@ggui-ai/mcp-server 0.1.0-rc.1

package/dist/oauth.d.ts

@@ -0,0 +1,347 @@
+/**
+ * OAuth 2.1 + PKCE + Dynamic Client Registration for the MCP server.
+ *
+ * Implements the auth flow MCP clients (Claude Desktop, claude.ai,
+ * Goose, etc.) expect from a remote MCP server per spec 2025-06-18+.
+ *
+ * ## Flow
+ *
+ *   1. Client hits `/mcp` without auth → 401 with
+ *      `WWW-Authenticate: Bearer resource_metadata="<url>"`.
+ *   2. Client fetches the resource metadata
+ *      (`/.well-known/oauth-protected-resource`, RFC 9728) → discovers
+ *      the authorization server URL.
+ *   3. Client fetches the auth server metadata
+ *      (`/.well-known/oauth-authorization-server`, RFC 8414) →
+ *      discovers `authorize` / `token` / `register` endpoints.
+ *   4. Client POSTs to `/oauth/register` (RFC 7591 Dynamic Client
+ *      Registration) → server returns a random `client_id`. PKCE-only,
+ *      so no `client_secret` is issued.
+ *   5. Client redirects user-agent to `/oauth/authorize?...&code_challenge=...`
+ *      → server renders an HTML page asking the user to paste their
+ *      `ggui_user_*` API key.
+ *   6. User pastes key + submits → server validates the key against the
+ *      configured {@link AuthAdapter} (same adapter that gates `/mcp`),
+ *      mints an authorization code, redirects back to the client's
+ *      `redirect_uri` with `?code=...`.
+ *   7. Client POSTs to `/oauth/token` with `code` + `code_verifier` →
+ *      server validates PKCE, returns the user's `ggui_user_*` key as
+ *      the `access_token`.
+ *   8. Client retries `/mcp` with `Authorization: Bearer ggui_user_*`
+ *      → existing `ApiKeyAuthAdapter` accepts it. ✅
+ *
+ * ## Why the access token IS the API key
+ *
+ * The simplest possible bridge between MCP's OAuth-required client UX
+ * and ggui's existing API-key auth model. No parallel token table, no
+ * key→token translation in the request hot path, no token-refresh
+ * dance. The "OAuth flow" becomes a one-time ceremony Claude Desktop
+ * runs to capture the user's already-minted key into its own credential
+ * storage. After that, every `/mcp` request is identical to a CLI call
+ * with `Authorization: Bearer ggui_user_*`.
+ *
+ * Trade-off: the access token TTL = the API key TTL. If the user
+ * revokes the key, Claude Desktop's stored token stops working at the
+ * next request (intended: revocation works without OAuth-specific
+ * machinery). No refresh token issued — re-auth means re-running the
+ * OAuth ceremony, which is a one-paste step.
+ *
+ * ## Storage
+ *
+ * Auth codes + DCR clients live in-memory ({@link InMemoryOAuthStorage}).
+ * For multi-replica deployments (e.g. `mcp.ggui.ai` with 2+ pods),
+ * either:
+ *   - Use nginx-ingress sticky sessions so the same pod handles both
+ *     `/oauth/authorize` and `/oauth/token` (current sandbox posture).
+ *   - Plug a Redis-backed {@link OAuthStorage} via the
+ *     `oauth.storage` config option (production posture).
+ *
+ * DCR clients are short-lived in practice — Claude Desktop registers
+ * once per install + caches the `client_id`. A pod restart drops all
+ * registrations; clients re-register transparently on next failure.
+ */
+import type { Request, Response } from 'express';
+import type { AuthAdapter, PairingService } from '@ggui-ai/mcp-server-core';
+export interface OAuthConfig {
+    /**
+     * Public origin of this server (e.g. `https://mcp.ggui.ai`). Used in
+     * discovery metadata, `WWW-Authenticate` headers, and OAuth redirects.
+     * Should NOT have a trailing slash. When absent, the server derives
+     * it from the request's `Host` header — fine for most deployments,
+     * fragile when a proxy rewrites the host.
+     */
+    readonly issuerUrl?: string;
+    /**
+     * Storage seam for auth codes + DCR clients. Defaults to
+     * {@link InMemoryOAuthStorage} — works for single-replica dev + any
+     * deployment with sticky sessions. Replace with a Redis/DDB-backed
+     * implementation for stateless multi-replica deployments.
+     */
+    readonly storage?: OAuthStorage;
+    /**
+     * External consent UI to delegate the user-facing approval step to
+     * (e.g. `https://console.ggui.ai/oauth/consent`). When set,
+     * `GET /oauth/authorize` returns a 302 to this URL with every OAuth
+     * query param forwarded verbatim — the consent UI then constructs an
+     * HTML form that POSTs back to `<issuer>/oauth/authorize` with the
+     * user's chosen `api_key`.
