@axiom-lattice/gateway 4.3.2 → 4.4.0

package/dist/{resources-JFKAPS45.mjs.map → resources-DXPXAXEZ.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/controllers/resources.ts","../src/services/open/sandboxGrants.ts"],"sourcesContent":["import { FastifyRequest, FastifyReply } from \"fastify\";\nimport type { ResourceAddress, ShareRecord, SharedResourceStore } from \"@axiom-lattice/protocols\";\nimport bcrypt from \"bcryptjs\";\nimport {\n  generateToken,\n  createSharePayload,\n  TokenCache,\n  SandboxLatticeManager,\n  buildNamedVolumeName,\n} from \"@axiom-lattice/core\";\nimport { getContentTypeFromFilename } from \"../utils/mime\";\nimport { sendBufferWithRange } from \"../utils/http-range\";\nimport { sanitizeShareOpenGrants } from \"../services/open/sandboxGrants\";\n\ninterface ResourceControllerDeps {\n  store: SharedResourceStore;\n  sandboxManager: SandboxLatticeManager;\n  cache: TokenCache;\n  logger: { info: (msg: string, obj?: object) => void; warn: (msg: string, obj?: object) => void; error: (msg: string, obj?: object) => void };\n}\n\nexport class ResourceController {\n  constructor(private deps: ResourceControllerDeps) {}\n\n  async createShare(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const workspaceId = request.headers[\"x-workspace-id\"] as string;\n    const projectId = request.headers[\"x-project-id\"] as string;\n    const body = request.body as any;\n\n    if (!workspaceId || !projectId) {\n      return reply.status(400).send({ error: \"x-workspace-id and x-project-id headers required\" });\n    }\n\n    const payload = createSharePayload(\n      tenantId,\n      workspaceId,\n      projectId,\n      userId as string,\n      body,\n    );\n    const token = generateToken();\n\n    try {\n      await this.deps.store.create({ ...payload, token });\n      this.deps.logger.info(\n        \"[share] created\",\n        { token, originalPath: body.resourcePath, normalizedPath: payload.address.resourcePath, volume: payload.address.volume, userId },\n      );\n    } catch {\n      return reply.status(500).send({ error: \"Failed to create share\" });\n    }\n\n    return reply.status(201).send({ token, url: `/s/${token}` });\n  }\n\n  async listShares(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const shares = await this.deps.store.listByUser(tenantId, userId as string);\n    return reply.send(shares.filter((r: any) => (r as any).visibility !== \"internal\"));\n  }\n\n  async updateShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const patch = request.body as any;\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, patch);\n\n    if (patch.revoked) {\n      this.deps.cache.invalidate(token);\n    }\n\n    return reply.send({ ok: true });\n  }\n\n  async revokeShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, { revoked: true });\n    this.deps.cache.invalidate(token);\n\n    return reply.send({ ok: true });\n  }\n\n  async resolveResource(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { token: string; \"*\"?: string };\n    const { token } = params;\n    const subPath = params[\"*\"] ?? \"\";\n\n    this.deps.logger.info(\"[share] resolve start\", { token, subPath });\n\n    const isApi = subPath && /(^|\\/)api\\//.test(subPath) && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\"));\n\n    // Only API paths accept non-GET methods\n    if (request.method !== \"GET\" && !isApi) {\n      return reply.status(405).send({ error: \"Method not allowed\" });\n    }\n\n    // API runtime — proxy to sandbox. Detected by /api/ anywhere in subPath.\n    if (isApi) {\n      const record = await this.deps.store.findByToken(token);\n      if (!record || record.revoked) return reply.status(404).send(\"Not found\");\n      if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n        return reply.status(410).send(\"Expired\");\n      }\n      // Auth check for API calls (same as file access)\n      if (!this._isInternalRequest(request)) {\n        if (record.visibility === \"internal\") {\n          return reply.status(401).send({ error: \"Internal access only\" });\n        }\n        if (record.visibility === \"password\") {\n          if (!this._isUnlocked(request, token)) {\n            return reply.status(401).send({ error: \"Password required\" });\n          }\n        }\n      }\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApi(record, subPath, ext, request, reply);\n    }\n\n    // 1. Check cache\n    const cached = this.deps.cache.get(token);\n    if (cached && !cached.requiresUnlock) {\n      this.deps.logger.info(\"[share] cache hit\", { token, volume: cached.address.volume, resourcePath: cached.address.resourcePath });\n      return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: \"default\", workspaceId: \"\", projectId: \"\", assistantId: null }, reply, request.headers.range);\n    }\n    this.deps.logger.info(\"[share] cache miss, querying DB\", { token });\n\n    // 2. Single DB lookup\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.revoked) {\n      this.deps.logger.warn(\"[share] token not found or revoked\", { token, found: !!record, revoked: record?.revoked });\n      return reply.status(404).send(\"Not found\");\n    }\n    if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n      this.deps.logger.info(\"[share] token expired\", { token, expiresAt: record.expiresAt });\n      return reply.status(410).send(\"Expired\");\n    }\n\n    this.deps.logger.info(\"[share] record found\", {\n      token,\n      volume: record.address.volume,\n      resourcePath: record.address.resourcePath,\n      visibility: record.visibility,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n    });\n\n    // 3. Auth\n    const isInternal = this._isInternalRequest(request);\n    if (!isInternal) {\n      // Internal shares: must be logged in\n      if (record.visibility === \"internal\") {\n        return reply.status(401).send({ error: \"Internal access only\" });\n      }\n      if (record.visibility === \"password\") {\n        const unlocked = this._isUnlocked(request, token);\n        if (!unlocked) {\n          this.deps.logger.info(\"[share] password protected, returning password page\", { token });\n          this.deps.cache.set(token, {\n            address: record.address,\n            requiresUnlock: true,\n            sandboxConfig: { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId },\n          });\n          return reply.type(\"text/html\").send(this._passwordPage(token));\n        }\n        this.deps.logger.info(\"[share] password unlocked\", { token });\n      }\n    }\n\n    // 4. Access count\n    if (record.maxAccess !== null) {\n      const ok = await this.deps.store.atomicIncrementAccess(token);\n      if (!ok) return reply.status(410).send(\"Access limit reached\");\n    } else {\n      this.deps.store.incrementAccess(token).catch(() => {});\n    }\n\n    // 5. Cache\n    const sandboxConfig = { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId };\n    this.deps.cache.set(token, {\n      address: record.address,\n      requiresUnlock: record.visibility === \"password\" && !isInternal,\n      sandboxConfig,\n    });\n\n    return this._serveFile(record.address, token, subPath, sandboxConfig, reply, request.headers.range);\n  }\n\n  /**\n   * Thin redirect: /f/{uuidHex3}/{path} → /s/{internal-token}/{path}\n   * Decodes 3 UUIDs (no dashes, 96 hex chars), ensures internal share, 302 redirects.\n   */\n  async resolveDirectFile(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { tid: string; wid: string; pid: string; \"*\"?: string };\n    const tenantId = params.tid;\n    const workspaceId = params.wid;\n    const projectId = params.pid;\n    const subPath = (params[\"*\"] ?? \"\");\n\n    const isApi = subPath && /(^|\\/)api\\//.test(subPath) && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\"));\n\n    // Only API paths accept non-GET methods\n    if (request.method !== \"GET\" && !isApi) {\n      return reply.status(405).send({ error: \"Method not allowed\" });\n    }\n\n    // API runtime\n    if (isApi) {\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApiCore({\n        tenantId, workspaceId, projectId, assistantId: \"\",\n        resourcePath: subPath,\n      }, subPath, ext, request, reply);\n    }\n\n    const volume = buildNamedVolumeName(\"p\", \"project\", tenantId, workspaceId, projectId);\n    return this._resolveAndServe(volume, subPath, reply, `/f/${tenantId}/${workspaceId}/${projectId}`,\n      { tenantId, workspaceId, projectId, assistantId: null },\n      request.headers.range,\n    );\n  }\n\n  async unlockShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const { password } = request.body as unknown as { password: string };\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || !record.passwordHash) {\n      return reply.status(404).send({ error: \"Invalid request\" });\n    }\n\n    const valid = await bcrypt.compare(password, record.passwordHash!);\n    if (!valid) {\n      return reply.status(401).send({ error: \"Incorrect password\" });\n    }\n\n    const cookieOpts = [\n      `share_unlock_${token}=1`,\n      \"Max-Age=86400\",\n      `Path=/s/${token}`,\n      \"SameSite=Lax\",\n      \"HttpOnly\",\n    ];\n    if (request.protocol === \"https\") {\n      cookieOpts.push(\"Secure\");\n    }\n    reply.header(\"Set-Cookie\", cookieOpts.join(\"; \"));\n    return reply.send({ ok: true });\n  }\n\n  private _isInternalRequest(request: FastifyRequest): boolean {\n    const user = (request as any).user;\n    if (user && user.id) return true;\n    // Fallback: same-origin browser request (iframe/img embed — no Auth header)\n    const origin = request.headers.origin || request.headers.referer;\n    if (origin) {\n      try {\n        const { hostname } = new URL(origin);\n        if (hostname === request.hostname) return true;\n      } catch { /* malformed */ }\n    }\n    return false;\n  }\n\n  private _isUnlocked(request: FastifyRequest, token: string): boolean {\n    const cookie = request.headers.cookie ?? \"\";\n    return cookie.includes(`share_unlock_${token}=1`);\n  }\n\n  /** Returns true if the path has a file extension indicating it's a file, not a directory */\n  private _isFilePath(path: string): boolean {\n    return /\\.[a-zA-Z0-9]+$/.test(path);\n  }\n\n  /**\n   * Shared file resolution: directory → index.html, volume FS → sandbox, base tag, response.\n   */\n  private async _resolveAndServe(\n    volume: string,\n    resourcePath: string,\n    reply: FastifyReply,\n    baseTagPrefix: string,\n    sandboxConfig?: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n    rangeHeader?: string,\n  ) {\n    const cleanPath = resourcePath.replace(/\\/+$/, \"\");\n    const entryPath = !cleanPath\n      ? \"index.html\"\n      : this._isFilePath(cleanPath)\n        ? cleanPath\n        : `${cleanPath}/index.html`;\n\n    const address: ResourceAddress = { volume, resourcePath: \"\" };\n\n    let buf: Buffer;\n    try {\n      // Volume FS first\n      const provider = this.deps.sandboxManager.getDefaultProvider();\n      buf = await provider.getResourceResolver().resolve({ ...address, resourcePath: entryPath });\n    } catch {\n      // Sandbox fallback\n      if (!sandboxConfig) return reply.status(404).send(\"File not found\");\n      try {\n        const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n          assistant_id: sandboxConfig.assistantId ?? \"\",\n          thread_id: \"\",\n          tenantId: sandboxConfig.tenantId,\n          workspaceId: sandboxConfig.workspaceId,\n          projectId: sandboxConfig.projectId,\n        });\n        buf = await sandbox.file.downloadFile({ file: `/project/${entryPath}` });\n      } catch {\n        return reply.status(404).send(\"File not found\");\n      }\n    }\n\n    const filename = entryPath.split(\"/\").pop() || \"download\";\n    const contentType = getContentTypeFromFilename(filename);\n\n    // Inject base tag for HTML\n    if (/\\.(html|htm)$/i.test(filename)) {\n      const baseDir = cleanPath\n        ? (this._isFilePath(cleanPath) ? cleanPath.replace(/[^/]+$/, \"\") : cleanPath)\n        : \"\";\n      const html = buf.toString(\"utf-8\");\n      if (!/<base\\b/i.test(html)) {\n        const baseTag = `<base href=\"${baseTagPrefix}${baseDir ? \"/\" + baseDir : \"\"}/\">`;\n        buf = Buffer.from(\n          html.includes(\"<head>\") ? html.replace(\"<head>\", `<head>${baseTag}`) : baseTag + html,\n          \"utf-8\"\n        );\n      }\n    }\n\n    return sendBufferWithRange(reply, buf, contentType, rangeHeader, {\n      \"Content-Disposition\": `inline; filename*=UTF-8''${encodeURIComponent(filename)}`,\n      \"Access-Control-Allow-Origin\": \"*\",\n    });\n  }\n\n  private async _serveFile(\n    address: ResourceAddress,\n    token: string,\n    subPath: string,\n    sandboxConfig: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n    reply: FastifyReply,\n    rangeHeader: string | undefined,\n  ) {\n    const resourcePath = subPath\n      ? this._resolveSafeSubPath(address.resourcePath, subPath)\n      : address.resourcePath;\n    return this._resolveAndServe(\n      address.volume,\n      resourcePath,\n      reply,\n      `/s/${token}`,\n      sandboxConfig,\n      rangeHeader,\n    );\n  }\n\n  private async _execApi(\n    record: ShareRecord,\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    const basePath = this._isFilePath(record.address.resourcePath)\n      ? \"\"\n      : `${record.address.resourcePath}/`;\n    return this._execApiCore({\n      tenantId: record.tenantId,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n      assistantId: record.assistantId,\n      resourcePath: basePath + apiSubPath,\n      openGrants: record.openGrants,\n    }, apiSubPath, ext, request, reply);\n  }\n\n  private async _execApiCore(\n    config: {\n      tenantId: string;\n      workspaceId: string;\n      projectId: string;\n      assistantId?: string | null;\n      resourcePath: string;\n      openGrants?: import(\"@axiom-lattice/protocols\").OpenGrant[];\n    },\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    let sandbox: any;\n    try {\n      sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n        assistant_id: config.assistantId ?? \"\",\n        thread_id: \"\",\n        tenantId: config.tenantId,\n        workspaceId: config.workspaceId,\n        projectId: config.projectId,\n      });\n    } catch (err) {\n      this.deps.logger.error(\"[share] sandbox start failed for API\", { error: (err as Error).message });\n      return reply.status(502).send({ error: \"Sandbox unavailable\" });\n    }\n\n    const scriptPath = `/project/${config.resourcePath}`;\n    const cmd = ext === \"py\" ? `python3 ${scriptPath}` : `node ${scriptPath}`;\n\n    // Pass query params and body via environment\n    const queryStr = request.url.includes(\"?\") ? (request.url as string).split(\"?\")[1] : \"\";\n    const queryObj: Record<string, string> = {};\n    if (queryStr) {\n      for (const [k, v] of new URLSearchParams(queryStr)) {\n        queryObj[k] = v;\n      }\n    }\n\n    const bodyStr = (request.body as string) ?? \"\";\n\n    const envVars = [\n      `export API_QUERY='${JSON.stringify(queryObj).replace(/'/g, \"'\\\\''\")}'`,\n      `export API_BODY='${bodyStr.replace(/'/g, \"'\\\\''\")}'`,\n      `export API_METHOD='${request.method}'`,\n      `export API_GATEWAY_URL='${request.protocol}://${request.headers[\"x-forwarded-host\"] ?? request.headers.host ?? request.hostname}'`,\n      `export API_TENANT_ID='${config.tenantId}'`,\n      `export API_ASSISTANT_ID='${config.assistantId || \"\"}'`,\n      `export OPEN_API_TOKEN='${this._mintSandboxToken(sandbox.name, config)}'`,\n    ].join(\" && \");\n\n    const fullCmd = `${envVars} && ${cmd}`;\n\n    this.deps.logger.info(\"[api] exec\", { scriptPath, cmd: cmd.substring(0, 80) });\n\n    try {\n      const result = await sandbox.shell.execCommand({ command: fullCmd });\n      // Parse stdout as JSON\n      let data: unknown;\n      try {\n        data = JSON.parse(result.output?.trim() || \"{}\");\n      } catch {\n        data = { output: result.output?.trim() || \"\" };\n      }\n      return reply.status(200).type(\"application/json\").send(data);\n    } catch (err) {\n      this.deps.logger.warn(\"[api] exec failed\", { scriptPath, error: (err as Error).message });\n      return reply.status(500).send({ error: (err as Error).message });\n    }\n  }\n\n  private _resolveSafeSubPath(entryFile: string, subPath: string): string {\n    if (!subPath) return entryFile;\n    if (subPath.includes(\"..