item.image.data }, (item.image.mimeType === undefined
+                    ? {}
+                    : { mimeType: item.image.mimeType })));
+            }
+        }
+        return Object.assign({ content, isError: result.success.isError === true }, (result.success.structuredContent === undefined
+            ? {}
+            : { structuredContent: result.success.structuredContent }));
+    }
+    return {
+        content: [{ type: "text", text: describeFailure(result) }],
+        isError: true,
+    };
+}
+function describeFailure(result) {
+    var _a, _b, _c, _d, _e, _f;
+    if (result.error !== undefined) {
+        return (_a = result.error.error) !== null && _a !== void 0 ? _a : "The tool call failed.";
+    }
+    if (result.permissionDenied !== undefined) {
+        return (_b = result.permissionDenied.error) !== null && _b !== void 0 ? _b : "Permission denied.";
+    }
+    if (result.rejected !== undefined) {
+        return `The tool call was rejected${result.rejected.reason === undefined ? "" : `: ${result.rejected.reason}`}.`;
+    }
+    if (result.toolNotFound !== undefined) {
+        return `Unknown tool "${(_c = result.toolNotFound.name) !== null && _c !== void 0 ? _c : ""}". Available: ${((_d = result.toolNotFound.availableTools) !== null && _d !== void 0 ? _d : []).join(", ") || "(none)"}.`;
+    }
+    if (result.serverNotFound !== undefined) {
+        return `Unknown MCP server "${(_e = result.serverNotFound.name) !== null && _e !== void 0 ? _e : ""}". Available: ${((_f = result.serverNotFound.availableServers) !== null && _f !== void 0 ? _f : []).join(", ") || "(none)"}.`;
+    }
+    return "The tool call returned no result.";
+}
+/** Best-effort human-readable message from a Connect error JSON body. */
+function connectErrorMessage(bodyText) {
+    const parsed = safeJsonParse(bodyText);
+    if (typeof parsed === "object" &&
+        parsed !== null &&
+        typeof parsed.message === "string" &&
+        parsed.message !== "") {
+        return parsed.message;
+    }
+    return bodyText.slice(0, 300) || "(empty response body)";
+}
+function jwtExpiryMs(token) {
+    try {
+        const payload = token.split(".")[1];
+        if (payload === undefined) {
+            throw new Error("not a JWT");
+        }
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        if (typeof claims.exp === "number") {
+            return claims.exp * 1000;
+        }
+    }
+    catch (_a) {
+        // Opaque token — assume a conservative lifetime.
+    }
+    return Date.now() + FALLBACK_TOKEN_LIFETIME_MS;
+}
+function describeError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Release undici/fetch connection slots on responses we will not parse. */
+function drainResponseBody(response) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield response.arrayBuffer();
+        }
+        catch (_a) {
+            // Best-effort; the socket may already be closed.
+        }
+    });
+}

package/dist/internal/cursor/credentials.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Cursor account credentials for the agent-serve host.
+ *
+ * Exactly one kind of secret exists at runtime: a **personal Cursor user API
+ * key**. Two ways to obtain it, one code path after that:
+ *
+ * - `agent-serve login` runs the same PKCE browser flow as `cursor-agent`
+ *   and Sand, then uses the short-lived session once to mint a named,
+ *   dashboard-revocable user API key — only the key is stored.
+ * - `CURSOR_API_KEY` (or `serve({ apiKey })`) wins over the stored key, so
+ *   CI and hosted deployments stay env-driven.
+ *
+ * There is deliberately no session-token storage, refresh-token rotation, or
+ * cross-tool credential sharing here: short-lived access tokens are minted
+ * on demand from the API key (see `backend-client.ts`).
+ */
+import { z } from "zod";
+export declare const DEFAULT_CURSOR_BACKEND_URL = "https://api2.cursor.sh";
+/** Backend API base URL (`CURSOR_API_BASE_URL` override for local dev). */
+export declare function cursorBackendUrl(): string;
+/** Website base URL for the login deep link (`CURSOR_WEBSITE_URL` override). */
+export declare function cursorWebsiteUrl(): string;
+declare const storedCredentialsSchema: z.ZodObject<{
+    backendUrl: z.ZodString;
+    apiKey: z.ZodString;
+}, "strip">;
+export type StoredCredentials = z.infer<typeof storedCredentialsSchema>;
+/**
+ * `~/.config/agent-serve/credentials.json` (0600), honoring
+ * `XDG_CONFIG_HOME`. `AGENT_SERVE_CONFIG_DIR` pins the directory outright
+ * (tests, containers).
