@rubytech/create-sitedesk-code 0.1.340

package/payload/platform/plugins/cloudflare/.claude-plugin/plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "cloudflare",
+  "description": "Cloudflare operations — tunnel setup/reset, DNS, Pages hosting, D1 data capture, and dashboard guidance. Zero agent-facing MCP tools; every operation is the agent invoking `cloudflared` or `wrangler` directly via Bash, calling the Cloudflare API with a reused per-scope narrow token, or quoting a dashboard click-path the operator performs themselves.",
+  "version": "0.1.0",
+  "author": {
+    "name": "Rubytech LLC"
+  }
+}

package/payload/platform/plugins/cloudflare/PLUGIN.md

@@ -0,0 +1,62 @@
+---
+name: cloudflare
+description: Cloudflare operations — tunnel setup/reset, DNS, Pages hosting, D1 data capture, and dashboard guidance. Zero agent-facing MCP tools; every operation is the agent invoking `cloudflared` or `wrangler` directly via Bash, calling the Cloudflare API with a reused per-scope narrow token, or quoting a dashboard click-path the operator performs themselves.
+tools: []
+mcp-manifest: skip
+---
+
+# Cloudflare Tunnel
+
+Each installation has its own Cloudflare account. Two auth paths serve two operation classes. **Tunnel** auth is OAuth: the operator signs in via `cloudflared tunnel login` (issued by the agent through Bash); `cloudflared` writes `cert.pem` to the brand-scoped config directory. **API** auth (DNS, zones, Pages, D1, Access, token management) is the master token: the operator provisions one fully-scoped master token in the dashboard (an advanced, operator-guided step the agent never automates), stored at the account-scoped secrets file; the agent reads it only to provision **one stable narrow token per scope** — minting it once if absent, persisting it to the secrets file, reusing it thereafter — and periodically reconciles strays. Account state is brand-isolated and the master token never leaves the secrets file — see `references/api.md`.
+
+## When to activate
+
+- Operator mentions Cloudflare, custom domain, public access, or internet access
+- Operator wants to expose the assistant publicly with a custom URL
+- Operator asks about setting up remote access with a custom domain
+- Operator says "set up Cloudflare", "reset the tunnel", "my tunnel is broken", or similar
+
+## What it unlocks
+
+- Public internet access via a custom domain
+- Reliable mobile admin access (replacing or supplementing Tailscale)
+- Custom-branded public chat URLs
+- Webhook endpoints on a stable domain
+
+## Operator-facing surface
+
+The plugin registers no agent-facing MCP tools. Every Cloudflare operation is the agent invoking `cloudflared` or `wrangler` directly via Bash, or calling the Cloudflare API with a reused per-scope narrow token, with stdout/stderr streamed verbatim into the PTY chat (secrets redacted). The OAuth URL printed by `cloudflared tunnel login` is linkified by the native PTY; the operator clicks it in their own browser. There is no shell-script wrapper, no orchestrator state machine, no MCP-tool surface.
+
+### Skills
+
+| Skill | Purpose |
+|---|---|
+| [cloudflare/SKILL.md](skills/cloudflare/SKILL.md) | The entry point for every Cloudflare operation. Routes each operation class to its reference, names the outcome contracts (tunnel external HTTP 200; hosting deployed URL; D1 round-trip), and states the tool-discipline + secret-redaction rules that bind the agent. |
+
+### References
+
+| Reference | Topics |
+|---|---|
+| [manual-setup.md](references/manual-setup.md) | Tunnel runbook — Steps 0–7 with isolated `cloudflared` command blocks. The agent reads the relevant step before issuing each command. |
+| [api.md](references/api.md) | Cloudflare API library — canonical docs URL + curated endpoint map (DNS, zones, tunnels, token list/create/verify/revoke), the advanced master-token creation walkthrough, the account-scoped secrets-file storage convention, the agent's reuse-a-stable-per-scope-token discipline, and the standing reconcile pass that revokes strays. |
+| [d1-data-capture.md](references/d1-data-capture.md) | Form → Pages Function → D1 store → read/sweep. The Pages-Edit **and** D1-Edit token-scope requirement, `wrangler d1 create`/`execute --remote`, the `swept` column. |
+| [hosting-sites.md](references/hosting-sites.md) | Deploy a static or Next.js site to Cloudflare Pages via `wrangler pages deploy`. |
+| [web-analytics.md](references/web-analytics.md) | Why a registered site reports 0 visitors — the RUM API is blocked (no permission group), registered ≠ collecting, edge auto-injection is impossible for a Pages-only custom domain, and the beacon must be injected into the site HTML, rebuilt, and redeployed. Outcome: beacon present in live HTML. |
+| [dashboard-guide.md](references/dashboard-guide.md) | Click-paths for operations the operator prefers to do by hand — sign in, switch accounts, add a site, edit an apex CNAME, verify nameservers, delete a tunnel, manage CNAME records, author an Access policy. |
+| [reset-guide.md](references/reset-guide.md) | Decision tree for reset vs. patch, the exact `pkill` incantation for token-mode connectors, and the dashboard cleanup paths for stray records and rogue entries. |
+
+The agent loads these references on demand via `plugin-read` as the conversation requires. They are not auto-injected into the system prompt.
