@framers/agentos-ext-gmail-source 0.2.0 → 0.4.0

package/README.md

@@ -1,8 +1,8 @@
 # Gmail source
 
-This library provides read-only Gmail authorization on the AgentOS redirect grant and sealed-token contracts, and text helpers that sanitize and trim mail before it is stored (see Text ingestion below). It requests the sole Gmail read-only scope, offline access and incremental consent. It exports no send, reply, label-modification or attachment-download tool.
+This library provides read-only Gmail authorization on the AgentOS redirect grant and sealed-token contracts, text helpers that sanitize and trim mail before it is stored (see Text ingestion below), a bounded mapper that turns one thread response into a sanitized source document (see Thread documents below), and a capped read-only API client that sends every call through the host's quota and grant services (see Read-only API below). It requests the sole Gmail read-only scope, offline access and incremental consent. It exports no send, reply, label-modification or attachment-download tool.
 
-Install it next to `@framers/agentos` 0.13.134 or later and `@framers/agentos-ext-account-sources` 0.4.0 or later. Both are peer dependencies with a floor and no upper bound. Node.js 20.19 or later is required.
+Install it next to `@framers/agentos` 0.13.134 or later and `@framers/agentos-ext-account-sources` 0.7.0 or later. Both are peer dependencies with a floor and no upper bound. Node.js 20.19 or later is required.
 
 ```ts
 import { GmailOAuthFlow } from '@framers/agentos-ext-gmail-source';
@@ -59,3 +59,76 @@ const filename = sanitizeMailMetadata(decodedFilename, { ...policy, maxOutputCha
 `messageText(input, policy)` sanitizes first, trims recognized reply history and short signatures, then applies the output cap. Explicit forwarded content and ambiguous prose are retained. Its `trimmedQuote`, `trimmedSignature` and `truncated` flags describe omissions. Quote spans must refer to its returned string, without inserted summaries or an ellipsis presented as source text. A host should disclose that attachments are listed and their contents are not read when its mapper implements that boundary.
 
 The functions return text and counts only. They do not store raw values or a reverse-redaction map, log matches, fetch URLs, interpret mail as instructions or invoke a model. Sanitization can remove benign text and cannot identify every possible secret. It does not make personal mail anonymous or authorize model processing, sharing or retention. Hosts must preserve the source's privacy, expiry and deletion rules for both text and derived results.
+
+## Thread documents
+
+```ts
+import { GmailThreadMapper } from '@framers/agentos-ext-gmail-source';
+
+const mapper = new GmailThreadMapper({
+  maxResponseBytes: 2_097_152, maxDecodedBytes: 2_097_152, maxMimeDepth: 20, maxMimeParts: 1_000,
+  maxMessages: 100, maxMessageCharacters: 20_000, maxThreadCharacters: 200_000,
+  maxMetadataCharacters: 200_000, maxInputCharacters: 2_097_152, maxLineCharacters: 65_536,
+  maximumCacheMs: 86_400_000,
+});
+
+// `response` is the parsed threads.get (format=full) body from a transport that capped its bytes.
+const result = await mapper.map(response, {
+  sourceId: response.id,
+  sourceDetailUrl: detailPath, // the host's authenticated source-detail route, never a Gmail link
+  cutoff, windowMs: 30 * 86_400_000, readStartedAt, receivedAt,
+  permission, cacheHeaders, labelNames, labelCache, signal,
+});
+// result.kind is 'document' (text, message spans, metadata, cache expiry) or 'skipped' with a fixed reason.
+```
+
+Construct `GmailThreadMapper(bounds)` with explicit response, decoded-byte, MIME depth/part, retained-message, message/thread text, metadata, sanitizer and cache ceilings. `map(thread, options)` returns the account-source `SourceSyncReadResult` union. The input is the parsed response from a transport that already enforced its byte cap before JSON decoding. The mapper separately checks recognized MIME data and the entire part tree before decoding any selected body. A parsed object alone cannot establish its original wire size.
+
+Supply a fixed selection cutoff, message window, original read start and completion times, actual response cache headers, independently established cache permission and a host-generated relative detail path. The path must resolve authentication and current source generation in the host. It is never a Gmail deep link or a request-derived external URL. A successful OAuth grant does not establish cache or model-processing permission.
+Pass `labelCache` as the separate labels response’s cache decision. Missing, refused or expired label permission keeps ids without names. Permitted names shorten the entire document’s expiry when their allowed lifetime ends first.
