@rubytech/create-maxy-code 0.1.469 → 0.1.470

package/dist/index.js

@@ -3720,6 +3720,46 @@ function installServiceDarwin() {
             }
         }
         logFile(`  [installer] op=outlook-client-id brand=${BRAND.hostname} stamped=${BRAND.outlookClientId ? "true" : "false"}`);
+        // Task 1761 — same upsert/strip discipline for the Google vendor app.
+        // GOOGLE_PUBLIC_BASE is the https origin the consent redirect returns to;
+        // it must match the authorized redirect URI on the vendor app byte-for-byte,
+        // so it is derived from the brand's public host, not guessed at call time.
+        // GOOGLE_PUBLIC_BASE is the https origin Google redirects back to. It is a
+        // property of THIS INSTALL's tunnel, not of the brand, so it is read from
+        // the same tunnel.state the uninstaller reads. Absent tunnel → the var is
+        // stripped and google-account-register refuses with an actionable message,
+        // rather than a guessed host that would fail Google's byte-for-byte
+        // redirect_uri comparison at the token exchange.
+        let googlePublicBase = "";
+        try {
+            const tunnelState = join(PERSIST_DIR, "cloudflared/tunnel.state");
+            if (existsSync(tunnelState)) {
+                const parsed = JSON.parse(readFileSync(tunnelState, "utf-8"));
+                if (parsed.domain)
+                    googlePublicBase = `https://public.${parsed.domain}`;
+            }
+        }
+        catch {
+            // Unreadable tunnel state is not fatal to the install; the var stays unset.
+        }
+        if (BRAND.googleClientId) {
+            for (const [key, value] of [
+                ["GOOGLE_CLIENT_ID", BRAND.googleClientId],
+                ["GOOGLE_PUBLIC_BASE", googlePublicBase],
+            ]) {
+                const re = new RegExp(`^${key}=.*$`, "m");
+                if (re.test(envContent))
+                    envContent = envContent.replace(re, `${key}=${value}`);
+                else
+                    envContent = envContent.trimEnd() + (envContent.length > 0 ? "\n" : "") + `${key}=${value}\n`;
+            }
+        }
+        else {
+            for (const key of ["GOOGLE_CLIENT_ID", "GOOGLE_PUBLIC_BASE"]) {
+                envContent = envContent.replace(new RegExp(`^${key}=.*\\n?`, "m"), "");
+            }
+        }
+        logFile(`  [installer] op=google-client-id brand=${BRAND.hostname} stamped=${BRAND.googleClientId ? "true" : "false"} publicBase=${googlePublicBase || "unset"}`);
         writeFileSync(envPath, envContent);
         logFile(`  .env: DISPLAY_MODE=${DISPLAY_MODE}, EMBED_MODEL=${EMBED_MODEL}, EMBED_DIMENSIONS=${EMBED_DIMS}, NEO4J_URI=bolt://localhost:${NEO4J_PORT}, PORT=${PORT}, MAXY_UI_INTERNAL_PORT=${PORT} (darwin-collapsed), CLAUDE_SESSION_MANAGER_PORT=${BRAND.claudeSessionManagerPort}, HOSTNAME=0.0.0.0, ACCOUNT_ID=${installAccountId.slice(0, 8)}…, CLAUDE_CONFIG_DIR=${persistDir}/.claude, CLAUDE_BIN=${canonicalClaude ?? "unresolved(PATH)"}, NODE_BIN=${nodeBin}, PATH=${darwinServiceEnvPath}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.469",
+  "version": "0.1.470",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/config/brand.json

@@ -15,6 +15,7 @@
   "cdpPort": 9222,
   "claudeSessionManagerPort": 19400,
   "outlookClientId": "",
+  "googleClientId": "",
   "commercialMode": false,
   "vertical": "schema-knowledge-work",
   "shipsPremiumBundles": ["venture-studio", "writer-craft", "teaching", "management-consulting"],

package/payload/platform/plugins/.claude-plugin/marketplace.json

@@ -59,6 +59,11 @@
       "source": "./filesystem",
       "version": "0.1.0"
     },
+    {
+      "name": "google",
+      "source": "./google",
+      "version": "0.1.0"
+    },
     {
       "name": "graph",
       "source": "./graph",

package/payload/platform/plugins/admin/hooks/lib/maxy-mcp-plugins.txt

@@ -5,6 +5,7 @@ connector
 contacts
 email
 filesystem
+google
 graph
 graph-viewer
 joblogic

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:c2a25fe4d72c9db00a75f700eb4642cb78ac01835892daf406e7bf0f438a9bb8
+content-hash: sha256:4f7717f06a4d87172809793ad9a02cfe57e3b4f6ec4b2f0f2dbff39792ef5456
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2152,6 +2152,79 @@ Latency triage: `mail-list count=0 elapsedMs<200` consistent → permissions iss
 
 Mail move to arbitrary folders / flag, hard (permanent) delete, removing an attachment from a **sent** message (Graph forbids it), ingesting reviewed mail into the business graph (the `email-ingest` analogue), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments, with a draft's attachments editable in place (add, remove, replace) — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
 
