@ggui-ai/cli 0.1.0-rc.1

package/dist/local-keys.js

@@ -0,0 +1,115 @@
+/**
+ * Local-file key management for self-host operators — mirrors the
+ * `--keys-file` JSON written by `InMemoryPairingService.persistencePath`.
+ *
+ * `ggui keys <list|create|revoke>` defaults to the cloud-backed
+ * `api.ggui.ai` path. Pass `--keys-file <path>` to switch each
+ * subcommand to operate on the LOCAL JSON file instead — useful for
+ * production-grade self-hosting where operators want to mint /
+ * inspect / revoke bearers without depending on api.ggui.ai.
+ *
+ * Schema is identical to what `InMemoryPairingService` writes (v=1)
+ * so `ggui keys` and `ggui serve --keys-file` operate on the same
+ * file with no migration step.
+ */
+import { randomBytes } from 'node:crypto';
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, } from 'node:fs';
+import { dirname } from 'node:path';
+/**
+ * Read + parse the keys file, or return empty state when the file is
+ * missing / empty (first-boot path). Throws on malformed JSON or
+ * unsupported schema — loud failure beats silent overwrite.
+ */
+export function loadLocalKeys(path) {
+    if (!existsSync(path)) {
+        return { v: 1, pairings: [], idCounter: 0 };
+    }
+    const raw = readFileSync(path, 'utf8');
+    if (raw.trim().length === 0) {
+        return { v: 1, pairings: [], idCounter: 0 };
+    }
+    const parsed = JSON.parse(raw);
+    if (parsed.v !== 1) {
+        throw new Error(`ggui keys: unsupported schema v=${String(parsed.v)} at ${path} (expected v=1)`);
+    }
+    return parsed;
+}
+/**
+ * Atomic write — temp file + rename, `0600` perms, parent dir created
+ * with `0700` if missing. Mirrors `InMemoryPairingService.persistToDisk`
+ * so the two writers can't disagree on file shape.
+ */
+export function saveLocalKeys(path, state) {
+    const dir = dirname(path);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${path}.tmp.${process.pid}`;
+    const fd = openSync(tmp, 'w', 0o600);
+    try {
+        writeSync(fd, JSON.stringify(state, null, 2));
+    }
+    finally {
+        closeSync(fd);
+    }
+    try {
+        renameSync(tmp, path);
+        chmodSync(path, 0o600);
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* swallow — original error is the real one */
+        }
+        throw err;
+    }
+}
+/**
+ * Mint a new `ggui_user_*` token and append it to `state`. Returns
+ * the appended row (caller surfaces the plaintext token to the
+ * operator — one-time reveal, exactly like cloud-side `keys create`).
+ */
+export function mintLocalKey(state, opts) {
+    const now = (opts.now ?? Date.now)();
+    const pairingId = `pair-${++state.idCounter}`;
+    const token = `ggui_user_${randomBytes(9).toString('base64url')}`;
+    const row = {
+        pairingId,
+        deviceName: opts.deviceName,
+        createdAt: now,
+        token,
+    };
+    state.pairings.push(row);
+    return row;
+}
+/**
+ * Remove the row with `pairingId`. Idempotent — revoking a missing
+ * id is not an error. Returns `true` when a row was removed.
+ */
+export function revokeLocalKey(state, pairingId) {
+    const before = state.pairings.length;
+    state.pairings = state.pairings.filter((p) => p.pairingId !== pairingId);
+    return state.pairings.length < before;
+}
+/**
+ * Render a fixed-width table to stdout. Columns chosen to match the
+ * cloud-side `keys list` shape so operators recognize the layout
+ * regardless of which mode they're in.
