@forklaunch/core 3.2.1 → 3.4.0

package/bin/gateway-mock/routes/payments-context.mjs

@@ -0,0 +1,260 @@
+// Mirrors companion managed-apps/domain/services/payments-context.ts; tested by source conformance.
+/** Read-only scoped protocol; never authorizes provider financial mutations. */
+import { createHmac, timingSafeEqual } from "node:crypto";
+export class PaymentContextError extends Error {
+    constructor() {
+        super("Payment context is unavailable or no longer matches");
+    }
+}
+function deny() {
+    throw new PaymentContextError();
+}
+const id = (v, prefix) => typeof v === "string" &&
+    v.length <= 128 &&
+    new RegExp(`^${prefix}[A-Za-z0-9_]+$`).test(v);
+const uuid = (v) => typeof v === "string" &&
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);
+const apiVersion = (v) => typeof v === "string" && /^\d{4}-\d{2}-\d{2}(?:\.[a-z]+)?$/.test(v);
+/** One immutable credential/base configuration, shared safely across requests. */
+export class PaymentsContextProtocol {
+    forward;
+    now;
+    signingKey;
+    constructor(secret, base, forward, now = Date.now) {
+        this.forward = forward;
+        this.now = now;
+        if (!secret.trim() || secret.length > 4096)
+            deny();
+        let url;
+        try {
+            url = new URL(base);
+        }
+        catch {
+            deny();
+        }
+        if (!["http:", "https:"].includes(url.protocol) ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash)
+            deny();
+        const normalized = url.href.replace(/\/+$/, "");
+        this.clock();
+        this.signingKey = createHmac("sha256", secret)
+            .update(`forklaunch/payments-context/key/v1\0${normalized}`)
+            .digest();
+    }
+    clock() {
+        const value = this.now();
+        if (!Number.isSafeInteger(value) ||
+            value < 0 ||
+            value > Number.MAX_SAFE_INTEGER - 5000)
+            return deny();
+        return value;
+    }
+    mac(payload) {
+        return createHmac("sha256", this.signingKey)
+            .update(`forklaunch/payments-context/token/v1\0${payload}`)
+            .digest();
+    }
+    fresh(scope) {
+        const now = this.clock();
+        if (!Number.isSafeInteger(scope.issuedAt) ||
+            !Number.isSafeInteger(scope.expiresAt) ||
+            scope.expiresAt - scope.issuedAt !== 5000 ||
+            now < scope.issuedAt ||
+            now >= scope.expiresAt)
+            deny();
+    }
+    async same(scope, read) {
+        this.fresh(scope);
+        const row = await read();
+        this.fresh(scope);
+        if (!row ||
+            row.instanceId !== scope.instanceId ||
+            row.organizationId !== scope.organizationId ||
+            row.stripeAccountId !== scope.accountId ||
+            row.bindingGeneration !== scope.bindingGeneration)
+            deny();
+    }
+    async get(scope, path) {
+        this.fresh(scope);
+        const result = await this.forward({
+            method: "GET",
+            path,
+            query: "",
+            stripeAccount: scope.accountId,
+            stripeVersion: scope.apiVersion,
+            scopedReadTimeoutMs: Math.max(1, Math.floor(scope.expiresAt - this.clock())),
+        });
+        this.fresh(scope);
+        if (result.status < 200 ||
+            result.status >= 300 ||
+            Buffer.byteLength(result.body, "utf8") > 1024 * 1024)
+            deny();
+        let value;
+        try {
+            value = JSON.parse(result.body);
+        }
+        catch {
+            return deny();
+        }
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return deny();
+        return value;
+    }
+    async mode(scope) {
+        const balance = await this.get(scope, "/v1/balance");
+        if (balance.object !== "balance" || balance.livemode !== scope.livemode)
+            deny();
+    }
+    async issue(owner, request, read) {
+        const started = this.clock();
+        if (!id(request.accountId, "acct_") ||
+            typeof request.livemode !== "boolean" ||
+            !apiVersion(request.apiVersion))
+            return deny();
+        const row = await read();
+        if (!row ||
+            !uuid(row.bindingGeneration) ||
+            row.instanceId !== owner.id ||
+            row.organizationId !== owner.organizationId ||
+            row.stripeAccountId !== request.accountId)
+            return deny();
+        const scope = {
+            version: 1,
+            instanceId: owner.id,
+            organizationId: owner.organizationId,
+            accountId: row.stripeAccountId,
+            livemode: request.livemode,
+            bindingGeneration: row.bindingGeneration,
+            apiVersion: request.apiVersion,
+            issuedAt: started,
+            expiresAt: started + 5000,
+        };
+        const account = await this.get(scope, `/v1/accounts/${scope.accountId}`);
+        if (account.object !== "account" || account.id !== scope.accountId)
+            deny();
+        await this.mode(scope);
+        await this.same(scope, read);
+        const payload = Buffer.from(JSON.stringify(scope)).toString("base64url");
