@every-app/sdk 0.2.0 → 0.3.0-rc.10

package/dist/internal/appSettings.js

@@ -0,0 +1,549 @@
+/**
+ * What an app needs set before it works, and whether it is: the model
+ * behind "needs setup" wherever an app is shown (the gateway's home and
+ * Admin → Apps, `everyapp status`, `everyapp secret list`, the end of
+ * `everyapp deploy`, and what `everyapp configure <app>` walks through).
+ *
+ * A manifest declares three kinds of setting. An AI provider
+ * (`providers`) and a capability (`capabilities`) are the Gateway's: their
+ * keys and clients live on the Gateway Worker, set once for every app
+ * with `everyapp secret set <NAME>`. The app's own secrets (`secrets`)
+ * live on its Worker, set from its directory. Each declaration carries a
+ * need: required (the default; the app doesn't open until it is set),
+ * optional (the app opens, and the feature says what is missing where it
+ * is used), or a member of a named any-of group (the app opens once any
+ * member is set; only for an app that picks among the set members at run
+ * time). Each may say `why` it is needed and where it comes from
+ * (`docs`, an https URL); for providers and capabilities the registries
+ * here supply a default. An app's plain settings (`settings`: a host, a
+ * project id, a region) are held like its secrets, on its Worker, but are
+ * values rather than keys: each says what it takes (a URL, a number, one
+ * of a list) and may give a default.
+ *
+ * Everything in this module is pure and tenant-neutral: a manifest ships
+ * in a release, and what is set is asked of the caller (`isSet`), which
+ * reads the Gateway's env, cf's secret list, or the registry's record of
+ * the app Worker's secret names.
+ */
+import { CATALOG, capabilitySettings, } from "./capabilities.js";
+import { aiDefaultSetupHint, aiRequiredSettings, resolveAiDefault, } from "./aiDefault.js";
+import { isInstallOwnedGatewaySetting, isSettableGatewaySetting, } from "./gatewaySettings.js";
+import { remoteMcpAuthLabel, remoteMcpOf, remoteMcpSecretOf, } from "./remoteMcp.js";
+/** The need an entry declares; required unless it says otherwise. */
+export function needOf(entry) {
+    if (!entry)
+        return { kind: "required" };
+    if (typeof entry.anyOf === "string" && entry.anyOf.trim()) {
+        return { kind: "anyOf", group: entry.anyOf.trim() };
+    }
+    if (entry.optional === true)
+        return { kind: "optional" };
+    return { kind: "required" };
+}
+function needFields(entry) {
+    if (!entry || typeof entry !== "object")
+        return {};
+    const record = entry;
+    return {
+        ...(typeof record["why"] === "string" ? { why: record["why"] } : {}),
+        ...(typeof record["docs"] === "string" ? { docs: record["docs"] } : {}),
+        ...(typeof record["optional"] === "boolean"
+            ? { optional: record["optional"] }
+            : {}),
+        ...(typeof record["setup"] === "string" ? { setup: record["setup"] } : {}),
+        ...(typeof record["anyOf"] === "string" ? { anyOf: record["anyOf"] } : {}),
+    };
+}
+/** The providers the manifest lists, each as an entry whatever form it took. */
+export function providerEntries(manifest) {
+    return (manifest.providers ?? []).flatMap((entry) => {
+        if (typeof entry === "string")
+            return [{ id: entry }];
+        if (entry && typeof entry === "object" && typeof entry.id === "string") {
+            return [{ id: entry.id, ...needFields(entry) }];
+        }
+        return [];
+    });
+}
+/** The provider ids the manifest lists, in order. */
+export function providerIds(manifest) {
+    return providerEntries(manifest).map((entry) => entry.id);
+}
+/** The app's own secrets the manifest lists, each as an entry whatever form it took. */
+export function secretEntries(manifest) {
+    return (manifest.secrets ?? []).flatMap((entry) => {
+        if (typeof entry === "string")
+            return [{ name: entry }];
+        if (entry && typeof entry === "object" && typeof entry.name === "string") {
+            return [{ name: entry.name, ...needFields(entry) }];
+        }
+        return [];
+    });
+}
+/** The names of the app's own secrets, in order. */
+export function secretNames(manifest) {
+    return secretEntries(manifest).map((entry) => entry.name);
+}
+/** The app's plain settings the manifest lists, each as an entry. */
+export function settingEntries(manifest) {
+    return (manifest.settings ?? []).flatMap((entry) => {
+        if (!entry || typeof entry !== "object" || typeof entry.name !== "string") {
+            return [];
+        }
+        const record = entry;
+        const type = record["type"];
+        const values = record["values"];
+        return [
+            {
+                name: entry.name,
+                ...needFields(entry),
+                ...(type === "url" ||
+                    type === "number" ||
+                    type === "boolean" ||
+                    type === "text"
+                    ? { type }
+                    : {}),
+                ...(Array.isArray(values) &&
+                    values.every((value) => typeof value === "string")
+                    ? { values: values }
+                    : {}),
+                ...(typeof record["default"] === "string"
+                    ? { default: record["default"] }
+                    : {}),
+            },
+        ];
+    });
+}
+/** The names of the app's plain settings, in order. */
+export function settingNames(manifest) {
+    return settingEntries(manifest).map((entry) => entry.name);
+}
+/**
+ * Every name the manifest puts on the app's own Workers: its secrets,
+ * then its plain settings. What `secret set` routes to the app and what
+ * `apps.secret_names` records.