+ */
+export function formatLocalKeyTable(state) {
+    if (state.pairings.length === 0) {
+        return 'No local keys. Run `ggui keys create --keys-file <path> --name <label>` to mint one.\n';
+    }
+    const headers = ['ID', 'PREFIX', 'NAME', 'CREATED', 'LAST USED'];
+    const rows = state.pairings.map((p) => [
+        p.pairingId,
+        `${p.token.slice(0, 14)}…`,
+        p.deviceName,
+        new Date(p.createdAt).toISOString(),
+        p.lastUsedAt ? new Date(p.lastUsedAt).toISOString() : '—',
+    ]);
+    const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? '').length)));
+    const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i] ?? 0)).join('  ');
+    return [fmt(headers), ...rows.map(fmt)].join('\n') + '\n';
+}

package/dist/mcp-backend.d.ts

@@ -0,0 +1,356 @@
+import { type BlueprintProvider, type GadgetDescriptor, type McpAppsMode, type DiscoveredPrimitiveCatalog, type GenerationDeps, type LoadedTheme, type McpServerMount, type OperatorConfig, type ResolvedStorageStores, type ShortCodeIndex, type ThemeWriter } from '@ggui-ai/mcp-server';
+import type { UiRegistry } from '@ggui-ai/ui-registry';
+import type { UiManifest } from '@ggui-ai/project-config';
+import type { ServeBackend } from './serve-command.js';
+export interface BuildMcpServerBackendOptions {
+    /**
+     * Pre-resolved storage from `ggui.json#storage`. Threaded straight
+     * through to `createGguiServer`. Omit / leave fields undefined to
+     * keep the server's in-memory defaults — no silent file creation
+     * without an explicit declaration.
+     */
+    readonly storage?: ResolvedStorageStores;
+    /**
+     * Version string echoed in the CLI banner. Deliberately separate
+     * from the server's own `info.version` (which still comes out of
+     * `@ggui-ai/mcp-server`'s package.json) so the user sees which CLI
+     * build launched the server.
+     */
+    readonly cliVersion: string;
+    /**
+     * Bind host used to compose the MCP Apps `renderBaseUrl` + `wsUrl`.
+     * Must be the same host the CLI then passes to `listen()`; otherwise
+     * the shortCode URLs the agent receives will point somewhere the
+     * browser can't reach.
+     */
+    readonly host: string;
+    /**
+     * Bind port used to compose the MCP Apps URLs. MUST be a concrete
+     * port (not `0`) — the agent-returned URL is captured at composition
+     * time, so deferring to an OS-assigned port would leave `ggui_push`
+     * emitting a broken link. Callers that started with `--port 0`
+     * should pre-resolve a free port via {@link pickFreePort} before
+     * constructing the backend.
+     */
+    readonly port: number;
+    /**
+     * Pre-constructed blueprint provider — the CLI builds one from
+     * `ggui.json#blueprints.include` (via `discoverLocalUis` +
+     * `ManifestBlueprintProvider`) and threads it through so
+     * `ggui_list_featured_blueprints` surfaces every declared UI.
+     * Omitted = provider-less server (`ggui_list_featured_blueprints`
+     * returns an empty catalog, matching pre-Phase-4 behavior).
+     */
+    readonly blueprintProvider?: BlueprintProvider;
+    /**
+     * UI registry consulted by `ggui_render_blueprint`. The CLI pairs
+     * this with `blueprintProvider` at boot — same manifest source,
+     * two complementary seams (provider for metadata / list / search,
+     * registry for compiled bundle resolution). OSS uses
+     * `@ggui-ai/dev-stack::LocalUiRegistry` (compile-on-demand via
+     * esbuild). Omitted = `ggui_render_blueprint` is NOT registered on
+     * this server (no throwing shim; the tool is simply absent from
+     * `tools/list`).
+     */
+    readonly uiRegistry?: UiRegistry;
+    /**
+     * Primitive catalogs resolved from
+     * `ggui.json#primitives.{packages,local}` by
+     * `discoverPrimitives()` in `@ggui-ai/project-config/node`. Passed
+     * through to `createGguiServer` so `server.primitiveCatalogs`
+     * reflects what the operator declared. Omitted = programmatic hosts
+     * / tests that don't need a primitive index — the server handle
+     * exposes an empty array in that case.
