@every-app/sdk 0.3.0-rc.8 → 0.3.0

package/dist/internal/gatewaySettings.js

@@ -48,7 +48,6 @@ const PROVIDER_GATEWAY_SETTINGS = [
 ].filter((name) => !INSTALL_OWNED.has(name));
 /** The Gateway's own optional settings `everyapp secret set` changes: nothing a provider reads. */
 export const GATEWAY_OWN_SETTINGS = [
-    "AI_PROXY_EXTRA_ROUTES",
     // Email's providers: Cloudflare's REST token, Resend's key, the choice.
     "EMAIL_REST_API_TOKEN",
     "RESEND_API_KEY",
@@ -66,8 +65,6 @@ export const GATEWAY_OWN_SETTINGS = [
     "CLOUDFLARE_ACCESS_TEAM_DOMAIN",
     "CLOUDFLARE_ACCESS_AUD",
     "CLOUDFLARE_ACCESS_APPS_AUD",
-    "CLOUDFLARE_ACCESS_AUTO_JOIN_DOMAINS",
-    "CLOUDFLARE_ACCESS_OUTER_RING_AUTO_JOIN",
     "EMAIL_PASSWORD_SIGN_IN",
     // "false" keeps the hosted gateway's sign-up invite-only.
     "HOSTED_OPEN_SIGNUP",
@@ -75,7 +72,7 @@ export const GATEWAY_OWN_SETTINGS = [
     // gate, THIRD_PARTY_DEPLOYS, is never set from here: it is opened by
     // hand once the launch checks pass (docs/runbooks/hosted-install.md).
     "CF_DEPLOY_TOKEN",
-    // Self-hosted browser installs are on by default; "off" opts out.
+    // Self-hosted Gateway app installs: off unless exactly "on" (everyapp deploy-token add).
     "BROWSER_APP_INSTALLS",
     "DISPATCH_NAMESPACE",
     "THIRD_PARTY_DOMAIN",
@@ -94,25 +91,13 @@ export const SETTABLE_GATEWAY_SETTINGS = [
 ];
 const SETTABLE = new Set(SETTABLE_GATEWAY_SETTINGS);
 /**
- * The credential names of remote MCP apps (`everyapp mcp add <url>`,
- * ./remoteMcp.ts): `<ID>_MCP_TOKEN` by default, any name ending in
- * `_MCP_TOKEN` by choice. A family rather than a list, so the names a
- * registry row declares at run time route to the Gateway like the fixed
- * names (`everyapp secret set` reads no registry to decide), an app's own
- * secret can never take one (the manifest validator refuses the family),
- * and a remote server can never be given a fixed provider key.
- */
-export const REMOTE_MCP_SECRET_PATTERN = /^[A-Z][A-Z0-9_]*_MCP_TOKEN$/;
-/** Whether `name` is a remote MCP app's credential name (`TREG_MCP_TOKEN`). */
-export function isRemoteMcpSecretName(name) {
-    return REMOTE_MCP_SECRET_PATTERN.test(name);
-}
-/**
- * Whether `everyapp secret set <name>` changes the Gateway: one of the
- * fixed settings, or a remote MCP app's credential name.
+ * Whether `everyapp secret set <name>` changes the Gateway because the
+ * catalog or the Gateway itself reads it. A registered provider row's
+ * settings (a remote MCP app's `<APPID>_MCP_TOKEN` among them) are the
+ * registry's (`providerRegistry().settingNames()`), checked at run time.
  */
 export function isSettableGatewaySetting(name) {
-    return SETTABLE.has(name) || isRemoteMcpSecretName(name);
+    return SETTABLE.has(name);
 }
 /**
  * Settable Gateway settings whose value is a plain word, address, list
@@ -126,7 +111,6 @@ export const PLAIN_GATEWAY_SETTINGS = [
     "EMAIL_FROM_NAME",
     "EMAIL_PROVIDER",
     "EMAIL_PASSWORD_SIGN_IN",
-    "AI_PROXY_EXTRA_ROUTES",
     "MCP_OAUTH_ENABLED",
     "MCP_DCR_ENABLED",
     "MCP_ALLOWED_ORIGINS",
@@ -137,8 +121,6 @@ export const PLAIN_GATEWAY_SETTINGS = [
     "CLOUDFLARE_ACCESS_TEAM_DOMAIN",
     "CLOUDFLARE_ACCESS_AUD",
     "CLOUDFLARE_ACCESS_APPS_AUD",
-    "CLOUDFLARE_ACCESS_AUTO_JOIN_DOMAINS",
-    "CLOUDFLARE_ACCESS_OUTER_RING_AUTO_JOIN",
     "HOSTED_OPEN_SIGNUP",
     "BROWSER_APP_INSTALLS",
     "DISPATCH_NAMESPACE",

