@cursor/july 0.1.15 → 0.1.17

package/src/internal/slack-provision-client.ts

@@ -0,0 +1,438 @@
+/**
+ * Thin client for the Agent Serve Slack provisioning API
+ * (`/internal/agent-serve/slack` on the Cursor backend — "Add to Slack").
+ * Pure request/response + error mapping — no console I/O, no polling
+ * loops; rendering lives in `cli-slack.ts`.
+ *
+ * Auth is the user API key sent directly as the bearer (the routes are
+ * `wrapUserApiRoute` on the backend); there is no token exchange here.
+ * The endpoints are gated on the `agent_serve_slack_provisioning` Statsig
+ * gate and 404 when it is off — the error mapping says so instead of
+ * "not found". Expected provisioning failures carry a stable JSON `code`
+ * (`not_connected`, `insufficient_scopes`, `app_conflict`,
+ * `app_cap_reached`, `ratelimited`, `invalid_app_id`, …) which flows
+ * through on {@link SlackProvisionApiError.code} so the CLI can branch.
+ */
+
+import { z } from "zod";
+
+export type SlackAppEnv = "dev" | "prod";
+
+/** One manager-connected Slack workspace from `GET /status`. */
+export interface SlackConnectedWorkspace {
+  slackTeamId: string;
+  slackUserId: string;
+  connectedAt: string;
+}
+
+/** One provisioned managed Slack app from `GET /status` (no token material). */
+export interface SlackManagedAppInfo {
+  slackAppId: string;
+  slackTeamId: string;
+  slug: string;
+  env: string;
+  installStatus: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface SlackProvisionStatus {
+  workspaces: SlackConnectedWorkspace[];
+  apps: SlackManagedAppInfo[];
+}
+
+export type SlackAppIconContentType = "image/png" | "image/jpeg" | "image/gif";
+
+/** Icon source for `setAppIcon`: an https image URL or a base64 file. */
+export type SlackAppIconInput =
+  | { url: string }
+  | { base64: string; contentType: SlackAppIconContentType };
+
+/**
+ * Outcome of `POST /apps`. Credentials are returned exactly once and never
+ * persisted server-side — the caller owns storing them. `appToken` can be
+ * absent when Slack's install response omitted the app-level token.
+ * `oauthAuthorizeUrl` is only minted on a fresh app create, so an update
+ * that lands in admin approval omits it.
+ */
+export type SlackAppProvisionResult =
+  | {
+      status: "installed";
+      appId: string;
+      botToken: string;
+      appToken?: string;
+      /** Present when the provision requested an icon (best-effort outcome). */
+      iconStatus?: "set" | "failed";
+    }
+  | {
+      status: "pending_admin_approval";
+      appId: string;
+      oauthAuthorizeUrl?: string;
+      iconStatus?: "set" | "failed";
+    };
+
+export class SlackProvisionApiError extends Error {
+  readonly status: number;
+  /** Stable backend error code (`not_connected`, `ratelimited`, …). */
+  readonly code?: string;
+  /** Seconds to wait before retrying (from 429 responses). */
+  readonly retryAfterSeconds?: number;
+  /** Drifted manifest paths (from `manifest_drift` 409 bodies). */
+  readonly changedPaths?: string[];
+
+  constructor(
+    message: string,
+    options: {
+      status: number;
+      code?: string;
+      retryAfterSeconds?: number;
+      changedPaths?: string[];
+    }
+  ) {
+    super(message);
+    this.name = "SlackProvisionApiError";
+    this.status = options.status;
+    this.code = options.code;
+    this.retryAfterSeconds = options.retryAfterSeconds;
+    this.changedPaths = options.changedPaths;
+  }
+}
+
+// ============================================================================
+// Response shapes (backend agentServeSlackEndpoints route bodies).
+// Interfaces are hand-written (the package compiles with
+// --isolatedDeclarations, so exported types cannot be z.infer of an
+// unannotated schema); the zod schemas below stay module-internal.
+// ============================================================================
+
+// All response schemas are `.passthrough()` so unknown fields from a newer
+// backend flow through untouched instead of breaking the parse.