+     */
+    readonly primitiveCatalogs?: readonly DiscoveredPrimitiveCatalog[];
+    /**
+     * Theme resolved from `ggui.json#theme` by `loadTheme()` in
+     * `@ggui-ai/project-config/node`. Threaded through to
+     * `createGguiServer({ theme })` so `server.theme` reflects what
+     * the operator declared. Omitted = programmatic hosts / tests
+     * that didn't load a theme — the server handle surfaces its own
+     * `lightTheme`-backed `LoadedTheme` default in that case.
+     */
+    readonly theme?: LoadedTheme;
+    /**
+     * Theme writer for the admin-gated `/ggui/console/theme` POST.
+     * Mounted only when present — the server returns 501 on Save when
+     * the writer is omitted (programmatic hosts / `--mcp-only` mode
+     * with no manifest). The CLI builds this from
+     * `manifestPath` via {@link createThemeWriter} when a `ggui.json`
+     * is on disk.
+     */
+    readonly themeWriter?: ThemeWriter;
+    /**
+     * Live theme getter — when set, supersedes the static `theme`
+     * resolution for every `ggui_push` bootstrap envelope. The CLI
+     * pairs this with `onThemeConfigChange` so a console save
+     * reaches the next push without a server restart.
+     */
+    readonly themeProvider?: () => {
+        readonly id?: string;
+        readonly mode?: 'light' | 'dark';
+    } | undefined;
+    /**
+     * Optional change notifier — fires from
+     * `mountDevtoolThemeRoutes`'s POST handlers when the operator
+     * saves a new theme via the picker. Pair with `themeProvider` so
+     * the push handler reads the live theme on every call.
+     */
+    readonly onThemeConfigChange?: (next: string | {
+        preset: string;
+        mode?: 'light' | 'dark';
+        overrides?: Record<string, string>;
+    } | {
+        file: string;
+        mode?: 'light' | 'dark';
+    } | null) => void;
+    /**
+     * Generation wiring for `ggui_push`. When present, the OSS push
+     * handler invokes the bound `UiGenerator` on every story-path
+     * call and appends real componentCode as a `StackItem`. Absent =
+     * placeholder mode: push creates sessions + shortCodes but does
+     * not produce componentCode.
+     *
+     * The CLI resolves this from the operator's BYOK state at boot via
+     * {@link probeGenerationBinding} — env (`ANTHROPIC_API_KEY` etc.)
+     * first, then `~/.ggui/credentials.json`. Programmatic hosts
+     * embedding `buildMcpServerBackend` directly supply their own
+     * `GenerationDeps` bundle (real BYOK in a hosted multi-tenant
+     * setting, a test double, etc.).
+     */
+    readonly generation?: GenerationDeps;
+    /**
+     * Marketplace-install bridge data. When set, the backend
+     * constructs an
+     * {@link InstalledBlueprintsProvider} rooted on the same
+     * `embedding` + `vectorStore` the matcher consumes, and merges it
+     * into `generation.installedBlueprints`. On the first
+     * `matchBlueprint` call per scope, every entry with a contract is
+     * compiled (esbuild) and registered into the cache with
+     * `provenance: 'install'` — so installed blueprints accelerate
+     * render the way synth-cached ones do.
+     *
+     * Caller is responsible for filtering `entries` to actual
+     * marketplace installs (typically: discovered UIs whose
+     * `manifestPath` lives under `.ggui/installed-blueprints/`). Hand-
+     * authored UIs are intentionally excluded today.
+     */
+    readonly installedBlueprints?: {
+        readonly projectRoot: string;
+        readonly entries: ReadonlyArray<{
+            readonly id: string;
+            readonly manifestPath: string;
+            readonly manifest: UiManifest;
+        }>;
+    };
+    /**
+     * External MCP tool-handler bundles to aggregate onto `/mcp`.
