@novorb/mcp-core 2.1.2 → 3.0.0

package/dist/credentials.d.ts

@@ -0,0 +1,288 @@
+/**
+ * @novorb/mcp-core - Credential health
+ *
+ * A credential is checked once when the env is loaded (see `credential-checks.ts`); after that its
+ * health is learned from use. A key can degrade (quota, rate limit), become invalid or expire while the
+ * server runs: that never crashes the server and never turns a tool call into an error on its own.
+ * Instead every tool result that touched a credential carries a report of the keys it used and the
+ * ones that are degraded, invalid or expired (see `registerTools`).
+ *
+ * - `CredentialRegistry` (process-wide by default, `processCredentials()`): the status per DECLARED key
+ *   name, pools (an env `multi` family: `KEY`, `KEY_1`, `KEY_2`, ...), `pick(pool)` rotation that
+ *   prefers valid over unknown over degraded and keeps invalid and expired keys as the last resort (so
+ *   no key is lost for good), `record(key, outcome)`, `snapshot()`, and a background re-check of invalid
+ *   and expired keys (the startup `check`) after `recheckMs`. Transitions are logged once per change.
+ * - `CredentialScope`: one tool call's view of the registry. It remembers which credentials the call
+ *   touched, so the result can report them; the http-client records into the current scope.
+ * - `credentialOutcomeFromHttp`: the one HTTP outcome mapping (status-gated, see there).
+ *
+ * Only declared key NAMES ever appear in logs, results and snapshots: an identifier that is not a
+ * registered name is refused with `UnknownCredentialError` (a programming error), so a value passed by
+ * mistake is never published. A registry never holds a value.
+ */
+import { type Logger } from './utils/logger.js';
+/**
+ * - `valid`: the provider accepted the key.
+ * - `invalid`: the provider rejected it (auth error); re-checked after `recheckMs`, still tried last.
+ * - `expired`: the provider reported it expired; handled like `invalid`.
+ * - `degraded`: quota exhausted or rate limited; back to `unknown` once the retry-after elapses.
+ * - `unknown`: not decided (no check, the check timed out or hit a network error).
+ */
+export type CredentialStatus = 'valid' | 'invalid' | 'expired' | 'degraded' | 'unknown';
+export declare const CREDENTIAL_STATUSES: readonly CredentialStatus[];
+/**
+ * What one use of a key showed:
+ * - `ok` (alias `recovered`): the provider accepted it; the key becomes `valid`.
+ * - `used`: the call went out but proved nothing about the key (a 404, a 500, a network error).
+ * - `degraded` / `invalid` / `expired`: the key's new status.
+ */
+export type CredentialOutcome = 'ok' | 'recovered' | 'used' | 'degraded' | 'invalid' | 'expired';
+export interface CredentialOutcomeInfo {
+    /** Short, value-free reason (`quota`, `rate limit`, `auth rejected`, ...). */
+    reason?: string;
+    /** For `degraded`: how long until the key may work again. */
+    retryAfterMs?: number;
+}
+/** An outcome with its details (what `credentialOutcomeFromHttp` returns). */
+export interface ClassifiedOutcome extends CredentialOutcomeInfo {
+    outcome: CredentialOutcome;
+}
+/** One credential's state as `snapshot()` reports it. Names only, never a value. */
+export interface CredentialState {
+    key: string;
+    /** The pool (env `multi` base key) this key belongs to, when it is a pool member. */
+    pool?: string;
+    status: CredentialStatus;
+    reason?: string;
+    /** For `degraded`: seconds until the retry-after elapses. */
+    retryInSeconds?: number;
+    /** ISO time of the last status change. */
+    changedAt?: string;
+    /** ISO time of the last recorded use. */
+    lastUsedAt?: string;
+}
+/** A re-check of one key (the startup `check` bound to the key's value): its new status. */
+export type CredentialProbe = () => Promise<CredentialOutcomeInfo & {
+    status: CredentialStatus;
+}>;
+export interface CredentialRegistryOptions {
+    /** Clock (tests). */
+    now?: () => number;
+    /** Logger for transitions (default the mcp-core singleton). */
+    logger?: Logger;
+    /** Cool-down for a `degraded` outcome that carries no retry-after (default 60000 ms). */
+    defaultRetryAfterMs?: number;
+    /** How long an invalid or expired key waits before its probe re-checks it (default 300000 ms). */
+    recheckMs?: number;
+}
+export declare const DEFAULT_CREDENTIAL_RECHECK_MS = 300000;
+/** No candidate of a pool worked: every one was tried and failed on its credential, or none is configured. */
+export declare class NoUsableCredentialError extends Error {
+    readonly pool: string;
+    readonly keys: readonly string[];
+    constructor(pool: string, keys: readonly string[], detail?: string);
+}
+/**
+ * A programming error: an identifier that is not a declared credential name (env key or pool member)
+ * was passed where a key NAME belongs (often the VALUE by mistake). The identifier itself is never put
+ * in the message.
