@jini-ai/mcp 0.1.0

package/dist/core/install-info.js

@@ -0,0 +1,79 @@
+/**
+ * @module @jini-ai/mcp/core/install-info
+ * Pure builder for the MCP install-info payload (command/args/env) shared by the
+ * daemon route, the settings UI, and its test fixture, so every install surface
+ * configures byte-identical bytes. Part of the MCP `core` kernel; intentionally
+ * side-effect-free and depends on no sibling subdirectory.
+ */
+// Pure builder for the MCP install-info payload. Extracted from the HTTP
+// handler so the test fixture and the production handler share the exact
+// env/argv/buildHint shape; a divergence here is the difference between an
+// MCP snippet that works and one that EPERMs out when pasted into an IDE
+// (Antigravity / Cursor / VS Code), or silently misses the sidecar
+// transport endpoint.
+//
+// Side effects (fs.existsSync probes, process.execPath, the
+// ELECTRON_RUN_AS_NODE env read, data-dir resolution, sidecar IPC
+// detection) all stay in the caller. This module is intentionally pure so
+// it can be unit-tested without booting a daemon.
+/**
+ * Build the `McpInstallPayload` from resolved runtime facts.
+ * Decides whether to bake `--daemon-url` into args (direct launch) or omit it
+ * (sidecar mode, where the spawned process discovers the URL via the IPC socket).
+ * Also pins the data-dir env var to prevent EPERM failures in packaged installs
+ * and injects `ELECTRON_RUN_AS_NODE=1` when running under Electron.
+ * @param inputs Runtime facts collected by the production route or test fixture.
+ * @returns The install payload; `buildHint` is non-null when prerequisites are missing.
+ */
+export function buildMcpInstallPayload(inputs) {
+    const subcommand = inputs.subcommand ?? 'mcp';
+    const hints = [];
+    if (!inputs.cliExists) {
+        hints.push(`CLI entry is missing at ${inputs.cliPath}. Rebuild the daemon or packaged app and refresh.`);
+    }
+    if (!inputs.nodeExists) {
+        hints.push(`Node-compatible runtime at ${inputs.execPath} no longer exists. Reinstall the runtime and restart the daemon.`);
+    }
+    // Pin the data-dir env var to the daemon's resolved data root so the
+    // spawned MCP process writes to the same directory the daemon already
+    // uses even when the IDE that launched it does not inherit the packaged
+    // app's environment. Without this, the process falls back to a
+    // per-cwd data dir which for packaged installs can be a read-only app
+    // bundle that trips EPERM.
+    const env = {
+        [inputs.dataDirEnvVar]: inputs.dataDir,
+        ...inputs.sidecarEnv,
+    };
+    if (inputs.electronAsNode) {
+        env.ELECTRON_RUN_AS_NODE = '1';
+    }
+    // Sidecar mode: omit --daemon-url so the spawned MCP process discovers
+    // the live URL via the IPC status socket on every spawn, surviving
+    // ephemeral-port restarts. Direct launches have no socket and need the
+    // URL baked.
+    const args = inputs.isSidecarMode
+        ? [inputs.cliPath, subcommand]
+        : [
+            inputs.cliPath,
+            subcommand,
+            '--daemon-url',
+            `http://127.0.0.1:${inputs.port}`,
+        ];
+    return {
+        command: inputs.execPath,
+        args,
+        env,
+        daemonUrl: `http://127.0.0.1:${inputs.port}`,
+        webBaseUrl: typeof inputs.webBaseUrl === 'string' && inputs.webBaseUrl.length > 0
+            ? inputs.webBaseUrl
+            : null,
+        // Surface platform so the install panel can localize path hints
+        // (~/.cursor vs %USERPROFILE%\.cursor) and keyboard shortcuts
+        // (Cmd vs Ctrl).