+
+Each message is filtered by its internal timestamp and excluded labels. Retained messages are selected newest first with stable id ties, within the explicit cap, and rendered chronologically. Plain text wins within a MIME alternative. Other multipart containers retain their non-attachment text children in MIME order. HTML uses the public AgentOS `HtmlLoader` with an in-memory Buffer. No browser or remote resource is loaded. The resulting text, structured headers, filenames, media types and label names all pass the text sanitizer.
+
+Attachments are listed; their contents are not read. An external body or attachment contributes only sanitized filename, media type and size. Inline attachment bytes and attachment ids are discarded. Bcc, raw payloads, snippets and unknown fields are not returned. The mapper never calls any Gmail endpoint. Unsupported charset, invalid bytes and omitted content have fixed counted reasons. Invalid protocol shape is a failure rather than an empty successful source.
+
+A returned document has matching item/ref versions, a normalized-content hash, message ids and body spans, earliest allowed expiry and explicit omission/truncation metadata. Spans count UTF-16 code units in the returned text and exclude the header prefix. Quote trimming preserves normalized source text; no generated summary or ellipsis is inserted into a quote. Header-only messages can have an empty body span. Render structured metadata as escaped text and treat all mail as untrusted data.
+
+A history-only change does not extend cache life or change the normalized hash. Storage still requires the account-source transactional fence, fresh expiry checks and host allowances. Derived results retain the whole source's personal-use, expiry and deletion restrictions. Never persist the transient MIME types or bypass the account-source store with a mapper result.
+
+## Read-only API
+
+```ts
+import { GmailApi } from '@framers/agentos-ext-gmail-source';
+
+// `revocations` is the host's SourceRevocations and `quota` its SourceQuota, on the tables its coordinator uses.
+const api = new GmailApi({
+  client, revocations, quota,
+  currentHandle: () => handle, // the sync handle that holds this connection's lease now
+  projectKey: 'project-1', mailboxKey, // a stable keyed hash for the mailbox, never its address
+  bounds, // the thread mapper's bounds (see Thread documents)
+  limits: { timeoutMs: 15_000, maxLabels: 1_000, maxHistoryReferences: 10_000, maxPageTokenCharacters: 4_096 },
+});
+
+const profile = await api.profile(signal); // compare profile.emailAddress privately; keep profile.historyId
+const labels = await api.labels(permission, signal);
+const page = await api.list(cutoff, 30 * 86_400_000, 100, null, signal); // { kind: 'scan', ids, nextPageToken }
+for (const id of page.ids) {
+  const result = await api.readThread(id, {
+    cutoff, windowMs: 30 * 86_400_000, sourceDetailUrl: detailPath(id), permission, labels, signal,
+  });
+}
+const changes = await api.history(profile.historyId, 100, null, signal); // { kind: 'history', ids, nextPageToken, cursor }
+// A failure is a SourceSyncFault with a fixed code and, for a wait, the time to try again in retryAt.
+```
+
+`GmailApi(options)` uses the account-source quota and grant services supplied by the host. Pass a live `currentHandle` getter, stable opaque project/mailbox quota keys, the dedicated OAuth client, mapper bounds and explicit transport limits. The client constructs each OAuth flow inside the grant service's callback. It retains no flow or sealed-store callback between operations. Production uses fixed Google origins and only profile, labels, threads list/get and history list. CI may configure loopback or reserved fixture origins; HTTP redirects and arbitrary paths are refused.
+
+`profile(signal?)` returns a server-memory address and history id for private account binding. Never store its address in a source or log it. `list(cutoff, windowMs, pageSize, pageToken, signal?)` returns a bounded scan page. The query uses epoch seconds and excludes spam, trash and drafts; exact message eligibility remains the mapper's responsibility. `history(fromCursor, pageSize, pageToken, signal?)` returns deduplicated changed thread ids and the string response cursor. The host must persist pending work and commit a terminal cursor only after all work has completed. Neither method claims mailbox-wide completeness.
+
+`labels(permission, signal?)` returns sanitized names and the cache decision from that labels response. A refused decision contains no names. `readThread(sourceId, options)` accepts cutoff/window, a trusted private detail path, cache permission, the independent label snapshot and optional signal. It passes the actual thread response headers and times to the mapper and returns only the account-source read-result union. It never returns raw MIME. A labels response cannot borrow a thread response's longer cache lifetime.