+     *
+     * Trade-off: the consent UI sees every OAuth param + the user's
+     * Cognito session — it MUST be operator-controlled (same trust
+     * boundary as the MCP server itself). Cross-origin POST is fine
+     * (form-encoded → no CORS preflight); the response is a 302 to the
+     * client's `redirect_uri` which the browser follows transparently.
+     *
+     * Absence: `GET /oauth/authorize` falls back to the in-server
+     * paste-key HTML page. Useful for OSS deployers who don't want to
+     * stand up a separate consent UI; the form works but is unbranded.
+     */
+    readonly consentUrl?: string;
+    /**
+     * RFC 8707 resource indicator validator. Receives
+     * the resolved `issuer` URL plus the client-supplied `resource`
+     * query param value; returns `true` when `resource` names a valid
+     * MCP endpoint on this deployment, `false` otherwise.
+     *
+     * For ggui this gates two shapes:
+     *   - Universal: `${issuer}` (cloud bare root) or
+     *     `${issuer}${universalMcpPath}` (OSS `/mcp`).
+     *   - Per-app:   `${issuer}${perAppRouting.pathPrefix}/<appId>`
+     *     where `<appId>` matches `perAppRouting.paramPattern`.
+     *
+     * server.ts builds this validator at boot from the deployment shape
+     * (universalMcpPath + perAppRouting); the OAuth handlers stay
+     * deployment-agnostic. When omitted, the resource param is accepted
+     * as-is without validation — fine for OSS deployments that don't
+     * advertise per-app endpoints.
+     *
+     * RFC 8707 §2 — auth servers SHOULD reject unknown resources with
+     * `invalid_target`. We do that at /authorize time so the user sees
+     * a clear error before the consent step (vs. silently issuing a
+     * code that then fails at /token).
+     */
+    readonly validateResource?: (issuer: string, resource: string) => boolean;
+}
+export interface AuthCodeRecord {
+    readonly code: string;
+    /**
+     * The user's `ggui_user_*` API key — returned verbatim as the
+     * `access_token` on `/oauth/token` exchange. The auth code is the
+     * server-side handle that prevents the key from leaking through the
+     * redirect URL (which logs / referers can capture).
+     */
+    readonly accessToken: string;
+    /** PKCE — `S256(code_verifier)` computed at /authorize time. */
+    readonly codeChallenge: string;
+    /** Redirect URI the client claimed at /authorize — must match at /token. */
+    readonly redirectUri: string;
+    /** Client id from DCR. */
+    readonly clientId: string;
+    /** Unix epoch ms — codes expire after 5 minutes. */
+    readonly expiresAt: number;
+    /**
+     * RFC 8707 resource indicator. Captured at
+     * /authorize time; if the /token request includes a `resource`
+     * parameter, it MUST equal this value (RFC 8707 §2.2). Absent
+     * when the client didn't claim a specific resource — universal
+     * scoping applies.
+     *
+     * Storage shape note: persisted on the auth-code row only. Tokens
+     * issued by /token are opaque static keys (`ggui_user_*`); the
+     * appId-from-resource binding is enforced at the auth-code →
+     * token boundary, not via JWT claims. Runtime appId resolution
+     * keeps reading the key shape (`UserKey.appId` from the
+     * `GguiUserApiKey` row).
+     */
+    readonly resource?: string;
+}
+export interface ClientRecord {
+    readonly clientId: string;
+    readonly redirectUris: readonly string[];
+    /** Optional human-readable label from DCR `client_name`. */
+    readonly clientName?: string;
+    /** Unix epoch ms — for cleanup; clients have no hard expiry. */
+    readonly createdAt: number;
+    /**
+     * RFC 8707 resource indicator from this client's most recent
+     * `/oauth/authorize` request (Q7 RESOLVED 2026-05-06). Captured
+     * each time `handleAuthorizePost` consumes the params — surfaces
+     * "Connected to: <App>" on the operator's Connected Apps console
+     * once that surface goes live. DCR itself doesn't carry resource
+     * (clients don't know their target at registration time); per-app
+     * resource is a per-/authorize-request property, so we snapshot
+     * the latest one onto the client record for display.
+     *
+     * Absent when the client never used a resource indicator (universal
+     * scoping). Absent on pre-2026-05-06 records (graceful undefined
+     * rather than null/empty-string) — operators see "Universal" in
+     * the UI for those.