+const statusResponseSchema = z
+  .object({
+    workspaces: z.array(
+      z
+        .object({
+          slackTeamId: z.string(),
+          slackUserId: z.string(),
+          connectedAt: z.string(),
+        })
+        .passthrough()
+    ),
+    apps: z.array(
+      z
+        .object({
+          slackAppId: z.string(),
+          slackTeamId: z.string(),
+          slug: z.string(),
+          env: z.string(),
+          installStatus: z.string(),
+          createdAt: z.string(),
+          updatedAt: z.string(),
+        })
+        .passthrough()
+    ),
+  })
+  .passthrough();
+
+const connectResponseSchema = z
+  .object({
+    url: z.string().min(1),
+  })
+  .passthrough();
+
+const provisionResponseSchema = z.discriminatedUnion("status", [
+  z
+    .object({
+      status: z.literal("installed"),
+      appId: z.string(),
+      botToken: z.string(),
+      appToken: z.string().optional(),
+      iconStatus: z.enum(["set", "failed"]).optional(),
+    })
+    .passthrough(),
+  z
+    .object({
+      status: z.literal("pending_admin_approval"),
+      appId: z.string(),
+      oauthAuthorizeUrl: z.string().optional(),
+      iconStatus: z.enum(["set", "failed"]).optional(),
+    })
+    .passthrough(),
+]);
+
+const deleteResponseSchema = z
+  .object({
+    deleted: z.boolean(),
+  })
+  .passthrough();
+
+const setIconResponseSchema = z
+  .object({
+    ok: z.boolean(),
+  })
+  .passthrough();
+
+// ============================================================================
+// Client
+// ============================================================================
+
+export interface AgentServeSlackClientOptions {
+  backendUrl: string;
+  apiKey: string;
+  /** Test seam; defaults to global fetch. */
+  fetchImpl?: typeof fetch;
+}
+
+export class AgentServeSlackClient {
+  private readonly backendUrl: string;
+  private readonly apiKey: string;
+  private readonly fetchImpl: typeof fetch;
+
+  constructor(options: AgentServeSlackClientOptions) {
+    this.backendUrl = options.backendUrl.endsWith("/")
+      ? options.backendUrl.slice(0, -1)
+      : options.backendUrl;
+    this.apiKey = options.apiKey;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+
+  /** Manager-connected workspaces + the managed-app inventory. */
+  async status(teamId: number): Promise<SlackProvisionStatus> {
+    const raw = await this.request({
+      method: "GET",
+      path: `/internal/agent-serve/slack/status?teamId=${teamId}`,
+      context: { verb: "read Slack provisioning status" },
+    });
+    return statusResponseSchema.parse(raw);
+  }
+
+  /**
+   * Mint the browser consent URL for the Slack manager grant. After the
+   * user approves it, the workspace shows up in {@link status}.
+   */
+  async connect(teamId: number): Promise<string> {
+    const raw = await this.request({
+      method: "POST",
+      path: "/internal/agent-serve/slack/connect",
+      body: { teamId },
+      context: { verb: "start the Slack workspace connect" },
+    });
+    return connectResponseSchema.parse(raw).url;
+  }
+
+  /**
+   * Provision (create or update) and install one managed Slack app for
+   * (slackTeamId, slug, env). Expected failures throw
+   * {@link SlackProvisionApiError} with a stable `code`.
