@agent-native/core 0.92.12 → 0.94.0

package/dist/automation/index.js

@@ -0,0 +1,464 @@
+/**
+ * Provider-neutral workflow automation connectors.
+ *
+ * This is intentionally separate from provider-api: an automation connector
+ * invokes a configured workflow or accepts a configured workflow callback. It
+ * is not an arbitrary provider HTTP escape hatch and it is not a chat channel.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { getHeader, getRouterParam, setResponseStatus } from "h3";
+import { z } from "zod";
+import { defineAction } from "../action.js";
+import { ssrfSafeFetch } from "../extensions/url-safety.js";
+import { resolveKeyReferencesWithRequestScopes } from "../secrets/substitution.js";
+import { getRequestUserEmail } from "../server/request-context.js";
+const DEFAULT_MAX_REQUEST_BYTES = 64 * 1024;
+const DEFAULT_MAX_RESPONSE_BYTES = 128 * 1024;
+const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_MAX_ATTEMPTS = 2;
+export class AutomationConnectorError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "AutomationConnectorError";
+    }
+}
+function byteLength(value) {
+    return new TextEncoder().encode(value).byteLength;
+}
+function bytesToString(chunks, byteCount) {
+    const bytes = new Uint8Array(byteCount);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(bytes);
+}
+function clampBytes(value, fallback) {
+    if (!Number.isFinite(value))
+        return fallback;
+    return Math.max(1, Math.min(Math.floor(value), 1024 * 1024));
+}
+function normalizeAttempts(value) {
+    if (!Number.isFinite(value))
+        return DEFAULT_MAX_ATTEMPTS;
+    return Math.max(1, Math.min(Math.floor(value), 3));
+}
+function redact(value, secretValues) {
+    return secretValues.reduce((result, secret) => secret ? result.split(secret).join("[REDACTED]") : result, value);
+}
+function redactUnknown(value, secretValues) {
+    if (typeof value === "string")
+        return redact(value, secretValues);
+    if (Array.isArray(value)) {
+        return value.map((item) => redactUnknown(item, secretValues));
+    }
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            key,
+            redactUnknown(item, secretValues),
+        ]));
+    }
+    return value;
+}
+function responseTarget(url) {
+    return `${url.origin}${url.pathname}`;
+}
+function assertAllowedTarget(definition) {
+    let base;
+    let target;
+    try {
+        base = new URL(definition.baseUrl);
+        target = new URL(definition.path, base);
+    }
+    catch {
+        throw new AutomationConnectorError("invalid_configuration", "Workflow has an invalid configured base URL or path.");
+    }
+    if (base.protocol !== "https:" || target.protocol !== "https:") {
+        throw new AutomationConnectorError("blocked_target", "Automation workflow targets must use HTTPS.");
+    }
+    const allowedOrigins = new Set([
+        base.origin,
+        ...(definition.allowedOrigins ?? []),
+    ]);
+    if (!allowedOrigins.has(target.origin)) {
+        throw new AutomationConnectorError("blocked_target", "Workflow target is outside its configured allow-listed origin.");
+    }
+    return target;
+}
+async function resolveStaticHeaders(headers, userEmail, resolveSecret) {
+    const output = {};
+    const secretValues = [];
+    for (const [name, value] of Object.entries(headers ?? {})) {
+        let resolved = value;
+        if (value.includes("${keys.")) {
+            const result = await resolveKeyReferencesWithRequestScopes(value, userEmail);
+            resolved = result.resolved;
+            secretValues.push(...result.secretValues);
+        }
+        output[name] = resolved;
+    }
+    // A small app adapter may use named secret refs rather than the app vault
+    // syntax. Resolve those only from static header values, never from agent args.
+    if (resolveSecret) {
+        for (const [name, value] of Object.entries(output)) {
+            const match = value.match(/^\$\{automationSecret\.([A-Za-z0-9_-]+)\}$/);
+            if (!match)
+                continue;
+            const secret = await resolveSecret(match[1], { userEmail });
+            if (!secret) {
+                throw new AutomationConnectorError("invalid_configuration", `A configured credential is unavailable for header "${name}".`);
+            }
+            output[name] = secret;
+            secretValues.push(secret);
+        }
+    }
+    return { headers: output, secretValues };
+}
+async function readBoundedResponse(response, maxBytes) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        return { value: "", truncated: false };
+    const chunks = [];
+    let byteCount = 0;
+    let truncated = false;
+    const declaredLength = Number(response.headers.get("content-length"));
+    const declaredOversize = Number.isFinite(declaredLength) && declaredLength > maxBytes;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value.byteLength === 0)
+                continue;
+            const remaining = maxBytes - byteCount;
+            if (value.byteLength > remaining) {
+                if (remaining > 0)
+                    chunks.push(value.subarray(0, remaining));
+                byteCount += remaining;
+                truncated = true;
+                await reader.cancel().catch(() => { });
+                break;
+            }
+            chunks.push(value);
+            byteCount += value.byteLength;
+            if (byteCount === maxBytes && declaredOversize) {
+                truncated = true;
+                await reader.cancel().catch(() => { });
+                break;
+            }
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bounded = bytesToString(chunks, byteCount);
+    try {
+        return { value: JSON.parse(bounded), truncated };
+    }
+    catch {
+        return { value: bounded, truncated };
+    }
+}
+function payloadTooLarge(maxBytes) {
+    return new AutomationConnectorError("payload_too_large", `Callback exceeds the ${maxBytes}-byte limit.`);
+}
+async function readBoundedRequestBody(event, maxBytes) {
+    const contentLength = getHeader(event, "content-length");
+    if (contentLength) {
+        const declared = Number(contentLength);
+        if (Number.isFinite(declared) && declared > maxBytes) {
+            throw payloadTooLarge(maxBytes);
+        }
+    }
+    const body = event.req.body;
+    if (!body)
+        return "";
+    const reader = body.getReader();
+    const chunks = [];
+    let byteCount = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value.byteLength === 0)
+                continue;
+            if (byteCount + value.byteLength > maxBytes) {
+                await reader.cancel().catch(() => { });
+                throw payloadTooLarge(maxBytes);
+            }
+            chunks.push(value);
+            byteCount += value.byteLength;
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return bytesToString(chunks, byteCount);
+}
+function shouldRetry(status) {
+    return status === 408 || status === 429 || status >= 500;
+}
+function secureEqual(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return (leftBuffer.length === rightBuffer.length &&
+        timingSafeEqual(leftBuffer, rightBuffer));
+}
+export function createAutomationRuntime(options) {
+    const workflows = new Map(options.workflows.map((workflow) => [workflow.id, workflow]));
+    async function invoke(invocation) {
+        const workflow = workflows.get(invocation.workflowId);
+        if (!workflow) {
+            throw new AutomationConnectorError("unknown_workflow", `Unknown automation workflow "${invocation.workflowId}".`);
+        }
+        if (!workflow.outbound || !workflow.capabilities.invokesExternalWorkflow) {
