@antseed/cli 0.1.179 → 0.1.181

package/dist/gateway/chat/tools.js

@@ -0,0 +1,347 @@
+/**
+ * Tools the console chat's agent runs on the gateway host.
+ *
+ *   web_fetch, web_search   every console member
+ *   list/read/write_file    a per-chat scratch directory under the gateway's data dir
+ *   run_command             org admins only: a shell in that directory, one approved command at a time
+ *
+ * The scratch directory confines the file tools, not the shell: a command
+ * runs as the gateway's own OS user, with its permissions. That is why the
+ * shell is for organization admins, who can run the gateway CLI anyway, and
+ * why no command runs without the admin's approval of that exact call: the
+ * model's output comes from a network seller (and from any page web_fetch
+ * reads), so it must never be able to start a command on its own.
+ */
+import { spawn } from 'node:child_process';
+import { lookup } from 'node:dns/promises';
+import { mkdir, readdir, readFile, realpath, stat, writeFile } from 'node:fs/promises';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { BlockList, isIP } from 'node:net';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { Readable } from 'node:stream';
+import { tool } from 'ai';
+import { z } from 'zod';
+const FETCH_TIMEOUT_MS = 15_000;
+const MAX_FETCH_BYTES = 2 * 1024 * 1024;
+const MAX_TOOL_TEXT = 20_000;
+const MAX_REDIRECTS = 5;
+const COMMAND_TIMEOUT_MS = 60_000;
+const MAX_COMMAND_OUTPUT = 20_000;
+const MAX_FILE_BYTES = 1024 * 1024;
+const USER_AGENT = 'Mozilla/5.0 (compatible; AntseedGatewayChat/1.0)';
+/** The tool that runs only after the user approves the exact call. */
+export const SHELL_TOOL = 'run_command';
+export function chatTools(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const fetchPageImpl = options.fetchImpl ? (url, _addresses, init) => fetchImpl(url, init) : fetchPinned;
+    const resolveHost = options.resolveHost ?? (async (host) => (await lookup(host, { all: true })).map((entry) => entry.address));
+    const tools = {
+        web_fetch: tool({
+            description: 'Fetch a public web page (http or https) and return its readable text. Use it to read pages found with web_search or given by the user.',
+            inputSchema: z.object({ url: z.string().describe('Absolute http(s) URL') }),
+            execute: async ({ url }) => fetchPage(url, fetchPageImpl, resolveHost),
+        }),
+        web_search: tool({
+            description: 'Search the web. Returns titles, URLs and snippets; read a result with web_fetch.',
+            inputSchema: z.object({ query: z.string().min(1), limit: z.number().int().min(1).max(10).optional() }),
+            execute: async ({ query, limit }) => searchWeb(query, limit ?? 6, options.braveApiKey ?? null, fetchImpl),
+        }),
+        list_files: tool({
+            description: 'List files in the chat\'s scratch directory (or a subdirectory of it).',
+            inputSchema: z.object({ path: z.string().optional().describe('Directory relative to the scratch directory; defaults to its root') }),
+            execute: async ({ path }) => listFiles(options.sandboxDir, path ?? '.'),
+        }),
+        read_file: tool({
+            description: 'Read a text file from the chat\'s scratch directory.',
+            inputSchema: z.object({ path: z.string() }),
+            execute: async ({ path }) => readSandboxFile(options.sandboxDir, path),
+        }),
+        write_file: tool({
+            description: 'Create or overwrite a text file in the chat\'s scratch directory.',
+            inputSchema: z.object({ path: z.string(), content: z.string() }),
+            execute: async ({ path, content }) => writeSandboxFile(options.sandboxDir, path, content),
+        }),
+    };
+    if (options.allowShell) {
+        tools[SHELL_TOOL] = tool({
+            description: `Run a shell command in the chat's scratch directory on the gateway host (/bin/sh, ${COMMAND_TIMEOUT_MS / 1000} s timeout). Returns exit code, stdout and stderr. The user approves each command before it runs; if they deny one, do not retry it.`,
+            inputSchema: z.object({ command: z.string().min(1) }),
+            execute: async ({ command }, { toolCallId }) => {
+                if (!options.approvedCommandCalls?.has(toolCallId))
+                    throw new Error('This command was not approved by the user, so it did not run.');
+                return runCommand(options.sandboxDir, command);
+            },
+        });
+    }
+    return tools;
+}
+// ── Web ─────────────────────────────────────────────────────────────────
+const PRIVATE_IPV4 = [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16],
+    ['172.16.0.0', 12], ['192.168.0.0', 16], ['198.18.0.0', 15], ['224.0.0.0', 3],
+];
+// Unspecified, loopback and IPv4-compatible; local-use NAT64; unique-local; link-local; site-local; multicast.
+const PRIVATE_IPV6 = [
+    ['::', 96], ['64:ff9b:1::', 48], ['fc00::', 7], ['fe80::', 10], ['fec0::', 10], ['ff00::', 8],
+];
+/**
+ * Loopback, private, link-local, CGNAT and other non-public ranges: never fetched (the buyer and gateway listen on loopback).