\")) throw new Error(\"Path traversal denied\");\n    if (subPath.startsWith(entryFile + \"/\") || subPath === entryFile) return subPath;\n    const entryDir = this._isFilePath(entryFile)\n      ? entryFile.replace(/[^/]+$/, \"\")\n      : entryFile + \"/\";\n    return (entryDir + subPath).replace(/\\/+/g, \"/\");\n  }\n\n  private _passwordPage(token: string): string {\n    return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class=\"card\"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id=\"f\"><input type=\"password\" id=\"p\" placeholder=\"Enter password\" required><button type=\"submit\">Unlock</button><div class=\"error\" id=\"e\">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;\n  }\n\n  private _mintSandboxToken(\n    sandboxName: string,\n    config: {\n      tenantId: string;\n      workspaceId: string;\n      projectId: string;\n      openGrants?: import(\"@axiom-lattice/protocols\").OpenGrant[];\n    },\n  ): string {\n    // eslint-disable-next-line @typescript-eslint/no-var-requires\n    const { signOpenToken } = require(\"../services/open/openToken\") as {\n      signOpenToken: (p: unknown) => string;\n    };\n    return signOpenToken({\n      kind: \"sandbox_token\",\n      tenantId: config.tenantId,\n      workspaceId: config.workspaceId,\n      projectId: config.projectId,\n      sandboxName,\n      grants: [\n        {\n          domain: \"sandbox\",\n          items: [\"files_read\", \"files_list\", \"files_write\", \"shell_exec\"],\n        },\n        ...sanitizeShareOpenGrants(config.openGrants),\n      ],\n    });\n  }\n}\n","/**\n * Sandbox-token grant sanitation.\n *\n * Sandbox tokens always carry the self-binding sandbox grant (resolved from\n * the credential's tenant/workspace/project). Shares may append extra\n * Open-door grants, but only within the V1 whitelist: read-only kb access.\n * Anything else is dropped server-side (the share creator cannot widen scope).\n */\n\nimport type { OpenGrant } from \"@axiom-lattice/protocols\";\n\n/** V1 allowlist: domain → permitted (read-only) actions. */\nconst ALLOWED: Record<string, string[]> = {\n  kb: [\"search\", \"entries_read\"],\n};\n\nexport function sanitizeShareOpenGrants(grants: OpenGrant[] | undefined): OpenGrant[] {\n  const out: OpenGrant[] = [];\n  for (const grant of grants ?? []) {\n    const allowed = ALLOWED[grant.domain];\n    if (!allowed) continue;\n    const items =\n      grant.items && grant.items.length > 0\n        ? grant.items.filter((item) => allowed.includes(item))\n        : allowed;\n    if (items.length > 0) out.push({ domain: grant.domain, items });\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;AAEA,OAAO,YAAY;AACnB;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,OACK;;;ACGP,IAAM,UAAoC;AAAA,EACxC,IAAI,CAAC,UAAU,cAAc;AAC/B;AAEO,SAAS,wBAAwB,QAA8C;AACpF,QAAM,MAAmB,CAAC;AAC1B,aAAW,SAAS,UAAU,CAAC,GAAG;AAChC,UAAM,UAAU,QAAQ,MAAM,MAAM;AACpC,QAAI,CAAC,QAAS;AACd,UAAM,QACJ,MAAM,SAAS,MAAM,MAAM,SAAS,IAChC,MAAM,MAAM,OAAO,CAAC,SAAS,QAAQ,SAAS,IAAI,CAAC,IACnD;AACN,QAAI,MAAM,SAAS,EAAG,KAAI,KAAK,EAAE,QAAQ,MAAM,QAAQ,MAAM,CAAC;AAAA,EAChE;AACA,SAAO;AACT;;;ADPO,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YAAoB,MAA8B;AAA9B;AAAA,EAA+B;AAAA,EAEnD,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,cAAc,QAAQ,QAAQ,gBAAgB;AACpD,UAAM,YAAY,QAAQ,QAAQ,cAAc;AAChD,UAAM,OAAO,QAAQ;AAErB,QAAI,CAAC,eAAe,CAAC,WAAW;AAC9B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC7F;AAEA,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAE5B,QAAI;AACF,YAAM,KAAK,KAAK,MAAM,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC;AAClD,WAAK,KAAK,OAAO;AAAA,QACf;AAAA,QACA,EAAE,OAAO,cAAc,KAAK,cAAc,gBAAgB,QAAQ,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,QAAQ,OAAO;AAAA,MACjI;AAAA,IACF,QAAQ;AACN,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IACnE;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAM,WAAW,SAAyB,OAAqB;AAC7D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,WAAW,UAAU,MAAgB;AAC1E,WAAO,MAAM,KAAK,OAAO,OAAO,CAAC,MAAY,EAAU,eAAe,UAAU,CAAC;AAAA,EACnF;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,QAAQ,QAAQ;AAEtB,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,KAAK;AAEzC,QAAI,MAAM,SAAS;AACjB,WAAK,KAAK,MAAM,WAAW,KAAK;AAAA,IAClC;AAEA,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AAEJ,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC;AACrD,SAAK,KAAK,MAAM,WAAW,KAAK;AAEhC,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,gBAAgB,SAAyB,OAAqB;AAClE,UAAM,SAAS,QAAQ;AACvB,UAAM,EAAE,MAAM,IAAI;AAClB,UAAM,UAAU,OAAO,GAAG,KAAK;AAE/B,SAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,QAAQ,CAAC;AAEjE,UAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK;AAG1G,QAAI,QAAQ,WAAW,SAAS,CAAC,OAAO;AACtC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAGA,QAAI,OAAO;AACT,YAAMA,UAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,UAAI,CAACA,WAAUA,QAAO,QAAS,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AACxE,UAAIA,QAAO,aAAa,IAAI,KAAKA,QAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,MACzC;AAEA,UAAI,CAAC,KAAK,mBAAmB,OAAO,GAAG;AACrC,YAAIA,QAAO,eAAe,YAAY;AACpC,iBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,QACjE;AACA,YAAIA,QAAO,eAAe,YAAY;AACpC,cAAI,CAAC,KAAK,YAAY,SAAS,KAAK,GAAG;AACrC,mBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,UAC9D;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,SAASA,SAAQ,SAAS,KAAK,SAAS,KAAK;AAAA,IAC3D;AAGA,UAAM,SAAS,KAAK,KAAK,MAAM,IAAI,KAAK;AACxC,QAAI,UAAU,CAAC,OAAO,gBAAgB;AACpC,WAAK,KAAK,OAAO,KAAK,qBAAqB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,cAAc,OAAO,QAAQ,aAAa,CAAC;AAC9H,aAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,OAAO,iBAAiB,EAAE,UAAU,WAAW,aAAa,IAAI,WAAW,IAAI,aAAa,KAAK,GAAG,OAAO,QAAQ,QAAQ,KAAK;AAAA,IACzL;AACA,SAAK,KAAK,OAAO,KAAK,mCAAmC,EAAE,MAAM,CAAC;AAGlE,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,SAAS;AAC7B,WAAK,KAAK,OAAO,KAAK,sCAAsC,EAAE,OAAO,OAAO,CAAC,CAAC,QAAQ,SAAS,QAAQ,QAAQ,CAAC;AAChH,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AAAA,IAC3C;AACA,QAAI,OAAO,aAAa,IAAI,KAAK,OAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,WAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,WAAW,OAAO,UAAU,CAAC;AACrF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,IACzC;AAEA,SAAK,KAAK,OAAO,KAAK,wBAAwB;AAAA,MAC5C;AAAA,MACA,QAAQ,OAAO,QAAQ;AAAA,MACvB,cAAc,OAAO,QAAQ;AAAA,MAC7B,YAAY,OAAO;AAAA,MACnB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,IACpB,CAAC;AAGD,UAAM,aAAa,KAAK,mBAAmB,OAAO;AAClD,QAAI,CAAC,YAAY;AAEf,UAAI,OAAO,eAAe,YAAY;AACpC,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MACjE;AACA,UAAI,OAAO,eAAe,YAAY;AACpC,cAAM,WAAW,KAAK,YAAY,SAAS,KAAK;AAChD,YAAI,CAAC,UAAU;AACb,eAAK,KAAK,OAAO,KAAK,uDAAuD,EAAE,MAAM,CAAC;AACtF,eAAK,KAAK,MAAM,IAAI,OAAO;AAAA,YACzB,SAAS,OAAO;AAAA,YAChB,gBAAgB;AAAA,YAChB,eAAe,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AAAA,UAC5I,CAAC;AACD,iBAAO,MAAM,KAAK,WAAW,EAAE,KAAK,KAAK,cAAc,KAAK,CAAC;AAAA,QAC/D;AACA,aAAK,KAAK,OAAO,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC9D;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,MAAM;AAC7B,YAAM,KAAK,MAAM,KAAK,KAAK,MAAM,sBAAsB,KAAK;AAC5D,UAAI,CAAC,GAAI,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,sBAAsB;AAAA,IAC/D,OAAO;AACL,WAAK,KAAK,MAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACvD;AAGA,UAAM,gBAAgB,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AACjJ,SAAK,KAAK,MAAM,IAAI,OAAO;AAAA,MACzB,SAAS,OAAO;AAAA,MAChB,gBAAgB,OAAO,eAAe,cAAc,CAAC;AAAA,MACrD;AAAA,IACF,CAAC;AAED,WAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,eAAe,OAAO,QAAQ,QAAQ,KAAK;AAAA,EACpG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAkB,SAAyB,OAAqB;AACpE,UAAM,SAAS,QAAQ;AACvB,UAAM,WAAW,OAAO;AACxB,UAAM,cAAc,OAAO;AAC3B,UAAM,YAAY,OAAO;AACzB,UAAM,UAAW,OAAO,GAAG,KAAK;AAEhC,UAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK;AAG1G,QAAI,QAAQ,WAAW,SAAS,CAAC,OAAO;AACtC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAGA,QAAI,OAAO;AACT,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,aAAa;AAAA,QACvB;AAAA,QAAU;AAAA,QAAa;AAAA,QAAW,aAAa;AAAA,QAC/C,cAAc;AAAA,MAChB,GAAG,SAAS,KAAK,SAAS,KAAK;AAAA,IACjC;AAEA,UAAM,SAAS,qBAAqB,KAAK,WAAW,UAAU,aAAa,SAAS;AACpF,WAAO,KAAK;AAAA,MAAiB;AAAA,MAAQ;AAAA,MAAS;AAAA,MAAO,MAAM,QAAQ,IAAI,WAAW,IAAI,SAAS;AAAA,MAC7F,EAAE,UAAU,aAAa,WAAW,aAAa,KAAK;AAAA,MACtD,QAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,CAAC,OAAO,cAAc;AACnC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,QAAQ,MAAM,OAAO,QAAQ,UAAU,OAAO,YAAa;AACjE,QAAI,CAAC,OAAO;AACV,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAEA,UAAM,aAAa;AAAA,MACjB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS;AAChC,iBAAW,KAAK,QAAQ;AAAA,IAC1B;AACA,UAAM,OAAO,cAAc,WAAW,KAAK,IAAI,CAAC;AAChD,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEQ,mBAAmB,SAAkC;AAC3D,UAAM,OAAQ,QAAgB;AAC9B,QAAI,QAAQ,KAAK,GAAI,QAAO;AAE5B,UAAM,SAAS,QAAQ,QAAQ,UAAU,QAAQ,QAAQ;AACzD,QAAI,QAAQ;AACV,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,IAAI,IAAI,MAAM;AACnC,YAAI,aAAa,QAAQ,SAAU,QAAO;AAAA,MAC5C,QAAQ;AAAA,MAAkB;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,YAAY,SAAyB,OAAwB;AACnE,UAAM,SAAS,QAAQ,QAAQ,UAAU;AACzC,WAAO,OAAO,SAAS,gBAAgB,KAAK,IAAI;AAAA,EAClD;AAAA;AAAA,EAGQ,YAAY,MAAuB;AACzC,WAAO,kBAAkB,KAAK,IAAI;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBACZ,QACA,cACA,OACA,eACA,eACA,aACA;AACA,UAAM,YAAY,aAAa,QAAQ,QAAQ,EAAE;AACjD,UAAM,YAAY,CAAC,YACf,eACA,KAAK,YAAY,SAAS,IACxB,YACA,GAAG,SAAS;AAElB,UAAM,UAA2B,EAAE,QAAQ,cAAc,GAAG;AAE5D,QAAI;AACJ,QAAI;AAEF,YAAM,WAAW,KAAK,KAAK,eAAe,mBAAmB;AAC7D,YAAM,MAAM,SAAS,oBAAoB,EAAE,QAAQ,EAAE,GAAG,SAAS,cAAc,UAAU,CAAC;AAAA,IAC5F,QAAQ;AAEN,UAAI,CAAC,cAAe,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAClE,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,UAClE,cAAc,cAAc,eAAe;AAAA,UAC3C,WAAW;AAAA,UACX,UAAU,cAAc;AAAA,UACxB,aAAa,cAAc;AAAA,UAC3B,WAAW,cAAc;AAAA,QAC3B,CAAC;AACD,cAAM,MAAM,QAAQ,KAAK,aAAa,EAAE,MAAM,YAAY,SAAS,GAAG,CAAC;AAAA,MACzE,QAAQ;AACN,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAAA,MAChD;AAAA,IACF;AAEA,UAAM,WAAW,UAAU,MAAM,GAAG,EAAE,IAAI,KAAK;AAC/C,UAAM,cAAc,2BAA2B,QAAQ;AAGvD,QAAI,iBAAiB,KAAK,QAAQ,GAAG;AACnC,YAAM,UAAU,YACX,KAAK,YAAY,SAAS,IAAI,UAAU,QAAQ,UAAU,EAAE,IAAI,YACjE;AACJ,YAAM,OAAO,IAAI,SAAS,OAAO;AACjC,UAAI,CAAC,WAAW,KAAK,IAAI,GAAG;AAC1B,cAAM,UAAU,eAAe,aAAa,GAAG,UAAU,MAAM,UAAU,EAAE;AAC3E,cAAM,OAAO;AAAA,UACX,KAAK,SAAS,QAAQ,IAAI,KAAK,QAAQ,UAAU,SAAS,OAAO,EAAE,IAAI,UAAU;AAAA,UACjF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,oBAAoB,OAAO,KAAK,aAAa,aAAa;AAAA,MAC/D,uBAAuB,4BAA4B,mBAAmB,QAAQ,CAAC;AAAA,MAC/E,+BAA+B;AAAA,IACjC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WACZ,SACA,OACA,SACA,eACA,OACA,aACA;AACA,UAAM,eAAe,UACjB,KAAK,oBAAoB,QAAQ,cAAc,OAAO,IACtD,QAAQ;AACZ,WAAO,KAAK;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM,KAAK;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,SACZ,QACA,YACA,KACA,SACA,OACA;AACA,UAAM,WAAW,KAAK,YAAY,OAAO,QAAQ,YAAY,IACzD,KACA,GAAG,OAAO,QAAQ,YAAY;AAClC,WAAO,KAAK,aAAa;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,MACpB,cAAc,WAAW;AAAA,MACzB,YAAY,OAAO;AAAA,IACrB,GAAG,YAAY,KAAK,SAAS,KAAK;AAAA,EACpC;AAAA,EAEA,MAAc,aACZ,QAQA,YACA,KACA,SACA,OACA;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,QAC5D,cAAc,OAAO,eAAe;AAAA,QACpC,WAAW;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,MAAM,wCAAwC,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAChG,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sBAAsB,CAAC;AAAA,IAChE;AAEA,UAAM,aAAa,YAAY,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,OAAO,WAAW,UAAU,KAAK,QAAQ,UAAU;AAGvE,UAAM,WAAW,QAAQ,IAAI,SAAS,GAAG,IAAK,QAAQ,IAAe,MAAM,GAAG,EAAE,CAAC,IAAI;AACrF,UAAM,WAAmC,CAAC;AAC1C,QAAI,UAAU;AACZ,iBAAW,CAAC,GAAG,CAAC,KAAK,IAAI,gBAAgB,QAAQ,GAAG;AAClD,iBAAS,CAAC,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,UAAW,QAAQ,QAAmB;AAE5C,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK,UAAU,QAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,MACpE,oBAAoB,QAAQ,QAAQ,MAAM,OAAO,CAAC;AAAA,MAClD,sBAAsB,QAAQ,MAAM;AAAA,MACpC,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,kBAAkB,KAAK,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,MAChI,yBAAyB,OAAO,QAAQ;AAAA,MACxC,4BAA4B,OAAO,eAAe,EAAE;AAAA,MACpD,0BAA0B,KAAK,kBAAkB,QAAQ,MAAM,MAAM,CAAC;AAAA,IACxE,EAAE,KAAK,MAAM;AAEb,UAAM,UAAU,GAAG,OAAO,OAAO,GAAG;AAEpC,SAAK,KAAK,OAAO,KAAK,cAAc,EAAE,YAAY,KAAK,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;AAE7E,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,MAAM,YAAY,EAAE,SAAS,QAAQ,CAAC;AAEnE,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,MAAM,OAAO,QAAQ,KAAK,KAAK,IAAI;AAAA,MACjD,QAAQ;AACN,eAAO,EAAE,QAAQ,OAAO,QAAQ,KAAK,KAAK,GAAG;AAAA,MAC/C;AACA,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,kBAAkB,EAAE,KAAK,IAAI;AAAA,IAC7D,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,KAAK,qBAAqB,EAAE,YAAY,OAAQ,IAAc,QAAQ,CAAC;AACxF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAAA,IACjE;AAAA,EACF;AAAA,EAEQ,oBAAoB,WAAmB,SAAyB;AACtE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACnE,QAAI,QAAQ,WAAW,YAAY,GAAG,KAAK,YAAY,UAAW,QAAO;AACzE,UAAM,WAAW,KAAK,YAAY,SAAS,IACvC,UAAU,QAAQ,UAAU,EAAE,IAC9B,YAAY;AAChB,YAAQ,WAAW,SAAS,QAAQ,QAAQ,GAAG;AAAA,EACjD;AAAA,EAEQ,cAAc,OAAuB;AAC3C,WAAO,8tCAA8tC,KAAK;AAAA,EAC5uC;AAAA,EAEQ,kBACN,aACA,QAMQ;AAER,UAAM,EAAE,cAAc,IAAI;AAG1B,WAAO,cAAc;AAAA,MACnB,MAAM;AAAA,MACN,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,OAAO,CAAC,cAAc,cAAc,eAAe,YAAY;AAAA,QACjE;AAAA,QACA,GAAG,wBAAwB,OAAO,UAAU;AAAA,MAC9C;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":["record"]}
+{"version":3,"sources":["../src/controllers/resources.ts","../src/services/open/sandboxGrants.ts"],"sourcesContent":["import { FastifyRequest, FastifyReply } from \"fastify\";\nimport type { ResourceAddress, ShareRecord, SharedResourceStore } from \"@axiom-lattice/protocols\";\nimport bcrypt from \"bcryptjs\";\nimport {\n  generateToken,\n  createSharePayload,\n  TokenCache,\n  SandboxLatticeManager,\n  buildNamedVolumeName,\n} from \"@axiom-lattice/core\";\nimport { getContentTypeFromFilename } from \"../utils/mime\";\nimport { sendBufferWithRange } from \"../utils/http-range\";\nimport { sanitizeShareOpenGrants } from \"../services/open/sandboxGrants\";\n\ninterface ResourceControllerDeps {\n  store: SharedResourceStore;\n  sandboxManager: SandboxLatticeManager;\n  cache: TokenCache;\n  logger: { info: (msg: string, obj?: object) => void; warn: (msg: string, obj?: object) => void; error: (msg: string, obj?: object) => void };\n}\n\nexport class ResourceController {\n  constructor(private deps: ResourceControllerDeps) {}\n\n  async createShare(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const workspaceId = request.headers[\"x-workspace-id\"] as string;\n    const projectId = request.headers[\"x-project-id\"] as string;\n    const body = request.body as any;\n\n    if (!workspaceId || !projectId) {\n      return reply.status(400).send({ error: \"x-workspace-id and x-project-id headers required\" });\n    }\n\n    const payload = createSharePayload(\n      tenantId,\n      workspaceId,\n      projectId,\n      userId as string,\n      body,\n    );\n    const token = generateToken();\n\n    try {\n      await this.deps.store.create({ ...payload, token });\n      this.deps.logger.info(\n        \"[share] created\",\n        { token, originalPath: body.resourcePath, normalizedPath: payload.address.resourcePath, volume: payload.address.volume, userId },\n      );\n    } catch {\n      return reply.status(500).send({ error: \"Failed to create share\" });\n    }\n\n    return reply.status(201).send({ token, url: `/s/${token}` });\n  }\n\n  async listShares(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const shares = await this.deps.store.listByUser(tenantId, userId as string);\n    return reply.send(shares.filter((r: any) => (r as any).visibility !== \"internal\"));\n  }\n\n  async updateShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const patch = request.body as any;\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, patch);\n\n    if (patch.revoked) {\n      this.deps.cache.invalidate(token);\n    }\n\n    return reply.send({ ok: true });\n  }\n\n  async revokeShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, { revoked: true });\n    this.deps.cache.invalidate(token);\n\n    return reply.send({ ok: true });\n  }\n\n  async resolveResource(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { token: string; \"*\"?: string };\n    const { token } = params;\n    const subPath = params[\"*\"] ?? \"\";\n\n    this.deps.logger.info(\"[share] resolve start\", { token, subPath });\n\n    const isApi = subPath && /(^|\\/)api\\//.test(subPath) && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\"));\n\n    // Only API paths accept non-GET methods\n    if (request.method !== \"GET\" && !isApi) {\n      return reply.status(405).send({ error: \"Method not allowed\" });\n    }\n\n    // API runtime — proxy to sandbox. Detected by /api/ anywhere in subPath.