@m1a0rz/agent-identity 0.1.2

package/dist/index.js

@@ -0,0 +1,306 @@
+/**
+ * Agent Identity Plugin
+ *
+ * - UserPool login via /identity login (OIDC URL returned directly, no HTTP start endpoint)
+ * - Credential hosting: list-credentials, fetch <provider>, set <provider> <envVar>
+ * - TIP token via CIS GetWorkloadAccessTokenForJWT in before_agent_start
+ * - Sub-agent TIP propagation in after_tool_call (sessions_spawn)
+ * - Optional AuthZ in before_tool_call
+ * - HTTP callback: /identity/oauth/callback (OIDC login). Credential OAuth uses Identity-provided callback.
+ * - Tools: identity_whoami, identity_logout
+ */
+import { createIdentityCommand, createIdCommand } from "./src/commands/identity-commands.js";
+import { createAfterToolCallHandler } from "./src/hooks/after-tool-call.js";
+import { createBeforeAgentStartHandler } from "./src/hooks/before-agent-start.js";
+import { createBeforeToolCallHandler } from "./src/hooks/before-tool-call.js";
+import { createOIDCCallbackHandler, createOIDCCallbackHandlerLazy, } from "./src/routes/oidc-login.js";
+import { IdentityClient, resolveOIDCConfig, } from "./src/services/identity-client.js";
+import { IdentityService } from "./src/services/identity-service.js";
+import { sendNotificationFeishu } from "./src/services/send-notification-feishu.js";
+import { createIdentityApproveTool } from "./src/tools/identity-approve-tool.js";
+import { createIdentityConfigTool } from "./src/tools/identity-config.js";
+import { createIdentityListRiskPatternsTool } from "./src/tools/identity-list-risk-patterns.js";
+import { createIdentityRiskCheckTool } from "./src/tools/identity-risk-check.js";
+import { createIdentityFetchTool } from "./src/tools/identity-fetch.js";
+import { createIdentityListCredentialsTool } from "./src/tools/identity-list-credentials.js";
+import { createIdentityListTipsTool } from "./src/tools/identity-list-tips.js";
+import { createIdentityLoginTool } from "./src/tools/identity-login.js";
+import { createIdentityLogoutTool } from "./src/tools/identity-logout.js";
+import { createIdentitySetBindingTool } from "./src/tools/identity-set-binding.js";
+import { createIdentityStatusTool } from "./src/tools/identity-status.js";
+import { createIdentityUnsetBindingTool } from "./src/tools/identity-unset-binding.js";
+import { createIdentityWhoamiTool } from "./src/tools/identity-whoami.js";
+import { parseSessionKeyToDeliveryTarget, } from "./src/utils/derive-session-key.js";
+const PLUGIN_STORE_DIR = "~/.openclaw/plugins/identity";
+/**
+ * Whether Identity should be enabled.
+ */
+function hasAnyIdentityConfig(identity) {
+    if (!identity)
+        return false;
+    return Boolean(identity.endpoint ||
+        identity.accessKeyId ||
+        identity.secretAccessKey ||
+        identity.sessionToken ||
+        identity.credentialsFile ||
+        identity.roleTrn ||
+        identity.workloadPoolName ||
+        identity.workloadName ||
+        identity.audience?.length ||
+        identity.durationSeconds);
+}
+export default function register(api) {
+    const pluginConfig = (api.pluginConfig ?? {});
+    const storeDir = api.resolvePath(PLUGIN_STORE_DIR);
+    const identityCfg = pluginConfig.identity;
+    const hasIdentity = hasAnyIdentityConfig(identityCfg);
+    const userpool = pluginConfig.userpool;
+    const identityClient = hasIdentity
+        ? new IdentityClient({
+            endpoint: identityCfg?.endpoint ?? "https://id.cn-beijing.volcengineapi.com",
+            accessKeyId: identityCfg?.accessKeyId,
+            secretAccessKey: identityCfg?.secretAccessKey,
+            sessionToken: identityCfg?.sessionToken,
+            credentialsFile: identityCfg?.credentialsFile,
+            roleTrn: identityCfg?.roleTrn,
+            serviceCode: "id",
+        })
+        : {
+            getWorkloadAccessTokenForJWT: async () => {
+                throw new Error("Identity not configured.");
+            },