+     * Threaded straight through to `createGguiServer({ mcpMounts })`;
+     * see that option's JSDoc for shape + collision rules.
+     *
+     * The `ggui serve` CLI today does NOT surface a `ggui.json` field
+     * for this — there's no config loader yet. Programmatic hosts and
+     * integration-test fixtures compose mounts directly via
+     * `buildMcpServerBackend({ mcpMounts: [...] })`.
+     */
+    readonly mcpMounts?: ReadonlyArray<McpServerMount>;
+    /**
+     * Switch the in-memory auth adapter to `devAllowAll: true`. Every
+     * non-empty bearer (including the no-bearer probe MCP custom
+     * connectors send) authenticates as builder. Local-dev / tunnel-
+     * smoke escape hatch only — pairing or a custom `AuthAdapter` is
+     * the production answer. Surface = `--dev-allow-all` CLI flag.
+     *
+     * Default `false` keeps the strict-auth posture (every bearer
+     * must be pair-minted).
+     */
+    readonly devAllowAll?: boolean;
+    /**
+     * Public-demo posture. Same auth-adapter shape as `devAllowAll`
+     * (every bearer authenticates as builder) but additionally:
+     *   - Wires a per-remote-IP `FixedWindowRateLimiter` over an
+     *     `InMemoryQuotaStore` (default 30 generations / 10 minutes per
+     *     IP). The limiter binds at `ggui_push` so end-user generations
+     *     can't burn the operator's BYOK budget.
+     *   - The CLI banner displays "PUBLIC DEMO" copy with a cost-
+     *     attribution + rate-limit note (vs. "DEV ALLOW-ALL" warning).
+     *
+     * Mutually exclusive with `devAllowAll`; the CLI rejects both at
+     * parse time. Surface = `--public-demo` CLI flag.
+     */
+    readonly publicDemo?: boolean;
+    /**
+     * Multi-tenant posture. Switches the `/ggui/console/llm-keys` gate
+     * from admin-token to auth-adapter — each authenticated end-user
+     * manages their OWN provider keys (scope = `userId` for `kind:'user'`
+     * identities, `appId` for `kind:'app'`). `kind:'builder'` identities
+     * are rejected at the gate; multi-tenant is meaningless without a
+     * real per-caller id.
+     *
+     * Strict-auth shape — every bearer must clear the `AuthAdapter`
+     * (pairing-minted, OIDC, Cognito, or whatever the embedding host
+     * binds). Mutually exclusive with `devAllowAll` and `publicDemo`;
+     * the CLI rejects combinations at parse time. Surface =
+     * `--multi-tenant` CLI flag.
+     */
+    readonly multiTenant?: boolean;
+    /**
+     * Public base URL that replaces `http://<host>:<port>` when
+     * composing `mcpApps.renderBaseUrl`, `mcpApps.wsUrl`, and
+     * `runtime.url`. Set this when the server is being reached
+     * through a tunnel (cloudflare, ngrok, …) so URLs the agent
+     * receives resolve from the MCP host's perspective rather than
+     * `localhost`.
+     *
+     * Required shape: `http://…` or `https://…`, no trailing slash.
+     * The `wsUrl` is derived by replacing the scheme with `ws`/`wss`.
+     * Surface = `--public-base-url <url>` CLI flag.
+     */
+    readonly publicBaseUrl?: string;
+    /**
+     * Path to a JSON file backing the in-memory pairing service. When
+     * set, paired bearer tokens survive `ggui serve` restarts — claude.ai
+     * (and any other MCP client) stays connected without re-pairing.
+     * Stored in plaintext at the path with `0600` perms; assume the
+     * file lives on operator-controlled disk.
+     *
+     * Surface = `--keys-file <path>` CLI flag. Default ephemeral when
+     * absent (current behavior).