+ */
+export declare class UnknownCredentialError extends Error {
+    constructor();
+}
+/** The process-wide (or a test's own) credential health registry. */
+export declare class CredentialRegistry {
+    private readonly entries;
+    private readonly pools;
+    private readonly cursors;
+    private readonly now;
+    private readonly logger?;
+    private readonly defaultRetryAfterMs;
+    private recheckMs;
+    constructor(options?: CredentialRegistryOptions);
+    private log;
+    /** Set the invalid/expired re-check cool-down (startup reads MCP_CREDENTIAL_RECHECK_MS). */
+    setRecheckMs(ms: number): void;
+    /**
+     * Declare a credential by its env NAME (status `unknown` until checked or used). Re-registering keeps
+     * the status and updates the pool. A pool member is appended to its pool in registration order.
+     * Throws `UnknownCredentialError` for anything that is not an env-variable-shaped name.
+     */
+    register(key: string, options?: {
+        pool?: string;
+    }): void;
+    /** Attach the re-check for an invalid or expired key (the startup `check` bound to its value). */
+    setProbe(key: string, probe: CredentialProbe): void;
+    /**
+     * Declare that `key` stands for the other parts of a multi-part credential (client id + secret, key +
+     * secret): every status change of `key` (a check, a recheck, a recorded outcome) is applied to each
+     * part too, with the same reason. Both sides must be declared (else `UnknownCredentialError`); `key`
+     * itself is ignored if listed.
+     */
+    cover(key: string, parts: readonly string[]): void;
+    /** Forget every credential (tests, or a server re-reading its env). */
+    clear(): void;
+    /** Whether `key` is a declared credential name. */
+    has(key: string): boolean;
+    /** The declared entry, or `UnknownCredentialError`. */
+    private entry;
+    /** A degraded key whose retry-after elapsed goes back to `unknown` (logged once). */
+    private refresh;
+    /** The current status (`unknown` for a key never registered). */
+    status(key: string): CredentialStatus;
+    /**
+     * The member keys of `pool`: a pool name, a single declared key, or an explicit list of declared keys
+     * (an undeclared name in a list throws `UnknownCredentialError`). An unknown pool name has no members.
+     */
+    members(pool: string | readonly string[]): string[];
+    /**
+     * Set a status directly (startup checks, re-checks). `silent` skips the transition log line (the
+     * caller logs a summary instead).
+     */
+    set(key: string, status: CredentialStatus, info?: CredentialOutcomeInfo & {
+        silent?: boolean;
+    }): void;
+    /** Record what a use of `key` showed. `key` must be a declared name. */
+    record(key: string, outcome: CredentialOutcome, info?: CredentialOutcomeInfo): void;
+    /** Mark a declared key as used (no outcome). */
+    touch(key: string): void;
+    private transition;
+    private transitionOne;
+    /** Rank for `candidates`: valid 0, unknown 1, degraded 2, invalid/expired 3 (the last resort). */
+    private rank;
+    /**
+     * Re-check `key` now with its probe (the startup `check`). Resolves with the new status, or the
+     * current one when there is no probe. One probe per key runs at a time; a probe never throws out.
+     */
+    recheck(key: string): Promise<CredentialStatus>;
+    /** Start the re-check of every invalid/expired member whose cool-down elapsed (not awaited). */
+    private recheckDue;
+    /**
+     * Every member of `pool`, best first: valid, unknown, degraded, then invalid and expired as the last
+     * resort (so a pool whose keys all went bad still tries a request, and a success restores the key).
+     * Rotated within the best tier so repeated calls spread over equally healthy keys. Invalid and expired
+     * members whose re-check cool-down elapsed are re-checked in the background.
