@zackbart/connecta 0.10.0 → 0.10.2

package/AGENTS.md

@@ -0,0 +1,113 @@
+# Working on connecta
+
+This is the canonical instruction file for coding agents. `CLAUDE.md` is a
+symlink to this file so every agent works from the same conventions.
+
+A single MCP endpoint aggregating downstream connectors (remote MCP servers and
+plain HTTP APIs) behind a small fixed set of meta-tools. A deployment with an
+executor serves seven, `execute_code` among them, and agents reach connectors by
+writing JavaScript against it; one without an executor serves the nine classic
+tools. One fetch-native core, running on both Node and Cloudflare Workers.
+
+- **[`ethos.md`](./ethos.md) is the constitution.** It states what connecta is
+  and isn't, and its decisions table carries a verdict for every shape already
+  considered — refused, removed, provisional, or gated. Check the table before
+  designing or building anything: a `refused` row is a "no" with the reason
+  attached, and a `removed` row (toolkits
+  [#178](https://github.com/zackbart/connecta/issues/178), proactive credential
+  liveness [#179](https://github.com/zackbart/connecta/issues/179)) records a
+  surface that no longer exists — do not reintroduce it without a new decision.
+- There is no TODO.md — the roadmap lives in
+  [GitHub issues](https://github.com/zackbart/connecta/issues). When you find
+  TODO items (in code comments, docs, or conversation), don't accumulate them
+  in a file: turn each one into a GitHub issue that clearly defines what to do
+  — motivation, behavioral requirements, and acceptance criteria — without
+  prescribing the implementation.
+
+## Verification
+
+`npm run check` must pass before you claim anything is done — `check:docs` →
+`check:operator-ui` → `check:lint` → `check:unused` → `typecheck` → `test`
+(both vitest projects) → `build` → `check:examples`. It is also the `prepack`
+hook. `npm run release:check` adds `check:security` and `check:package` and is
+what CI runs on publish; use it when touching packaging, dependencies, or
+exports.
+
+## The map
+
+- [`ethos.md`](./ethos.md) — what connecta is, what it refuses to be, the
+  decisions table, and the invariants every change must preserve. Check it
+  before building something new; "we already decided not to" is a real answer
+  there, and its removed/provisional verdicts override anything staler.
+- [`documentation/`](./documentation/) — per-subsystem guides for agents
+  working on the repo. **Currently stubs**: the old manual (`docs/`) was
+  retired in the phase-1 docs restructure and each guide is being rewritten as
+  the ideas settle. Until a guide is filled in, the subsystem's prior manual
+  text lives in git history (`docs/<name>.md`) — consult it there when you need
+  the old rationale, but treat `ethos.md` as the authority where they disagree.
+- [`README.md`](./README.md) — the human-facing overview.
+- [`templates/node/`](./templates/node/) — the one standalone Node deployment
+  shape copied by `connecta init`. Keep it small and prescribed; examples may
+  demonstrate alternatives, but they must not become competing scaffolds.
+
+**Read `ethos.md` and the subsystem's guide (or its git-history predecessor)
+before changing a subsystem.**
+
+## Deployment setup
+
+`connecta init [directory]` is the golden path. It copies `templates/node/`,
+pins the generated deployment to the CLI package's exact version, restores the
+template `.gitignore`, and refuses to merge into an existing path.
+`connecta doctor` verifies a running deployment's health, executor, and exact
+seven-tool surface. Setup changes must keep the root README, template, Docker
+example, and `scripts/check-package.mjs` smoke aligned; do not add a second
+initializer or another “recommended” project shape.
+
+## Where new code goes
+
+Two boundaries CI enforces that are not obvious from reading a file:
+
+- **Import-graph purity.** Nothing reachable from `src/index.ts` may import a
+  `node:` builtin — the core is Web-API only so it runs unchanged on Workers.
+  `src/node.ts`, `src/storage/file.ts`, and the QuickJS process-pool entry
+  (`src/executors/quickjs.ts` + child) are the Node-touching paths and must stay
+  unreachable from the root entry. `test/purity.test.ts` walks the import graph
+  and fails otherwise. Need a Node API? It goes behind an explicit Node-only
+  subpath (`/node` or `/quickjs`), never the root.
+- **The published surface.** Platform-specific storage adapters live in
+  `examples/`, not the package. `@clerk/backend` and `quickjs-emscripten` are
+  optional peers behind the `./auth/clerk` and `./quickjs` subpaths and must
+  never become dependencies or install with core. Enforced by
+  `test/package-surface.test.ts` and `scripts/check-package.mjs`. Anything
+  heavyweight or platform-bound gets a subpath and an optional peer.
+
+## Where new tests go
+
+Suites live in `test/` and run as two vitest projects (`vitest.config.ts`).
+Every `*.test.ts` belongs to exactly one explicit list: runtime-portable suites
+in `WORKERS_SUITES`, Node-bound suites in `NODE_ONLY_SUITES` with a reason. The
+`node` project runs both lists; the `workers` project re-runs the portable list
+inside workerd. `test/suite-partition.test.ts` walks the directory and fails on
+an unclassified, double-classified, stale, or reasonless entry. New behavior
+also gets a row in the test map in
+[`documentation/operations.md`](./documentation/operations.md) once that guide
+is rewritten; until then the row waits with the guide.
+
+## Conventions
+
+- **Static analysis.** `npm run check:lint` runs Oxlint's correctness category
+  only; it does not enforce style. `npm run check:unused` runs Knip's
+  unused-export and dependency gate. Keep both clean, and prefer removing dead
+  declarations over suppressing a finding.
+- **Style.** There is no formatter. Match the surrounding code. The docs voice
+  is precise, occasionally wry, and always explains *why* — don't flatten it
+  into boilerplate.
+- **Commits.** Imperative summary naming the behavior change, with issue refs in
+  parens: `Normalize maxResultBytes at every intake point (#32) (#39)`.
+- **CHANGELOG.** Each release opens with a narrative paragraph — what this
+  release is, what breaks, what a deployment can ignore — then
+  `### Added` / `### Changed` / `### Fixed`.
+- **Releases.** `npm run release:check`, tag `v<version>` matching
+  `package.json` exactly (the publish workflow verifies this and fails
+  otherwise), and publishing fires on GitHub **Release publication**, not on the
+  tag push.