+
+One provider operation makes one attempt, with one fresh-token retry permitted after 401. Every HTTP dispatch is separately metered. Token refreshes also use the one-unit profile reservation as conservative local accounting; this does not assert a Gmail quota cost for the OAuth endpoint. The durable account-source coordinator owns retry episodes, exponential backoff and exhaustion. The client persists provider waits through the quota service and never sleeps or buys capacity. A quota deferral, or a start that missed the quota's send window, sends nothing and throws `rate_limited` with the time to try again; only a reused attempt id is `invalid_response`. A retry time the client hands back is always after its own clock, even when the quota's database clock lags it; give the client the clock the host's sync store reads (`Date.now` for both unless given). Unknown errors become fixed failures without retaining their messages or causes.
+
+A canonical thread 404 means gone. History 404 means the history anchor expired and bounded recovery is required. Domain policy is a fixed failure. Missing or explicitly invalid grants and insufficient scope are passed to the coordinator's fenced grant-loss lifecycle. Client configuration errors and transient network/provider failures are not reported as revoked mailboxes. Oversized successful thread responses are counted skips; oversized control pages fail without a cursor advance. Response streams are capped before decoding and are cancelled on size, deadline or caller cancellation.
+
+The client performs no storage write, purge, logging, model request or attachment fetch. Its successful result is still untrusted source material and needs the host's fresh owner/generation/expiry checks before storage, preparation or delivery. Limits are defensive library policy, not provider maxima; hosts must record any live compatibility failure before changing them.

package/dist/gmail.d.ts

@@ -0,0 +1,182 @@
+import { type SourceQuota, type SourceRevocations, type SourceSyncHandle, type SourceSyncScanPage, type SourceSyncHistoryPage, type SourceSyncReadResult, type SourceCachePermission, type SourceCacheDecision } from '@framers/agentos-ext-account-sources';
+import type { GmailOAuthClient, GmailOAuthEndpoints } from './types.js';
+import { type GmailMappingBounds } from './mime.js';
+/**
+ * The client's defensive transport limits, each a positive safe integer no greater than the value in brackets. They
+ * are library choices, not Google maxima: a control page past one fails without a partial page.
+ */
+export interface GmailApiLimits {
+    /** Milliseconds one call and the reading of its body may take (15,000). */
+    readonly timeoutMs: number;
+    /** Labels one labels response may hold (1,000). */
+    readonly maxLabels: number;
+    /** Message references one history page may hold across its five event fields (10,000). */
+    readonly maxHistoryReferences: number;
+    /** Characters of one page token, given or returned (4,096). */
+    readonly maxPageTokenCharacters: number;
+}
+/**
+ * What a `GmailApi` is built from. Every value comes from trusted server configuration and the host's released
+ * account-source services; none comes from a browser request.
+ *
+ * @typeParam Prepared - The host's prepared-document type of its `SourceRevocations`.
+ */
+export interface GmailApiOptions<Prepared = unknown> {
+    /** The dedicated OAuth client the grant was issued to. */
+    readonly client: GmailOAuthClient;
+    /** The host's revocation service; its `withGrant` serializes every refresh under the durable grant lease. */
+    readonly revocations: Pick<SourceRevocations<Prepared>, 'withGrant'>;
+    /** Answers the sync handle current for this connection at each call, so a superseded handle is refused. */
+    readonly currentHandle: () => SourceSyncHandle;
+    /** The shared quota: each token refresh and each HTTP dispatch is one `run`, and provider waits go to `defer`. */
+    readonly quota: Pick<SourceQuota, 'run' | 'defer'>;
+    /** The opaque quota key of the project, 1 to 512 letters, digits, `:`, `_` or `-`. */
+    readonly projectKey: string;
+    /** Stable host HMAC key, never an address or a rotating connection id. */
+    readonly mailboxKey: string;
+    /** The thread mapper's bounds; `maxResponseBytes` also caps every API response before decoding. */
+    readonly bounds: GmailMappingBounds;
+    /** The transport and control-page limits. */
+    readonly limits: GmailApiLimits;
+    /** The fetch every token and API call goes through; the global fetch by default. */
+    readonly fetchImpl?: typeof fetch;
+    /**
+     * Epoch milliseconds; `Date.now` unless given. Give it the clock the host's sync store reads: a retry time this
+     * client hands back is always at least one millisecond after it, whichever clock produced the time.
