@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.11

package/dist/internal/oauthPresets.js

@@ -0,0 +1,253 @@
+/**
+ * OAuth presets: ready `oauth2-user` specs, in the JSON shape `everyapp
+ * provider add` takes, for providers people most often want a "Connect"
+ * button for. A preset becomes a `providers` row when added (`everyapp
+ * provider add --oauth github-oauth`, the Admin dialog,
+ * `everyapp_provider_add` with `preset`), so an operator may `provider
+ * show` and edit a copy; nothing here is a hidden catalog entry, and no
+ * gateway reserves a preset's setting names until it is added. Google,
+ * Microsoft and Slack are built in (./oauthBuiltIns.ts) and are offered
+ * in the same picker.
+ *
+ * Each preset parses with `parseProviderSpec` (oauthPresets.test.ts) and
+ * names a console where the client is made, the API hosts the token is
+ * sent to, and how the provider spells scopes. Which scopes a connection
+ * holds is each app's `everyapp.config.ts`, never the preset. Endpoints
+ * were checked against the providers' docs on 2026-10-25; only GitHub's
+ * and Google's have been tried against a live connect.
+ */
+import { parseProviderSpec, } from "./providerSpec.js";
+export const OAUTH_PRESETS = {
+    "github-oauth": {
+        id: "github-oauth",
+        name: "GitHub",
+        description: "Repositories, issues, pull requests and the person's profile.",
+        docs: "https://github.com/settings/developers",
+        api: "https://docs.github.com/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps",
+        hosts: ["api.github.com"],
+        auth: {
+            kind: "oauth2-user",
+            authorizeUrl: "https://github.com/login/oauth/authorize",
+            tokenUrl: "https://github.com/login/oauth/access_token",
+            revokeUrl: "https://api.github.com/applications/{client_id}/grant",
+            revokeMethod: "DELETE",
+            clientId: "GITHUB_OAUTH_CLIENT_ID",
+            clientSecret: "GITHUB_OAUTH_CLIENT_SECRET",
+            inject: "form",
+            pkce: true,
+            scopeSeparator: "comma",
+            tokenHeaders: { Accept: "application/json" },
+            // GET /user answers with the public profile under any token.
+            identity: {
+                url: "https://api.github.com/user",
+                label: "login",
+                id: "id",
+            },
+        },
+        hint: "Register an OAuth App (not a GitHub App) and paste its client id and secret. GitHub's `repo` scope is read and write.",
+    },
+    "notion-oauth": {
+        id: "notion-oauth",
+        name: "Notion",
+        description: "Pages and databases the person shares with the integration.",
+        docs: "https://www.notion.so/my-integrations",
+        api: "https://developers.notion.com/reference",
+        hosts: ["api.notion.com"],
+        auth: {
+            kind: "oauth2-user",
+            authorizeUrl: "https://api.notion.com/v1/oauth/authorize",
+            tokenUrl: "https://api.notion.com/v1/oauth/token",
+            clientId: "NOTION_OAUTH_CLIENT_ID",
+            clientSecret: "NOTION_OAUTH_CLIENT_SECRET",
+            inject: "basic",
+            pkce: false,
+            scopeSeparator: "space",
+            authorizeParams: { owner: "user" },
+        },
+        hint: "Notion has no scopes: an app lists scopes: [] and the person picks the pages to share on Notion's consent screen. Make the integration public to get a client id and secret. Apps send `Notion-Version` on every call.",
+    },
+    "linear-oauth": {
+        id: "linear-oauth",
+        name: "Linear",
+        description: "Issues, projects and teams, over Linear's GraphQL API.",
+        docs: "https://linear.app/settings/api/applications",
+        api: "https://developers.linear.app/docs/oauth/authentication",
+        hosts: ["api.linear.app"],
+        auth: {
+            kind: "oauth2-user",
+            authorizeUrl: "https://linear.app/oauth/authorize",
+            tokenUrl: "https://api.linear.app/oauth/token",
+            revokeUrl: "https://api.linear.app/oauth/revoke",
+            clientId: "LINEAR_OAUTH_CLIENT_ID",
+            clientSecret: "LINEAR_OAUTH_CLIENT_SECRET",
+            inject: "form",
+            pkce: false,
+            scopeSeparator: "comma",
+        },
+        hint: "Linear's scopes are read, write, issues:create and comments:create; its API is GraphQL over POST.",
+    },
+    "gitlab-oauth": {
+        id: "gitlab-oauth",
+        name: "GitLab",
+        description: "Projects, merge requests and issues on gitlab.com.",
+        docs: "https://gitlab.com/-/user_settings/applications",
+        api: "https://docs.gitlab.com/integration/oauth_provider/#view-all-authorized-applications",
+        hosts: ["gitlab.com"],
+        auth: {
