sipgate-mcp 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+## 0.3.0 - 2026-08-30
+
+- Add `sipgate-mcp setup` for interactive PAT storage in macOS Keychain.
+- Register installed Codex and Claude Code clients with a secret-free launch
+  command, user scope, and read-only mode by default.
+- Load Keychain credentials automatically when environment credentials are
+  absent, while keeping environment variables as an explicit override.
+- Add setup dry-run and opt-in write-mode flags.
+- Add a versioned agent skill and README bootstrap link for guided setup.
+- Add `sipgate-mcp --version` and verify that CLI, package, and skill versions
+  remain synchronized.
+
+## 0.2.0 - 2026-08-30
+
+- Default to MCP-level user scope resolved from sipgate's authenticated user.
+- Restrict user-scoped users, numbers, devices, phonelines, settings, and call
+  history to the authenticated user's resources.
+- Validate user-scoped write targets and outbound caller identities before
+  sending changes or chargeable actions to sipgate.
+- Avoid account-wide number and active-call snapshots in user-scoped actions.
+- Add explicit account scope that requires a verified sipgate administrator.
+- Advertise active scope and read-only behavior through MCP server instructions.
+
+## 0.1.0 - 2026-08-30
+
+- Initial local stdio MCP server with focused sipgate read and write tools.
+- Personal Access Token authentication and optional read-only mode.

package/README.md

@@ -2,18 +2,32 @@
 
 `sipgate-mcp` is an open-source, self-hosted Model Context Protocol server for inspecting and configuring a sipgate account. It exposes the sipgate REST API v2 as focused tools for agents such as Claude Code, Claude Desktop, and Codex.
 
+Version 0.2 and later default to user-scoped access: tools are constrained to the
+authenticated sipgate user's resources. Account-wide access is an explicit
+administrator-only mode.
+
 The server uses stdio only. It does not start an HTTP server or route credentials
 through a third-party service. It sends authentication only from the local MCP
 process directly to `https://api.sipgate.com/v2`.
 
+## Agent-assisted setup
+
+Tell Codex or Claude:
+
+> Set up sipgate MCP by following
+> https://raw.githubusercontent.com/wiesson/sipgate-mcp/main/SKILL.md
+
+The linked, versioned [`SKILL.md`](SKILL.md) tells the agent how to install and
+verify the matching package without asking for credentials in chat. Secret
+entry remains an interactive local Keychain step controlled by the user.
+
 ## Requirements
 
 - Node.js 22 or newer
 - A sipgate account with a Personal Access Token (PAT)
 - An MCP client with stdio support
 
-After the first npm release, install the command globally with any of the
-supported package managers:
+Install the command globally with any of the supported package managers:
 
 ```bash
 npm install --global sipgate-mcp
@@ -21,54 +35,114 @@ pnpm add --global sipgate-mcp
 vp install --global sipgate-mcp
 ```
 
-Then start it with:
+On macOS, run the interactive setup once:
 
 ```bash
-export SIPGATE_TOKEN_ID="your-token-id"
-export SIPGATE_TOKEN="your-token"
-sipgate-mcp
+sipgate-mcp setup
+```
+
+The setup stores the PAT token ID and token in macOS Keychain without placing
+either value in shell history or an MCP configuration file. It registers every
+installed supported client (Codex and Claude Code) in user/read-only mode.
+Those clients start and stop the stdio server automatically; `sipgate-mcp` does
+not run as a daemon and does not need to be started manually.
+
+Use `sipgate-mcp setup --client codex` or `--client claude` to configure only
+one client. Add `--allow-writes` only when agent-initiated account changes are
+deliberately wanted. `--dry-run` prints the secret-free registration commands
+without changing the Keychain or client configuration.
+
+Secure interactive storage currently supports macOS. Environment variables
+remain available for Linux, Windows, containers, CI, and password-manager
+wrappers. To avoid putting literal credentials in shell history, read them
+interactively:
+
+```bash
+printf "sipgate PAT token ID: "
+IFS= read -r SIPGATE_TOKEN_ID
+printf "sipgate PAT token: "
+IFS= read -rs SIPGATE_TOKEN
+printf "\n"
+export SIPGATE_TOKEN_ID SIPGATE_TOKEN
+export SIPGATE_MCP_SCOPE="user"
+export SIPGATE_MCP_READONLY="1"
 ```
 
 For clients that manage MCP commands on demand, `npx -y sipgate-mcp` remains
-supported without a global installation. The package name was available when
-checked on 2026-08-30; this repository is configured for `sipgate-mcp`, but the
-initial npm publish still needs to be completed.
+supported without a global installation.
 