+ */
+export function appWorkerNames(manifest) {
+    return [...secretNames(manifest), ...settingNames(manifest)];
+}
+/** A plain setting's rule, from its entry. */
+export function settingValueRule(entry) {
+    return {
+        type: entry.type ?? "text",
+        ...(entry.values?.length ? { values: [...entry.values] } : {}),
+        ...(entry.default !== undefined ? { default: entry.default } : {}),
+    };
+}
+/** `a, b or c`. */
+function either(values) {
+    return values.length < 2
+        ? (values[0] ?? "")
+        : `${values.slice(0, -1).join(", ")} or ${values.at(-1)}`;
+}
+/**
+ * What a plain setting takes, completing "Takes …": "an http or https
+ * URL", "one of us or eu", with ", default <value>" when it has one.
+ */
+export function settingValueTakes(rule) {
+    const what = rule.values?.length
+        ? `${rule.values.length > 2 ? "one of " : ""}${either(rule.values)}`
+        : {
+            text: "any text",
+            url: "an http or https URL",
+            number: "a number",
+            boolean: "true or false",
+        }[rule.type];
+    return rule.default !== undefined ? `${what}, default ${rule.default}` : what;
+}
+/**
+ * Why `value` won't do for a plain setting (one sentence), or null when
+ * it will: never empty, and of its type, or one of its values exactly.
+ */
+export function settingValueProblem(rule, value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return "Enter a value.";
+    if (rule.values?.length) {
+        return rule.values.includes(trimmed)
+            ? null
+            : `Not ${rule.values.length > 2 ? "one of " : ""}${either(rule.values)}.`;
+    }
+    switch (rule.type) {
+        case "text":
+            return null;
+        case "url": {
+            let url = null;
+            try {
+                url = new URL(trimmed);
+            }
+            catch {
+                url = null;
+            }
+            return url && (url.protocol === "http:" || url.protocol === "https:")
+                ? null
+                : `"${trimmed}" isn't an http or https URL.`;
+        }
+        case "number":
+            return /^-?\d+(\.\d+)?$/.test(trimmed)
+                ? null
+                : `"${trimmed}" isn't a number.`;
+        case "boolean":
+            return trimmed === "true" || trimmed === "false"
+                ? null
+                : "Not true or false.";
+    }
+}
+/**
+ * The Gateway settings an AI provider needs, the install's left out (set
+ * already). A catalog provider's names are settable by definition; a
+ * registered row's are its own, so they count too.
+ */
+function providerNames(capability) {
+    // An optional key (AI Gateway's own token) is never a need.
+    return aiRequiredSettings(capability).filter((name) => !isInstallOwnedGatewaySetting(name));
+}
+/** A capability's Gateway settings: what it needs, and what it also reads. */
+function capabilityNames(capability) {
+    const settable = (names) => names.filter((name) => isSettableGatewaySetting(name) && !isInstallOwnedGatewaySetting(name));
+    switch (capability.mode) {
+        case "api_key":
+            return { names: [...capabilitySettings(capability)], alsoReads: [] };
+        case "ai":
+            return { names: providerNames(capability), alsoReads: [] };
+        case "service":
+            return {
+                names: settable(capability.settings),
+                alsoReads: settable(capability.optionalSettings),
+            };
+        case "oauth_client":
+            return {
+                names: [
+                    capability.secrets.clientId,
+                    ...(capability.secrets.clientSecret
+                        ? [capability.secrets.clientSecret]
+                        : []),
+                ],
+                alsoReads: [],
+            };
+    }
+}
+/**
+ * Where a capability's key or client comes from, when the registry knows:
+ * an API-key provider's access page, or an OAuth client's console.
