mandala-computer-mcp 0.5.0 → 0.6.0

package/README.md

@@ -155,6 +155,17 @@ Parameter and response-mode support remains a separate contract.
 `list_windows`, `window_action`, `read_clipboard`, `write_clipboard`,
 `read_file`, `write_file`, `list_directory`
 
+`write_file` replaces a file already at the path. With `overwrite: false` it
+creates the file only if nothing is there, and a path that is taken is refused
+without that attempt writing anything (Linux computers only). Incomplete
+contents are never published at the path, but a failure while publishing or
+answering can leave the complete file there, so after any error read the path
+before retrying or overwriting. `read_file` and `write_file` take `no_wake: true`
+to refuse (409) rather than resume a computer that is not running. For
+embedders, the `Api` raises that refusal as `FileExistsError`, and a
+create-only 409 whose reason could not be read as `CreateOnlyConflictError`,
+which says nothing about the path; `isTransient` is false for both.
+
 **Retained versions** — `retain_execution_output`, `get_result`, `read_result_output`,
 `delete_result`, `publish_artifact`, `get_artifact`, `read_artifact`, `delete_artifact`
 
@@ -186,14 +197,27 @@ was issued to, not to the account, and are accepted by every computer with SSH
 on, on every account where that person is an owner or member. A
 workspace-scoped key can read keys but not add or remove them.
 
-**Secret bindings** — `get_computer_secrets`, `set_computer_secrets`, and
-`create_computer`'s `secrets`. Which of the account's secrets a computer
-receives, at which revision, and where: as an environment variable (`env`) or as
-a file under `/run/mandala-secrets/user/files` (`file`). Values never cross these
-tools. A set replaces the whole list (`[]` removes every binding) and reaches the
-guest at the computer's next start or restart; send the `version` a read
-answered to have it refused with 409 if the list changed since. A secret bound
-as a file is also rewritten on a running computer when its value is replaced.
+**Secrets** — `list_secrets`, `get_secret`, `create_secret`, `replace_secret`,
+`delete_secret` for the account's secret store, and `get_computer_secrets`,
+`set_computer_secrets` and `create_computer`'s `secrets` for which of them a
+computer receives. A value goes in through `create_secret` or `replace_secret`
+and never comes back out. No route answers one, and a store tool's result
+holds only the decoded documented fields (success) or the status, the `reason`
+word and a sentence of its own (refusal). It never includes the platform's
+response text, and the `Api` keeps none for these routes. The bindings carry
+only secret ids, revisions and names. A computer receives a secret as an environment variable (`env`) or as a
+file under `/run/mandala-secrets/user/files` (`file`). A set replaces the whole
+binding list (`[]` removes every binding) and reaches the guest at the
+computer's next start or restart; send the `version` a read answered to have it
+refused with 409 if the list changed since. A replaced value also reaches a
+running computer: a file binding's file is rewritten in place, and on an image
+that supports it an env binding reaches new shells and `exec` with
+`desktop: true` (programs already running keep the old value until a restart).
+A command that needs a bound variable should use `desktop: true`. Whether a
+plain root `exec` sees it depends on the platform version. `replace_secret`
+and `delete_secret` need the current `revision_id`, and a stale one is a 409.
+`delete_secret` also needs `confirm: true`: a computer still bound to a deleted
+secret cannot start again until that binding is removed.
 
 **Delegating** — `run_agent`, `run_agent_chat`, registered only when a model key is present:
 `MANDALA_MODEL_KEY` on stdio, or the caller's own `X-Model-Key` header over HTTP.
@@ -233,7 +257,7 @@ with an error listing all valid tags.
 | `usage` | `get_usage` |
 | `webhooks` | All webhook tools listed above |
 | `ssh` | All SSH tools listed above |
-| `secrets` | `get_computer_secrets`, `set_computer_secrets` |
+| `secrets` | `list_secrets`, `get_secret`, `create_secret`, `replace_secret`, `delete_secret`, `get_computer_secrets`, `set_computer_secrets` |
 | `agent` | `run_agent`, `run_agent_chat` |
 | `activities` | `list_activities`, `get_activity`, `get_activity_results` |
 | `signals` | `read_signals` |
@@ -719,6 +743,25 @@ available. A missing computer, snapshot, route or guest file remains
 `NotFoundError` (404); other guest failures keep their own status and message.
 Neither response causes an automatic retry or method switch.
 