+---
+# Google Calendar
+Source: https://docs.getmaxy.com/google-guide.md
+
+# Google Calendar
+
+Live Google Calendar for one account: read the user's real events, and create,
+update, cancel, respond to and check availability against them. Eleven tools,
+admin agent only.
+
+There is deliberately no Gmail surface here. Mail runs on the `email` plugin's
+IMAP/SMTP path, and Gmail's read/modify scopes are *restricted*, which would
+force Google's annual third-party security assessment. Calendar is only a
+*sensitive* scope, so it needs the lighter brand verification.
+
+## Connecting an account
+
+`google-account-register` returns a consent URL. Relay it to the user: they open
+it on any device, sign in, and approve. Google redirects to this install's
+public host at `/api/google/oauth/callback`, which exchanges the code and stores
+encrypted tokens. `google-account-register-poll` then reports the outcome.
+
+The register tool does not block and does not wait. A second register while one
+is already live is refused rather than overwriting it; that refusal names how
+long the live one has been pending.
+
+One account can connect several Google accounts. Every operational tool takes an
+optional `account` (the email address). Omit it when there is one; with two or
+more, omitting it returns a refusal listing them.
+
+## Reading and controlling
+
+- `google-calendar-list` — events in the next `rangeDays` days (default 7).
+  Recurring series are expanded into instances, so this returns what the user
+  actually sees in their calendar.
+- `google-calendar-event` — one event by id.
+- `google-calendar-create` — times are RFC3339 (`2026-07-20T09:00:00Z`) unless
+  `allDay` is true, in which case they are plain dates (`2026-07-20`).
+- `google-calendar-update` — changes only the fields you name. Omitted fields
+  are left alone, so an update never blanks something by accident.
+- `google-calendar-cancel` — deletes the event and notifies attendees.
+- `google-calendar-respond` — accept, decline or tentatively accept an
+  invitation. Every other attendee's response is preserved.
+- `google-calendar-freebusy` — busy blocks between two times. Free time is the
+  complement, which you work out.
+
+## Checking health
+
+`google-account-list` answers "is anything connected?" from local stores with no
+network call. Read each entry's `status` — a count alone is not "connected", and
+an unreadable store still counts. `google-account-info` gives one account's auth
+state, including whether its access token is near expiry and which scopes were
+granted.
+
+## When something is wrong
+
+**"GOOGLE_CLIENT_ID is not configured"** — this brand has no Google vendor app
+yet. Nothing the operator does on the device fixes it; the brand needs its own
+Google Cloud OAuth client. See `platform/plugins/google/references/auth.md`.
+
+**A 403 naming insufficient scope** — the connected account approved something
+narrower than the full calendar scope. Re-run `google-account-register` so they
+re-consent.
+
+**The user re-consents every week** — the brand's Google app is still in
+Testing, where Google caps refresh tokens at seven days and limits the app to
+100 named test users. Completing brand verification removes both. This is a
+property of the vendor app, not a fault in the connection.
+
+**A registration never completes** — the consent URL was opened but not
+approved, or the callback could not be reached. `google-account-register-poll`
+reports `expired` once the pending entry outlives Google's code lifetime.
+
 ---
 # QuickBooks Online
 Source: https://docs.getmaxy.com/quickbooks.md

package/payload/platform/plugins/docs/references/google-guide.md

@@ -0,0 +1,68 @@
+# Google Calendar
+
+Live Google Calendar for one account: read the user's real events, and create,
+update, cancel, respond to and check availability against them. Eleven tools,
+admin agent only.
+
+There is deliberately no Gmail surface here. Mail runs on the `email` plugin's
+IMAP/SMTP path, and Gmail's read/modify scopes are *restricted*, which would
+force Google's annual third-party security assessment. Calendar is only a
+*sensitive* scope, so it needs the lighter brand verification.
+
+## Connecting an account
+
+`google-account-register` returns a consent URL. Relay it to the user: they open
+it on any device, sign in, and approve. Google redirects to this install's
+public host at `/api/google/oauth/callback`, which exchanges the code and stores
+encrypted tokens. `google-account-register-poll` then reports the outcome.
+
+The register tool does not block and does not wait. A second register while one
+is already live is refused rather than overwriting it; that refusal names how
+long the live one has been pending.
+
+One account can connect several Google accounts. Every operational tool takes an
+optional `account` (the email address). Omit it when there is one; with two or
+more, omitting it returns a refusal listing them.
+
+## Reading and controlling
+
+- `google-calendar-list` — events in the next `rangeDays` days (default 7).
+  Recurring series are expanded into instances, so this returns what the user
+  actually sees in their calendar.
+- `google-calendar-event` — one event by id.
+- `google-calendar-create` — times are RFC3339 (`2026-07-20T09:00:00Z`) unless
+  `allDay` is true, in which case they are plain dates (`2026-07-20`).
+- `google-calendar-update` — changes only the fields you name. Omitted fields
+  are left alone, so an update never blanks something by accident.
+- `google-calendar-cancel` — deletes the event and notifies attendees.
+- `google-calendar-respond` — accept, decline or tentatively accept an
+  invitation. Every other attendee's response is preserved.
+- `google-calendar-freebusy` — busy blocks between two times. Free time is the
+  complement, which you work out.
+
+## Checking health
+
+`google-account-list` answers "is anything connected?" from local stores with no
+network call. Read each entry's `status` — a count alone is not "connected", and
+an unreadable store still counts. `google-account-info` gives one account's auth
+state, including whether its access token is near expiry and which scopes were
+granted.
+
+## When something is wrong
+
+**"GOOGLE_CLIENT_ID is not configured"** — this brand has no Google vendor app
+yet. Nothing the operator does on the device fixes it; the brand needs its own
+Google Cloud OAuth client. See `platform/plugins/google/references/auth.md`.
+
+**A 403 naming insufficient scope** — the connected account approved something
+narrower than the full calendar scope. Re-run `google-account-register` so they
+re-consent.
+
+**The user re-consents every week** — the brand's Google app is still in
+Testing, where Google caps refresh tokens at seven days and limits the app to
+100 named test users. Completing brand verification removes both. This is a
+property of the vendor app, not a fault in the connection.
+
+**A registration never completes** — the consent URL was opened but not
+approved, or the callback could not be reached. `google-account-register-poll`
+reports `expired` once the pending entry outlives Google's code lifetime.