+            kind: "oauth2-user",
+            authorizeUrl: "https://gitlab.com/oauth/authorize",
+            tokenUrl: "https://gitlab.com/oauth/token",
+            revokeUrl: "https://gitlab.com/oauth/revoke",
+            clientId: "GITLAB_OAUTH_CLIENT_ID",
+            clientSecret: "GITLAB_OAUTH_CLIENT_SECRET",
+            inject: "form",
+            pkce: true,
+            scopeSeparator: "space",
+            identity: {
+                url: "https://gitlab.com/api/v4/user",
+                label: "username",
+                id: "id",
+                scopes: ["read_user"],
+            },
+        },
+        hint: "A self-managed GitLab needs a custom provider with its own host in place of gitlab.com.",
+    },
+    atlassian: {
+        id: "atlassian",
+        name: "Atlassian (Jira and Confluence)",
+        description: "Jira issues and Confluence pages on the sites the person grants.",
+        docs: "https://developer.atlassian.com/console/myapps/",
+        api: "https://developer.atlassian.com/cloud/jira/platform/scopes-for-oauth-2-3LO-and-forge-apps/",
+        hosts: ["api.atlassian.com"],
+        auth: {
+            kind: "oauth2-user",
+            authorizeUrl: "https://auth.atlassian.com/authorize",
+            tokenUrl: "https://auth.atlassian.com/oauth/token",
+            clientId: "ATLASSIAN_CLIENT_ID",
+            clientSecret: "ATLASSIAN_CLIENT_SECRET",
+            inject: "form",
+            pkce: false,
+            scopeSeparator: "space",
+            authorizeParams: { audience: "api.atlassian.com", prompt: "consent" },
+            identity: {
+                url: "https://api.atlassian.com/me",
+                label: "email",
+                id: "account_id",
+                // `offline_access` is what yields a refresh token.
+                scopes: ["read:me", "offline_access"],
+            },
+        },
+        hint: "Calls go to api.atlassian.com/ex/jira/<cloud id>/… ; the cloud id comes from /oauth/token/accessible-resources.",
+    },
+    "hubspot-oauth": {
+        id: "hubspot-oauth",
+        name: "HubSpot",
+        description: "CRM contacts, companies and deals.",
+        docs: "https://developers.hubspot.com/",
+        api: "https://developers.hubspot.com/docs/api/working-with-oauth",
+        hosts: ["api.hubapi.com"],
+        auth: {
+            kind: "oauth2-user",
+            authorizeUrl: "https://app.hubspot.com/oauth/authorize",
+            tokenUrl: "https://api.hubapi.com/oauth/v1/token",
+            clientId: "HUBSPOT_OAUTH_CLIENT_ID",
+            clientSecret: "HUBSPOT_OAUTH_CLIENT_SECRET",
+            inject: "form",
+            pkce: false,
+            scopeSeparator: "space",
+        },
+        hint: "The app's scopes in HubSpot's developer console must include the scopes apps list, or HubSpot refuses the authorize URL.",
+    },
+    zoom: {
+        id: "zoom",
+        name: "Zoom",
+        description: "The person's meetings and recordings.",
+        docs: "https://marketplace.zoom.us/develop/create",
+        api: "https://developers.zoom.us/docs/integrations/oauth-scopes-overview/",
+        hosts: ["api.zoom.us"],
+        auth: {
+            kind: "oauth2-user",
+            authorizeUrl: "https://zoom.us/oauth/authorize",
+            tokenUrl: "https://zoom.us/oauth/token",
+            revokeUrl: "https://zoom.us/oauth/revoke",
+            clientId: "ZOOM_CLIENT_ID",
+            clientSecret: "ZOOM_CLIENT_SECRET",
+            inject: "basic",
+            pkce: true,
+            scopeSeparator: "space",
+            identity: {
+                url: "https://api.zoom.us/v2/users/me",
+                label: "email",
+                id: "id",
+                scopes: ["user:read:user"],
+            },
+        },
+        hint: "A General app with user-managed OAuth, using Zoom's granular scope names.",
+    },
+    dropbox: {
+        id: "dropbox",
+        name: "Dropbox",
+        description: "Files and folders in the person's Dropbox.",
+        docs: "https://www.dropbox.com/developers/apps",
+        api: "https://developers.dropbox.com/oauth-guide",
+        hosts: ["api.dropboxapi.com", "content.dropboxapi.com"],
+        auth: {
+            kind: "oauth2-user",
+            authorizeUrl: "https://www.dropbox.com/oauth2/authorize",
+            tokenUrl: "https://api.dropboxapi.com/oauth2/token",
+            revokeUrl: "https://api.dropboxapi.com/2/auth/token/revoke",
+            clientId: "DROPBOX_OAUTH_CLIENT_ID",
+            clientSecret: "DROPBOX_OAUTH_CLIENT_SECRET",
+            inject: "form",
+            pkce: true,
+            scopeSeparator: "space",
+            authorizeParams: { token_access_type: "offline" },
+            // Dropbox grants account_info.read to every app.