+`isTransient(err)` answers "is this worth sending again unchanged". A `503` is
+transient only for a GET or HEAD. Any change answered `503` may or may not have
+happened, because the platform answers a failure after the request was sent the
+same way. So `isTransient` is false for it whatever `reason` it carries, the
+tool's answer says to read the current state first, and `error.method` records
+the method. A `reason` this version does not
+know, such as a new word, is treated as no classification. `reasonKind` returns
+`undefined` for it, and the status decides.
+
+The secret store has typed calls on `api.secrets`: `list`, `create`, `get`,
+`replace` and `delete`. Each answer is decoded strictly to the documented
+fields, and none of them carries a value:
+
+```ts
+const { secrets } = await api.secrets.list();
+const s = await api.secrets.create({ name: 'OPENAI_API_KEY', value: key });
+await api.secrets.replace(s.id, { value: next, revisionId: s.revision_id });
+```
+
 Embedders can inspect optional diagnostics on every `APIError`:
 
 ```ts
@@ -746,7 +789,7 @@ and nested chat accounting. `allow` and `wwwAuthenticate` come only from receive
 headers. HEAD failures can carry these fields with no body. Older servers,
 intermediaries and connection failures may supply none of them. Existing
 constructor arguments retain their meanings; an optional trailing
-`APIErrorMetadata` object adds these three fields.
+`APIErrorMetadata` object adds these three fields, and `method`.
 
 MCP error results include supplied `reason`, `request_id`, `allow`,
 `www_authenticate` and `retry_after_ms` as labelled JSON metadata. Diagnostic
@@ -895,6 +938,69 @@ not list it, and every request is refused with a 403. Set
 is in force, so a `403` on a deployment that worked before has a line above it
 naming the fix.
 
+### Hosted, with OAuth
+
+The endpoint at `https://app.mandala.computer/mcp` is this server run with
+`--http` behind the platform's own proxy, with the platform as its OAuth 2.1
+authorization server. Nobody pastes a key:
+
+```sh
+claude mcp add --transport http mandala https://app.mandala.computer/mcp
+```
+
+Two variables make an HTTP server behave that way, and without them nothing
+changes — self-hosters keep bringing API keys:
+
+```sh
+MANDALA_MCP_RESOURCE_METADATA_URL=https://app.mandala.computer/.well-known/oauth-protected-resource/mcp \
+MANDALA_MCP_SERVICE_SECRET=… \
+MANDALA_ALLOWED_HOSTS=app.mandala.computer \
+  npx mandala-computer-mcp --http --host 127.0.0.1 --port 3000
+```
+
+In this mode `X-Forwarded-For` is believed from a loopback peer only, so the
+proxy in front must be on the same machine and must set it to the real client
+address.
+
+- **Every `/mcp` request needs a bearer**, initialize and `tools/list`
+  included. One without is answered `401` with exactly
+  `WWW-Authenticate: Bearer resource_metadata="<that URL>", scope="mcp:tools"`,
+  which is how a client finds where to authorize. `/healthz` stays open.
+- **The bearer is passed through unchanged** — an `mcpat_…` access token, or an
+  API key, which the platform still accepts. The access token is good for this
+  endpoint only. It is not an API key: sent to the API directly, the platform
+  refuses it with `401` (`reason: "invalid"`). A person revokes it under
+  Settings → Connected apps.
+- **A bearer is checked with the platform before it gets anything.** An
+  initialize makes no session until the platform accepts its token — a `2xx`
+  from `GET ssh-keys`, which every valid credential gets — so invented tokens
+  cannot fill the session pool. A `401` is the challenge above; any other
+  answer is `503` and nothing is remembered. Refused initializes are budgeted
+  per source address, 20 a minute. Past that, a token already accepted still
+  passes and a new one is still checked, but only one every 5 s per address;
+  the rest get `429` with `Retry-After`. The budget comes back when its minute
+  is up. A POST
+  carrying a request is checked again before it is dispatched, with an
+  acceptance cached for 60 s under the token's digest, so an expired or
+  revoked token is a clean `401` before any stream opens.
+- **A token the platform refuses during a call comes back as that same
+  `401`**, not as a tool error, so the client refreshes or authorizes again —
+  the answer is held until its first byte for this. The one case that cannot
+  work: a token that dies mid-call AFTER the stream has committed (the SDK's
+  15 s keep-alive, a progress notification or a partial result). That call
+  ends as a tool error, the session remembers the refusal, and the next
+  request on that token gets the `401` without reaching the platform.
+- **A refreshed token starts a new session.** A session is bound to the digest
+  of the bearer that opened it, and a different bearer on it is answered