+            throw new AutomationConnectorError("unsupported_direction", `Workflow "${workflow.id}" does not support outbound invocation.`);
+        }
+        const target = assertAllowedTarget(workflow.outbound);
+        const body = JSON.stringify(invocation.input);
+        const maxRequestBytes = clampBytes(workflow.outbound.maxRequestBytes, DEFAULT_MAX_REQUEST_BYTES);
+        if (byteLength(body) > maxRequestBytes) {
+            throw new AutomationConnectorError("payload_too_large", `Automation input exceeds the ${maxRequestBytes}-byte limit.`);
+        }
+        if (workflow.outbound.idempotencyHeader &&
+            workflow.capabilities.supportsIdempotency &&
+            !invocation.idempotencyKey) {
+            throw new AutomationConnectorError("missing_idempotency", "This workflow requires an idempotency key.");
+        }
+        const { headers, secretValues } = await resolveStaticHeaders(workflow.outbound.headers, invocation.userEmail, options.resolveSecret);
+        headers["content-type"] ??= "application/json";
+        if (workflow.outbound.idempotencyHeader && invocation.idempotencyKey) {
+            headers[workflow.outbound.idempotencyHeader] = invocation.idempotencyKey;
+        }
+        const attempts = normalizeAttempts(workflow.outbound.retry?.maxAttempts);
+        const timeoutMs = Math.max(1, Math.min(workflow.outbound.timeoutMs ?? DEFAULT_TIMEOUT_MS, 30_000));
+        const maxResponseBytes = clampBytes(workflow.outbound.maxResponseBytes, DEFAULT_MAX_RESPONSE_BYTES);
+        let lastError;
+        for (let attempt = 1; attempt <= attempts; attempt++) {
+            const abort = new AbortController();
+            const timer = setTimeout(() => abort.abort(), timeoutMs);
+            try {
+                const request = {
+                    method: workflow.outbound.method ?? "POST",
+                    headers,
+                    body,
+                    signal: abort.signal,
+                };
+                const response = options.fetch
+                    ? await options.fetch(target.href, { ...request, redirect: "manual" })
+                    : await ssrfSafeFetch(target.href, request, {
+                        httpsOnly: true,
+                        maxRedirects: 0,
+                    });
+                const parsed = await readBoundedResponse(response, maxResponseBytes);
+                if (!response.ok &&
+                    shouldRetry(response.status) &&
+                    attempt < attempts) {
+                    await new Promise((resolve) => setTimeout(resolve, workflow.outbound.retry?.retryDelayMs ?? 250));
+                    continue;
+                }
+                if (!response.ok) {
+                    throw new AutomationConnectorError("request_failed", `Workflow request to ${responseTarget(target)} failed with HTTP ${response.status}.`);
+                }
+                return {
+                    workflowId: workflow.id,
+                    connectorId: workflow.connectorId,
+                    status: workflow.response.mode === "asynchronous"
+                        ? "accepted"
+                        : "completed",
+                    responseMode: workflow.response.mode,
+                    attempts: attempt,
+                    httpStatus: response.status,
+                    output: redactUnknown(parsed.value, secretValues),
+                    responseTruncated: parsed.truncated,
+                };
+            }
+            catch (error) {
+                lastError = error;
+                if (abort.signal.aborted) {
+                    lastError = new AutomationConnectorError("timeout", `Workflow request to ${responseTarget(target)} timed out.`);
+                }
+                const retryable = abort.signal.aborted ||
+                    !(lastError instanceof AutomationConnectorError);
+                if (attempt < attempts && retryable) {
+                    await new Promise((resolve) => setTimeout(resolve, workflow.outbound.retry?.retryDelayMs ?? 250));
+                    continue;
+                }
+                break;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        if (lastError instanceof AutomationConnectorError)
+            throw lastError;
+        throw new AutomationConnectorError("request_failed", `Workflow request to ${responseTarget(target)} failed after ${attempts} attempts.`);
+    }
+    async function receiveCallback(input) {
+        const workflow = workflows.get(input.workflowId);
+        if (!workflow) {
+            throw new AutomationConnectorError("unknown_workflow", "Unknown automation callback.");
+        }
+        if (!workflow.inbound || !workflow.capabilities.receivesCallback) {
+            throw new AutomationConnectorError("unsupported_direction", "This workflow does not accept callbacks.");
+        }
+        const maxRequestBytes = clampBytes(workflow.inbound.maxRequestBytes, DEFAULT_MAX_REQUEST_BYTES);
+        if (byteLength(input.rawBody) > maxRequestBytes) {
+            throw new AutomationConnectorError("payload_too_large", `Callback exceeds the ${maxRequestBytes}-byte limit.`);
+        }
+        const auth = workflow.inbound.authentication;
+        let authenticated = false;
+        if (auth.kind === "provider-auth") {
+            authenticated = await auth.verify({
+                rawBody: input.rawBody,
+                headers: input.headers,
+            });
+        }
+        else {
+            const secret = await options.resolveSecret?.(auth.secretRef, {});
+            if (!secret) {
+                throw new AutomationConnectorError("invalid_configuration", "The configured automation callback credential is unavailable.");
+            }
+            const supplied = input.headers.get(auth.header) ?? "";
+            const expected = auth.kind === "hmac-sha256"
+                ? `${auth.prefix ?? "sha256="}${createHmac("sha256", secret).update(input.rawBody).digest("hex")}`
+                : `${auth.prefix ?? ""}${secret}`;
+            authenticated = secureEqual(supplied, expected);
+        }
+        if (!authenticated) {
+            throw new AutomationConnectorError("authentication_failed", "Automation callback authentication failed.");
+        }
+        const suppliedEventId = input.headers
+            .get(workflow.inbound.eventIdHeader ?? "x-event-id")
+            ?.trim();
+        let eventId;
+        if (workflow.inbound.triggersAgentExecution) {
+            if (!options.claimInboundEvent ||
+                !options.releaseInboundEvent ||
+                !options.enqueueInboundEvent) {
+                throw new AutomationConnectorError("invalid_configuration", "Agent-triggering callbacks require durable claim, release, and queue handlers.");
+            }
+            if (!suppliedEventId) {
+                throw new AutomationConnectorError("missing_idempotency", "Agent-triggering callbacks require a stable provider event ID.");
+            }
+            eventId = suppliedEventId;
+            const claimed = await options.claimInboundEvent({ workflow, eventId });
+            if (!claimed)
+                return { accepted: true, duplicate: true, eventId };
+            let payload = input.rawBody;
+            try {
+                payload = JSON.parse(input.rawBody);
+            }
+            catch {
+                // A plain-text callback is permitted; the payload bound above still applies.
+            }
+            try {
+                await options.enqueueInboundEvent({ workflow, eventId, payload });
+            }
+            catch (error) {
+                await options.releaseInboundEvent({ workflow, eventId });
+                throw error;
+            }
+        }
+        else {
+            eventId =
+                suppliedEventId ??