+ */
+function capabilityDocs(capability) {
+    switch (capability.mode) {
+        case "api_key":
+        case "ai":
+            return capability.docs;
+        case "oauth_client":
+            return capability.console;
+        case "service":
+            return undefined;
+    }
+}
+/** What a provider's entry says about getting its key: its hint, then each setting's own, named when there are several. */
+function providerHint(capability, names) {
+    if (capability.mode === "service" || capability.mode === "oauth_client") {
+        return {};
+    }
+    const details = capability.secrets ?? [];
+    const lines = [
+        ...(capability.hint ? [capability.hint] : []),
+        ...details
+            .filter((detail) => detail.hint && names.includes(detail.name))
+            .map((detail) => names.length > 1 ? `${detail.name}: ${detail.hint}` : detail.hint),
+    ];
+    return lines.length > 0 ? { hint: lines.join(" ") } : {};
+}
+function withNeed(setting, entry, defaults = {}) {
+    const docs = entry?.docs ?? defaults.docs;
+    // The registry's guide for a Gateway setting; the manifest's for the app's own secret.
+    const setup = setting.holder === "gateway" ? defaults.setup : entry?.setup;
+    return {
+        ...setting,
+        need: needOf(entry),
+        ...(entry?.why ? { why: entry.why } : {}),
+        ...(docs ? { docs } : {}),
+        ...(setup ? { setup } : {}),
+        ...(defaults.hint ? { hint: defaults.hint } : {}),
+    };
+}
+/**
+ * Every setting the manifest declares, in manifest order: its AI
+ * providers, its capabilities, the AI proxy's extra routes when `ai.routes`
+ * asks for any, then the app's own secrets. A provider or capability the
+ * gateway doesn't offer contributes nothing (the manifest validator refuses
+ * it elsewhere); so does a capability with nothing to set (`members`),
+ * which is always set. `lookup` is where ids are found: the catalog alone
+ * by default, or a gateway's registry with its registered rows.
+ */
+export function appSettings(manifest, lookup = CATALOG, options = {}) {
+    const settings = [];
+    const chat = manifest.ai?.chat;
+    if (chat === true || (chat && typeof chat === "object")) {
+        // The default resolves on what is set: with nothing set, the first of
+        // the order (or the operator's choice) and its settings are what to
+        // ask for; with one configured, that provider's. `isSet` here only
+        // orders the candidates; evaluateAppSettings decides what is set.
+        const resolution = resolveAiDefault({
+            provider: options.aiDefault ?? null,
+            isSet: options.isSet ?? (() => false),
+            lookup,
+        });
+        const settable = (names) => names.filter((name) => !isInstallOwnedGatewaySetting(name));
+        const provider = lookup.get(resolution.provider);
+        settings.push(withNeed({
+            kind: "ai-default",
+            id: "ai-default",
+            label: `A chat model (${resolution.label})`,
+            holder: "gateway",
+            names: settable(resolution.settings),
+            alsoReads: [],
+            alternatives: resolution.candidates
+                .map((candidate) => settable(candidate.settings))
+                .filter((names) => names.length > 0),
+        }, chat === true ? undefined : chat, {
+            ...(provider?.mode === "ai" ? { docs: provider.docs } : {}),
+            setup: "setup/ai.md",
+            hint: aiDefaultSetupHint(resolution),
+        }));
+    }
+    // The default's settings: an optional pin that needs only those is the
+    // same row (one key, set once), so it isn't listed twice. A required
+    // pin stays: it needs that provider's key even while another provider
+    // serves the default.