+  `404 Unknown session`, the MCP spec's signal to initialize again. An access
+  token says nothing this server can check about which grant it came from, so
+  rebinding would let any valid credential that learned a session id take over
+  its bound computer, buffered events and retained results.
+- `X-Mandala-MCP-Service` carries `MANDALA_MCP_SERVICE_SECRET` on every
+  platform request, only ever to `MANDALA_BASE_URL`, so a token cannot be
+  replayed at the API directly by the app it was issued to. A client's own
+  header of that name is never forwarded.
+
 ### Configuration
 
 | Variable | Meaning |
@@ -909,8 +1015,10 @@ naming the fix.
 | `MANDALA_READ_ONLY` | Keep only tools annotated `readOnlyHint: true`; strict boolean parsing as described under Tool filters. |
 | `MANDALA_TAGS` | Comma-separated lowercase tool tags; see Tool filters for the inventory and intersection rules. |
 | `MANDALA_ALLOWED_HOSTS`, `MANDALA_ALLOWED_ORIGINS` | Comma-separated. Which `Host` and `Origin` values this server answers to. On a loopback bind the host list defaults to the address it was given, so DNS-rebinding protection is on without configuration; set this when serving under a name. |
+| `MANDALA_MCP_RESOURCE_METADATA_URL` | `--http` only. The OAuth protected-resource metadata URL this server is published under. Set, it answers OAuth clients as described under Hosted, with OAuth; unset, callers bring an API key. |
+| `MANDALA_MCP_SERVICE_SECRET` | `--http` only. Sent as `X-Mandala-MCP-Service` on every platform request, to `MANDALA_BASE_URL` only. Never logged. |
 
-Every one of these but the model key and the two tool filters has a flag as well, and a flag overrides
+Every one of these but the model key, the two tool filters and the two OAuth settings has a flag as well, and a flag overrides
 the environment: `--http`, `--port`, `--host`, `--base-url`, `--computer`,
 `--allowed-hosts`, `--allowed-origins`, `--no-lifecycle`, local `--profile`, plus `--help` and
 `--version`. `--key` exists for a caller launching several servers under

package/dist/api.d.ts

@@ -1,7 +1,19 @@
 import { Agent } from 'undici';
+import { type SecretStore } from './secret-store.js';
+export { isSecretStoreRoute } from './secret-errors.js';
 export declare const DEFAULT_BASE_URL = "https://app.mandala.computer/api/v1";
 /** Anthropic's own key, forwarded for the one route that runs a model. */
 export declare const MODEL_KEY_HEADER = "X-Model-Key";
+/**
+ * Proof, to the platform, that a request comes through the hosted MCP service
+ * (OPL-4982). The platform takes an OAuth access token only alongside it, so a
+ * token cannot be replayed at the API directly by the app it was issued to.
+ *
+ * Only this server's own value is ever sent. A header of this name arriving
+ * from anywhere else — a caller, or a per-call header set — is dropped in
+ * `#fetch`, so a client cannot supply the secret or learn anything by trying.
+ */
+export declare const SERVICE_HEADER = "X-Mandala-MCP-Service";
 export type RequestOptions = {
     query?: Record<string, string | number | boolean | undefined>;
     body?: unknown;
@@ -114,10 +126,32 @@ export type SSEEvent = {
  * result goes into a model's context and from there into transcripts, and an
  * API key is every computer on the account, forever.
  */
+/**
+ * What an embedding transport adds to every request one client makes.
+ *
+ * Both halves exist for the hosted install (OPL-4982), where this server stands
+ * between an OAuth client and the platform: the platform takes an access token
+ * only from a caller that also proves it is this service, and a refused token
+ * has to reach the MCP client as an HTTP 401 rather than as a tool error.
+ */
+export type ApiOptions = {
+    /**
+     * Sent as {@link SERVICE_HEADER} with every request to the configured base
+     * URL, and nowhere else. Never logged and never put on an error, like the
+     * key itself.
+     */
+    serviceSecret?: string;
+    /**
+     * Called when the platform refuses THE BEARER: a 401 carrying a `Bearer`
+     * challenge. A 401 without one is a model provider refusing a model key,
+     * which says nothing about this client's credential, and is not reported.
+     */
+    onBearerRefused?: () => void;
+};
 export declare class Api {
     #private;
     readonly baseUrl: string;
-    constructor(apiKey: string, baseUrl?: string, signal?: AbortSignal);
+    constructor(apiKey: string, baseUrl?: string, signal?: AbortSignal, options?: ApiOptions);
     /**
      * This same client, with every request bound to one tool call's cancellation.
      *
@@ -182,6 +216,18 @@ export declare class Api {
     }>;
     /** For the two routes whose body is not JSON: the screenshot and the download. */
     bytes(method: string, path: string, opts?: RequestOptions, maxBytes?: number | ((contentType: string) => number)): Promise<Bytes>;