package/CHANGELOG.md

@@ -2,6 +2,89 @@
 
 All notable changes to this package are documented here.
 
+## 0.10.2 — 2026-07-30
+
+A prescribed deployment path for agents and operators. `connecta init` now
+creates one small, reviewable Node project with exact dependencies and
+auto-discoverable conventions; `connecta doctor` proves the running endpoint is
+healthy, advertises the intended seven tools, and can actually execute a
+harmless QuickJS program. The initializer never merges into an existing path,
+and it stages the complete project before an atomic rename so an interrupted
+setup leaves nothing half-created. **Existing deployments are unchanged.** The
+new template refuses to start without an explicit bearer token, while the
+repository Docker example now selects the same code-first surface by default.
+
+### Added
+
+- **One command to create the prescribed deployment.**
+  `npx @zackbart/connecta init <directory>` writes only the deployment config,
+  exact package manifest, TypeScript config, environment example, ignore rules,
+  README, and canonical `AGENTS.md` with `CLAUDE.md` pointing to it. The command
+  refuses every existing destination and pins the generated project to the
+  initializer's exact Connecta version.
+- **A live deployment doctor.** `CONNECTA_TOKEN=… connecta doctor` checks
+  `/health`, requires the exact seven-tool code-first surface, and runs
+  `async () => 42` through `execute_code`. Requests are bounded to ten seconds,
+  bearer tokens are accepted only from the environment, and remote plaintext
+  HTTP is refused.
+- **Artifact-level setup qualification.** The package smoke now installs the
+  packed tarball, initializes a deployment, checks overwrite refusal, installs
+  and typechecks the generated project, verifies tokenless startup fails,
+  starts it with auth, and runs the live doctor through QuickJS.
+
+### Changed
+
+- **Agent instructions have one source of truth.** `AGENTS.md` is canonical in
+  the package repository and generated deployments; `CLAUDE.md` is a symlink
+  where the filesystem supports it.
+- **The setup material ships with the package.** The standalone template,
+  agent-facing documentation, ethos, and usable Node and Worker examples are
+  available beside the installed package. Docker remains explicitly
+  repository-only because its reproducible build consumes repository inputs.
+- **The Docker example is code-first by default.** Its entrypoint configures the
+  bounded QuickJS executor instead of leaving operators to infer and add it.
+
+### Fixed
+
+- **The prescribed Node deployment no longer has a known fallback secret.**
+  Both the generated template and repository example refuse startup when
+  `CONNECTA_TOKEN` is absent.
+- **Failed initialization no longer strands a partial destination.** Work is
+  assembled in a uniquely named sibling directory, cleaned on failure, and
+  renamed into place only when complete.
+
+## 0.10.1 — 2026-07-30
+
+An inbound-auth escape hatch for MCP clients whose OAuth implementations do not
+interoperate cleanly with a Connecta deployment. Eligible Clerk operators can
+now issue named, revocable Bearer tokens from `/tokens`; each call is attributed
+to the token's immutable identity while activity history resolves the current
+friendly name. The secret is shown once, only a SHA-256 digest is stored, and a
+token can authenticate MCP without gaining operator privileges. **Deployments
+that do not set `accessTokens: {}` are unchanged.** Enabling it requires a
+storage adapter with `list(prefix)` and a Clerk auth provider so token lifecycle
+operations remain behind the human operator boundary.
+
+### Added
+
+- **Managed MCP access tokens.** `accessTokens: {}` adds a Clerk-only operator
+  ledger for creating, naming, renaming, and revoking `cta_…` Bearer tokens.
+  `maxActive` defaults to 100 and can be configured from 1 through 1,000.
+- **Token-attributed activity.** Calls authenticated by a managed token record
+  its immutable token ID and resolve the current friendly name when an eligible
+  operator reads activity. Revoked metadata remains as a tombstone so historical
+  attribution survives rotation.
+- **Enumerable storage.** `KVStorage.list(prefix)` is available for durable
+  metadata ledgers, with implementations in the built-in memory and file
+  adapters and the Cloudflare Workers KV example.
+
+### Fixed
+
+- **One-time secrets leave no reusable operator-UI state.** The plaintext token
+  disappears when it is dismissed, when the operator navigates away or signs
+  out, and before the document enters the browser back-forward cache. The create
+  form stays unavailable while a newly issued secret is waiting to be stored.
+
 ## 0.10.0 — 2026-07-30
 
 **Code-first is what a model sees.** A deployment with an executor now serves

package/README.md

@@ -13,13 +13,17 @@ among them.
 
 ```mermaid
 flowchart LR
-    Agent["AI agent"] -- "writes a program" --> Sandbox
-    Agent -- "one deliberate call" --> Explicit
-    subgraph Connecta["Connecta — one MCP endpoint. Credentials stay here."]
+    Agent["AI agent"]
+    Integrations["The integrations you chose"]
+
+    subgraph Connecta["Connecta: one MCP endpoint; credentials stay here"]
         Sandbox["execute_code<br/>server-side sandbox"]
         Explicit["Explicit tools<br/>destructive calls, search, auth"]
     end
-    Sandbox --> Integrations["The integrations you chose"]
+
+    Agent -->|"writes a program"| Sandbox
+    Agent -->|"one deliberate call"| Explicit
+    Sandbox --> Integrations
     Explicit --> Integrations
 ```
 
@@ -31,20 +35,66 @@ flowchart LR
   to be loaded up front.
 - **Safer access.** Credentials stay server-side — the program never sees them
   — and consequential actions remain explicit and individual.
+- **Named client access.** A Clerk operator can issue and revoke one-time,
+  hashed Bearer tokens for MCP clients that support header authentication.
 - **Your deployment.** Connecta runs on Node, Docker, or Cloudflare Workers,
   with configuration you can review and version.
 