+            getResourceOauth2Token: async () => {
+                throw new Error("Identity not configured.");
+            },
+            oauth2Callback: async () => {
+                throw new Error("Identity not configured.");
+            },
+            getResourceApiKey: async () => {
+                throw new Error("Identity not configured.");
+            },
+            checkPermission: async () => {
+                throw new Error("Identity not configured.");
+            },
+            listCredentialProviders: async () => ({
+                CredentialProviders: [],
+                Data: [],
+                TotalCount: 0,
+                PageNumber: 1,
+                PageSize: 20,
+            }),
+            getUserPool: async () => {
+                throw new Error("Identity not configured.");
+            },
+            listUserPools: async () => ({
+                pageNumber: 1,
+                pageSize: 10,
+                totalCount: 0,
+                data: [],
+            }),
+            createUserPool: async () => {
+                throw new Error("Identity not configured.");
+            },
+            getUserPoolClient: async () => {
+                throw new Error("Identity not configured.");
+            },
+            listUserPoolClients: async () => ({
+                pageNumber: 1,
+                pageSize: 10,
+                totalCount: 0,
+                data: [],
+            }),
+            createUserPoolClient: async () => {
+                throw new Error("Identity not configured.");
+            },
+        };
+    const identityService = new IdentityService({
+        identityClient: identityClient,
+        workloadPoolName: identityCfg?.workloadPoolName,
+        workloadName: identityCfg?.workloadName,
+        audience: identityCfg?.audience,
+        durationSeconds: identityCfg?.durationSeconds,
+        roleTrn: identityCfg?.roleTrn,
+    });
+    const dynamicOidcEnabled = !!(userpool?.userPoolName &&
+        userpool?.clientName &&
+        userpool?.callbackUrl &&
+        hasIdentity);
+    const explicitOidcEnabled = !!(userpool?.discoveryUrl &&
+        userpool?.clientId &&
+        userpool?.callbackUrl);
+    let getResolvedOidcConfig = null;
+    if (dynamicOidcEnabled) {
+        let cached = null;
+        getResolvedOidcConfig = async () => {
+            if (cached)
+                return cached;
+            cached = await resolveOIDCConfig(identityClient, {
+                userPoolName: userpool.userPoolName,
+                clientName: userpool.clientName,
+                redirectUri: userpool.callbackUrl,
+                scope: userpool.scope,
+                autoCreate: userpool.autoCreate ?? true,
+            });
+            return cached;
+        };
+    }
+    else if (explicitOidcEnabled) {
+        getResolvedOidcConfig = async () => ({
+            discoveryUrl: userpool.discoveryUrl,
+            clientId: userpool.clientId,
+            clientSecret: userpool.clientSecret,
+            scope: userpool.scope,
+            callbackUrl: userpool.callbackUrl,
+        });
+    }
+    const getOidcConfigForRefresh = dynamicOidcEnabled
+        ? async () => {
+            const c = await getResolvedOidcConfig();
+            return {
+                discoveryUrl: c.discoveryUrl,
+                clientId: c.clientId,
+                clientSecret: c.clientSecret,
+            };
+        }
+        : explicitOidcEnabled
+            ? async () => ({
+                discoveryUrl: userpool.discoveryUrl,
+                clientId: userpool.clientId,
+                clientSecret: userpool.clientSecret,
+            })
+            : undefined;
+    const CHANNEL_SEND_KEYS = {
+        telegram: "sendMessageTelegram",
+        slack: "sendMessageSlack",
+        discord: "sendMessageDiscord",
+        signal: "sendMessageSignal",
+        imessage: "sendMessageIMessage",
+        whatsapp: "sendMessageWhatsApp",