 ## Create a Personal Access Token
 
 1. Open [sipgate Personal Access Tokens](https://app.sipgate.com/personal-access-token).
 2. Select **Add token**, give the token a recognizable name, and select the scopes needed for the tools you intend to use.
 3. Copy both the token ID and token. sipgate displays the token itself only once.
-4. Put them in the environment as `SIPGATE_TOKEN_ID` and `SIPGATE_TOKEN` before starting your MCP client.
+4. Run `sipgate-mcp setup` on macOS, or provide them as `SIPGATE_TOKEN_ID` and `SIPGATE_TOKEN` in the MCP process environment.
 
 sipgate PAT authentication uses HTTP Basic Auth with `token-id:token` as the credential pair. `sipgate-mcp` constructs that header in memory. See sipgate's [authentication guide](https://en.sipgate.io/rest-api/authentication).
 
-Do not put either value in this repository, an MCP config committed to source control, command output, or an issue report.
+Do not put either value in this repository, an MCP config committed to source control, shell command arguments, command output, or an issue report.
+
+The separate **API Clients** screen in the sipgate account creates OAuth 2.0
+client credentials for an application that redirects users through sipgate's
+authorization flow. Those client credentials are not PAT replacements and are
+not used by the local stdio setup. They are relevant to a future hosted/remote
+MCP, which would need a registered redirect URI, user consent, access-token
+refresh, and secure per-user token storage. See sipgate's [OAuth authentication
+flow](https://en.sipgate.io/rest-api/authentication#oauth2) and [API client
+management](https://en.sipgate.io/rest-api/managing-third-party-clients).
+
+## MCP access scopes
+
+`SIPGATE_MCP_SCOPE` controls the resource boundary enforced by the MCP in
+addition to sipgate's own user role and PAT scopes:
+
+| Value | Behavior |
+| --- | --- |
+| `user` (default) | Resolves the authenticated user through `/authorization/userinfo`; returns only that user and their assigned numbers; forces user-specific device, routing, and settings reads; constrains call history to owned connection IDs; and validates every write target against owned numbers, phonelines, or devices. |
+| `account` | Enables account-wide reads and writes. Startup fails unless `/users/{authenticatedUserId}` reports `admin: true`. Requires `users:read` for the administrator check. |
+
+Token scopes are permission ceilings, not role elevation. For example,
+`numbers:write` does not turn a regular sipgate user into an administrator.
+The effective permission is the intersection of the sipgate user role, PAT
+scopes, MCP access scope, and read-only mode.
+
+Use account scope only when account-wide administration is intended:
+
+```bash
+export SIPGATE_MCP_SCOPE="account"
+npx -y sipgate-mcp
+```
 
 ## Tools and PAT scopes
 
-The table lists the non-`all` scopes named by sipgate's live Swagger document, plus scopes required by this server's pre/post state reads. sipgate also exposes broader parent scopes such as `sessions:write`; select the listed specific and parent scopes offered by the PAT UI when in doubt.
+Every mode identifies the authenticated user with `GET /authorization/userinfo`.
+The table lists the non-`all` scopes named by sipgate's live Swagger document,
+including ownership checks performed in user scope and pre/post state reads.
+sipgate also exposes broader parent scopes such as `sessions:write`; select the
+listed specific and parent scopes offered by the PAT UI when in doubt.
 