+ * A BlockList matches the IPv4 ranges in their IPv4-mapped IPv6 forms too (WHATWG URL writes
+ * `[::ffff:127.0.0.1]` as `[::ffff:7f00:1]`); their NAT64 (`64:ff9b::/96`) forms are added explicitly.
+ */
+const PRIVATE_ADDRESSES = (() => {
+    const list = new BlockList();
+    for (const [network, prefix] of PRIVATE_IPV4) {
+        list.addSubnet(network, prefix, 'ipv4');
+        list.addSubnet(`64:ff9b::${network}`, 96 + prefix, 'ipv6');
+    }
+    for (const [network, prefix] of PRIVATE_IPV6)
+        list.addSubnet(network, prefix, 'ipv6');
+    return list;
+})();
+export function isPrivateAddress(address) {
+    const version = isIP(address);
+    if (version === 0)
+        return true;
+    return PRIVATE_ADDRESSES.check(address, version === 4 ? 'ipv4' : 'ipv6');
+}
+async function assertPublicUrl(raw, resolveHost) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`Not a valid URL: ${raw}`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        throw new Error('Only http and https URLs can be fetched.');
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    const addresses = isIP(host) ? [host] : await resolveHost(host).catch(() => []);
+    if (addresses.length === 0)
+        throw new Error(`Could not resolve ${host}.`);
+    if (addresses.some(isPrivateAddress))
+        throw new Error(`${host} is a private or local address; only public web pages can be fetched.`);
+    return { url, addresses };
+}
+async function fetchPage(raw, fetchPinnedImpl, resolveHost) {
+    let { url, addresses } = await assertPublicUrl(raw, resolveHost);
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
+        // Connect to the addresses just checked: re-resolving the host could answer with a private one (DNS rebinding).
+        const response = await fetchPinnedImpl(url, addresses, {
+            redirect: 'manual',
+            headers: { 'user-agent': USER_AGENT, accept: 'text/html,text/plain,application/json;q=0.9,*/*;q=0.5' },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        const location = response.headers.get('location');
+        if (response.status >= 300 && response.status < 400 && location) {
+            // Every hop is checked again: a public page must not redirect into the gateway's network.
+            ;
+            ({ url, addresses } = await assertPublicUrl(new URL(location, url).toString(), resolveHost));
+            continue;
+        }
+        const type = response.headers.get('content-type') ?? '';
+        const body = await readCapped(response, MAX_FETCH_BYTES);
+        const text = /html/i.test(type) ? htmlToText(body) : body;
+        return { url: url.toString(), status: response.status, contentType: type, text: truncate(text, MAX_TOOL_TEXT) };
+    }
+    throw new Error(`Too many redirects from ${raw}.`);
+}
+/** node:http(s) GET whose DNS lookup answers with `addresses`; TLS still verifies the certificate for the URL's host name. */
+export function fetchPinned(url, addresses, init) {
+    const pinned = addresses.map((address) => ({ address, family: isIP(address) }));
+    const lookup = (_host, options, callback) => {
+        if (options.all)
+            callback(null, pinned);
+        else
+            callback(null, pinned[0].address, pinned[0].family);
+    };
+    const request = url.protocol === 'https:' ? httpsRequest : httpRequest;
+    const headers = init.headers;
+    return new Promise((resolvePromise, reject) => {
+        const req = request(url, { method: 'GET', headers, lookup, signal: init.signal ?? undefined }, (res) => {
+            const responseHeaders = new Headers();
+            for (const [name, value] of Object.entries(res.headers)) {
+                for (const item of Array.isArray(value) ? value : [value ?? ''])
+                    responseHeaders.append(name, item);
+            }
+            const status = res.statusCode ?? 502;
+            let body = null;
+            if (status === 204 || status === 205 || status === 304)
+                res.resume();
+            else
+                body = Readable.toWeb(res);
+            resolvePromise(new Response(body, { status, statusText: res.statusMessage, headers: responseHeaders }));
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+async function readCapped(response, maxBytes) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        return '';
+    const chunks = [];
+    let size = 0;
+    while (size < maxBytes) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        chunks.push(value);
+        size += value.length;
+    }
+    await reader.cancel().catch(() => undefined);
+    return new TextDecoder().decode(Buffer.concat(chunks).subarray(0, maxBytes));
+}
+const ENTITIES = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ' };
+/** Readable text from HTML: drops scripts, styles and markup, keeps line structure. */
+export function htmlToText(html) {
+    return html
+        .replace(/<(script|style|noscript|svg|template)[\s\S]*?<\/\1>/gi, ' ')
+        .replace(/<!--[\s\S]*?-->/g, ' ')
+        .replace(/<(br|\/p|\/div|\/li|\/h[1-6]|\/tr|\/section|\/article)\b[^>]*>/gi, '\n')
+        .replace(/<li\b[^>]*>/gi, '\n- ')