+                    createHmac("sha256", workflow.id).update(input.rawBody).digest("hex");
+        }
+        return { accepted: true, duplicate: false, eventId };
+    }
+    return {
+        listWorkflows: () => [...workflows.values()],
+        getWorkflow: (workflowId) => workflows.get(workflowId),
+        invoke,
+        receiveCallback,
+    };
+}
+const invokeAutomationWorkflowSchema = z.object({
+    workflowId: z.string().min(1),
+    input: z.record(z.string(), z.unknown()),
+    idempotencyKey: z.string().min(8).max(256).optional(),
+});
+/**
+ * Creates the narrow action applications expose to their agent and UI. The
+ * workflow identity resolves to static server configuration; callers cannot
+ * supply arbitrary target URLs or credentials.
+ */
+export function createInvokeAutomationWorkflowAction(runtime, options = {}) {
+    return defineAction({
+        description: options.description ??
+            "Invoke a configured external automation workflow by its stable workflow ID. This cannot call arbitrary URLs and never exposes credentials.",
+        schema: invokeAutomationWorkflowSchema,
+        http: false,
+        needsApproval: (args) => options.requireApproval ??
+            runtime.getWorkflow(args.workflowId)?.capabilities
+                .mayCauseExternalSideEffects !== false,
+        run: async (args) => {
+            const userEmail = getRequestUserEmail();
+            if (!userEmail)
+                throw new Error("You must be signed in to invoke a workflow.");
+            return runtime.invoke({ ...args, userEmail });
+        },
+    });
+}
+/**
+ * Builds a route-only H3 callback handler. Mount it at
+ * `/_agent-native/automations/callback/:workflowId`; ordinary app operations
+ * still use actions. The callback only authenticates, deduplicates, and
+ * durably enqueues work before returning a quick acknowledgement.
+ */
+export function createAutomationCallbackHandler(runtime) {
+    return async (event) => {
+        const workflowId = getRouterParam(event, "workflowId");
+        if (!workflowId) {
+            setResponseStatus(event, 404);
+            return { error: "Unknown automation workflow." };
+        }
+        try {
+            const workflow = runtime.getWorkflow(workflowId);
+            if (!workflow?.inbound || !workflow.capabilities.receivesCallback) {
+                throw new AutomationConnectorError(workflow ? "unsupported_direction" : "unknown_workflow", "Unknown automation callback.");
+            }
+            const maxRequestBytes = clampBytes(workflow.inbound.maxRequestBytes, DEFAULT_MAX_REQUEST_BYTES);
+            const rawBody = await readBoundedRequestBody(event, maxRequestBytes);
+            const result = await runtime.receiveCallback({
+                workflowId,
+                rawBody,
+                headers: new Headers(event.headers),
+            });
+            setResponseStatus(event, result.duplicate ? 200 : 202);
+            return {
+                accepted: true,
+                duplicate: result.duplicate,
+                eventId: result.eventId,
+            };
+        }
+        catch (error) {
+            let status = 500;
+            if (error instanceof AutomationConnectorError) {
+                switch (error.code) {
+                    case "unknown_workflow":
+                    case "unsupported_direction":
+                        status = 404;
+                        break;
+                    case "authentication_failed":
+                        status = 401;
+                        break;
+                    case "missing_idempotency":
+                        status = 400;
+                        break;
+                    case "payload_too_large":
+                        status = 413;
+                        break;
+                }
+            }
+            setResponseStatus(event, status);
+            return { error: "Automation callback rejected." };
+        }
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/automation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/automation/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAElE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,0BAA0B,GAAG,GAAG,GAAG,IAAI,CAAC;AAC9C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAyH/B,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAEtC,IAAI;IADf,YACW,IASW,EACpB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;oBAZN,IAAI;QAab,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AA4DD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CACpB,MAA6B,EAC7B,SAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB,EAAE,QAAgB;IAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAM,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,YAA+B;IAC5D,OAAO,YAAY,CAAC,MAAM,CACxB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CACjB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,EAC3D,KAAK,CACN,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,YAA+B;IAE/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACzC,GAAG;YACH,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC;SAClC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAAQ;IAC9B,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAwC;IACnE,IAAI,IAAS,CAAC;IACd,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,wBAAwB,CAChC,gBAAgB,EAChB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,IAAI,CAAC,MAAM;QACX,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAwB,CAChC,gBAAgB,EAChB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAAqD,EACrD,SAAiB,EACjB,aAAwD;IAExD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,qCAAqC,CACxD,KAAK,EACL,SAAS,CACV,CAAC;YACF,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,sDAAsD,IAAI,IAAI,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;YACtB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,QAAkB,EAClB,QAAgB;IAEhB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEpD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GACpB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,QAAQ,CAAC;IAE/D,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;gBAAE,SAAS;YAErC,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;YACvC,IAAI,KAAK,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC;gBACjC,IAAI,SAAS,GAAG,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;gBAC7D,SAAS,IAAI,SAAS,CAAC;gBACvB,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACtC,MAAM;YACR,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC;YAC9B,IAAI,SAAS,KAAK,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBAC/C,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACtC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,IAAI,wBAAwB,CACjC,mBAAmB,EACnB,wBAAwB,QAAQ,cAAc,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAAc,EACd,QAAgB;IAEhB,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACzD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACrD,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;gBAAE,SAAS;YACrC,IAAI,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;gBAC5C,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACtC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC;QAChC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAiC;IAEjC,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAC7D,CAAC;IAEF,KAAK,UAAU,MAAM,CACnB,UAAgC;QAEhC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,wBAAwB,CAChC,kBAAkB,EAClB,gCAAgC,UAAU,CAAC,UAAU,IAAI,CAC1D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,uBAAuB,EAAE,CAAC;YACzE,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,aAAa,QAAQ,CAAC,EAAE,yCAAyC,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,eAAe,GAAG,UAAU,CAChC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EACjC,yBAAyB,CAC1B,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,gCAAgC,eAAe,cAAc,CAC9D,CAAC;QACJ,CAAC;QACD,IACE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB;YACnC,QAAQ,CAAC,YAAY,CAAC,mBAAmB;YACzC,CAAC,UAAU,CAAC,cAAc,EAC1B,CAAC;YACD,MAAM,IAAI,wBAAwB,CAChC,qBAAqB,EACrB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAoB,CAC1D,QAAQ,CAAC,QAAQ,CAAC,OAAO,EACzB,UAAU,CAAC,SAAS,EACpB,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,OAAO,CAAC,cAAc,CAAC,KAAK,kBAAkB,CAAC;QAC/C,IAAI,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC;QAC3E,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,IAAI,kBAAkB,EAAE,MAAM,CAAC,CACpE,CAAC;QACF,MAAM,gBAAgB,GAAG,UAAU,CACjC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAClC,0BAA0B,CAC3B,CAAC;QACF,IAAI,SAAkB,CAAC;QAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAgB;oBAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,IAAI,MAAM;oBAC1C,OAAO;oBACP,IAAI;oBACJ,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC;gBACF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK;oBAC5B,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBACtE,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE;wBACxC,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,CAAC;qBAChB,CAAC,CAAC;gBACP,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;gBACrE,IACE,CAAC,QAAQ,CAAC,EAAE;oBACZ,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC5B,OAAO,GAAG,QAAQ,EAClB,CAAC;oBACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5B,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAS,CAAC,KAAK,EAAE,YAAY,IAAI,GAAG,CAAC,CACnE,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,wBAAwB,CAChC,gBAAgB,EAChB,uBAAuB,cAAc,CAAC,MAAM,CAAC,qBAAqB,QAAQ,CAAC,MAAM,GAAG,CACrF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,MAAM,EACJ,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,cAAc;wBACvC,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,WAAW;oBACjB,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;oBACpC,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC;oBACjD,iBAAiB,EAAE,MAAM,CAAC,SAAS;iBACpC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAC;gBAClB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACzB,SAAS,GAAG,IAAI,wBAAwB,CACtC,SAAS,EACT,uBAAuB,cAAc,CAAC,MAAM,CAAC,aAAa,CAC3D,CAAC;gBACJ,CAAC;gBACD,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,CAAC,OAAO;oBACpB,CAAC,CAAC,SAAS,YAAY,wBAAwB,CAAC,CAAC;gBACnD,IAAI,OAAO,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC;oBACpC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5B,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAS,CAAC,KAAK,EAAE,YAAY,IAAI,GAAG,CAAC,CACnE,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,SAAS,YAAY,wBAAwB;YAAE,MAAM,SAAS,CAAC;QACnE,MAAM,IAAI,wBAAwB,CAChC,gBAAgB,EAChB,uBAAuB,cAAc,CAAC,MAAM,CAAC,iBAAiB,QAAQ,YAAY,CACnF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,KAA8B;QAE9B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,wBAAwB,CAChC,kBAAkB,EAClB,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YACjE,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,UAAU,CAChC,QAAQ,CAAC,OAAO,CAAC,eAAe,EAChC,yBAAyB,CAC1B,CAAC;QACF,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,eAAe,EAAE,CAAC;YAChD,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,wBAAwB,eAAe,cAAc,CACtD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,+DAA+D,CAChE,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,aAAa;gBACzB,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBAClG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;YACtC,aAAa,GAAG,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO;aAClC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,IAAI,YAAY,CAAC;YACpD,EAAE,IAAI,EAAE,CAAC;QACX,IAAI,OAAe,CAAC;QACpB,IAAI,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;YAC5C,IACE,CAAC,OAAO,CAAC,iBAAiB;gBAC1B,CAAC,OAAO,CAAC,mBAAmB;gBAC5B,CAAC,OAAO,CAAC,mBAAmB,EAC5B,CAAC;gBACD,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,gFAAgF,CACjF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,wBAAwB,CAChC,qBAAqB,EACrB,gEAAgE,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,eAAe,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAClE,IAAI,OAAO,GAAY,KAAK,CAAC,OAAO,CAAC;YACrC,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,6EAA6E;YAC/E,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,eAAe;oBACf,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,OAAO;QACL,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;QAC5C,WAAW,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;QACtD,MAAM;QACN,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,OAA0B,EAC1B,OAAO,GAGH,EAAE;IAEN,OAAO,YAAY,CAAC;QAClB,WAAW,EACT,OAAO,CAAC,WAAW;YACnB,4IAA4I;QAC9I,MAAM,EAAE,8BAA8B;QACtC,IAAI,EAAE,KAAK;QACX,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CACtB,OAAO,CAAC,eAAe;YACvB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY;iBAC/C,2BAA2B,KAAK,KAAK;QAC1C,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAClB,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACxC,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAA0B;IACxE,OAAO,KAAK,EAAE,KAAc,EAAE,EAAE;QAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;gBAClE,MAAM,IAAI,wBAAwB,CAChC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,EACvD,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YACD,MAAM,eAAe,GAAG,UAAU,CAChC,QAAQ,CAAC,OAAO,CAAC,eAAe,EAChC,yBAAyB,CAC1B,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC;gBAC3C,UAAU;gBACV,OAAO;gBACP,OAAO,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;aACpC,CAAC,CAAC;YACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACvD,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,GAAG,GAAG,CAAC;YACjB,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;gBAC9C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,kBAAkB,CAAC;oBACxB,KAAK,uBAAuB;wBAC1B,MAAM,GAAG,GAAG,CAAC;wBACb,MAAM;oBACR,KAAK,uBAAuB;wBAC1B,MAAM,GAAG,GAAG,CAAC;wBACb,MAAM;oBACR,KAAK,qBAAqB;wBACxB,MAAM,GAAG,GAAG,CAAC;wBACb,MAAM;oBACR,KAAK,mBAAmB;wBACtB,MAAM,GAAG,GAAG,CAAC;wBACb,MAAM;gBACV,CAAC;YACH,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Provider-neutral workflow automation connectors.\n *\n * This is intentionally separate from provider-api: an automation connector\n * invokes a configured workflow or accepts a configured workflow callback. It\n * is not an arbitrary provider HTTP escape hatch and it is not a chat channel.