+ */
+export declare function credentialsFilePath(): string;
+export declare function readStoredCredentials(): Promise<StoredCredentials | undefined>;
+export declare function writeStoredCredentials(credentials: StoredCredentials): Promise<void>;
+export declare function clearStoredCredentials(): Promise<boolean>;
+export type ApiKeySource = "option" | "env" | "login";
+export interface ResolvedApiKey {
+    apiKey: string;
+    source: ApiKeySource;
+    backendUrl: string;
+}
+/**
+ * Resolve the account API key for `backendUrl` (defaults to the active
+ * backend): explicit option → `CURSOR_API_KEY` → stored login. A stored key
+ * minted against a different backend is ignored rather than sent to the
+ * wrong host.
+ */
+export declare function resolveApiKey(options?: {
+    apiKey?: string;
+    backendUrl?: string;
+}): Promise<ResolvedApiKey | undefined>;
+/** One-line hint for "no credentials" errors, shared across surfaces. */
+export declare const SIGN_IN_HINT: string;
+export interface LoginStart {
+    /** URL the user opens in a browser to approve the login. */
+    loginUrl: string;
+    uuid: string;
+    verifier: string;
+}
+/**
+ * Build the `/loginDeepControl` deep link and its PKCE material. The portal
+ * completes the login and the backend holds the resulting session until
+ * {@link pollForLoginTokens} picks it up with the verifier.
+ */
+export declare function startBrowserLogin(): LoginStart;
+/**
+ * Why the poll stopped. Distinct cases because collapsing them into
+ * "timed out or was cancelled" turned an unsupported-verb 404 into an
+ * unfalsifiable "login is slow" report.
+ */
+export type LoginPollResult = {
+    status: "signed_in";
+    accessToken: string;
+} | {
+    status: "cancelled";
+} | {
+    status: "timed_out";
+} | {
+    status: "failed";
+    message: string;
+};
+/**
+ * Poll `/auth/poll` until the browser login completes.
+ *
+ * **POST, with the verifier in the JSON body.** The verifier is redeemable:
+ * anyone holding it (plus the uuid) can complete the login and mint a durable
+ * user API key, so it must not reach a URL — not the backend's access log, not
+ * a proxy's request log, not a terminal. `POST /auth/poll` exists for exactly
+ * this reason.
+ *
+ * A backend that predates that route answers POST with a route-not-found 404.
+ * Those get one sticky fallback to `GET /auth/poll?uuid=…&verifier=…` — the
+ * shape the vscode client and Sand already use — so the login still works
+ * while the backend catches up. The fallback puts the verifier in the query
+ * string, which is the exposure POST was added to remove, so it warns; it
+ * disappears on its own once the backend serves POST.
+ */
+export declare function pollForLoginTokens(args: {
+    uuid: string;
+    verifier: string;
+    backendUrl?: string;
+    signal?: AbortSignal;
+    /** Notified once if the backend forces the GET fallback. */
+    logger?: (line: string) => void;
+    /** Test seam; defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+    /** Test seam; defaults to 150 (~24 minutes with the backoff below). */
+    maxAttempts?: number;
+}): Promise<LoginPollResult>;
+export {};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/internal/cursor/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAGnE,2EAA2E;AAC3E,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAUD,QAAA,MAAM,uBAAuB,EAAE,CAAC,CAAC,SAAS,CACxC;IAAE,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,EAChD,OAAO,CAKP,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAQ5C;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CACpD,iBAAiB,GAAG,SAAS,CAC9B,CAsBA;AAED,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/D;AAMD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CActC;AAED,yEAAyE;AACzE,eAAO,MAAM,YAAY,EAAE,MAA8F,CAAC;AAQ1H,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAU9C;AAKD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmG3B"}