crewly 1.20.265 → 1.20.267

package/dist/backend/backend/src/services/connector/remote-mcp-auth-card.js

@@ -0,0 +1,98 @@
+/**
+ * The Slack side of remote MCP sign-in: a card in the owner's DM whose
+ * button opens a single-use Crewly Cloud ticket link (never the server URL
+ * or its key), and a receipt when the sign-in finished.
+ *
+ * Posted in the owner's DM with the agent whose call needed it (that
+ * agent's bot), else the orchestrator's / workspace bot. A DM, so only the
+ * owner sees the link.
+ *
+ * @module services/connector/remote-mcp-auth-card
+ */
+import { CLOUD_DISCONNECT_NOTICE_CONSTANTS } from '../../../../config/constants.js';
+const SLACK = CLOUD_DISCONNECT_NOTICE_CONSTANTS;
+/**
+ * Build the card. Pure, so the wording is testable.
+ *
+ * @param label - Server name ("Zoho")
+ * @param url - Ticket link
+ * @param expiresAt - When the link stops working
+ * @param now - Clock (tests)
+ * @returns Fallback text and Block Kit blocks
+ */
+export function buildRemoteMcpAuthCard(label, url, expiresAt, now = Date.now()) {
+    const hours = Math.max(1, Math.round((new Date(expiresAt).getTime() - now) / 3_600_000));
+    const safe = label.replace(/[<>&*_~`]/g, '');
+    return {
+        text: `${safe} needs you to sign in once. Tap to authorize (works on your phone).`,
+        blocks: [
+            {
+                type: 'section',
+                text: { type: 'mrkdwn', text: `*${safe}* needs you to sign in once.\nTap to authorize — it works on your phone.` },
+                accessory: { type: 'button', text: { type: 'plain_text', text: 'Authorize' }, url, style: 'primary' },
+            },
+            {
+                type: 'context',
+                elements: [{ type: 'mrkdwn', text: `The link works once, for about ${hours} hour${hours === 1 ? '' : 's'}. Your agents get access after you allow it.` }],
+            },
+        ],
+    };
+}
+/**
+ * Open the owner DM on a bot and post.
+ *
+ * @param fetchImpl - fetch
+ * @param botToken - Bot token (never logged)
+ * @param ownerUserId - Owner
+ * @param message - Text and optional blocks
+ * @returns True when Slack accepted it
+ */
+async function postDm(fetchImpl, botToken, ownerUserId, message) {
+    const call = async (method, body) => {
+        const res = await fetchImpl(`${SLACK.SLACK_API_BASE}/${method}`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${botToken}`, 'Content-Type': 'application/json; charset=utf-8' },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(SLACK.SLACK_REQUEST_TIMEOUT_MS),
+        });
+        const data = (await res.json().catch(() => ({})));
+        if (!res.ok || data['ok'] !== true)
+            throw new Error(`Slack ${method} failed: ${String(data['error'] ?? res.status)}`);
+        return data;
+    };
+    const opened = await call('conversations.open', { users: ownerUserId });
+    const channel = opened['channel']?.id;
+    if (!channel)
+        throw new Error('Slack conversations.open returned no channel');
+    await call('chat.postMessage', { channel, text: message.text, ...(message.blocks ? { blocks: message.blocks } : {}), unfurl_links: false, unfurl_media: false });
+    return true;
+}
+/**
+ * The notifier the auth service posts through.
+ *
+ * @param deps - Owner id, bot token lookup, fetch
+ * @returns Notifier
+ */
+export function createSlackRemoteMcpNotifier(deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const target = (agentSession) => {
+        const owner = deps.ownerUserId();
+        const token = deps.botTokenFor(agentSession) ?? (agentSession ? deps.botTokenFor(undefined) : null);
+        return owner && token ? { owner, token } : null;
+    };
+    return {
+        async postAuthCard({ serverLabel, url, expiresAt, agentSession }) {
+            const t = target(agentSession);
+            if (!t)
+                return false;
+            return postDm(fetchImpl, t.token, t.owner, buildRemoteMcpAuthCard(serverLabel, url, expiresAt));
+        },
+        async postReceipt({ text, agentSession }) {
+            const t = target(agentSession);
+            if (!t)
+                return false;
+            return postDm(fetchImpl, t.token, t.owner, { text });
+        },
+    };
+}
+//# sourceMappingURL=remote-mcp-auth-card.js.map

package/dist/backend/backend/src/services/connector/remote-mcp-auth-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp-auth-card.js","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-auth-card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAGpF,MAAM,KAAK,GAAG,iCAAiC,CAAC;AAKhD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,GAAW,EAAE,SAAiB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC5G,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO;QACL,IAAI,EAAE,GAAG,IAAI,qEAAqE;QAClF,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,0EAA0E,EAAE;gBAClH,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE;aACtG;YACD;gBACE,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,8CAA8C,EAAE,CAAC;aAC1J;SACF;KACF,CAAC;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,KAAK,UAAU,MAAM,CAAC,SAAoB,EAAE,QAAgB,EAAE,WAAmB,EAAE,OAA6C;IAC9H,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,IAA6B,EAAoC,EAAE;QACrG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,cAAc,IAAI,MAAM,EAAE,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE;YACnG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,YAAY,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAI,MAAM,CAAC,SAAS,CAAiC,EAAE,EAAE,CAAC;IACvE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC9E,MAAM,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACjK,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAuB;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAK,KAAmB,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,YAAqB,EAA2C,EAAE;QAChF,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpG,OAAO,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE;YAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrB,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,sBAAsB,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QAClG,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;YACtC,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrB,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/services/connector/remote-mcp-auth.service.d.ts

@@ -0,0 +1,277 @@
+/**
+ * OAuth for remote MCP servers — the owner signs in once, from a phone.