 ## Start here
 
-- [Node example](./examples/node/)
-- [Docker example](./examples/docker/)
-- [Cloudflare Worker example](./examples/worker/)
-- [Documentation](./documentation/)
+Create the prescribed Node deployment:
+
+```sh
+npx @zackbart/connecta init my-connecta
+cd my-connecta
+npm install
+CONNECTA_TOKEN=dev-token npm start
+```
+
+Point an MCP client at `http://localhost:8787/mcp` with
+`Authorization: Bearer dev-token`. The generated project is deliberately small:
+
+```text
+my-connecta/
+├── src/index.ts       # connectors, auth, storage, public URL
+├── package.json       # exact Connecta and QuickJS versions
+├── tsconfig.json
+├── .env.example
+├── .gitignore
+├── AGENTS.md
+├── CLAUDE.md -> AGENTS.md
+└── README.md
+```
+
+For an agent setting this up, the contract is:
+
+1. Edit `src/index.ts`; do not copy Connecta internals into the deployment.
+2. Keep `executor: quickJsExecutor()` for the prescribed seven-tool surface.
+3. Keep secrets in environment variables or a secret store, never source.
+4. Add code only for deliberate `api()` connectors.
+5. Run `npm run typecheck`, start the server, and run
+   `CONNECTA_TOKEN=... npm run doctor`. Doctor checks health, the executor, and
+   the exact seven-tool model-facing surface, then executes a harmless sandbox
+   program. The bearer stays in the environment rather than command history.
+
+The template refuses to merge into an existing directory, so initialization
+cannot overwrite another project. Its generated programs have no filesystem,
+environment, arbitrary network, imports, or timers; only explicitly read-only
+connector tools are reachable. Unannotated or write-capable calls stay
+individual and cross `call_destructive_tool`, where the MCP host can ask the
+operator for approval.
+
+Other supported deployment shapes:
+
+- [Prescribed Node template](./templates/node/)
+- [Node repository example](./examples/node/)
+- [Code-first Docker deployment (repository-only)](https://github.com/zackbart/connecta/tree/main/examples/docker)
+- [Cloudflare Worker deployment](./examples/worker/)
+- [Subsystem documentation](./documentation/)
 
-Configuring a sandbox — a Dynamic Worker on Cloudflare, QuickJS on Node — is
-what selects the code-first surface, and it is the assumed posture. A
-deployment without one keeps the earlier nine-tool, call-by-call interface,
-which stays supported.
+Configuring a sandbox — QuickJS on Node or a Dynamic Worker on Cloudflare — is
+what selects the code-first surface and is the assumed posture. A deployment
+without one keeps the earlier nine-tool compatibility interface.
 