+
+### Success contract
+
+The setup-done claim only fires when `curl -I https://<hostname>` issued from outside the local network returns `HTTP/2 200` (or `HTTP/1.1 200 OK`) and the response is surfaced verbatim in chat. No state file, no service-active claim, no `cloudflared` exit code substitutes for the live HTTP response. When the curl returns anything else, the agent diagnoses with `cloudflared tunnel info <tunnelId>` and `systemctl --user status cloudflared-${BRAND}.service`, cites the relevant step in `references/reset-guide.md`, and stops.
+
+## Identity model
+
+- **Product identity** (SiteDesk vs Real Agent) — known from `brand.json` (`productName`, `configDir`).
+- **Cloudflare account identity** — `cert.pem` from OAuth. One account per brand per device.
+- **Account binding drift** — `~/{configDir}/cloudflared/account-binding.json` is a historical drift marker. Reset by `rm -rf ~/.${BRAND}/cloudflared/` per `references/reset-guide.md` when switching accounts.
+
+## Discipline
+
+The agent's permitted surfaces are: direct `cloudflared` and `wrangler` invocations via Bash following the references; Cloudflare API calls authenticated by a reused per-scope narrow token, minted once if absent and persisted to the secrets file (the master token stays in that same file, never on a command line that echoes, never in chat); the reference files; and live verification (`curl -I` for tunnels, the deployed URL for hosting, a `SELECT` for D1). Out of bounds: Playwright or Chrome DevTools driving the dashboard, browser-automating master-token creation, WebSearch-for-CF-recipes, ad-hoc `cloudflared` flag invention not in the runbook, and writing or echoing any token. When a step fails, the agent reports the exact output (secrets redacted), cites the recovery step from `references/reset-guide.md`, and stops.

package/payload/platform/plugins/cloudflare/mcp/dist/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/plugins/cloudflare/mcp/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/cloudflare/mcp/dist/index.js

@@ -0,0 +1,24 @@
+import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js";
+initStderrTee("cloudflare");
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+// The Cloudflare plugin exposes zero agent-facing tools. Every
+// Cloudflare operation is the agent invoking `cloudflared` directly via
+// the Bash tool, following the runbook in
+// platform/plugins/cloudflare/references/manual-setup.md, with
+// cloudflared stdout/stderr streamed verbatim into the PTY. The MCP
+// server process still spawns for lifecycle and stderr-tee consistency
+// with other plugins, but its tool list is empty by design.
+const server = new McpServer({
+    name: "cloudflare",
+    version: "0.4.0",
+});
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((err) => {
+    console.error(`[cloudflare-mcp] fatal: ${err}`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/cloudflare/mcp/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,aAAa,CAAC,YAAY,CAAC,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,+DAA+D;AAC/D,wEAAwE;AACxE,0CAA0C;AAC1C,+DAA+D;AAC/D,oEAAoE;AACpE,uEAAuE;AACvE,4DAA4D;AAE5D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.d.ts

@@ -0,0 +1,283 @@
+interface BrandConfig {
+    configDir: string;
+    productName: string;
+    vncDisplay: number;
+}
+export declare function loadBrand(): BrandConfig;
+/**
+ * Test-only: reset the cached brand so a subsequent loadBrand() re-reads
+ * the manifest. Production code never calls this.
+ */
+export declare function _resetBrandCache(): void;
+export declare function findBinary(): string | null;
+export declare function isInstalled(): boolean;
+export declare function version(): string | null;
+interface AccountBinding {
+    accountId: string;
+    boundAt: string;
+}
+export declare function readAccountBinding(): AccountBinding | null;
+/**
+ * @internal — production code MUST go through `materializeBinding` so the
+ * source-of-truth lifecycle (fresh-login vs migration) is preserved and
+ * logged. Exported only so unit tests can pre-seed bindings without
+ * re-implementing the file format.