package/payload/platform/plugins/google/.claude-plugin/plugin.json

@@ -0,0 +1,21 @@
+{
+  "name": "google",
+  "description": "Live Google Calendar for one account via the Google Calendar API v3 — read plus control. Per-account OAuth authorization-code + PKCE; the consent URL is minted by the plugin and the code is exchanged by platform/ui, which holds the house-only client secret. One account can connect several Google accounts; every operational tool takes an optional account selector (the email address) and refuses ambiguously when two or more are connected and none is named. There is deliberately no Gmail surface — mail runs on the `email` plugin's IMAP/SMTP path, and Gmail's restricted scopes would force Google's annual third-party security assessment, whereas Calendar is only a sensitive scope. Tools — google-account-register / google-account-register-poll: connect a Google Calendar (returns a consent URL, then reports the outcome from local state); google-calendar-list: events in the next rangeDays days, recurring series expanded; google-calendar-event: one event by id; google-calendar-create / google-calendar-update / google-calendar-cancel: control events, attendees notified, update changes only the fields named; google-calendar-respond: accept, decline or tentatively accept an invitation, leaving other attendees' responses untouched; google-calendar-freebusy: busy blocks for this or named calendars; google-account-info: auth state for one connected Google account; google-account-list: every connected Google account with its own status.",
+  "version": "0.1.0",
+  "author": {
+    "name": "Rubytech LLC"
+  },
+  "mcpServers": {
+    "google": {
+      "type": "stdio",
+      "command": "node",
+      "args": [
+        "${CLAUDE_PLUGIN_ROOT}/lib/mcp-spawn-tee/index.js",
+        "${CLAUDE_PLUGIN_ROOT}/mcp/dist/index.js"
+      ],
+      "env": {
+        "MCP_SPAWN_TEE_NAME": "google"
+      }
+    }
+  }
+}

package/payload/platform/plugins/google/PLUGIN.md

@@ -0,0 +1,104 @@
+---
+name: google
+description: Live Google Calendar for one account via the Google Calendar API v3 — read plus control. Per-account OAuth authorization-code + PKCE; the consent URL is minted by the plugin and the code is exchanged by platform/ui, which holds the house-only client secret. One account can connect several Google accounts; every operational tool takes an optional account selector (the email address) and refuses ambiguously when two or more are connected and none is named. There is deliberately no Gmail surface — mail runs on the `email` plugin's IMAP/SMTP path, and Gmail's restricted scopes would force Google's annual third-party security assessment, whereas Calendar is only a sensitive scope. Tools — google-account-register / google-account-register-poll: connect a Google Calendar (returns a consent URL, then reports the outcome from local state); google-calendar-list: events in the next rangeDays days, recurring series expanded; google-calendar-event: one event by id; google-calendar-create / google-calendar-update / google-calendar-cancel: control events, attendees notified, update changes only the fields named; google-calendar-respond: accept, decline or tentatively accept an invitation, leaving other attendees' responses untouched; google-calendar-freebusy: busy blocks for this or named calendars; google-account-info: auth state for one connected Google account; google-account-list: every connected Google account with its own status.
+tools:
+  - name: google-account-register
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: google-account-register-poll
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: google-calendar-list
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: google-calendar-event
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: google-calendar-create
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: google-calendar-update
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: google-calendar-cancel
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: google-calendar-respond
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: google-calendar-freebusy
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: google-account-info
+    publicAllowlist: false
+    adminAllowlist: false
+  - name: google-account-list
+    publicAllowlist: false
+    adminAllowlist: false
+mcp:
+  command: node
+  args:
+    - ${PLATFORM_ROOT}/lib/mcp-spawn-tee/dist/index.js
+    - ${PLATFORM_ROOT}/plugins/google/mcp/dist/index.js
+  env:
+    MCP_SPAWN_TEE_NAME: google
+    LOG_DIR: ${LOG_DIR}
+    PLATFORM_ROOT: ${PLATFORM_ROOT}
+    ACCOUNT_ID: ${ACCOUNT_ID}
+    SESSION_ID: ${SESSION_ID}
+    GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
+    GOOGLE_PUBLIC_BASE: ${GOOGLE_PUBLIC_BASE}
+    MAXY_UI_INTERNAL_PORT: ${MAXY_UI_INTERNAL_PORT}
+mcp-manifest: auto
+---
+
+# Google Calendar
+
+Per-account live Google Calendar. Read the user's real events, and create,
+update, cancel, respond to and check availability against them.
+
+## Why this exists
+
+A client sub-account cannot hold a claude.ai connector: connectors are
+authorised per client and visible only to the admin/claude.ai session, and the
+install holds one house Google identity that cannot represent each client's
+separate calendar. Before this plugin the only live-calendar path was that
+house-admin-only connector, so a client asking "what is on my calendar?" was
+dead-ended. See `references/auth.md`.
+
+## Auth
+
+Authorization-code + PKCE, not device-code. Google's device flow serves a fixed
+scope allowlist that excludes Calendar, and the out-of-band paste-a-code flow
+has been blocked since 31 January 2023, so consent must land on a real redirect.
+
+`google-account-register` mints the PKCE pair and a `state` nonce, persists them
+single-slot per account, and returns a consent URL. The user opens it on any
+device and approves. Google redirects to `/api/google/oauth/callback` on this
+install's public host, which verifies `state`, exchanges the code, resolves the
+account's email from its primary calendar, and writes encrypted tokens.
+`google-account-register-poll` then reports the outcome from local state.
+
+The client secret never enters this MCP process. A Web-application client must
+present it to refresh, so refresh is delegated to `platform/ui`, which holds it
+at `${PLATFORM_ROOT}/config/google-house.env`.
+
+## Scope
+
+One scope: `https://www.googleapis.com/auth/calendar`. The account's email is
+read from `GET /calendars/primary` (whose id is the address) rather than by
+requesting `openid`/`email`/`profile`, so consent stays minimal.
+
+## Configuration
+
+| Variable | Source | Effect when unset |
+|---|---|---|
+| `GOOGLE_CLIENT_ID` | `brand.json#googleClientId` | Plugin inert; register refuses with an actionable message |
+| `GOOGLE_PUBLIC_BASE` | install's public host origin | Register refuses; the redirect cannot be built |
+| `MAXY_ADMIN_BASE` | loopback `platform/ui` base | Defaults to `http://127.0.0.1:19301` |
+
+## Out of scope
+
+Gmail (stays on IMAP/SMTP), Contacts, Drive/Docs, push notification channels,
+recurring-series per-occurrence editing, and auto-sync with the internal
+`scheduling` plugin.