+     */
+    readonly lastResource?: string;
+    /**
+     * Unix epoch ms of the most recent `/oauth/authorize` POST that
+     * referenced this client. Pairs with {@link lastResource} for
+     * "last seen" UI hints. Distinct from `createdAt` (DCR registration
+     * time) — a client may have registered weeks ago but only just
+     * now run its first authorize.
+     */
+    readonly lastAuthorizeAt?: number;
+}
+/**
+ * Storage interface for OAuth state. Two collections:
+ *   - **Auth codes** (short-lived, single-use): one-time tokens
+ *     returned from /authorize, exchanged at /token for an access token.
+ *   - **DCR clients** (long-lived): registered via /oauth/register,
+ *     identifies which client is making subsequent OAuth requests.
+ *
+ * `listClients` + `deleteClient` back the console's "Connected Apps"
+ * management surface so operators can see who registered + revoke
+ * stale entries without a server restart.
+ *
+ * **Revocation semantics on `deleteClient`:** removes the
+ * registration only. In-flight access tokens minted under that
+ * client_id are NOT invalidated here (in the current paste-key flow
+ * `access_token === paired_bearer`, so cutting the bearer means
+ * cutting EVERYONE). Revoking only stops future `/oauth/register`
+ * re-discovery and `/oauth/token` exchanges from that client. This is
+ * documented at the console route level.
+ */
+export interface OAuthStorage {
+    putAuthCode(record: AuthCodeRecord): Promise<void>;
+    /** Atomic fetch-and-delete (single-use enforcement). */
+    consumeAuthCode(code: string): Promise<AuthCodeRecord | null>;
+    putClient(record: ClientRecord): Promise<void>;
+    getClient(clientId: string): Promise<ClientRecord | null>;
+    /**
+     * List every registered DCR client, sorted oldest-first by
+     * `createdAt`. Operator-facing; the console's Connected Apps tab
+     * paints from this. Empty array when no clients have registered
+     * yet.
+     */
+    listClients(): Promise<readonly ClientRecord[]>;
+    /**
+     * Delete a single client registration by `clientId`. Idempotent —
+     * deleting an unknown id resolves cleanly (no error, no state
+     * change). See {@link OAuthStorage} doc for the in-flight-token
+     * caveat.
+     */
+    deleteClient(clientId: string): Promise<void>;
+}
+export declare class InMemoryOAuthStorage implements OAuthStorage {
+    private readonly codes;
+    private readonly clients;
+    putAuthCode(record: AuthCodeRecord): Promise<void>;
+    consumeAuthCode(code: string): Promise<AuthCodeRecord | null>;
+    putClient(record: ClientRecord): Promise<void>;
+    getClient(clientId: string): Promise<ClientRecord | null>;
+    listClients(): Promise<readonly ClientRecord[]>;
+    deleteClient(clientId: string): Promise<void>;
+}
+/**
+ * Resolve the public origin for OAuth metadata. Prefer the configured
+ * {@link OAuthConfig.issuerUrl} (operator-controlled, deterministic);
+ * fall back to deriving from the request's forwarded headers (works
+ * behind nginx-ingress + ALB which both set X-Forwarded-Proto / -Host).
+ */
+export declare function resolveIssuerUrl(req: Request, configured?: string): string;
+/**
+ * Build the `WWW-Authenticate` header value pointing at the resource-
+ * metadata document. Per RFC 9728 §5, MCP-aware clients fetch this URL
+ * to discover the authorization server.
+ *
+ * `resourcePath` (default `''`) is the path prefix the per-app metadata
+ * lives under — e.g. `/apps/aB3kP9xY` → header points at
+ * `${issuer}/apps/aB3kP9xY/.well-known/oauth-protected-resource` so a
+ * client that 401'd on a per-app endpoint discovers the per-app
+ * metadata document. Empty string preserves the
+ * universal-only behavior — `${issuer}/.well-known/...` — used by the
+ * universal `/mcp` route, the auth-check probe, and OSS deployments
+ * without per-app routing.
+ *
+ * Caller must supply a leading slash (or empty string). Trailing slash
+ * is normalized off so callers can pass either `/apps/x` or
+ * `/apps/x/` interchangeably.
+ */
+export declare function buildWwwAuthenticate(issuerUrl: string, resourcePath?: string): string;
+/**
+ * `GET /.well-known/oauth-protected-resource` — RFC 9728 metadata that
+ * tells the client where to find the authorization server. Same origin
+ * in our case (we host both the resource AND the auth server).
+ *
+ * `mcpPath` (default `/mcp`) is the deployment's universal MCP route.