 ## Project status
 

package/bin/connecta.mjs

@@ -0,0 +1,272 @@
+#!/usr/bin/env node
+
+import {
+  copyFile,
+  cp,
+  lstat,
+  mkdtemp,
+  readFile,
+  rename,
+  rm,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const [command, ...args] = process.argv.slice(2);
+
+function shellCd(path) {
+  if (process.platform === "win32") {
+    return `cd /d "${path.replaceAll('"', '""')}"`;
+  }
+  return `cd '${path.replaceAll("'", "'\\''")}'`;
+}
+
+function usage() {
+  console.log(`Usage:
+  connecta init [directory]
+  CONNECTA_TOKEN=<bearer> connecta doctor [--url http://localhost:8787]`);
+}
+
+async function init() {
+  if (args.length > 1) {
+    usage();
+    process.exitCode = 1;
+    return;
+  }
+  const destination = args[0] ?? "connecta-deployment";
+  const target = resolve(process.cwd(), destination);
+  const parent = dirname(target);
+  try {
+    await lstat(target);
+    throw new Error(`Refusing to overwrite existing path: ${target}`);
+  } catch (error) {
+    const code =
+      error && typeof error === "object" && "code" in error
+        ? String(error.code)
+        : "";
+    if (code !== "ENOENT") throw error;
+  }
+
+  // Build beside the destination, then rename once complete. A failed copy or
+  // rewrite leaves no partial destination that blocks a clean retry.
+  let stage = await mkdtemp(
+    join(parent, `.${basename(target)}.connecta-init-`),
+  );
+  try {
+    await cp(join(packageRoot, "templates", "node"), stage, {
+      recursive: true,
+    });
+
+    // npm excludes .gitignore files and symlinks from packed dependencies.
+    // Restore both conventions explicitly in the generated project.
+    await writeFile(
+      join(stage, ".gitignore"),
+      ".connecta-state.json\n.env\nnode_modules/\n",
+    );
+    await rm(join(stage, "CLAUDE.md"), { force: true });
+    try {
+      await symlink("AGENTS.md", join(stage, "CLAUDE.md"));
+    } catch {
+      // Some Windows environments disallow symlink creation. A materialized
+      // fallback preserves discovery even though AGENTS.md remains canonical.
+      await copyFile(join(stage, "AGENTS.md"), join(stage, "CLAUDE.md"));
+    }
+
+    const rootPackage = JSON.parse(
+      await readFile(join(packageRoot, "package.json"), "utf8"),
+    );
+    const deploymentPath = join(stage, "package.json");
+    const deploymentPackage = JSON.parse(
+      await readFile(deploymentPath, "utf8"),
+    );
+    deploymentPackage.dependencies["@zackbart/connecta"] = rootPackage.version;
+    await writeFile(
+      deploymentPath,
+      JSON.stringify(deploymentPackage, null, 2) + "\n",
+    );
+
+    await rename(stage, target);
+    stage = "";
+  } finally {
+    if (stage) await rm(stage, { recursive: true, force: true });
+  }
+
+  console.log(`Created ${target}`);
+  console.log("Next:");
+  console.log(`  ${shellCd(target)}`);
+  console.log("  npm install");
+  console.log("  CONNECTA_TOKEN=dev-token npm start");
+}
+
+function option(name, fallback) {
+  const index = args.indexOf(name);
+  if (index < 0) return fallback;
+  const value = args[index + 1];
+  if (!value || value.startsWith("--")) {
+    throw new Error(`${name} requires a value`);
+  }
+  return value;
+}
+
+async function jsonResponse(response) {
+  const text = await response.text();
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${text.slice(0, 500)}`);
+  }
+  if ((response.headers.get("content-type") ?? "").includes("text/event-stream")) {
+    const line = text
+      .split("\n")
+      .filter((candidate) => candidate.startsWith("data:"))
+      .pop();
+    if (!line) throw new Error("MCP response contained no SSE data");
+    return JSON.parse(line.slice("data:".length).trim());
+  }
+  return JSON.parse(text);
+}
+
+const DOCTOR_TIMEOUT_MS = 10_000;
+
+async function doctorFetch(url, init = {}) {
+  try {
+    return await fetch(url, {
+      ...init,