+ */
+export declare function writeAccountBinding(accountId: string): AccountBinding;
+export type RefusalReason = "account-drift" | "unbound-device" | "post-flight-fqdn-mismatch" | "bound-account-does-not-own-hostname" | "hostname-zone-not-routable";
+export interface RefusalDetail {
+    reason: RefusalReason;
+    message: string;
+    /** Structured fields for the [cloudflare:refuse] log line. */
+    fields?: {
+        requestedHostname?: string;
+        requestedDomain?: string;
+        boundAccountId?: string | null;
+        certAccountId?: string | null;
+        actualFqdn?: string;
+        tunnelId?: string;
+    };
+}
+export declare function logRefuse(detail: RefusalDetail): void;
+/**
+ * The only recovery instruction — every refusal that involves the wrong
+ * Cloudflare account points here. Single source of truth so the four
+ * surfaces that quote it (tunnel-status, tunnel-add-hostname, personal
+ * assistant template, setup-tunnel skill) cannot drift.
+ */
+export declare const DASHBOARD_SWITCH_ACCOUNTS_INSTRUCTION: string;
+export declare function recoveryMessage(): string;
+export declare function resetAuth(): {
+    deletedCert: boolean;
+    deletedBinding: boolean;
+};
+export declare function hasCert(): boolean;
+interface CertIdentity {
+    accountId: string;
+}
+/**
+ * Parse the ARGO TUNNEL TOKEN PEM block from cert.pem to extract the
+ * AccountTag. Only the account ID is returned — nothing else in cert.pem
+ * is used by this codebase. The cert itself stays on disk; `cloudflared`
+ * shell-outs read it via `--origincert` for tunnel CRUD and DNS routing.
+ */
+export declare function parseCertPem(): CertIdentity | null;
+/** Wraps a structured RefusalDetail so call sites can branch on `reason`. */
+export declare class CloudflareRefusalError extends Error {
+    refusal: RefusalDetail;
+    constructor(detail: RefusalDetail);
+}
+export interface AuthValidation {
+    hasCert: boolean;
+    hasBinding: boolean;
+    /** True when both present AND cert.accountId === binding.accountId. */
+    bound: boolean;
+    certAccountId: string | null;
+    boundAccountId: string | null;
+}
+export declare function validateAuth(): AuthValidation;
+/**
+ * Establish the device-local account binding from cert.pem. Used by:
+ *   (1) tunnel-login fresh-success path — first time creds are derived.
+ *   (2) migration path — when cert.pem exists from a prior install but no
+ *       binding has yet been written (silent materialization, since the
+ *       cert was already trust-established by the operator's prior login).
+ */
+export declare function materializeBinding(source: "fresh-login" | "migration"): AccountBinding;
+export declare function createTunnelCli(name: string): {
+    tunnelId: string;
+    tunnelName: string;
+    credentialsPath: string;
+};
+export declare function getTunnelTokenCli(tunnelId: string): string;
+/**
+ * Write a local config.yml for cloudflared tunnel run.
+ * This is the ONLY tunnel startup configuration — no remote config, no API.
+ * hostnames: the actual FQDNs to route (e.g. ["joel.maxy.bot", "shop.maxy.bot"]).
+ */
+export declare function writeLocalConfig(tunnelId: string, credentialsPath: string, hostnames: string[], port: number): string;
+export declare function parseConfiguredHostnames(configYmlPath: string): string[];
+export interface NsPreflightResult {
+    zoneParent: string;
+    nameservers: string[];
+    onCloudflare: boolean;
+    error?: string;
+}
+export declare function checkZoneParentOnCloudflare(hostname: string): Promise<NsPreflightResult>;
+export declare function routeDnsCli(tunnelId: string, hostname: string): Promise<{
+    created: boolean;
+    output: string;
+    fqdn: string;
+}>;
+interface LoginState {
+    pid: number;
+    startedAt: number;
+    authUrl: string;
+    logPath: string;
+    /**
+     * Byte offset in `logPath` at the moment this login was spawned. Every
+     * subsequent failure-marker parse slices the log from this offset forward
+     * so historical markers from prior (reset + respawned) attempts cannot
+     * re-trigger the failed state. Without this, `cloudflared-login.log`
+     * being append-mode across spawns would cause the handler to loop on
+     * old "Failed to fetch resource" lines forever after the first recovery.
+     *
+     * Defaults to 0 when absent (backward compatibility with pre-541 state
+     * files): a zero offset scans the whole file, which is the pre-541
+     * behaviour — safe as a one-time fallthrough because the handler's
+     * `failed` branch calls `resetAuth()` which clears the login state,
+     * guaranteeing the next spawn writes a state file with a real offset.