+     */
+    readonly clock?: () => number;
+    /** CI-only transport endpoints. No request-supplied origin or client value. */
+    readonly apiOrigin?: string;
+    /** CI-only OAuth stand-in endpoints, checked as `GmailOAuthFlow` checks them. */
+    readonly oauthEndpoints?: GmailOAuthEndpoints;
+}
+/** Server-memory identity result. Never serialize it into a source or telemetry. */
+export interface GmailProfile {
+    /** The mailbox address, for the host's private comparison only. */
+    readonly emailAddress: string;
+    /** The mailbox's current history id as a decimal string. */
+    readonly historyId: string;
+}
+/** Sanitized label names and the labels response's own cache decision; a refused decision holds no names. */
+export interface GmailLabels {
+    /** Sanitized names by label id. */
+    readonly names: Readonly<Record<string, string>>;
+    /** The decision for the labels response, independent of any thread response. */
+    readonly cache: SourceCacheDecision;
+}
+/** The per-read values of one `readThread` call, passed to the thread mapper with the response's times and headers. */
+export interface GmailReadOptions {
+    /** The selection cutoff in epoch milliseconds. */
+    readonly cutoff: number;
+    /** The message window in milliseconds. */
+    readonly windowMs: number;
+    /** The host's authenticated relative source-detail path; never a Gmail link. */
+    readonly sourceDetailUrl: string;
+    /** The host's evidenced cache permission; null refuses durable content. */
+    readonly permission: SourceCachePermission | null;
+    /** The cycle's label snapshot from `labels`, or null to keep label ids without names. */
+    readonly labels: GmailLabels | null;
+    /** Cancels the read. */
+    readonly signal?: AbortSignal;
+}
+/**
+ * A client's fixed refusal; its message is `gmail_api_<reason>`. `configuration` is thrown by the constructor;
+ * `response_too_large` stays inside the client, which answers it as a skipped thread or an invalid control page.
+ */
+export declare class GmailApiFault extends Error {
+    readonly reason: 'configuration' | 'response_too_large';
+    /** @param reason Why the client refused. */
+    constructor(reason: 'configuration' | 'response_too_large');
+}
+/**
+ * The capped, read-only Gmail API client. Each provider operation makes one attempt: one OAuth refresh inside the
+ * host's grant operation, then one HTTP dispatch, each admitted by the shared quota with a new attempt id; a 401 earns
+ * one fresh token and one repeat of the same call. Provider waits are recorded through the quota's `defer` and thrown
+ * as `rate_limited` or `provider_unavailable` with their time; the durable coordinator owns retry episodes, backoff
+ * and exhaustion. Every failure is a fixed `SourceSyncFault`.
+ *
+ * @typeParam Prepared - The host's prepared-document type of its `SourceRevocations`.
+ */
+export declare class GmailApi<Prepared = unknown> {
+    private readonly options;
+    private readonly origin;
+    private readonly send;
+    private readonly bounds;
+    private readonly limits;
+    private readonly mapper;
+    /**
+     * @param options The client, the host's grant and quota services, the quota keys, the bounds and limits, and the
+     * optional fetch, clock and CI-only endpoints.
+     * @throws {GmailApiFault} `configuration` for an origin override outside CI or not a loopback or `.invalid` origin,
+     * a limit outside its ceiling, or a malformed quota key.
+     * @throws {GmailMappingFault} `configuration` for invalid bounds.
+     */
+    constructor(options: GmailApiOptions<Prepared>);
+    private now;
+    private later;
+    private pageToken;
+    private pageSize;
+    private quotaValue;
+    private reserve;
+    private defer;
+    private accessToken;
+    /** Consume/cancel the whole body within the quota callback, before releasing its slot. */
+    private wire;
+    private request;
+    private control;
+    /**
+     * The mailbox address and current history id, for the host's private account binding and its history anchor. The
+     * answer's other fields are dropped.
+     *
+     * @param signal Cancels the call.
+     * @throws {SourceSyncFault} A fixed failure, `invalid_response` for a malformed answer.
+     */
+    profile(signal?: AbortSignal): Promise<GmailProfile>;
+    /**
+     * The mailbox's labels: sanitized names by id under the labels response's own cache decision. A refused decision
+     * keeps no names.
+     *
+     * @param permission The host's evidenced cache permission; null refuses the names.
+     * @param signal Cancels the call.
+     * @throws {SourceSyncFault} A fixed failure, `invalid_response` for a malformed or oversized list.
+     */
+    labels(permission: SourceCachePermission | null, signal?: AbortSignal): Promise<GmailLabels>;
+    /**
+     * One page of candidate thread ids between `cutoff - windowMs` and `cutoff`, outside spam, trash and drafts. The
+     * query's whole-second bounds are widened by a second each way; the mapper enforces the exact window. Snippets and
+     * estimates are dropped, and no mailbox-wide completeness is claimed.
