@every-app/sdk 0.2.0 → 0.3.0-rc.1

package/dist/dev/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @every-app/sdk/dev — the well-known dev identity: the keypair `everyapp dev`
+ * signs with, its issuer and its key id. For the platform's local dev tools
+ * (the CLI, `@every-app/perimeter/dev`); never imported by a Worker.
+ */
+export { DEV_ISSUER, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
+export { IDENTITY_DEV_KEY_ID } from "../internal/protocol.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/dev/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dev/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/dev/index.js

@@ -0,0 +1,7 @@
+/**
+ * @every-app/sdk/dev — the well-known dev identity: the keypair `everyapp dev`
+ * signs with, its issuer and its key id. For the platform's local dev tools
+ * (the CLI, `@every-app/perimeter/dev`); never imported by a Worker.
+ */
+export { DEV_ISSUER, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
+export { IDENTITY_DEV_KEY_ID } from "../internal/protocol.js";

package/dist/dev/keypair.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The well-known keypair and issuer of local dev identities.
+ *
+ * Public by design: the private key is in this file for anyone to read, so a
+ * token signed with it proves nothing outside dev. The SDK accepts it only
+ * under the dev key id, only behind the dev opt-in (`EVERYAPP_DEV`, which
+ * `everyAppWorker()` sets in development and a deploy never does), and only
+ * from {@link DEV_ISSUER}. Anything that reaches the local dev ports can mint
+ * a dev identity with it; that is the local-dev trust boundary, which is why
+ * `everyapp dev` listens on 127.0.0.1 unless told otherwise.
+ *
+ * A leaf module: `cloudflare.config.ts` loads it through
+ * `@every-app/sdk/cloudflare`, and the Vite plugin hides from the Worker
+ * every file the config loads, so the Worker never imports it. The Worker
+ * side keeps its own copy of the issuer (`internal/protocol.ts`); a test
+ * pins the two together.
+ */
+/** Issuer of locally minted dev identity tokens. */
+export declare const DEV_ISSUER = "https://gateway.dev.localhost";
+/** SPKI PEM public half of the dev keypair. */
+export declare const DEV_PUBLIC_KEY_PEM = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh40zWf+QK3rJdMTNoy+X\nF9iydV5raWSeEt4DXyeY98c8IZHRjy2UXaaYejweebRsv9Az+bZuL3cfJ0E7pOGd\n4VCOiSG1BjJglmTC1whV4Md6qhLDVOP6iztUJSxDwnlR85UtOyNJ4G5dYY6RrAWl\nPMMXPSYdGWqAP4n5QXAw+7uTFmJMdWy1W8KLbTj//NSGn3DCm+EZJIC8q9yDhMSc\nM0ejJnBVColvp4T8k8dt2kYGu2Wd7dCMrHv/lxUoqD58avpdMOzbaZtwsQ7BAaIa\nmIeQ1AKxmnCj1np23uWvYQmoaZocvupLSALK7fWGUyVDZ+RW4HtN5KqzZypfiyZ8\nkQIDAQAB\n-----END PUBLIC KEY-----\n";
+/** PKCS#8 PEM private half of the dev keypair. Public, see above. */
+export declare const DEV_PRIVATE_KEY_PEM = "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCHjTNZ/5Aresl0\nxM2jL5cX2LJ1XmtpZJ4S3gNfJ5j3xzwhkdGPLZRdpph6PB55tGy/0DP5tm4vdx8n\nQTuk4Z3hUI6JIbUGMmCWZMLXCFXgx3qqEsNU4/qLO1QlLEPCeVHzlS07I0ngbl1h\njpGsBaU8wxc9Jh0ZaoA/iflBcDD7u5MWYkx1bLVbwottOP/81IafcMKb4RkkgLyr\n3IOExJwzR6MmcFUKiW+nhPyTx23aRga7ZZ3t0Iyse/+XFSioPnxq+l0w7Ntpm3Cx\nDsEBohqYh5DUArGacKPWenbe5a9hCahpmhy+6ktIAsrt9YZTJUNn5Fbge03kqrNn\nKl+LJnyRAgMBAAECggEABCi9GAB3URw3APgWarDHwS2vGRqU72KM1p2dCx8FCqpA\ncjO+Ezd171Mwp8R/N2MFuLN32sxCEH8GU88kuDwLevm8q+C+xBJI5ChykYRCFU/t\nl7kUaP8HRZ0kCXF0oUuVbATKYt+D8WjVgOwt1FJGhgki5geMukZKKdjvDtbVS+4D\nqGRBV4/XT4Y5JDNrjnITwSV2xfMD6Yd92/NN375+V9vWFI4kaESPbE/YQ7yF1o66\nDfhjRMSMmTgWEeoVDwFMlnXppo1nkdEXY8MXlgho0mDGre4PurAvQmZRYlU6VJ63\nx7/NTaNPnQEJ7+FkUXvtOz8sCBjLzgtilGnBNwGqeQKBgQC7zA7kojSPYvlm7nbC\nL2kO8iAL3p/B1vtS6XLTFiV0Wv2kT6Cy51ulVteUijwGMrDuCMdBqXfIocQvYhls\nJzPR/DaFcE2qClCei9L4wxvdBLcqoQH7LsllGA9oHSoZNnzT0muNech0xuL75X6B\nLLMpVtOyb/prd8N6hhBlcGElCQKBgQC4x8A9aDnFlcyztcutW2YQMfEyDEK+PcuC\nn6cnSJ8MjmFEyulKZuklqKkhwMiNBm8xNhI6UdUtrFPfKmGqYifjEUX4D6xGLL8b\nLNOZojkMAI3jtuD+IGzlpkSCy2TWXVb53TTi82LUD7Sbb5siYhL5uW0IRzbJt1aR\nn2JNphvFSQKBgA1NPNjQ7GwjlIrH5T2H4ice20o78JDoS1DqHCn7bZe6QjD7OuSx\nInqplgd9axb9TC7wDD0IZeWeH6lDh41zkWYUOUBmXfnnVSKFwOHB4B1dkiPA18UU\n4Ur5002Kk0rJ4zmVs+yHbb1nwPgan0VDB0WsUr5W1CP8jaoGCO9GcHsRAoGAX6Xm\neOLupLx6DbxZBg99sXxoocN++QL7yU3jNI5+5fz9lKKESCMlJH09r18fcQCXph2b\nKd0aQF4nvCkwDQZqJzvVwCY8wsZ+1g5KKgizBudyiyErLeCS/f0nEZ0/QUdnskcz\nDRd3XNYUYzFOWGnz8JhvPA3A6oGgqhiaxh7p2SECgYA+7s6WRfQLSad3dXuDNajQ\nsBwG4E6M/yUbgdbNjnv+AuVYS8Uyvf6x/xaWH3zssluIXhod0Two22bjtkPGJ2nx\n1ZXmbxSdWVGwLZn3GYRoRu6X6VGTbFAaK1mb7KDfwjoaauV7G3A2mw6M5xxg4zx/\nhsbx0DA4sMMIUEniw9W/YA==\n-----END PRIVATE KEY-----\n";
+//# sourceMappingURL=keypair.d.ts.map

package/dist/dev/keypair.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../src/dev/keypair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,oDAAoD;AACpD,eAAO,MAAM,UAAU,kCAAkC,CAAC;AAE1D,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,idAS9B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,ysDA4B/B,CAAC"}

package/dist/dev/keypair.js

@@ -0,0 +1,60 @@
+/**
+ * The well-known keypair and issuer of local dev identities.
+ *
+ * Public by design: the private key is in this file for anyone to read, so a
+ * token signed with it proves nothing outside dev. The SDK accepts it only
+ * under the dev key id, only behind the dev opt-in (`EVERYAPP_DEV`, which
+ * `everyAppWorker()` sets in development and a deploy never does), and only
+ * from {@link DEV_ISSUER}. Anything that reaches the local dev ports can mint
+ * a dev identity with it; that is the local-dev trust boundary, which is why
+ * `everyapp dev` listens on 127.0.0.1 unless told otherwise.
+ *
+ * A leaf module: `cloudflare.config.ts` loads it through
+ * `@every-app/sdk/cloudflare`, and the Vite plugin hides from the Worker
+ * every file the config loads, so the Worker never imports it. The Worker
+ * side keeps its own copy of the issuer (`internal/protocol.ts`); a test
+ * pins the two together.
+ */
+/** Issuer of locally minted dev identity tokens. */
+export const DEV_ISSUER = "https://gateway.dev.localhost";
+/** SPKI PEM public half of the dev keypair. */
+export const DEV_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh40zWf+QK3rJdMTNoy+X
+F9iydV5raWSeEt4DXyeY98c8IZHRjy2UXaaYejweebRsv9Az+bZuL3cfJ0E7pOGd
+4VCOiSG1BjJglmTC1whV4Md6qhLDVOP6iztUJSxDwnlR85UtOyNJ4G5dYY6RrAWl
+PMMXPSYdGWqAP4n5QXAw+7uTFmJMdWy1W8KLbTj//NSGn3DCm+EZJIC8q9yDhMSc
+M0ejJnBVColvp4T8k8dt2kYGu2Wd7dCMrHv/lxUoqD58avpdMOzbaZtwsQ7BAaIa
+mIeQ1AKxmnCj1np23uWvYQmoaZocvupLSALK7fWGUyVDZ+RW4HtN5KqzZypfiyZ8
+kQIDAQAB
+-----END PUBLIC KEY-----
+`;
+/** PKCS#8 PEM private half of the dev keypair. Public, see above. */
+export const DEV_PRIVATE_KEY_PEM = `-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCHjTNZ/5Aresl0
+xM2jL5cX2LJ1XmtpZJ4S3gNfJ5j3xzwhkdGPLZRdpph6PB55tGy/0DP5tm4vdx8n
+QTuk4Z3hUI6JIbUGMmCWZMLXCFXgx3qqEsNU4/qLO1QlLEPCeVHzlS07I0ngbl1h
+jpGsBaU8wxc9Jh0ZaoA/iflBcDD7u5MWYkx1bLVbwottOP/81IafcMKb4RkkgLyr
+3IOExJwzR6MmcFUKiW+nhPyTx23aRga7ZZ3t0Iyse/+XFSioPnxq+l0w7Ntpm3Cx
+DsEBohqYh5DUArGacKPWenbe5a9hCahpmhy+6ktIAsrt9YZTJUNn5Fbge03kqrNn
+Kl+LJnyRAgMBAAECggEABCi9GAB3URw3APgWarDHwS2vGRqU72KM1p2dCx8FCqpA
+cjO+Ezd171Mwp8R/N2MFuLN32sxCEH8GU88kuDwLevm8q+C+xBJI5ChykYRCFU/t
+l7kUaP8HRZ0kCXF0oUuVbATKYt+D8WjVgOwt1FJGhgki5geMukZKKdjvDtbVS+4D
