pog-mcp 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Proof of Goal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,186 @@
+# pog-mcp — play Proof of Goal as an agent
+
+An MCP server that turns [pog.soccer](https://pog.soccer) into fourteen tools. The
+API has always been reachable over plain HTTP (see the repo's `AGENTS.md`); what
+this adds is that the agent no longer has to read a runbook, hold a Solana
+keypair, or guess payload shapes.
+
+```
+login → get_game_rules → create_squad → play_friendly → get_match
+                              ↑                    │
+                              └─── update_squad ───┘
+```
+
+That loop back is the game. A wallet holds one squad; you improve it by playing
+friendlies and rewriting the lineup, not by building new teams.
+
+Across sessions the wallet file is the account, so the agent returns as the same
+manager. Cups and league fixtures resolve on a scheduler, hours after they start,
+which means an agent's own results normally arrive while it is away — `catch_up`
+is the one call that closes that gap.
+
+## Install
+
+Nothing to clone or build. For Claude Code:
+
+```bash
+claude mcp add proof-of-goal -- npx -y pog-mcp
+```
+
+For any client that reads a JSON config:
+
+```json
+{
+  "mcpServers": {
+    "proof-of-goal": {
+      "command": "npx",
+      "args": ["-y", "pog-mcp"]
+    }
+  }
+}
+```
+
+### From a checkout
+
+Working on the server itself, or running it against your own API:
+
+```bash
+pnpm --filter pog-mcp build
+claude mcp add proof-of-goal -- node /absolute/path/to/packages/mcp/dist/index.js
+```
+
+## Releasing
+
+Publishing is automated: merge to `main` with a new `version` in `package.json`
+and `.github/workflows/publish-mcp.yml` puts it on npm. A pull request that
+changes shipped files (`src/`, `skill/`, `README.md`, the manifest) while the
+version is already on npm fails the check — npm cannot overwrite a version, so
+without the bump the merge would publish nothing and `npx -y pog-mcp` would keep
+handing out the old server.
+
+Two things are set up once, by hand:
+
+- **The first publish.** A granular token can only be scoped to a package that
+  exists, so the order is: `npm publish --access public` from this directory,
+  then create the token. Nothing to decide first — the licence is in place.
+- **`NPM_TOKEN`.** A granular npm access token with read-and-write rights on
+  this package, stored as the repository secret `NPM_TOKEN`. Nothing in CI can
+  create it.
+
+## Licence
+
+MIT — see `LICENSE`, which covers **this package only**. It is the client you
+run; the game it talks to is not open source, and the repository this package
+is built from is private.
+
+## Configuration
+
+Everything is optional for the default deployment. Pointing somewhere else is
+not: the client refuses to sign a login for any host it was not built to trust,
+so a staging or self-hosted API needs `POG_SIWS_DOMAIN` as well.
+
+```bash
+POG_API_URL=https://api.staging.example \
+POG_SIWS_DOMAIN=staging.example \
+  node packages/mcp/dist/index.js
+```
+
+Loopback (`localhost`, `127.0.0.1`) is trusted automatically, so a local API
+needs nothing beyond `POG_API_URL`. Without the override you get a refusal that
+names both the host it saw and the variable to set — it fails closed rather than
+signing for whatever answered.