+        return {
+            scope,
+            contextToken: `${payload}.${this.mac(payload).toString("base64url")}`,
+        };
+    }
+    checkout(owner, request, read) {
+        return this.scopedRead("checkout", owner, request, read);
+    }
+    paymentLink(owner, request, read) {
+        return this.scopedRead("payment-link", owner, request, read);
+    }
+    /** Fixed paired evidence read; never exposes an arbitrary event/proxy route. */
+    async pausedSubscription(owner, request, read) {
+        if (!id(request.eventId, "evt_") || !id(request.subscriptionId, "sub_"))
+            return deny();
+        const scope = this.readScope(owner, request);
+        await this.same(scope, read);
+        await this.mode(scope);
+        await this.same(scope, read);
+        const event = await this.get(scope, `/v1/events/${request.eventId}`);
+        await this.same(scope, read);
+        if (event.id !== request.eventId ||
+            event.object !== "event" ||
+            event.type !== "customer.subscription.paused" ||
+            event.livemode !== scope.livemode ||
+            (event.account != null && event.account !== scope.accountId) ||
+            event.context != null ||
+            !Number.isSafeInteger(event.created) ||
+            event.created < 0)
+            return deny();
+        const data = event.data;
+        const prior = data?.object;
+        const before = this.pausedCustomer(prior, request.subscriptionId, scope);
+        const subscription = await this.get(scope, `/v1/subscriptions/${request.subscriptionId}`);
+        await this.same(scope, read);
+        if (this.pausedCustomer(subscription, request.subscriptionId, scope) !==
+            before)
+            return deny();
+        const result = { scope, event, subscription };
+        if (Buffer.byteLength(JSON.stringify(result), "utf8") > 1024 * 1024)
+            return deny();
+        this.fresh(scope);
+        return result;
+    }
+    pausedCustomer(value, subscriptionId, scope) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return deny();
+        const object = value;
+        if (object.id !== subscriptionId ||
+            object.object !== "subscription" ||
+            object.status !== "paused" ||
+            object.livemode !== scope.livemode)
+            return deny();
+        if (id(object.customer, "cus_"))
+            return object.customer;
+        const customer = object.customer;
+        if (!customer ||
+            typeof customer !== "object" ||
+            Array.isArray(customer) ||
+            customer.object !== "customer" ||
+            !id(customer.id, "cus_") ||
+            (Object.hasOwn(customer, "deleted") && customer.deleted !== false) ||
+            (Object.hasOwn(customer, "livemode") &&
+                customer.livemode !== scope.livemode))
+            return deny();
+        return customer.id;
+    }
+    readScope(owner, request) {
+        if (typeof request.contextToken !== "string" ||
+            request.contextToken.length > 4096)
+            return deny();
+        const parts = request.contextToken.split(".");
+        if (parts.length !== 2 || !parts.every((p) => /^[A-Za-z0-9_-]+$/.test(p)))
+            return deny();
+        const [payload, signature] = parts;
+        const actual = Buffer.from(signature, "base64url");
+        const expected = this.mac(payload);
+        if (actual.length !== expected.length ||
+            !timingSafeEqual(actual, expected) ||
+            actual.toString("base64url") !== signature)
+            return deny();
+        let scope;
+        try {
+            scope = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        }
+        catch {
+            return deny();
+        }
+        if (!scope ||
+            scope.version !== 1 ||
+            scope.instanceId !== owner.id ||
+            scope.organizationId !== owner.organizationId ||
+            !id(scope.accountId, "acct_") ||
+            !uuid(scope.bindingGeneration) ||
+            typeof scope.livemode !== "boolean" ||
+            !apiVersion(scope.apiVersion) ||
+            scope.apiVersion !== request.apiVersion)
+            return deny();
+        return scope;
+    }
+    async scopedRead(kind, owner, request, read) {
+        if (typeof request.contextToken !== "string" ||
+            request.contextToken.length > 4096 ||
+            !id(request.id, kind === "checkout" ? "cs_" : "plink_"))
+            return deny();
+        const scope = this.readScope(owner, request);
+        await this.same(scope, read);
+        await this.mode(scope);
+        const object = await this.get(scope, kind === "checkout"
+            ? `/v1/checkout/sessions/${request.id}`
+            : `/v1/payment_links/${request.id}`);
+        if (object.id !== request.id ||
+            object.object !==
+                (kind === "checkout" ? "checkout.session" : "payment_link") ||
+            object.livemode !== scope.livemode)
+            deny();
+        await this.same(scope, read);
+        return { scope, object };
+    }
+}