+ *
+ * Flow (owner-away: nothing runs on `localhost` in the owner's browser):
+ *
+ * 1. A server answers 401 + `WWW-Authenticate: Bearer resource_metadata=…`
+ *    (on add, on test, or through the agent proxy). Discovery, dynamic
+ *    client registration and PKCE run here (see remote-mcp-oauth).
+ * 2. The authorize URL (minus `state`) goes to the Crewly Cloud broker,
+ *    which adds `state`, hosts the public redirect URI and returns a
+ *    single-use ticket link. The PKCE verifier never leaves this machine.
+ * 3. The link reaches the owner as a Slack card (throttled), in the API
+ *    response and on the Connections / portal card.
+ * 4. This service polls the broker; when the code arrives it exchanges it
+ *    with the verifier, stores the tokens and tells the broker (the page on
+ *    the owner's phone then says "connected") and Slack.
+ * 5. {@link RemoteMcpAuthService.getAccessToken} hands the agent proxy a
+ *    fresh token, refreshing before expiry (single-flight per server).
+ *
+ * State lives in `<CREWLY_HOME>/remote-mcp-oauth.enc`: AES-256-GCM under
+ * the install's master key, mode 0600. Nothing secret is logged.
+ *
+ * @module services/connector/remote-mcp-auth.service
+ */
+import { type BearerChallenge, type DiscoveredAuthorization, type OAuthClient, type OAuthFetch, type OAuthTokens } from './remote-mcp-oauth.js';
+import { type RemoteMcpServer } from './remote-mcp.service.js';
+/** A sign-in waiting on the owner. */
+export interface PendingAuthorization {
+    /** Broker session (never logged). */
+    state: string;
+    verifier: string;
+    /** Ticket link (single-use). */
+    url: string;
+    startedAt: number;
+    /** When the link stops working. */
+    expiresAt: number;
+    /** The owner has opened the link. */
+    opened?: boolean;
+    /** The agent whose call needed it (its Slack DM gets the receipt). */
+    agentSession?: string;
+}
+/** Per-server OAuth record. */
+export interface RemoteMcpOAuthRecord {
+    status: 'needs_auth' | 'connected' | 'error';
+    discovered?: DiscoveredAuthorization;
+    client?: OAuthClient;
+    /** The client was entered by the owner (no dynamic registration). */
+    manualClient?: boolean;
+    tokens?: OAuthTokens;
+    connectedAt?: string;
+    lastError?: string;
+    pending?: PendingAuthorization;
+    /** Last Slack card: when, and for which link. */
+    lastCard?: {
+        at: number;
+        state: string;
+    };
+}
+/** What the API shows about a server's sign-in (no secrets). */
+export interface RemoteMcpAuthView {
+    mode: 'oauth';
+    status: 'needs_auth' | 'connected' | 'error';
+    /** Host of the authorization server. */
+    authorizationServer?: string;
+    scopes?: string[];
+    /** ISO time the current access token expires. */
+    expiresAt?: string;
+    connectedAt?: string;
+    error?: string;
+    /** A live sign-in link, when one is pending. */
+    authorizeUrl?: string;
+    authorizeExpiresAt?: string;
+}
+/** Slack side, wired at boot (see slack-initializer). */
+export interface RemoteMcpAuthNotifier {
+    /** Post the "sign in once" card to the owner. */
+    postAuthCard(args: {
+        serverLabel: string;
+        url: string;
+        expiresAt: string;
+        agentSession?: string;
+    }): Promise<boolean>;
+    /** Tell the owner how it went. */
+    postReceipt(args: {
+        serverLabel: string;
+        text: string;
+        agentSession?: string;
+    }): Promise<boolean>;
+}
+/** Collaborators (tests inject). */
+export interface RemoteMcpAuthDeps {
+    crewlyHome?: string;
+    fetchImpl?: OAuthFetch;
+    cloud?: {
+        getToken(): string | null;
+        getCloudUrl(): string | null;
+    };
+    now?: () => number;
+    /** Schedules a poll (tests drive it by hand). */
+    setTimer?: (fn: () => void, ms: number) => {