+     */
+    logOffset?: number;
+}
+export interface TunnelLoginResult {
+    authUrl: string;
+    alreadyRunning?: boolean;
+}
+/**
+ * Login process state from the agent's perspective. Three states plus one
+ * non-terminal advisory decoration.
+ *
+ *   in-progress               — PID alive. The OAuth-callback loop is still
+ *                               listening, regardless of what the log
+ *                               contains. `browserLaunchFailed: true` when
+ *                               the courtesy-marker is present: cloudflared
+ *                               attempted to open the browser itself and
+ *                               couldn't (headless spawn context, DISPLAY
+ *                               unreachable, etc.), but the sign-in can
+ *                               still complete if the user opens the auth
+ *                               URL in any reachable browser.
+ *   failed                    — PID dead AND cert.pem absent. The login
+ *                               process tore down without writing the cert.
+ *                               Caller must restart. `reason` distinguishes
+ *                               *why* the process is gone: `-with-marker`
+ *                               when the courtesy marker was observed during
+ *                               its lifetime, `-without-marker` otherwise.
+ *                               Both variants trigger the same handler
+ *                               response — reason is for log-side
+ *                               observability only.
+ *   idle                      — nothing recorded; fresh spawn required.
+ *
+ * `complete` (cert.pem written) is determined upstream in the tunnel-login
+ * handler via `findCert()` / `validateAuth().bound` before this helper is
+ * called — so it is not represented here.
+ *
+ * rewrite: the old `failed` state fired on marker-alone, which
+ * looped restart-respawn hermetically because cloudflared re-emits the
+ * courtesy marker on every spawn whose browser-launch subcommand fails.
+ * Liveness (PID alive) is now the sole discriminant for in-progress; the
+ * marker is informational and drives an operator-facing advisory, not a
+ * restart.
+ */
+export type LoginStatus = {
+    state: "in-progress";
+    loginState: LoginState;
+    browserLaunchFailed: boolean;
+} | {
+    state: "failed";
+    loginState: LoginState | null;
+    reason: "login-process-exited-without-cert" | "login-process-exited-with-marker";
+} | {
+    state: "idle";
+};
+export declare function getLoginStatus(): LoginStatus;
+export declare function tunnelLogin(): Promise<TunnelLoginResult>;
+interface TunnelState {
+    tunnelId: string;
+    tunnelName: string;
+    domain: string;
+    configPath: string;
+    credentialsPath: string;
+    adminHostname: string | null;
+    publicHostname: string | null;
+    pid: number | null;
+    startedAt: number | null;
+    connectorToken?: string;
+}
+export declare function getPersistedTunnelId(): string | null;
+export declare function getPersistedDomain(): string | null;
+export declare function getPersistedState(): TunnelState | null;
+export declare function saveTunnelIdentity(params: {
+    tunnelId: string;
+    tunnelName: string;
+    domain: string;
+    configPath: string;
+    credentialsPath: string;
+    adminHostname: string;
+    publicHostname: string | null;
+}): void;
+/**
+ * Return the actual hostnames from persisted state (or derive from domain
+ * for pre-521 state files).
+ */
+export declare function getPersistedHostnames(): string[];
+export type HostnameFailureMode = "ok" | "dns-missing" | "cname-points-elsewhere" | "edge-unreachable" | "tunnel-not-matched";
+/**
+ * Exhaustive enum of reasons `tunnel-status` can return `healthy: false`.
+ * The agent's recovery sentence is a total function of this enum — every
+ * arm must map to exactly one prescribed sentence in the `tunnel-status`
+ * handler's `buildTunnelStatusGuidance`. Adding a value here without
+ * updating the handler is a compile error (exhaustiveness check).
+ */
+export type TunnelUnhealthyReason = "not-running" | "no-tunnel-configured" | "bound-account-does-not-own-hostname" | "hostname-probes-failed";
+export interface HostnameProbeResult {
+    hostname: string;
+    resolves: boolean;
+    cname: string | null;
+    httpStatus: number | null;
+    failureMode: HostnameFailureMode;
+}
+export declare function probeHostname(hostname: string, expectedTunnelId: string | null): Promise<HostnameProbeResult>;
+export interface TunnelStatus {
+    installed: boolean;
+    version: string | null;
+    hasCert: boolean;
+    hasBinding: boolean;
+    /** True when cert and binding agree. */
+    bound: boolean;
+    certAccountId: string | null;
+    boundAccountId: string | null;
+    running: boolean;
+    pid: number | null;
+    tunnelId: string | null;
+    domain: string | null;
+    /** Hostnames parsed from config.yml (authoritative for ingress). */
+    configuredHostnames: string[];
+    /** Hostnames from tunnel.state — may diverge from config.yml. */
+    persistedHostnames: string[];
+    adminHostname: string | null;
+    publicHostname: string | null;
+    upSince: number | null;
+    probes: HostnameProbeResult[];
+    /**
+     * True iff tunnel is running AND at least one hostname's CNAME points
+     * back to this tunnel (proving the signed-in Cloudflare account owns
+     * the domain being served). False means the laptop is running a tunnel
+     * that nothing on the internet is reaching — almost always "wrong
+     * Cloudflare account signed in."