+        platform: inputs.platform,
+        cliExists: inputs.cliExists,
+        nodeExists: inputs.nodeExists,
+        buildHint: hints.length ? hints.join(' ') : null,
+    };
+}
+//# sourceMappingURL=install-info.js.map

package/dist/core/install-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-info.js","sourceRoot":"","sources":["../../src/core/install-info.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,mEAAmE;AACnE,sBAAsB;AACtB,EAAE;AACF,4DAA4D;AAC5D,kEAAkE;AAClE,0EAA0E;AAC1E,kDAAkD;AAuDlD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAoC;IAEpC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,2BAA2B,MAAM,CAAC,OAAO,mDAAmD,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,8BAA8B,MAAM,CAAC,QAAQ,kEAAkE,CAChH,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,+DAA+D;IAC/D,sEAAsE;IACtE,2BAA2B;IAC3B,MAAM,GAAG,GAA2B;QAClC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,OAAO;QACtC,GAAG,MAAM,CAAC,UAAU;KACrB,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC;IACjC,CAAC;IACD,uEAAuE;IACvE,mEAAmE;IACnE,uEAAuE;IACvE,aAAa;IACb,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa;QAC/B,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC;QAC9B,CAAC,CAAC;YACE,MAAM,CAAC,OAAO;YACd,UAAU;YACV,cAAc;YACd,oBAAoB,MAAM,CAAC,IAAI,EAAE;SAClC,CAAC;IACN,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,IAAI;QACJ,GAAG;QACH,SAAS,EAAE,oBAAoB,MAAM,CAAC,IAAI,EAAE;QAC5C,UAAU,EACR,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,IAAI;QACV,gEAAgE;QAChE,8DAA8D;QAC9D,iBAAiB;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;KACjD,CAAC;AACJ,CAAC"}

package/dist/core/oauth.d.ts

@@ -0,0 +1,274 @@
+/**
+ * @module @jini-ai/mcp/core/oauth
+ * Daemon-side OAuth 2.1 / PKCE client for remote (HTTP / SSE) MCP servers:
+ * auth-server discovery, dynamic client registration, the authorize/token/refresh
+ * exchanges, and the in-memory `PendingAuthCache`. Part of the MCP `core` kernel;
+ * depends on no sibling subdirectory.
+ */
+import { createValidatingLookup } from '@jini-ai/platform';
+/** RFC 9728 `oauth-protected-resource` document fields we use. */
+export interface ProtectedResourceMetadata {
+    resource?: string;
+    authorization_servers?: string[];
+    scopes_supported?: string[];
+}
+/** RFC 8414 / OIDC discovery document fields we use. */
+export interface AuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint?: string;
+    scopes_supported?: string[];
+    response_types_supported?: string[];
+    grant_types_supported?: string[];
+    code_challenge_methods_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+}
+/** Cached client registration for a given auth server + redirect URI. */
+export interface RegisteredClient {
+    authServerIssuer: string;
+    redirectUri: string;
+    clientId: string;
+    clientSecret?: string;
+    registeredAt: number;
+}
+/** RFC 6749 §5.1 token endpoint response (subset). */
+export interface OAuthTokenResponse {
+    access_token: string;
+    token_type?: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+}
+/** In-flight authorization request. Stashed in memory while the user
+ * approves in their browser. */
+export interface PendingAuthState {
+    serverId: string;
+    authServerIssuer: string;
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    codeVerifier: string;
+    scope?: string;
+    resourceUrl?: string;
+    createdAt: number;
+}
+type DnsLookupCb = Parameters<typeof createValidatingLookup>[0];
+/**
+ * Read a response body up to `maxBytes`, aborting `controller` (when given)
+ * and throwing the moment the cap is exceeded rather than buffering an
+ * unbounded body first. Falls back to a single `res.text()` call (tolerant
+ * of a throw, matching the old `safeText`'s forgiving error-path behavior)
+ * for response-like test doubles that don't expose a real `ReadableStream`
+ * body.