 | Tool | Access | sipgate API calls | PAT scopes |
 | --- | --- | --- | --- |
-| `account_info` | Read | `GET /account`, `GET /authorization/userinfo` | `account:read` (`userinfo` has no scope declaration in Swagger) |
-| `list_users` | Read | `GET /users` | `users:read` |
-| `list_numbers` | Read | `GET /numbers` | `numbers:read` |
-| `list_devices` | Read | `GET /users`, `GET /{userId}/devices` | `devices:read`; `users:read` when `user_id` is omitted |
-| `get_routing` | Read | `GET /numbers`, `GET /users`, `GET /{userId}/phonelines`, `GET /{userId}/phonelines/{phonelineId}/numbers`, `GET /{userId}/phonelines/{phonelineId}/forwardings` | `numbers:read`, `phonelines:read`, `phonelines:numbers:read`, `phonelines:forwardings:read`; `users:read` when `user_id` is omitted |
-| `call_history` | Read | `GET /history` | `history:read` |
+| `account_info` | Read | User: cached `/authorization/userinfo`; account: plus `GET /account` | Account: `account:read` (`userinfo` has no scope declaration in Swagger) |
+| `list_users` | Read | User: `GET /users/{self}`; account: `GET /users` | `users:read` |
+| `list_numbers` | Read | User: `GET /{self}/phonelines` and each phoneline's `/numbers`; account: `GET /numbers` | User: `phonelines:read`, `phonelines:numbers:read`; account: `numbers:read` |
+| `list_devices` | Read | User: `GET /{self}/devices`; account: `GET /users`, `GET /{userId}/devices` | `devices:read`; account also needs `users:read` when `user_id` is omitted |
+| `get_routing` | Read | User: own phonelines, numbers, and forwardings; account: also `GET /numbers` and `GET /users` | `phonelines:read`, `phonelines:numbers:read`, `phonelines:forwardings:read`; account also needs `numbers:read` and, when `user_id` is omitted, `users:read` |
+| `call_history` | Read | User: ownership reads for own phonelines/devices, then filtered `GET /history`; account: `GET /history` | `history:read`; user also needs `phonelines:read`, `devices:read` |
 | `get_settings` | Read | `GET /users[/userId]`, `GET /{userId}/devices`, `GET /{userId}/phonelines[/phonelineId]` | `users:read`, `devices:read`, `phonelines:read` |
-| `set_number_routing` | Write | pre/post `GET /numbers`, `PUT /numbers/{numberId}` | `numbers:read`, `numbers:write` |
-| `set_forwarding` | Write | pre/post `GET /{userId}/phonelines/{phonelineId}/forwardings`, `PUT` to the same path | `phonelines:read`, `phonelines:write`, `phonelines:forwardings:read`, `phonelines:forwardings:write` |
-| `set_dnd` | Write | pre/post `GET /devices/{deviceId}`, `PUT /devices/{deviceId}` | `devices:read`, `devices:write` |
+| `set_number_routing` | Write | User: pre/post reads through own phonelines; account: pre/post `GET /numbers`; all modes: `PUT /numbers/{numberId}` | `numbers:write`; user also needs `phonelines:read`, `phonelines:numbers:read`; account needs `numbers:read` |
+| `set_forwarding` | Write | User: phoneline ownership read; then pre/post forwarding reads and `PUT` | `phonelines:read`, `phonelines:write`, `phonelines:forwardings:read`, `phonelines:forwardings:write` |
+| `set_dnd` | Write | User: device ownership read; then pre/post `GET /devices/{deviceId}` and `PUT` | `devices:read`, `devices:write` |
 | `send_sms` | Write/action | `GET /{userId}/sms`, pre/post `GET /history`, `POST /sessions/sms` | `sms:read`, `history:read`, `sessions:write`, `sessions:sms:write` |
-| `initiate_call` | Write/action | pre/post `GET /calls`, `POST /sessions/calls` | `rtcm:read`, `sessions:write`, `sessions:calls:write` |
+| `initiate_call` | Write/action | User: device/number ownership reads, then `POST /sessions/calls`; account: pre/post `GET /calls` plus `POST` | `sessions:write`, `sessions:calls:write`; user also needs `devices:read`, `phonelines:read`, `phonelines:numbers:read`; account needs `rtcm:read` |
 
 Every write tool reads current state first and returns a JSON object with `before` and `after`. SMS history can update asynchronously, and `/calls` only contains established calls, so those action snapshots also include an acceptance/session marker.
 
 ### Tool notes
 
 - `list_devices` resolves devices through users because the documented account-wide route is `GET /{userId}/devices`; the live v2 Swagger document does not define `GET /devices`.
+- User scope resolves assigned numbers through the authenticated user's phonelines and never calls account-wide `GET /users` or `GET /numbers` for read tools.
+- User-scoped number-routing snapshots are also resolved through owned phonelines, and user-scoped Click2Dial deliberately omits account-wide `/calls` snapshots.
 - Number routing uses sipgate's documented `endpointId`. Obtain existing IDs from the read tools; a phoneline ID such as `p0` is the documented example.
 - `set_forwarding` replaces the complete phoneline forwarding list. Pass `forwardings: []` to remove all forwardings. A `timeout` of `0` represents immediate forwarding.
 - `send_sms` refuses to post unless `GET /{userId}/sms` returns the requested (or first available) SMS extension.
@@ -80,12 +154,16 @@ Set `SIPGATE_MCP_READONLY=1` to register only the seven read tools. Write tools
 
 ```bash
 export SIPGATE_MCP_READONLY=1
+export SIPGATE_MCP_SCOPE=user
 npx -y sipgate-mcp
 ```
 