package/payload/platform/plugins/google/lib/mcp-spawn-tee/index.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * MCP spawn-tee — in-process stderr capture + lifecycle observability.
+ *
+ * Claude Code spawns each MCP server itself; the platform never holds a
+ * ChildProcess handle. This shim sits between Claude Code and the real MCP
+ * server: Claude Code runs `node <this> <real-entry>`, and the shim runs the
+ * real entry IN ITS OWN PROCESS via dynamic import() — one node runtime, not
+ * two. Before importing, it replaces process.stderr.write with a tee so every
+ * stderr byte the server writes is mirrored to the log sinks; stdin and stdout
+ * (the JSON-RPC channel) are never touched.
+ *
+ *   Claude Code CLI → shim (this file) = node running <real-entry> in-process
+ *        stdin/stdout : untouched (JSON-RPC channel)
+ *        stderr       : process.stderr.write teed → raw sink + passthrough
+ *
+ * Destinations:
+ *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — raw stderr + lifecycle lines.
+ *     The sole raw sink. Task 1721 retired the per-date twin: its date was
+ *     pinned at spawn, no reader ever parsed it, and a since-removed stderr
+ *     tee wrote the same file, so every line landed twice.
+ *   - `${LOG_DIR}/mcp-<name>-nosession.log`      — the same, for a spawn with
+ *     no SESSION_ID (enumeration). One fixed file per server.
+ *   - `server.log` via the loopback log-ingest route — best-effort mirror of
+ *     the [mcp-helper] lifecycle lines.
+ *
+ * Lifecycle lines, correlation key `session=<id8> server=<name>` — unchanged:
+ *   [mcp-helper] op=spawn ... pid= entry=
+ *   [mcp-helper] op=boot  ... head=<first stderr bytes>
+ *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=
+ *
+ * Process model (Task 989): the shim IS the server's process. op=exit fires
+ * from process.on("exit"), so it covers a normal exit, a non-zero exit, an
+ * uncaught throw (code 1), and a catchable-signal exit (SIGTERM/SIGINT/SIGHUP,
+ * whose handlers record the signal name). An external SIGKILL is uncatchable
+ * and leaves no op=exit line — the per-session stderr tail already on disk and
+ * Claude Code's own transport-drop are the evidence for that death mode.
+ *
+ * The shim never writes to fd 1 (stdout) — that is the JSON-RPC channel.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
+const SERVER_NAME = process.env.MCP_SPAWN_TEE_NAME ?? "unknown";
+const LOG_DIR = process.env.LOG_DIR;
+const SESSION_ID = process.env.SESSION_ID;
+const PLATFORM_PORT = process.env.PLATFORM_PORT;
+const ENTRY = process.argv[2];
+const SESSION_ID8 = SESSION_ID ? SESSION_ID.slice(0, 8) : "—";
+const spawnStamp = Date.now();
+// The one raw sink (Task 1721). A sessionless spawn (rc-daemon stamps
+// SESSION_ID='' — rc-daemon.ts:513 — while still stamping LOG_DIR) shares one
+// fixed file per server rather than a date-named one: the date was never read
+// by any reader and named a process lifetime, not a day. Interleaved spawns in
+// the nosession file are separated by the [mcp-helper] op=spawn pid= lines.
+const rawSinkPath = LOG_DIR
+    ? (0, node_path_1.resolve)(LOG_DIR, SESSION_ID ? `mcp-${SERVER_NAME}-${SESSION_ID}.log` : `mcp-${SERVER_NAME}-nosession.log`)
+    : undefined;
+// Rolling tail of entry stderr for op=exit. Capped so a chatty server cannot
+// grow the buffer without bound.
+const TAIL_CAP = 2048;
+let stderrTail = "";
+let bootEmitted = false;
+let exitEmitted = false;
+let exitSignal;
+// The real stderr writer, captured before the tee replaces it. Lifecycle lines
+// and stderr passthrough both go through this so they are never re-teed into
+// the raw sink nor recursed back into the patched writer.
+const rawStderrWrite = process.stderr.write.bind(process.stderr);
+// LOG_DIR is created once, lazily, on the first successful append — not per
+// chunk. teeWrite runs on the server's own stderr hot path now, so a per-call
+// mkdirSync would be two syscalls per log line for nothing.
+let logDirReady = false;
+function appendSafe(path, data) {
+    if (!path || !LOG_DIR)
+        return;
+    try {
+        if (!logDirReady) {
+            (0, node_fs_1.mkdirSync)(LOG_DIR, { recursive: true });
+            logDirReady = true;
+        }
+        (0, node_fs_1.appendFileSync)(path, data);
+    }
+    catch {
+        /* unwritable destination — never mask primary output */
+    }
+}
+// Best-effort mirror of a lifecycle line to server.log via the loopback
+// log-ingest route. Fire-and-forget: the per-session file is authoritative, so
+// a dropped POST loses nothing. On the "exit" event the loop is stopping, so
+// the op=exit mirror may not flush — the per-session line, written sync, holds.
+function postToServerLog(suffix, level) {
+    if (!PLATFORM_PORT)
+        return;
+    try {
+        const ctrl = new AbortController();
+        const t = setTimeout(() => ctrl.abort(), 500);
+        t.unref?.(); // never let the abort timer keep the shim's event loop alive
+        void fetch(`http://127.0.0.1:${PLATFORM_PORT}/api/admin/log-ingest`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ tag: "mcp-helper", level, line: suffix }),
+            signal: ctrl.signal,
+        }).then(() => clearTimeout(t)).catch(() => clearTimeout(t));
+    }
+    catch {
+        /* fetch threw synchronously — best-effort only */
+    }
+}
+// Emit one [mcp-helper] lifecycle line: authoritative per-session file (sync,
+// survives process.exit), the shim's own stderr via the RAW writer (journald /
+// Claude Code visibility, never re-teed), and a best-effort server.log mirror.
+// `suffix` is the line body after the tag and carries no newline (the
+// log-ingest route rejects newlines).
+function emitLifecycle(suffix, level) {
+    const line = `[mcp-helper] ${suffix}\n`;
+    appendSafe(rawSinkPath, line);
+    try {
+        rawStderrWrite(line);
+    }
+    catch { /* stderr closed */ }
+    postToServerLog(suffix, level);
+}
+if (!ENTRY) {
+    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason="no entry given (argv[2] missing)"`, "error");
+    process.exit(2);
+}
+// Replace process.stderr.write with a tee: mirror every server stderr byte to
+// the raw sink, keep a rolling tail for op=exit, emit
+// op=boot on the first bytes, then pass the write through to the real stderr.
+const teeWrite = ((...args) => {
+    const chunk = args[0];
+    appendSafe(rawSinkPath, chunk); // raw sink (Task 1721)
+    const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+    stderrTail = (stderrTail + text).slice(-TAIL_CAP);
+    if (!bootEmitted) {
+        bootEmitted = true;
+        const head = text.split("\n")[0].slice(0, 200);
+        emitLifecycle(`op=boot session=${SESSION_ID8} server=${SERVER_NAME} head=${JSON.stringify(head)}`, "info");
+    }
+    return rawStderrWrite(...args); // passthrough
+});
+process.stderr.write = teeWrite;
+// Catchable-signal handling. The shim drives the exit ONLY when it is the sole
+// listener for the signal — i.e. the imported entry installed no handler of its
+// own. In that case it records the signal (so op=exit carries signal=<sig>) and
+// exits with 128+signum, mirroring the prior wrapper's exit-status convention.
+//
+// When the entry DID install a handler, the shim defers entirely and records
+// nothing: the entry's handler decides the exit code, and op=exit reflects that
+// exit verbatim. This matches the prior two-process model, where a child that
+// caught the signal and exited cleanly was observed as code=0 signal=— (a clean
+// self-exit), not as a signal death. Setting exitSignal here unconditionally
+// would mislabel every graceful signal-driven shutdown as a signal kill.
+function onSignal(sig, code) {
+    return () => {
+        if (process.listenerCount(sig) === 1) {
+            exitSignal = sig;
+            process.exit(code);
+        }
+    };
+}
+process.on("SIGTERM", onSignal("SIGTERM", 143));
+process.on("SIGINT", onSignal("SIGINT", 130));
+process.on("SIGHUP", onSignal("SIGHUP", 129));
+// op=exit, emitted once from the process "exit" event. Sync-only — the loop is
+// stopping. When a catchable signal caused the exit, report code=— signal=<sig>
+// to match the prior wrapper's format; otherwise code=<exit code> signal=—.
+process.on("exit", (code) => {
+    if (exitEmitted)
+        return;
+    exitEmitted = true;
+    const lifetimeMs = Date.now() - spawnStamp;
+    const tail = stderrTail.slice(-200);
+    const codeField = exitSignal ? "—" : String(code);
+    const level = exitSignal || code !== 0 ? "error" : "info";
+    emitLifecycle(`op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} ` +
+        `code=${codeField} signal=${exitSignal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level);
+});
+emitLifecycle(`op=spawn session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} entry=${ENTRY}`, "info");
+// Run the real MCP server in THIS process. Dynamic import() (not top-level
+// await — this file compiles to CommonJS) loads the ESM entry; a load-time
+// failure mirrors the old child spawn-error path (op=error, exit 127). The
+// op=exit handler is suppressed on this path so op=error stays the sole record.
+import((0, node_url_1.pathToFileURL)(ENTRY).href).catch((err) => {
+    const msg = err instanceof Error ? err.message : String(err);
+    exitEmitted = true;
+    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`import error: ${msg}`)}`, "error");
+    process.exit(127);
+});
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/google/lib/mcp-spawn-tee/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/payload/platform/plugins/google/mcp/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@maxy/google",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "test": "node --test dist/__tests__/*.test.js",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0"
+  }
+}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAuB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAsStD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAwB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAiTtD,CAAA"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js