+qGRBV4/XT4Y5JDNrjnITwSV2xfMD6Yd92/NN375+V9vWFI4kaESPbE/YQ7yF1o66
+DfhjRMSMmTgWEeoVDwFMlnXppo1nkdEXY8MXlgho0mDGre4PurAvQmZRYlU6VJ63
+x7/NTaNPnQEJ7+FkUXvtOz8sCBjLzgtilGnBNwGqeQKBgQC7zA7kojSPYvlm7nbC
+L2kO8iAL3p/B1vtS6XLTFiV0Wv2kT6Cy51ulVteUijwGMrDuCMdBqXfIocQvYhls
+JzPR/DaFcE2qClCei9L4wxvdBLcqoQH7LsllGA9oHSoZNnzT0muNech0xuL75X6B
+LLMpVtOyb/prd8N6hhBlcGElCQKBgQC4x8A9aDnFlcyztcutW2YQMfEyDEK+PcuC
+n6cnSJ8MjmFEyulKZuklqKkhwMiNBm8xNhI6UdUtrFPfKmGqYifjEUX4D6xGLL8b
+LNOZojkMAI3jtuD+IGzlpkSCy2TWXVb53TTi82LUD7Sbb5siYhL5uW0IRzbJt1aR
+n2JNphvFSQKBgA1NPNjQ7GwjlIrH5T2H4ice20o78JDoS1DqHCn7bZe6QjD7OuSx
+Inqplgd9axb9TC7wDD0IZeWeH6lDh41zkWYUOUBmXfnnVSKFwOHB4B1dkiPA18UU
+4Ur5002Kk0rJ4zmVs+yHbb1nwPgan0VDB0WsUr5W1CP8jaoGCO9GcHsRAoGAX6Xm
+eOLupLx6DbxZBg99sXxoocN++QL7yU3jNI5+5fz9lKKESCMlJH09r18fcQCXph2b
+Kd0aQF4nvCkwDQZqJzvVwCY8wsZ+1g5KKgizBudyiyErLeCS/f0nEZ0/QUdnskcz
+DRd3XNYUYzFOWGnz8JhvPA3A6oGgqhiaxh7p2SECgYA+7s6WRfQLSad3dXuDNajQ
+sBwG4E6M/yUbgdbNjnv+AuVYS8Uyvf6x/xaWH3zssluIXhod0Two22bjtkPGJ2nx
+1ZXmbxSdWVGwLZn3GYRoRu6X6VGTbFAaK1mb7KDfwjoaauV7G3A2mw6M5xxg4zx/
+hsbx0DA4sMMIUEniw9W/YA==
+-----END PRIVATE KEY-----
+`;

package/dist/internal/aiProviders.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The gateway's AI providers as the SDK's local-dev fallback reaches them:
+ * with no gateway binding, a developer's own key, under the name of the
+ * gateway secret that holds it, goes to the provider directly. Deployed
+ * apps always go through the gateway, which holds the real keys. The
+ * providers themselves are the catalog's `ai` entries (./capabilities.ts);
+ * this derives the fallback's view of each, and holds the one response
+ * rewrite the gateway has (Workers AI's numeric tokens).
+ */
+import { type AiProviderCapability, type AiProviderId, type ApiKeyAuth, type CapabilitySettings } from "./capabilities.js";
+export interface DevAiProviderSpec {
+    origin: string;
+    /** The gateway secret holding the provider key; in local dev, the `.dev.vars` name. */
+    keyEnv: string;
+    /** Where the key goes on a request (`authorizationOf`). */
+    auth: ApiKeyAuth;
+    /** Where an operator gets the key: the provider's API keys page. */
+    docs: string;
+    /** The everyapp skill's setup guide for it, relative to the skill (`setup/openai.md`). */
+    setup?: string;
+    /** Gateway settings the provider's URL needs besides the key, under the same names. */
+    alsoNeeds?: readonly string[];
+    /** The path every provider path is joined onto, from those settings. */
+    basePath?: (settings: Readonly<Record<string, string>>) => string;
+    /** Turns the provider's response at `path` into what OpenAI clients parse. */
+    normalizeResponse?: (path: string, response: Response) => Response;
+}
+export type DevAiProvider = AiProviderId;
+/** The fallback's view of one `ai` catalog entry. */
+export declare function devAiProviderSpec(capability: AiProviderCapability): DevAiProviderSpec;
+export declare const DEV_AI_PROVIDERS: Readonly<Record<DevAiProvider, DevAiProviderSpec>>;
+export declare function devAiProvider(name: string): DevAiProviderSpec | undefined;
+/** Every setting a provider needs, its key first: the names `.dev.vars` and the gateway use. */
+export declare function aiProviderSettings(spec: DevAiProviderSpec): string[];
+/**
+ * An `ai` entry's `basePath` with each `{SETTING}` filled from the
+ * settings, URL-encoded (`/client/v4/accounts/{CLOUDFLARE_ACCOUNT_ID}/ai`
+ * with `acc 1` makes `/client/v4/accounts/acc%201/ai`), or null while a
+ * named setting is unset or blank.