+   */
+  async provisionApp(args: {
+    teamId: number;
+    slackTeamId: string;
+    slug: string;
+    env: SlackAppEnv;
+    /** Full Slack app manifest JSON string. */
+    manifest: string;
+    /** Icon URL, applied best-effort by the backend after the install. */
+    icon?: { url: string };
+    /** Overwrite manifest edits made in Slack (skips the drift check). */
+    force?: boolean;
+  }): Promise<SlackAppProvisionResult> {
+    const raw = await this.request({
+      method: "POST",
+      path: "/internal/agent-serve/slack/apps",
+      body: {
+        teamId: args.teamId,
+        slackTeamId: args.slackTeamId,
+        slug: args.slug,
+        env: args.env,
+        manifest: args.manifest,
+        icon: args.icon,
+        force: args.force,
+      },
+      context: { verb: "provision the Slack app" },
+    });
+    return provisionResponseSchema.parse(raw);
+  }
+
+  /** Delete the Slack app and its inventory row. */
+  async deleteApp(args: { teamId: number; slackAppId: string }): Promise<void> {
+    const raw = await this.request({
+      method: "DELETE",
+      path: `/internal/agent-serve/slack/apps/${encodeURIComponent(args.slackAppId)}?teamId=${args.teamId}`,
+      context: { verb: "delete the Slack app" },
+    });
+    deleteResponseSchema.parse(raw);
+  }
+
+  /** Set the app's icon: an https image URL or a base64 png/jpeg/gif ≤512KB. */
+  async setAppIcon(args: {
+    teamId: number;
+    slackAppId: string;
+    icon: SlackAppIconInput;
+  }): Promise<void> {
+    const raw = await this.request({
+      method: "POST",
+      path: `/internal/agent-serve/slack/apps/${encodeURIComponent(args.slackAppId)}/icon`,
+      body: { teamId: args.teamId, icon: args.icon },
+      context: { verb: "set the Slack app icon" },
+    });
+    setIconResponseSchema.parse(raw);
+  }
+
+  private async request(args: {
+    method: "GET" | "POST" | "DELETE";
+    path: string;
+    body?: unknown;
+    context: { verb: string };
+  }): Promise<unknown> {
+    const headers: Record<string, string> = {
+      accept: "application/json",
+      authorization: `Bearer ${this.apiKey}`,
+    };
+    if (args.body !== undefined) {
+      headers["content-type"] = "application/json";
+    }
+    let response: Response;
+    try {
+      response = await this.fetchImpl(`${this.backendUrl}${args.path}`, {
+        method: args.method,
+        headers,
+        body: args.body === undefined ? undefined : JSON.stringify(args.body),
+        signal: AbortSignal.timeout(60_000),
+      });
+    } catch (error) {
+      throw new SlackProvisionApiError(
+        `Could not reach the Cursor backend at ${this.backendUrl}: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+        { status: 0 }
+      );
+    }
+    const text = await response.text();
+    if (!response.ok) {
+      throw mapErrorResponse(response, text, args.context);
+    }
+    try {
+      return JSON.parse(text) as unknown;
+    } catch {
+      throw new SlackProvisionApiError(
+        `The Cursor backend returned a non-JSON response to ${args.context.verb}.`,
+        { status: response.status }
+      );
+    }
+  }
+}
+
+// ============================================================================
+// Error mapping (HTTP → actionable human messages, stable codes kept)
+// ============================================================================
+
+function parseErrorBody(bodyText: string): {
+  error?: string;
+  code?: string;
+  retryAfterSeconds?: number;
+  changedPaths?: string[];
+} {
+  let parsed: {
+    error?: unknown;
+    code?: unknown;
+    retryAfterSeconds?: unknown;
+    changedPaths?: unknown;
+  };
+  try {
+    parsed = JSON.parse(bodyText) as typeof parsed;
+  } catch {
+    return {};
+  }
+  return {
+    error:
+      typeof parsed.error === "string" && parsed.error !== ""
+        ? parsed.error
+        : undefined,
+    code:
+      typeof parsed.code === "string" && parsed.code !== ""
+        ? parsed.code
+        : undefined,
+    retryAfterSeconds:
+      typeof parsed.retryAfterSeconds === "number"
+        ? parsed.retryAfterSeconds
+        : undefined,
+    changedPaths:
+      Array.isArray(parsed.changedPaths) &&
+      parsed.changedPaths.every(
+        (path): path is string => typeof path === "string"
+      )
+        ? parsed.changedPaths
+        : undefined,
+  };
+}
+
+function mapErrorResponse(
+  response: Response,
+  bodyText: string,
+  context: { verb: string }
+): SlackProvisionApiError {
+  const body = parseErrorBody(bodyText);
+  const serverError = body.error;
+  switch (response.status) {
+    case 401:
+      return new SlackProvisionApiError(
+        "The Cursor API key was rejected. Run `agentkit login` again or update CURSOR_API_KEY.",
+        { status: 401 }
+      );
+    case 403:
+      return new SlackProvisionApiError(
+        `${serverError ?? "Not authorized"} — Slack provisioning needs team-admin permission and the cloud-agent entitlement on that team.`,
+        { status: 403 }
+      );
+    case 404: {
+      // Fastify's route-not-found envelope means we hit the wrong host
+      // (api2 vs api.cursor.com), not a closed gate.