+    /**
+     * The account's secret store, `GET|POST secrets` and `GET|PUT|DELETE
+     * secrets/:id`, as five typed calls.
+     *
+     * Typed, and decoded strictly, because a value goes IN here and the caller
+     * must be able to rely on nothing coming back: every answer is reduced to the
+     * documented fields before it is returned, so no answer can hand a value on.
+     * A malformed answer is a {@link MandalaError}; for a change it says the
+     * change may have been made. Bound to this client, so
+     * `api.with(signal).secrets` carries the signal.
+     */
+    get secrets(): SecretStore;
     /**
      * The agent route, which answers with a stream of steps rather than a result.
      *

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAmE,MAAM,QAAQ,CAAC;AAchG,eAAO,MAAM,gBAAgB,wCAAwC,CAAC;AAEtE,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAU9C,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;;;OAOG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AA6BF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,SAAU,CAAC;AACnD,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,mBAAmB,OAG9B,CAAC;AAWH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,aAAa,QAAO,OAAO,UAAU,CAAC,KAG7B,CAAC;AAEvB,iDAAiD;AACjD,MAAM,MAAM,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,qBAAa,GAAG;;IACd,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAQb,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,MAAyB,EAAE,MAAM,CAAC,EAAE,WAAW;IAoDpF;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,GAAG;IA0Q1C;;;;;;;;;;;;OAYG;IACG,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAW5F,4FAA4F;IACtF,cAAc,CAAC,CAAC,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,CAAC,CAAA;KAAE,CAAC;IAOxC,8FAA8F;IACxF,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,YAAY,CAAC;IA+ClB,WAAW,CACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,OAAO,CAAC;IAWnB;;;;;;OAMG;IACG,IAAI,CAAC,CAAC,GAAG,OAAO,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAKzB;;;;;;;;;;;;;;OAcG;IACG,OAAO,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC;QAAE,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAY/D,kFAAkF;IAC5E,KAAK,CACT,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,cAAmB,EACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,GACpD,OAAO,CAAC,KAAK,CAAC;IAoFjB;;;;;;OAMG;IACI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,cAAc,CAAC,QAAQ,CAAC;CAsF9F;AAyCD;;;;;;;;;GASG;AACH,wBAAiB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQnF;AAkgBD,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAmD3E;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAmE,MAAM,QAAQ,CAAC;AAsBhG,OAAO,EAAsB,KAAK,WAAW,EAA0B,MAAM,mBAAmB,CAAC;AAEjG,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,eAAO,MAAM,gBAAgB,wCAAwC,CAAC;AAEtE,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,0BAA0B,CAAC;AA2BtD,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;;;OAOG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAkCF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,SAAU,CAAC;AACnD,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,mBAAmB,OAG9B,CAAC;AAWH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,aAAa,QAAO,OAAO,UAAU,CAAC,KAG7B,CAAC;AAEvB,iDAAiD;AACjD,MAAM,MAAM,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAExD;;;;;;;;;;;GAWG;AACH;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;CAC9B,CAAC;AAEF,qBAAa,GAAG;;IACd,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAUvB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAyB,EAClC,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,UAAe;IAsD1B;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,GAAG;IAiW1C;;;;;;;;;;;;OAYG;IACG,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IAe5F,4FAA4F;IACtF,cAAc,CAAC,CAAC,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,CAAC,CAAA;KAAE,CAAC;IAexC,8FAA8F;IACxF,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,YAAY,CAAC;IA2DlB,WAAW,CACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,OAAO,CAAC;IAuBnB;;;;;;OAMG;IACG,IAAI,CAAC,CAAC,GAAG,OAAO,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAazB;;;;;;;;;;;;;;OAcG;IACG,OAAO,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC;QAAE,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAmB/D,kFAAkF;IAC5E,KAAK,CACT,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,cAAmB,EACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,GACpD,OAAO,CAAC,KAAK,CAAC;IA+FjB;;;;;;;;;;OAUG;IACH,IAAI,OAAO,IAAI,WAAW,CA6FzB;IAED;;;;;;OAMG;IACI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,cAAc,CAAC,QAAQ,CAAC;CAyG9F;AAyCD;;;;;;;;;GASG;AACH,wBAAiB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQnF;AAkgBD,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAmD3E;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC"}