+     */
+    candidates(pool: string | readonly string[]): string[];
+    /** The best member of `pool` (see `candidates`), or undefined when the pool has no member. */
+    pick(pool: string | readonly string[]): string | undefined;
+    /** One key's state (undefined when never registered). */
+    state(key: string): CredentialState | undefined;
+    /** Every credential's state, in registration order. */
+    snapshot(): CredentialState[];
+}
+/** The process-wide registry `runMcpServer` fills and `registerTools` reports from. */
+export declare function processCredentials(): CredentialRegistry;
+/** Replace the process-wide registry (tests, or a host with its own). Undefined resets it. */
+export declare function setProcessCredentials(registry: CredentialRegistry | undefined): void;
+/** One credential in a tool result's report. */
+export interface CredentialReportEntry {
+    key: string;
+    status: CredentialStatus;
+    /** True when this call used the key (a request went out with it). */
+    used: boolean;
+    reason?: string;
+    retryInSeconds?: number;
+}
+/** Anything that accepts an outcome for a key (a registry or a call scope). */
+export interface CredentialRecorder {
+    /** Whether `key` is a declared credential name. */
+    has(key: string): boolean;
+    record(key: string, outcome: CredentialOutcome, info?: CredentialOutcomeInfo): void;
+}
+/** A tool call's view of the registry: what it picks and records is reported on its result. */
+export declare class CredentialScope implements CredentialRecorder {
+    readonly registry: CredentialRegistry;
+    private readonly touched;
+    private readonly valueFor;
+    constructor(registry: CredentialRegistry, valueFor?: (key: string) => string | undefined);
+    private touch;
+    has(key: string): boolean;
+    /** Consider every member of `pool` (reported when not healthy) and return them, best first. */
+    candidates(pool: string | readonly string[]): string[];
+    /**
+     * The best key of `pool` (marked used); an invalid or expired key when nothing better is left (try
+     * it and record the outcome). Undefined only when the pool has no member.
+     */
+    pick(pool: string | readonly string[]): string | undefined;
+    /** Like `pick`, but throws `NoUsableCredentialError` when the pool has no member. */
+    require(pool: string | readonly string[]): string;
+    /** Mark a declared `key` as used by this call without recording an outcome. */
+    use(key: string): void;
+    record(key: string, outcome: CredentialOutcome, info?: CredentialOutcomeInfo): void;
+    /**
+     * Try the members of `pool` in order (best first, invalid and expired last): `fn(key, value)` for each
+     * until one succeeds. A failure that is a credential problem (see `credentialOutcomeFromError`) is
+     * recorded and the next key is tried; any other error is rethrown. When every member failed on its
+     * credential (or the pool is empty) it throws `NoUsableCredentialError`.
+     */
+    withFallback<T>(pool: string | readonly string[], fn: (key: string, value: string | undefined) => Promise<T>): Promise<T>;
+    /** Whether this call touched any credential. */
+    get touchedAny(): boolean;
+    /**
+     * The report entries: every key the call used, plus every considered key that is not healthy
+     * (degraded, invalid, expired). Considered-but-unused healthy keys are left out.
+     */
+    report(): CredentialReportEntry[];
+}
+/** The report as one line the model reads: `Credentials: A used; B degraded (quota, retry in 60s); C invalid`. */
+export declare function formatCredentialReport(entries: readonly CredentialReportEntry[]): string;
+/**
+ * Run `fn` with `scope` as the current call's credential scope (registerTools does this per call).
+ * Outcomes are recorded into the scope active where a request STARTS: a shared in-flight promise
+ * (a dedup cache, a coalesced request) reports its key on the call that started it only.
+ */
+export declare function runWithCredentialScope<T>(scope: CredentialScope, fn: () => T): T;
+/** The current tool call's credential scope, when inside one. */
+export declare function currentCredentialScope(): CredentialScope | undefined;
+/** The facts `credentialOutcomeFromHttp` reads. */
+export interface CredentialHttpFacts {
+    /** HTTP status; undefined for a network error. */
+    status?: number;
+    /** Upstream or normalized error code. */
+    code?: string;
+    /** Upstream error message (already masked). */
+    message?: string;
+    /** Upstream OAuth-style `error_description` (already masked), when the body carried one apart from `message`. */
+    description?: string;
+    /**
+     * The `WWW-Authenticate` response header, when present. Only its `error` and `error_description`
+     * parameters are read (RFC 6750), never the realm or anything else.
+     */
+    authenticate?: string;
+    /** The challenge's parameters already parsed (`HttpError.challenge`); used instead of `authenticate`. */
+    challenge?: AuthChallenge;
+    retryAfterMs?: number;
+}
+/** The two `WWW-Authenticate` parameters the credential mapping reads (RFC 6750). */
+export interface AuthChallenge {
+    error?: string;
+    description?: string;
+}
+/**
+ * The `error` and `error_description` auth-params of a `WWW-Authenticate` header (first occurrence of
+ * each). The header is tokenised left to right: a quoted string (`"..."` with backslash escapes, or
+ * `'...'`) is one value and is never searched, so a quoted realm cannot inject a parameter.