+        unref?: () => void;
+    } | unknown;
+    clearTimer?: (handle: unknown) => void;
+    /** Server lookup (label, URL) for polls that outlive the caller. */
+    getServer?: (id: string) => Promise<RemoteMcpServer | undefined>;
+    /** List tools after sign-in (for the receipt). */
+    countTools?: (server: RemoteMcpServer, headers: Record<string, string>) => Promise<number | null>;
+}
+/** Owner-facing failure of an authorization start. */
+export declare class RemoteMcpAuthError extends Error {
+    readonly code: 'not_signed_in' | 'cloud_error' | 'oauth' | 'not_oauth';
+    constructor(code: 'not_signed_in' | 'cloud_error' | 'oauth' | 'not_oauth', message: string);
+}
+/**
+ * Wire (or clear) the Slack notifier.
+ *
+ * @param next - Notifier, or null
+ */
+export declare function setRemoteMcpAuthNotifier(next: RemoteMcpAuthNotifier | null): void;
+/**
+ * Remote MCP OAuth — see module docs.
+ */
+export declare class RemoteMcpAuthService {
+    private static instance;
+    private readonly logger;
+    private readonly crewlyHome;
+    private readonly fetchImpl;
+    private readonly cloud;
+    private readonly now;
+    private readonly setTimer;
+    private readonly clearTimer;
+    private readonly deps;
+    private cache;
+    private writeChain;
+    private readonly refreshing;
+    private readonly timers;
+    private redirectUri;
+    private readonly lastUnauthorized;
+    constructor(deps?: RemoteMcpAuthDeps);
+    static getInstance(): RemoteMcpAuthService;
+    /** Reset the singleton (tests). */
+    static resetInstance(): void;
+    /** Install an instance (tests / wiring). */
+    static setInstance(service: RemoteMcpAuthService): void;
+    /** Absolute path of the encrypted store. */
+    getFilePath(): string;
+    private masterKeyPath;
+    /** Stop every poll timer. */
+    stop(): void;
+    private load;
+    private mutate;
+    /**
+     * The record for a server, if it uses OAuth.
+     *
+     * @param id - Server id
+     * @returns A copy of the record, or undefined
+     */
+    getRecord(id: string): Promise<RemoteMcpOAuthRecord | undefined>;
+    /**
+     * Whether a server signs in with OAuth.
+     *
+     * @param id - Server id
+     * @returns True when it has an OAuth record
+     */
+    usesOAuth(id: string): Promise<boolean>;
+    /**
+     * The API view of a server's sign-in.
+     *
+     * @param id - Server id
+     * @returns The view, or undefined for a static-key server
+     */
+    view(id: string): Promise<RemoteMcpAuthView | undefined>;
+    /**
+     * Forget a server's sign-in (server removed).
+     *
+     * @param id - Server id
+     */
+    forget(id: string): Promise<void>;
+    /**
+     * Set an owner-entered client (servers without dynamic registration).
+     *
+     * @param id - Server id
+     * @param client - Client id and optional secret
+     */
+    setManualClient(id: string, client: {
+        clientId: string;
+        clientSecret?: string;
+    }): Promise<void>;
+    /**
+     * Ask the server (no credentials beyond its static headers) whether it
+     * wants OAuth.
+     *
+     * @param server - Stored server
+     * @returns The Bearer challenge when it answered 401, else null
+     */
+    detect(server: RemoteMcpServer): Promise<BearerChallenge | null>;
+    /**
+     * Record that a server needs OAuth and run discovery.
+     *
+     * @param server - Stored server
+     * @param challenge - What its 401 said
+     * @returns The record
+     * @throws RemoteMcpAuthError oauth (discovery failed)
+     */
+    markOAuth(server: RemoteMcpServer, challenge: BearerChallenge | null): Promise<RemoteMcpOAuthRecord>;
+    private cloudRequest;
+    private getRedirectUri;
+    /**
+     * Start (or reuse) a sign-in and return the link for the owner.