\n    if (isApi) {\n      const record = await this.deps.store.findByToken(token);\n      if (!record || record.revoked) return reply.status(404).send(\"Not found\");\n      if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n        return reply.status(410).send(\"Expired\");\n      }\n      // Auth check for API calls (same as file access)\n      if (!this._isInternalRequest(request)) {\n        if (record.visibility === \"internal\") {\n          return reply.status(401).send({ error: \"Internal access only\" });\n        }\n        if (record.visibility === \"password\") {\n          if (!this._isUnlocked(request, token)) {\n            return reply.status(401).send({ error: \"Password required\" });\n          }\n        }\n      }\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApi(record, subPath, ext, request, reply);\n    }\n\n    // 1. Check cache\n    const cached = this.deps.cache.get(token);\n    if (cached && !cached.requiresUnlock) {\n      this.deps.logger.info(\"[share] cache hit\", { token, volume: cached.address.volume, resourcePath: cached.address.resourcePath });\n      return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: \"default\", workspaceId: \"\", projectId: \"\", assistantId: null }, reply, request.headers.range);\n    }\n    this.deps.logger.info(\"[share] cache miss, querying DB\", { token });\n\n    // 2. Single DB lookup\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.revoked) {\n      this.deps.logger.warn(\"[share] token not found or revoked\", { token, found: !!record, revoked: record?.revoked });\n      return reply.status(404).send(\"Not found\");\n    }\n    if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n      this.deps.logger.info(\"[share] token expired\", { token, expiresAt: record.expiresAt });\n      return reply.status(410).send(\"Expired\");\n    }\n\n    this.deps.logger.info(\"[share] record found\", {\n      token,\n      volume: record.address.volume,\n      resourcePath: record.address.resourcePath,\n      visibility: record.visibility,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n    });\n\n    // 3. Auth\n    const isInternal = this._isInternalRequest(request);\n    if (!isInternal) {\n      // Internal shares: must be logged in\n      if (record.visibility === \"internal\") {\n        return reply.status(401).send({ error: \"Internal access only\" });\n      }\n      if (record.visibility === \"password\") {\n        const unlocked = this._isUnlocked(request, token);\n        if (!unlocked) {\n          this.deps.logger.info(\"[share] password protected, returning password page\", { token });\n          this.deps.cache.set(token, {\n            address: record.address,\n            requiresUnlock: true,\n            sandboxConfig: { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId },\n          });\n          return reply.type(\"text/html\").send(this._passwordPage(token));\n        }\n        this.deps.logger.info(\"[share] password unlocked\", { token });\n      }\n    }\n\n    // 4. Access count\n    if (record.maxAccess !== null) {\n      const ok = await this.deps.store.atomicIncrementAccess(token);\n      if (!ok) return reply.status(410).send(\"Access limit reached\");\n    } else {\n      this.deps.store.incrementAccess(token).catch(() => {});\n    }\n\n    // 5. Cache\n    const sandboxConfig = { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId };\n    this.deps.cache.set(token, {\n      address: record.address,\n      requiresUnlock: record.visibility === \"password\" && !isInternal,\n      sandboxConfig,\n    });\n\n    return this._serveFile(record.address, token, subPath, sandboxConfig, reply, request.headers.range);\n  }\n\n  /**\n   * Thin redirect: /f/{uuidHex3}/{path} → /s/{internal-token}/{path}\n   * Decodes 3 UUIDs (no dashes, 96 hex chars), ensures internal share, 302 redirects.\n   */\n  async resolveDirectFile(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { tid: string; wid: string; pid: string; \"*\"?: string };\n    const tenantId = params.tid;\n    const workspaceId = params.wid;\n    const projectId = params.pid;\n    const subPath = (params[\"*\"] ?? \"\");\n\n    const isApi = subPath && /(^|\\/)api\\//.test(subPath) && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\"));\n\n    // Only API paths accept non-GET methods\n    if (request.method !== \"GET\" && !isApi) {\n      return reply.status(405).send({ error: \"Method not allowed\" });\n    }\n\n    // API runtime\n    if (isApi) {\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApiCore({\n        tenantId, workspaceId, projectId, assistantId: \"\",\n        resourcePath: subPath,\n      }, subPath, ext, request, reply);\n    }\n\n    const volume = buildNamedVolumeName(\"p\", \"project\", tenantId, workspaceId, projectId);\n    return this._resolveAndServe(volume, subPath, reply, `/f/${tenantId}/${workspaceId}/${projectId}`,\n      { tenantId, workspaceId, projectId, assistantId: null },\n      request.headers.range,\n    );\n  }\n\n  async unlockShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const { password } = request.body as unknown as { password: string };\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || !record.passwordHash) {\n      return reply.status(404).send({ error: \"Invalid request\" });\n    }\n\n    const valid = await bcrypt.compare(password, record.passwordHash!);\n    if (!valid) {\n      return reply.status(401).send({ error: \"Incorrect password\" });\n    }\n\n    const cookieOpts = [\n      `share_unlock_${token}=1`,\n      \"Max-Age=86400\",\n      `Path=/s/${token}`,\n      \"SameSite=Lax\",\n      \"HttpOnly\",\n    ];\n    if (request.protocol === \"https\") {\n      cookieOpts.push(\"Secure\");\n    }\n    reply.header(\"Set-Cookie\", cookieOpts.join(\"; \"));\n    return reply.send({ ok: true });\n  }\n\n  private _isInternalRequest(request: FastifyRequest): boolean {\n    const user = (request as any).user;\n    if (user && user.id) return true;\n    // Fallback: same-origin browser request (iframe/img embed — no Auth header)\n    const origin = request.headers.origin || request.headers.referer;\n    if (origin) {\n      try {\n        const { hostname } = new URL(origin);\n        if (hostname === request.hostname) return true;\n      } catch { /* malformed */ }\n    }\n    return false;\n  }\n\n  private _isUnlocked(request: FastifyRequest, token: string): boolean {\n    const cookie = request.headers.cookie ?? \"\";\n    return cookie.includes(`share_unlock_${token}=1`);\n  }\n\n  /** Returns true if the path has a file extension indicating it's a file, not a directory */\n  private _isFilePath(path: string): boolean {\n    return /\\.[a-zA-Z0-9]+$/.test(path);\n  }\n\n  /**\n   * Injects a `<base href>` tag into an HTML document when it does not already\n   * declare one. Injects right after `<head>` when present, otherwise prefixes\n   * the document.\n   */\n  private _injectBaseTag(html: string, baseHref: string): string {\n    if (/<base\\b/i.test(html)) return html;\n    const baseTag = `<base href=\"${baseHref}\">`;\n    return html.includes(\"<head>\") ? html.replace(\"<head>\", `<head>${baseTag}`) : baseTag + html;\n  }\n\n  /**\n   * Shared file resolution: directory → index.html, volume FS → sandbox, base tag, response.\n   */\n  private async _resolveAndServe(\n    volume: string,\n    resourcePath: string,\n    reply: FastifyReply,\n    baseTagPrefix: string,\n    sandboxConfig?: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n    rangeHeader?: string,\n  ) {\n    const cleanPath = resourcePath.replace(/\\/+$/, \"\");\n    const entryPath = !cleanPath\n      ? \"index.html\"\n      : this._isFilePath(cleanPath)\n        ? cleanPath\n        : `${cleanPath}/index.html`;\n\n    const address: ResourceAddress = { volume, resourcePath: \"\" };\n\n    let buf: Buffer;\n    try {\n      // Volume FS first\n      const provider = this.deps.sandboxManager.getDefaultProvider();\n      buf = await provider.getResourceResolver().resolve({ ...address, resourcePath: entryPath });\n    } catch {\n      // Sandbox fallback\n      if (!sandboxConfig) return reply.status(404).send(\"File not found\");\n      try {\n        const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n          assistant_id: sandboxConfig.assistantId ?? \"\",\n          thread_id: \"\",\n          tenantId: sandboxConfig.tenantId,\n          workspaceId: sandboxConfig.workspaceId,\n          projectId: sandboxConfig.projectId,\n        });\n        buf = await sandbox.file.downloadFile({ file: `/project/${entryPath}` });\n      } catch {\n        return reply.status(404).send(\"File not found\");\n      }\n    }\n\n    const filename = entryPath.split(\"/\").pop() || \"download\";\n    const contentType = getContentTypeFromFilename(filename);\n\n    // Inject base tag for HTML\n    if (/\\.(html|htm)$/i.test(filename)) {\n      const baseDir = cleanPath\n        ? (this._isFilePath(cleanPath) ? cleanPath.replace(/[^/]+$/, \"\") : cleanPath)\n        : \"\";\n      const baseHref = `${baseTagPrefix}${baseDir ? \"/\" + baseDir : \"\"}/`;\n      buf = Buffer.from(\n        this._injectBaseTag(buf.toString(\"utf-8\"), baseHref),\n        \"utf-8\"\n      );\n    }\n\n    return sendBufferWithRange(reply, buf, contentType, rangeHeader, {\n      \"Content-Disposition\": `inline; filename*=UTF-8''${encodeURIComponent(filename)}`,\n      \"Access-Control-Allow-Origin\": \"*\",\n    });\n  }\n\n  private async _serveFile(\n    address: ResourceAddress,\n    token: string,\n    subPath: string,\n    sandboxConfig: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n    reply: FastifyReply,\n    rangeHeader: string | undefined,\n  ) {\n    const resourcePath = subPath\n      ? this._resolveSafeSubPath(address.resourcePath, subPath)\n      : address.resourcePath;\n    return this._resolveAndServe(\n      address.volume,\n      resourcePath,\n      reply,\n      `/s/${token}`,\n      sandboxConfig,\n      rangeHeader,\n    );\n  }\n\n  private async _execApi(\n    record: ShareRecord,\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    const basePath = this._isFilePath(record.address.resourcePath)\n      ? \"\"\n      : `${record.address.resourcePath}/`;\n    return this._execApiCore({\n      tenantId: record.tenantId,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n      assistantId: record.assistantId,\n      resourcePath: basePath + apiSubPath,\n      openGrants: record.openGrants,\n    }, apiSubPath, ext, request, reply);\n  }\n\n  private async _execApiCore(\n    config: {\n      tenantId: string;\n      workspaceId: string;\n      projectId: string;\n      assistantId?: string | null;\n      resourcePath: string;\n      openGrants?: import(\"@axiom-lattice/protocols\").OpenGrant[];\n    },\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    let sandbox: any;\n    try {\n      sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n        assistant_id: config.assistantId ?? \"\",\n        thread_id: \"\",\n        tenantId: config.tenantId,\n        workspaceId: config.workspaceId,\n        projectId: config.projectId,\n      });\n    } catch (err) {\n      this.deps.logger.error(\"[share] sandbox start failed for API\", { error: (err as Error).message });\n      return reply.status(502).send({ error: \"Sandbox unavailable\" });\n    }\n\n    const scriptPath = `/project/${config.resourcePath}`;\n    const cmd = ext === \"py\" ? `python3 ${scriptPath}` : `node ${scriptPath}`;\n\n    // Pass query params and body via environment\n    const queryStr = request.url.includes(\"?\") ? (request.url as string).split(\"?\")[1] : \"\";\n    const queryObj: Record<string, string> = {};\n    if (queryStr) {\n      for (const [k, v] of new URLSearchParams(queryStr)) {\n        queryObj[k] = v;\n      }\n    }\n\n    const bodyStr = (request.body as string) ?? \"\";\n\n    const envVars = [\n      `export API_QUERY='${JSON.stringify(queryObj).replace(/'/g, \"'\\\\''\")}'`,\n      `export API_BODY='${bodyStr.replace(/'/g, \"'\\\\''\")}'`,\n      `export API_METHOD='${request.method}'`,\n      `export API_GATEWAY_URL='${request.protocol}://${request.headers[\"x-forwarded-host\"] ?? request.headers.host ?? request.hostname}'`,\n      `export API_TENANT_ID='${config.tenantId}'`,\n      `export API_ASSISTANT_ID='${config.assistantId || \"\"}'`,\n      `export OPEN_API_TOKEN='${this._mintSandboxToken(sandbox.name, config)}'`,\n    ].join(\" && \");\n\n    const fullCmd = `${envVars} && ${cmd}`;\n\n    this.deps.logger.info(\"[api] exec\", { scriptPath, cmd: cmd.substring(0, 80) });\n\n    try {\n      const result = await sandbox.shell.execCommand({ command: fullCmd });\n      // Parse stdout as JSON\n      let data: unknown;\n      try {\n        data = JSON.parse(result.output?.trim() || \"{}\");\n      } catch {\n        data = { output: result.output?.trim() || \"\" };\n      }\n      return reply.status(200).type(\"application/json\").send(data);\n    } catch (err) {\n      this.deps.logger.warn(\"[api] exec failed\", { scriptPath, error: (err as Error).message });\n      return reply.status(500).send({ error: (err as Error).message });\n    }\n  }\n\n  private _resolveSafeSubPath(entryFile: string, subPath: string): string {\n    if (!subPath) return entryFile;\n    if (subPath.includes(\"..\")) throw new Error(\"Path traversal denied\");\n    if (subPath.startsWith(entryFile + \"/\") || subPath === entryFile) return subPath;\n    const entryDir = this._isFilePath(entryFile)\n      ? entryFile.replace(/[^/]+$/, \"\")\n      : entryFile + \"/\";\n    return (entryDir + subPath).replace(/\\/+/g, \"/\");\n  }\n\n  private _passwordPage(token: string): string {\n    return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class=\"card\"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id=\"f\"><input type=\"password\" id=\"p\" placeholder=\"Enter password\" required><button type=\"submit\">Unlock</button><div class=\"error\" id=\"e\">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;\n  }\n\n  private _mintSandboxToken(\n    sandboxName: string,\n    config: {\n      tenantId: string;\n      workspaceId: string;\n      projectId: string;\n      openGrants?: import(\"@axiom-lattice/protocols\").OpenGrant[];\n    },\n  ): string {\n    // eslint-disable-next-line @typescript-eslint/no-var-requires\n    const { signOpenToken } = require(\"../services/open/openToken\") as {\n      signOpenToken: (p: unknown) => string;\n    };\n    return signOpenToken({\n      kind: \"sandbox_token\",\n      tenantId: config.tenantId,\n      workspaceId: config.workspaceId,\n      projectId: config.projectId,\n      sandboxName,\n      grants: [\n        {\n          domain: \"sandbox\",\n          items: [\"files_read\", \"files_list\", \"files_write\", \"shell_exec\"],\n        },\n        ...sanitizeShareOpenGrants(config.openGrants),\n      ],\n    });\n  }\n}\n","/**\n * Sandbox-token grant sanitation.\n *\n * Sandbox tokens always carry the self-binding sandbox grant (resolved from\n * the credential's tenant/workspace/project). Shares may append extra\n * Open-door grants, but only within the V1 whitelist: read-only kb access.\n * Anything else is dropped server-side (the share creator cannot widen scope).