+        .replace(/<[^>]+>/g, ' ')
+        .replace(/&(#\d+|#x[0-9a-f]+|[a-z]+);/gi, (match, code) => {
+        if (code[0] === '#')
+            return String.fromCodePoint(code[1]?.toLowerCase() === 'x' ? parseInt(code.slice(2), 16) : parseInt(code.slice(1), 10));
+        return ENTITIES[code.toLowerCase()] ?? match;
+    })
+        .replace(/[ \t\f\r]+/g, ' ')
+        .replace(/ *\n */g, '\n')
+        .replace(/\n{3,}/g, '\n\n')
+        .trim();
+}
+async function searchWeb(query, limit, braveApiKey, fetchImpl) {
+    if (braveApiKey) {
+        const response = await fetchImpl(`https://api.search.brave.com/res/v1/web/search?q=${encodeURIComponent(query)}&count=${limit}`, {
+            headers: { accept: 'application/json', 'x-subscription-token': braveApiKey },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            throw new Error(`Brave Search answered ${response.status}.`);
+        const body = await response.json();
+        return { results: (body.web?.results ?? []).slice(0, limit).map((row) => ({ title: htmlToText(row.title ?? ''), url: row.url ?? '', snippet: htmlToText(row.description ?? '') })) };
+    }
+    const response = await fetchImpl(`https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`, {
+        headers: { 'user-agent': USER_AGENT, accept: 'text/html' },
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!response.ok)
+        throw new Error(`The search engine answered ${response.status}.`);
+    return { results: parseDuckDuckGo(await readCapped(response, MAX_FETCH_BYTES)).slice(0, limit) };
+}
+/** Results from DuckDuckGo's no-JavaScript HTML page. */
+export function parseDuckDuckGo(html) {
+    const results = [];
+    const blocks = html.split(/class="result results_links/).slice(1);
+    for (const block of blocks) {
+        const link = /class="result__a"[^>]*href="([^"]+)"[^>]*>([\s\S]*?)<\/a>/.exec(block);
+        if (!link)
+            continue;
+        let url = link[1].replace(/&amp;/g, '&');
+        const redirect = /[?&]uddg=([^&]+)/.exec(url);
+        if (redirect)
+            url = decodeURIComponent(redirect[1]);
+        if (url.startsWith('//'))
+            url = `https:${url}`;
+        const snippet = /class="result__snippet"[^>]*>([\s\S]*?)<\/a>/.exec(block);
+        results.push({ title: htmlToText(link[2]), url, snippet: snippet ? htmlToText(snippet[1]) : '' });
+    }
+    return results;
+}
+// ── Scratch directory ───────────────────────────────────────────────────
+/** A path inside the scratch directory; refuses `..`, absolute paths and symlinks that lead out. */
+async function sandboxPath(root, path) {
+    await mkdir(root, { recursive: true });
+    const realRoot = await realpath(root);
+    const target = resolve(realRoot, path);
+    const inside = (candidate) => candidate === realRoot || candidate.startsWith(realRoot + sep);
+    if (!inside(target))
+        throw new Error('Paths must stay inside the chat\'s scratch directory.');
+    // The deepest existing ancestor must also resolve inside (no symlink escapes).
+    let probe = target;
+    for (;;) {
+        try {
+            if (!inside(await realpath(probe)))
+                throw new Error('Paths must stay inside the chat\'s scratch directory.');
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const parent = dirname(probe);
+            if (parent === probe)
+                break;
+            probe = parent;
+        }
+    }
+    return target;
+}
+async function listFiles(root, path) {
+    const dir = await sandboxPath(root, path);
+    const entries = await readdir(dir, { withFileTypes: true }).catch((error) => {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    });
+    const rows = await Promise.all(entries.slice(0, 500).map(async (entry) => {
+        const full = join(dir, entry.name);
+        const info = await stat(full).catch(() => null);
+        return { path: relative(await realpath(root), full) || '.', type: entry.isDirectory() ? 'directory' : 'file', size: info?.size ?? 0 };
+    }));
+    return { files: rows };
+}
+async function readSandboxFile(root, path) {
+    const file = await sandboxPath(root, path);
+    const info = await stat(file);
+    if (!info.isFile())
+        throw new Error(`${path} is not a file.`);
+    const content = await readFile(file, 'utf8');
+    return { path, size: info.size, content: truncate(content, MAX_TOOL_TEXT) };
+}
+async function writeSandboxFile(root, path, content) {
+    if (Buffer.byteLength(content) > MAX_FILE_BYTES)
+        throw new Error(`Files are limited to ${MAX_FILE_BYTES / 1024} KiB.`);
+    const file = await sandboxPath(root, path);
+    await mkdir(dirname(file), { recursive: true });
+    await writeFile(file, content, 'utf8');
+    return { path, bytes: Buffer.byteLength(content) };
+}
+function runCommand(root, command) {
+    return mkdir(root, { recursive: true }).then(() => new Promise((done) => {
+        const child = spawn('/bin/sh', ['-c', command], {
+            cwd: root,
+            detached: true,
+            // A minimal environment: the gateway's own secrets (keys, tokens) stay out of reach of `env`.