+ */
+export declare function fillBasePath(template: string, settings: CapabilitySettings): string | null;
+/**
+ * The base URL an `ai` entry's calls are joined onto, from the Gateway's
+ * settings: its origin and filled `basePath`, or null while a setting the
+ * path needs is unset.
+ */
+export declare function aiBaseUrl(capability: AiProviderCapability, settings: CapabilitySettings): string | null;
+/** The account-scoped base path of Workers AI's REST API. */
+export declare function workersAiBasePath(accountId: string): string;
+/**
+ * `base` with `path` joined onto its path (never replacing it) and
+ * `search` as its query: `https://api.cloudflare.com/client/v4/accounts/<id>/ai`
+ * and `/v1/chat/completions` make `…/ai/v1/chat/completions`. `path` starts
+ * with one slash; null when the result would leave `base`'s path.
+ */
+export declare function joinProviderUrl(base: string, path: string, search?: string): URL | null;
+/**
+ * Workers AI's OpenAI-compatible chat completions on the vLLM-backed models
+ * (Meta's Llama among them) send a token made only of digits as a JSON
+ * number (`"delta":{"content":18}`), which OpenAI clients refuse:
+ * `@ai-sdk/openai-compatible` drops the token and reports an error part.
+ * This turns such numbers back into strings, in `choices[].delta` (streams)
+ * and `choices[].message` (whole JSON bodies); every other event or body
+ * passes through byte for byte. Remove it once Cloudflare sends strings.
+ */
+export declare function normalizeWorkersAiResponse(path: string, response: Response): Response;
+//# sourceMappingURL=aiProviders.d.ts.map

package/dist/internal/aiProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiProviders.d.ts","sourceRoot":"","sources":["../../src/internal/aiProviders.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,IAAI,EAAE,UAAU,CAAC;IACjB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;IAClE,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC;CACpE;AAED,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC;AAEzC,qDAAqD;AACrD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,oBAAoB,GAC/B,iBAAiB,CAkBnB;AAED,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CACrC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAQG,CAAC;AAE9C,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAIzE;AAED,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,kBAAkB,GAC3B,MAAM,GAAG,IAAI,CAcf;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,UAAU,EAAE,oBAAoB,EAChC,QAAQ,EAAE,kBAAkB,GAC3B,MAAM,GAAG,IAAI,CAIf;AAED,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,SAAK,GACV,GAAG,GAAG,IAAI,CAOZ;AAWD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,GACjB,QAAQ,CAqBV"}

package/dist/internal/aiProviders.js

@@ -0,0 +1,220 @@
+/**
+ * The gateway's AI providers as the SDK's local-dev fallback reaches them:
+ * with no gateway binding, a developer's own key, under the name of the
+ * gateway secret that holds it, goes to the provider directly. Deployed
+ * apps always go through the gateway, which holds the real keys. The
+ * providers themselves are the catalog's `ai` entries (./capabilities.ts);
+ * this derives the fallback's view of each, and holds the one response
+ * rewrite the gateway has (Workers AI's numeric tokens).
+ */
+import { CAPABILITIES, CAPABILITY_IDS, } from "./capabilities.js";
+/** The fallback's view of one `ai` catalog entry. */
+export function devAiProviderSpec(capability) {
+    const { basePath, normalize } = capability;
+    return {
+        origin: capability.origin,
+        keyEnv: capability.auth.secret,
+        auth: capability.auth,
+        docs: capability.docs,
+        ...(capability.setup === undefined ? {} : { setup: capability.setup }),
+        ...(capability.alsoNeeds === undefined
+            ? {}
+            : { alsoNeeds: capability.alsoNeeds }),
+        ...(basePath === undefined
+            ? {}
+            : { basePath: (settings) => fillBasePath(basePath, settings) ?? "" }),
+        ...(normalize === "workers-ai"
+            ? { normalizeResponse: normalizeWorkersAiResponse }
+            : {}),
+    };
+}
+export const DEV_AI_PROVIDERS = Object.fromEntries(CAPABILITY_IDS.flatMap((id) => {
+    const capability = CAPABILITIES[id];
+    return capability.mode === "ai"
+        ? [[id, devAiProviderSpec(capability)]]
+        : [];
+}));
+export function devAiProvider(name) {
+    return Object.hasOwn(DEV_AI_PROVIDERS, name)
+        ? DEV_AI_PROVIDERS[name]
+        : undefined;
+}
+/** Every setting a provider needs, its key first: the names `.dev.vars` and the gateway use. */
+export function aiProviderSettings(spec) {
+    return [spec.keyEnv, ...(spec.alsoNeeds ?? [])];
+}
+/**
+ * An `ai` entry's `basePath` with each `{SETTING}` filled from the
+ * settings, URL-encoded (`/client/v4/accounts/{CLOUDFLARE_ACCOUNT_ID}/ai`
+ * with `acc 1` makes `/client/v4/accounts/acc%201/ai`), or null while a
+ * named setting is unset or blank.