package/dist/internal/index.d.ts

@@ -18,6 +18,7 @@ export * from "./audit.js";
 export * from "./providerSpec.js";
 export * from "./providerRegistry.js";
 export * from "./remoteMcp.js";
+export * from "./mcpOAuth.js";
 export * from "./signInProviders.js";
 export * from "./devProviders.js";
 export { ConfigurationError, IdentityError, assertOrganizationPin, getIdentityFromRequest, parsePublicKeys, resolveVerifyOptions, verifyIdentity, verifyIdentityJwt, verifyPublicMarkerJwt, verifySystemJwt, type IdentityResult, type RequestIdentityOptions, type VerifiedIdentity, type VerifyOptions, } from "./identity.js";

package/dist/internal/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/internal/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/internal/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC"}

package/dist/internal/index.js

@@ -18,6 +18,7 @@ export * from "./audit.js";
 export * from "./providerSpec.js";
 export * from "./providerRegistry.js";
 export * from "./remoteMcp.js";
+export * from "./mcpOAuth.js";
 export * from "./signInProviders.js";
 export * from "./devProviders.js";
 export { ConfigurationError, IdentityError, assertOrganizationPin, getIdentityFromRequest, parsePublicKeys, resolveVerifyOptions, verifyIdentity, verifyIdentityJwt, verifyPublicMarkerJwt, verifySystemJwt, } from "./identity.js";