+            env: { PATH: process.env['PATH'] ?? '/usr/bin:/bin', HOME: root, LANG: process.env['LANG'] ?? 'C.UTF-8', TERM: 'dumb' },
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        let timedOut = false;
+        child.stdout.on('data', (chunk) => { if (stdout.length < MAX_COMMAND_OUTPUT)
+            stdout += chunk.toString('utf8'); });
+        child.stderr.on('data', (chunk) => { if (stderr.length < MAX_COMMAND_OUTPUT)
+            stderr += chunk.toString('utf8'); });
+        const timer = setTimeout(() => {
+            timedOut = true;
+            try {
+                process.kill(-child.pid, 'SIGKILL');
+            }
+            catch {
+                child.kill('SIGKILL');
+            }
+        }, COMMAND_TIMEOUT_MS);
+        const finish = (exitCode) => {
+            clearTimeout(timer);
+            done({ exitCode, timedOut, stdout: truncate(stdout, MAX_COMMAND_OUTPUT), stderr: truncate(stderr, MAX_COMMAND_OUTPUT) });
+        };
+        child.once('error', (error) => { stderr += error.message; finish(null); });
+        child.once('close', (code) => finish(code));
+    }));
+}
+function truncate(text, max) {
+    return text.length > max ? `${text.slice(0, max)}\n… [truncated ${text.length - max} characters]` : text;
+}
+//# sourceMappingURL=tools.js.map

package/dist/gateway/chat/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/gateway/chat/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAuB,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,IAAI,EAAgB,MAAM,IAAI,CAAA;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAC/B,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACvC,MAAM,aAAa,GAAG,MAAM,CAAA;AAC5B,MAAM,aAAa,GAAG,CAAC,CAAA;AACvB,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAA;AAClC,MAAM,UAAU,GAAG,kDAAkD,CAAA;AACrE,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAA;AAoBvC,MAAM,UAAU,SAAS,CAAC,OAAwB;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,aAAa,GAAgB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;IACpH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IACtI,MAAM,KAAK,GAAY;QACrB,SAAS,EAAE,IAAI,CAAC;YACd,WAAW,EAAE,wIAAwI;YACrJ,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,CAAC;SACvE,CAAC;QACF,UAAU,EAAE,IAAI,CAAC;YACf,WAAW,EAAE,kFAAkF;YAC/F,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACtG,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,SAAS,CAAC;SAC1G,CAAC;QACF,UAAU,EAAE,IAAI,CAAC;YACf,WAAW,EAAE,wEAAwE;YACrF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC,EAAE,CAAC;YACpI,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,IAAI,GAAG,CAAC;SACxE,CAAC;QACF,SAAS,EAAE,IAAI,CAAC;YACd,WAAW,EAAE,sDAAsD;YACnE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC;SACvE,CAAC;QACF,UAAU,EAAE,IAAI,CAAC;YACf,WAAW,EAAE,mEAAmE;YAChF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAChE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC;SAC1F,CAAC;KACH,CAAA;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;YACvB,WAAW,EAAE,qFAAqF,kBAAkB,GAAG,IAAI,sIAAsI;YACjQ,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;gBAC7C,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,UAAU,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;gBACpI,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YAChD,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2EAA2E;AAE3E,MAAM,YAAY,GAAoC;IACpD,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC;IAC1F,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;CAC9E,CAAA;AACD,+GAA+G;AAC/G,MAAM,YAAY,GAAoC;IACpD,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;CAC9F,CAAA;AAED;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE;IAC9B,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAA;IAC5B,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,SAAS,CAAC,YAAY,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5D,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,YAAY;QAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IACrF,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,EAAE,CAAA;AAEJ,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAC7B,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9B,OAAO,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAC1E,CAAC;AAMD,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,WAAyB;IACnE,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAA;IAAC,CAAC;IAC/E,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IACtH,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAA;IACzE,IAAI,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uEAAuE,CAAC,CAAA;IACrI,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;AAC3B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,eAA4B,EAAE,WAAyB;IAC3F,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAChE,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACjD,gHAAgH;QAChH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE;YACrD,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,uDAAuD,EAAE;YACtG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;YAChE,0FAA0F;YAC1F,CAAC;YAAA,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC,CAAA;YAC7F,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;QACvD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACzD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAA;IACjH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,GAAG,CAAC,CAAA;AACpD,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,WAAW,CAAC,GAAQ,EAAE,SAAmB,EAAE,IAAiB;IAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/E,MAAM,MAAM,GAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC1D,IAAI,OAAO,CAAC,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;;YAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAA;IAC5D,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6C,CAAA;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACrG,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAA;YACrC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACrG,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAA;YACpC,IAAI,IAAI,GAAsC,IAAI,CAAA;YAClD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;gBAAE,GAAG,CAAC,MAAM,EAAE,CAAA;;gBAC/D,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAA;YAC7D,cAAc,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;QACzG,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,QAAgB;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,OAAO,IAAI,GAAG,QAAQ,EAAE,CAAC;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;IACtB,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC5C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,QAAQ,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AAExG,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI;SACR,OAAO,CAAC,uDAAuD,EAAE,GAAG,CAAC;SACrE,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,OAAO,CAAC,kEAAkE,EAAE,IAAI,CAAC;SACjF,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;SAChC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,+BAA+B,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAChE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QAC5I,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAA;IAC9C,CAAC,CAAC;SACD,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAA;AACX,CAAC;AAID,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa,EAAE,WAA0B,EAAE,SAAuB;IACxG,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,oDAAoD,kBAAkB,CAAC,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE;YAC/H,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,WAAW,EAAE;YAC5E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;QAC9E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA2F,CAAA;QAC3H,OAAO,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;IACtL,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,uCAAuC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;QACnG,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE;QAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;KAC9C,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACnF,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAA;AAClG,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,OAAO,GAAmB,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpF,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QACzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,QAAQ;YAAE,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAA;QACpD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,GAAG,GAAG,SAAS,GAAG,EAAE,CAAA;QAC9C,MAAM,OAAO,GAAG,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACrG,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,2EAA2E;AAE3E,oGAAoG;AACpG,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACnD,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAA;IACpG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC7F,+EAA+E;IAC/E,IAAI,KAAK,GAAG,MAAM,CAAA;IAClB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;YAC5G,MAAK;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAA;YACnE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,MAAM,KAAK,KAAK;gBAAE,MAAK;YAC3B,KAAK,GAAG,MAAM,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;QACjG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAA;QACtC,MAAM,KAAK,CAAA;IACb,CAAC,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC/C,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAA;IACvI,CAAC,CAAC,CAAC,CAAA;IACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACvD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAA;AAC7E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe;IACzE,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,cAAc,GAAG,IAAI,OAAO,CAAC,CAAA;IACtH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,OAAe;IAC/C,OAAO,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;YAC9C,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,IAAI;YACd,8FAA8F;YAC9F,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE;YACvH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAA;QACF,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACxH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACxH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAA;YACf,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAI,EAAE,SAAS,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAAC,CAAC;QAC9E,CAAC,EAAE,kBAAkB,CAAC,CAAA;QACtB,MAAM,MAAM,GAAG,CAAC,QAAuB,EAAE,EAAE;YACzC,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAA;QAC1H,CAAC,CAAA;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACzE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAC,CAAA;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW;IACzC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB,IAAI,CAAC,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1G,CAAC"}

package/dist/gateway/chat/tools.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tools.test.d.ts.map

package/dist/gateway/chat/tools.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.test.d.ts","sourceRoot":"","sources":["../../../src/gateway/chat/tools.test.ts"],"names":[],"mappings":""}

package/dist/gateway/chat/tools.test.js

@@ -0,0 +1,136 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, rm, stat, symlink, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { after, test } from 'node:test';
+import { chatTools, fetchPinned, htmlToText, isPrivateAddress, parseDuckDuckGo } from './tools.js';
+import { mapChatModels } from './routes.js';
+const dirs = [];
+after(async () => { await Promise.all(dirs.map((dir) => rm(dir, { recursive: true, force: true }))); });
+async function sandbox() {
+    const dir = await mkdtemp(join(tmpdir(), 'gc-chat-'));
+    dirs.push(dir);
+    return dir;
+}
+/** Runs one tool's execute like the AI SDK would. */
+async function run(tools, name, input) {
+    const execute = tools[name]?.execute;
+    assert.ok(execute, `tool ${name} exists`);
+    return execute(input, { toolCallId: 't', messages: [] });
+}
+test('private and local addresses are never fetched', () => {
+    for (const address of [
+        '127.0.0.1', '10.1.2.3', '172.16.0.1', '192.168.1.1', '169.254.169.254', '100.64.0.1', '0.0.0.0', '::', '::1', 'fd00::1', 'fe80::1',
+        // IPv4-mapped (dotted and the hex form WHATWG URL produces), IPv4-compatible and NAT64 forms of private IPv4.