+ */
+export function fillBasePath(template, settings) {
+    let missing = false;
+    const filled = template.replace(/\{([A-Z][A-Z0-9_]*)\}/g, (_, name) => {
+        const value = settings[name];
+        if (typeof value !== "string" || !value.trim()) {
+            missing = true;
+            return "";
+        }
+        return encodeURIComponent(value.trim());
+    });
+    return missing ? null : filled;
+}
+/**
+ * The base URL an `ai` entry's calls are joined onto, from the Gateway's
+ * settings: its origin and filled `basePath`, or null while a setting the
+ * path needs is unset.
+ */
+export function aiBaseUrl(capability, settings) {
+    if (capability.basePath === undefined)
+        return capability.origin;
+    const path = fillBasePath(capability.basePath, settings);
+    return path === null ? null : `${capability.origin}${path}`;
+}
+/** The account-scoped base path of Workers AI's REST API. */
+export function workersAiBasePath(accountId) {
+    return `/client/v4/accounts/${encodeURIComponent(accountId.trim())}/ai`;
+}
+/**
+ * `base` with `path` joined onto its path (never replacing it) and
+ * `search` as its query: `https://api.cloudflare.com/client/v4/accounts/<id>/ai`
+ * and `/v1/chat/completions` make `…/ai/v1/chat/completions`. `path` starts
+ * with one slash; null when the result would leave `base`'s path.
+ */
+export function joinProviderUrl(base, path, search = "") {
+    const url = new URL(base);
+    const basePath = url.pathname.replace(/\/+$/, "");
+    url.pathname = `${basePath}${path}`;
+    url.search = search;
+    url.hash = "";
+    return url.pathname === `${basePath}${path}` ? url : null;
+}
+const WORKERS_AI_NORMALIZED_ROUTES = new Set([
+    "/v1/chat/completions",
+]);
+/** Text fields of a chat completion choice that OpenAI clients require as strings. */
+const TEXT_FIELDS = ["content", "reasoning_content", "reasoning"];
+const NUMERIC_TEXT_FIELD = /"(?:content|reasoning_content|reasoning)"\s*:\s*-?\d/;
+/**
+ * Workers AI's OpenAI-compatible chat completions on the vLLM-backed models
+ * (Meta's Llama among them) send a token made only of digits as a JSON
+ * number (`"delta":{"content":18}`), which OpenAI clients refuse:
+ * `@ai-sdk/openai-compatible` drops the token and reports an error part.
+ * This turns such numbers back into strings, in `choices[].delta` (streams)
+ * and `choices[].message` (whole JSON bodies); every other event or body
+ * passes through byte for byte. Remove it once Cloudflare sends strings.
+ */
+export function normalizeWorkersAiResponse(path, response) {
+    if (!response.body || !WORKERS_AI_NORMALIZED_ROUTES.has(path)) {
+        return response;
+    }
+    const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
+    const transform = contentType.startsWith("text/event-stream")
+        ? normalizeSseLines()
+        : contentType.startsWith("application/json")
+            ? normalizeJsonBody()
+            : null;
+    if (!transform)
+        return response;
+    const headers = new Headers(response.headers);
+    // The body may change length.
+    headers.delete("content-length");
+    return new Response(response.body.pipeThrough(transform), {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+/** Stringify numeric text fields of every choice in a chat completion (chunk). */
+function stringifyNumericText(payload) {
+    if (!isRecord(payload) || !Array.isArray(payload["choices"]))
+        return false;
+    let changed = false;
+    for (const choice of payload["choices"]) {
+        if (!isRecord(choice))
+            continue;
+        for (const part of [choice["delta"], choice["message"]]) {
+            if (!isRecord(part))
+                continue;
+            for (const field of TEXT_FIELDS) {
+                const value = part[field];
+                if (typeof value === "number") {
+                    part[field] = String(value);
+                    changed = true;
+                }
+            }
+        }
+    }
+    return changed;
+}
+/** `json` with its numeric text fields as strings, or null when it has none. */
+function normalizedJson(json) {
+    if (!NUMERIC_TEXT_FIELD.test(json))
+        return null;
+    let payload;
+    try {
+        payload = JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+    return stringifyNumericText(payload) ? JSON.stringify(payload) : null;
+}
+/**
+ * An SSE stream, line by line: a `data:` line whose JSON has a numeric text
+ * field is rewritten, every other line (and its line ending) is kept.