+            tolerated: ["account_info.read"],
+        },
+        hint: "`token_access_type=offline` is what yields a refresh token.",
+    },
+    spotify: {
+        id: "spotify",
+        name: "Spotify",
+        description: "The person's library, playlists and listening.",
+        docs: "https://developer.spotify.com/dashboard",
+        api: "https://developer.spotify.com/documentation/web-api/concepts/scopes",
+        hosts: ["api.spotify.com"],
+        auth: {
+            kind: "oauth2-user",
+            authorizeUrl: "https://accounts.spotify.com/authorize",
+            tokenUrl: "https://accounts.spotify.com/api/token",
+            clientId: "SPOTIFY_CLIENT_ID",
+            clientSecret: "SPOTIFY_CLIENT_SECRET",
+            inject: "basic",
+            pkce: true,
+            scopeSeparator: "space",
+            // GET /v1/me names the account under any token.
+            identity: {
+                url: "https://api.spotify.com/v1/me",
+                label: "display_name",
+                id: "id",
+            },
+        },
+    },
+};
+/** The preset ids, in the order the picker shows them. */
+export function oauthPresetIds() {
+    return Object.keys(OAUTH_PRESETS);
+}
+/** A preset's parsed capability, for the picker's labels; throws for an unknown id (the test parses every preset). */
+export function oauthPreset(id) {
+    const spec = OAUTH_PRESETS[id];
+    if (!spec)
+        return null;
+    const parsed = parseProviderSpec(spec);
+    if (!parsed.ok) {
+        throw new Error(`preset ${id} doesn't parse: ${JSON.stringify(parsed.problems)}`);
+    }
+    return parsed.capability;
+}
+/** Whether `capability` is an OAuth provider the Gateway runs the flow for. */
+export function isOAuthProvider(capability) {
+    return capability?.mode === "oauth_client" && capability.flow !== undefined;
+}

package/dist/internal/oauthScopes.d.ts

@@ -1,117 +1,60 @@
 /**
- * Scope sets for an `oauth_client` capability with a `scopePolicy`
- * (docs/capabilities.md "OAuth clients"): what an app's manifest entry
- * declares, what that lets the app ask the provider for, how each provider
- * spells what it granted, and which API routes a set unlocks. Pure
- * functions over the registry, shared by the gateway's token-endpoint
- * check, the SDK's local-dev twin of it and, later, the proxy and the
- * outbound Worker. Nothing here reads a secret or a token value.
- */
-import type { OAuthScopePolicy } from "./capabilities.js";
-import type { TokenRequest } from "./oauthClient.js";
-/** Scopes by the token they belong to: the bot or only token, and Slack's user token. */
-export interface ScopeList {
-    scopes: string[];
-    userScopes: string[];
-}
-/** What a token response says it granted; a field is present when that kind of token is. */
-export interface GrantedScopes {
-    scopes?: string[];
-    userScopes?: string[];
-}
-/**
- * The scope set names a manifest entry declares, or null when the entry
- * voids its grant: `scopes` missing, not an array, empty, a non-string
- * element, a name listed twice, or any name the policy doesn't offer. An
- * unknown name voids the whole grant rather than narrowing it silently, so
- * a newer CLI's set name reaching an older gateway is refused outright and
- * a message can say so.
- */
-export declare function declaredScopeSets(policy: OAuthScopePolicy, entry: {
-    scopes?: unknown;
-} | undefined): string[] | null;
-/**
- * What an app with `sets` asks the provider for: the sets' scopes in
- * registry order, deduplicated, then `alwaysRequested`. The status hands
- * these out and the authorize URL (Microsoft: the token leg too) carries
- * them verbatim.