+ *
+ * `controller` is real, intentional API surface — a caller that already has
+ * an in-flight fetch's `AbortController` can pass it so an oversized
+ * response stops being pulled from upstream the moment the cap is exceeded,
+ * not merely rejected after the fact — but no real call site in this file
+ * currently has one in scope to pass (each of the four call sites reads a
+ * `Response` it received after its own `safeOAuthFetch` call already
+ * returned, by which point that call's own `AbortController` is out of
+ * scope). Exported (not just internal) so this real, functioning behavior
+ * is directly unit-testable without inventing an unused call site just to
+ * reach it — matching this repo's established "extract into a directly-
+ * testable pure function" convention.
+ */
+export declare function readCappedText(res: Response, maxBytes: number, controller?: AbortController): Promise<string>;
+/**
+ * Generate a cryptographically random PKCE code verifier (RFC 7636 §4.1).
+ * Produces a 64-byte base64url-encoded string, within the 43–128 character range.
+ * @returns A fresh code verifier string for use in a single authorization request.
+ */
+export declare function generateCodeVerifier(): string;
+/**
+ * Derive the S256 PKCE code challenge from a code verifier (RFC 7636 §4.2).
+ * Computes `BASE64URL(SHA256(ASCII(verifier)))`.
+ * @param verifier The code verifier string produced by `generateCodeVerifier`.
+ * @returns The base64url-encoded SHA-256 hash to pass as `code_challenge`.
+ */
+export declare function deriveCodeChallenge(verifier: string): string;
+/**
+ * Generate a cryptographically random OAuth `state` parameter.
+ * Used as the CSRF token for the authorization request; must be unique per flow.
+ * @returns A base64url-encoded 32-byte random string.
+ */
+export declare function generateState(): string;
+/**
+ * Try to fetch the protected-resource metadata for a given MCP URL.
+ *
+ * Per RFC 9728, the well-known is at the resource origin's
+ * `/.well-known/oauth-protected-resource[<path>]`. We try both the
+ * path-suffixed form and the bare `/.well-known/...` so servers that
+ * only publish at the root still work.
+ *
+ * @param lookupImpl Injectable `dns.lookup` for the connection-time SSRF
+ *   guard (tests only — see `safeOAuthFetch`).
+ */
+export declare function discoverProtectedResource(resourceUrl: string, fetchImpl?: typeof fetch, lookupImpl?: DnsLookupCb): Promise<ProtectedResourceMetadata | null>;
+/**
+ * Fetch the authorization-server metadata for an issuer URL. Tries both
+ * the OAuth (RFC 8414) and OIDC layouts (`/.well-known/oauth-authorization-server`
+ * and `/.well-known/openid-configuration`); some providers only publish one.
+ *
+ * Per RFC 8414 §3.3, a discovery document's `issuer` — when present — MUST
+ * match the issuer used to construct the request; a mismatched document is
+ * rejected rather than trusted (SEC-RB-001 / CR-005). Every endpoint the
+ * document names (`authorization_endpoint`, `token_endpoint`,
+ * `registration_endpoint`) is additionally required to be an absolute
+ * `https:` URL sharing the queried issuer's own origin, so a compromised or
+ * hostile document can't redirect DCR or token exchange at an unrelated
+ * origin.
+ *
+ * @param lookupImpl Injectable `dns.lookup` for the connection-time SSRF
+ *   guard (tests only — see `safeOAuthFetch`).
+ */
+export declare function discoverAuthServer(issuer: string, fetchImpl?: typeof fetch, lookupImpl?: DnsLookupCb): Promise<AuthorizationServerMetadata | null>;
+/**
+ * POST to the auth server's `registration_endpoint` per RFC 7591. Returns
+ * a freshly issued client_id (and optional client_secret). Caller is
+ * responsible for caching the result.
+ * @param lookupImpl Injectable `dns.lookup` for the connection-time SSRF
+ *   guard (tests only — see `safeOAuthFetch`).