+ */
+function normalizeSseLines() {
+    const decoder = new TextDecoder();
+    const encoder = new TextEncoder();
+    let pending = "";
+    const normalizeLine = (line) => {
+        const match = /^(data:[ ]?)(.*?)(\r?)$/s.exec(line);
+        if (!match)
+            return line;
+        const rewritten = normalizedJson(match[2]);
+        return rewritten === null ? line : `${match[1]}${rewritten}${match[3]}`;
+    };
+    return new TransformStream({
+        transform(chunk, controller) {
+            pending += decoder.decode(chunk, { stream: true });
+            const end = pending.lastIndexOf("\n");
+            if (end === -1)
+                return;
+            const complete = pending.slice(0, end + 1);
+            pending = pending.slice(end + 1);
+            controller.enqueue(encoder.encode(complete.split("\n").map(normalizeLine).join("\n")));
+        },
+        flush(controller) {
+            pending += decoder.decode();
+            if (pending)
+                controller.enqueue(encoder.encode(normalizeLine(pending)));
+        },
+    });
+}
+/** A whole JSON body: rewritten when it has a numeric text field, else kept as sent. */
+function normalizeJsonBody() {
+    const chunks = [];
+    return new TransformStream({
+        transform(chunk) {
+            chunks.push(chunk);
+        },
+        flush(controller) {
+            const decoder = new TextDecoder();
+            const text = chunks
+                .map((chunk) => decoder.decode(chunk, { stream: true }))
+                .join("") + decoder.decode();
+            const rewritten = normalizedJson(text);
+            if (rewritten !== null) {
+                controller.enqueue(new TextEncoder().encode(rewritten));
+                return;
+            }
+            for (const chunk of chunks)
+                controller.enqueue(chunk);
+        },
+    });
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/internal/appSettings.d.ts

@@ -0,0 +1,237 @@
+/**
+ * What an app needs set before it works, and whether it is: the model
+ * behind "needs setup" wherever an app is shown (the gateway's home and
+ * Admin → Apps, `everyapp status`, `everyapp secret list`, the end of
+ * `everyapp deploy`, and what `everyapp configure <app>` walks through).
+ *
+ * A manifest declares three kinds of setting. An AI provider
+ * (`providers`) and a capability (`capabilities`) are the Gateway's: their
+ * keys and clients live on the Gateway Worker, set once for every app
+ * with `everyapp secret set <NAME>`. The app's own secrets (`secrets`)
+ * live on its Worker, set from its directory. Each declaration carries a
+ * need: required (the default; the app doesn't open until it is set),
+ * optional (the app opens, and the feature says what is missing where it
+ * is used), or a member of a named any-of group (the app opens once any
+ * member is set; only for an app that picks among the set members at run
+ * time). Each may say `why` it is needed and where it comes from
+ * (`docs`, an https URL); for providers and capabilities the registries
+ * here supply a default.
+ *
+ * Everything in this module is pure and tenant-neutral: a manifest ships
+ * in a release, and what is set is asked of the caller (`isSet`), which
+ * reads the Gateway's env, cf's secret list, or the registry's record of
+ * the app Worker's secret names.
+ */
+import { type ApiKeyCapability, type CapabilityLookup } from "./capabilities.js";
+/** A provider as `providers` lists it: its id, or an entry with a need. */
+export interface ProviderEntry extends SettingNeedFields {
+    id: string;
+}
+/** A secret as `secrets` lists it: its name, or an entry with a need. */
+export interface SecretEntry extends SettingNeedFields {
+    name: string;
+}
+/** What any declaration may say about its need. */
+export interface SettingNeedFields {
+    /** Why the app needs it, for whoever sets it (200 characters at most). */
+    why?: string;
+    /** Where the key or client comes from: an https URL. */
+    docs?: string;
+    /** The app works without it; the feature using it says so where it is used. */
+    optional?: boolean;
+    /**
+     * For an app's own secret: its setup guide, relative to the everyapp
+     * skill (`setup/main-secret.md`). Providers and capabilities take theirs
+     * from the registries and can't override it.
+     */
+    setup?: string;
+    /**
+     * The name of a group of which one set member is enough ("AI model").
+     * Only for an app that picks among the set members at run time: the
+     * gateway refuses a call to a provider whose key isn't set, whichever
+     * others are.