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `POG_API_URL` | `https://api.pog.soccer` | Point at a local API (`http://localhost:3001`) or another deployment. |
+| `POG_SIWS_DOMAIN` | — | **Required** with a non-loopback `POG_API_URL`. The site that deployment signs people in to. |
+| `POG_SIWS_CHAIN` | `solana:devnet` | The chain the deployment binds sign-in to. |
+| `POG_API_HOST` | `<siws domain>` or `api.<siws domain>` | The host this client will TALK TO. Declaring `POG_SIWS_DOMAIN` already authorizes that domain and its `api.` subdomain — set this only when the API lives somewhere else entirely. It replaces the relation, it does not add to it. |
+| `POG_SIWS_URI` | `https://<siws domain>` | The exact URI the message may name. The whole URI is bound, not just its host — set this if your deployment signs for a path or a non-https scheme. Ignored for a loopback API. |
+| `POG_API_TIMEOUT_MS` | `30000` | Per-request ceiling. |
+| `POG_MCP_WALLET_FILE` | `~/.pog-mcp/wallet.json` | Where the recovery phrase lives. **Set this when the host only persists specific directories** — containers, sandboxes and agent runtimes often wipe `$HOME` between runs, and a missing file means a NEW phrase and a new account, silently. Absolute paths only: `~` is not expanded, and an MCP config `env` block has no shell to expand it. The directory must not be writable by other users. |
+| `POG_MCP_MNEMONIC` | — | Import an existing phrase instead of generating one. Refuses to start if a DIFFERENT wallet is already stored — move that file first, or point `POG_MCP_WALLET_FILE` elsewhere.  One-time import, not steady-state config: the process environment is readable by anything running as you, and MCP clients keep it in a config file on disk.|
+
+## The wallet
+
+`login` generates a BIP39 phrase on first use and derives a Solana keypair on
+`m/44'/501'/0'/0'` — the same path Phantom and Solflare use, so the phrase can be
+imported into either and the agent's squad shows up in a normal wallet.
+
+The file is written `0600` inside a `0700` directory. It is a real key: whatever
+the agent earns is held by it, and anyone who reads the file is that manager.
+
+Nothing is written until a tool actually needs the wallet, so starting the server
+and listing its tools does not mint a key. That property has a test
+(`server.test.ts` → "constructs without touching the wallet file") because it is
+the kind of thing a refactor breaks silently.
+
+## Tools
+
+| Tool | Auth | Notes |
+| --- | --- | --- |
+| `login` | — | SIWS handshake. Call once; sessions last ~30 days. |
+| `catch_up` | ✓ | Everything since last time, in one call. Start every return with it. |
+| `whoami` | — | Wallet address and session state. Never reveals the phrase. |
+| `get_game_rules` | — | Squad constraints and how the daily cup works. Read before building. |
+| `list_nations` | — | Code→name map. Pass `nationCode` for that nation's name pools. |
+| `create_squad` | ✓ | 11 players, 212 points. One squad per wallet — a second attempt redirects you to `update_squad`. |
+| `update_squad` | ✓ | Rewrite the lineup you own. Applies to the next unsimulated match. |
+| `my_squads` | ✓ | Squads owned by this wallet. |
+| `get_squad` | — | Any squad by id — scout an opponent. |
+| `play_friendly` | ✓ | Instant match. You must own `homeTeamId`. Standings-neutral. |
+| `play_playoff` | ✓ | One RANKED ladder match. Nothing schedules these — you start them. |
+| `get_match` | — | Result and event stream. Replays are deterministic. |
+| `get_cup` | — | Bracket for a date (UTC). The cup opens 04:00 UTC. |
+| `get_leaderboard` | — | Top 20 by default. Skip rows marked `playable: false` — their team was deleted and `topTeamId` is null. |
+
+## The Skill
+
+MCP gives an agent the ability to act; it does not give it judgment. An agent
+with only these tools builds a squad by splitting 212 points evenly across
+eleven players, which is measurably the worst thing you can build.
+
+`skill/SKILL.md` is the other half: what the engine actually rewards, and how
+many friendlies a conclusion needs before it means anything. Install it for
+Claude Code with
+
+```bash
+mkdir -p ~/.claude/skills && cp -r packages/mcp/skill ~/.claude/skills/play-proof-of-goal
+```
+
+Every strategy claim in it was measured by running the engine over tens of
+thousands of matches. The probes that produced those tables live in this
+repository at `packages/mcp/skill/reference/probes/`. They are **not** in the
+published package: they import the game engine from the workspace, so they run
+from a checkout and would fail with module-not-found anywhere else.
+
+```bash
+npx tsx packages/mcp/skill/reference/probes/gk-sweep.mts
+```
+
+Re-run them after any engine change — a rebalance invalidates the advice.
+
+## Notes for anyone extending this
+
+**Responses are billed as context.** `list_nations` originally returned the raw
+55 kB payload — ~14k tokens, almost all of it name pools nobody asked for. It now
+projects to a code→name map (~760 tokens) and `get_leaderboard` returns a window.