@@ -14,6 +14,7 @@ export const MAXY_MCP_PLUGINS = [
     "contacts",
     "email",
     "filesystem",
+    "google",
     "graph",
     "graph-viewer",
     "joblogic",
@@ -127,6 +128,17 @@ export const CANONICAL_MAXY_TOOL_NAMES = [
     "mcp__plugin_filesystem_filesystem__file-list",
     "mcp__plugin_filesystem_filesystem__file-read",
     "mcp__plugin_filesystem_filesystem__file-write",
+    "mcp__plugin_google_google__google-account-info",
+    "mcp__plugin_google_google__google-account-list",
+    "mcp__plugin_google_google__google-account-register",
+    "mcp__plugin_google_google__google-account-register-poll",
+    "mcp__plugin_google_google__google-calendar-cancel",
+    "mcp__plugin_google_google__google-calendar-create",
+    "mcp__plugin_google_google__google-calendar-event",
+    "mcp__plugin_google_google__google-calendar-freebusy",
+    "mcp__plugin_google_google__google-calendar-list",
+    "mcp__plugin_google_google__google-calendar-respond",
+    "mcp__plugin_google_google__google-calendar-update",
     "mcp__plugin_graph-viewer_graph-viewer__graph-render",
     "mcp__plugin_graph_graph__maxy-graph-get_neo4j_schema",
     "mcp__plugin_graph_graph__maxy-graph-read_neo4j_cypher",