\n */\n\nimport type { OpenGrant } from \"@axiom-lattice/protocols\";\n\n/** V1 allowlist: domain → permitted (read-only) actions. */\nconst ALLOWED: Record<string, string[]> = {\n  kb: [\"search\", \"entries_read\"],\n};\n\nexport function sanitizeShareOpenGrants(grants: OpenGrant[] | undefined): OpenGrant[] {\n  const out: OpenGrant[] = [];\n  for (const grant of grants ?? []) {\n    const allowed = ALLOWED[grant.domain];\n    if (!allowed) continue;\n    const items =\n      grant.items && grant.items.length > 0\n        ? grant.items.filter((item) => allowed.includes(item))\n        : allowed;\n    if (items.length > 0) out.push({ domain: grant.domain, items });\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;AAEA,OAAO,YAAY;AACnB;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,OACK;;;ACGP,IAAM,UAAoC;AAAA,EACxC,IAAI,CAAC,UAAU,cAAc;AAC/B;AAEO,SAAS,wBAAwB,QAA8C;AACpF,QAAM,MAAmB,CAAC;AAC1B,aAAW,SAAS,UAAU,CAAC,GAAG;AAChC,UAAM,UAAU,QAAQ,MAAM,MAAM;AACpC,QAAI,CAAC,QAAS;AACd,UAAM,QACJ,MAAM,SAAS,MAAM,MAAM,SAAS,IAChC,MAAM,MAAM,OAAO,CAAC,SAAS,QAAQ,SAAS,IAAI,CAAC,IACnD;AACN,QAAI,MAAM,SAAS,EAAG,KAAI,KAAK,EAAE,QAAQ,MAAM,QAAQ,MAAM,CAAC;AAAA,EAChE;AACA,SAAO;AACT;;;ADPO,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YAAoB,MAA8B;AAA9B;AAAA,EAA+B;AAAA,EAEnD,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,cAAc,QAAQ,QAAQ,gBAAgB;AACpD,UAAM,YAAY,QAAQ,QAAQ,cAAc;AAChD,UAAM,OAAO,QAAQ;AAErB,QAAI,CAAC,eAAe,CAAC,WAAW;AAC9B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC7F;AAEA,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAE5B,QAAI;AACF,YAAM,KAAK,KAAK,MAAM,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC;AAClD,WAAK,KAAK,OAAO;AAAA,QACf;AAAA,QACA,EAAE,OAAO,cAAc,KAAK,cAAc,gBAAgB,QAAQ,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,QAAQ,OAAO;AAAA,MACjI;AAAA,IACF,QAAQ;AACN,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IACnE;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAM,WAAW,SAAyB,OAAqB;AAC7D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,WAAW,UAAU,MAAgB;AAC1E,WAAO,MAAM,KAAK,OAAO,OAAO,CAAC,MAAY,EAAU,eAAe,UAAU,CAAC;AAAA,EACnF;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,QAAQ,QAAQ;AAEtB,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,KAAK;AAEzC,QAAI,MAAM,SAAS;AACjB,WAAK,KAAK,MAAM,WAAW,KAAK;AAAA,IAClC;AAEA,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AAEJ,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC;AACrD,SAAK,KAAK,MAAM,WAAW,KAAK;AAEhC,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,gBAAgB,SAAyB,OAAqB;AAClE,UAAM,SAAS,QAAQ;AACvB,UAAM,EAAE,MAAM,IAAI;AAClB,UAAM,UAAU,OAAO,GAAG,KAAK;AAE/B,SAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,QAAQ,CAAC;AAEjE,UAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK;AAG1G,QAAI,QAAQ,WAAW,SAAS,CAAC,OAAO;AACtC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAGA,QAAI,OAAO;AACT,YAAMA,UAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,UAAI,CAACA,WAAUA,QAAO,QAAS,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AACxE,UAAIA,QAAO,aAAa,IAAI,KAAKA,QAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,MACzC;AAEA,UAAI,CAAC,KAAK,mBAAmB,OAAO,GAAG;AACrC,YAAIA,QAAO,eAAe,YAAY;AACpC,iBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,QACjE;AACA,YAAIA,QAAO,eAAe,YAAY;AACpC,cAAI,CAAC,KAAK,YAAY,SAAS,KAAK,GAAG;AACrC,mBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,UAC9D;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,SAASA,SAAQ,SAAS,KAAK,SAAS,KAAK;AAAA,IAC3D;AAGA,UAAM,SAAS,KAAK,KAAK,MAAM,IAAI,KAAK;AACxC,QAAI,UAAU,CAAC,OAAO,gBAAgB;AACpC,WAAK,KAAK,OAAO,KAAK,qBAAqB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,cAAc,OAAO,QAAQ,aAAa,CAAC;AAC9H,aAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,OAAO,iBAAiB,EAAE,UAAU,WAAW,aAAa,IAAI,WAAW,IAAI,aAAa,KAAK,GAAG,OAAO,QAAQ,QAAQ,KAAK;AAAA,IACzL;AACA,SAAK,KAAK,OAAO,KAAK,mCAAmC,EAAE,MAAM,CAAC;AAGlE,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,SAAS;AAC7B,WAAK,KAAK,OAAO,KAAK,sCAAsC,EAAE,OAAO,OAAO,CAAC,CAAC,QAAQ,SAAS,QAAQ,QAAQ,CAAC;AAChH,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AAAA,IAC3C;AACA,QAAI,OAAO,aAAa,IAAI,KAAK,OAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,WAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,WAAW,OAAO,UAAU,CAAC;AACrF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,IACzC;AAEA,SAAK,KAAK,OAAO,KAAK,wBAAwB;AAAA,MAC5C;AAAA,MACA,QAAQ,OAAO,QAAQ;AAAA,MACvB,cAAc,OAAO,QAAQ;AAAA,MAC7B,YAAY,OAAO;AAAA,MACnB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,IACpB,CAAC;AAGD,UAAM,aAAa,KAAK,mBAAmB,OAAO;AAClD,QAAI,CAAC,YAAY;AAEf,UAAI,OAAO,eAAe,YAAY;AACpC,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MACjE;AACA,UAAI,OAAO,eAAe,YAAY;AACpC,cAAM,WAAW,KAAK,YAAY,SAAS,KAAK;AAChD,YAAI,CAAC,UAAU;AACb,eAAK,KAAK,OAAO,KAAK,uDAAuD,EAAE,MAAM,CAAC;AACtF,eAAK,KAAK,MAAM,IAAI,OAAO;AAAA,YACzB,SAAS,OAAO;AAAA,YAChB,gBAAgB;AAAA,YAChB,eAAe,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AAAA,UAC5I,CAAC;AACD,iBAAO,MAAM,KAAK,WAAW,EAAE,KAAK,KAAK,cAAc,KAAK,CAAC;AAAA,QAC/D;AACA,aAAK,KAAK,OAAO,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC9D;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,MAAM;AAC7B,YAAM,KAAK,MAAM,KAAK,KAAK,MAAM,sBAAsB,KAAK;AAC5D,UAAI,CAAC,GAAI,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,sBAAsB;AAAA,IAC/D,OAAO;AACL,WAAK,KAAK,MAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACvD;AAGA,UAAM,gBAAgB,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AACjJ,SAAK,KAAK,MAAM,IAAI,OAAO;AAAA,MACzB,SAAS,OAAO;AAAA,MAChB,gBAAgB,OAAO,eAAe,cAAc,CAAC;AAAA,MACrD;AAAA,IACF,CAAC;AAED,WAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,eAAe,OAAO,QAAQ,QAAQ,KAAK;AAAA,EACpG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAkB,SAAyB,OAAqB;AACpE,UAAM,SAAS,QAAQ;AACvB,UAAM,WAAW,OAAO;AACxB,UAAM,cAAc,OAAO;AAC3B,UAAM,YAAY,OAAO;AACzB,UAAM,UAAW,OAAO,GAAG,KAAK;AAEhC,UAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK;AAG1G,QAAI,QAAQ,WAAW,SAAS,CAAC,OAAO;AACtC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAGA,QAAI,OAAO;AACT,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,aAAa;AAAA,QACvB;AAAA,QAAU;AAAA,QAAa;AAAA,QAAW,aAAa;AAAA,QAC/C,cAAc;AAAA,MAChB,GAAG,SAAS,KAAK,SAAS,KAAK;AAAA,IACjC;AAEA,UAAM,SAAS,qBAAqB,KAAK,WAAW,UAAU,aAAa,SAAS;AACpF,WAAO,KAAK;AAAA,MAAiB;AAAA,MAAQ;AAAA,MAAS;AAAA,MAAO,MAAM,QAAQ,IAAI,WAAW,IAAI,SAAS;AAAA,MAC7F,EAAE,UAAU,aAAa,WAAW,aAAa,KAAK;AAAA,MACtD,QAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,CAAC,OAAO,cAAc;AACnC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,QAAQ,MAAM,OAAO,QAAQ,UAAU,OAAO,YAAa;AACjE,QAAI,CAAC,OAAO;AACV,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAEA,UAAM,aAAa;AAAA,MACjB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS;AAChC,iBAAW,KAAK,QAAQ;AAAA,IAC1B;AACA,UAAM,OAAO,cAAc,WAAW,KAAK,IAAI,CAAC;AAChD,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEQ,mBAAmB,SAAkC;AAC3D,UAAM,OAAQ,QAAgB;AAC9B,QAAI,QAAQ,KAAK,GAAI,QAAO;AAE5B,UAAM,SAAS,QAAQ,QAAQ,UAAU,QAAQ,QAAQ;AACzD,QAAI,QAAQ;AACV,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,IAAI,IAAI,MAAM;AACnC,YAAI,aAAa,QAAQ,SAAU,QAAO;AAAA,MAC5C,QAAQ;AAAA,MAAkB;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,YAAY,SAAyB,OAAwB;AACnE,UAAM,SAAS,QAAQ,QAAQ,UAAU;AACzC,WAAO,OAAO,SAAS,gBAAgB,KAAK,IAAI;AAAA,EAClD;AAAA;AAAA,EAGQ,YAAY,MAAuB;AACzC,WAAO,kBAAkB,KAAK,IAAI;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,MAAc,UAA0B;AAC7D,QAAI,WAAW,KAAK,IAAI,EAAG,QAAO;AAClC,UAAM,UAAU,eAAe,QAAQ;AACvC,WAAO,KAAK,SAAS,QAAQ,IAAI,KAAK,QAAQ,UAAU,SAAS,OAAO,EAAE,IAAI,UAAU;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBACZ,QACA,cACA,OACA,eACA,eACA,aACA;AACA,UAAM,YAAY,aAAa,QAAQ,QAAQ,EAAE;AACjD,UAAM,YAAY,CAAC,YACf,eACA,KAAK,YAAY,SAAS,IACxB,YACA,GAAG,SAAS;AAElB,UAAM,UAA2B,EAAE,QAAQ,cAAc,GAAG;AAE5D,QAAI;AACJ,QAAI;AAEF,YAAM,WAAW,KAAK,KAAK,eAAe,mBAAmB;AAC7D,YAAM,MAAM,SAAS,oBAAoB,EAAE,QAAQ,EAAE,GAAG,SAAS,cAAc,UAAU,CAAC;AAAA,IAC5F,QAAQ;AAEN,UAAI,CAAC,cAAe,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAClE,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,UAClE,cAAc,cAAc,eAAe;AAAA,UAC3C,WAAW;AAAA,UACX,UAAU,cAAc;AAAA,UACxB,aAAa,cAAc;AAAA,UAC3B,WAAW,cAAc;AAAA,QAC3B,CAAC;AACD,cAAM,MAAM,QAAQ,KAAK,aAAa,EAAE,MAAM,YAAY,SAAS,GAAG,CAAC;AAAA,MACzE,QAAQ;AACN,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAAA,MAChD;AAAA,IACF;AAEA,UAAM,WAAW,UAAU,MAAM,GAAG,EAAE,IAAI,KAAK;AAC/C,UAAM,cAAc,2BAA2B,QAAQ;AAGvD,QAAI,iBAAiB,KAAK,QAAQ,GAAG;AACnC,YAAM,UAAU,YACX,KAAK,YAAY,SAAS,IAAI,UAAU,QAAQ,UAAU,EAAE,IAAI,YACjE;AACJ,YAAM,WAAW,GAAG,aAAa,GAAG,UAAU,MAAM,UAAU,EAAE;AAChE,YAAM,OAAO;AAAA,QACX,KAAK,eAAe,IAAI,SAAS,OAAO,GAAG,QAAQ;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,WAAO,oBAAoB,OAAO,KAAK,aAAa,aAAa;AAAA,MAC/D,uBAAuB,4BAA4B,mBAAmB,QAAQ,CAAC;AAAA,MAC/E,+BAA+B;AAAA,IACjC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WACZ,SACA,OACA,SACA,eACA,OACA,aACA;AACA,UAAM,eAAe,UACjB,KAAK,oBAAoB,QAAQ,cAAc,OAAO,IACtD,QAAQ;AACZ,WAAO,KAAK;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM,KAAK;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,SACZ,QACA,YACA,KACA,SACA,OACA;AACA,UAAM,WAAW,KAAK,YAAY,OAAO,QAAQ,YAAY,IACzD,KACA,GAAG,OAAO,QAAQ,YAAY;AAClC,WAAO,KAAK,aAAa;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,MACpB,cAAc,WAAW;AAAA,MACzB,YAAY,OAAO;AAAA,IACrB,GAAG,YAAY,KAAK,SAAS,KAAK;AAAA,EACpC;AAAA,EAEA,MAAc,aACZ,QAQA,YACA,KACA,SACA,OACA;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,QAC5D,cAAc,OAAO,eAAe;AAAA,QACpC,WAAW;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,MAAM,wCAAwC,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAChG,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sBAAsB,CAAC;AAAA,IAChE;AAEA,UAAM,aAAa,YAAY,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,OAAO,WAAW,UAAU,KAAK,QAAQ,UAAU;AAGvE,UAAM,WAAW,QAAQ,IAAI,SAAS,GAAG,IAAK,QAAQ,IAAe,MAAM,GAAG,EAAE,CAAC,IAAI;AACrF,UAAM,WAAmC,CAAC;AAC1C,QAAI,UAAU;AACZ,iBAAW,CAAC,GAAG,CAAC,KAAK,IAAI,gBAAgB,QAAQ,GAAG;AAClD,iBAAS,CAAC,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,UAAW,QAAQ,QAAmB;AAE5C,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK,UAAU,QAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,MACpE,oBAAoB,QAAQ,QAAQ,MAAM,OAAO,CAAC;AAAA,MAClD,sBAAsB,QAAQ,MAAM;AAAA,MACpC,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,kBAAkB,KAAK,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,MAChI,yBAAyB,OAAO,QAAQ;AAAA,MACxC,4BAA4B,OAAO,eAAe,EAAE;AAAA,MACpD,0BAA0B,KAAK,kBAAkB,QAAQ,MAAM,MAAM,CAAC;AAAA,IACxE,EAAE,KAAK,MAAM;AAEb,UAAM,UAAU,GAAG,OAAO,OAAO,GAAG;AAEpC,SAAK,KAAK,OAAO,KAAK,cAAc,EAAE,YAAY,KAAK,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;AAE7E,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,MAAM,YAAY,EAAE,SAAS,QAAQ,CAAC;AAEnE,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,MAAM,OAAO,QAAQ,KAAK,KAAK,IAAI;AAAA,MACjD,QAAQ;AACN,eAAO,EAAE,QAAQ,OAAO,QAAQ,KAAK,KAAK,GAAG;AAAA,MAC/C;AACA,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,kBAAkB,EAAE,KAAK,IAAI;AAAA,IAC7D,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,KAAK,qBAAqB,EAAE,YAAY,OAAQ,IAAc,QAAQ,CAAC;AACxF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAAA,IACjE;AAAA,EACF;AAAA,EAEQ,oBAAoB,WAAmB,SAAyB;AACtE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACnE,QAAI,QAAQ,WAAW,YAAY,GAAG,KAAK,YAAY,UAAW,QAAO;AACzE,UAAM,WAAW,KAAK,YAAY,SAAS,IACvC,UAAU,QAAQ,UAAU,EAAE,IAC9B,YAAY;AAChB,YAAQ,WAAW,SAAS,QAAQ,QAAQ,GAAG;AAAA,EACjD;AAAA,EAEQ,cAAc,OAAuB;AAC3C,WAAO,8tCAA8tC,KAAK;AAAA,EAC5uC;AAAA,EAEQ,kBACN,aACA,QAMQ;AAER,UAAM,EAAE,cAAc,IAAI;AAG1B,WAAO,cAAc;AAAA,MACnB,MAAM;AAAA,MACN,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,OAAO,CAAC,cAAc,cAAc,eAAe,YAAY;AAAA,QACjE;AAAA,QACA,GAAG,wBAAwB,OAAO,UAAU;AAAA,MAC9C;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":["record"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/gateway",
-  "version": "4.3.2",
+  "version": "4.4.0",
   "main": "dist/index.js",
   "files": [
     "dist"
@@ -48,11 +48,11 @@
     "uuid": "^9.0.1",
     "web-push": "^3.6.7",
     "zod": "3.25.76",
-    "@axiom-lattice/cli-a2a": "0.2.11",
-    "@axiom-lattice/core": "4.2.16",
-    "@axiom-lattice/pg-stores": "3.1.16",
-    "@axiom-lattice/protocols": "4.3.1",
-    "@axiom-lattice/queue-redis": "1.1.11"
+    "@axiom-lattice/cli-a2a": "0.2.13",
+    "@axiom-lattice/core": "4.3.0",
+    "@axiom-lattice/pg-stores": "3.1.18",
+    "@axiom-lattice/protocols": "4.4.0",
+    "@axiom-lattice/queue-redis": "1.1.13"
   },
   "devDependencies": {
     "@types/bcrypt": "^6.0.0",
@@ -68,13 +68,14 @@
     "@typescript-eslint/parser": "^7.2.0",
     "eslint": "^8.57.0",
     "jest": "^29.7.0",
+    "langchain": "1.0.6",
     "nodemon": "^3.1.9",
     "ts-jest": "^29.4.0",
     "ts-node": "^10.9.2",
     "tsconfig-paths": "^4.2.0",
     "tsup": "^8.5.0",
     "typescript": "^5.8.2",
-    "@axiom-lattice/react-sdk": "4.2.2"
+    "@axiom-lattice/react-sdk": "4.3.0"
   },
   "scripts": {
     "build": "tsup src/index.ts --format cjs,esm --dts --clean --sourcemap && pnpm copy:embed-assets",
@@ -84,6 +85,8 @@
     "lint": "eslint src",
     "test": "jest",
     "test:watch": "jest --watch",
-    "test:coverage": "jest --coverage"
+    "test:coverage": "jest --coverage",
+    "test:live:mcp": "tsx scripts/live-mcp-e2e.ts",
+    "test:e2e:mcp-app": "tsx scripts/mcp-app-e2e.ts"
   }
 }

package/dist/a2a-standard-ALXWP7V6.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/routes/a2a-standard.ts","../src/services/a2a/A2ATaskStoreAdapter.ts","../src/services/a2a/AxiomAgentExecutor.ts","../src/services/a2a/a2aFileRefs.ts","../src/services/a2a/A2AFileIngestor.ts","../src/services/a2a/A2ARuntimeRegistry.ts"],"sourcesContent":["import type { FastifyInstance, FastifyRequest } from \"fastify\";\nimport { v4 as uuidv4 } from \"uuid\";\nimport {\n  A2AError,\n  DefaultExecutionEventBus,\n  DefaultRequestHandler,\n  InMemoryTaskStore,\n  JsonRpcTransportHandler,\n  RequestContext,\n} from \"@a2a-js/sdk/server\";\nimport type { AgentExecutionEvent } from \"@a2a-js/sdk/server\";\nimport type { JSONRPCResponse, Message } from \"@a2a-js/sdk\";\nimport { createTaskLifecycleService, getStoreLattice } from \"@axiom-lattice/core\";\nimport type {\n  Assistant,\n  AssistantStore,\n  ProjectStore,\n  TaskStore,\n  TaskWorkItemStore,\n  TenantStore,\n} from \"@axiom-lattice/protocols\";\nimport { A2AAuthError } from \"../services/a2a/A2AAuthService\";\nimport type { A2AAuthService } from \"../services/a2a/A2AAuthService\";\nimport { buildAgentCardForAssistant } from \"../services/a2a/A2AAgentCardBuilder\";\nimport { A2ATaskStoreAdapter } from \"../services/a2a/A2ATaskStoreAdapter\";\nimport type { A2ATaskLifecycleAdapter, A2ATaskStore } from \"../services/a2a/A2ATaskStoreAdapter\";\nimport { AxiomAgentExecutor, assistantHasGovernedTask } from \"../services/a2a/AxiomAgentExecutor\";\nimport { A2AFileIngestor } from \"../services/a2a/A2AFileIngestor\";\nimport {\n  A2ARuntimeCapacityError,\n  A2ARuntimeRegistry,\n} from \"../services/a2a/A2ARuntimeRegistry\";\nimport { saveProjectFile } from \"../services/workspace-file-service\";\n\n/** Stores injectable into the standard A2A routes (overridable in tests). */\nexport interface A2AStandardRoutesDeps {\n  authService: A2AAuthService;\n  /** Returns the internal task store (default: `getStoreLattice(\"default\",\"task\").store`). */\n  getTaskStoreLattice?: () => TaskStore;\n  /** Returns the work-item store used for governed A2A observations and lifecycle events. */\n  getTaskWorkItemStore?: () => TaskWorkItemStore;\n  /** Returns the assistant store (default: `getStoreLattice(\"default\",\"assistant\").store`). */\n  getAssistantStore?: () => AssistantStore;\n  /** Returns the project store (used by test-call to scope the request's project to the tenant). */\n  getProjectStore?: () => ProjectStore;\n  /** Returns the tenant store (used by agent-card discovery for cross-tenant fallback). */\n  getTenantStore?: () => TenantStore | undefined;\n  /**\n   * Maximum decoded byte size accepted per inline file; defaults to the\n   * {@link A2AFileIngestor} default (10 MiB). Exposed for testability.\n   */\n  maxFileBytes?: number;\n  /** Gateway-lifetime scoped runtime registry; injectable for lifecycle tests. */\n  runtimeRegistry?: A2ARuntimeRegistry;\n}\n\nfunction getHeader(value: string | string[] | undefined): string | undefined {\n  if (Array.isArray(value)) return value[0];\n  return value;\n}\n\n/** Session user parsed by the gateway global preHandler from the `Authorization` header. */\nfunction getSessionUser(\n  request: FastifyRequest,\n): { id: string; tenantId?: string } | undefined {\n  return (request as unknown as { user?: { id: string; tenantId?: string } })\n    .user;\n}\n\n/**\n * Resolve the request tenant for session-aware discovery: prefer the session\n * user's tenant, then fall back to the `x-tenant-id` header, then `\"default\"`.\n */\nfunction buildBaseUrl(request: FastifyRequest): string {\n  const protocol =\n    getHeader(request.headers[\"x-forwarded-proto\"]) ?? request.protocol;\n  const forwardedHost = getHeader(request.headers[\"x-forwarded-host\"]);\n  const host = forwardedHost\n    ? forwardedHost.split(\",\")[0]!.trim()\n    : request.host;\n  return `${protocol}://${host}`;\n}\n\n/**\n * Build a per-request file ingestor, binding the request's tenant onto the\n * shared `saveProjectFile` service (whose signature requires `tenantId`).\n */\nfunction makeFileIngestor(\n  tenantId: string,\n  maxFileBytes?: number,\n): A2AFileIngestor {\n  return new A2AFileIngestor({\n    saveProjectFile: (params) =>\n      saveProjectFile({ tenantId, ...params }),\n    ...(maxFileBytes !== undefined ? { maxBytes: maxFileBytes } : {}),\n  });\n}\n\nfunction extractRequestId(body: unknown): string | number | null {\n  if (typeof body === \"object\" && body !== null && \"id\" in body) {\n    const id = (body as { id?: unknown }).id;\n    if (typeof id === \"string\" || typeof id === \"number\" || id === null) {\n      return id;\n    }\n  }\n  return null;\n}\n\n/** Map an auth failure status onto a JSON-RPC server error code. */\nfunction authErrorToRpcCode(statusCode: number): number {\n  switch (statusCode) {\n    case 401:\n      return -32001;\n    case 403:\n      return -32002;\n    case 404:\n      return -32003;\n    default:\n      return -32603;\n  }\n}\n\nfunction jsonRpcError(\n  id: string | number | null,\n  code: number,\n  message: string,\n): JSONRPCResponse {\n  return { jsonrpc: \"2.0\", id, error: { code, message } };\n}\n\nfunction isAsyncGenerator(\n  value: JSONRPCResponse | AsyncGenerator<JSONRPCResponse, void, undefined>,\n): value is AsyncGenerator<JSONRPCResponse, void, undefined> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    typeof (value as unknown as { [Symbol.asyncIterator]?: unknown })[\n      Symbol.asyncIterator\n    ] === \"function\"\n  );\n}\n\nconst SSE_HEADERS: Record<string, string> = {\n  \"Content-Type\": \"text/event-stream\",\n  \"Cache-Control\": \"no-cache\",\n  Connection: \"keep-alive\",\n  \"Access-Control-Allow-Origin\": \"*\",\n  \"A2A-Version\": \"0.3\",\n};\n\n/**\n * Register the standard A2A 0.3 endpoints for per-assistant discovery and\n * execution: agent card, JSON-RPC (`message/send`, `message/stream`,\n * `tasks/get`, `tasks/cancel`), and an internal `test-call` management route.