+     */
+    boundAccountOwnsHostnames: boolean;
+    /**
+     * Aggregated health: true only when the tunnel is running, at least one
+     * hostname is configured, and every configured hostname probes `ok`.
+     */
+    healthy: boolean;
+    /**
+     * Structured reason for unhealthy status. "no-tunnel-configured" when
+     * config.yml or hostnames are absent; "not-running" when cloudflared is
+     * not alive; "bound-account-does-not-own-hostname" when the dominant
+     * failure mode is wrong-account; "hostname-probes-failed" otherwise.
+     */
+    unhealthyReason: TunnelUnhealthyReason | null;
+}
+export declare function getStatus(domain?: string): Promise<TunnelStatus>;
+export declare function startTunnel(params: {
+    tunnelId: string;
+    tunnelName: string;
+    domain: string;
+    configPath: string;
+    credentialsPath: string;
+}): void;
+export declare function stopTunnel(): void;
+export {};
+//# sourceMappingURL=cloudflared.d.ts.map

package/payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared.d.ts","sourceRoot":"","sources":["../../src/lib/cloudflared.ts"],"names":[],"mappings":"AA2BA,UAAU,WAAW;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,wBAAgB,SAAS,IAAI,WAAW,CAwBvC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAcD,wBAAgB,UAAU,IAAI,MAAM,GAAG,IAAI,CAqB1C;AAED,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED,wBAAgB,OAAO,IAAI,MAAM,GAAG,IAAI,CAavC;AAcD,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD,wBAAgB,kBAAkB,IAAI,cAAc,GAAG,IAAI,CAgB1D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAMrE;AA0BD,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,gBAAgB,GAChB,2BAA2B,GAC3B,qCAAqC,GACrC,4BAA4B,CAAC;AAEjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAgBrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC,QAKf,CAAC;AAEpC,wBAAgB,eAAe,IAAI,MAAM,CAOxC;AAYD,wBAAgB,SAAS,IAAI;IAAE,WAAW,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CA2C7E;AAwDD,wBAAgB,OAAO,IAAI,OAAO,CAEjC;AAED,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,YAAY,GAAG,IAAI,CA0BlD;AAED,6EAA6E;AAC7E,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,OAAO,EAAE,aAAa,CAAC;gBACX,MAAM,EAAE,aAAa;CAKlC;AAMD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,wBAAgB,YAAY,IAAI,cAAc,CAU7C;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,aAAa,GAAG,WAAW,GAClC,cAAc,CAUhB;AAkBD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,GACX;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAkFnE;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GACf,MAAM,CAsBR;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,SAAS,EAAE,MAAM,EAAE,EACnB,IAAI,EAAE,MAAM,GACX,MAAM,CAsBR;AAWD,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAcxE;AAyBD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY9F;AAoBD,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsH7D;AAUD,UAAU,UAAU;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA6BD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AA0CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,GAC9E;IACE,KAAK,EAAE,QAAQ,CAAC;IAChB,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,mCAAmC,GAAG,kCAAkC,CAAC;CAClF,GACD;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtB,wBAAgB,cAAc,IAAI,WAAW,CAqC5C;AA+BD,wBAAgB,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAoIxD;AAUD,UAAU,WAAW;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AA4BD,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAEpD;AAED,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAElD;AAED,wBAAgB,iBAAiB,IAAI,WAAW,GAAG,IAAI,CAEtD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,IAAI,CAYP;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAehD;AAcD,MAAM,MAAM,mBAAmB,GAC3B,IAAI,GACJ,aAAa,GACb,wBAAwB,GACxB,kBAAkB,GAClB,oBAAoB,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAC7B,aAAa,GACb,sBAAsB,GACtB,qCAAqC,GACrC,wBAAwB,CAAC;AAE7B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAqE9B;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,wCAAwC;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oEAAoE;IACpE,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iEAAiE;IACjE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,yBAAyB,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,eAAe,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC/C;AAED,wBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA+GtE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,IAAI,CA8CP;AAED,wBAAgB,UAAU,IAAI,IAAI,CAwBjC"}