+        line: "sendMessageLine",
+        feishu: "sendMessageFeishu",
+    };
+    const sendToSession = async (targetOrSessionKey, text) => {
+        const target = typeof targetOrSessionKey === "object"
+            ? targetOrSessionKey
+            : parseSessionKeyToDeliveryTarget(targetOrSessionKey);
+        if (!target) {
+            api.logger.warn(`agent-identity: Cannot deliver to channel (sessionKey not parseable). Set session.dmScope to per-channel-peer or per-account-channel-peer so approval messages reach Feishu/Telegram/etc.`);
+            return;
+        }
+        if (target.channel === "feishu") {
+            try {
+                const cfg = await api.runtime.config.loadConfig();
+                await sendNotificationFeishu(cfg, target.to, text, target.accountId);
+            }
+            catch (err) {
+                api.logger.warn(`agent-identity: Feishu notification failed (to=${target.to}): ${String(err)}`);
+            }
+            return;
+        }
+        const sendKey = CHANNEL_SEND_KEYS[target.channel];
+        const sendFn = sendKey
+            ? api.runtime?.channel?.[target.channel]?.[sendKey]
+            : undefined;
+        if (sendFn)
+            await sendFn(target.to, text);
+    };
+    const onLoginSuccess = async (sessionKey, sub, deliveryTarget) => {
+        const targetOrKey = deliveryTarget ?? parseSessionKeyToDeliveryTarget(sessionKey) ?? sessionKey;
+        await sendToSession(targetOrKey, `✓ Login successful as ${sub}. You can continue in the chat.`);
+    };
+    // Only 2 HTTP routes: OIDC callback and credential OAuth callback (IdP redirects here)
+    if (dynamicOidcEnabled && getResolvedOidcConfig) {
+        api.registerHttpRoute({
+            path: "/identity/oauth/callback",
+            handler: createOIDCCallbackHandlerLazy({
+                storeDir,
+                getOidcConfig: getResolvedOidcConfig,
+                identityService,
+                onLoginSuccess,
+            }),
+        });
+    }
+    else if (explicitOidcEnabled) {
+        const oidcConfig = {
+            discoveryUrl: userpool.discoveryUrl,
+            clientId: userpool.clientId,
+            clientSecret: userpool.clientSecret,
+            scope: userpool.scope,
+            callbackUrl: userpool.callbackUrl,
+        };
+        api.registerHttpRoute({
+            path: "/identity/oauth/callback",
+            handler: createOIDCCallbackHandler({
+                storeDir,
+                config: oidcConfig,
+                identityService,
+                onLoginSuccess,
+            }),
+        });
+    }
+    // Slash commands (all logic in command, no HTTP start endpoints)
+    const getOidcConfigForCommand = getResolvedOidcConfig ??
+        (explicitOidcEnabled
+            ? async () => ({
+                discoveryUrl: userpool.discoveryUrl,
+                clientId: userpool.clientId,
+                clientSecret: userpool.clientSecret,
+                scope: userpool.scope,
+                callbackUrl: userpool.callbackUrl,
+            })
+            : async () => {
+                throw new Error("OIDC not configured. Set userpool in plugin config.");
+            });
+    const identityCommandsDeps = {
+        storeDir,
+        identityService,
+        getOidcConfig: getOidcConfigForCommand,
+        identityClient: hasIdentity ? identityClient : undefined,
+        logger: api.logger,
+        pluginConfig,
+        sendCredentialMessage: sendToSession,
+    };
+    api.registerCommand(createIdentityCommand(identityCommandsDeps));
+    api.registerCommand(createIdCommand(identityCommandsDeps));
+    api.logger.info("agent-identity: commands /identity, /id (login, status, logout, list-tips, list-credentials, fetch, set, unset); HTTP callback /identity/oauth/callback (credential OAuth uses Identity callback)");
+    // Tools (share deps with commands). Optional = only included when agent allowlist explicitly adds them.