+     */
+    readonly keysFile?: string;
+    /**
+     * Mount the OAuth 2.1 + PKCE + Dynamic Client Registration routes.
+     * Required for MCP custom-connector hosts (claude.ai, ChatGPT) whose
+     * "Add connector" form has no field for a pre-shared bearer.
+     *
+     * The full flow lives in `@ggui-ai/mcp-server::oauth.ts`; here we
+     * just forward `oauth: true` to `createGguiServer` so the server
+     * mounts `.well-known/oauth-*` + `/oauth/{authorize,token,register}`.
+     * Defaults (in-memory storage, paste-key consent page) are right for
+     * single-replica dev. Programmatic embedders that need a custom
+     * `OAuthConfig` (storage seam, external consent UI) compose
+     * `createGguiServer({oauth: <config>})` directly.
+     *
+     * Surface = `--oauth` CLI flag.
+     */
+    readonly oauth?: boolean;
+    /**
+     * Server-level MCP instructions preset. Threaded straight through
+     * to `createGguiServer({mcpInstructions})`. Falls back to the
+     * `GGUI_MCP_INSTRUCTIONS` env var when absent. Both absent =
+     * `createGguiServer`'s no-preset default (`'aggressive'`).
+     *
+     * Surface = `--mcp-instructions <preset>` CLI flag or
+     * `GGUI_MCP_INSTRUCTIONS` env var (CLI flag wins).
+     */
+    readonly mcpInstructions?: 'default' | 'aggressive' | 'always' | 'minimal' | 'off';
+    /**
+     * Directory backing the cross-restart persistence bundle. When set,
+     * `bootstrapSecret` + `renderSigning.secret` are read from / minted
+     * into 0600-mode files there so the HMAC keys survive `ggui serve`
+     * restart — claude.ai chat-history revisits keep their cached
+     * `_meta.ggui.bootstrap.token` + `/r/<code>?sig=&exp=` URLs valid.
+     *
+     * Absent / undefined = the legacy ephemeral behavior (every restart
+     * mints fresh secrets; cached tokens fail HMAC verify). The CLI sets
+     * this to `getPersistentDir(projectRoot)` by default and skips when
+     * `--ephemeral` is passed.
+     */
+    readonly persistentDir?: string;
+    /**
+     * Pre-resolved `ShortCodeIndex` implementation. When set, replaces
+     * the default `InMemoryShortCodeIndex` — typically the caller passes
+     * `SqliteShortCodeIndex` rooted under `persistentDir` so cached
+     * `/api/bootstrap/<code>` URLs (and the `/r/<code>` viewer) keep
+     * resolving after a `ggui serve` restart. Without that, the index
+     * is process-local and every restart turns prior shortCodes into
+     * 404s — defeating the bootstrap-secret persistence above.
+     *
+     * Absent = `InMemoryShortCodeIndex` (the legacy default, fine for
+     * tests + `--ephemeral`). The CLI composes this via
+     * `createPersistentShortCodeIndex(persistentDir)` in cli.ts so the
+     * sqlite peer-dep loads lazily.
+     */
+    readonly shortCodeIndex?: ShortCodeIndex;
+    /**
+     * Operator-pinned admin token gating the console `/keys` plane.
+     * When omitted, the server mints a fresh `ggui_admin_*` token on
+     * boot and surfaces it via `GguiServer.adminToken`. The CLI banner
+     * prints whichever value ended up in effect so the operator can
+     * paste it into `/admin-login`.
+     *
+     * Surface = `--admin-token <token>` CLI flag.
+     */
+    readonly adminToken?: string;
+    /**
+     * Server-rendered public welcome page at `/`. Identifies who runs
+     * the server (operator block, hidden when nothing configured)
+     * and links to the public deep-link surfaces + operator login.