\n */\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\nimport { getHeader, getRouterParam, setResponseStatus } from \"h3\";\nimport type { H3Event } from \"h3\";\nimport { z } from \"zod\";\n\nimport { defineAction } from \"../action.js\";\nimport { ssrfSafeFetch } from \"../extensions/url-safety.js\";\nimport { resolveKeyReferencesWithRequestScopes } from \"../secrets/substitution.js\";\nimport { getRequestUserEmail } from \"../server/request-context.js\";\n\nconst DEFAULT_MAX_REQUEST_BYTES = 64 * 1024;\nconst DEFAULT_MAX_RESPONSE_BYTES = 128 * 1024;\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst DEFAULT_MAX_ATTEMPTS = 2;\n\nexport type AutomationResponseMode = \"synchronous\" | \"asynchronous\";\nexport type AutomationInvocationStatus = \"completed\" | \"accepted\";\nexport type JsonSchema = Readonly<Record<string, unknown>>;\n\nexport interface AutomationRetryPolicy {\n  /** Total request attempts, including the first. Bounded to three. */\n  readonly maxAttempts?: number;\n  readonly retryDelayMs?: number;\n}\n\nexport interface AutomationWorkflowCapabilities {\n  readonly invokesExternalWorkflow: boolean;\n  readonly receivesCallback: boolean;\n  readonly supportsIdempotency: boolean;\n  readonly supportsSynchronousResponse: boolean;\n  readonly supportsAsynchronousResponse: boolean;\n  readonly mayCauseExternalSideEffects: boolean;\n}\n\nexport interface AutomationOutboundDefinition {\n  /** An explicit, static HTTPS origin such as https://automations.example.com. */\n  readonly baseUrl: string;\n  /** Additional explicit origins allowed for this workflow, if any. */\n  readonly allowedOrigins?: readonly string[];\n  /** A static path below baseUrl. It is never supplied by an agent. */\n  readonly path: string;\n  readonly method?: \"POST\" | \"PUT\" | \"PATCH\";\n  /**\n   * Static headers may use `${keys.NAME}` references. They are resolved only\n   * after an action call reaches the server and are redacted from all results.\n   */\n  readonly headers?: Readonly<Record<string, string>>;\n  readonly credentialRequirements?: readonly string[];\n  readonly timeoutMs?: number;\n  readonly retry?: AutomationRetryPolicy;\n  readonly maxRequestBytes?: number;\n  readonly maxResponseBytes?: number;\n  readonly idempotencyHeader?: string;\n}\n\nexport type AutomationCallbackAuthentication =\n  | {\n      readonly kind: \"shared-secret\";\n      readonly secretRef: string;\n      readonly header: string;\n      readonly prefix?: string;\n    }\n  | {\n      readonly kind: \"hmac-sha256\";\n      readonly secretRef: string;\n      readonly header: string;\n      readonly prefix?: string;\n    }\n  | {\n      readonly kind: \"provider-auth\";\n      /**\n       * Provider verification stays in the app adapter; the shared runtime\n       * never pretends every provider uses the same signature protocol.\n       */\n      readonly verify: (input: {\n        readonly rawBody: string;\n        readonly headers: Headers;\n      }) => Promise<boolean>;\n    };\n\nexport interface AutomationInboundDefinition {\n  readonly authentication: AutomationCallbackAuthentication;\n  readonly eventIdHeader?: string;\n  readonly maxRequestBytes?: number;\n  /**\n   * Receiving a callback that starts agent work requires both durable callbacks\n   * below. The runtime rejects configurations that omit either one.\n   */\n  readonly triggersAgentExecution?: boolean;\n}\n\nexport interface AutomationWorkflowDefinition {\n  /** Stable app-owned ID; callers use this rather than a URL. */\n  readonly id: string;\n  readonly connectorId: string;\n  readonly name: string;\n  readonly inputSchema: JsonSchema;\n  readonly outputSchema?: JsonSchema;\n  readonly response: { readonly mode: AutomationResponseMode };\n  readonly capabilities: AutomationWorkflowCapabilities;\n  readonly outbound?: AutomationOutboundDefinition;\n  readonly inbound?: AutomationInboundDefinition;\n}\n\nexport interface AutomationInvocation {\n  readonly workflowId: string;\n  readonly input: Record<string, unknown>;\n  readonly idempotencyKey?: string;\n  readonly userEmail: string;\n}\n\nexport interface AutomationInvocationResult {\n  readonly workflowId: string;\n  readonly connectorId: string;\n  readonly status: AutomationInvocationStatus;\n  readonly responseMode: AutomationResponseMode;\n  readonly attempts: number;\n  readonly httpStatus: number;\n  readonly output?: unknown;\n  readonly responseTruncated: boolean;\n}\n\nexport interface AutomationCallbackInput {\n  readonly workflowId: string;\n  readonly rawBody: string;\n  readonly headers: Headers;\n}\n\nexport interface AutomationCallbackResult {\n  readonly accepted: boolean;\n  readonly duplicate: boolean;\n  readonly eventId: string;\n}\n\nexport class AutomationConnectorError extends Error {\n  constructor(\n    readonly code:\n      | \"unknown_workflow\"\n      | \"unsupported_direction\"\n      | \"invalid_configuration\"\n      | \"blocked_target\"\n      | \"payload_too_large\"\n      | \"authentication_failed\"\n      | \"missing_idempotency\"\n      | \"timeout\"\n      | \"request_failed\",\n    message: string,\n  ) {\n    super(message);\n    this.name = \"AutomationConnectorError\";\n  }\n}\n\nexport interface AutomationRuntimeOptions {\n  readonly workflows: readonly AutomationWorkflowDefinition[];\n  /**\n   * Test-only transport injection. Production calls always use the framework\n   * SSRF-safe fetch path.\n   */\n  readonly fetch?: typeof fetch;\n  /**\n   * The caller receives the raw secret only inside this server-side callback.\n   * Return a value for a configured secret reference; never log or return it.\n   */\n  readonly resolveSecret?: (\n    secretRef: string,\n    context: { readonly userEmail?: string },\n  ) => Promise<string | null>;\n  /**\n   * Durable, SQL-backed idempotency claim. Return false for an already-seen\n   * event. It is required when callbacks trigger agent execution.\n   */\n  readonly claimInboundEvent?: (input: {\n    readonly workflow: AutomationWorkflowDefinition;\n    readonly eventId: string;\n  }) => Promise<boolean>;\n  /**\n   * Release a claim acquired by claimInboundEvent when durable enqueueing\n   * throws. It is required when callbacks trigger agent execution so a\n   * provider retry can claim the event again.\n   */\n  readonly releaseInboundEvent?: (input: {\n    readonly workflow: AutomationWorkflowDefinition;\n    readonly eventId: string;\n  }) => Promise<void>;\n  /**\n   * Persist and dispatch agent work using the app's established durable queue.\n   * This must be idempotent for the workflow/event ID pair because a transport\n   * failure can make enqueue success ambiguous. Do not run an agent loop in a\n   * callback request.