+    api.registerTool(createIdentityWhoamiTool(identityCommandsDeps), { optional: false });
+    api.registerTool(createIdentityLogoutTool(identityCommandsDeps), { optional: false });
+    api.registerTool(createIdentityStatusTool(identityCommandsDeps), { optional: false });
+    api.registerTool(createIdentityLoginTool(identityCommandsDeps), { optional: false });
+    api.registerTool(createIdentityListCredentialsTool(identityCommandsDeps), { optional: false });
+    api.registerTool(createIdentityListTipsTool(identityCommandsDeps), { optional: false });
+    api.registerTool(createIdentityConfigTool(identityCommandsDeps), { optional: false });
+    api.registerTool(createIdentityFetchTool(identityCommandsDeps), { optional: false });
+    api.registerTool(createIdentitySetBindingTool(identityCommandsDeps), { optional: true });
+    api.registerTool(createIdentityUnsetBindingTool(identityCommandsDeps), { optional: true });
+    api.registerTool(createIdentityRiskCheckTool({ pluginConfig, logger: api.logger }), { optional: true });
+    api.registerTool(createIdentityListRiskPatternsTool(), { optional: true });
+    const authz = pluginConfig.authz;
+    const approvalTtlMs = (authz?.approvalTtlSeconds ?? 300) * 1000;
+    // Optional: agent must NOT have this (would self-approve). Use /identity approve for human approval.
+    api.registerTool(createIdentityApproveTool({ approvalTtlMs, logger: api.logger }), {
+        optional: true,
+    });
+    // Hooks
+    if (hasIdentity) {
+        api.on("before_agent_start", createBeforeAgentStartHandler({
+            storeDir,
+            identityService,
+            getOidcConfigForRefresh,
+            logger: api.logger,
+        }));
+        api.on("after_tool_call", createAfterToolCallHandler({ storeDir, logger: api.logger }));
+    }
+    if (authz?.enable) {
+        api.on("before_tool_call", createBeforeToolCallHandler({
+            storeDir,
+            identityClient: hasIdentity ? identityClient : undefined,
+            namespaceName: authz.namespaceName ?? "default",
+            logger: api.logger,
+            sendToSession,
+            authz,
+            approvalTtlMs,
+        }));
+    }
+}

package/dist/src/actions/identity-actions.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Shared identity actions: pure logic returning structured data.
+ * Used by both commands (format to text) and tools (return jsonResult).
+ */
+import type { OpenClawConfig } from "openclaw/plugin-sdk";
+import type { IdentityClientInterface } from "../services/identity-client.js";
+import type { IdentityService } from "../services/identity-service.js";
+import type { PluginConfig } from "../types.js";
+import type { SessionKeyDeliveryTarget } from "../utils/derive-session-key.js";
+import { type CredentialEntry } from "../store/credential-store.js";
+export type OIDCConfigForCommand = {
+    discoveryUrl: string;
+    clientId: string;
+    clientSecret?: string;
+    scope?: string;
+    callbackUrl: string;
+};
+export type IdentityActionsLogger = {
+    info?: (msg: string) => void;
+    warn?: (msg: string) => void;
+    debug?: (msg: string) => void;
+};
+export type IdentityActionsDeps = {
+    storeDir: string;
+    identityService: IdentityService;
+    getOidcConfig: () => Promise<OIDCConfigForCommand>;
+    identityClient?: IdentityClientInterface;
+    logger?: IdentityActionsLogger;
+    pluginConfig?: PluginConfig;
+    sendCredentialMessage?: (targetOrSessionKey: SessionKeyDeliveryTarget | string, text: string) => Promise<void>;
+};
+export type FetchFlow = "oauth2-user" | "oauth2-m2m" | "apikey";
+export type StatusResult = {
+    loggedIn: boolean;
+    sub: string | null;
+    hasTip: boolean;
+    /** Session login time (ms since epoch). */
+    sessionLoginAt?: number;
+    /** Session expiry (ms). Absent = no explicit expiry. */
+    sessionExpiresAt?: number | null;
+    /** TIP issued time (ms). */
+    tipIssuedAt?: number;
+    /** TIP expiry (ms). */
+    tipExpiresAt?: number;
+    /** TIP delegation chain (agent IDs). */
+    tipChain?: string[];
+    credentials: Record<string, CredentialEntry>;
+    bindings: Record<string, string>;
+};
+export declare function runStatus(deps: IdentityActionsDeps, sessionKey: string, config?: OpenClawConfig): Promise<StatusResult>;
+export type LoginResult = {
+    kind: "already_logged_in";
+    sub: string;
+} | {
+    kind: "auth_url";
+    authUrl: string;
+} | {