+      signal: AbortSignal.timeout(DOCTOR_TIMEOUT_MS),
+    });
+  } catch (error) {
+    if (
+      error instanceof Error &&
+      (error.name === "TimeoutError" || error.name === "AbortError")
+    ) {
+      throw new Error(`Timed out after ${DOCTOR_TIMEOUT_MS}ms contacting ${url}`);
+    }
+    throw error;
+  }
+}
+
+async function doctor() {
+  const known = new Set(["--url"]);
+  for (let index = 0; index < args.length; index += 2) {
+    if (!known.has(args[index]) || !args[index + 1]) {
+      usage();
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const requestedUrl = option("--url", "http://localhost:8787");
+  const parsedUrl = new URL(requestedUrl);
+  if (parsedUrl.username || parsedUrl.password) {
+    throw new Error("Doctor URL must not contain credentials.");
+  }
+  if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+    throw new Error("Doctor URL must use http or https.");
+  }
+  const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+  if (
+    parsedUrl.protocol === "http:" &&
+    !loopbackHosts.has(parsedUrl.hostname)
+  ) {
+    throw new Error(
+      "Refusing to send a bearer token over remote plaintext HTTP. Use HTTPS.",
+    );
+  }
+  const baseUrl = requestedUrl.replace(/\/+$/, "");
+  const token = process.env.CONNECTA_TOKEN;
+  if (!token) {
+    throw new Error(
+      "Set CONNECTA_TOKEN so doctor can inspect the MCP surface.",
+    );
+  }
+
+  const health = await jsonResponse(
+    await doctorFetch(`${baseUrl}/health`),
+  );
+  if (health.status !== "ok") {
+    throw new Error(`Unexpected health status: ${String(health.status)}`);
+  }
+  if (health.admission?.code === null) {
+    throw new Error(
+      "The server has no executor and is serving classic compatibility. " +
+        "Keep executor: quickJsExecutor() for the prescribed surface.",
+    );
+  }
+
+  let requestId = 0;
+  const mcp = async (method, params) =>
+    jsonResponse(
+      await doctorFetch(`${baseUrl}/mcp`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream",
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+          id: ++requestId,
+          method,
+          params,
+      }),
+      }),
+    );
+
+  const listed = await mcp("tools/list", {});
+  if (listed.error) {
+    throw new Error(`tools/list failed: ${JSON.stringify(listed.error)}`);
+  }
+  const actual = listed.result?.tools
+    ?.map((tool) => tool.name)
+    .sort();
+  const expected = [
+    "authorize_connector",
+    "call_destructive_tool",
+    "call_tool",
+    "execute_code",
+    "get_result",
+    "search_tools",
+    "skills",
+  ];
+  if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+    throw new Error(
+      `Unexpected MCP surface. Expected ${expected.join(", ")}; received ` +
+      `${Array.isArray(actual) ? actual.join(", ") : "no tool list"}.`,
+    );
+  }
+
+  const executed = await mcp("tools/call", {
+    name: "execute_code",
+    arguments: { code: "async () => 42" },
+  });
+  if (executed.error) {
+    throw new Error(`execute_code failed: ${JSON.stringify(executed.error)}`);
+  }
+  const executionResult =
+    executed.result?.structuredContent ??
+    JSON.parse(executed.result?.content?.[0]?.text ?? "null");
+  if (executed.result?.isError || executionResult?.result !== 42) {
+    throw new Error(
+      `QuickJS execution check failed: ${JSON.stringify(executed.result)}`,
+    );
+  }
+
+  console.log(
+    `Connecta doctor passed: ${health.connectors} connector(s), ` +
+      "QuickJS executed, prescribed seven-tool surface.",
+  );
+}
+
+try {
+  if (command === "init") await init();
+  else if (command === "doctor") await doctor();
+  else {
+    usage();
+    process.exitCode = command === "--help" || command === "-h" ? 0 : 1;
+  }
+} catch (error) {
+  console.error(
+    `[connecta] ${error instanceof Error ? error.message : String(error)}`,
+  );
+  process.exitCode = 1;
+}