\n */\nexport function registerA2AStandardRoutes(\n  app: FastifyInstance,\n  deps: A2AStandardRoutesDeps,\n): void {\n  const authService = deps.authService;\n  const resolveTasks =\n    deps.getTaskStoreLattice ??\n    (() => getStoreLattice(\"default\", \"task\").store as TaskStore);\n  const resolveTaskWorkItems = deps.getTaskWorkItemStore ??\n    (() => getStoreLattice(\"default\", \"taskWorkItem\").store as TaskWorkItemStore);\n  const getAssistantStore =\n    deps.getAssistantStore ??\n    (() => getStoreLattice(\"default\", \"assistant\").store as AssistantStore);\n  const getProjectStore =\n    deps.getProjectStore ??\n    (() => getStoreLattice(\"default\", \"project\").store as ProjectStore);\n  const runtimeRegistry = deps.runtimeRegistry ?? new A2ARuntimeRegistry();\n  app.addHook(\"onClose\", async () => {\n    runtimeRegistry.close();\n  });\n\n  // GET /api/a2a/agents/:assistantId/.well-known/agent-card.json\n  app.get<{ Params: { assistantId: string } }>(\n    \"/api/a2a/agents/:assistantId/.well-known/agent-card.json\",\n    async (request, reply) => {\n      // Card discovery is key-authenticated: the same key that authorizes\n      // jsonrpc also gates which agents are discoverable.\n      const auth = await authService.authenticate(\n        getHeader(request.headers.authorization) ??\n          getHeader(request.headers[\"x-api-key\"]),\n      );\n      if (!auth.authenticated) {\n        reply.status(401).send({ error: \"Unauthorized\" });\n        return;\n      }\n\n      let assistant: Assistant;\n      try {\n        assistant = await authService.assertAgentAccess(\n          auth,\n          request.params.assistantId,\n        );\n      } catch (err) {\n        if (err instanceof A2AAuthError) {\n          reply.status(err.statusCode).send({ error: err.message });\n          return;\n        }\n        request.log.error({ err }, \"a2a:agent-card:auth\");\n        reply.status(500).send({ error: \"Internal error\" });\n        return;\n      }\n\n      reply.header(\"A2A-Version\", \"0.3\");\n      reply\n        .status(200)\n        .send(\n          buildAgentCardForAssistant({\n            assistant,\n            baseUrl: buildBaseUrl(request),\n          }),\n        );\n    },\n  );\n\n  // POST /api/a2a/agents/:assistantId/jsonrpc\n  app.post<{ Params: { assistantId: string } }>(\n    \"/api/a2a/agents/:assistantId/jsonrpc\",\n    async (request, reply) => {\n      const requestId = extractRequestId(request.body);\n      const auth = await authService.authenticate(\n        getHeader(request.headers.authorization) ??\n          getHeader(request.headers[\"x-api-key\"]),\n      );\n\n      if (!auth.authenticated) {\n        reply.status(401).send(jsonRpcError(requestId, -32001, \"Unauthorized\"));\n        return;\n      }\n\n      let assistant: Assistant;\n      try {\n        assistant = await authService.assertAgentAccess(\n          auth,\n          request.params.assistantId,\n        );\n      } catch (err) {\n        if (err instanceof A2AAuthError) {\n          reply\n            .status(err.statusCode)\n            .send(\n              jsonRpcError(\n                requestId,\n                authErrorToRpcCode(err.statusCode),\n                err.message,\n              ),\n            );\n          return;\n        }\n        request.log.error({ err }, \"a2a:jsonrpc:auth\");\n        reply\n          .status(500)\n          .send(jsonRpcError(requestId, -32603, \"Internal error\"));\n        return;\n      }\n\n      const scope = {\n        tenantId: auth.tenantId ?? \"default\",\n        projectId: auth.projectId ?? \"\",\n        assistantId: assistant.id,\n      };\n      const internalTasks = resolveTasks();\n      const workItems = resolveTaskWorkItems();\n      // Governed agents persist A2A tasks as platform TaskItems; plain agents\n      // use an SDK in-memory A2A task store (no TaskMiddleware required).\n      const taskStore: A2ATaskStore = assistantHasGovernedTask(assistant)\n        ? new A2ATaskStoreAdapter({\n            taskStore: internalTasks,\n            workItemStore: workItems,\n            lifecycle: createTaskLifecycleService({\n              taskStore: internalTasks,\n              workItemStore: workItems,\n            }) as unknown as A2ATaskLifecycleAdapter,\n            scope,\n          })\n        : (new InMemoryTaskStore() as unknown as A2ATaskStore);\n      const ingestor = makeFileIngestor(scope.tenantId, deps.maxFileBytes);\n      const executor = new AxiomAgentExecutor({ scope, assistant, taskStore, ingestor });\n      const card = buildAgentCardForAssistant({\n        assistant,\n        baseUrl: buildBaseUrl(request),\n      });\n      let runtimeLease;\n      try {\n        runtimeLease = runtimeRegistry.acquire(scope);\n      } catch (err) {\n        if (err instanceof A2ARuntimeCapacityError) {\n          request.log.error({ err, scope }, \"a2a:jsonrpc:runtime_capacity\");\n          reply\n            .status(503)\n            .send(jsonRpcError(requestId, -32603, \"A2A runtime capacity exhausted\"));\n          return;\n        }\n        throw err;\n      }\n      let result: JSONRPCResponse | AsyncGenerator<JSONRPCResponse, void, undefined>;\n      try {\n        const handler = new DefaultRequestHandler(\n          card,\n          taskStore,\n          executor,\n          runtimeLease.manager,\n        );\n        const transport = new JsonRpcTransportHandler(handler);\n        reply.header(\"A2A-Version\", \"0.3\");\n        result = await transport.handle(request.body);\n      } catch (err) {\n        runtimeLease.release();\n        request.log.error({ err }, \"a2a:jsonrpc:handler\");\n        reply\n          .status(500)\n          .send(jsonRpcError(requestId, -32603, \"Internal error\"));\n        return;\n      }\n\n      if (isAsyncGenerator(result)) {\n        reply.hijack();\n        reply.raw.writeHead(200, SSE_HEADERS);\n        try {\n          for await (const evt of result) {\n            reply.raw.write(`data: ${JSON.stringify(evt)}\\n\\n`);\n          }\n        } catch (err) {\n          request.log.error({ err }, \"a2a:jsonrpc:stream\");\n          const errorResponse = {\n            jsonrpc: \"2.0\" as const,\n            id: requestId,\n            error: A2AError.internalError(\n              err instanceof Error ? err.message : \"Streaming error.\",\n            ).toJSONRPCError(),\n          };\n          reply.raw.write(`event: error\\ndata: ${JSON.stringify(errorResponse)}\\n\\n`);\n        } finally {\n          runtimeLease.release();\n          reply.raw.end();\n        }\n        return;\n      }\n\n      runtimeLease.release();\n      reply.send(result);\n    },\n  );\n\n  // POST /api/a2a/agents/:assistantId/test-call\n  app.post<{\n    Params: { assistantId: string };\n    Body: { projectId?: string; message?: string };\n  }>(\n    \"/api/a2a/agents/:assistantId/test-call\",\n    async (request, reply) => {\n      const user = getSessionUser(request);\n      if (!user?.tenantId) {\n        reply.status(401).send({ success: false, error: \"Unauthorized\" });\n        return;\n      }\n      const tenantId = user.tenantId;\n      const body = request.body ?? {};\n      const { projectId, message } = body;\n\n      if (!projectId) {\n        reply.status(400).send({ error: \"projectId is required\" });\n        return;\n      }\n      if (!message || !message.trim()) {\n        reply.status(400).send({ error: \"message is required\" });\n        return;\n      }\n\n      const assistant = await getAssistantStore().getAssistantById(\n        tenantId,\n        request.params.assistantId,\n      );\n      if (!assistant) {\n        reply.status(404).send({ error: \"Assistant not found\" });\n        return;\n      }\n\n      const project = await getProjectStore().getProjectById(\n        tenantId,\n        projectId,\n      );\n      if (!project || project.tenantId !== tenantId) {\n        reply.status(403).send({ error: \"Project not found\" });\n        return;\n      }\n\n      const scope = {\n        tenantId,\n        projectId,\n        assistantId: assistant.id,\n      };\n      const ingestor = makeFileIngestor(scope.tenantId, deps.maxFileBytes);\n      const internalTasks = resolveTasks();\n      const workItems = resolveTaskWorkItems();\n      // Governed agents persist A2A tasks as platform TaskItems; plain agents\n      // use an SDK in-memory A2A task store (no TaskMiddleware required).\n      const taskStore: A2ATaskStore = assistantHasGovernedTask(assistant)\n        ? new A2ATaskStoreAdapter({\n            taskStore: internalTasks,\n            workItemStore: workItems,\n            lifecycle: createTaskLifecycleService({\n              taskStore: internalTasks,\n              workItemStore: workItems,\n            }) as unknown as A2ATaskLifecycleAdapter,\n            scope,\n          })\n        : (new InMemoryTaskStore() as unknown as A2ATaskStore);\n      const executor = new AxiomAgentExecutor({ scope, assistant, taskStore, ingestor });\n\n      const taskId = uuidv4();\n      const contextId = uuidv4();\n      const userMessage: Message = {\n        kind: \"message\",\n        messageId: uuidv4(),\n        role: \"user\",\n        parts: [{ kind: \"text\", text: message }],\n      };\n      const requestContext = new RequestContext(userMessage, taskId, contextId);\n      const bus = new DefaultExecutionEventBus();\n\n      reply.hijack();\n      reply.raw.writeHead(200, SSE_HEADERS);\n\n      const sendEvent = (event: string, data: unknown): void => {\n        reply.raw.write(`event: ${event}\\ndata: ${JSON.stringify(data)}\\n\\n`);\n      };\n\n      bus.on(\"event\", (event: AgentExecutionEvent) => {\n        sendEvent(event.kind, event);\n      });\n\n      try {\n        await executor.execute(requestContext, bus);\n      } catch (err) {\n        request.log.error({ err }, \"a2a:test-call:execution\");\n        sendEvent(\"status-update\", {\n          kind: \"status-update\",\n          taskId,\n          contextId,\n          status: { state: \"failed\", timestamp: new Date().toISOString() },\n          final: true,\n        });\n      } finally {\n        reply.raw.end();\n      }\n    },\n  );\n}\n","import { createHash } from \"node:crypto\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport type { LifecycleResult } from \"@axiom-lattice/core\";\nimport type {\n  A2AMessage,\n  A2APart,\n  A2ATask,\n  A2ATaskState,\n  TaskFileRef,\n  TaskItem,\n  TaskStore,\n  TaskWorkItemStore,\n} from \"@axiom-lattice/protocols\";\n\n/**\n * Projection from A2A protocol `TaskState` values onto the internal\n * `TaskItem` status lifecycle. `TaskItem` is the single source of truth,\n * so each SDK state must collapse onto one of its statuses.\n */\nexport const A2A_STATE_TO_TASK_STATUS: Record<string, TaskItem[\"status\"]> = {\n  submitted: \"pending\",\n  working: \"in_progress\",\n  \"input-required\": \"interrupted\",\n  completed: \"completed\",\n  failed: \"failed\",\n  canceled: \"cancelled\",\n  rejected: \"failed\",\n};\n\n/**\n * Reverse projection used by {@link A2ATaskStoreAdapter.load} to surface the\n * current `TaskItem.status` back onto the restored SDK task's `status.state`.\n */\nexport const TASK_STATUS_TO_A2A_STATE: Record<TaskItem[\"status\"], A2ATaskState> = {\n  pending: \"submitted\",\n  in_progress: \"working\",\n  review: \"input-required\",\n  interrupted: \"input-required\",\n  completed: \"completed\",\n  failed: \"failed\",\n  cancelled: \"canceled\",\n};\n\n/**\n * Structural contract satisfied by {@link A2ATaskStoreAdapter}, mirroring the\n * `@a2a-js/sdk` `TaskStore` interface (`save` / `load`). The `context` argument\n * is the SDK `ServerCallContext`, unused by this adapter.\n */\nexport interface A2ATaskStore {\n  save(task: A2ATask, context?: unknown): Promise<void>;\n  load(taskId: string, context?: unknown): Promise<A2ATask | undefined>;\n}\n\n/** Scope captured per A2A request, used to bind tasks to the right owner. */\nexport interface A2ATaskStoreAdapterScope {\n  tenantId: string;\n  projectId: string;\n  assistantId: string;\n}\n\n/** Dependencies injected into {@link A2ATaskStoreAdapter}. */\nexport interface A2ATaskStoreAdapterOptions {\n  taskStore: TaskStore;\n  workItemStore: TaskWorkItemStore;\n  lifecycle: A2ATaskLifecycleAdapter;\n  scope: A2ATaskStoreAdapterScope;\n}\n\n/** Narrow Core lifecycle surface used to govern A2A status observations. */\nexport interface A2ATaskLifecycleAdapter {\n  startTask(input: { tenantId: string; taskId: string; actor: string; threadId?: string }): Promise<LifecycleResult>;\n  failTask(input: {\n    tenantId: string; taskId: string; failureReason: string; actor: string; threadId?: string;\n  }): Promise<LifecycleResult>;\n  interruptTask(input: {\n    tenantId: string; taskId: string; type: \"missing_input\" | \"external_dependency\" | \"user_decision\";\n    summary: string; actor: string; threadId?: string;\n  }): Promise<LifecycleResult>;\n  cancelTask(input: {\n    tenantId: string; taskId: string; actor: string; threadId?: string; summary?: string;\n  }): Promise<LifecycleResult>;\n}\n\ntype A2AArtifact = NonNullable<A2ATask[\"artifacts\"]>[number];\nconst TITLE_MAX_LENGTH = 80;\n\n/** Structured failure raised when an A2A task ID belongs to another exact scope. */\nexport class A2ATaskScopeConflictError extends Error {\n  readonly code = \"A2A_TASK_SCOPE_CONFLICT\";\n  readonly taskId: string;\n\n  constructor(taskId: string) {\n    super(`A2A task ${taskId} belongs to another scope`);\n    this.name = \"A2ATaskScopeConflictError\";\n    this.taskId = taskId;\n  }\n}\n\nfunction mapTaskStatusToA2AState(status: TaskItem[\"status\"]): A2ATaskState {\n  return TASK_STATUS_TO_A2A_STATE[status];\n}\n\nfunction asString(value: unknown): string | undefined {\n  return typeof value === \"string\" ? value : undefined;\n}\n\nfunction asStringArray(value: unknown): string[] | undefined {\n  if (!Array.isArray(value)) return undefined;\n  const strings = value.filter((item): item is string => typeof item === \"string\");\n  return strings.length > 0 ? strings : undefined;\n}\n\nfunction extractText(parts: A2APart[]): string {\n  return parts\n    .filter((part): part is Extract<A2APart, { kind: \"text\" }> => part.kind === \"text\")\n    .map((part) => part.text)\n    .join(\"\\n\");\n}\n\nfunction truncate(text: string, maxLength: number): string {\n  if (text.length <= maxLength) return text;\n  return `${text.slice(0, maxLength)}…`;\n}\n\nfunction extractTitleAndDescription(task: A2ATask): {\n  title: string;\n  description: string;\n} {\n  const firstUserMessage = task.history?.find((message) => message.role === \"user\");\n  const text = firstUserMessage ? extractText(firstUserMessage.parts) : \"\";\n  return {\n    title: truncate(text, TITLE_MAX_LENGTH),\n    description: text ? [\n      \"## Objective\",\n      \"\",\n      text,\n      \"\",\n      \"## Acceptance Criteria\",\n      \"\",\n      \"Complete the requested work and return the result through A2A.\",\n    ].join(\"\\n\") : \"\",\n  };\n}\n\nfunction isFileRef(value: unknown): value is TaskFileRef {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    typeof (value as TaskFileRef).uri === \"string\"\n  );\n}\n\nfunction artifactFileRefs(artifacts: A2AArtifact[] | undefined): TaskFileRef[] {\n  const refs: TaskFileRef[] = [];\n  for (const artifact of artifacts ?? []) {\n    for (const part of artifact.parts) {\n      if (part.kind !== \"file\") continue;\n      const file = part.file;\n      if (!(\"uri\" in file)) continue;\n      refs.push({\n        uri: file.uri,\n        ...(file.name ? { name: file.name } : {}),\n        ...(file.mimeType ? { mimeType: file.mimeType } : {}),\n        addedBy: \"agent\",\n      });\n    }\n  }\n  return refs;\n}\n\nfunction extractFiles(task: A2ATask): TaskFileRef[] {\n  const inputFiles = task.metadata?.inputFiles;\n  const inputRefs = Array.isArray(inputFiles) ? inputFiles.filter(isFileRef) : [];\n  return [...inputRefs, ...artifactFileRefs(task.artifacts)];\n}\n\nfunction extractArtifactText(artifacts: A2AArtifact[] | undefined): string {\n  return (artifacts ?? [])\n    .map((artifact) => extractText(artifact.parts))\n    .filter((text) => text.length > 0)\n    .join(\"\\n\");\n}\n\n/**\n * Derive the result text from the final agent turn in the task history.