+     *
+     * The CLI's `serve-command.ts` resolves this from
+     * `ggui.json#operator` + `ggui.json#app.name`. Programmatic hosts
+     * pass whatever fits their context. Omitted = no welcome page;
+     * the SPA index handler still owns `/`.
+     */
+    readonly welcomePage?: {
+        readonly operator?: OperatorConfig;
+        readonly appName?: string;
+    };
+    /**
+     * Per-app gadget catalog from `ggui.json#app.gadgets`.
+     * Gadgets (Leaflet, Mapbox, …) declared
+     * here populate `App.gadgets` so the
+     * `assertGadgetsRegistered` validator (push, ops_register,
+     * ops_generate) accepts contracts that reference them.
+     *
+     * Omitted ⇒ `STDLIB_GADGETS` defaults from
+     * `@ggui-ai/protocol` apply (the 7 first-party hooks).
+     */
+    readonly gadgets?: readonly GadgetDescriptor[];
+    /**
+     * Operator-stamped public env channel from
+     * `ggui.json#app.publicEnv`. Each key MUST match
+     * `^GGUI_PUBLIC_APP_[A-Z0-9_]+$`. The server projects only the keys
+     * that some registered wrapper's `requires` references, onto
+     * `_meta.ggui.bootstrap.publicEnv` and ultimately
+     * `globalThis.__ggui__.publicEnv` for `getPublicEnv()` to read.
+     *
+     * Omitted ⇒ field absent on the App record (no values projected;
+     * wrappers without `requires` still mount, wrappers with `requires`
+     * fail at push-gate validation).
+     */
+    readonly publicEnv?: Readonly<Record<string, string>>;
+    /**
+     * Per-app MCP-Apps presentation mode from
+     * `ggui.json#app.defaultMcpAppsMode`. `'canvas'` makes
+     * `ggui_new_session` mint a session-scoped iframe
+     * (`ui://ggui/session/<sessionId>`) and route subsequent pushes
+     * through the session channel; `'inline'` (or omitted) preserves
+     * the per-push-iframe legacy behavior.
+     */
+    readonly defaultMcpAppsMode?: McpAppsMode;
+}
+/**
+ * Pick a free localhost TCP port by letting the OS assign one on a
+ * throwaway listener. Close the listener immediately and return the
+ * chosen number. Exported so the CLI (`cli.ts::runServeCommand`) and
+ * the integration tests can resolve `--port 0` to a concrete port
+ * BEFORE constructing the backend — {@link buildMcpServerBackend}
+ * captures the port in the composed `mcpApps.renderBaseUrl` / `wsUrl`
+ * at construction time, so the caller must know it up-front.
+ *
+ * Tiny race window: another process could claim the port between our
+ * `close()` and the caller's `listen()`. The CLI surfaces bind errors
+ * as a fatal exit; the OSS first-run path recovers by re-running.
+ */
+export declare function pickFreePort(host?: string): Promise<number>;
+/**
+ * Build the `ServeBackend` that `runServe` drives. Returns a thin
+ * adapter around `createGguiServer` — the factory is invoked here so
+ * preconditions that throw (e.g. missing auth bridge support for
+ * `pairing: true`) surface synchronously, before `runServe` bothers
+ * binding a port.
+ */
+export declare function buildMcpServerBackend(opts: BuildMcpServerBackendOptions): ServeBackend;
+//# sourceMappingURL=mcp-backend.d.ts.map

package/dist/mcp-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAUL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,0BAA0B,EAE/B,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAevD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAQ1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM;QAC7B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GAAG,SAAS,CAAC;IACd;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAC7B,IAAI,EACA,MAAM,GACN;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC/E;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACzC,IAAI,KACL,IAAI,CAAC;IACV;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EACrB,SAAS,GACT,YAAY,GACZ,QAAQ,GACR,SAAS,GACT,KAAK,CAAC;IAEV;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC;CAC3C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,4BAA4B,GACjC,YAAY,CAimBd"}