+    const defaultNames = settings.find((setting) => setting.kind === "ai-default")?.names;
+    for (const entry of providerEntries(manifest)) {
+        const capability = lookup.get(entry.id);
+        if (capability?.mode !== "ai")
+            continue;
+        const names = providerNames(capability);
+        if (defaultNames &&
+            needOf(entry).kind === "optional" &&
+            names.length > 0 &&
+            names.every((name) => defaultNames.includes(name))) {
+            continue;
+        }
+        settings.push(withNeed({
+            kind: "provider",
+            id: entry.id,
+            label: capability.label,
+            holder: "gateway",
+            names,
+            alsoReads: [],
+        }, entry, {
+            docs: capability.docs,
+            setup: capability.setup,
+            ...providerHint(capability, names),
+        }));
+    }
+    for (const [id, entry] of Object.entries(manifest.capabilities ?? {})) {
+        const capability = lookup.get(id);
+        // An AI provider under `capabilities` is the validator's to refuse.
+        if (!capability || capability.mode === "ai")
+            continue;
+        const { names, alsoReads } = capabilityNames(capability);
+        settings.push(withNeed({
+            kind: "capability",
+            id,
+            label: capability.label,
+            holder: "gateway",
+            names,
+            alsoReads,
+        }, needFields(entry), {
+            docs: capabilityDocs(capability),
+            setup: capability.setup,
+            ...providerHint(capability, names),
+        }));
+    }
+    if (manifest.ai?.routes?.length) {
+        settings.push({
+            kind: "ai-routes",
+            id: "ai-routes",
+            label: "AI proxy routes",
+            holder: "gateway",
+            names: ["AI_PROXY_EXTRA_ROUTES"],
+            alsoReads: [],
+            need: { kind: "required" },
+            why: `Lets the app call ${manifest.ai.routes.join(", ")} through the AI proxy.`,
+            setup: "setup/openai.md",
+        });
+    }
+    const remote = remoteMcpOf(manifest);
+    if (remote) {
+        const secret = remoteMcpSecretOf(remote.auth);
+        if (secret) {
+            const label = typeof manifest.name === "string" && manifest.name.trim()
+                ? manifest.name.trim()
+                : "the MCP server";
+            settings.push({
+                kind: "remote-mcp",
+                id: secret,
+                label: `${label} credential`,
+                holder: "gateway",
+                names: [secret],
+                alsoReads: [],
+                need: { kind: "required" },
+                why: `What ${label} expects: ${remoteMcpAuthLabel(remote.auth)}. The Gateway sends it to ${remote.url} and nowhere else.`,
+                setup: "setup/remote-mcp.md",
+            });
+        }
+    }
+    for (const entry of secretEntries(manifest)) {
+        settings.push(withNeed({
+            kind: "secret",
+            id: entry.name,
+            label: entry.name,
+            holder: "app",
+            names: [entry.name],
+            alsoReads: [],
+        }, entry));
+    }
+    for (const entry of settingEntries(manifest)) {
+        // A setting with a default is never unset for long: the deploy writes it.
+        const need = entry.default !== undefined ? { ...entry, optional: true } : entry;
+        settings.push({
+            ...withNeed({
+                kind: "setting",
+                id: entry.name,
+                label: entry.name,
+                holder: "app",
+                names: [entry.name],
+                alsoReads: [],
+            }, need),
+            value: settingValueRule(entry),
+        });
+    }
+    return settings;
+}
+/** Whether each name of `setting` is set: all → true, one unset → false, else unknown. */
+function settingIsSet(setting, isSet) {
+    const groupIsSet = (names) => {
+        let unknown = false;
+        for (const name of names) {
+            const state = isSet(setting.holder, name);
+            if (state === false)
+                return false;
+            if (state === null)
+                unknown = true;
+        }
+        return unknown ? null : true;
+    };
+    if (!setting.alternatives?.length)
+        return groupIsSet(setting.names);
+    // Any one provider configured makes the default serve; unknown only
+    // when no group is set and one couldn't be read.
+    let unknown = false;
+    for (const names of setting.alternatives) {
+        const state = groupIsSet(names);
+        if (state === true)
+            return true;
+        if (state === null)
+            unknown = true;
+    }
+    return unknown ? null : false;
+}
+/**
+ * Every setting against what is set. `isSet` answers per holder and name:
+ * true, false, or null when it can't tell (the registry never recorded
+ * the app Worker's secret names), which never blocks. An any-of group is
+ * met once any member is set; while none is and none is unknown, every
+ * member blocks.