+ */
+export declare function registerClient(registrationEndpoint: string, redirectUri: string, fetchImpl?: typeof fetch, lookupImpl?: DnsLookupCb): Promise<{
+    clientId: string;
+    clientSecret?: string;
+}>;
+/**
+ * Cached version of `registerClient`. Looks up `(authServerIssuer, redirectUri)`
+ * in the cache file and re-uses the existing client; falls back to a fresh
+ * DCR call when nothing is cached.
+ * @param lookupImpl Injectable `dns.lookup` for the connection-time SSRF
+ *   guard (tests only — see `safeOAuthFetch`).
+ */
+export declare function getOrRegisterClient(dataDir: string, authServer: AuthorizationServerMetadata, redirectUri: string, fetchImpl?: typeof fetch, lookupImpl?: DnsLookupCb): Promise<RegisteredClient>;
+/** Inputs required to assemble the authorization redirect URL. */
+export interface AuthorizeUrlInput {
+    authServer: AuthorizationServerMetadata;
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+    scope?: string;
+    /** RFC 8707 resource indicator — narrows the issued token to the target MCP server. */
+    resource?: string;
+}
+/**
+ * Assemble the authorization endpoint URL the user's browser must be directed to.
+ * Sets PKCE parameters (`code_challenge`, `code_challenge_method=S256`), the `state`
+ * CSRF token, and optionally the RFC 8707 `resource` indicator.
+ * @param input All parameters needed to build the URL.
+ * @returns The fully-qualified authorization URL as a string.
+ */
+export declare function buildAuthorizeUrl(input: AuthorizeUrlInput): string;
+/** Inputs for the authorization-code → token exchange (RFC 6749 §4.1.3). */
+export interface ExchangeCodeInput {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    code: string;
+    codeVerifier: string;
+    /** RFC 8707 resource indicator to include in the token request. */
+    resource?: string;
+}
+/**
+ * Exchange an authorization code for access and refresh tokens (RFC 6749 §4.1.3).
+ * Includes the PKCE `code_verifier` and, when supplied, the RFC 8707 `resource`
+ * indicator. Throws when the token endpoint returns a non-2xx status.
+ * @param input The code-exchange parameters.
+ * @param fetchImpl Injectable fetch, defaults to the global `fetch`.
+ * @param lookupImpl Injectable `dns.lookup` for the connection-time SSRF
+ *   guard (tests only — see `safeOAuthFetch`).
+ * @returns The token endpoint response containing at least an `access_token`.
+ */
+export declare function exchangeCodeForToken(input: ExchangeCodeInput, fetchImpl?: typeof fetch, lookupImpl?: DnsLookupCb): Promise<OAuthTokenResponse>;
+/** Inputs for the refresh-token → new-access-token exchange (RFC 6749 §6). */
+export interface RefreshTokenInput {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    refreshToken: string;
+    scope?: string;
+    /** RFC 8707 resource indicator, included when the original token was resource-scoped. */
+    resource?: string;
+}
+/**
+ * Exchange a refresh token for a new access token (RFC 6749 §6).
+ * Preserves scope and resource binding from the original authorization.
+ * Throws when the token endpoint returns a non-2xx status.
+ * @param input The refresh parameters.
+ * @param fetchImpl Injectable fetch, defaults to the global `fetch`.
+ * @param lookupImpl Injectable `dns.lookup` for the connection-time SSRF
+ *   guard (tests only — see `safeOAuthFetch`).
+ * @returns A fresh `OAuthTokenResponse`; the server may issue a new refresh token.
+ */
+export declare function refreshAccessToken(input: RefreshTokenInput, fetchImpl?: typeof fetch, lookupImpl?: DnsLookupCb): Promise<OAuthTokenResponse>;
+/**
+ * The OAuth dance is split across two HTTP requests on our side:
+ *   1. the "start" request                 — we mint state + verifier
+ *   2. the "callback" request              — browser returns code + state
+ * State has to survive between (1) and (2) on the daemon. We keep it in a
+ * Map with a TTL sweeper; persistence isn't needed because the user has
+ * to complete auth in the same daemon process anyway (state is single-use).