+Before adding a tool, look at what its endpoint actually returns.
+
+**Tool descriptions are read as fact.** An agent can't see the validator; it reads
+`get_game_rules` and reasons on top of it. A wrong rule doesn't cost a retry — it
+makes the agent exclude squads that are legal, and nothing ever tells it why.
+`__tests__/gameFacts.test.ts` pins every published number to
+`packages/engine/src/validator.ts` and fails when either side moves.
+
+**Derivation is duplicated, not shared.** `@sws26/shared` is dependency-free by
+design and can't host crypto libraries, so this package re-implements SLIP-0010.
+Both halves assert the same fixed vectors (`__tests__/derivationVectors.ts`) —
+change one alone and its own suite fails. A silent break here doesn't throw, it
+hands the same phrase a different address.
+
+**Both real bugs found so far were invisible in code review**, and both are now
+regression tests in `client.test.ts`: preferring Fastify's `error` field over
+`message` threw away the only actionable half of a 400, and omitting `auth` on
+the friendly route 401'd every match while every read still worked — so the
+surface looked healthy.

package/dist/client.d.ts

@@ -0,0 +1,319 @@
+/**
+ * client — typed HTTP access to the Proof of Goal API, with SIWS handled here.
+ *
+ * The whole point of this layer is that `login()` is one call. The real flow is
+ * four round-trips and an ed25519 signature:
+ *
+ *   1. GET  /api/auth/nonce?wallet=…            → single-use nonce
+ *   2. GET  /api/auth/message?wallet=…&nonce=…  → the exact text to sign
+ *   3. sign it locally
+ *   4. POST /api/auth/signin                    → bearer session
+ *
+ * Step 2 matters: the server builds the SIWS text (domain, URI, statement) and
+ * checks the parsed result on the way back in. Rebuilding that string here would
+ * work right up until SIWS_DOMAIN changes on a deploy and every login started
+ * failing signature verification for no visible reason. Ask, don't guess.
+ */
+/**
+ * Largest page GET /api/leaderboard will serve (its MAX_LIMIT). Asking for it
+ * makes truncation detectable: a full page means there may be more.
+ */
+export declare const LEADERBOARD_MAX_LIMIT = 500;
+/** Public deployment. Override with POG_API_URL to point at a local server. */
+export declare const DEFAULT_API_URL = "https://api.pog.soccer";
+export interface Session {
+    sessionId: string;
+    walletAddress: string;
+    expiresAt: string;
+}
+/**
+ * A selectable nation. `givenNames`/`surnames` are the pools the web UI's
+ * randomise button draws from — they are big (174 nations ≈ 55 kB all told) and
+ * irrelevant to picking a nation, so the MCP layer projects them away by
+ * default. See `list_nations`.
+ */
+export interface Nation {
+    code: string;
+    name: string;
+    givenNames: string[];
+    surnames: string[];
+}
+/** One manager's standing. The board is a flat array, already rank-ordered. */
+export interface LeaderboardRow {
+    rank: number;
+    ownerAddress: string;
+    managerScore: number;
+    /**
+     * Null when the manager's team was deleted after its matches were played —
+     * the row stays on the board, the opponent does not exist. Typed nullable so
+     * the tool cannot hand an agent a `null` to pass as awayTeamId.
+     */
+    topTeamId: string | null;
+    topTeamName: string | null;
+    [k: string]: unknown;
+}
+/** GET /api/cups/:date — no fixtures, despite the name. */
+export interface CupSummary {
+    date: string;
+    tournamentId: string;
+    status: string;
+    matchCount: number;
+    [k: string]: unknown;
+}
+/** One fixture from the bracket. */
+export interface BracketMatch {
+    matchId: string;
+    matchType: string;
+    [k: string]: unknown;
+}
+/** GET /api/tournaments/:id/bracket — 104 fixtures for a full cup. */
+export interface CupBracket {
+    tournamentId: string;
+    matches: BracketMatch[];
+    /** Duplicates every `matches[].matchId`; projected away by the MCP layer. */
+    matchIds?: string[];
+    [k: string]: unknown;
+}
+/** One finished match from a team's history. */
+export interface HistoryMatch {
+    matchId: string;
+    finishedAt: string;
+    result: 'W' | 'D' | 'L';
+    score: {
+        home: number;
+        away: number;
+    };
+    opponent: string;
+    homeTeamId: string;
+    /** False when a level score is definitive: 90 minutes, draws allowed. */
+    shootoutPossible?: boolean;
+    [k: string]: unknown;
+}
+export declare class ApiError extends Error {
+    readonly status: number;
+    readonly path: string;
+    /**
+     * The `teamId` some rejections carry alongside the error. POST /api/teams
+     * answers 409 `{error:"team_exists", teamId}` — the id is the whole point of
+     * that response, so it must not be flattened away into the message.