+    kind: "error";
+    message: string;
+};
+export declare function runLogin(deps: IdentityActionsDeps, sessionKey: string, options?: {
+    config?: OpenClawConfig;
+    deliveryTarget?: SessionKeyDeliveryTarget | null;
+}): Promise<LoginResult>;
+export type LogoutResult = {
+    ok: boolean;
+};
+export declare function runLogout(deps: IdentityActionsDeps, sessionKey: string): Promise<LogoutResult>;
+export type ListCredentialsResult = {
+    providers: Array<{
+        name: string;
+        type: string;
+        flow?: string;
+        status: string;
+        binding?: string;
+    }>;
+    storedOnly: Array<{
+        name: string;
+        status: string;
+        binding?: string;
+    }>;
+    page: number;
+    hasMore: boolean;
+    totalCount?: number;
+};
+export declare function runListCredentials(deps: IdentityActionsDeps, sessionKey: string, page?: number): Promise<ListCredentialsResult>;
+export type ListTipsResult = {
+    tips: Array<{
+        sessionKey: string;
+        sub: string;
+        chain: string[];
+        expiresAt: number;
+        ttlSec: number;
+    }>;
+    /** Bindings per sessionKey (provider -> envVar). */
+    bindingsBySession: Record<string, Record<string, string>>;
+};
+export declare function runListTips(deps: IdentityActionsDeps): Promise<ListTipsResult>;
+export type ConfigResult = {
+    identity?: Record<string, unknown>;
+    userpool?: Record<string, unknown>;
+    authz?: Record<string, unknown>;
+};
+export declare function runConfig(deps: IdentityActionsDeps): Promise<ConfigResult>;
+export type FetchResult = {
+    kind: "success";
+    message: string;
+} | {
+    kind: "auth_url";
+    authUrl: string;
+    message: string;
+} | {
+    kind: "error";
+    message: string;
+};
+export declare function runFetch(deps: IdentityActionsDeps, sessionKey: string, params: {
+    provider: string;
+    flow: FetchFlow;
+    flowExplicit?: boolean;
+    redirectUrl?: string;
+    scopes?: string[];
+    deliveryTarget?: SessionKeyDeliveryTarget | null;
+    config?: OpenClawConfig;
+}): Promise<FetchResult>;
+export type SetBindingResult = {
+    ok: boolean;
+    message?: string;
+    error?: string;
+};
+export declare function runSetBinding(deps: IdentityActionsDeps, sessionKey: string, params: {
+    provider: string;
+    envVar: string;
+}): Promise<SetBindingResult>;
+export type UnsetBindingResult = {
+    ok: boolean;
+    message?: string;
+    error?: string;
+};
+export declare function runUnsetBinding(deps: IdentityActionsDeps, sessionKey: string, params: {
+    provider: string;
+}): Promise<UnsetBindingResult>;
+//# sourceMappingURL=identity-actions.d.ts.map

package/dist/src/actions/identity-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../../src/actions/identity-actions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAY/E,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAUtC,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnD,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,qBAAqB,CAAC,EAAE,CACtB,kBAAkB,EAAE,wBAAwB,GAAG,MAAM,EACrD,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAC;AA+EhE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,wBAAsB,SAAS,CAC7B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,YAAY,CAAC,CAiDvB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,cAAc,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;CAAE,GACtF,OAAO,CAAC,WAAW,CAAC,CAmDtB;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3C,wBAAsB,SAAS,CAC7B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,CAWvB;AAID,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClG,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAU,GACf,OAAO,CAAC,qBAAqB,CAAC,CA2EhC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,KAAK,CAAC;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,oDAAoD;IACpD,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D,CAAC;AAEF,wBAAsB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAsBpF;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,wBAAsB,SAAS,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0ChF;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;IACN,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB,GACA,OAAO,CAAC,WAAW,CAAC,CA4GtB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,wBAAsB,aAAa,CACjC,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C,OAAO,CAAC,gBAAgB,CAAC,CAkC3B;AAED,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAW7B"}