+     *
+     * @param cutoff The selection cutoff in epoch milliseconds.
+     * @param windowMs The window, from 1 millisecond to 90 days.
+     * @param pageSize Candidates per page, from 1 to 100.
+     * @param pageToken The resume token from the previous page, or null for the first.
+     * @param signal Cancels the call.
+     * @throws {SourceSyncFault} A fixed failure, `invalid_response` for bad arguments, a malformed page or a repeated
+     * page token.
+     */
+    list(cutoff: number, windowMs: number, pageSize: number, pageToken: string | null, signal?: AbortSignal): Promise<SourceSyncScanPage>;
+    /**
+     * One page of history after `fromCursor`: the thread ids of every message addition, deletion and label change, and
+     * of generic message entries, deduplicated and sorted, with the page's decimal-string cursor. The host persists the
+     * pending work and commits a terminal cursor only once every item is terminal.
+     *
+     * @param fromCursor The committed history id, a decimal string.
+     * @param pageSize Records per page, from 1 to 100.
+     * @param pageToken The resume token from the previous page, or null for the first.
+     * @param signal Cancels the call.
+     * @throws {SourceSyncFault} `history_expired` when Google no longer holds the anchor; `invalid_response` for bad
+     * arguments, a malformed or out-of-order page, too many references or a repeated page token; another fixed failure.
+     */
+    history(fromCursor: string, pageSize: number, pageToken: string | null, signal?: AbortSignal): Promise<SourceSyncHistoryPage>;
+    /**
+     * Reads one thread in the `full` format and maps it with its own read times and cache headers and the separate
+     * label snapshot. A 404 is `gone`; an oversized successful answer is skipped as `response_too_large`; any other
+     * result is the mapper's. The raw response never leaves the client.
+     *
+     * @param sourceId The thread id, 1 to 64 hexadecimal characters.
+     * @param options The cutoff, window, detail path, cache permission, label snapshot and signal.
+     * @throws {SourceSyncFault} A fixed failure, `invalid_response` for a malformed id.
+     */
+    readThread(sourceId: string, options: GmailReadOptions): Promise<SourceSyncReadResult>;
+}
+//# sourceMappingURL=gmail.d.ts.map

package/dist/gmail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gmail.d.ts","sourceRoot":"","sources":["../src/gmail.ts"],"names":[],"mappings":"AAUA,OAAO,EAEL,KAAK,WAAW,EAAkD,KAAK,iBAAiB,EACxF,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,KAAK,qBAAqB,EAAE,KAAK,oBAAoB,EAC5E,KAAK,qBAAqB,EAAE,KAAK,mBAAmB,EAC9E,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExE,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAI5E;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0FAA0F;IAC1F,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+DAA+D;IAC/D,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AACD;;;;;GAKG;AACH,MAAM,WAAW,eAAe,CAAC,QAAQ,GAAG,OAAO;IACjD,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,6GAA6G;IAC7G,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IACrE,2GAA2G;IAC3G,QAAQ,CAAC,aAAa,EAAE,MAAM,gBAAgB,CAAC;IAC/C,kHAAkH;IAClH,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;IACnD,sFAAsF;IACtF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mGAAmG;IACnG,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CAC/C;AACD,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACD,6GAA6G;AAC7G,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC;AACD,uHAAuH;AACvH,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAClD,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,wBAAwB;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AACD;;;GAGG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAE1B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,oBAAoB;IADnE,4CAA4C;gBACvB,MAAM,EAAE,eAAe,GAAG,oBAAoB;CAGpE;AAgGD;;;;;;;;GAQG;AACH,qBAAa,QAAQ,CAAC,QAAQ,GAAG,OAAO;IAa1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAZpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C;;;;;;OAMG;gBAC0B,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC;IAc/D,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,QAAQ;IAGhB,OAAO,CAAC,UAAU;YAKJ,OAAO;YAQP,KAAK;YAUL,WAAW;IA8BzB,0FAA0F;YAC5E,IAAI;YA+CJ,OAAO;YAyBP,OAAO;IAKrB;;;;;;OAMG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAO1D;;;;;;;OAOG;IACG,MAAM,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAsBlG;;;;;;;;;;;;OAYG;IACG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAC3D,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgB9E;;;;;;;;;;;OAWG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAC1E,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA8BvD;;;;;;;;OAQG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAmB7F"}