+ */
+export function evaluateAppSettings(settings, isSet, options = {}) {
+    const evaluated = settings.map((setting) => {
+        const ready = options.readiness?.(setting);
+        return {
+            ...setting,
+            set: ready === undefined ? settingIsSet(setting, isSet) : ready,
+            blocking: false,
+        };
+    });
+    const groups = [];
+    for (const setting of evaluated) {
+        if (setting.need.kind !== "anyOf")
+            continue;
+        const group = setting.need.group;
+        let found = groups.find((each) => each.group === group);
+        if (!found) {
+            found = { group, members: [], met: false };
+            groups.push(found);
+        }
+        found.members.push(setting);
+    }
+    for (const group of groups) {
+        group.met = group.members.some((member) => member.set === true);
+        const unknown = group.members.some((member) => member.set === null);
+        if (!group.met && !unknown) {
+            for (const member of group.members)
+                member.blocking = true;
+        }
+    }
+    for (const setting of evaluated) {
+        if (setting.need.kind === "required" && setting.set === false) {
+            setting.blocking = true;
+        }
+    }
+    const unmet = evaluated.filter((setting) => setting.blocking);
+    return { ready: unmet.length === 0, settings: evaluated, groups, unmet };
+}
+/**
+ * What to run for an app that needs setup: `everyapp configure <app>`,
+ * which reads the app's manifest (from the registry, so it runs from
+ * anywhere), prompts for each unmet setting (one member of an any-of group
+ * is enough: it asks which) and sets them where they are held. Null when
+ * the app is ready. `cli` is how the operator runs everyapp (`pnpm
+ * everyapp` from a checkout). Scripts that set one name at a time use
+ * `everyapp secret set NAME [--app <id>]` instead.
+ *
+ * A provider app (`provider`: the gateway's own, with no Worker and no
+ * directory; `everyapp mcp on <id>`, an MCP app) has nothing to configure: its
+ * command is the `secret set` of its Gateway key (the first member of an
+ * unmet any-of group), as `mcp list` says it.
+ */
+export function setupCommand(report, { cli, appId, provider = false, }) {
+    if (report.unmet.length === 0)
+        return null;
+    if (!provider)
+        return { command: `${cli} configure ${appId}` };
+    const names = [];
+    const add = (setting) => {
+        for (const name of setting.names)
+            if (!names.includes(name))
+                names.push(name);
+    };
+    for (const setting of report.unmet) {
+        if (setting.need.kind === "required")
+            add(setting);
+    }
+    for (const group of report.groups) {
+        const first = group.members.find((member) => member.blocking);
+        if (first)
+            add(first);
+    }
+    return { command: `${cli} secret set ${names.join(" ")}` };
+}
+export function appSetupOf(report, options) {
+    const strip = ({ alsoReads: _alsoReads, ...setting }) => setting;
+    return {
+        ready: report.ready,
+        settings: report.settings.map(strip),
+        unmet: report.unmet.map(strip),
+        groups: report.groups.map((group) => ({
+            group: group.group,
+            met: group.met,
+            members: group.members.map((member) => member.id),
+        })),
+        command: options.withCommand === false ? null : setupCommand(report, options),
+    };
+}
+/** The provider registry's labels, for anything that names a provider to a person. */
+export function providerLabel(id, lookup = CATALOG) {
+    return lookup.get(id)?.label ?? id;
+}
+/** The capability `id` names in `lookup`, as an API-key provider, or undefined. */
+export function apiKeyCapabilityOf(id, lookup = CATALOG) {
+    const capability = lookup.get(id);
+    return capability?.mode === "api_key" ? capability : undefined;
+}

package/dist/internal/audit.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The audit log's shared reading of an event row: who did it, what it was
+ * about, and what the type means in plain words. Admin → Activity → Audit,
+ * `everyapp workspace audit` and `everyapp_workspace_audit` all show the
+ * same columns, so the three derive them here, from the stored `actor`
+ * and `data` (the catalogue's builders decide what those hold; the
+ * gateway's `summarize` writes the one-line summary from the same data).
+ * Nothing here reads a secret, a tool's arguments or result, or a mail
+ * body: the rows never hold one.