 ## MCP client configuration
 
-Set `SIPGATE_TOKEN_ID` and `SIPGATE_TOKEN` in the environment that launches the MCP client. The examples keep secret values out of configuration files.
+The recommended macOS path is `sipgate-mcp setup`. The following manual
+examples are useful for other platforms and custom launchers. Set
+`SIPGATE_TOKEN_ID` and `SIPGATE_TOKEN` in the environment that launches the MCP
+client; the examples keep secret values out of configuration files.
 
 ### Claude Code
 
@@ -95,12 +173,13 @@ Claude Code expands `${VAR}` references in MCP environment entries. Single quote
 claude mcp add \
   --env 'SIPGATE_TOKEN_ID=${SIPGATE_TOKEN_ID}' \
   --env 'SIPGATE_TOKEN=${SIPGATE_TOKEN}' \
+  --env SIPGATE_MCP_SCOPE=user \
   --transport stdio \
   --scope user \
   sipgate -- npx -y sipgate-mcp
 ```
 
-Add `--env SIPGATE_MCP_READONLY=1` before `--transport` for read-only mode. Verify the connection with `claude mcp get sipgate`. See the official [Claude Code MCP documentation](https://code.claude.com/docs/en/mcp).
+Add `--env SIPGATE_MCP_READONLY=1` before `--transport` for read-only mode. Replace the scope with `account` only for deliberate administrator access. Verify the connection with `claude mcp get sipgate`. See the official [Claude Code MCP documentation](https://code.claude.com/docs/en/mcp).
 
 ### Claude Desktop
 
@@ -127,18 +206,22 @@ Codex can forward named variables from its local environment without storing the
 [mcp_servers.sipgate]
 command = "npx"
 args = ["-y", "sipgate-mcp"]
-env_vars = ["SIPGATE_TOKEN_ID", "SIPGATE_TOKEN", "SIPGATE_MCP_READONLY"]
+env_vars = ["SIPGATE_TOKEN_ID", "SIPGATE_TOKEN", "SIPGATE_MCP_SCOPE", "SIPGATE_MCP_READONLY"]
 ```
 
 Export the variables before starting Codex, then use `/mcp` or `codex mcp list` to confirm the server. The `env_vars` forwarding form is documented in the [official OpenAI MCP documentation](https://developers.openai.com/codex/mcp/).
 
 ## Manual smoke test with MCP Inspector
 
-This test makes real sipgate API calls. Start with a PAT containing only `account:read` and `numbers:read`, plus the required environment variables:
+This test makes real sipgate API calls. Start in user/read-only mode with a PAT
+containing `phonelines:read` and `phonelines:numbers:read`, plus the required
+environment variables:
 
 ```bash
 export SIPGATE_TOKEN_ID="your-token-id"
 export SIPGATE_TOKEN="your-token"
+export SIPGATE_MCP_SCOPE="user"
+export SIPGATE_MCP_READONLY=1
 npx @modelcontextprotocol/inspector npx -y sipgate-mcp
 ```
 
@@ -158,17 +241,24 @@ The MCP layer depends only on the backend interface:
 ```text
 MCP stdio server
   -> validated tool definitions (Zod)
-    -> TelephonyBackend
-      -> SipgateBackend (v1 implementation)
-        -> SipgateClient
-          -> native fetch -> https://api.sipgate.com/v2
+    -> user/account access policy
+      -> TelephonyBackend
+        -> SipgateBackend
+          -> SipgateClient
+            -> native fetch -> https://api.sipgate.com/v2
 ```
 
 `TelephonyBackend` contains the stable, provider-neutral operations. `SipgateBackend` is the only v1 implementation, so a future second telephony provider can reuse the same MCP tool surface.
 