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.js","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,kEAAkE;AAClE,yDAAyD;AACzD,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO;IACP,KAAK;IACL,SAAS;IACT,WAAW;IACX,UAAU;IACV,OAAO;IACP,YAAY;IACZ,OAAO;IACP,cAAc;IACd,UAAU;IACV,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,cAAc;IACd,UAAU;IACV,MAAM;IACN,WAAW;CACZ,CAAA;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,yCAAyC;IACzC,yCAAyC;IACzC,kDAAkD;IAClD,sDAAsD;IACtD,yCAAyC;IACzC,yCAAyC;IACzC,uCAAuC;IACvC,wCAAwC;IACxC,iDAAiD;IACjD,yCAAyC;IACzC,iDAAiD;IACjD,yCAAyC;IACzC,sCAAsC;IACtC,yCAAyC;IACzC,wCAAwC;IACxC,oCAAoC;IACpC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,2CAA2C;IAC3C,4CAA4C;IAC5C,qCAAqC;IACrC,yCAAyC;IACzC,4CAA4C;IAC5C,oCAAoC;IACpC,sCAAsC;IACtC,0CAA0C;IAC1C,uCAAuC;IACvC,sCAAsC;IACtC,sDAAsD;IACtD,mDAAmD;IACnD,6CAA6C;IAC7C,wCAAwC;IACxC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,sCAAsC;IACtC,wCAAwC;IACxC,+BAA+B;IAC/B,qCAAqC;IACrC,sCAAsC;IACtC,yCAAyC;IACzC,4CAA4C;IAC5C,uDAAuD;IACvD,+CAA+C;IAC/C,2CAA2C;IAC3C,gDAAgD;IAChD,oDAAoD;IACpD,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,gDAAgD;IAChD,6CAA6C;IAC7C,6CAA6C;IAC7C,iDAAiD;IACjD,oDAAoD;IACpD,+CAA+C;IAC/C,2CAA2C;IAC3C,2CAA2C;IAC3C,+CAA+C;IAC/C,iDAAiD;IACjD,uDAAuD;IACvD,iDAAiD;IACjD,qDAAqD;IACrD,+CAA+C;IAC/C,+CAA+C;IAC/C,8CAA8C;IAC9C,+CAA+C;IAC/C,6CAA6C;IAC7C,+CAA+C;IAC/C,+CAA+C;IAC/C,6CAA6C;IAC7C,6CAA6C;IAC7C,uCAAuC;IACvC,sCAAsC;IACtC,2CAA2C;IAC3C,2CAA2C;IAC3C,sCAAsC;IACtC,2CAA2C;IAC3C,4CAA4C;IAC5C,uCAAuC;IACvC,4CAA4C;IAC5C,8CAA8C;IAC9C,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,+CAA+C;IAC/C,qDAAqD;IACrD,sDAAsD;IACtD,uDAAuD;IACvD,wDAAwD;IACxD,sDAAsD;IACtD,mDAAmD;IACnD,oDAAoD;IACpD,sDAAsD;IACtD,iEAAiE;IACjE,2DAA2D;IAC3D,yDAAyD;IACzD,yDAAyD;IACzD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,sDAAsD;IACtD,uDAAuD;IACvD,2DAA2D;IAC3D,0DAA0D;IAC1D,wDAAwD;IACxD,qDAAqD;IACrD,sDAAsD;IACtD,gEAAgE;IAChE,qDAAqD;IACrD,oDAAoD;IACpD,iDAAiD;IACjD,kDAAkD;IAClD,wDAAwD;IACxD,oDAAoD;IACpD,wDAAwD;IACxD,wDAAwD;IACxD,qDAAqD;IACrD,uDAAuD;IACvD,sDAAsD;IACtD,mDAAmD;IACnD,oDAAoD;IACpD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,qDAAqD;IACrD,0DAA0D;IAC1D,wDAAwD;IACxD,0DAA0D;IAC1D,sDAAsD;IACtD,sDAAsD;IACtD,sDAAsD;IACtD,mDAAmD;IACnD,8DAA8D;IAC9D,sDAAsD;IACtD,iEAAiE;IACjE,kEAAkE;IAClE,6DAA6D;IAC7D,8CAA8C;IAC9C,wDAAwD;IACxD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,wDAAwD;IACxD,wCAAwC;IACxC,wCAAwC;IACxC,iDAAiD;IACjD,wDAAwD;IACxD,0DAA0D;IAC1D,0CAA0C;IAC1C,6CAA6C;IAC7C,wCAAwC;IACxC,mDAAmD;IACnD,+CAA+C;IAC/C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,8CAA8C;IAC9C,oDAAoD;IACpD,kDAAkD;IAClD,+CAA+C;IAC/C,mDAAmD;IACnD,2CAA2C;IAC3C,qDAAqD;IACrD,+CAA+C;IAC/C,sDAAsD;IACtD,gDAAgD;IAChD,2CAA2C;IAC3C,gDAAgD;IAChD,0CAA0C;IAC1C,0CAA0C;IAC1C,kDAAkD;IAClD,yCAAyC;IACzC,kDAAkD;IAClD,2CAA2C;IAC3C,yCAAyC;IACzC,2CAA2C;IAC3C,4CAA4C;IAC5C,mDAAmD;IACnD,uDAAuD;IACvD,4DAA4D;IAC5D,sDAAsD;