+ */
+import { type EventGroup, type EventTypeInfo } from "./events.js";
+/** Who caused an audit event, as every surface shows it. */
+export interface AuditActor {
+    /** `user`, `agent`, `app`, `operator`, `gateway`, or what the row says. */
+    kind: string;
+    /** The user id, the credential id (an agent), the app id, the operator's id; null for the gateway. */
+    id: string | null;
+    email: string | null;
+    /** A member's name, or the AI app's name for an agent. */
+    name: string | null;
+}
+/** What an audit event is about, picked from its `data` by the keys the catalogue uses. */
+export interface AuditSubject {
+    app?: {
+        id: string;
+        name: string | null;
+    };
+    user?: {
+        id: string;
+        email: string | null;
+        name: string | null;
+    };
+    group?: {
+        id: string;
+        name: string | null;
+    };
+    provider?: {
+        id: string;
+        name: string | null;
+    };
+    mcpApp?: {
+        id: string;
+        name: string | null;
+    };
+    subscription?: {
+        id: string;
+        name: string | null;
+    };
+    /** `member.invited`: whom. */
+    invitation?: {
+        email: string;
+        role: string | null;
+    };
+    /** Setting names an event lists (never a value): unmet, changed, added, removed. */
+    settings?: string[];
+    tool?: string;
+    /** The AI app of a connection or a blocked call. */
+    client?: string;
+    /** A personal access token's name. */
+    token?: string;
+}
+/** The stored `actor` (a JSON string or the parsed object) as the surfaces show it. */
+export declare function auditActorOf(actor: unknown): AuditActor;
+/**
+ * The Who cell: a person by name or email, "agent · Claude" for an AI
+ * client, "CLI · <operator>" for the operator's command line, "app · crm"
+ * for an app's own event, "Gateway" for what the gateway did by itself.
+ */
+export declare function auditActorLabel(actor: AuditActor): string;
+/** The plain-words label for a type: the catalogue's description, or "App event" for an app's own. */
+export declare function auditTypeLabel(type: string): string;
+/** What the event is about, from its stored `data`. */
+export declare function auditSubjectOf(type: string, data: unknown): AuditSubject;
+/** The Subject cell: the first thing the event is about, by name, then what else it names. */
+export declare function auditSubjectLabel(subject: AuditSubject): string;
+/**
+ * What the audit log leaves out unless asked for by type: `ping` (a test)
+ * and `tool.*` (the tool-calls view lists every call, blocked or not).
+ */
+export declare const AUDIT_DEFAULT_EXCLUDED: readonly string[];
+/**
+ * Whether an event of `type` is in the audit log's default view, or
+ * matches the type filter given (an exact type, or a prefix like
+ * `member.*`; `*` is everything, the excluded included).
+ */
+export declare function auditTypeMatches(type: string, filter: string | undefined): boolean;
+/** The SQL the filter translates to: `type = ?` or `type LIKE 'prefix.%'`; null for `*`. */
+export declare function auditTypeCondition(filter: string): {
+    op: "eq";
+    value: string;
+} | {
+    op: "prefix";
+    value: string;
+} | null;
+/** A type-filter value someone typed, cleaned, or null for none. */
+export declare function auditTypeFilterOf(value: unknown): string | undefined;
+export interface AuditTypeGroup {
+    group: EventGroup;
+    label: string;
+    /** `member.*` */
+    pattern: string;
+    types: EventTypeInfo[];
+}
+/** The groups' plain-words headings, as the Add-subscription dialog names them. */
+export declare const AUDIT_GROUP_LABELS: Partial<Record<EventGroup, string>>;
+/** The catalogue grouped for a type filter, in catalogue order, `ping` left out. */
+export declare function auditTypeGroups(types?: readonly EventTypeInfo[]): AuditTypeGroup[];
+//# sourceMappingURL=audit.d.ts.map

package/dist/internal/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/internal/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAML,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,2FAA2F;AAC3F,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC1C,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACjE,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC5C,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC/C,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7C,YAAY,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACnD,8BAA8B;IAC9B,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAoBD,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAgBvD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAezD;AAED,sGAAsG;AACtG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQnD;AAUD,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,YAAY,CA6CxE;AAED,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAoB/D;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAuB,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,OAAO,CAQT;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,GACb;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKtE;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAQD,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAWlE,CAAC;AAEF,oFAAoF;AACpF,wBAAgB,eAAe,CAC7B,KAAK,GAAE,SAAS,aAAa,EAAgB,GAC5C,cAAc,EAAE,CAgBlB"}