 ## Security
 
-- PAT values are read only from `SIPGATE_TOKEN_ID` and `SIPGATE_TOKEN`.
+- PAT values are read from `SIPGATE_TOKEN_ID` and `SIPGATE_TOKEN`, or from the
+  current user's macOS Keychain when both variables are absent.
+- `sipgate-mcp setup` delegates secret entry directly to the macOS Keychain
+  prompt. Secret values are never passed as command-line arguments and are not
+  written to Codex or Claude configuration.
+- User scope is the default and validates user IDs plus number, phoneline, device, call, and history ownership before delegation.
+- Account scope fails startup unless the authenticated sipgate user reports `admin: true`.
 - The Basic Auth header exists only in memory and is sent only to the fixed sipgate API base URL.
 - API error bodies are discarded. User-facing errors never include request headers, response bodies, or credentials.
 - Potentially sensitive response properties such as `credentials`, `password`, `token`, and `secret` are redacted before tool output.
@@ -184,7 +274,7 @@ npm run build
 npm test
 ```
 
-Tests use `node:test` and mocked `fetch`; they never call the real sipgate API. The suite includes client authentication/error behavior, exact critical write payloads, credential redaction, one test per MCP tool, and read-only registration.
+Tests use `node:test` and mocked `fetch`; they never call the real sipgate API. The suite includes client authentication/error behavior, user/account access-policy enforcement, exact critical write payloads, credential redaction, one test per MCP tool, and read-only registration.
 
 ## Releases
 
@@ -203,8 +293,9 @@ The endpoint paths, query parameters, request bodies, response models, and scope
 
 ## Roadmap
 
-- v1: local self-hosted stdio server (this release)
-- v2: optional remote deployment, including a Cloudflare Workers backend, without changing the MCP tool surface
+- v0.1: local self-hosted stdio server and sipgate REST API tools
+- v0.2: user-scoped access by default plus explicit administrator-only account scope
+- Future: optional remote deployment, including a Cloudflare Workers backend, without changing the MCP tool surface
 - Additional `TelephonyBackend` implementation(s)
 - Product-aware Click2Dial behavior for classic and Neo PBX accounts
 

package/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: sipgate-mcp
+description: Install and securely configure the sipgate MCP server when a user asks to set up or connect a sipgate account to Codex or Claude. Do not use for ordinary sipgate product questions.
+metadata:
+  version: "0.3.0"
+---
+
+# Set up sipgate MCP
+
+Install the matching CLI version with one available package manager:
+
+```bash
+vp install -g sipgate-mcp@0.3.0
+```
+
+```bash
+npm install -g sipgate-mcp@0.3.0
+```
+
+```bash
+pnpm add -g sipgate-mcp@0.3.0
+```
+
+Run only one install command. Confirm that `sipgate-mcp --version` reports
+`0.3.0` before continuing.
+
+## Security boundary
+
+- Never ask the user to paste a sipgate PAT, token, client secret, or other
+  credential into chat.
+- Never place credentials in command arguments, MCP configuration, repository
+  files, logs, or issue reports.
+- The local server uses a sipgate Personal Access Token. A sipgate OAuth API
+  client ID and secret are not substitutes for this local setup.
+- Keep the first setup user-scoped and read-only. Do not enable write tools or
+  account-wide administrator access without an explicit user request.
+- Do not remove or replace an existing MCP configuration without the user's
+  approval.
+
+## Configure
+
+On macOS, run the interactive setup for the MCP client the user is currently
+using:
+
+```bash
+sipgate-mcp setup --client codex
+```
+
+or:
+
+```bash
+sipgate-mcp setup --client claude
+```
+
+Omit `--client` only when both installed clients should be configured. The
+setup delegates PAT entry directly to macOS Keychain and registers a
+user-scoped, read-only stdio server. The client starts and stops that process;
+do not launch `sipgate-mcp` as a daemon.
+
+If the Keychain prompt cannot be presented in the current environment, ask the
+user to run the setup command in their local interactive terminal. Do not ask
+them to provide the credential to the agent instead. On Linux or Windows,
+follow the secret-free environment or password-manager launcher guidance in
+the project README rather than inventing a plaintext credential file.
+
+If setup reports that an MCP server named `sipgate` already exists, inspect it
+with `codex mcp get sipgate` or `claude mcp get sipgate`. Explain the conflict
+and request approval before removing or replacing that configuration.
+
+## Verify
+
+Use the applicable client command:
+
+```bash
+codex mcp get sipgate
+```
+
+```bash
+claude mcp get sipgate
+```
+
+Ask the user to restart the client when required, open `/mcp`, and test with:
+
+> Use sipgate read-only. Check the connection and list my phone numbers.
+
+Do not enable `--allow-writes` merely to make a failed read test pass. Diagnose