\n *\n * The executor streams agent output as incremental `working` status-update\n * messages (one per chunk), so a text-only result is present as a sequence of\n * agent messages after the last user message rather than as an artifact.\n */\nfunction extractFinalTurnAgentText(history: A2AMessage[] | undefined): string {\n  const messages = history ?? [];\n  let lastUserIndex = -1;\n  for (let i = 0; i < messages.length; i += 1) {\n    if (messages[i].role === \"user\") lastUserIndex = i;\n  }\n  return messages\n    .slice(lastUserIndex + 1)\n    .filter((message) => message.role === \"agent\")\n    .map((message) => extractText(message.parts))\n    .filter((text) => text.length > 0)\n    .join(\"\");\n}\n\nfunction isFailureState(state: A2ATaskState): boolean {\n  return state === \"failed\" || state === \"rejected\";\n}\n\nfunction extractFailureReason(task: A2ATask): string | undefined {\n  if (!isFailureState(task.status.state) || !task.status.message) return undefined;\n  return extractText(task.status.message.parts);\n}\n\nfunction observationEventKey(task: A2ATask, result?: string, failureReason?: string): string {\n  const digest = createHash(\"sha256\").update(JSON.stringify({\n    state: task.status.state,\n    timestamp: task.status.timestamp,\n    message: task.status.message,\n    result,\n    failureReason,\n  })).digest(\"hex\");\n  return `a2a-status-observation:${task.id}:${digest}`;\n}\n\nfunction snapshotEventKey(task: A2ATask): string {\n  const digest = createHash(\"sha256\").update(JSON.stringify(task)).digest(\"hex\");\n  return `a2a-task-snapshot:${task.id}:${digest}`;\n}\n\nfunction isGovernedObservation(state: A2ATaskState): boolean {\n  return state === \"completed\" || state === \"failed\" || state === \"rejected\" ||\n    state === \"input-required\" || state === \"canceled\";\n}\n\nfunction isA2ATaskSnapshot(value: unknown): value is A2ATask {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    typeof (value as A2ATask).id === \"string\" &&\n    typeof (value as A2ATask).status === \"object\" &&\n    (value as A2ATask).status !== null\n  );\n}\n\nfunction snapshotSequence(value: unknown): number | undefined {\n  return typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0\n    ? value\n    : undefined;\n}\n\n/**\n * Adapter projecting the A2A SDK's `Task` objects onto the internal `TaskStore`\n * lattice (`TaskItem` is the single lifecycle truth). Implements the SDK\n * `TaskStore` contract so `DefaultRequestHandler` can persist and restore tasks.\n *\n * A single ID is used in both directions: `TaskItem.id === SDK task.id`.\n */\nexport class A2ATaskStoreAdapter implements A2ATaskStore {\n  private readonly taskStore: TaskStore;\n  private readonly workItemStore: TaskWorkItemStore;\n  private readonly lifecycle: A2ATaskStoreAdapterOptions[\"lifecycle\"];\n  private readonly scope: A2ATaskStoreAdapterScope;\n  private readonly snapshotSequences = new Map<string, number>();\n\n  constructor(options: A2ATaskStoreAdapterOptions) {\n    this.taskStore = options.taskStore;\n    this.workItemStore = options.workItemStore;\n    this.lifecycle = options.lifecycle;\n    this.scope = options.scope;\n  }\n\n  /**\n   * Persist an SDK task by projecting it onto a `TaskItem`, creating it when\n   * the id is unseen or updating it otherwise. A full snapshot of the SDK task\n   * is stored under `context.a2aTask` so `load` can restore it.\n   */\n  async save(task: A2ATask): Promise<void> {\n    const { tenantId } = this.scope;\n    const { title, description } = extractTitleAndDescription(task);\n    const files = extractFiles(task);\n    const result =\n      task.status.state === \"completed\"\n        ? extractArtifactText(task.artifacts) ||\n          extractFinalTurnAgentText(task.history)\n        : undefined;\n    const failureReason = extractFailureReason(task);\n    const context: Record<string, unknown> = {\n      a2aContextId: task.contextId,\n      threadId: asString(task.metadata?.threadId),\n      a2aTask: task,\n    };\n\n    let existing = await this.taskStore.getById(tenantId, task.id);\n    if (existing) {\n      this.requireScope(existing, task.id);\n      await this.recordSnapshot(task, existing);\n    } else {\n      try {\n        existing = await this.taskStore.create({\n          id: task.id,\n          tenantId,\n          ownerType: \"agent\",\n          ownerId: this.scope.assistantId,\n          projectId: this.scope.projectId,\n          title,\n          description,\n          sourceId: \"a2a\",\n          status: \"pending\",\n          priority: \"medium\",\n          dependencies: asStringArray(task.metadata?.dependencies),\n          files,\n          context,\n        });\n      } catch (error) {\n        existing = await this.taskStore.getById(tenantId, task.id);\n        if (!existing) throw error;\n        this.requireScope(existing, task.id);\n      }\n      await this.recordSnapshot(task, existing);\n    }\n\n    const actor = `a2a:${this.scope.assistantId}`;\n    const threadId = asString(task.metadata?.threadId);\n    if (task.status.state === \"working\") {\n      if (existing.status === \"pending\") {\n        await this.requireLifecycleSuccess(\"start\", task.id, await this.lifecycle.startTask({\n          tenantId, taskId: task.id, actor, ...(threadId ? { threadId } : {}),\n        }));\n      }\n      return;\n    }\n    if (!isGovernedObservation(task.status.state)) return;\n    await this.recordObservation(task, existing, result, failureReason);\n    if ([\"completed\", \"failed\", \"cancelled\"].includes(existing.status)) return;\n    if (task.status.state === \"input-required\" && this.isExactInterruptionReplay(task, existing)) return;\n    if (existing.status === \"pending\") {\n      const started = await this.requireLifecycleSuccess(\"start\", task.id, await this.lifecycle.startTask({\n        tenantId, taskId: task.id, actor, ...(threadId ? { threadId } : {}),\n      }));\n      existing = started.task;\n    }\n    await this.applyObservation(task, failureReason);\n  }\n\n  private async recordSnapshot(task: A2ATask, item: TaskItem): Promise<void> {\n    const incomingSequence = snapshotSequence(task.metadata?.snapshotSequence) ?? 0;\n    const currentSequence = this.snapshotSequences.get(task.id) ?? 0;\n    const sequence = Math.max(incomingSequence, currentSequence) + 1;\n    this.snapshotSequences.set(task.id, sequence);\n    const sequencedTask: A2ATask = {\n      ...task,\n      metadata: { ...(task.metadata ?? {}), snapshotSequence: sequence },\n    };\n    const eventKey = snapshotEventKey(sequencedTask);\n    await this.workItemStore.createIfAbsentByEventKey({\n      tenantId: this.scope.tenantId,\n      taskId: task.id,\n      projectId: this.scope.projectId,\n      action: \"activity\",\n      actor: `a2a:${this.scope.assistantId}`,\n      summary: \"A2A task snapshot\",\n      detail: { type: \"a2a_task_snapshot\", snapshotSequence: sequence, eventKey, task: sequencedTask },\n      eventKey,\n      ...(asString(task.metadata?.threadId) ? { threadId: asString(task.metadata?.threadId) } : {}),\n      ...(item.workspaceId ? { workspaceId: item.workspaceId } : {}),\n    });\n  }\n\n  private async recordObservation(\n    task: A2ATask,\n    item: TaskItem,\n    result?: string,\n    failureReason?: string,\n  ): Promise<void> {\n    await this.workItemStore.createIfAbsentByEventKey({\n      tenantId: this.scope.tenantId,\n      taskId: task.id,\n      projectId: this.scope.projectId,\n      action: \"activity\",\n      actor: `a2a:${this.scope.assistantId}`,\n      summary: `A2A observed ${task.status.state}`,\n      detail: {\n        type: \"a2a_status_observation\",\n        state: task.status.state,\n        ...(result === undefined ? {} : { result }),\n        ...(failureReason === undefined ? {} : { failureReason }),\n        ...(task.status.message ? { message: extractText(task.status.message.parts) } : {}),\n      },\n      eventKey: observationEventKey(task, result, failureReason),\n      ...(asString(task.metadata?.threadId) ? { threadId: asString(task.metadata?.threadId) } : {}),\n      ...(item.workspaceId ? { workspaceId: item.workspaceId } : {}),\n    });\n  }\n\n  private async applyObservation(\n    task: A2ATask,\n    failureReason?: string,\n  ): Promise<void> {\n    const actor = `a2a:${this.scope.assistantId}`;\n    const threadId = asString(task.metadata?.threadId);\n    if (task.status.state === \"canceled\") {\n      await this.requireLifecycleSuccess(\"cancel\", task.id, await this.lifecycle.cancelTask({\n        tenantId: this.scope.tenantId, taskId: task.id, actor,\n        summary: \"A2A observed canceled\", ...(threadId ? { threadId } : {}),\n      }));\n      return;\n    }\n    if (isFailureState(task.status.state)) {\n      await this.requireLifecycleSuccess(\"fail\", task.id, await this.lifecycle.failTask({\n        tenantId: this.scope.tenantId, taskId: task.id,\n        failureReason: failureReason?.trim() || `A2A observed ${task.status.state}`,\n        actor, ...(threadId ? { threadId } : {}),\n      }));\n      return;\n    }\n    if (task.status.state === \"input-required\") {\n      await this.requireLifecycleSuccess(\"interrupt\", task.id, await this.lifecycle.interruptTask({\n        tenantId: this.scope.tenantId, taskId: task.id, type: \"missing_input\",\n        summary: task.status.message ? extractText(task.status.message.parts).trim() || \"A2A requires input\" : \"A2A requires input\",\n        actor, ...(threadId ? { threadId } : {}),\n      }));\n      return;\n    }\n\n    const canonical = await this.taskStore.getById(this.scope.tenantId, task.id);\n    if (!canonical || !this.isInScope(canonical)) {\n      throw new Error(`A2A completed observation cannot reconcile missing task ${task.id}`);\n    }\n    if (canonical.status === \"completed\") return;\n    throw new Error(\n      `A2A completed observation conflicts with canonical ${canonical.status} task ${task.id}`,\n    );\n  }\n\n  private async requireLifecycleSuccess(\n    operation: string,\n    taskId: string,\n    result: LifecycleResult,\n  ): Promise<Extract<LifecycleResult, { success: true }>> {\n    if (result.success) {\n      if (result.warnings?.length) {\n        console.warn({ event: \"a2a:lifecycle:warnings\", operation, taskId, warnings: result.warnings });\n      }\n      return result;\n    }\n    throw new Error(`A2A lifecycle ${operation} failed: ${result.code}: ${result.error}`);\n  }\n\n  private isExactInterruptionReplay(task: A2ATask, item: TaskItem): boolean {\n    const observed = task.metadata?.interruption;\n    const canonical = item.context?.interruption;\n    if (item.status !== \"interrupted\" || !canonical || typeof canonical !== \"object\") return false;\n    if (observed && typeof observed === \"object\") return isDeepStrictEqual(observed, canonical);\n    const observedSummary = task.status.message ? extractText(task.status.message.parts).trim() : \"\";\n    return observedSummary.length > 0 &&\n      (canonical as Record<string, unknown>).summary === observedSummary;\n  }\n\n  /**\n   * Restore an SDK task from the stored snapshot, overlaying the current\n   * `TaskItem.status` onto `task.status.state`. Returns `undefined` when the\n   * task is unknown to the tenant or has no A2A snapshot.\n   */\n  async load(taskId: string): Promise<A2ATask | undefined> {\n    const item = await this.taskStore.getById(this.scope.tenantId, taskId);\n    if (!item || !this.isInScope(item)) return undefined;\n\n    const pageSize = 100;\n    let selected: SnapshotCandidate | undefined;\n    for (let offset = 0; ; offset += pageSize) {\n      const activities = await this.workItemStore.list({\n        tenantId: this.scope.tenantId,\n        taskId,\n        action: \"activity\",\n        order: \"desc\",\n        limit: pageSize,\n        offset,\n      });\n      for (const activity of activities) {\n        if (activity.detail?.type !== \"a2a_task_snapshot\" || !isA2ATaskSnapshot(activity.detail.task)) continue;\n        const sequence = snapshotSequence(activity.detail.snapshotSequence) ??\n          snapshotSequence(activity.detail.task.metadata?.snapshotSequence);\n        const candidate = {\n          task: activity.detail.task,\n          sequence,\n          eventKey: asString(activity.detail.eventKey) ?? activity.eventKey ??\n            snapshotEventKey(activity.detail.task),\n          statusTimestamp: Date.parse(activity.detail.task.status.timestamp ?? \"\"),\n          createdAt: activity.createdAt,\n          id: activity.id,\n        };\n        if (!selected || this.isLaterSnapshot(candidate, selected)) selected = candidate;\n      }\n      if (activities.length < pageSize) break;\n    }\n    const snapshot = selected?.task ?? item.context?.a2aTask;\n    if (!isA2ATaskSnapshot(snapshot)) return undefined;\n    const restoredSequence = selected?.sequence ?? snapshotSequence(snapshot.metadata?.snapshotSequence);\n    if (restoredSequence !== undefined) {\n      this.snapshotSequences.set(taskId, Math.max(this.snapshotSequences.get(taskId) ?? 0, restoredSequence));\n    }\n\n    const state = mapTaskStatusToA2AState(item.status);\n    const interruption = item.context?.interruption;\n    const metadata = {\n      ...(snapshot.metadata ?? {}),\n      ...(interruption && typeof interruption === \"object\" ? { interruption } : {}),\n    };\n    const nonResultArtifacts = (snapshot.artifacts ?? []).filter((artifact) => artifact.name !== \"result\");\n    const artifacts = item.status === \"completed\" && item.result?.trim()\n      ? [...nonResultArtifacts, {\n          artifactId: `${item.id}:result`,\n          name: \"result\",\n          parts: [{ kind: \"text\" as const, text: item.result }],\n        }]\n      : nonResultArtifacts;\n    const message = state === \"failed\" && item.failureReason?.trim()\n      ? {\n          kind: \"message\" as const,\n          messageId: `${item.id}:failure`,\n          role: \"agent\" as const,\n          parts: [{ kind: \"text\" as const, text: item.failureReason }],\n        }\n      : interruption && typeof interruption === \"object\" &&\n        typeof (interruption as Record<string, unknown>).summary === \"string\"\n      ? {\n          kind: \"message\" as const,\n          messageId: `${item.id}:interruption`,\n          role: \"agent\" as const,\n          parts: [{ kind: \"text\" as const, text: (interruption as Record<string, unknown>).summary as string }],\n        }\n        : snapshot.status.message;\n    return {\n      ...snapshot,\n      metadata,\n      ...(artifacts.length > 0 ? { artifacts } : { artifacts: undefined }),\n      status: {\n        ...snapshot.status,\n        state,\n        ...(message ? { message } : {}),\n      },\n    };\n  }\n\n  private isInScope(item: TaskItem): boolean {\n    return (\n      item.tenantId === this.scope.tenantId &&\n      item.projectId === this.scope.projectId &&\n      item.ownerType === \"agent\" &&\n      item.ownerId === this.scope.assistantId &&\n      item.sourceId === \"a2a\"\n    );\n  }\n\n  private requireScope(item: TaskItem, taskId: string): void {\n    if (!this.isInScope(item)) throw new A2ATaskScopeConflictError(taskId);\n  }\n\n  private isLaterSnapshot(\n    candidate: SnapshotCandidate,\n    selected: SnapshotCandidate,\n  ): boolean {\n    if (candidate.sequence !== undefined || selected.sequence !== undefined) {\n      if (candidate.sequence === undefined) return false;\n      if (selected.sequence === undefined) return true;\n      if (candidate.sequence !== selected.sequence) return candidate.sequence > selected.sequence;\n\n      // Concurrent adapters can allocate the same sequence. This resolves that\n      // unordered conflict deterministically; it does not imply wall-clock append order.\n      const candidateTimestamp = Number.isNaN(candidate.statusTimestamp) ? Number.NEGATIVE_INFINITY : candidate.statusTimestamp;\n      const selectedTimestamp = Number.isNaN(selected.statusTimestamp) ? Number.NEGATIVE_INFINITY : selected.statusTimestamp;\n      if (candidateTimestamp !