+ * Cloud `mcp.ggui.ai` mounts at the bare root `/` so URLs are short
+ * (the domain already says "mcp"); OSS keeps the conventional `/mcp`.
+ * The trailing slash is normalized off when the path is `/` so the
+ * resource URL is `${issuer}` (no trailing slash) rather than
+ * `${issuer}/`.
+ */
+export declare function handleProtectedResourceMetadata(req: Request, res: Response, config: OAuthConfig, mcpPath?: string): void;
+/**
+ * `GET /.well-known/oauth-authorization-server` — RFC 8414 metadata
+ * describing this auth server's capabilities + endpoints.
+ */
+export declare function handleAuthorizationServerMetadata(req: Request, res: Response, config: OAuthConfig): void;
+/**
+ * `POST /oauth/register` — RFC 7591 Dynamic Client Registration. Issues
+ * a random `client_id`. No `client_secret` (PKCE-only). Accepts arbitrary
+ * `redirect_uris` from the client without validation against an allowlist
+ * — the trade-off matches the MCP spec's pragmatism: any client willing
+ * to do PKCE + paste-key gets registered.
+ */
+export declare function handleRegister(req: Request, res: Response, config: OAuthConfig, storage: OAuthStorage): Promise<void>;
+/**
+ * `GET /oauth/authorize` — render the paste-key form. Query params
+ * (per OAuth 2.1 + PKCE):
+ *   - `client_id` — from DCR
+ *   - `redirect_uri` — must match one registered at DCR time
+ *   - `response_type=code`
+ *   - `code_challenge` — base64url(SHA256(code_verifier))
+ *   - `code_challenge_method=S256`
+ *   - `state` — opaque, echoed back to client
+ *   - `scope` — ignored (we don't gate by scope today)
+ *
+ * The page is intentionally minimal — server-rendered HTML, no JS
+ * required, no external CDN. The form POSTs back to `/oauth/authorize`
+ * with the user's pasted key.
+ */
+export declare function handleAuthorizeGet(req: Request, res: Response, config: OAuthConfig, storage: OAuthStorage): Promise<void>;
+/**
+ * `POST /oauth/authorize` — handle paste-key form submission. Validates
+ * the key against the configured {@link AuthAdapter} (same one that
+ * gates `/mcp`), mints an auth code, redirects to client's
+ * `redirect_uri` with `?code=...&state=...`.
+ *
+ * Validation flow:
+ *   1. Re-validate the OAuth params (defense — caller could skip /GET).
+ *   2. Resolve the pasted key through `auth.authenticate()` — accepts
+ *      any key the adapter accepts. For ggui this means `ggui_user_*`
+ *      keys validated against `GguiUserApiKey` table via the existing
+ *      `lookupUser` binding.
+ *   3. On success: write {code, accessToken=key, codeChallenge,
+ *      redirectUri, clientId} to storage. 5-minute TTL.
+ *   4. Redirect to `redirect_uri?code=<code>&state=<state>`.
+ *   5. On bad key: re-render the page with an error message (preserves
+ *      OAuth params).
+ */
+export declare function handleAuthorizePost(req: Request, res: Response, config: OAuthConfig, storage: OAuthStorage, auth: AuthAdapter, pairingService?: PairingService | null): Promise<void>;
+/**
+ * `POST /oauth/token` — exchange auth code for access token. RFC 6749
+ * §4.1.3 + RFC 7636 (PKCE).
+ *
+ * Request body (form-urlencoded or JSON):
+ *   - `grant_type=authorization_code`
+ *   - `code` — from the redirect
+ *   - `redirect_uri` — must match what was passed at /authorize
+ *   - `client_id` — from DCR
+ *   - `code_verifier` — PKCE verifier (raw, server hashes + compares)
+ *
+ * Response:
+ *   - `access_token` — the user's `ggui_user_*` key (stored from /authorize)
+ *   - `token_type=Bearer`
+ *   - `expires_in` — omitted; key TTL matches the underlying API key
+ *
+ * Errors per RFC 6749 §5.2 — JSON body with `{error, error_description}`,
+ * 400 status code.
+ */
+export declare function handleToken(req: Request, res: Response, storage: OAuthStorage): Promise<void>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO5E,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAEhC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3E;AAMD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0BAA0B;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,wDAAwD;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,WAAW,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAChD;;;;;OAKG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAErD,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQ7D,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIzD,WAAW,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAU/C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpD;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK1E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,GAAE,MAAW,GACxB,MAAM,CAIR;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,MAAe,GACvB,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,GAClB,IAAI,CAaN;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,WAAW,EACjB,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,GACrC,OAAO,CAAC,IAAI,CAAC,CAoHf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAiFf"}