@mysten-incubation/memwal-mcp 0.0.14-dev.1 → 0.0.14-dev.3

package/README.md

@@ -152,6 +152,45 @@ Credentials are stored locally in `~/.memwal/credentials.json`. To remove them:
 npx -y @mysten-incubation/memwal-mcp --logout
 ```
 
+### Per-project credentials
+
+A project can keep its own `.memwal/credentials.json` so memory written from it
+goes to a separate account. That file lives inside the repository, where anyone
+who can commit to it — or who can get you to open a clone — could otherwise
+choose the account and relayer your memories go to. So it is **ignored until you
+approve it**, once per machine:
+
+```sh
+cd path/to/project
+npx -y @mysten-incubation/memwal-mcp approve-project
+```
+
+Until then the global credentials are used, and a line on stderr names the file
+that was skipped and the destination it wanted. An approval covers one exact
+project path, account, delegate key and relayer: if any of those change, it has
+to be approved again. The record is kept in `~/.memwal/project-approvals.json`,
+outside the repository, so a repository cannot carry its own approval.
+`revoke-project` withdraws it.
+
+Approving also picks the file that is **written**: a later sign-in from that
+project saves a delegate private key into `.memwal/credentials.json` in plain
+text, inside the repository. `approve-project` says so, and so does the sign-in
+warning. Add `.memwal/` to your `.gitignore`. (The short-lived login
+write-ahead record is kept outside the repository either way.)
+
+`MEMWAL_CREDS_DIR` points both the credentials and the approval record at a
+directory of your choosing and overrides project resolution entirely, with no
+approval. Because it skips the gate, it must be an **absolute path outside the
+current project**: a relative value would resolve against the working directory
+and put the approval record inside the repository, and an MCP client passes on
+the `env` block it reads from `.cursor/mcp.json` / `.vscode/mcp.json` /
+`.claude/settings.json` in the checkout — where `${workspaceFolder}` is expanded,
+so an in-project absolute path is not proof you chose it. Anything else is
+refused with an error naming the value, rather than quietly ignored. An empty
+value means unset.
+
+`memwal_health` reports the destination in use as `account=… relayer=…`.
+
 ## License
 
 Apache-2.0

package/dist/auth.d.ts

@@ -21,25 +21,163 @@ export interface MemWalCredentials {
     version: 1;
 }
 /**
- * Which credentials file this process should read and write.
+ * Refusal of a `MEMWAL_CREDS_DIR` that cannot be trusted to sit outside a
+ * repository. Thrown, never swallowed — see {@link credsDirOverride}.
+ */
+export declare class UntrustedCredsDirError extends Error {
+    constructor(message: string);
+}
+/** The approval store. Outside every repository, on purpose. */
+export declare function projectApprovalsPath(): string;
+/**
+ * What approval is granted against: the destination, not the file's bytes.
  *
- * The nearest project-local `.memwal/credentials.json` at or above the working
- * directory wins over the global one, the way `.npmrc` and `.git/config`
- * resolve. Signing in from one project otherwise repoints every other project
- * on the machine at a different account and delegate key, silently — memories
- * then land on the wrong account, on immutable storage, with no delete path
- * (GH #628).
+ * Account, delegate and relayer are the three fields that decide WHERE a
+ * memory ends up and WHO signs for it. Hashing them means a project file may
+ * be re-saved, relabelled or reformatted freely, while any edit that moves the
+ * destination invalidates the approval and has to be approved again. The
+ * delegate private key is deliberately NOT part of it — it must never be read
+ * into a record that gets written back out.
+ */
+export declare function credentialsFingerprint(creds: {
+    accountId: string;
+    delegateAddress: string;
+    relayerUrl: string;
+}): string;
+/** One approved project credentials file. Contains no secret. */
+export interface ProjectApproval {
+    /** Canonical path of the approved `.memwal/credentials.json`. */
+    path: string;
+    fingerprint: string;
+    accountId: string;
+    delegateAddress: string;
+    relayerUrl: string;
+    approvedAt: string;
+}
+/** Why a project credentials file was, or was not, used. */
+export type ProjectCredsDecision = 
+/** Approved for exactly this account + delegate + relayer: in use. */
+"approved"
+/** Never approved on this machine. Ignored. */
+ | "unapproved"
+/** Approved once, but the destination has since changed. Ignored. */
+ | "changed"
+/** Present but not valid credentials, so there is nothing to approve. */
+ | "unreadable";
+export interface ProjectCredsInfo {
+    /** The project-local file that was found. */
+    path: string;
+    decision: ProjectCredsDecision;
+    /** Destination it points at. Absent when the file could not be read — and
+     * never the delegate private key, which no caller of this ever needs. */
+    accountId?: string;
+    relayerUrl?: string;
+}
+/** Which file won, and what happened to any project-local file that did not. */
+export interface CredsResolution {
+    /** The file this process reads and writes. */
+    path: string;
+    source: "override" | "project" | "global";
+    /** The project-local file found by the walk, if any — present whether or
+     * not it was used, so callers can report one they ignored. */
+    project?: ProjectCredsInfo;
+}
+/**
+ * Which credentials file this process should read and write, and why.