== selectedTimestamp) return candidateTimestamp > selectedTimestamp;\n      return candidate.eventKey > selected.eventKey;\n    }\n    return candidate.createdAt.getTime() > selected.createdAt.getTime() ||\n      (candidate.createdAt.getTime() === selected.createdAt.getTime() && candidate.id > selected.id);\n  }\n}\n\ninterface SnapshotCandidate {\n  task: A2ATask;\n  sequence?: number;\n  eventKey: string;\n  statusTimestamp: number;\n  createdAt: Date;\n  id: string;\n}\n","import { v4 as uuidv4 } from \"uuid\";\nimport { agentInstanceManager } from \"@axiom-lattice/core\";\nimport { MessageChunkTypes } from \"@axiom-lattice/protocols\";\nimport type { A2AMessage, A2APart, A2ATask, Assistant, TaskFileRef } from \"@axiom-lattice/protocols\";\nimport type {\n  AgentExecutor,\n  ExecutionEventBus,\n  RequestContext,\n} from \"@a2a-js/sdk/server\";\nimport type {\n  TaskArtifactUpdateEvent,\n  TaskStatusUpdateEvent,\n} from \"@a2a-js/sdk\";\nimport { filePartsToRefsWithIngest } from \"./a2aFileRefs\";\nimport type { A2AFileIngestor } from \"./A2AFileIngestor\";\nimport type { A2ATaskStore } from \"./A2ATaskStoreAdapter\";\nimport { formatFileRefsSection } from \"../files/task-file-refs\";\n\n/** Scope captured per A2A request, used to bind execution to the right owner. */\nexport interface AxiomAgentExecutorScope {\n  tenantId: string;\n  projectId: string;\n  assistantId: string;\n}\n\n/** Dependencies injected into {@link AxiomAgentExecutor}. */\nexport interface AxiomAgentExecutorOptions {\n  scope: AxiomAgentExecutorScope;\n  /** Persisted assistant definition used to preflight governed task capability. */\n  assistant: Assistant;\n  /**\n   * Task store used to resolve thread/scope info when canceling a task.\n   * Optional: execution-only harnesses (e.g. the internal `test-call` route)\n   * omit it because they do not persist TaskItems.\n   */\n  taskStore?: A2ATaskStore;\n  /**\n   * Optional bytes-ingestor for inline A2A file parts. When omitted, inline\n   * bytes parts are rejected (URI-only projection).\n   */\n  ingestor?: A2AFileIngestor;\n}\n\nfunction isoNow(): string {\n  return new Date().toISOString();\n}\n\nfunction asString(value: unknown): string | undefined {\n  return typeof value === \"string\" ? value : undefined;\n}\n\nfunction extractText(parts: A2APart[]): string {\n  return parts\n    .filter((part): part is Extract<A2APart, { kind: \"text\" }> => part.kind === \"text\")\n    .map((part) => part.text)\n    .join(\"\\n\");\n}\n\nfunction agentMessage(text: string): A2AMessage {\n  return {\n    kind: \"message\",\n    messageId: uuidv4(),\n    role: \"agent\",\n    parts: [{ kind: \"text\", text }],\n  };\n}\n\n/**\n * Whether an assistant is built for the platform's governed TaskItem flow\n * (TaskMiddleware exposing manage_task). Governed agents get TaskItem-mapped\n * A2A persistence; others get a plain A2A task store.\n */\nexport function assistantHasGovernedTask(assistant: Assistant): boolean {\n  const graph = assistant.graphDefinition;\n  const middleware = graph && typeof graph === \"object\"\n    ? (graph as { middleware?: unknown }).middleware\n    : undefined;\n  const taskMiddleware = Array.isArray(middleware)\n    ? middleware.find((entry): entry is Record<string, unknown> =>\n        !!entry && typeof entry === \"object\" &&\n        (entry as Record<string, unknown>).type === \"task\" &&\n        (entry as Record<string, unknown>).enabled === true)\n    : undefined;\n  const allowedTools = taskMiddleware?.allowedTools;\n  return !!taskMiddleware && (\n    allowedTools === undefined ||\n    (Array.isArray(allowedTools) && (allowedTools.length === 0 || allowedTools.includes(\"manage_task\")))\n  );\n}\n\n/**\n * Translates a standard A2A request into an internal agent execution and\n * projects the agent's chunk stream back onto A2A lifecycle events.\n *\n * Implements the SDK `AgentExecutor` contract so `DefaultRequestHandler` can\n * drive execution. `TaskItem` persistence is owned by the injected task store\n * adapter; this class only publishes the correct event sequence.\n *\n * This intentionally does not use the Console/WebApp execution helper: A2A\n * owns a distinct event bus, cancellation protocol, and canonical task lifecycle.\n */\nexport class AxiomAgentExecutor implements AgentExecutor {\n  private static readonly executions = new Map<string, Set<{ canceled: boolean }>>();\n  private readonly scope: AxiomAgentExecutorScope;\n  private readonly assistant: Assistant;\n  private readonly taskStore?: A2ATaskStore;\n  private readonly ingestor?: A2AFileIngestor;\n\n  constructor(options: AxiomAgentExecutorOptions) {\n    this.scope = options.scope;\n    this.assistant = options.assistant;\n    this.taskStore = options.taskStore;\n    this.ingestor = options.ingestor;\n  }\n\n  /**\n   * Execute the incoming message on the bound internal agent and publish the\n   * resulting task/status/artifact events onto the bus.\n   */\n  async execute(ctx: RequestContext, bus: ExecutionEventBus): Promise<void> {\n    const execution = { canceled: false };\n    const taskKey = this.taskKey(ctx.taskId);\n    const active = AxiomAgentExecutor.executions.get(taskKey) ?? new Set();\n    active.add(execution);\n    AxiomAgentExecutor.executions.set(taskKey, active);\n    const text = extractText(ctx.userMessage.parts);\n    const existing = ctx.task;\n    const threadId = asString(existing?.metadata?.threadId) ?? uuidv4();\n    const dependencies = ctx.referenceTasks?.map((task) => task.id) ?? [];\n\n    const createTask = (inputFiles: TaskFileRef[]): A2ATask => ({\n        kind: \"task\",\n        id: ctx.taskId,\n        contextId: ctx.contextId,\n        ...(existing?.history ? { history: existing.history } : {}),\n        ...(existing?.artifacts ? { artifacts: existing.artifacts } : {}),\n        status: { state: \"working\", timestamp: isoNow() },\n        metadata: { threadId, dependencies, inputFiles },\n      } as A2ATask);\n\n    const publishFailed = (err: unknown): void => {\n      bus.publish({\n        kind: \"status-update\",\n        taskId: ctx.taskId,\n        contextId: ctx.contextId,\n        status: {\n          state: \"failed\",\n          message: agentMessage(err instanceof Error ? err.message : String(err)),\n          timestamp: isoNow(),\n        },\n        final: true,\n      } as TaskStatusUpdateEvent);\n    };\n\n    try {\n      if (!this.taskStore) {\n        const initialTask = createTask([]);\n        bus.publish(initialTask);\n        publishFailed(new Error(\"A2A execution requires a canonical task store\"));\n        return;\n      }\n      // Governed task flow requires TaskMiddleware exposing manage_task; without\n      // it we run a plain A2A task (platform-managed lifecycle) so any agent is\n      // exposable over A2A — per the A2A spec, which mandates no middleware.\n      const governed = this.hasGovernedTaskCapability();\n\n      const interruption = existing?.metadata?.interruption;\n      const reviewInterruption = interruption && typeof interruption === \"object\" &&\n        (interruption as Record<string, unknown>).type === \"review_required\";\n      const reviewCommand = reviewInterruption\n        ? this.reviewCommand(text)\n        : undefined;\n      if (reviewInterruption && !reviewCommand) {\n        bus.publish(agentMessage(\"Review response must be exactly 'approve', 'reject', or 'reject: <note>'.\"));\n        return;\n      }\n\n      let inputFiles: TaskFileRef[];\n      try {\n        inputFiles = await filePartsToRefsWithIngest(\n          ctx.userMessage.parts,\n          \"user\",\n          this.ingestor,\n          ctx.taskId,\n          this.scope.projectId,\n        );\n      } catch (err) {\n        // Emit the initial task (without files) before the terminal status so the\n        // ResultManager has a task to attach the failure to — otherwise the\n        // failed status-update is dropped for a not-yet-persisted task.\n        const initialTask = createTask([]);\n        if (this.taskStore) await this.taskStore.save(initialTask);\n        bus.publish(initialTask);\n        publishFailed(err);\n        return;\n      }\n\n      const initialTask = createTask(inputFiles);\n      await this.taskStore.save(initialTask);\n      bus.publish(initialTask);\n      try {\n      const agent = agentInstanceManager.getAgent({\n        assistant_id: this.scope.assistantId,\n        thread_id: threadId,\n        tenant_id: this.scope.tenantId,\n        project_id: this.scope.projectId,\n      });\n\n      // Files must reach the agent, not just TaskItem metadata. There is no\n      // attachment channel on `QueueMessage`, so the references are appended\n      // to the message text as a structured \"[附件]\" section (see\n      // `formatFileRefsSection`).\n      const requestText =\n        inputFiles.length > 0\n          ? `${text}\\n\\n${formatFileRefsSection(inputFiles)}`\n          : text;\n      const messageText = governed\n        ? [\n            `A2A governed task instruction: get and update the existing TaskItem ${ctx.taskId}; do not create a replacement task.`,\n            \"Before doing the requested work, initialize its canonical description through manage_task with ## Objective, ## Acceptance Criteria, and ## Belief State sections.\",\n            \"Keep lifecycle status truthful. Change status only through manage_task set_status; complete with a nonblank result and structured beliefImpact, and use interrupted, failed, or cancelled when appropriate. Use manage_task update for content fields only.\",\n            \"\",\n            requestText,\n          ].join(\"\\n\")\n        : requestText;\n\n      const continuationCommand = interruption && typeof interruption === \"object\"\n        ? { resume: text }\n        : undefined;\n      const { messageId } = await agent.addMessage({\n        input: { message: messageText },\n        ...(reviewCommand || continuationCommand\n          ? { command: reviewCommand ?? continuationCommand }\n          : {}),\n        custom_run_config: { taskId: ctx.taskId },\n      });\n\n      const stream = agent.chunkStream(messageId, [\n        MessageChunkTypes.MESSAGE_COMPLETED,\n      ]);\n\n      let outputText = \"\";\n      let interrupted = false;\n      for await (const chunk of stream) {\n        if (execution.canceled) return;\n        const chunkType = chunk.type;\n        const chunkText = chunk.data?.content ?? \"\";\n\n        if (chunkType === MessageChunkTypes.INTERRUPT) {\n          interrupted = true;\n          break;\n        }\n\n        if (chunkType === MessageChunkTypes.AI && chunkText) {\n          outputText += chunkText;\n        }\n\n        if (\n          chunkType === MessageChunkTypes.AI ||\n          chunkType === MessageChunkTypes.TOOL\n        ) {\n          if (chunkText) {\n            bus.publish({\n              kind: \"status-update\",\n              taskId: ctx.taskId,\n              contextId: ctx.contextId,\n              status: {\n                state: \"working\",\n                message: agentMessage(chunkText),\n                timestamp: isoNow(),\n              },\n              final: false,\n            } as TaskStatusUpdateEvent);\n          }\n        }\n      }\n\n      if (execution.canceled) return;\n\n      if (!governed) {\n        if (interrupted) {\n          const paused = {\n            ...createTask(inputFiles),\n            status: { state: \"input-required\", timestamp: isoNow() },\n          } as A2ATask;\n          await this.taskStore.save(paused);\n          bus.publish({\n            kind: \"status-update\",\n            taskId: ctx.taskId,\n            contextId: ctx.contextId,\n            status: { state: \"input-required\", timestamp: isoNow() },\n            final: true,\n          } as TaskStatusUpdateEvent);\n          return;\n        }\n        const resultArtifact = {\n          artifactId: uuidv4(),\n          name: \"result\",\n          parts: [{ kind: \"text\", text: outputText }],\n        };\n        const completed = {\n          ...createTask(inputFiles),\n          artifacts: [...(existing?.artifacts ?? []), resultArtifact],\n          status: { state: \"completed\", timestamp: isoNow() },\n        } as A2ATask;\n        await this.taskStore.save(completed);\n        bus.publish({\n          kind: \"artifact-update\",\n          taskId: ctx.taskId,\n          contextId: ctx.contextId,\n          artifact: resultArtifact,\n        } as TaskArtifactUpdateEvent);\n        bus.publish({\n          kind: \"status-update\",\n          taskId: ctx.taskId,\n          contextId: ctx.contextId,\n          status: { state: \"completed\", timestamp: isoNow() },\n          final: true,\n        } as TaskStatusUpdateEvent);\n        return;\n      }\n\n      const canonical = await this.taskStore.load(ctx.taskId);\n      const canonicalState = canonical?.status.state;\n      if (canonicalState === \"completed\") {\n        const resultArtifact = canonical?.artifacts?.find((artifact) => artifact.name === \"result\");\n        if (!resultArtifact) {\n          throw new Error(`Canonical completed task ${ctx.taskId} has no result artifact`);\n        }\n        if (execution.canceled) return;\n        bus.publish({\n          kind: \"artifact-update\",\n          taskId: ctx.taskId,\n          contextId: ctx.contextId,\n          artifact: resultArtifact,\n        } as TaskArtifactUpdateEvent);\n      }\n      if (canonicalState === \"completed\" || canonicalState === \"failed\" || canonicalState === \"canceled\") {\n        if (execution.canceled) return;\n        bus.publish({\n          kind: \"status-update\",\n          taskId: ctx.taskId,\n          contextId: ctx.contextId,\n          status: {\n            state: canonicalState,\n            ...(canonical?.status.message ? { message: canonical.status.message } : {}),\n            timestamp: isoNow(),\n          },\n          final: true,\n        } as TaskStatusUpdateEvent);\n        return;\n      }\n      if (canonicalState === \"input-required\") {\n        bus.publish({\n          kind: \"status-update\",\n          taskId: ctx.taskId,\n          contextId: ctx.contextId,\n          status: {\n            state: \"input-required\",\n            ...(canonical?.status.message ? { message: canonical.status.message } : {}),\n            timestamp: isoNow(),\n          },\n          final: true,\n        } as TaskStatusUpdateEvent);\n        return;\n      }\n      bus.publish({\n        kind: \"status-update\",\n        taskId: ctx.taskId,\n        contextId: ctx.contextId,\n        status: {\n          state: \"failed\",\n          message: agentMessage(\"Agent did not complete governed task lifecycle\"),\n          timestamp: isoNow(),\n        },\n        final: true,\n      } as TaskStatusUpdateEvent);\n      } catch (err) {\n        publishFailed(err);\n      }\n    } finally {\n      active.delete(execution);\n      if (active.size === 0) AxiomAgentExecutor.executions.delete(taskKey);\n    }\n  }\n\n  private reviewCommand(text: string):\n    { resume: { action: \"approve\" } | { action: \"reject\"; data: { note: string } } } | undefined {\n    const trimmed = text.trim();\n    const normalized = trimmed.toLowerCase();\n    if (normalized === \"approve\") return { resume: { action: \"approve\" } };\n    if (normalized === \"reject\") {\n      return { resume: { action: \"reject\", data: { note: \"Changes requested.\" } } };\n    }\n    const prefixedNote = /^reject:\\s*(.+)$/is.exec(trimmed)?.[1]?.trim();\n    if (prefixedNote) {\n      return { resume: { action: \"reject\", data: { note: prefixedNote } } };\n    }\n    return undefined;\n  }\n\n  private taskKey(taskId: string): string {\n    return `${this.scope.tenantId}:${this.scope.projectId}:${this.scope.assistantId}:${taskId}`;\n  }\n\n  private hasGovernedTaskCapability(): boolean {\n    return assistantHasGovernedTask(this.assistant);\n  }\n\n  /**\n   * Cancel a running task: resolve its thread id from the task store, abort the\n   * underlying agent, and publish the terminal `canceled` event.\n   */\n  async cancelTask(taskId: string, bus: ExecutionEventBus): Promise<void> {\n    for (const execution of AxiomAgentExecutor.executions.get(this.taskKey(taskId)) ?? []) {\n      execution.canceled = true;\n    }\n    const task = this.taskStore ? await this.taskStore.load(taskId) : undefined;\n    const threadId = task ? asString(task.metadata?.threadId) : undefined;\n\n    if (threadId) {\n      try {\n        const agent = agentInstanceManager.getAgent({\n          assistant_id: this.scope.assistantId,\n          thread_id: threadId,\n          tenant_id: this.scope.tenantId,\n          project_id: this.scope.projectId,\n        });\n        await agent.abort();\n      } catch (err) {\n        // The agent session may have already been cleaned up.\n        console.warn({\n          event: \"a2a:cancel:no_agent\",\n          taskId,\n          threadId,\n          error: err instanceof Error ? err.message : String(err),\n        });\n      }\n    }\n\n    bus.publish({\n      kind: \"status-update\",\n      taskId,\n      contextId: task?.contextId ?? \"\",\n      status: { state: \"canceled\", timestamp: isoNow() },\n      final: true,\n    } as TaskStatusUpdateEvent);\n  }\n}\n","import type { A2APart, TaskFileRef } from \"@axiom-lattice/protocols\";\nimport type { A2AFileIngestor } from \"./A2AFileIngestor\";\nexport { formatFileRefsSection } from \"../files/task-file-refs\";\n\n/**\n * Project A2A message `file` parts onto internal {@link TaskFileRef} records.