\n   */\n  readonly enqueueInboundEvent?: (input: {\n    readonly workflow: AutomationWorkflowDefinition;\n    readonly eventId: string;\n    readonly payload: unknown;\n  }) => Promise<void>;\n}\n\nexport interface AutomationRuntime {\n  readonly listWorkflows: () => readonly AutomationWorkflowDefinition[];\n  readonly getWorkflow: (\n    workflowId: string,\n  ) => AutomationWorkflowDefinition | undefined;\n  readonly invoke: (\n    input: AutomationInvocation,\n  ) => Promise<AutomationInvocationResult>;\n  readonly receiveCallback: (\n    input: AutomationCallbackInput,\n  ) => Promise<AutomationCallbackResult>;\n}\n\nfunction byteLength(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\nfunction bytesToString(\n  chunks: readonly Uint8Array[],\n  byteCount: number,\n): string {\n  const bytes = new Uint8Array(byteCount);\n  let offset = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return new TextDecoder().decode(bytes);\n}\n\nfunction clampBytes(value: number | undefined, fallback: number): number {\n  if (!Number.isFinite(value)) return fallback;\n  return Math.max(1, Math.min(Math.floor(value!), 1024 * 1024));\n}\n\nfunction normalizeAttempts(value: number | undefined): number {\n  if (!Number.isFinite(value)) return DEFAULT_MAX_ATTEMPTS;\n  return Math.max(1, Math.min(Math.floor(value!), 3));\n}\n\nfunction redact(value: string, secretValues: readonly string[]): string {\n  return secretValues.reduce(\n    (result, secret) =>\n      secret ? result.split(secret).join(\"[REDACTED]\") : result,\n    value,\n  );\n}\n\nfunction redactUnknown(\n  value: unknown,\n  secretValues: readonly string[],\n): unknown {\n  if (typeof value === \"string\") return redact(value, secretValues);\n  if (Array.isArray(value)) {\n    return value.map((item) => redactUnknown(item, secretValues));\n  }\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, item]) => [\n        key,\n        redactUnknown(item, secretValues),\n      ]),\n    );\n  }\n  return value;\n}\n\nfunction responseTarget(url: URL): string {\n  return `${url.origin}${url.pathname}`;\n}\n\nfunction assertAllowedTarget(definition: AutomationOutboundDefinition): URL {\n  let base: URL;\n  let target: URL;\n  try {\n    base = new URL(definition.baseUrl);\n    target = new URL(definition.path, base);\n  } catch {\n    throw new AutomationConnectorError(\n      \"invalid_configuration\",\n      \"Workflow has an invalid configured base URL or path.\",\n    );\n  }\n  if (base.protocol !== \"https:\" || target.protocol !== \"https:\") {\n    throw new AutomationConnectorError(\n      \"blocked_target\",\n      \"Automation workflow targets must use HTTPS.\",\n    );\n  }\n  const allowedOrigins = new Set([\n    base.origin,\n    ...(definition.allowedOrigins ?? []),\n  ]);\n  if (!allowedOrigins.has(target.origin)) {\n    throw new AutomationConnectorError(\n      \"blocked_target\",\n      \"Workflow target is outside its configured allow-listed origin.\",\n    );\n  }\n  return target;\n}\n\nasync function resolveStaticHeaders(\n  headers: Readonly<Record<string, string>> | undefined,\n  userEmail: string,\n  resolveSecret: AutomationRuntimeOptions[\"resolveSecret\"],\n): Promise<{ headers: Record<string, string>; secretValues: string[] }> {\n  const output: Record<string, string> = {};\n  const secretValues: string[] = [];\n  for (const [name, value] of Object.entries(headers ?? {})) {\n    let resolved = value;\n    if (value.includes(\"${keys.\")) {\n      const result = await resolveKeyReferencesWithRequestScopes(\n        value,\n        userEmail,\n      );\n      resolved = result.resolved;\n      secretValues.push(...result.secretValues);\n    }\n    output[name] = resolved;\n  }\n\n  // A small app adapter may use named secret refs rather than the app vault\n  // syntax. Resolve those only from static header values, never from agent args.\n  if (resolveSecret) {\n    for (const [name, value] of Object.entries(output)) {\n      const match = value.match(/^\\$\\{automationSecret\\.([A-Za-z0-9_-]+)\\}$/);\n      if (!match) continue;\n      const secret = await resolveSecret(match[1], { userEmail });\n      if (!secret) {\n        throw new AutomationConnectorError(\n          \"invalid_configuration\",\n          `A configured credential is unavailable for header \"${name}\".`,\n        );\n      }\n      output[name] = secret;\n      secretValues.push(secret);\n    }\n  }\n  return { headers: output, secretValues };\n}\n\nasync function readBoundedResponse(\n  response: Response,\n  maxBytes: number,\n): Promise<{ value: unknown; truncated: boolean }> {\n  const reader = response.body?.getReader();\n  if (!reader) return { value: \"\", truncated: false };\n\n  const chunks: Uint8Array[] = [];\n  let byteCount = 0;\n  let truncated = false;\n  const declaredLength = Number(response.headers.get(\"content-length\"));\n  const declaredOversize =\n    Number.isFinite(declaredLength) && declaredLength > maxBytes;\n\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (value.byteLength === 0) continue;\n\n      const remaining = maxBytes - byteCount;\n      if (value.byteLength > remaining) {\n        if (remaining > 0) chunks.push(value.subarray(0, remaining));\n        byteCount += remaining;\n        truncated = true;\n        await reader.cancel().catch(() => {});\n        break;\n      }\n\n      chunks.push(value);\n      byteCount += value.byteLength;\n      if (byteCount === maxBytes && declaredOversize) {\n        truncated = true;\n        await reader.cancel().catch(() => {});\n        break;\n      }\n    }\n  } finally {\n    reader.releaseLock();\n  }\n\n  const bounded = bytesToString(chunks, byteCount);\n  try {\n    return { value: JSON.parse(bounded), truncated };\n  } catch {\n    return { value: bounded, truncated };\n  }\n}\n\nfunction payloadTooLarge(maxBytes: number): AutomationConnectorError {\n  return new AutomationConnectorError(\n    \"payload_too_large\",\n    `Callback exceeds the ${maxBytes}-byte limit.`,\n  );\n}\n\nasync function readBoundedRequestBody(\n  event: H3Event,\n  maxBytes: number,\n): Promise<string> {\n  const contentLength = getHeader(event, \"content-length\");\n  if (contentLength) {\n    const declared = Number(contentLength);\n    if (Number.isFinite(declared) && declared > maxBytes) {\n      throw payloadTooLarge(maxBytes);\n    }\n  }\n\n  const body = event.req.body;\n  if (!body) return \"\";\n\n  const reader = body.getReader();\n  const chunks: Uint8Array[] = [];\n  let byteCount = 0;\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (value.byteLength === 0) continue;\n      if (byteCount + value.byteLength > maxBytes) {\n        await reader.cancel().catch(() => {});\n        throw payloadTooLarge(maxBytes);\n      }\n      chunks.push(value);\n      byteCount += value.byteLength;\n    }\n  } finally {\n    reader.releaseLock();\n  }\n  return bytesToString(chunks, byteCount);\n}\n\nfunction shouldRetry(status: number): boolean {\n  return status === 408 || status === 429 || status >= 500;\n}\n\nfunction secureEqual(left: string, right: string): boolean {\n  const leftBuffer = Buffer.from(left);\n  const rightBuffer = Buffer.from(right);\n  return (\n    leftBuffer.length === rightBuffer.length &&\n    timingSafeEqual(leftBuffer, rightBuffer)\n  );\n}\n\nexport function createAutomationRuntime(\n  options: AutomationRuntimeOptions,\n): AutomationRuntime {\n  const workflows = new Map(\n    options.workflows.map((workflow) => [workflow.id, workflow]),\n  );\n\n  async function invoke(\n    invocation: AutomationInvocation,\n  ): Promise<AutomationInvocationResult> {\n    const workflow = workflows.get(invocation.workflowId);\n    if (!workflow) {\n      throw new AutomationConnectorError(\n        \"unknown_workflow\",\n        `Unknown automation workflow \"${invocation.workflowId}\".