+     */
+    anyOf?: string;
+}
+/** The manifest fields this module reads, as a stored or authored manifest has them. */
+export interface SettingsManifestLike {
+    readonly providers?: ReadonlyArray<string | ProviderEntry>;
+    readonly capabilities?: {
+        readonly [id: string]: unknown;
+    };
+    readonly secrets?: ReadonlyArray<string | SecretEntry>;
+    readonly ai?: {
+        readonly routes?: readonly string[];
+    };
+    /** A remote MCP app's registration (./remoteMcp.ts): its credential is a required Gateway setting. */
+    readonly remote?: unknown;
+    readonly name?: string;
+}
+export type SettingKind = "provider" | "capability" | "secret" | "ai-routes"
+/** A remote MCP app's credential (./remoteMcp.ts): one Gateway setting named by the row. */
+ | "remote-mcp";
+/** Which Worker holds a setting: the Gateway's, or the app's own. */
+export type SettingHolder = "gateway" | "app";
+export type SettingNeed = {
+    kind: "required";
+} | {
+    kind: "optional";
+} | {
+    kind: "anyOf";
+    group: string;
+};
+/** One thing the app needs set, as the manifest declares it. */
+export interface AppSetting {
+    kind: SettingKind;
+    /** The provider id, capability id or secret name; "ai-routes" for the AI proxy's extra routes. */
+    id: string;
+    /** "OpenRouter", "DataForSEO", "MAIN_SECRET", "AI proxy routes". */
+    label: string;
+    holder: SettingHolder;
+    /** Every one of these must be set for the setting to count as set. */
+    names: string[];
+    /** Read when set, never required (a capability's optional settings). */
+    alsoReads: string[];
+    need: SettingNeed;
+    why?: string;
+    docs?: string;
+    /**
+     * The everyapp skill's setup guide for it, relative to the skill
+     * (`setup/dataforseo.md`; in an app `.claude/skills/everyapp/setup/…`, in
+     * the checkout `packages/cli/skills/everyapp/setup/…`): what an agent
+     * reads to set it up end to end. From the registries for providers and
+     * capabilities; from the manifest entry for an app's own secret.
+     */
+    setup?: string;
+    /**
+     * What the key is and where it comes from, in a sentence or three, from
+     * the provider's entry (its `hint`, and each secret's own after it):
+     * what the "Needs setup" dialog, `everyapp status` and `everyapp
+     * configure` show beside `why`. A provider registered on the gateway
+     * has no guide, so this is what an agent reads for it.
+     */
+    hint?: string;
+}
+/** A setting with whether it is set, and whether that keeps the app closed. */
+export interface EvaluatedSetting extends AppSetting {
+    /**
+     * True: every name is set. False: one isn't. Null: not known (an app
+     * Worker whose secret names were never recorded), which never blocks.
+     */
+    set: boolean | null;
+    /** This setting keeps the app from opening: required and unset, or a member of an any-of group none of whose members is set. */
+    blocking: boolean;
+}
+/** An any-of group: met once any member is set. */
+export interface AnyOfGroup {
+    group: string;
+    members: EvaluatedSetting[];
+    met: boolean;
+}
+/** What `evaluateAppSettings` finds: whether the app opens, and every setting's state. */
+export interface AppSettingsReport {
+    /** No required setting is unset and every any-of group is met. */
+    ready: boolean;
+    /** Every setting, in manifest order: providers, capabilities, the AI routes, secrets. */
+    settings: EvaluatedSetting[];
+    groups: AnyOfGroup[];
+    /** The settings that keep the app closed, in manifest order. */
+    unmet: EvaluatedSetting[];
+}
+/** The need an entry declares; required unless it says otherwise. */
+export declare function needOf(entry: SettingNeedFields | undefined): SettingNeed;
+/** The providers the manifest lists, each as an entry whatever form it took. */
+export declare function providerEntries(manifest: Pick<SettingsManifestLike, "providers">): ProviderEntry[];
+/** The provider ids the manifest lists, in order. */
+export declare function providerIds(manifest: Pick<SettingsManifestLike, "providers">): string[];
+/** The app's own secrets the manifest lists, each as an entry whatever form it took. */
+export declare function secretEntries(manifest: Pick<SettingsManifestLike, "secrets">): SecretEntry[];
+/** The names of the app's own secrets, in order. */
+export declare function secretNames(manifest: Pick<SettingsManifestLike, "secrets">): string[];
+/**
+ * Every setting the manifest declares, in manifest order: its AI
+ * providers, its capabilities, the AI proxy's extra routes when `ai.routes`
+ * asks for any, then the app's own secrets. A provider or capability the
+ * gateway doesn't offer contributes nothing (the manifest validator refuses
+ * it elsewhere); so does a capability with nothing to set (`members`),
+ * which is always set. `lookup` is where ids are found: the catalog alone
+ * by default, or a gateway's registry with its registered rows.
+ */
+export declare function appSettings(manifest: SettingsManifestLike, lookup?: CapabilityLookup): AppSetting[];
+export interface EvaluateOptions {
+    /**
+     * A capability's own readiness rule, where names alone don't say (the
+     * gateway's email is configured once a sender parses and a provider is
+     * selectable): a boolean or null overrides the names; undefined defers
+     * to them.
+     */
+    readiness?: (setting: AppSetting) => boolean | null | undefined;
+}
+/**
+ * Every setting against what is set. `isSet` answers per holder and name:
+ * true, false, or null when it can't tell (the registry never recorded
+ * the app Worker's secret names), which never blocks. An any-of group is
+ * met once any member is set; while none is and none is unknown, every
+ * member blocks.