- */
-export declare function requestedScopes(policy: OAuthScopePolicy, sets: readonly string[]): ScopeList;
-/**
- * What a token an app with `sets` is handed may carry: the requested
- * scopes and the tolerated ones, in the dialect's canonical spelling so a
- * granted list canonicalised the same way compares exactly.
- */
-export declare function allowedScopes(policy: OAuthScopePolicy, sets: readonly string[]): ScopeList;
-/**
- * Whether a token response body carries a token: an access, refresh or ID
- * token, or Slack's user token under `authed_user`. A 2xx without one
- * (Slack's `ok: false`) is an error the app must see, not a grant.
+ * Scopes for an OAuth provider the Gateway runs the flow for: what a
+ * connect asks for, what a token response says it granted, whether that
+ * is more than was asked, and whether a connection holds what an app
+ * declares. One set of rules for every provider, driven by its spec
+ * (./oauthSpec.ts): the separator, the prefix, the identity scopes and
+ * the tolerated ones. Nothing here names a provider, reads a secret or a
+ * token value.
+ *
+ * An app's `everyapp.config.ts` lists the provider's own scope strings,
+ * short (`gmail.modify`, joined onto the spec's `scopePrefix`) or in
+ * full. Comparison is of the canonical form: percent-decoded, lower case,
+ * the prefix taken off.
  */
-export declare function carriesToken(json: unknown): boolean;
+import type { OAuthFlow } from "./capabilities.js";
+/** The scope rules of a provider's flow. */
+type ScopeRules = Pick<OAuthFlow, "scopeSeparator" | "scopePrefix" | "identityScopes" | "tolerated">;
 /**
- * The scopes a token response says it granted, canonicalised per dialect,
- * or null when the answer names none for a token it carries, which fails
- * closed: every documented success response of the three providers names
- * them (map-providers: Google and Microsoft `scope`, Slack `scope` and
- * `authed_user.scope`), so a missing field is an answer the gateway can't
- * hold to anything.
+ * A scope as the provider is asked for it: an app's short scope joined
+ * onto the spec's prefix; a full one (with `://`), one of the spec's own
+ * identity or tolerated scopes, or any scope of a provider without a
+ * prefix, as written.
  */
-export declare function grantedScopes(policy: OAuthScopePolicy, json: unknown): GrantedScopes | null;
+export declare function expandScope(rules: ScopeRules, scope: string): string;
+/** A scope in the one spelling comparisons use: decoded, lower case, without the prefix. */
+export declare function canonicalScope(rules: ScopeRules, scope: string): string;
+/** `scopes` canonical, deduplicated, order kept. */
+export declare function canonicalScopes(rules: ScopeRules, scopes: readonly string[]): string[];
 /**
- * What `granted` carries beyond `allowed`, per token kind, for a refusal's
- * message and log line: the user token's extras as `user:<scope>`. Both
- * lists are in the dialect's canonical spelling already.
+ * What a connect for an app that declares `declared` asks the provider
+ * for, in the provider's spelling: the app's scopes, then the spec's
+ * identity scopes, each once.
  */
-export declare function scopeExcess(granted: GrantedScopes, allowed: ScopeList): string[];
+export declare function requestedScopes(rules: ScopeRules, declared: readonly string[]): string[];
+/** Scopes joined as the provider's `scope` parameter takes them. */
+export declare function joinScopes(rules: Pick<OAuthFlow, "scopeSeparator">, scopes: readonly string[]): string;
 /**
- * The scopes a token request itself asks for (`scope`, and Slack's
- * `user_scope`, in any case) in its form or JSON body, canonicalised per
- * dialect for comparison with `allowedScopes()`, or null when the body
- * names none. The query string is never read: the gateway refuses a
- * request that puts these there, so only one place decides.
+ * The scopes a token response says it granted, canonical. A response
+ * with no `scope` field is taken as granted exactly as `requested` (RFC
+ * 6749 §5.1); one whose `scope` isn't a string is null (refused).
  */
-export declare function requestedTokenScopes(policy: OAuthScopePolicy, request: TokenRequest): GrantedScopes | null;
+export declare function grantedScopes(rules: ScopeRules, body: Record<string, unknown>, requested: readonly string[]): string[] | null;
 /**
- * `request` with its `scope`, in any case, as the policy's `requestScope`
- * says: replaced by the requested list of the app's `sets`, dropped, or
- * kept as sent. A separate step after `injectClientCredentials()`, whose
- * re-serialised form or JSON body this edits the same way; any other body
- * is left alone.