+     */
+    readonly teamId?: string;
+    /**
+     * When to try again, in seconds — the whole point of a 429.
+     *
+     * The server always says this, twice over: `retry-after` on the response and,
+     * for the playoff cooldown, `retryAfterMs`/`nextMatchAt` in the body. Both
+     * used to be dropped on the floor, so an agent that woke a minute early got a
+     * sentence to read instead of a time to sleep until, and had to spend another
+     * call working out what the rejection already contained.
+     */
+    readonly retryAfterSeconds?: number;
+    /** The exact instant the next attempt is allowed, when the server names one. */
+    readonly retryAt?: string;
+    /** Requests left in this window, so an agent can PACE instead of only backing off. */
+    readonly remaining?: number;
+    constructor(status: number, path: string, message: string, teamId?: string, extra?: {
+        retryAfterSeconds?: number;
+        retryAt?: string;
+        remaining?: number;
+    });
+}
+/**
+ * Hosts this client will sign a sign-in for.
+ *
+ * The anchor is BUILT IN, not derived from POG_API_URL. Deriving it from the
+ * URL under suspicion was the flaw: point the client at evil.example and it
+ * would serve a message for evil.example, satisfy every field check, and get a
+ * signature from the persistent wallet. Thorough validation of a self-consistent
+ * forgery is still a forgery — the check has to start from something the
+ * attacker does not control.
+ *
+ * So: the known Proof of Goal domains by default; loopback automatically,
+ * because a local dev server is not a phishing target; anything else only with
+ * an explicit POG_SIWS_DOMAIN. A mistyped host therefore fails closed and says
+ * what to set.
+ *
+ * The ORIGIN has to clear that bar too, not just the domain in the message.
+ * Returning the production hosts for an arbitrary API URL left one attack whole:
+ * a hostile HTTPS host does not have to forge anything — it proxies the nonce
+ * and message straight from api.pog.soccer, hands back the genuine pog.soccer
+ * text, and every field check passes because every field is real. Then it keeps
+ * the signature and the session. HTTPS authenticates the relay, not the service
+ * behind it. So an origin we do not know is refused before a message is fetched.
+ */
+export declare function expectedSiwsHosts(apiOrigin: string, env?: NodeJS.ProcessEnv): string[];
+/**
+ * Hosts this client will send a wallet address to.
+ *
+ * Separate from the domains a MESSAGE may name, because they answer different
+ * questions and a deployment can legitimately split them: the product's own API
+ * lives at api.pog.soccer and signs for pog.soccer. So an operator who declares
+ * their domain gets that same relation for free — the domain itself, or `api.`
+ * in front of it — and POG_API_HOST is there for the topologies that are neither.
+ */
+export declare function expectedApiHosts(env?: NodeJS.ProcessEnv): string[];
+/**
+ * The product's own domains, derived from DEFAULT_API_URL so the two cannot
+ * drift: the API host and the site it signs people in to.
+ */
+export declare const TRUSTED_SIWS_HOSTS: string[];
+/**
+ * Refuse to run the sign-in flow over plaintext to a remote host.
+ *
+ * Loopback is exempt: there is no path for anyone to sit on.
+ */
+export declare function assertTransportIsSafe(origin: string): void;
+/**
+ * The exact `domain` a message may name, or `null` to check only the host.