IACtD,sDAAsD;IACtD,qDAAqD;IACrD,wDAAwD;IACxD,oDAAoD;IACpD,uDAAuD;IACvD,sDAAsD;IACtD,oDAAoD;IACpD,4CAA4C;IAC5C,iDAAiD;IACjD,iDAAiD;IACjD,sDAAsD;IACtD,kDAAkD;IAClD,sDAAsD;IACtD,gDAAgD;IAChD,uDAAuD;IACvD,iDAAiD;IACjD,kDAAkD;IAClD,gDAAgD;IAChD,mDAAmD;IACnD,mDAAmD;IACnD,6DAA6D;IAC7D,2DAA2D;IAC3D,2DAA2D;IAC3D,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,0DAA0D;IAC1D,6DAA6D;IAC7D,6DAA6D;IAC7D,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,qDAAqD;IACrD,sDAAsD;IACtD,2DAA2D;IAC3D,iDAAiD;IACjD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,oDAAoD;IACpD,iEAAiE;IACjE,mDAAmD;IACnD,wDAAwD;IACxD,iDAAiD;IACjD,wDAAwD;IACxD,kDAAkD;IAClD,oDAAoD;IACpD,iDAAiD;IACjD,8DAA8D;IAC9D,4DAA4D;IAC5D,6DAA6D;IAC7D,gEAAgE;IAChE,iEAAiE;IACjE,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,wCAAwC;IACxC,gDAAgD;IAChD,0DAA0D;IAC1D,sCAAsC;IACtC,6DAA6D;IAC7D,kEAAkE;IAClE,8DAA8D;IAC9D,oEAAoE;IACpE,0DAA0D;IAC1D,kDAAkD;IAClD,gDAAgD;IAChD,kEAAkE;IAClE,uDAAuD;IACvD,oDAAoD;IACpD,oDAAoD;IACpD,qDAAqD;IACrD,oDAAoD;IACpD,kDAAkD;IAClD,oDAAoD;IACpD,gDAAgD;IAChD,yCAAyC;IACzC,uCAAuC;IACvC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;IACrC,yCAAyC;IACzC,qCAAqC;IACrC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,kCAAkC;IAClC,mCAAmC;IACnC,oCAAoC;IACpC,oCAAoC;IACpC,kDAAkD;IAClD,kDAAkD;IAClD,mDAAmD;IACnD,+CAA+C;IAC/C,gDAAgD;IAChD,gDAAgD;IAChD,kDAAkD;IAClD,oDAAoD;CACrD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.js","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,kEAAkE;AAClE,yDAAyD;AACzD,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO;IACP,KAAK;IACL,SAAS;IACT,WAAW;IACX,UAAU;IACV,OAAO;IACP,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,cAAc;IACd,UAAU;IACV,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,cAAc;IACd,UAAU;IACV,MAAM;IACN,WAAW;CACZ,CAAA;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,yCAAyC;IACzC,yCAAyC;IACzC,kDAAkD;IAClD,sDAAsD;IACtD,yCAAyC;IACzC,yCAAyC;IACzC,uCAAuC;IACvC,wCAAwC;IACxC,iDAAiD;IACjD,yCAAyC;IACzC,iDAAiD;IACjD,yCAAyC;IACzC,sCAAsC;IACtC,yCAAyC;IACzC,wCAAwC;IACxC,oCAAoC;IACpC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,2CAA2C;IAC3C,4CAA4C;IAC5C,qCAAqC;IACrC,yCAAyC;IACzC,4CAA4C;IAC5C,oCAAoC;IACpC,sCAAsC;IACtC,0CAA0C;IAC1C,uCAAuC;IACvC,sCAAsC;IACtC,sDAAsD;IACtD,mDAAmD;IACnD,6CAA6C;IAC7C,wCAAwC;IACxC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,sCAAsC;IACtC,wCAAwC;IACxC,+BAA+B;IAC/B,qCAAqC;IACrC,sCAAsC;IACtC,yCAAyC;IACzC,4CAA4C;IAC5C,uDAAuD;IACvD,+CAA+C;IAC/C,2CAA2C;IAC3C,gDAAgD;IAChD,oDAAoD;IACpD,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,gDAAgD;IAChD,6CAA6C;IAC7C,6CAA6C;IAC7C,iDAAiD;IACjD,oDAAoD;IACpD,+CAA+C;IAC/C,2CAA2C;IAC3C,2CAA2C;IAC3C,+CAA+C;IAC/C,iDAAiD;IACjD,uDAAuD;IACvD,iDAAiD;IACjD,qDAAqD;IACrD,+CAA+C;IAC/C,+CAA+C;IAC/C,8CAA8C;IAC9C,+CAA+C;IAC/C,6CAA6C;IAC7C,+CAA+C;IAC/C,+CAA+C;IAC/C,6CAA6C;IAC7C,6CAA6C;IAC7C,uCAAuC;IACvC,sCAAsC;IACtC,2CAA2C;IAC3C,2CAA2C;IAC3C,sCAAsC;IACtC,2CAA2C;IAC3C,4CAA4C;IAC