+ */
+export declare function evaluateAppSettings(settings: readonly AppSetting[], isSet: (holder: SettingHolder, name: string) => boolean | null, options?: EvaluateOptions): AppSettingsReport;
+/** The one command that opens the app. */
+export interface SetupCommand {
+    /**
+     * `everyapp configure <app>`: asks for every required setting the app
+     * lacks, then offers the optional ones, and sets each where it is held.
+     */
+    command: string;
+}
+/**
+ * What to run for an app that needs setup: `everyapp configure <app>`,
+ * which reads the app's manifest (from the registry, so it runs from
+ * anywhere), prompts for each unmet setting (one member of an any-of group
+ * is enough: it asks which) and sets them where they are held. Null when
+ * the app is ready. `cli` is how the operator runs everyapp (`pnpm
+ * everyapp` from a checkout). Scripts that set one name at a time use
+ * `everyapp secret set NAME [--app <id>]` instead.
+ *
+ * A provider app (`provider`: the gateway's own, with no Worker and no
+ * directory; `everyapp mcp on <id>`, an MCP app) has nothing to configure: its
+ * command is the `secret set` of its Gateway key (the first member of an
+ * unmet any-of group), as `mcp list` says it.
+ */
+export declare function setupCommand(report: Pick<AppSettingsReport, "unmet" | "groups">, { cli, appId, provider, }: {
+    cli: string;
+    appId: string;
+    provider?: boolean;
+}): SetupCommand | null;
+/** One setting as `AppSetup` carries it: the evaluation without what only the CLI reads. */
+export type AppSetupSetting = Omit<EvaluatedSetting, "alsoReads">;
+/**
+ * An app's setup state as every surface shows it, the same on the
+ * gateway's app lists (`setup`), `everyapp status --json`
+ * (`apps[].setup`) and `everyapp secret list --json`: whether it opens,
+ * every setting with its state, the any-of groups, and the one command
+ * that opens it, `everyapp configure <app>` (null when it is ready, or
+ * when whoever reads this can't run it: a shared app seen from another
+ * organization).
+ */
+export interface AppSetup {
+    ready: boolean;
+    settings: AppSetupSetting[];
+    unmet: AppSetupSetting[];
+    groups: Array<{
+        group: string;
+        met: boolean;
+        members: string[];
+    }>;
+    command: SetupCommand | null;
+}
+export declare function appSetupOf(report: AppSettingsReport, options: {
+    cli: string;
+    appId: string;
+    withCommand?: boolean;
+    provider?: boolean;
+}): AppSetup;
+/** The provider registry's labels, for anything that names a provider to a person. */
+export declare function providerLabel(id: string, lookup?: CapabilityLookup): string;
+/** The capability `id` names in `lookup`, as an API-key provider, or undefined. */
+export declare function apiKeyCapabilityOf(id: string, lookup?: CapabilityLookup): ApiKeyCapability | undefined;
+//# sourceMappingURL=appSettings.d.ts.map

package/dist/internal/appSettings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appSettings.d.ts","sourceRoot":"","sources":["../../src/internal/appSettings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAKL,KAAK,gBAAgB,EAErB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAW3B,2EAA2E;AAC3E,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC;IAC3D,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;IACvD,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACtD,sGAAsG;IACtG,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,YAAY,GACZ,QAAQ,GACR,WAAW;AACb,4FAA4F;GAC1F,YAAY,CAAC;AAEjB,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,KAAK,CAAC;AAE9C,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,kGAAkG;IAClG,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,CAAC;IACtB,sEAAsE;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD;;;OAGG;IACH,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;IACpB,gIAAgI;IAChI,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,GAAG,EAAE,OAAO,CAAC;CACd;AAED,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;IACf,yFAAyF;IACzF,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,gEAAgE;IAChE,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAED,qEAAqE;AACrE,wBAAgB,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,SAAS,GAAG,WAAW,CAOxE;AAgBD,gFAAgF;AAChF,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,GAChD,aAAa,EAAE,CAQjB;AAED,qDAAqD;AACrD,wBAAgB,WAAW,CACzB,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,GAChD,MAAM,EAAE,CAEV;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,GAC9C,WAAW,EAAE,CAQf;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CACzB,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,GAC9C,MAAM,EAAE,CAEV;AA4GD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,GAAE,gBAA0B,GACjC,UAAU,EAAE,CAmGd;AAgBD,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;CACjE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,UAAU,EAAE,EAC/B,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,EAC9D,OAAO,GAAE,eAAoB,GAC5B,iBAAiB,CAkCnB;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,QAAQ,CAAC,EACnD,EACE,GAAG,EACH,KAAK,EACL,QAAgB,GACjB,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACpD,YAAY,GAAG,IAAI,CAgBrB;AAED,4FAA4F;AAC5F,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAClE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE;IACP,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GACA,QAAQ,CAeV;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,EACV,MAAM,GAAE,gBAA0B,GACjC,MAAM,CAER;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,MAAM,EACV,MAAM,GAAE,gBAA0B,GACjC,gBAAgB,GAAG,SAAS,CAG9B"}