+        '::ffff:127.0.0.1', '::ffff:7f00:1', '::ffff:a00:1', '0:0:0:0:0:ffff:a9fe:a9fe', '::7f00:1', '64:ff9b::7f00:1', '64:ff9b::a9fe:a9fe', '64:ff9b:1::1',
+    ]) {
+        assert.equal(isPrivateAddress(address), true, address);
+    }
+    for (const address of ['93.184.216.34', '1.1.1.1', '2606:4700:4700::1111', '::ffff:808:808', '64:ff9b::808:808'])
+        assert.equal(isPrivateAddress(address), false, address);
+});
+test('web_fetch refuses IPv6 literals that embed a private IPv4 address', async () => {
+    const fetchImpl = (async () => new Response('reached'));
+    const tools = chatTools({ sandboxDir: await sandbox(), allowShell: false, fetchImpl, resolveHost: async () => ['93.184.216.34'] });
+    for (const url of ['http://[::ffff:127.0.0.1]:8377/', 'http://[::ffff:7f00:1]/', 'http://[::ffff:a00:1]/', 'http://[64:ff9b::127.0.0.1]/']) {
+        await assert.rejects(run(tools, 'web_fetch', { url }), /private or local/, url);
+    }
+});
+test('the pinned fetch connects to the checked address, never re-resolving the host', async () => {
+    const server = createServer((req, res) => res.end(`host=${req.headers.host}`));
+    await new Promise((resolveListen) => server.listen(0, '127.0.0.1', resolveListen));
+    try {
+        const { port } = server.address();
+        // `.invalid` never resolves in DNS, so a response proves the connection used the pinned address.
+        const response = await fetchPinned(new URL(`http://pinned.invalid:${port}/`), ['127.0.0.1'], { headers: { accept: 'text/plain' } });
+        assert.equal(response.status, 200);
+        assert.equal(await response.text(), `host=pinned.invalid:${port}`);
+    }
+    finally {
+        server.close();
+    }
+});
+test('web_fetch refuses local targets, including a public page that redirects to one', async () => {
+    const fetchImpl = (async (url) => {
+        if (String(url).startsWith('https://public.example/'))
+            return new Response('', { status: 302, headers: { location: 'http://127.0.0.1:8377/_antseed/channels' } });
+        return new Response('nope');
+    });
+    const tools = chatTools({ sandboxDir: await sandbox(), allowShell: false, fetchImpl, resolveHost: async (host) => (host === 'public.example' ? ['93.184.216.34'] : ['127.0.0.1']) });
+    await assert.rejects(run(tools, 'web_fetch', { url: 'http://localhost:8377/' }), /private or local/);
+    await assert.rejects(run(tools, 'web_fetch', { url: 'https://public.example/' }), /private or local/);
+    await assert.rejects(run(tools, 'web_fetch', { url: 'file:///etc/passwd' }), /Only http and https/);
+});
+test('web_fetch returns readable text from HTML', async () => {
+    const fetchImpl = (async () => new Response('<html><head><style>x{}</style><script>alert(1)</script></head><body><h1>Title</h1><p>One &amp; two</p><ul><li>a</li><li>b</li></ul></body></html>', { headers: { 'content-type': 'text/html' } }));
+    const tools = chatTools({ sandboxDir: await sandbox(), allowShell: false, fetchImpl, resolveHost: async () => ['93.184.216.34'] });
+    const page = await run(tools, 'web_fetch', { url: 'https://public.example/' });
+    assert.equal(page.status, 200);
+    assert.match(page.text, /Title\nOne & two/);
+    assert.doesNotMatch(page.text, /alert|x\{\}/);
+    assert.equal(htmlToText('<p>a&#39;b&#x41;</p>'), "a'bA");
+});
+test('DuckDuckGo results are parsed and their redirect links unwrapped', () => {
+    const html = '<div class="result results_links results_links_deep web-result"><a rel="nofollow" class="result__a" href="//duckduckgo.com/l/?uddg=https%3A%2F%2Fantseed.com%2F&amp;rut=x">Antseed <b>home</b></a><a class="result__snippet" href="#">Open market for <b>AI</b></a></div>';
+    assert.deepEqual(parseDuckDuckGo(html), [{ title: 'Antseed home', url: 'https://antseed.com/', snippet: 'Open market for AI' }]);
+});
+test('file tools stay inside the chat scratch directory', async () => {
+    const root = await sandbox();
+    const outside = await sandbox();
+    await writeFile(join(outside, 'secret.txt'), 'top secret');
+    const tools = chatTools({ sandboxDir: join(root, 'chat'), allowShell: false });
+    assert.deepEqual(await run(tools, 'write_file', { path: 'notes/a.md', content: 'hello' }), { path: 'notes/a.md', bytes: 5 });
+    assert.equal((await run(tools, 'read_file', { path: 'notes/a.md' })).content, 'hello');
+    assert.deepEqual((await run(tools, 'list_files', {})).files.map((f) => f.path), ['notes']);
+    await assert.rejects(run(tools, 'read_file', { path: '../../etc/passwd' }), /inside the chat/);
+    await assert.rejects(run(tools, 'write_file', { path: '/tmp/x', content: 'x' }), /inside the chat/);
+    // A symlink planted inside cannot be used to reach out.