  *
- * Presence-based on purpose: creating the local file is the opt-in, so this is
- * purely additive. Resolved per call rather than at module load, because the
- * working directory is not knowable at import time.
+ * `MEMWAL_CREDS_DIR` wins outright, and skips the approval gate — but only a
+ * value {@link credsDirOverride} accepts, i.e. a non-empty ABSOLUTE path
+ * outside the current project. It is "trusted" exactly as far as whoever set
+ * the environment is, and an MCP client will hand this process an `env` block
+ * it read out of the checkout, so a value that could have been committed is
+ * refused rather than obeyed. Otherwise the nearest project-local
+ * `.memwal/credentials.json` at or above the working directory is used IF the
+ * user has approved that exact destination on this machine (WALM-639), and the
+ * global file is used in every other case — including an unapproved, altered
+ * or malformed project file. Falling back rather than failing keeps a machine
+ * that has never seen a project file behaving exactly as it always did.
  *
- * `MEMWAL_CREDS_DIR` overrides both project and global resolution when set,
- * and is re-read on every call.
+ * Resolved per call rather than at module load, because neither the working
+ * directory nor the approval store is knowable at import time.
  */
+export declare function resolveCreds(): CredsResolution;
+/** The credentials file in use. Thin wrapper over {@link resolveCreds} so the
+ * many callers that only need a path are unchanged. */
 export declare function credsPath(): string;
 /** Load credentials from disk. Returns null if missing or malformed. */
 export declare function loadCreds(): MemWalCredentials | null;
+/** What {@link approveProjectCreds} did. */
+export interface ApproveProjectResult {
+    outcome: 
+    /** Newly approved. */
+    "approved"
+    /** Approved again after the destination changed. */
+     | "reapproved"
+    /** Already approved for this exact destination; nothing written. */
+     | "already-approved"
+    /** No project-local credentials file at or above the working directory. */
+     | "none"
+    /** A project file exists but is not valid credentials. */
+     | "unreadable"
+    /** `MEMWAL_CREDS_DIR` is set, so project resolution never runs. */
+     | "overridden";
+    projectPath?: string;
+    accountId?: string;
+    relayerUrl?: string;
+    /** Destination the previous approval covered, when this replaced one. */
+    previousAccountId?: string;
+    previousRelayerUrl?: string;
+    approvalsPath: string;
+}
+/**
+ * Approve the project-local credentials found from the working directory.
+ *
+ * Deliberately takes no arguments: it approves what resolution would otherwise
+ * ignore, from the same directory, so "what am I approving" and "what will be
+ * used" cannot drift apart.
+ */
+export declare function approveProjectCreds(): ApproveProjectResult;
+/** What {@link revokeProjectCredsApproval} did. */
+export interface RevokeProjectResult {
+    outcome: "revoked" | "none";
+    projectPath?: string;
+    approvalsPath: string;
+}
+/**
+ * Withdraw the approval for the project-local credentials here.
+ *
+ * Keyed on the path rather than on the file's current contents, so an approval
+ * can be withdrawn even after the file it covered was edited or deleted — a
+ * revoke that only worked while the destination still matched would be
+ * useless exactly when it is wanted.
+ */
+export declare function revokeProjectCredsApproval(): RevokeProjectResult;
+/**
+ * The warning for a project credentials file that was found and NOT used, or
+ * null when there is nothing to report.
+ *
+ * Says which file was ignored, where memory is going instead, and the exact
+ * command that approves it — a silent fallback would be the mirror image of
+ * the silent redirect this gate exists to stop. Never contains a key: the only
+ * fields it reads are the account id and the relayer URL.
+ */
+export declare function formatProjectCredsNotice(resolution?: CredsResolution): string | null;
+/**
+ * What approving a project credentials file costs, beyond redirecting reads.
+ *
+ * Approval does not just decide which file is READ — it decides which file is
+ * WRITTEN. `saveCreds` writes to `credsPath()`, so from here on every sign-in
+ * from this project puts a fresh 64-hex Ed25519 delegate seed, in plaintext,
+ * into a directory that is inside the repository. An attacker who planted the
+ * file planted the directory too, so it is already tracked rather than ignored,
+ * and `git add -A` stages the key. The user cannot weigh that if nobody says
+ * it, and "you approved a destination" is not the same sentence as "you
+ * approved storing a private key in your repo".
+ *
+ * Separate from {@link formatProjectCredsNotice} on purpose: that one is about
+ * a file that was IGNORED, this one is about a file that is about to be used.
+ */
+export declare function formatProjectCredsStorageWarning(projectPath: string): string;
 /**
  * Write credentials with secure (`0600`) permission, to whichever file
  * `credsPath()` resolves to.
@@ -102,6 +240,11 @@ export interface SaveCredsResult {
  * callback arrives, by which point a delegate key has already been registered
  * on-chain — so a warning that waits for both ids is a warning that arrives
  * too late to act on.
+ *
+ * When the file being replaced is an approved project one, that is also the
+ * last moment before a new private key lands inside a repository, so the
+ * storage warning is repeated here rather than left behind at approval time —
+ * approval may have been months ago, or done by someone else on the machine.