+ *
+ * Loopback stays host-only: the local API signs "localhost" whichever spelling
+ * and port you dialled it by, and pinning that would refuse a perfectly good
+ * local login — the same exemption the host and URI checks already make.
+ */
+export declare function expectedSiwsDomain(apiOrigin: string, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * The exact URI(s) a message may name, or `null` to check only the host.
+ *
+ * The API builds this as `https://{SIWS_DOMAIN}` unless SIWS_URI overrides it,
+ * so the expected value is derivable and worth pinning: a compromised endpoint
+ * that can only vary scheme and path still gets a signature over a resource the
+ * operator never agreed to.
+ *
+ * Loopback stays host-only. Ports and schemes vary freely on a dev box, it is
+ * not a phishing target — the same exemption the host check already makes — and
+ * pinning it would only teach people to set an override they do not need.
+ */
+export declare function expectedSiwsUris(apiOrigin: string, env?: NodeJS.ProcessEnv): string[] | null;
+/**
+ * The one chain id this client will sign a sign-in for.
+ *
+ * The API binds auth to a single chain (SOLANA_DEVNET_CHAIN_ID today), so this
+ * is an exact match, not a family. Moving the deployment to another chain means
+ * setting POG_SIWS_CHAIN — logins fail closed until then, and the refusal names
+ * both chains so the cause is obvious.
+ */
+export declare function expectedSiwsChain(env?: NodeJS.ProcessEnv): string;
+/**
+ * Refuse to sign anything that is not a login to THIS service, for THIS wallet,
+ * with the nonce we just asked for.
+ *
+ * Every field is bound, not sampled. A message we cannot fully parse is a
+ * refusal: there is no safe way to sign text we could not read, and the only
+ * party who benefits from a lenient parser here is whoever served the message.
+ */
+export declare function assertSiwsMatchesRequest(message: string, expected: {
+    walletAddress: string;
+    nonce: string;
+    origin: string;
+}, env?: NodeJS.ProcessEnv): void;
+export declare class PogClient {
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    /** Per-request ceiling. Generous: a cup-day bracket is a large response. */
+    private readonly timeoutMs;
+    private session;
+    constructor(baseUrl?: string, fetchImpl?: typeof fetch, 
+    /** Per-request ceiling. Generous: a cup-day bracket is a large response. */
+    timeoutMs?: number);
+    /**
+     * The active session, or null when there is none or it has expired.
+     *
+     * Expiry is checked on read rather than trusted from when it was issued: this
+     * process can outlive a session, and returning a stale one made `whoami`
+     * report "signed in" while every authenticated call 401'd.
+     */
+    currentSession(): Session | null;
+    private request;
+    /** Run the full SIWS handshake and hold the resulting bearer session. */
+    login(mnemonic: string, walletAddress: string): Promise<Session>;
+    /**
+     * Liveness. Deliberately /healthz and not /api/ops/status — the ops routes are
+     * operator surface and answer 401 without OPS_API_KEY on any real deployment,
+     * so exposing them here would ship a tool that never works for a player.
+     */
+    health(): Promise<unknown>;
+    /** Whether the FA market is open on this deployment (public, ungated). */
+    marketStatus(): Promise<unknown>;
+    nations(): Promise<{
+        nations: Nation[];
+    }>;
+    myTeams(): Promise<unknown>;
+    /**
+     * Everything about this manager in one authenticated call: squads, league
+     * rank, playoff entry and cooldown, finished-match history, next fixture,
+     * honours, career record.
+     *
+     * This is the endpoint that makes the game playable across sessions. Cups run
+     * daily and finish hours after they open, so an agent that only ever looks at
+     * what it did inside one session never sees its own results — and never has a
+     * reason to change the squad. The alternative is six separate calls the agent
+     * has to know to make and stitch together itself.
+     */
+    dashboard(): Promise<unknown>;
+    /**
+     * A team's finished matches, newest first, up to `limit` (the API caps at 200).
+     *
+     * Lives under /api/playoff/ but is not playoff-only — it lists every completed
+     * match for the team, friendlies included. Needed because the dashboard's own
+     * `teamHistory` is capped at five rows, which is fewer than a single cup day
+     * produces.