+      if (/Route \S+ not found/i.test(bodyText)) {
+        return new SlackProvisionApiError(
+          `Agent Serve Slack API not found on this host — use the default api.cursor.com (unset CURSOR_API_BASE_URL), or point CURSOR_API_BASE_URL at a backend that mounts /internal/agent-serve/*.`,
+          { status: 404 }
+        );
+      }
+      // The gate-off body is exactly {error: "Not found"}; anything else
+      // (e.g. "App not found" on delete) is a real not-found to surface.
+      if (serverError !== undefined && serverError !== "Not found") {
+        return new SlackProvisionApiError(serverError, {
+          status: 404,
+          code: body.code,
+        });
+      }
+      return new SlackProvisionApiError(
+        `Not found — Cursor's "Add to Slack" provisioning (the agent_serve_slack_provisioning feature gate) is not enabled for this account yet.`,
+        { status: 404 }
+      );
+    }
+    case 429: {
+      const retryAfterHeader = response.headers.get("retry-after");
+      const retryAfterSeconds =
+        retryAfterHeader !== null && /^\d+$/.test(retryAfterHeader)
+          ? Number(retryAfterHeader)
+          : body.retryAfterSeconds;
+      return new SlackProvisionApiError(
+        `${serverError ?? "Rate limited"}${
+          retryAfterSeconds === undefined
+            ? ""
+            : ` — retry in ${retryAfterSeconds}s`
+        }`,
+        { status: 429, code: body.code ?? "ratelimited", retryAfterSeconds }
+      );
+    }
+    default:
+      return new SlackProvisionApiError(
+        serverError ??
+          `The ${context.verb} request failed (${response.status}): ${
+            bodyText.slice(0, 300) || "(empty body)"
+          }`,
+        {
+          status: response.status,
+          code: body.code,
+          changedPaths: body.changedPaths,
+        }
+      );
+  }
+}

package/src/types.ts

@@ -269,6 +269,38 @@ export interface AgentLocalOptions {
    * ambient `AGENTS.md` / `.cursor` rules.
    */
   cwd?: string;
+  /**
+   * One harness cwd shared by every session, for agents that work inside an
+   * existing checkout. Absolute, or relative to the agent project root.
+   * Takes precedence over {@link cwd}; a per-send
+   * {@link SendMessageOptions.workspaceDir} still wins over both.
+   *
+   * The SDK keys its local executor — Cursor rules, skills, MCP, the ignore
+   * mappings — on the harness cwd, so a shared directory resolves the
+   * workspace once per serve process instead of once per session. With
+   * `cwd`'s `<cwd>/<sessionId>` layout that cache never hits, and on a large
+   * repo each session pays the full scan again.
+   *
+   * Sessions are no longer isolated from each other on disk: they share a
+   * working tree, and a file one turn writes is visible to the next. Agent
+   * scaffold (`AGENTS.md`, skills, tool scripts) is kept out of the shared
+   * directory and delivered inline instead, so pointing this at a repo does
+   * not write agentkit files into it — but `workspaceFiles` still lands in
+   * the harness cwd, as it does for a per-send override.
+   */
+  workspaceDir?: string;
+  /**
+   * Run the harness inside Cursor's local sandbox (`sandboxOptions.enabled`
+   * on the SDK). Off by default, matching the SDK: shell then auto-approves
+   * and inherits the serve process environment — including any credentials
+   * the host holds.
+   *
+   * Turn this on for agents whose turns read untrusted input (webhook
+   * payloads, PR diffs, inbound chat). It is a real tool boundary rather
+   * than a prompt-level one, so it still holds when the model is steered
+   * into ignoring its instructions.