  */
 export declare function formatPendingSignInWarning(): string | null;
 /**
@@ -156,8 +299,26 @@ export interface PendingLogin {
     createdAt: string;
     version: 1;
 }
-/** Sits beside whichever credentials file `credsPath()` resolves to, so a
- * project-local sign-in recovers into that same project. */
+/**
+ * Where the write-ahead record lives — never inside a repository.
+ *
+ * It used to sit beside whichever credentials file `credsPath()` resolved to,
+ * which reads as "recover into the project you signed in from" and is the right
+ * intent. But for an approved project that path is `<repo>/.memwal/`, so every
+ * sign-in dropped a plaintext 64-hex delegate seed into the working tree —
+ * under a directory an attacker who planted the credentials file had already
+ * created, so tracked rather than ignored, and staged by `git add -A`.
+ *
+ * Nothing about this record needs to be in the repo. It is short-lived
+ * handshake state, nobody edits it by hand, and the only property that matters
+ * is that the project which started a sign-in is the one that can reclaim it.
+ * So it moves to the trusted state directory, keyed by a hash of the
+ * credentials path: same per-project scoping, no key material in the checkout.
+ *
+ * The non-project cases are byte-for-byte where they always were —
+ * `dirname(credsPath())` IS `trustedStateDir()` for both the override and the
+ * global file — so a machine that has never approved a project sees no change.
+ */
 export declare function pendingLoginPath(): string;
 /**
  * Persist the pending keypair. Throws if it cannot.
@@ -168,10 +329,10 @@ export declare function pendingLoginPath(): string;
  * the connect URL while claiming a durability that does not exist — the
  * original WALM-332 loss, now silent.
  *
- * Failing the login costs the user nothing: this file sits beside
- * `credentials.json`, so a directory that cannot take it cannot take the
- * credentials either. The same login would have failed at the callback anyway,
- * one on-chain `add_delegate_key` later.
+ * Failing the login costs the user nothing: this file lives in the same
+ * trusted state directory the approval record does, so a directory that cannot
+ * take it is one this process cannot keep state in at all. The same login would
+ * have failed at the callback anyway, one on-chain `add_delegate_key` later.
  */
 export declare function savePendingLogin(pending: PendingLogin): void;
 /**

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,iBAAiB;IAC9B,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC;CACd;AAkDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAIlC;AAED,wEAAwE;AACxE,wBAAgB,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAWpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAKnE;AAqDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3B,GACP,IAAI,CAuCN;AAED;;sCAEsC;AACtC,MAAM,WAAW,eAAe;IAC5B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb;iCAC6B;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;kCAC8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAQ1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,KAAK,EAAE,eAAe,EACtB,iBAAiB,EAAE,MAAM,GAC1B,MAAM,GAAG,IAAI,CASf;AA0BD;yEACyE;AACzE,MAAM,WAAW,gBAAgB;IAC7B;wBACoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;2EACuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAa7C;AAmCD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAErD,MAAM,WAAW,YAAY;IACzB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,CAAC;CACd;AAED;4DAC4D;AAC5D,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAe5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,IAAI,CAoBtD;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,iBAAiB;IAC9B,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC;CACd;AAoED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI9B;AAsID,gEAAgE;AAChE,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAIT;AAED,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC5B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB;AAwDD,4DAA4D;AAC5D,MAAM,MAAM,oBAAoB;AAC5B,sEAAsE;AACpE,UAAU;AACZ,+CAA+C;GAC7C,YAAY;AACd,qEAAqE;GACnE,SAAS;AACX,yEAAyE;GACvE,YAAY,CAAC;AAEnB,MAAM,WAAW,gBAAgB;IAC7B,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;IAC/B;6EACyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC1C;kEAC8D;IAC9D,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,IAAI,eAAe,CAgC9C;AAED;uDACuD;AACvD,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAeD,wEAAwE;AACxE,wBAAgB,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAEpD;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACjC,OAAO;IACH,sBAAsB;IACpB,UAAU;IACZ,oDAAoD;OAClD,YAAY;IACd,oEAAoE;OAClE,kBAAkB;IACpB,2EAA2E;OACzE,MAAM;IACR,0DAA0D;OACxD,YAAY;IACd,mEAAmE;OACjE,YAAY,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,oBAAoB,CA2C1D;AAED,mDAAmD;AACnD,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,mBAAmB,CAShE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACpC,UAAU,GAAE,eAAgC,GAC7C,MAAM,GAAG,IAAI,CAgCf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAW5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAKnE;AAqDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3B,GACP,IAAI,CAuCN;AAED;;sCAEsC;AACtC,MAAM,WAAW,eAAe;IAC5B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb;iCAC6B;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;kCAC8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAa1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,KAAK,EAAE,eAAe,EACtB,iBAAiB,EAAE,MAAM,GAC1B,MAAM,GAAG,IAAI,CASf;AA0BD;yEACyE;AACzE,MAAM,WAAW,gBAAgB;IAC7B;wBACoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;2EACuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAa7C;AAuCD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAErD,MAAM,WAAW,YAAY;IACzB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAe5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,IAAI,CAoBtD;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC"}