package/dist/internal/mcpOAuth.d.ts

@@ -0,0 +1,210 @@
+/**
+ * OAuth to remote MCP servers (docs/design/2026-11-mcp-apps-auth.md, the
+ * MCP authorization spec): discovering a server's authorization server,
+ * registering a client with it, and the provider specs `everyapp mcp add`
+ * and the Gateway's "Add an MCP server" write for an app's own credential
+ * (`<appId>-mcp`, ./remoteMcp.ts). Pure apart from the injected `fetch`:
+ * the CLI runs it from the operator's machine, the Gateway in-process.
+ *
+ * Every fetch here is bounded the same way: https only, a public host
+ * (`publicHostProblem`, and no IP literal), the default port, no redirects
+ * followed (`redirect: "manual"`; a 3xx is a failure), at most
+ * {@link MCP_OAUTH_MAX_BODY} bytes of answer and {@link MCP_OAUTH_TIMEOUT_MS}
+ * per request. Nothing fetched here ever carries a credential except the
+ * registration request, which carries none either (RFC 7591's open
+ * registration).
+ *
+ * A client: the one the server registers for this Gateway (RFC 7591 DCR),
+ * else, for a server that registers none but takes OAuth client ID
+ * metadata documents (CIMD, `client_id_metadata_document_supported`), the
+ * URL of the document the Gateway serves about itself as the client id: a
+ * public client (PKCE, no secret) whose one redirect URI is the Gateway's
+ * callback for that app.
+ *
+ * Discovery (RFC 9728, then RFC 8414 / OpenID discovery):
+ *  1. the protected resource metadata: `resourceMetadataUrl` (the 401's
+ *     `resource_metadata`) when given, else
+ *     `<origin>/.well-known/oauth-protected-resource<path>`, then
+ *     `<origin>/.well-known/oauth-protected-resource`. Its `resource` must
+ *     be the MCP URL or a path prefix of it on the same origin;
+ *     `authorization_servers[0]` is the issuer.
+ *  2. the issuer's metadata: `/.well-known/oauth-authorization-server`
+ *     path-inserted, then `/.well-known/openid-configuration` path-inserted
+ *     and path-appended. `issuer` must be the one asked for; PKCE S256
+ *     must be supported.
+ *  3. a server without resource metadata (the 2025-03-26 spec): the
+ *     authorization server metadata at the MCP URL's origin.
+ */
+import type { OAuthClientInjection } from "./capabilities.js";
+import { type RemoteMcpStaticKind } from "./remoteMcp.js";
+/** The largest answer a discovery or registration fetch reads: 64 KiB. */
+export declare const MCP_OAUTH_MAX_BODY: number;
+/** How long one discovery or registration fetch may take. */
+export declare const MCP_OAUTH_TIMEOUT_MS = 10000;
+/** The fetch this module is given (the global one, or a test's). */
+export type McpOAuthFetch = (input: string, init: RequestInit) => Promise<Response>;
+/** What a `WWW-Authenticate: Bearer …` challenge says (RFC 6750, RFC 9728 section 5.1). */
+export interface McpBearerChallenge {
+    /** `resource_metadata`: where the protected resource metadata is. */
+    resourceMetadata?: string;
+    /** `scope`: the scopes the server wants for the request, space-separated. */
+    scope?: string;
+    /** `error`: `invalid_token`, `insufficient_scope`, … */
+    error?: string;
+}
+/**
+ * The Bearer challenge of a `WWW-Authenticate` header, or null when the
+ * header carries none. Reads several challenges in one header
+ * (`Basic realm="x", Bearer resource_metadata="…"`), quoted and bare
+ * values, and parameter names in any case.
+ */
+export declare function parseWwwAuthenticate(header: string | null | undefined): McpBearerChallenge | null;
+/** What discovery found: everything the synthesized OAuth row needs. */
+export interface McpOAuthDiscovery {
+    /** The protected resource (RFC 8707 `resource`): the metadata's `resource`, or the MCP URL for a server without metadata. */
+    resource: string;
+    /** The authorization server's issuer, as its metadata spells it (what `iss` must equal). */
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    registrationEndpoint?: string;
+    revocationEndpoint?: string;
+    /** The scopes to ask for: the challenge's `scope`, else the resource's `scopes_supported`, else none. */
+    scopes: string[];
+    /** The resource's `scopes_supported`, every one a token may carry. */
+    supportedScopes?: string[];
+    /** `token_endpoint_auth_methods_supported`, `["client_secret_basic"]` when the server says nothing (RFC 8414's default). */
+    tokenEndpointAuthMethods: string[];
+    /** Whether the server had protected resource metadata (false: the 2025-03-26 fallback). */
+    resourceMetadata: boolean;
+    /** Whether the authorization server takes a client metadata document's URL as a client id (CIMD). */
+    clientIdMetadataDocument?: boolean;
+}
+export type McpOAuthDiscoveryResult = {
+    ok: true;
+    discovery: McpOAuthDiscovery;
+} | {
+    ok: false;
+    problem: string;
+};
+/** Why `url` can't be fetched by discovery, or null when it can. */
+export declare function mcpOAuthUrlProblem(url: string, { query }?: {
+    query?: boolean;
+}): string | null;
+/**
+ * Find how `url`'s MCP server takes OAuth: its protected resource, its
+ * authorization server, the endpoints, the scopes to ask for and the
+ * client authentication it accepts. Refuses (with the reason) anything
+ * the Gateway would not run: no PKCE S256, a resource that isn't this
+ * server, metadata naming another issuer, an endpoint off https or on a
+ * private host, a redirect anywhere.
+ */
+export declare function discoverMcpOAuth(input: {
+    url: string;
+    fetch: McpOAuthFetch;
+    /** The 401's `resource_metadata` ({@link parseWwwAuthenticate}). */
+    resourceMetadataUrl?: string | null;
+    /** The 401's `scope`, asked for ahead of `scopes_supported`. */
+    scope?: string | null;
+}): Promise<McpOAuthDiscoveryResult>;
+export type McpClientRegistration = {
+    ok: true;
+    clientId: string;