+   */
+  sandbox?: boolean;
 }
 
 export type AgentConfigDefinition = AgentConfig & BrandedDefinition<"agent">;
@@ -585,9 +617,9 @@ export type ConnectionTransport =
       /** Expose the Cursor account's MCP connectors (backend-executed). */
       cursorAccount: true;
       /**
-       * Restrict to these connector names (as they appear in the Cursor
-       * account's MCP config, e.g. `["Linear", "Notion"]`). Omit to expose
-       * every connected HTTP/SSE server on the account.
+       * Restrict to these connector names after discovery normalization.
+       * Authored configs may also pass `"*"` / `["*"]` (see
+       * {@link ConnectionConfig}); those normalize to `undefined` (= all).
        */
       servers?: string[];
     };
@@ -606,6 +638,38 @@ export function isCursorAccountTransport(
   return "cursorAccount" in transport && transport.cursorAccount === true;
 }
 
+/**
+ * Normalize an authored Cursor account `servers` filter.
+ *
+ * `undefined`, `"*"`, and `["*"]` (after trim) all mean every connected
+ * HTTP/SSE server on the account. Returns a concrete allowlist, or
+ * `undefined` for all. Does not validate emptiness, blank entries, or a
+ * mixed `"*"` + names list — discovery owns those diagnostics.
+ */
+export function normalizeCursorAccountServers(
+  servers: string[] | "*" | undefined
+): string[] | undefined {
+  if (servers === undefined || servers === "*") {
+    return undefined;
+  }
+  const trimmed = servers.map((server) => server.trim());
+  if (trimmed.length === 1 && trimmed[0] === "*") {
+    return undefined;
+  }
+  return [...servers];
+}
+
+/** True when an authored allowlist mixes `"*"` with other connector names. */
+export function cursorAccountServersHasMixedWildcard(
+  servers: string[] | "*" | undefined
+): boolean {
+  if (servers === undefined || servers === "*") {
+    return false;
+  }
+  const trimmed = servers.map((server) => server.trim());
+  return trimmed.includes("*") && trimmed.some((server) => server !== "*");
+}
+
 /**
  * True for transports that stay symbolic at discovery time and are resolved
  * by the serve host once it is listening (peers and the Cursor account
@@ -620,7 +684,29 @@ export function isSymbolicConnectionTransport(
   );
 }
 
-export type ConnectionConfig = ConnectionTransport & {
+/**
+ * Authored MCP connection config (`defineConnection(...)`).
+ *
+ * For Cursor account connections, `servers` may be omitted, `"*"`, or
+ * `["*"]` to forward every connected HTTP/SSE connector; a concrete
+ * `string[]` allowlists by connector name. Discovery normalizes the
+ * wildcard forms to an unfiltered {@link ConnectionTransport}.
+ */
+export type ConnectionConfig = (
+  | Exclude<ConnectionTransport, { cursorAccount: true }>
+  | {
+      cursorAccount: true;
+      /**
+       * Which account connectors to expose.
+       *
+       * - Omit, pass `"*"`, or pass `["*"]` to forward **every** connected
+       *   HTTP/SSE server on the account (no per-connector allowlist).
+       * - Pass connector names as they appear in the Cursor account's MCP
+       *   config (e.g. `["Linear", "Notion"]`) to restrict the set.
+       */
+      servers?: string[] | "*";
+    }
+) & {
   /** Documentation only; shown in `info` output. */
   description?: string;
   /**
@@ -1876,6 +1962,8 @@ export interface RunnerTurnRequest {
   sdkAgentId?: string;
   /** Absolute path of the session's materialized workspace. */
   workspaceDir: string;
+  /** Run the local harness sandboxed ({@link AgentLocalOptions.sandbox}). */
+  sandbox?: boolean;
   /** Absolute path for runner-owned durable state (conversation store). */
   runnerStateDir: string;
   prompt: string;

package/dist/channels/slack/post-update-delivery.d.ts

@@ -1,85 +0,0 @@
-/**
- * Live-reply delivery strategies for the Slack default handlers.
- *
- * A single strategy owns how an in-progress reply is opened, updated,
- * finalized, and cleaned up so the handlers in `defaults.ts` don't fork on the
- * delivery mode at every event:
- *
- * - `stream`: Slack chat.startStream / appendStream / stopStream.