+     *
+     * @param server - Stored server
+     * @param options - Who needed it, and whether to post the Slack card
+     * @returns The ticket link and its expiry
+     * @throws RemoteMcpAuthError
+     */
+    startAuthorization(server: RemoteMcpServer, options?: {
+        agentSession?: string;
+        notify?: boolean;
+        challenge?: BearerChallenge | null;
+    }): Promise<{
+        url: string;
+        expiresAt: string;
+        posted: boolean;
+    }>;
+    /**
+     * Post the Slack card unless one carrying this same live link went out
+     * within the throttle window.
+     *
+     * @param server - Server
+     * @param pending - The live sign-in
+     * @param agentSession - Agent whose DM should carry it
+     * @returns Whether a card was posted
+     */
+    private maybePostCard;
+    /**
+     * The proxy got a 401 it could not fix: ask the owner (throttled).
+     *
+     * @param server - Server
+     * @param agentSession - The calling agent
+     */
+    onUnauthorized(server: RemoteMcpServer, agentSession?: string): Promise<void>;
+    /**
+     * Resume polls for sign-ins in flight (boot).
+     */
+    resumePending(): Promise<void>;
+    private schedulePoll;
+    /**
+     * One broker poll for a server's pending sign-in (exposed for tests).
+     *
+     * @param id - Server id
+     * @returns The broker status seen
+     */
+    pollOnce(id: string): Promise<string>;
+    private clearPending;
+    /**
+     * Exchange the code and store the tokens; tell Cloud and Slack.
+     *
+     * @param id - Server id
+     * @param pending - The sign-in
+     * @param code - Authorization code
+     */
+    private complete;
+    private receipt;
+    /**
+     * A usable access token for a server, refreshed when it is about to
+     * expire (or when `force`).
+     *
+     * @param id - Server id
+     * @param options - `force` refreshes even when the token looks fresh
+     * @returns The access token, or null when the owner must sign in
+     */
+    getAccessToken(id: string, options?: {
+        force?: boolean;
+    }): Promise<string | null>;
+    private refresh;
+}
+//# sourceMappingURL=remote-mcp-auth.service.d.ts.map

package/dist/backend/backend/src/services/connector/remote-mcp-auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp-auth.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/connector/remote-mcp-auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,OAAO,EASL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAKjF,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,+BAA+B;AAC/B,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,OAAO,CAAC;IAC7C,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qEAAqE;IACrE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,iDAAiD;IACjD,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AASD,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,OAAO,CAAC;IAC7C,wCAAwC;IACxC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,YAAY,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrH,kCAAkC;IAClC,WAAW,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnG;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,KAAK,CAAC,EAAE;QAAE,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,IAAI,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC;IAC5E,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,oEAAoE;IACpE,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACjE,kDAAkD;IAClD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACnG;AAED,sDAAsD;AACtD,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,aAAa,GAAG,OAAO,GAAG,WAAW;gBAA7D,IAAI,EAAE,eAAe,GAAG,aAAa,GAAG,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,MAAM;CAIpG;AAYD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAEjF;AAED;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAqC;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8D;IACpF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6C;IACtE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+C;IAC1E,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,UAAU,CAAuC;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6C;IACxE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;gBAElD,IAAI,GAAE,iBAAsB;IAexC,MAAM,CAAC,WAAW,IAAI,oBAAoB;IAa1C,mCAAmC;IACnC,MAAM,CAAC,aAAa,IAAI,IAAI;IAK5B,4CAA4C;IAC5C,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAIvD,4CAA4C;IAC5C,WAAW,IAAI,MAAM;IAIrB,OAAO,CAAC,aAAa;IAIrB,6BAA6B;IAC7B,IAAI,IAAI,IAAI;YAOE,IAAI;YAqBJ,MAAM;IAkBpB;;;;;OAKG;IACG,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAKtE;;;;;OAKG;IACG,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7C;;;;;OAKG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAuB9D;;;;OAIG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC;;;;;OAKG;IACG,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrG;;;;;;OAMG;IACG,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAetE;;;;;;;OAOG;IACG,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,oBAAoB,CAAC;YAyB5F,YAAY;YA4BZ,cAAc;IAQ5B;;;;;;;OAOG;IACG,kBAAkB,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;KAAO,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IAgE9M;;;;;;;;OAQG;YACW,aAAa;IAoB3B;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBnF;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAOpC,OAAO,CAAC,YAAY;IASpB;;;;;OAKG;IACG,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAkD7B,YAAY;IAM1B;;;;;;OAMG;YACW,QAAQ;YA+CR,OAAO;IAQrB;;;;;;;OAOG;IACG,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAY7E,OAAO;CA4CtB"}