package/dist/access-tokens.d.ts

@@ -0,0 +1,32 @@
+import type { InboundAuth, KVStorage } from "./types.js";
+export interface AccessTokenMetadata {
+    id: string;
+    name: string;
+    tokenPrefix: string;
+    createdAt: string;
+    revokedAt?: string;
+}
+export interface CreatedAccessToken {
+    token: string;
+    accessToken: AccessTokenMetadata;
+}
+/**
+ * Deployment-scoped personal access tokens. Secret material is never
+ * recoverable: authentication indexes a SHA-256 digest of a random 256-bit
+ * token, while separately enumerable metadata powers operator management.
+ */
+export declare class AccessTokenManager {
+    private readonly storage;
+    readonly auth: InboundAuth;
+    private readonly maxActive;
+    constructor(storage: KVStorage, options?: {
+        maxActive?: number;
+    });
+    private read;
+    list(): Promise<AccessTokenMetadata[]>;
+    create(name: unknown, createdBy: string): Promise<CreatedAccessToken>;
+    rename(id: string, name: unknown): Promise<AccessTokenMetadata | null>;
+    revoke(id: string, revokedBy: string): Promise<AccessTokenMetadata | null>;
+    private authorize;
+}
+//# sourceMappingURL=access-tokens.d.ts.map

package/dist/access-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-tokens.d.ts","sourceRoot":"","sources":["../src/access-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA6BrE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAyGD;;;;GAIG;AACH,qBAAa,kBAAkB;IAK3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGhB,OAAO,EAAE,SAAS,EACnC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO;YAgCxB,IAAI;IAKZ,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IActC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoCrE,MAAM,CACV,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAQhC,MAAM,CACV,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAexB,SAAS;CAgBxB"}