5C,uCAAuC;IACvC,4CAA4C;IAC5C,8CAA8C;IAC9C,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,+CAA+C;IAC/C,gDAAgD;IAChD,gDAAgD;IAChD,oDAAoD;IACpD,yDAAyD;IACzD,mDAAmD;IACnD,mDAAmD;IACnD,kDAAkD;IAClD,qDAAqD;IACrD,iDAAiD;IACjD,oDAAoD;IACpD,mDAAmD;IACnD,qDAAqD;IACrD,sDAAsD;IACtD,uDAAuD;IACvD,wDAAwD;IACxD,sDAAsD;IACtD,mDAAmD;IACnD,oDAAoD;IACpD,sDAAsD;IACtD,iEAAiE;IACjE,2DAA2D;IAC3D,yDAAyD;IACzD,yDAAyD;IACzD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,sDAAsD;IACtD,uDAAuD;IACvD,2DAA2D;IAC3D,0DAA0D;IAC1D,wDAAwD;IACxD,qDAAqD;IACrD,sDAAsD;IACtD,gEAAgE;IAChE,qDAAqD;IACrD,oDAAoD;IACpD,iDAAiD;IACjD,kDAAkD;IAClD,wDAAwD;IACxD,oDAAoD;IACpD,wDAAwD;IACxD,wDAAwD;IACxD,qDAAqD;IACrD,uDAAuD;IACvD,sDAAsD;IACtD,mDAAmD;IACnD,oDAAoD;IACpD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,qDAAqD;IACrD,0DAA0D;IAC1D,wDAAwD;IACxD,0DAA0D;IAC1D,sDAAsD;IACtD,sDAAsD;IACtD,sDAAsD;IACtD,mDAAmD;IACnD,8DAA8D;IAC9D,sDAAsD;IACtD,iEAAiE;IACjE,kEAAkE;IAClE,6DAA6D;IAC7D,8CAA8C;IAC9C,wDAAwD;IACxD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,wDAAwD;IACxD,wCAAwC;IACxC,wCAAwC;IACxC,iDAAiD;IACjD,wDAAwD;IACxD,0DAA0D;IAC1D,0CAA0C;IAC1C,6CAA6C;IAC7C,wCAAwC;IACxC,mDAAmD;IACnD,+CAA+C;IAC/C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,8CAA8C;IAC9C,oDAAoD;IACpD,kDAAkD;IAClD,+CAA+C;IAC/C,mDAAmD;IACnD,2CAA2C;IAC3C,qDAAqD;IACrD,+CAA+C;IAC/C,sDAAsD;IACtD,gDAAgD;IAChD,2CAA2C;IAC3C,gDAAgD;IAChD,0CAA0C;IAC1C,0CAA0C;IAC1C,kDAAkD;IAClD,yCAAyC;IACzC,kDAAkD;IAClD,2CAA2C;IAC3C,yCAAyC;IACzC,2CAA2C;IAC3C,4CAA4C;IAC5C,mDAAmD;IACnD,uDAAuD;IACvD,4DAA4D;IAC5D,sDAAsD;IACtD,sDAAsD;IACtD,qDAAqD;IACrD,wDAAwD;IACxD,oDAAoD;IACpD,uDAAuD;IACvD,sDAAsD;IACtD,oDAAoD;IACpD,4CAA4C;IAC5C,iDAAiD;IACjD,iDAAiD;IACjD,sDAAsD;IACtD,kDAAkD;IAClD,sDAAsD;IACtD,gDAAgD;IAChD,uDAAuD;IACvD,iDAAiD;IACjD,kDAAkD;IAClD,gDAAgD;IAChD,mDAAmD;IACnD,mDAAmD;IACnD,6DAA6D;IAC7D,2DAA2D;IAC3D,2DAA2D;IAC3D,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,0DAA0D;IAC1D,6DAA6D;IAC7D,6DAA6D;IAC7D,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,qDAAqD;IACrD,sDAAsD;IACtD,2DAA2D;IAC3D,iDAAiD;IACjD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,oDAAoD;IACpD,iEAAiE;IACjE,mDAAmD;IACnD,wDAAwD;IACxD,iDAAiD;IACjD,wDAAwD;IACxD,kDAAkD;IAClD,oDAAoD;IACpD,iDAAiD;IACjD,8DAA8D;IAC9D,4DAA4D;IAC5D,6DAA6D;IAC7D,gEAAgE;IAChE,iEAAiE;IACjE,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,wCAAwC;IACxC,gDAAgD;IAChD,0DAA0D;IAC1D,sCAAsC;IACtC,6DAA6D;IAC7D,kEAAkE;IAClE,8DAA8D;IAC9D,oEAAoE;IACpE,0DAA0D;IAC1D,kDAAkD;IAClD,gDAAgD;IAChD,kEAAkE;IAClE,uDAAuD;IACvD,oDAAoD;IACpD,oDAAoD;IACpD,qDAAqD;IACrD,oDAAoD;IACpD,kDAAkD;IAClD,oDAAoD;IACpD,gDAAgD;IAChD,yCAAyC;IACzC,uCAAuC;IACvC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;IACrC,yCAAyC;IACzC,qCAAqC;IACrC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,kCAAkC;IAClC,mCAAmC;IACnC,oCAAoC;IACpC,oCAAoC;IACpC,kDAAkD;IAClD,kDAAkD;IAClD,mDAAmD;IACnD,+CAA+C;IAC/C,gDAAgD;IAChD,gDAAgD;IAChD,kDAAkD;IAClD,oDAAoD;CACrD,CAAA"}