- * - `post-update`: a chat.postMessage skeleton edited with chat.update. This is
- *   the only path that preserves Cursor-account identity pinning (which only
- *   covers postMessage).
- *
- * `buildDefaultEvents` selects one via {@link selectLiveDeliveryStrategy} up
- * front and calls into it. All calls keep the same soft-fail / log behavior as
- * the inlined logic they replaced.
- */
-import type { ChannelEventContext } from "../../types.js";
-import type { SlackLog } from "./log.js";
-import type { SlackBotToken, SlackChannelState } from "./types.js";
-type SlackChannel = ChannelEventContext<SlackChannelState>;
-export interface LiveDeliveryDeps {
-    botToken: SlackBotToken | undefined;
-    getLog: () => SlackLog;
-}
-/**
- * How the default handlers deliver an in-progress reply. Methods write live
- * delivery state (`streamTs`, `streamChannelId`, `lastPostedText`,
- * `lastPostUpdateAtMs`, `streamingUnavailable`) on `channel.state` directly.
- */
-export interface LiveDeliveryStrategy {
-    /** True when tool-call thinking steps can be appended to the live message. */
-    readonly inlineToolSteps: boolean;
-    /** Open the live message (skeleton post / stream start). */
-    start(args: {
-        channel: SlackChannel;
-        channelId: string;
-        threadTs: string;
-        sessionId: string;
-    }): Promise<void>;
-    /** Push the latest cumulative text to the live message (throttled). */
-    append(args: {
-        channel: SlackChannel;
-        channelId: string;
-        streamTs: string;
-        text: string;
-        sessionId: string;
-    }): Promise<void>;
-    /**
-     * Flush the final reply text. `delivered` is false only when the caller must
-     * post the full reply as a fresh message (finalize failed on partial text).
-     */
-    finalize(args: {
-        channel: SlackChannel;
-        channelId: string;
-        streamTs: string;
-        text: string;
-        sessionId: string;
-    }): Promise<{
-        delivered: boolean;
-    }>;
-    /** Close the live message when the turn produced no final text. */
-    finalizeEmpty(args: {
-        channel: SlackChannel;
-        channelId: string;
-        streamTs: string;
-    }): Promise<void>;
-    /** Best-effort remove a live message left open after the turn ended. */
-    cleanupOrphan(args: {
-        channel: SlackChannel;
-    }): Promise<void>;
-    /** Deliver the error text into the live message; `delivered` gates a fallback post. */
-    fail(args: {
-        channel: SlackChannel;
-        channelId: string;
-        streamTs: string;
-        errorText: string;
-        sessionId: string;
-    }): Promise<{
-        delivered: boolean;
-    }>;
-}
-/** Pick the live-reply delivery strategy for a `buildDefaultEvents` instance. */
-export declare function selectLiveDeliveryStrategy(deps: LiveDeliveryDeps, usePostUpdate: boolean): LiveDeliveryStrategy;
-export {};
-//# sourceMappingURL=post-update-delivery.d.ts.map

package/dist/channels/slack/post-update-delivery.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"post-update-delivery.d.ts","sourceRoot":"","sources":["../../../src/channels/slack/post-update-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAW1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEnE,KAAK,YAAY,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,MAAM,QAAQ,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,4DAA4D;IAC5D,KAAK,CAAC,IAAI,EAAE;QACV,OAAO,EAAE,YAAY,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,uEAAuE;IACvE,MAAM,CAAC,IAAI,EAAE;QACX,OAAO,EAAE,YAAY,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,OAAO,EAAE,YAAY,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpC,mEAAmE;IACnE,aAAa,CAAC,IAAI,EAAE;QAClB,OAAO,EAAE,YAAY,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,wEAAwE;IACxE,aAAa,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uFAAuF;IACvF,IAAI,CAAC,IAAI,EAAE;QACT,OAAO,EAAE,YAAY,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACrC;AA6RD,iFAAiF;AACjF,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,gBAAgB,EACtB,aAAa,EAAE,OAAO,GACrB,oBAAoB,CAItB"}