+ */
+export declare class PendingAuthCache {
+    private readonly ttlMs;
+    private store;
+    private timer;
+    constructor(ttlMs?: number);
+    /**
+     * Store a pending auth state keyed by the OAuth `state` parameter.
+     * Starts the TTL sweeper if it is not already running.
+     * @param state The random `state` string from the authorization request.
+     * @param value The associated pending auth metadata to stash.
+     */
+    put(state: string, value: PendingAuthState): void;
+    /** One-shot consume — any successful callback removes the state so a
+     * replay can't reuse it. */
+    consume(state: string): PendingAuthState | null;
+    /** Return the number of pending auth states currently held in the cache. */
+    size(): number;
+    /** Stop the background sweeper. Used by tests; production lets the
+     * timer ride on the process lifetime. */
+    stop(): void;
+    private startSweeper;
+    private sweep;
+}
+/** Inputs for the full pre-redirect OAuth dance. */
+export interface BeginAuthInput {
+    /** The `McpServerConfig.id` of the server being authorized. */
+    serverId: string;
+    /** The MCP server endpoint URL (used for protected-resource discovery). */
+    serverUrl: string;
+    /** The OAuth redirect URI the daemon has registered. */
+    redirectUri: string;
+    /** The resolved data directory (for caching the client registration). */
+    dataDir: string;
+    scope?: string;
+    /** Injectable fetch implementation; defaults to the global `fetch`. */
+    fetchImpl?: typeof fetch;
+    /** Injectable `dns.lookup` for the connection-time SSRF guard (tests only). */
+    lookupImpl?: DnsLookupCb;
+}
+/** Result of `beginAuth`: everything needed to redirect the browser and later complete the flow. */
+export interface BeginAuthResult {
+    /** The fully-qualified authorization URL to redirect the user's browser to. */
+    authorizeUrl: string;
+    /** The random `state` string; must be passed to `PendingAuthCache.put` before redirecting. */
+    state: string;
+    /** The pending-auth metadata to store in `PendingAuthCache` keyed by `state`. */
+    pending: PendingAuthState;
+}
+/**
+ * Run the entire pre-redirect half of the OAuth dance:
+ *   discovery → DCR (cached) → PKCE → authorize URL.
+ *
+ * Returns everything the caller needs to (a) push the user's browser at the
+ * correct authorize URL, and (b) finish the flow when the callback hits.
+ */
+export declare function beginAuth(input: BeginAuthInput): Promise<BeginAuthResult>;
+export {};
+//# sourceMappingURL=oauth.d.ts.map

package/dist/core/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/core/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4BH,OAAO,EAAuB,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAOhF,kEAAkE;AAClE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,wDAAwD;AACxD,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;CAClD;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;gCACgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAmCD,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;AA+BhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,QAAQ,EACb,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,eAAe,GAC3B,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAqFD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,EAC/B,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAmB3C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,OAAO,KAAa,EAC/B,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC,CA0B7C;AAkFD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,EAC/B,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAsCtD;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,2BAA2B,EACvC,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,EAC/B,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;AAMD,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,2BAA2B,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAclE;AAMD,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,iBAAiB,EACxB,SAAS,GAAE,OAAO,KAAa,EAC/B,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAS7B;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,EACxB,SAAS,GAAE,OAAO,KAAa,EAC/B,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AA2CD;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAIf,OAAO,CAAC,QAAQ,CAAC,KAAK;IAHlC,OAAO,CAAC,KAAK,CAAuC;IACpD,OAAO,CAAC,KAAK,CAA+C;gBAE/B,KAAK,GAAE,MAAuB;IAE3D;;;;;OAKG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAKjD;gCAC4B;IAC5B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAQ/C,4EAA4E;IAC5E,IAAI,IAAI,MAAM;IAId;6CACyC;IACzC,IAAI,IAAI,IAAI;IAOZ,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,KAAK;CAUd;AAMD,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,WAAW,CAAC;CAC1B;AAED,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,eAAe,CAAC,CAgE1B"}