+    clientSecret?: string;
+    /** Where the client goes on the token request: HTTP Basic, or the form body. */
+    inject: OAuthClientInjection;
+    /** The method the server registered (`client_secret_basic`, `client_secret_post`, `none`). */
+    authMethod: string;
+} | {
+    ok: false;
+    problem: string;
+    /** The server offers no registration endpoint: a client must be pasted. */
+    unsupported?: boolean;
+};
+/** The token endpoint auth method to ask for: Basic when offered, else the form, else a public client. */
+export declare function chooseTokenEndpointAuthMethod(supported: readonly string[]): "client_secret_basic" | "client_secret_post" | "none" | null;
+/**
+ * Register a client with the server's authorization server (RFC 7591
+ * dynamic client registration): the Gateway's callback as the one
+ * redirect URI, the authorization-code and refresh grants, and the token
+ * endpoint auth method {@link chooseTokenEndpointAuthMethod} picks. Reads
+ * back what the server registered: its method decides `inject`.
+ */
+export declare function registerMcpClient(input: {
+    discovery: McpOAuthDiscovery;
+    redirectUri: string;
+    clientName: string;
+    fetch: McpOAuthFetch;
+}): Promise<McpClientRegistration>;
+/**
+ * The client metadata document the Gateway serves at `clientId` (CIMD):
+ * a public client (`token_endpoint_auth_method: none`, so PKCE is its
+ * proof) with the Gateway's callback for the app as its one redirect URI.
+ */
+export declare function mcpClientMetadataDocument(input: {
+    clientId: string;
+    redirectUri: string;
+    clientName: string;
+    clientUri: string;
+}): Record<string, unknown>;
+/**
+ * A client for the Gateway at the server: the one it registers (RFC 7591),
+ * else, when it registers none, the Gateway's client metadata document's
+ * URL (`documentUrl`, null for a Gateway not on https) where the server
+ * takes CIMD and public clients. `unsupported` when neither can be had: a
+ * client must be registered by hand and pasted.
+ */
+export declare function obtainMcpClient(input: {
+    discovery: McpOAuthDiscovery;
+    redirectUri: string;
+    clientName: string;
+    documentUrl: string | null;
+    fetch: McpOAuthFetch;
+}): Promise<McpClientRegistration & {
+    via?: "dcr" | "cimd";
+}>;
+/** A built spec, checked by `parseProviderSpec`, or why it can't be. */
+export type McpProviderSpecResult = {
+    ok: true;
+    id: string;
+    spec: Record<string, unknown>;
+} | {
+    ok: false;
+    problem: string;
+};
+/**
+ * The `oauth2-user` spec of an app's own OAuth row (`<appId>-mcp`): the
+ * MCP URL's host as its one API host (the token goes there and nowhere
+ * else), the discovered endpoints, the client in `<APPID>_MCP_CLIENT_ID`
+ * (and `_SECRET` for a confidential client), PKCE, the `resource` and
+ * `issuer`. The scopes the connect asks for are the app's (its manifest's
+ * entry, from discovery); the ones the server says it supports are
+ * tolerated on a token.
+ */
+export declare function mcpOAuthProviderSpec(input: {
+    appId: string;
+    name: string;
+    url: string;
+    discovery: McpOAuthDiscovery;
+    client: {
+        hasSecret: boolean;
+        inject: OAuthClientInjection;
+    };
+}): McpProviderSpecResult;
+/**
+ * The API-key spec of an app's own static credential (`<appId>-mcp`): the
+ * MCP URL's host as its one host, the value in `<APPID>_MCP_TOKEN`, placed
+ * as `kind` says: `Authorization: Bearer` (or `<prefix>` as the scheme),
+ * a header (`header`, `prefix`), a query parameter (`param`), or HTTP
+ * Basic with the value as `user:password`.
+ */
+export declare function mcpStaticProviderSpec(input: {
+    appId: string;
+    name: string;
+    url: string;
+    kind: RemoteMcpStaticKind;
+    header?: string | null;
+    prefix?: string | null;
+    param?: string | null;
+}): McpProviderSpecResult;
+//# sourceMappingURL=mcpOAuth.d.ts.map

package/dist/internal/mcpOAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpOAuth.d.ts","sourceRoot":"","sources":["../../src/internal/mcpOAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAExB,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,QAAY,CAAC;AAC5C,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,KACd,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,kBAAkB,GAAG,IAAI,CA6D3B;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,6HAA6H;IAC7H,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yGAAyG;IACzG,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,4HAA4H;IAC5H,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,2FAA2F;IAC3F,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qGAAqG;IACrG,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,iBAAiB,CAAA;CAAE,GAC1C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC,oEAAoE;AACpE,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,EAAE,KAAY,EAAE,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,MAAM,GAAG,IAAI,CAwBf;AA4OD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,aAAa,CAAC;IACrB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwHnC;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,MAAM,EAAE,oBAAoB,CAAC;IAC7B,8FAA8F;IAC9F,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEN,0GAA0G;AAC1G,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAK9D;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAuEjC;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAU1B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,aAAa,CAAC;CACtB,GAAG,OAAO,CAAC,qBAAqB,GAAG;IAAE,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;CAAE,CAAC,CA2B5D;AAED,wEAAwE;AACxE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACvD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAyCnC;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC;CAC9D,GAAG,qBAAqB,CAqCxB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,qBAAqB,CA0DxB"}