+    await mkdir(join(root, 'chat'), { recursive: true });
+    await symlink(outside, join(root, 'chat', 'link'));
+    await assert.rejects(run(tools, 'read_file', { path: 'link/secret.txt' }), /inside the chat/);
+});
+test('the shell is offered only when allowed, runs in the scratch directory without the gateway environment', async () => {
+    const root = await sandbox();
+    assert.equal(chatTools({ sandboxDir: root, allowShell: false })['run_command'], undefined);
+    process.env['ANTSEED_TEST_SECRET'] = 'leak';
+    try {
+        const tools = chatTools({ sandboxDir: root, allowShell: true, approvedCommandCalls: new Set(['t']) });
+        const result = await run(tools, 'run_command', { command: 'pwd; echo "s=${ANTSEED_TEST_SECRET:-none}"; exit 3' });
+        assert.equal(result.exitCode, 3);
+        assert.match(result.stdout, /s=none/);
+        assert.ok(result.stdout.includes(root.split('/').pop()));
+    }
+    finally {
+        delete process.env['ANTSEED_TEST_SECRET'];
+    }
+});
+test('the shell refuses a call the user did not approve', async () => {
+    const root = await sandbox();
+    for (const approvedCommandCalls of [undefined, new Set(), new Set(['another-call'])]) {
+        const tools = chatTools({ sandboxDir: root, allowShell: true, ...(approvedCommandCalls ? { approvedCommandCalls } : {}) });
+        await assert.rejects(run(tools, 'run_command', { command: 'touch ran' }), /not approved/);
+    }
+    await assert.rejects(stat(join(root, 'ran')), /ENOENT/);
+});
+test('chat models: text only, tool-capable first, cheapest offer and peers by reputation', () => {
+    const models = mapChatModels({
+        data: [
+            { id: 'img', type: 'image', peers: [] },
+            { id: 'plain', name: 'Plain', type: 'text', capability_coverage: { tool_use: 0 }, peers: [{ peerId: 'AA', inputUsdPerMillion: 0.1, outputUsdPerMillion: 0.2 }] },
+            {
+                id: 'agent', name: 'Agent', type: 'text', capability_coverage: { tool_use: 2, reasoning: 1 },
+                peers: [
+                    { peerId: 'BB', displayName: ' Beta ', inputUsdPerMillion: 2, outputUsdPerMillion: 4, effectiveReputationScore: 50, capabilities: { toolUse: true } },
+                    { peerId: 'CC', inputUsdPerMillion: 1, outputUsdPerMillion: 5, reputationScore: 90, capabilities: { toolUse: false } },
+                ],
+            },
+        ],
+    });
+    assert.deepEqual(models.map((m) => m.id), ['agent', 'plain']);
+    assert.equal(models[0].inputUsdPerMillion, 1);
+    assert.equal(models[0].outputUsdPerMillion, 4);
+    assert.deepEqual(models[0].peers.map((p) => [p.peerId, p.name, p.toolUse]), [['cc', null, false], ['bb', 'Beta', true]]);
+    assert.equal(models[1].toolUse, false);
+});
+//# sourceMappingURL=tools.test.js.map

package/dist/gateway/chat/tools.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.test.js","sourceRoot":"","sources":["../../../src/gateway/chat/tools.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,IAAI,GAAa,EAAE,CAAA;AACzB,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;AAEtG,KAAK,UAAU,OAAO;IACpB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAA;IACrD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACd,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,qDAAqD;AACrD,KAAK,UAAU,GAAG,CAAC,KAAmC,EAAE,IAAY,EAAE,KAAc;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACpC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,IAAI,SAAS,CAAC,CAAA;IACzC,OAAO,OAAO,CAAC,KAAc,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAW,CAAC,CAAA;AAC5E,CAAC;AAED,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;IACzD,KAAK,MAAM,OAAO,IAAI;QACpB,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;QACnI,8GAA8G;QAC9G,kBAAkB,EAAE,eAAe,EAAE,cAAc,EAAE,0BAA0B,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,cAAc;KACrJ,EAAE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACxD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;AAC3K,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAiB,CAAA;IACvE,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;IAClI,KAAK,MAAM,GAAG,IAAI,CAAC,iCAAiC,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,8BAA8B,CAAC,EAAE,CAAC;QAC3I,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAA;IACjF,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC/F,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAC9E,MAAM,IAAI,OAAO,CAAO,CAAC,aAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAA;IACxF,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAA;QAChD,iGAAiG;QACjG,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QACnI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,uBAAuB,IAAI,EAAE,CAAC,CAAA;IACpE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAiB,EAAE,EAAE;QAC7C,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC;YAAE,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,yCAAyC,EAAE,EAAE,CAAC,CAAA;QACjK,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC,CAAiB,CAAA;IAClB,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAA;IACpL,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAA;IACpG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAA;IACrG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAA;AACrG,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,mJAAmJ,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,CAAC,CAAiB,CAAA;IAC/P,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;IAClI,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAC9E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;IAC3C,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAA;AAC1D,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,IAAI,GAAG,2QAA2Q,CAAA;IACxR,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,sBAAsB,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;AAClI,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAA;IAC/B,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9E,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5H,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACtF,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5G,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAA;IAC9F,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAA;IACnG,wDAAwD;IACxD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAA;AAC/F,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;IACvH,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAA;IAC5B,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,CAAA;IAC1F,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAA;IAC3C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;QACrG,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAA;QACjH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACrC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC,CAAA;IAC3D,CAAC;YAAS,CAAC;QACT,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAA;IAC3C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAA;IAC5B,KAAK,MAAM,oBAAoB,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,EAAU,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC1H,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,cAAc,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;AACzD,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,oFAAoF,EAAE,GAAG,EAAE;IAC9F,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,IAAI,EAAE;YACJ,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;YACvC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,EAAE;YAChK;gBACE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;gBAC5F,KAAK,EAAE;oBACL,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,wBAAwB,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;oBACrJ,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;iBACvH;aACF;SACF;KACF,CAAC,CAAA;IACF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;IAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAA;IAC9C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACzH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACzC,CAAC,CAAC,CAAA"}

package/dist/gateway/console-api/access.d.ts

@@ -0,0 +1,52 @@
+import { type Actor } from '../services/context.js';
+import type { AuditInput, GatewayStore } from '../store.js';
+import { type ConsoleRequest, type Principal } from './router.js';
+import type { WorkspaceRole } from './types.js';
+/** The live member behind a principal, or null for keys and tokens. Throws when the member is no longer active. */
+export declare function activeMember(store: GatewayStore, p: Principal | null): import("../store.js").MemberRecord | null;
+export declare function isOrgAdmin(store: GatewayStore, p: Principal | null): boolean;
+/**
+ * Org owner or admin (or a management token). The store argument is
+ * optional to keep the spec'd signature; without it the principal's own
+ * claim is trusted.
+ */
+export declare function requireOrgAdmin(p: Principal | null, store?: GatewayStore): void;
+/** The caller's role in a workspace: org admins and tokens count as workspace admins. */
+export declare function workspaceRole(store: GatewayStore, p: Principal | null, workspaceId: string): WorkspaceRole | null;
+export declare function requireWorkspaceAccess(store: GatewayStore, p: Principal | null, workspaceId: string, minRole?: 'member' | 'admin'): void;
+export declare function canSeeWorkspace(store: GatewayStore, p: Principal | null, workspaceId: string): boolean;
+/** Workspaces the caller can open; null means all of them. */
+export declare function visibleWorkspaceIds(store: GatewayStore, p: Principal | null): Set<string> | null;
+/**
+ * Keys whose usage and request log the caller may read; null means all.
+ * A key session sees its key; a member sees every key in workspaces they
+ * administer plus their own keys elsewhere.
+ */
+export declare function visibleKeyIds(store: GatewayStore, p: Principal | null): string[] | null;
+/** The audit-log actor for a principal (null → system). */
+export declare function auditActor(store: Pick<GatewayStore, 'getMember' | 'getKey' | 'getAdminToken'>, p: Principal | null): AuditInput['actor'];
+/**
+ * Client address of a console request. `CF-Connecting-IP` is believed only
+ * when the gateway runs behind its own Cloudflare tunnel
+ * (`deps.trustCloudflareHeaders`); otherwise the last `X-Forwarded-For`
+ * hop added by a loopback proxy, else the socket peer.
+ */
+export declare function requestIp(request: Pick<ConsoleRequest, 'raw'>, deps?: {
+    trustCloudflareHeaders?: boolean;
+}): string | null;
+/**
+ * Records one mutating console action. Never throws: a failed write is
+ * logged loudly instead, since the action itself already happened.
+ *
+ *   audit(deps, request, 'preset.update', { kind: 'preset', id, label: name }, { before, after })
+ */
+export declare function audit(deps: {
+    store: GatewayStore;
+    log: (message: string) => void;
+}, request: Pick<ConsoleRequest, 'principal' | 'raw'>, action: string, target?: AuditInput['target'], details?: Record<string, unknown>): void;
+/** The audit actor and client address of a console request, for the shared services. */
+export declare function requestActor(deps: {
+    store: GatewayStore;
+    trustCloudflareHeaders?: boolean;
+}, request: Pick<ConsoleRequest, 'principal' | 'raw'>): Actor;
+//# sourceMappingURL=access.d.ts.map

package/dist/gateway/console-api/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/gateway/console-api/access.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAiB/C,mHAAmH;AACnH,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,6CAMpE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,EAAE,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAU/E;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAOjH;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,QAAQ,GAAG,OAAkB,GAAG,IAAI,CAOlJ;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAGtG;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAIhG;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,GAAG,IAAI,CAUvF;AAID,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CASxI;AAQD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE;IAAE,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAG1H;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CACnB,IAAI,EAAE;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAC7D,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,KAAK,CAAC,EAClD,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,UAAU,CAAC,QAAQ,CAAQ,EACnC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACpC,IAAI,CAEN;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,KAAK,CAAC,GAAG,KAAK,CAQvJ"}