`,\n      );\n    }\n    if (!workflow.outbound || !workflow.capabilities.invokesExternalWorkflow) {\n      throw new AutomationConnectorError(\n        \"unsupported_direction\",\n        `Workflow \"${workflow.id}\" does not support outbound invocation.`,\n      );\n    }\n\n    const target = assertAllowedTarget(workflow.outbound);\n    const body = JSON.stringify(invocation.input);\n    const maxRequestBytes = clampBytes(\n      workflow.outbound.maxRequestBytes,\n      DEFAULT_MAX_REQUEST_BYTES,\n    );\n    if (byteLength(body) > maxRequestBytes) {\n      throw new AutomationConnectorError(\n        \"payload_too_large\",\n        `Automation input exceeds the ${maxRequestBytes}-byte limit.`,\n      );\n    }\n    if (\n      workflow.outbound.idempotencyHeader &&\n      workflow.capabilities.supportsIdempotency &&\n      !invocation.idempotencyKey\n    ) {\n      throw new AutomationConnectorError(\n        \"missing_idempotency\",\n        \"This workflow requires an idempotency key.\",\n      );\n    }\n\n    const { headers, secretValues } = await resolveStaticHeaders(\n      workflow.outbound.headers,\n      invocation.userEmail,\n      options.resolveSecret,\n    );\n    headers[\"content-type\"] ??= \"application/json\";\n    if (workflow.outbound.idempotencyHeader && invocation.idempotencyKey) {\n      headers[workflow.outbound.idempotencyHeader] = invocation.idempotencyKey;\n    }\n\n    const attempts = normalizeAttempts(workflow.outbound.retry?.maxAttempts);\n    const timeoutMs = Math.max(\n      1,\n      Math.min(workflow.outbound.timeoutMs ?? DEFAULT_TIMEOUT_MS, 30_000),\n    );\n    const maxResponseBytes = clampBytes(\n      workflow.outbound.maxResponseBytes,\n      DEFAULT_MAX_RESPONSE_BYTES,\n    );\n    let lastError: unknown;\n\n    for (let attempt = 1; attempt <= attempts; attempt++) {\n      const abort = new AbortController();\n      const timer = setTimeout(() => abort.abort(), timeoutMs);\n      try {\n        const request: RequestInit = {\n          method: workflow.outbound.method ?? \"POST\",\n          headers,\n          body,\n          signal: abort.signal,\n        };\n        const response = options.fetch\n          ? await options.fetch(target.href, { ...request, redirect: \"manual\" })\n          : await ssrfSafeFetch(target.href, request, {\n              httpsOnly: true,\n              maxRedirects: 0,\n            });\n        const parsed = await readBoundedResponse(response, maxResponseBytes);\n        if (\n          !response.ok &&\n          shouldRetry(response.status) &&\n          attempt < attempts\n        ) {\n          await new Promise((resolve) =>\n            setTimeout(resolve, workflow.outbound!.retry?.retryDelayMs ?? 250),\n          );\n          continue;\n        }\n        if (!response.ok) {\n          throw new AutomationConnectorError(\n            \"request_failed\",\n            `Workflow request to ${responseTarget(target)} failed with HTTP ${response.status}.`,\n          );\n        }\n        return {\n          workflowId: workflow.id,\n          connectorId: workflow.connectorId,\n          status:\n            workflow.response.mode === \"asynchronous\"\n              ? \"accepted\"\n              : \"completed\",\n          responseMode: workflow.response.mode,\n          attempts: attempt,\n          httpStatus: response.status,\n          output: redactUnknown(parsed.value, secretValues),\n          responseTruncated: parsed.truncated,\n        };\n      } catch (error) {\n        lastError = error;\n        if (abort.signal.aborted) {\n          lastError = new AutomationConnectorError(\n            \"timeout\",\n            `Workflow request to ${responseTarget(target)} timed out.`,\n          );\n        }\n        const retryable =\n          abort.signal.aborted ||\n          !(lastError instanceof AutomationConnectorError);\n        if (attempt < attempts && retryable) {\n          await new Promise((resolve) =>\n            setTimeout(resolve, workflow.outbound!.retry?.retryDelayMs ?? 250),\n          );\n          continue;\n        }\n        break;\n      } finally {\n        clearTimeout(timer);\n      }\n    }\n    if (lastError instanceof AutomationConnectorError) throw lastError;\n    throw new AutomationConnectorError(\n      \"request_failed\",\n      `Workflow request to ${responseTarget(target)} failed after ${attempts} attempts.`,\n    );\n  }\n\n  async function receiveCallback(\n    input: AutomationCallbackInput,\n  ): Promise<AutomationCallbackResult> {\n    const workflow = workflows.get(input.workflowId);\n    if (!workflow) {\n      throw new AutomationConnectorError(\n        \"unknown_workflow\",\n        \"Unknown automation callback.\",\n      );\n    }\n    if (!workflow.inbound || !workflow.capabilities.receivesCallback) {\n      throw new AutomationConnectorError(\n        \"unsupported_direction\",\n        \"This workflow does not accept callbacks.\",\n      );\n    }\n    const maxRequestBytes = clampBytes(\n      workflow.inbound.maxRequestBytes,\n      DEFAULT_MAX_REQUEST_BYTES,\n    );\n    if (byteLength(input.rawBody) > maxRequestBytes) {\n      throw new AutomationConnectorError(\n        \"payload_too_large\",\n        `Callback exceeds the ${maxRequestBytes}-byte limit.`,\n      );\n    }\n\n    const auth = workflow.inbound.authentication;\n    let authenticated = false;\n    if (auth.kind === \"provider-auth\") {\n      authenticated = await auth.verify({\n        rawBody: input.rawBody,\n        headers: input.headers,\n      });\n    } else {\n      const secret = await options.resolveSecret?.(auth.secretRef, {});\n      if (!secret) {\n        throw new AutomationConnectorError(\n          \"invalid_configuration\",\n          \"The configured automation callback credential is unavailable.\",\n        );\n      }\n      const supplied = input.headers.get(auth.header) ?? \"\";\n      const expected =\n        auth.kind === \"hmac-sha256\"\n          ? `${auth.prefix ?? \"sha256=\"}${createHmac(\"sha256\", secret).update(input.rawBody).digest(\"hex\")}`\n          : `${auth.prefix ?? \"\"}${secret}`;\n      authenticated = secureEqual(supplied, expected);\n    }\n    if (!authenticated) {\n      throw new AutomationConnectorError(\n        \"authentication_failed\",\n        \"Automation callback authentication failed.\",\n      );\n    }\n\n    const suppliedEventId = input.headers\n      .get(workflow.inbound.eventIdHeader ?? \"x-event-id\")\n      ?.trim();\n    let eventId: string;\n    if (workflow.inbound.triggersAgentExecution) {\n      if (\n        !options.claimInboundEvent ||\n        !options.releaseInboundEvent ||\n        !options.enqueueInboundEvent\n      ) {\n        throw new AutomationConnectorError(\n          \"invalid_configuration\",\n          \"Agent-triggering callbacks require durable claim, release, and queue handlers.\",\n        );\n      }\n      if (!suppliedEventId) {\n        throw new AutomationConnectorError(\n          \"missing_idempotency\",\n          \"Agent-triggering callbacks require a stable provider event ID.