+installation, credentials, client registration, and PAT read scopes first.

package/dist/backend/access-controlled-backend.d.ts

@@ -0,0 +1,57 @@
+import type { AccessScope, AuthenticatedUserContext, DeviceType, ForwardingRule, HistoryQuery, JsonValue, MutationResult, PaginationInput, TelephonyBackend } from "./telephony-backend.js";
+export declare class AccessPolicyError extends Error {
+    constructor(message: string);
+}
+/**
+ * Enforces MCP-level resource boundaries in addition to sipgate's own role and
+ * token-scope checks. Account scope is rejected unless sipgate identifies the
+ * authenticated user as an administrator.
+ */
+export declare class AccessControlledBackend implements TelephonyBackend {
+    private readonly delegate;
+    private readonly scope;
+    private readonly context;
+    constructor(delegate: TelephonyBackend, scope: AccessScope, context: AuthenticatedUserContext);
+    getAuthenticatedUser(): Promise<AuthenticatedUserContext>;
+    getUser(userId: string): Promise<JsonValue>;
+    getAccountInfo(): Promise<JsonValue>;
+    listUsers(): Promise<JsonValue>;
+    listNumbers({ offset, limit }: PaginationInput): Promise<JsonValue>;
+    listUserNumbers(userId: string, pagination: PaginationInput): Promise<JsonValue>;
+    listPhonelines(userId: string): Promise<JsonValue>;
+    listDevices(userId?: string, types?: DeviceType[]): Promise<JsonValue>;
+    getRouting(userId?: string): Promise<JsonValue>;
+    getCallHistory(query: HistoryQuery): Promise<JsonValue>;
+    getSettings(userId?: string): Promise<JsonValue>;
+    setNumberRouting(numberId: string, endpointId: string): Promise<MutationResult>;
+    setUserNumberRouting(userId: string, numberId: string, endpointId: string): Promise<MutationResult>;
+    setForwarding(userId: string, phonelineId: string, forwardings: ForwardingRule[]): Promise<MutationResult>;
+    setDnd(deviceId: string, enabled: boolean): Promise<MutationResult>;
+    sendSms(input: {
+        userId: string;
+        smsId?: string;
+        recipient: string;
+        message: string;
+        sendAt?: number;
+    }): Promise<MutationResult>;
+    initiateCall(input: {
+        caller: string;
+        callee: string;
+        callerId?: string;
+        deviceId?: string;
+    }): Promise<MutationResult>;
+    initiateUserCall(input: {
+        caller: string;
+        callee: string;
+        callerId?: string;
+        deviceId?: string;
+    }): Promise<MutationResult>;
+    private assertUser;
+    private assertOwned;
+    private ownedConnectionIds;
+    private ownedPhonelineIds;
+    private ownedDeviceIds;
+    private ownedNumbers;
+}
+export declare function createAccessControlledBackend(delegate: TelephonyBackend, scope: AccessScope): Promise<AccessControlledBackend>;
+//# sourceMappingURL=access-controlled-backend.d.ts.map

package/dist/backend/access-controlled-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-controlled-backend.d.ts","sourceRoot":"","sources":["../../src/backend/access-controlled-backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,wBAAwB,EACxB,UAAU,EACV,cAAc,EACd,YAAY,EAEZ,SAAS,EACT,cAAc,EACd,eAAe,EACf,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAEhC,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAmB,OAAO,EAAE,MAAM,EAGjC;CACF;AAiCD;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,gBAAgB;IAE5D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,YACmB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,wBAAwB,EAChD;IAEG,oBAAoB,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAE/D;IAEY,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAGvD;IAEY,cAAc,IAAI,OAAO,CAAC,SAAS,CAAC,CAQhD;IAEY,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,CAI3C;IAEY,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAG/E;IAEM,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAGtF;IAEM,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAGxD;IAEM,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAI5E;IAEM,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAIrD;IAEY,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBnE;IAEM,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAItD;IAEY,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAY3F;IAEM,oBAAoB,CACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,CAAC,CAGzB;IAEY,aAAa,CACxB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,cAAc,EAAE,GAC5B,OAAO,CAAC,cAAc,CAAC,CAMzB;IAEY,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAK/E;IAEY,OAAO,CAAC,KAAK,EAAE;QAC1B,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,cAAc,CAAC,CAG1B;IAEY,YAAY,CAAC,KAAK,EAAE;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmB1B;IAEM,gBAAgB,CAAC,KAAK,EAAE;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAG1B;IAED,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,WAAW;YAOL,kBAAkB;YAQlB,iBAAiB;YASjB,cAAc;YASd,YAAY;CAe3B;AAED,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,uBAAuB,CAAC,CAWlC"}