package/bin/gateway-mock/routes/payments.mjs

@@ -7,6 +7,10 @@
  *                                   creates the instance's connected account
  *                                   on first use (acct_mock_<n>)
  *   GET  /payments/status           { chargesEnabled, payoutsEnabled, requirementsDue }
+ *   GET  /payments/payouts?limit=N  { available, pending, payouts, bank, schedule }:
+ *                                   empty before onboarding; once enabled, a
+ *                                   balance and one paid payout (read-only)
+ *   POST /payments/dashboard-link   { url } once onboarded; 409 before
  *   *    /stripe/v1/...             the Stripe API, as the real Stripe SDK
  *                                   sends it (form-encoded, signed verbatim)
  *
@@ -41,7 +45,8 @@
  *                               http://localhost:12111 (docker stripe/stripe-mock)
  *   MOCK_STRIPE_UPSTREAM_KEY    the key sent upstream (default sk_test_123)
  */
-import { randomBytes } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { PaymentsContextProtocol } from './payments-context.mjs';
 
 const env = process.env;
 const AUTO_ENABLE = !['0', 'false', 'no'].includes(
@@ -446,6 +451,7 @@ async function onboardingLink(ctx) {
     ctx.state.accountCount = (ctx.state.accountCount ?? 0) + 1;
     account = ctx.state.accounts[ctx.instanceId] = {
       id: `acct_mock_${String(ctx.state.accountCount).padStart(4, '0')}`,
+      bindingGeneration: randomUUID(),
       chargesEnabled: false,
       payoutsEnabled: false,
       detailsSubmitted: false,
@@ -466,6 +472,87 @@ function status(ctx) {
   });
 }
 