\",\n        );\n      }\n      eventId = suppliedEventId;\n      const claimed = await options.claimInboundEvent({ workflow, eventId });\n      if (!claimed) return { accepted: true, duplicate: true, eventId };\n      let payload: unknown = input.rawBody;\n      try {\n        payload = JSON.parse(input.rawBody);\n      } catch {\n        // A plain-text callback is permitted; the payload bound above still applies.\n      }\n      try {\n        await options.enqueueInboundEvent({ workflow, eventId, payload });\n      } catch (error) {\n        await options.releaseInboundEvent({ workflow, eventId });\n        throw error;\n      }\n    } else {\n      eventId =\n        suppliedEventId ??\n        createHmac(\"sha256\", workflow.id).update(input.rawBody).digest(\"hex\");\n    }\n    return { accepted: true, duplicate: false, eventId };\n  }\n\n  return {\n    listWorkflows: () => [...workflows.values()],\n    getWorkflow: (workflowId) => workflows.get(workflowId),\n    invoke,\n    receiveCallback,\n  };\n}\n\nconst invokeAutomationWorkflowSchema = z.object({\n  workflowId: z.string().min(1),\n  input: z.record(z.string(), z.unknown()),\n  idempotencyKey: z.string().min(8).max(256).optional(),\n});\n\n/**\n * Creates the narrow action applications expose to their agent and UI. The\n * workflow identity resolves to static server configuration; callers cannot\n * supply arbitrary target URLs or credentials.\n */\nexport function createInvokeAutomationWorkflowAction(\n  runtime: AutomationRuntime,\n  options: {\n    readonly description?: string;\n    readonly requireApproval?: boolean;\n  } = {},\n) {\n  return defineAction({\n    description:\n      options.description ??\n      \"Invoke a configured external automation workflow by its stable workflow ID. This cannot call arbitrary URLs and never exposes credentials.\",\n    schema: invokeAutomationWorkflowSchema,\n    http: false,\n    needsApproval: (args) =>\n      options.requireApproval ??\n      runtime.getWorkflow(args.workflowId)?.capabilities\n        .mayCauseExternalSideEffects !== false,\n    run: async (args) => {\n      const userEmail = getRequestUserEmail();\n      if (!userEmail)\n        throw new Error(\"You must be signed in to invoke a workflow.\");\n      return runtime.invoke({ ...args, userEmail });\n    },\n  });\n}\n\n/**\n * Builds a route-only H3 callback handler. Mount it at\n * `/_agent-native/automations/callback/:workflowId`; ordinary app operations\n * still use actions. The callback only authenticates, deduplicates, and\n * durably enqueues work before returning a quick acknowledgement.\n */\nexport function createAutomationCallbackHandler(runtime: AutomationRuntime) {\n  return async (event: H3Event) => {\n    const workflowId = getRouterParam(event, \"workflowId\");\n    if (!workflowId) {\n      setResponseStatus(event, 404);\n      return { error: \"Unknown automation workflow.\" };\n    }\n    try {\n      const workflow = runtime.getWorkflow(workflowId);\n      if (!workflow?.inbound || !workflow.capabilities.receivesCallback) {\n        throw new AutomationConnectorError(\n          workflow ? \"unsupported_direction\" : \"unknown_workflow\",\n          \"Unknown automation callback.\",\n        );\n      }\n      const maxRequestBytes = clampBytes(\n        workflow.inbound.maxRequestBytes,\n        DEFAULT_MAX_REQUEST_BYTES,\n      );\n      const rawBody = await readBoundedRequestBody(event, maxRequestBytes);\n      const result = await runtime.receiveCallback({\n        workflowId,\n        rawBody,\n        headers: new Headers(event.headers),\n      });\n      setResponseStatus(event, result.duplicate ? 200 : 202);\n      return {\n        accepted: true,\n        duplicate: result.duplicate,\n        eventId: result.eventId,\n      };\n    } catch (error) {\n      let status = 500;\n      if (error instanceof AutomationConnectorError) {\n        switch (error.code) {\n          case \"unknown_workflow\":\n          case \"unsupported_direction\":\n            status = 404;\n            break;\n          case \"authentication_failed\":\n            status = 401;\n            break;\n          case \"missing_idempotency\":\n            status = 400;\n            break;\n          case \"payload_too_large\":\n            status = 413;\n            break;\n        }\n      }\n      setResponseStatus(event, status);\n      return { error: \"Automation callback rejected.\" };\n    }\n  };\n}\n"]}

package/dist/cli/code-agent-connector.d.ts

@@ -1,3 +1,4 @@
+import type { RemoteComputerCapabilities } from "../integrations/remote-types.js";
 export interface RemoteCodeAgentDeviceConfig {
     token: string;
     relayUrl?: string;
@@ -11,7 +12,15 @@ export interface RunCodeAgentConnectorOptions {
     signal?: AbortSignal;
     once?: boolean;
 }
+export interface LocalComputerBridgeConfig {
+    url: string;
+    token: string;
+    capabilities: RemoteComputerCapabilities;
+}
 export declare function remoteDeviceConfigPath(): string;
 export declare function loadRemoteCodeAgentDeviceConfig(configPath?: string): RemoteCodeAgentDeviceConfig | null;
 export declare function runCodeAgentConnector(options?: RunCodeAgentConnectorOptions): Promise<number>;
+export declare function loadLocalComputerBridgeConfig(env?: NodeJS.ProcessEnv): LocalComputerBridgeConfig | null;
+export declare function callLocalComputerBridgeTool(config: LocalComputerBridgeConfig, toolName: "computer_operation" | "computer_revoke_control", args: Record<string, unknown>, fetchImpl?: typeof fetch): Promise<unknown>;
+export declare function dispatchComputerOperationToLocalBridge(config: LocalComputerBridgeConfig | null, rawEnvelope: unknown, fetchImpl?: typeof fetch): Promise<Record<string, unknown>>;
 //# sourceMappingURL=code-agent-connector.d.ts.map

package/dist/cli/code-agent-connector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-agent-connector.d.ts","sourceRoot":"","sources":["../../src/cli/code-agent-connector.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA6BD,wBAAgB,sBAAsB,IAAI,MAAM,CAK/C;AAED,wBAAgB,+BAA+B,CAC7C,UAAU,SAA2B,GACpC,2BAA2B,GAAG,IAAI,CA0BpC;AAED,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,MAAM,CAAC,CAmCjB"}
+{"version":3,"file":"code-agent-connector.d.ts","sourceRoot":"","sources":["../../src/cli/code-agent-connector.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,iCAAiC,CAAC;AAoBzC,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,0BAA0B,CAAC;CAC1C;AAgCD,wBAAgB,sBAAsB,IAAI,MAAM,CAK/C;AAED,wBAAgB,+BAA+B,CAC7C,UAAU,SAA2B,GACpC,2BAA2B,GAAG,IAAI,CA0BpC;AAED,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAutBD,wBAAgB,6BAA6B,CAC3C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,yBAAyB,GAAG,IAAI,CA0BlC;AAED,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,yBAAyB,EACjC,QAAQ,EAAE,oBAAoB,GAAG,yBAAyB,EAC1D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,OAAO,CAAC,CA+BlB;AAED,wBAAsB,sCAAsC,CAC1D,MAAM,EAAE,yBAAyB,GAAG,IAAI,EACxC,WAAW,EAAE,OAAO,EACpB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAqBlC"}