+ * The mint check: what `granted` (canonical) carries beyond `requested`,
+ * the identity scopes and the tolerated ones. Empty means the token may
+ * be kept; anything else and the Gateway drops it.
  */
-export declare function rewriteTokenRequestScope(policy: OAuthScopePolicy, sets: readonly string[], request: TokenRequest): TokenRequest;
+export declare function scopeExcess(rules: ScopeRules, granted: readonly string[], requested: readonly string[]): string[];
 /**
- * The declared set that unlocks `method upstream`, or null. Not wired to
- * any live path yet: it becomes the proxy's boundary once the gateway
- * holds tokens, and the outbound Worker's for dispatched apps before that.
- *
- * In order: https only; the host must be on one of the declared sets'
- * routes; the raw pathname is refused when it holds `\`, `//` or `%00`;
- * each raw segment, and each percent-decoding of it while a `%` remains
- * (a provider's layers may each decode once), is refused when it won't
- * decode, holds a control or format character or a backslash, is one of
- * the policy's denied segments in any case, or splits on `/` into a dot
- * segment: `.` or `..`, with or without a `;` parameter (`..;x`), which
- * Google's front end resolves like the bare one. The denied comparison is
- * of the whole segment, because an encoded slash is part of one id to the
- * provider, never a separator: a Search Console site URL whose own path
- * holds `batch` stays matchable, and `2%2FmeasurementProtocolSecrets` is
- * a data stream id that doesn't exist, not the secrets. Then the raw
- * pathname, case preserved, is matched: GET and HEAD need a `paths` entry
- * (exact, or a prefix when it ends in `/`), POST needs a `posts` pattern,
- * and no other method goes through. Matching the raw path is what lets
- * Search Console's `sites/https%3A%2F%2Fexample.com%2F/searchAnalytics/query`
- * match `[^/]+` while `..`, batch tunnels and secrets stay refused however
- * encoded. `X-HTTP-Method-Override`, `access_token` and `token` parameters
- * are the proxy's to strip before it asks; nothing here reads them. The
- * proxy fetches with `redirect: "manual"`: Google answers a dot segment it
- * resolves with a 302 to the resolved path, and following one would carry
- * the token to a path this never matched.
+ * The scopes an app declares that a connection doesn't hold: `held` is
+ * the connection's canonical list, `declared` as the app wrote them.
  */
-export declare function scopeRouteAllows(policy: OAuthScopePolicy, sets: readonly string[], method: string, upstream: URL): string | null;
+export declare function missingScopes(rules: ScopeRules, held: readonly string[], declared: readonly string[]): string[];
 /**
  * `text` as a JSON object, or null for anything else (an array, a scalar,
- * not JSON). Shared with the gateway's read of a provider's token answer.
+ * not JSON). The gateway's read of a provider's token answer.
  */
 export declare function jsonObject(text: string): Record<string, unknown> | null;
+export {};
 //# sourceMappingURL=oauthScopes.d.ts.map

package/dist/internal/oauthScopes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthScopes.d.ts","sourceRoot":"","sources":["../../src/internal/oauthScopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAEV,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,yFAAyF;AACzF,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,4FAA4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GACtC,MAAM,EAAE,GAAG,IAAI,CAejB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,SAAS,CASX;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,SAAS,CASX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CASnD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,OAAO,GACZ,aAAa,GAAG,IAAI,CA6BtB;AA+BD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,SAAS,GACjB,MAAM,EAAE,CASV;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,YAAY,GACpB,aAAa,GAAG,IAAI,CAStB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,YAAY,GACpB,YAAY,CA+Bd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,GAAG,GACZ,MAAM,GAAG,IAAI,CAsBf;AAwJD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMvE"}
+{"version":3,"file":"oauthScopes.d.ts","sourceRoot":"","sources":["../../src/internal/oauthScopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,4CAA4C;AAC5C,KAAK,UAAU,GAAG,IAAI,CACpB,SAAS,EACT,gBAAgB,GAAG,aAAa,GAAG,gBAAgB,GAAG,WAAW,CAClE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvE;AAED,oDAAoD;AACpD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,MAAM,EAAE,CAOV;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,EAAE,CASV;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CACxB,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACxC,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,MAAM,EAAE,GAAG,IAAI,CAejB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,MAAM,EAAE,CAOV;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,EAAE,CAKV;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CASvE"}