+/** Mirrors the platform: 1..50, 10 when missing or not a number. */
+function payoutsLimit(raw) {
+  const n = raw === null || raw.trim() === '' ? NaN : Number(raw);
+  if (!Number.isFinite(n)) return 10;
+  return Math.min(50, Math.max(1, Math.floor(n)));
+}
+
+function payouts(ctx) {
+  const account = accountFor(ctx);
+  if (!account) {
+    return ctx.send(200, { available: [], pending: [], payouts: [], bank: null, schedule: null });
+  }
+  const limit = payoutsLimit(new URL(ctx.req.url ?? '/', 'http://mock').searchParams.get('limit'));
+  const enabled = Boolean(account.payoutsEnabled);
+  const day = 86_400_000;
+  return ctx.send(200, {
+    available: [{ amount: enabled ? 12_500 : 0, currency: 'usd' }],
+    pending: [{ amount: enabled ? 4_200 : 0, currency: 'usd' }],
+    payouts: enabled
+      ? [{
+          id: `po_mock_${account.id.slice(-4)}`,
+          amount: 9_900,
+          currency: 'usd',
+          status: 'paid',
+          arrivalDate: new Date(Date.now() - 2 * day).toISOString(),
+          automatic: true
+        }].slice(0, limit)
+      : [],
+    bank: enabled ? { bankName: 'STRIPE TEST BANK', last4: '6789' } : null,
+    schedule: enabled ? { interval: 'daily', delayDays: 2 } : null
+  });
+}
+
+function dashboardLink(ctx) {
+  const account = accountFor(ctx);
+  if (!account?.detailsSubmitted) {
+    return ctx.send(409, 'Payments are not set up yet: finish Stripe onboarding first');
+  }
+  return ctx.send(200, { url: `https://connect.stripe.com/express/${account.id}/mock_${randomBytes(6).toString('hex')}` });
+}
+
+// Dedicated context routes never widen STRIPE_ALLOWLIST. Synthetic mode is
+// test-only; configured upstream verifies its own actual account and mode.
+async function scopedRead(ctx, operation) {
+  const read = async () => {
+    const account = accountFor(ctx);
+    return account ? {instanceId:ctx.instanceId, organizationId:`mock:${ctx.instanceId}`,
+      stripeAccountId:account.id, bindingGeneration:account.bindingGeneration} : null;
+  };
+  const protocol = new PaymentsContextProtocol(UPSTREAM_KEY, UPSTREAM ?? 'https://gateway-mock.invalid', async request => {
+    if (UPSTREAM) {
+      const response = await fetch(`${UPSTREAM}${request.path}`, {method:'GET', redirect:'error',
+        signal:AbortSignal.timeout(5000), headers:{authorization:`Bearer ${UPSTREAM_KEY}`,
+          'stripe-account':request.stripeAccount,'stripe-version':request.stripeVersion}});
+      return {status:response.status,body:await response.text()};
+    }
+    let object;
+    if (request.path === '/v1/balance') object = {object:'balance',livemode:false};
+    else if (request.path === `/v1/accounts/${request.stripeAccount}`) object = {object:'account',id:request.stripeAccount};
+    else {
+      const saved = ctx.state.objects.get(request.path.split('/').pop());
+      if (saved?.__account === request.stripeAccount) object = visible(saved);
+    }
+    return {status:object ? 200 : 404,body:JSON.stringify(object ?? {})};
+  });
+  try {
+    const fields = operation === 'issue' ? ['accountId','livemode','apiVersion'] : operation === 'pausedSubscription' ? ['contextToken','eventId','subscriptionId','apiVersion'] : ['contextToken','id','apiVersion'];
+    if (!ctx.body || typeof ctx.body !== 'object' || Array.isArray(ctx.body)
+      || Object.keys(ctx.body).some(k => !fields.includes(k)) || ctx.req.url.includes('?')) throw new Error('invalid');
+    const minute = Math.floor(Date.now()/60000);
+    ctx.state.rate ??= {};
+    const key = `${ctx.instanceId}:${minute}`;
+    ctx.state.rate[key] = (ctx.state.rate[key] ?? 0)+1;
+    if (ctx.state.rate[key] > RPM) return stripeError(ctx,429,'rate_limit_error','Payments request limit exceeded','rate_limit');
+    const owner = {id:ctx.instanceId,organizationId:`mock:${ctx.instanceId}`};
+    return ctx.send(200, await protocol[operation](owner,ctx.body,read),{'cache-control':'no-store'});
+  } catch {
+    return stripeError(ctx,409,'invalid_request_error','Payment context is unavailable or no longer matches','payments_context_invalid');
+  }
+}
+
 async function stripeProxy(ctx) {
   const method = ctx.req.method;
   const path = ctx.path.replace(/^\/instance-gateway\/stripe/, '');
@@ -532,6 +619,12 @@ export default {
   routes: [
     { method: 'POST', path: '/payments/onboarding-link', handler: onboardingLink },
     { method: 'GET', path: '/payments/status', handler: status },
+    { method: 'GET', path: '/payments/payouts', handler: payouts },
+    { method: 'POST', path: '/payments/dashboard-link', handler: dashboardLink },
+    { method: 'POST', path: '/payments/context', handler: ctx => scopedRead(ctx,'issue') },
+    { method: 'POST', path: '/payments/context/checkout-read', handler: ctx => scopedRead(ctx,'checkout') },
+    { method: 'POST', path: '/payments/context/payment-link-read', handler: ctx => scopedRead(ctx,'paymentLink') },
+    { method: 'POST', path: '/payments/context/paused-subscription-read', handler: ctx => scopedRead(ctx,'pausedSubscription') },
     ...['GET', 'POST', 'DELETE'].map((method) => ({ method, path: PROXY, handler: stripeProxy }))
   ],
   vendorRoutes: [