+ */
+export declare function parseAuthChallenge(header: string | undefined): AuthChallenge;
+/**
+ * Map an HTTP outcome onto a credential outcome, status-gated:
+ * - 2xx/3xx -> ok; 5xx, network errors and every other 4xx (400, 404, 409, 413, 422, ...) -> used;
+ * - 401 -> invalid, or expired when the code, message, `error_description` or the `WWW-Authenticate`
+ *   `error` / `error_description` parameters name an expired credential (GitLab: `error="invalid_token",
+ *   error_description="Token is expired"`);
+ * - 402 -> degraded (quota); 429 -> degraded (rate limit, or quota when the body says so);
+ * - 403 -> expired / degraded / invalid ONLY when the body (or the challenge's `error="invalid_token"`)
+ *   says the credential itself expired, hit a quota or rate limit, or was rejected; a plain 403 is an
+ *   authorization answer about one resource and leaves the key alone (used).
+ * Degraded outcomes carry the Retry-After.
+ */
+export declare function credentialOutcomeFromHttp(facts: CredentialHttpFacts): ClassifiedOutcome;
+/**
+ * Classify a thrown error as a credential problem, or undefined when it is not one. Reads an
+ * `HttpError`-shaped object (`status`, `code`, `message`, `description`, `challenge`, `retryAfterMs`), so
+ * it reaches the same verdict the http-client recorded (an expired GitLab token stays expired inside
+ * `withFallback` and on a throwing startup check); only invalid, expired and degraded count.
+ */
+export declare function credentialOutcomeFromError(err: unknown): ClassifiedOutcome | undefined;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAa,KAAK,MAAM,EAAoB,MAAM,mBAAmB,CAAC;AAG7E;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAExF,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAA2D,CAAC;AAEvH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAEjG,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAkB,SAAQ,qBAAqB;IAC9D,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4FAA4F;AAC5F,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAAC;AAElG,MAAM,WAAW,yBAAyB;IACxC,qBAAqB;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD,eAAO,MAAM,6BAA6B,SAAU,CAAC;AAYrD,8GAA8G;AAC9G,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;gBACrB,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM;CAUnE;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAOhD;AAkBD,qEAAqE;AACrE,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,GAAE,yBAA8B;IAOnD,OAAO,CAAC,GAAG;IAIX,4FAA4F;IAC5F,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI9B;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,IAAI;IAuB5D,kGAAkG;IAClG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI;IAInD;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAOlD,uEAAuE;IACvE,KAAK,IAAI,IAAI;IAMb,mDAAmD;IACnD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB,uDAAuD;IACvD,OAAO,CAAC,KAAK;IAMb,qFAAqF;IACrF,OAAO,CAAC,OAAO;IAMf,iEAAiE;IACjE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB;IAOrC;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE;IAUnD;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,GAAE,qBAAqB,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,IAAI;IAKzG,wEAAwE;IACxE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,GAAE,qBAA0B,GAAG,IAAI;IAOvF,gDAAgD;IAChD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxB,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,aAAa;IAqBrB,kGAAkG;IAClG,OAAO,CAAC,IAAI;IAeZ;;;OAGG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsB/C,gGAAgG;IAChG,OAAO,CAAC,UAAU;IASlB;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE;IAiBtD,8FAA8F;IAC9F,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS;IAI1D,yDAAyD;IACzD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAe/C,uDAAuD;IACvD,QAAQ,IAAI,eAAe,EAAE;CAG9B;AAID,uFAAuF;AACvF,wBAAgB,kBAAkB,IAAI,kBAAkB,CAGvD;AAED,8FAA8F;AAC9F,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAEpF;AAED,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,CAAC;IACzB,qEAAqE;IACrE,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,mDAAmD;IACnD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACrF;AAED,+FAA+F;AAC/F,qBAAa,eAAgB,YAAW,kBAAkB;IACxD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;gBAEnD,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAA2B;IAKzG,OAAO,CAAC,KAAK;IAMb,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB,+FAA+F;IAC/F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE;IAKtD;;;OAGG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS;IAM1D,qFAAqF;IACrF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,MAAM;IAMjD,+EAA+E;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKtB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,GAAE,qBAA0B,GAAG,IAAI;IAKvF;;;;;OAKG;IACG,YAAY,CAAC,CAAC,EAClB,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAChC,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GACzD,OAAO,CAAC,CAAC,CAAC;IAsBb,gDAAgD;IAChD,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;OAGG;IACH,MAAM,IAAI,qBAAqB,EAAE;CAalC;AAMD,kHAAkH;AAClH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GAAG,MAAM,CASxF;AAID;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEhF;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,IAAI,eAAe,GAAG,SAAS,CAEpE;AAED,mDAAmD;AACnD,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iHAAiH;IACjH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yGAAyG;IACzG,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAKD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAqD5E;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,mBAAmB,GAAG,iBAAiB,CAgCvF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CA2BtF"}