+     */
+    teamHistory(teamId: string, limit: number): Promise<{
+        matches: HistoryMatch[];
+    }>;
+    team(teamId: string): Promise<unknown>;
+    match(matchId: string): Promise<unknown>;
+    /**
+     * Cup SUMMARY only: status, champion, final score, match count. No fixtures —
+     * see `cupBracket` for those.
+     */
+    cup(date: string): Promise<CupSummary>;
+    /**
+     * The fixtures. A cup date maps to tournament id `wc-${date}`, and the bracket
+     * lives on the tournament, not the cup — /api/cups/:date returns a summary
+     * with a `matchCount` and no matches at all.
+     */
+    cupBracket(date: string): Promise<CupBracket>;
+    /**
+     * The board's top `limit` rows. The API defaults to 100 and caps at
+     * MAX_LIMIT=500, so a request without an explicit limit silently truncates on
+     * any deployment with more managers than that — and `rows.length` is then the
+     * page size, not the population.
+     */
+    leaderboard(limit?: number): Promise<LeaderboardRow[]>;
+    /**
+     * Play one ranked playoff match. Bodyless POST — the server picks the
+     * opponent from the ladder and creates the caller's ladder entry on first
+     * call, which is how a new squad enters the competitive season at all.
+     *
+     * No body and therefore no content-type header: sending
+     * `application/json` with an empty body is what earns a 415 here.
+     */
+    playPlayoff(): Promise<unknown>;
+    createTeam(input: {
+        name: string;
+        nationCode: string;
+        players: unknown[];
+    }): Promise<unknown>;
+    updateTeam(teamId: string, input: {
+        players: unknown[];
+        name?: string;
+    }): Promise<unknown>;
+    /**
+     * Play a friendly. Team-id form only, on purpose: the server then reads both
+     * squads itself. The inline-squad form exists for engine callers and needs the
+     * engine's attribute names (dori/shoo/defe), which differ from the flat shape
+     * POST /api/teams takes — a trap worth not exposing to an agent.
+     *
+     * Authenticated, and the caller must OWN the home team: a friendly is a
+     * challenge you start with your squad against an arbitrary opponent. Without
+     * that gate anyone could fabricate results onto someone else's public career,
+     * so the route fails closed at 401 when no session is attached.
+     */
+    playFriendly(input: {
+        homeTeamId: string;
+        awayTeamId: string;
+        allowDraw?: boolean;
+    }): Promise<unknown>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH;;;GAGG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAYzC,+EAA+E;AAC/E,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,qBAAa,QAAS,SAAQ,KAAK;IA0B/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IA1BvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,sFAAsF;IACtF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;gBAGjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;CAS/E;AA2ED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAuCnG;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAW/E;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,EAGnC,CAAC;AA2BL;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAc1D;AAQD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAKf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,EAAE,GAAG,IAAI,CA0BjB;AAYD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE9E;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAClE,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,IAAI,CAiIN;AAED,qBAAa,SAAS;IAIlB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,SAAS;IAN5B,OAAO,CAAC,OAAO,CAAwB;gBAGpB,OAAO,GAAE,MAAsD,EAC/D,SAAS,GAAE,OAAO,KAAa;IAChD,4EAA4E;IAC3D,SAAS,GAAE,MAA4D;IAK1F;;;;;;OAMG;IACH,cAAc,IAAI,OAAO,GAAG,IAAI;YAUlB,OAAO;IAmHrB,yEAAyE;IACnE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkCtE;;;;OAIG;IACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1B,0EAA0E;IAC1E,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAIhC,OAAO,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAIzC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAI3B;;;;;;;;;;OAUG;IACH,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAI7B;;;;;;;OAOG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;IAMhF,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItC,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxC;;;OAGG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAItC;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI7C;;;;;OAKG;IACH,WAAW,CAAC,KAAK,SAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAQrE;;;;;;;OAOG;IACH,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,UAAU,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7F,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ1F;;;;;;;;;;OAUG;IACH,YAAY,CAAC,KAAK,EAAE;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GAAG,OAAO,CAAC,OAAO,CAAC;CAOrB"}