package/lib/agent/agent.d.ts

@@ -0,0 +1,26 @@
+import { type ModelGatewayClient } from '../http/modelGatewayClient';
+import { type AgentEvent, type AgentLimits, type AgentTaskRequest, type AgentTaskResult, type AgentToolContext, type AgentToolListing, type ToolSource } from './types';
+export declare const DEFAULT_AGENT_LIMITS: AgentLimits;
+export interface AgentDefinition {
+    name: string;
+    instructions: string;
+    /** Catalog model alias. Default: the `AGENT_MODEL` setting. */
+    model?: string;
+    sources: ToolSource[];
+    limits?: Partial<AgentLimits>;
+    /** Key that seals approval continuations. Default: the `HMAC_SECRET_KEY` setting. */
+    continuationSecret?: string;
+    /** Stream model output. Default: the `FORKLAUNCH_MODEL_STREAMING` setting is `1`. */
+    streaming?: boolean;
+    client?: () => ModelGatewayClient;
+}
+export interface Agent {
+    name: string;
+    listTools(context: AgentToolContext): Promise<AgentToolListing>;
+    /** Runs or resumes a task, yielding stream events. */
+    stream(request: AgentTaskRequest, context: AgentToolContext): AsyncGenerator<AgentEvent>;
+    /** Runs or resumes a task to completion or to the next approval. */
+    run(request: AgentTaskRequest, context: AgentToolContext): Promise<AgentTaskResult>;
+}
+export declare function defineAgent(definition: AgentDefinition): Agent;
+//# sourceMappingURL=agent.d.ts.map

package/lib/agent/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/agent/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AASpC,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAEpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EAErB,KAAK,UAAU,EAChB,MAAM,SAAS,CAAC;AAEjB,eAAO,MAAM,oBAAoB,EAAE,WAMlC,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,qFAAqF;IACrF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,kBAAkB,CAAC;CACnC;AAID,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChE,sDAAsD;IACtD,MAAM,CACJ,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,gBAAgB,GACxB,cAAc,CAAC,UAAU,CAAC,CAAC;IAC9B,oEAAoE;IACpE,GAAG,CACD,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7B;AA+BD,wBAAgB,WAAW,CAAC,UAAU,EAAE,eAAe,GAAG,KAAK,CA6b9D"}

package/lib/agent/continuation.d.ts

@@ -0,0 +1,29 @@
+import type { GatewayChatMessage } from '../http/modelGatewayClient';
+export interface PendingToolCall {
+    id: string;
+    name: string;
+    arguments: string;
+}
+/** Everything needed to resume a run after the user decides on a tool call. */
+export interface Continuation {
+    v: 1;
+    userId: string;
+    expiresAt: number;
+    steps: number;
+    messages: GatewayChatMessage[];
+    /** The call awaiting approval first, then any later calls of the same model turn. */
+    pending: PendingToolCall[];
+    toolCalls: {
+        id: string;
+        name: string;
+        ok: boolean;
+    }[];
+}
+export declare const CONTINUATION_TTL_MS: number;
+/**
+ * Seals a continuation with AES-256-GCM: tool results inside stay confidential,
+ * and any change makes it unreadable. Nothing is stored on the server.
+ */
+export declare function sealContinuation(value: Continuation, secret: string): string;
+export declare function openContinuation(token: string, secret: string, userId: string): Continuation | null;
+//# sourceMappingURL=continuation.d.ts.map

package/lib/agent/continuation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"continuation.d.ts","sourceRoot":"","sources":["../../src/agent/continuation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,CAAC,EAAE,CAAC,CAAC;IACL,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,qFAAqF;IACrF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CACxD;AAGD,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAO/C;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAa5E;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,YAAY,GAAG,IAAI,CA0BrB"}

package/lib/agent/index.d.ts

@@ -0,0 +1,8 @@
+export { defineAgent, DEFAULT_AGENT_LIMITS } from './agent';
+export type { Agent, AgentDefinition } from './agent';
+export { openContinuation, sealContinuation } from './continuation';
+export type { Continuation, PendingToolCall } from './continuation';
+export { mcpServer, serviceTools } from './sources';
+export { localTools, requiresApproval, toJsonSchema, toolFactory, toolNameSegment, TOOL_NAME } from './tools';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/lib/agent/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAC5D,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,SAAS,EACV,MAAM,SAAS,CAAC;AACjB,cAAc,SAAS,CAAC"}