\n *\n * This is a URI-only pure function: only parts whose file is referenced by URI\n * are supported. Inline `bytes` files are rejected with an explicit error — to\n * ingest `bytes` into workspace storage, use {@link filePartsToRefsWithIngest}\n * with an {@link A2AFileIngestor} instead.\n *\n * @param parts - The A2A message parts to scan for file references.\n * @param addedBy - Who attached the file: `\"user\"` (reference material) or `\"agent\"` (artifact).\n * @returns The file references extracted from URI-backed file parts, in encounter order.\n * @throws {Error} When any file part carries inline `bytes` instead of a `uri`.\n */\nexport function filePartsToRefs(\n  parts: A2APart[],\n  addedBy: \"user\" | \"agent\",\n): TaskFileRef[] {\n  const refs: TaskFileRef[] = [];\n\n  for (const part of parts) {\n    if (part.kind !== \"file\") continue;\n\n    const file = part.file;\n    if (\"bytes\" in file) {\n      throw new Error(\n        \"A2A file parts with inline bytes are not supported by this pure function — bytes ingest requires filePartsToRefsWithIngest with an A2AFileIngestor; provide a file uri otherwise\",\n      );\n    }\n\n    refs.push({\n      uri: file.uri,\n      ...(file.name ? { name: file.name } : {}),\n      ...(file.mimeType ? { mimeType: file.mimeType } : {}),\n      addedBy,\n    });\n  }\n\n  return refs;\n}\n\n/**\n * Project A2A message `file` parts onto {@link TaskFileRef} records, ingesting\n * inline `bytes` through the provided {@link A2AFileIngestor}.\n *\n * When no ingestor is supplied this delegates to the pure {@link filePartsToRefs}\n * projection (URI-only, rejecting inline bytes), preserving the executor's\n * original behavior for harnesses that do not wire storage.\n *\n * @param parts - The A2A message parts to scan for file references.\n * @param addedBy - Who attached the files: `\"user\"` or `\"agent\"`.\n * @param ingestor - Optional bytes-ingestor; when absent, bytes parts are rejected.\n * @param dedupeKeyBase - Stable key prefix for idempotent ingest (e.g. `taskId`).\n * @param projectId - Destination project for bytes ingestion.\n * @returns The file references in encounter order.\n */\nexport async function filePartsToRefsWithIngest(\n  parts: A2APart[],\n  addedBy: \"user\" | \"agent\",\n  ingestor: A2AFileIngestor | undefined,\n  dedupeKeyBase: string,\n  projectId: string,\n): Promise<TaskFileRef[]> {\n  if (!ingestor) {\n    return filePartsToRefs(parts, addedBy);\n  }\n\n  const refs: TaskFileRef[] = [];\n  for (let index = 0; index < parts.length; index += 1) {\n    const part = parts[index];\n    if (part.kind !== \"file\") continue;\n    const dedupeKey = `${dedupeKeyBase}:${index}`;\n    refs.push(await ingestor.ingest(part, dedupeKey, projectId, addedBy));\n  }\n  return refs;\n}\n","import type { A2APart, TaskFileRef } from \"@axiom-lattice/protocols\";\n\ntype FilePart = Extract<A2APart, { kind: \"file\" }>;\n\n/** Dependencies injected into {@link A2AFileIngestor} for testability. */\nexport interface A2AFileIngestorOptions {\n  /**\n   * Writes decoded file bytes into project storage and returns the URI agents\n   * reference. Bound to the shared workspace `saveProjectFile` service by the\n   * gateway wiring; overridable in tests.\n   *\n   * NOTE: this contract does not include `tenantId` — callers bind the tenant\n   * via a closure (e.g. `(p) => saveProjectFile({ tenantId, ...p })`).\n   */\n  saveProjectFile: (params: {\n    projectId: string;\n    name: string;\n    bytes: Uint8Array;\n    mimeType?: string;\n    /** Relative subdirectory under the project root (e.g. `a2a/<taskId>`). */\n    path?: string;\n  }) => Promise<{ uri: string }>;\n  /** Maximum decoded byte size accepted per file; defaults to 10 MiB. */\n  maxBytes?: number;\n}\n\nconst DEFAULT_MAX_BYTES = 100 * 1024 * 1024;\n\n/**\n * Minimal executable-file blacklist. Inline `bytes` uploads are an ingestion\n * vector for scripts/binaries; there is no existing allowlist in the upload\n * flow, so reject these by extension or MIME before writing.\n */\nconst EXECUTABLE_EXTENSIONS = new Set([\n  \".exe\", \".sh\", \".bat\", \".cmd\", \".com\", \".msi\",\n  \".js\", \".mjs\", \".cjs\", \".ps1\", \".vbs\", \".dll\", \".so\", \".dylib\",\n]);\n\nconst EXECUTABLE_MIME_TYPES = new Set([\n  \"application/x-msdownload\",\n  \"application/x-msdos-program\",\n  \"application/x-executable\",\n  \"application/x-sh\",\n  \"application/x-bat\",\n  \"application/x-shellscript\",\n  \"text/x-shellscript\",\n  \"application/javascript\",\n  \"application/x-javascript\",\n  \"text/javascript\",\n]);\n\nfunction decodeBase64(value: string): Uint8Array {\n  return new Uint8Array(Buffer.from(value, \"base64\"));\n}\n\n/**\n * Upper bound on a base64 string length that can still fit within `maxBytes`\n * after decoding (4 base64 chars encode 3 bytes, plus up to 2 padding chars).\n * Used as a cheap pre-flight guard to avoid decoding oversized payloads into\n * memory; the exact decoded length is verified after decoding.\n */\nfunction maxEncodedLengthFor(maxBytes: number): number {\n  return Math.ceil((maxBytes * 4) / 3) + 4;\n}\n\n/**\n * Reduce an untrusted string to a single safe path segment: no separators, no\n * `..` runs, no leading/trailing dots or dashes. Falls back when nothing\n * usable remains.\n */\nfunction sanitizePathSegment(segment: string, fallback: string): string {\n  const cleaned = segment\n    .replace(/[^A-Za-z0-9._-]+/g, \"-\")\n    .replace(/\\.{2,}/g, \".\")\n    .replace(/^[.-]+|[.-]+$/g, \"\");\n  return cleaned.length > 0 ? cleaned : fallback;\n}\n\n/**\n * Derive the deterministic storage location for a bytes part from its\n * `dedupeKey` (`<taskId>:<partIndex>`). Retried requests for the same task\n * recompute the same location, so re-ingestion overwrites the same object\n * instead of accumulating duplicates — idempotency no longer depends on the\n * in-memory cache surviving across requests.\n */\nfunction storageLocationFor(\n  dedupeKey: string,\n  name: string,\n): { path: string; name: string } {\n  const separatorIndex = dedupeKey.lastIndexOf(\":\");\n  const keyBase = separatorIndex >= 0 ? dedupeKey.slice(0, separatorIndex) : dedupeKey;\n  const keyIndex = separatorIndex >= 0 ? dedupeKey.slice(separatorIndex + 1) : \"0\";\n  return {\n    path: `a2a/${sanitizePathSegment(keyBase, \"task\")}`,\n    name: `${sanitizePathSegment(keyIndex, \"0\")}-${sanitizePathSegment(name, \"file\")}`,\n  };\n}\n\nfunction extensionOf(name: string): string {  return name.includes(\".\")\n    ? name.slice(name.lastIndexOf(\".\")).toLowerCase()\n    : \"\";\n}\n\nfunction assertAllowedFileType(name: string, mimeType: string | undefined): void {\n  if (EXECUTABLE_EXTENSIONS.has(extensionOf(name))) {\n    throw new Error(`Refusing to ingest executable file \"${name}\"`);\n  }\n  if (mimeType && EXECUTABLE_MIME_TYPES.has(mimeType.toLowerCase())) {\n    throw new Error(`Refusing to ingest executable file \"${name}\"`);\n  }\n}\n\n/**\n * Turns A2A file parts into {@link TaskFileRef} records, ingesting inline\n * `bytes` into workspace storage.\n *\n * URI-backed parts pass through untouched. Bytes-backed parts are validated,\n * base64-decoded, written via the injected `saveProjectFile`, and cached by\n * `dedupeKey` so repeated ingests of the same part do not rewrite storage.\n */\nexport class A2AFileIngestor {\n  private readonly saveProjectFile: A2AFileIngestorOptions[\"saveProjectFile\"];\n  private readonly maxBytes: number;\n  private readonly cache = new Map<string, string>();\n\n  constructor(options: A2AFileIngestorOptions) {\n    this.saveProjectFile = options.saveProjectFile;\n    this.maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;\n  }\n\n  /**\n   * Project a single file part onto a {@link TaskFileRef}, ingesting bytes when\n   * present. Idempotent per `dedupeKey`: a repeated key returns the cached URI\n   * without re-writing storage, and even across ingestor instances the key\n   * maps to a deterministic storage path (`a2a/<taskId>/<partIndex>-<name>`),\n   * so request retries overwrite the same object.\n   *\n   * NOTE: the key is based on `taskId` + part index rather than the internal\n   * message id because the executor must ingest files *before* `addMessage`\n   * returns a messageId. A client retrying with a different taskId for the\n   * same message writes a second copy; that is accepted and documented.\n   */\n  async ingest(\n    part: FilePart,\n    dedupeKey: string,\n    projectId: string,\n    addedBy: \"user\" | \"agent\",\n  ): Promise<TaskFileRef> {\n    const file = part.file;\n\n    if (\"uri\" in file) {\n      return {\n        uri: file.uri,\n        ...(file.name ? { name: file.name } : {}),\n        ...(file.mimeType ? { mimeType: file.mimeType } : {}),\n        addedBy,\n      };\n    }\n\n    const name = file.name ?? \"file\";\n    assertAllowedFileType(name, file.mimeType);\n\n    if (file.bytes.length > maxEncodedLengthFor(this.maxBytes)) {\n      throw new Error(\n        `A2A file part exceeds the ${this.maxBytes} byte ingest limit`,\n      );\n    }\n\n    const bytes = decodeBase64(file.bytes);\n    if (bytes.length > this.maxBytes) {\n      throw new Error(\n        `A2A file part exceeds the ${this.maxBytes} byte ingest limit`,\n      );\n    }\n\n    const cached = this.cache.get(dedupeKey);\n    if (cached !== undefined) {\n      return {\n        uri: cached,\n        ...(file.name ? { name: file.name } : {}),\n        ...(file.mimeType ? { mimeType: file.mimeType } : {}),\n        addedBy,\n      };\n    }\n\n    const location = storageLocationFor(dedupeKey, name);\n    const { uri } = await this.saveProjectFile({\n      projectId,\n      name: location.name,\n      path: location.path,\n      bytes,\n      ...(file.mimeType ? { mimeType: file.mimeType } : {}),\n    });\n    this.cache.set(dedupeKey, uri);\n\n    return {\n      uri,\n      ...(file.name ? { name: file.name } : {}),\n      ...(file.mimeType ? { mimeType: file.mimeType } : {}),\n      addedBy,\n    };\n  }\n}\n","import {\n  DefaultExecutionEventBus,\n  type ExecutionEventBus,\n  type ExecutionEventBusManager,\n} from \"@a2a-js/sdk/server\";\nimport type { A2ATaskStoreAdapterScope } from \"./A2ATaskStoreAdapter\";\n\nconst DEFAULT_MAX_SCOPES = 1_000;\nconst DEFAULT_IDLE_TTL_MS = 15 * 60 * 1_000;\n\n/** Error raised when every bounded runtime scope is currently active. */\nexport class A2ARuntimeCapacityError extends Error {\n  constructor(maxScopes: number) {\n    super(`A2A runtime scope capacity of ${maxScopes} is exhausted`);\n    this.name = \"A2ARuntimeCapacityError\";\n  }\n}\n\n/** Configuration for the bounded process-local A2A runtime registry. */\nexport interface A2ARuntimeRegistryOptions {\n  maxScopes?: number;\n  idleTtlMs?: number;\n  now?: () => number;\n}\n\n/**\n * Pins one scoped A2A runtime while a request is using its manager.\n *\n * @remarks Call {@link release} exactly once when request or stream processing\n * finishes. Repeated calls are harmless.\n */\nexport interface A2ARuntimeLease {\n  manager: ExecutionEventBusManager;\n  release(): void;\n}\n\ninterface RuntimeEntry {\n  manager: ScopedExecutionEventBusManager;\n  lastAccessedAt: number;\n  leaseCount: number;\n}\n\nclass ScopedExecutionEventBusManager implements ExecutionEventBusManager {\n  private readonly buses = new Map<string, ExecutionEventBus>();\n  private readonly touch: () => void;\n\n  constructor(touch: () => void) {\n    this.touch = touch;\n  }\n\n  createOrGetByTaskId(taskId: string): ExecutionEventBus {\n    this.touch();\n    const existing = this.buses.get(taskId);\n    if (existing) return existing;\n\n    const bus = new DefaultExecutionEventBus();\n    this.buses.set(taskId, bus);\n    return bus;\n  }\n\n  getByTaskId(taskId: string): ExecutionEventBus | undefined {\n    this.touch();\n    return this.buses.get(taskId);\n  }\n\n  cleanupByTaskId(taskId: string): void {\n    this.touch();\n    const bus = this.buses.get(taskId);\n    bus?.removeAllListeners();\n    this.buses.delete(taskId);\n  }\n\n  get activeBusCount(): number {\n    return this.buses.size;\n  }\n\n  close(): void {\n    for (const bus of this.buses.values()) {\n      bus.removeAllListeners();\n    }\n    this.buses.clear();\n  }\n}\n\n/**\n * Owns process-local SDK event bus managers isolated by authorization scope.\n *\n * @remarks Call {@link acquire} for every request and retain its lease until\n * ordinary response completion or complete streaming generator consumption.\n */\nexport class A2ARuntimeRegistry {\n  private readonly entries = new Map<string, RuntimeEntry>();\n  private readonly maxScopes: number;\n  private readonly idleTtlMs: number;\n  private readonly now: () => number;\n  private closed = false;\n\n  constructor(options: A2ARuntimeRegistryOptions = {}) {\n    this.maxScopes = options.maxScopes ?? DEFAULT_MAX_SCOPES;\n    this.idleTtlMs = options.idleTtlMs ?? DEFAULT_IDLE_TTL_MS;\n    this.now = options.now ?? Date.now;\n  }\n\n  /**\n   * Acquire and pin the runtime manager for an authorization scope.\n   *\n   * @param scope Exact tenant, project, and assistant authorization scope.\n   * @returns A lease whose manager is shared only within that scope.\n   */\n  acquire(scope: A2ATaskStoreAdapterScope): A2ARuntimeLease {\n    if (this.closed) throw new Error(\"A2A runtime registry is closed\");\n\n    const now = this.now();\n    this.pruneExpired(now);\n    const key = JSON.stringify([\n      scope.tenantId,\n      scope.projectId,\n      scope.assistantId,\n    ]);\n    const existing = this.entries.get(key);\n    const entry = existing ?? this.createEntry(key, now);\n    entry.lastAccessedAt = now;\n    entry.leaseCount += 1;\n    let released = false;\n    return {\n      manager: entry.manager,\n      release: (): void => {\n        if (released) return;\n        released = true;\n        entry.leaseCount -= 1;\n        entry.lastAccessedAt = this.now();\n      },\n    };\n  }\n\n  close(): void {\n    if (this.closed) return;\n    this.closed = true;\n    for (const entry of this.entries.values()) {\n      entry.manager.close();\n    }\n    this.entries.clear();\n  }\n\n  private pruneExpired(now: number): void {\n    for (const [key, entry] of this.entries) {\n      if (\n        !this.isActive(entry) &&\n        now - entry.lastAccessedAt > this.idleTtlMs\n      ) {\n        entry.manager.close();\n        this.entries.delete(key);\n      }\n    }\n  }\n\n  private makeCapacity(): void {\n    if (this.entries.size < this.maxScopes) return;\n\n    let oldest: [string, RuntimeEntry] | undefined;\n    for (const candidate of this.entries) {\n      if (this.isActive(candidate[1])) continue;\n      if (!oldest || candidate[1].lastAccessedAt < oldest[1].lastAccessedAt) {\n        oldest = candidate;\n      }\n    }\n\n    if (!oldest) throw new A2ARuntimeCapacityError(this.maxScopes);\n    oldest[1].manager.close();\n    this.entries.delete(oldest[0]);\n  }\n\n  private createEntry(key: string, now: number): RuntimeEntry {\n    this.makeCapacity();\n    const entry: RuntimeEntry = {\n      lastAccessedAt: now,\n      leaseCount: 0,\n      manager: new ScopedExecutionEventBusManager(() => {\n        entry.lastAccessedAt = this.now();\n      }),\n    };\n    this.entries.set(key, entry);\n    return entry;\n  }\n\n  private isActive(entry: RuntimeEntry): boolean {\n    return entry.leaseCount > 0 || entry.manager.activeBusCount > 0;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AACA,SAAS,MAAMA,eAAc;AAC7B;AAAA,EACE;AAAA,EACA,4BAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,4BAA4B,uBAAuB;;;ACZ5D,SAAS,kBAAkB;AAC3B,SAAS,yBAAyB;AAgC3B,IAAM,2BAAqE;AAAA,EAChF,SAAS;AAAA,EACT,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,WAAW;AACb;AA2CA,IAAM,mBAAmB;AAGlB,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAInD,YAAY,QAAgB;AAC1B,UAAM,YAAY,MAAM,2BAA2B;AAJrD,SAAS,OAAO;AAKd,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEA,SAAS,wBAAwB,QAA0C;AACzE,SAAO,yBAAyB,MAAM;AACxC;AAEA,SAAS,SAAS,OAAoC;AACpD,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAS,cAAc,OAAsC;AAC3D,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,QAAM,UAAU,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ;AAC/E,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,YAAY,OAA0B;AAC7C,SAAO,MACJ,OAAO,CAAC,SAAqD,KAAK,SAAS,MAAM,EACjF,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,KAAK,IAAI;AACd;AAEA,SAAS,SAAS,MAAc,WAA2B;AACzD,MAAI,KAAK,UAAU,UAAW,QAAO;AACrC,SAAO,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC;AACpC;AAEA,SAAS,2BAA2B,MAGlC;AACA,QAAM,mBAAmB,KAAK,SAAS,KAAK,CAAC,YAAY,QAAQ,SAAS,MAAM;AAChF,QAAM,OAAO,mBAAmB,YAAY,iBAAiB,KAAK,IAAI;AACtE,SAAO;AAAA,IACL,OAAO,SAAS,MAAM,gBAAgB;AAAA,IACtC,aAAa,OAAO;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI,IAAI;AAAA,EACjB;AACF;AAEA,SAAS,UAAU,OAAsC;AACvD,SACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAAsB,QAAQ;AAE1C;AAEA,SAAS,iBAAiB,WAAqD;AAC7E,QAAM,OAAsB,CAAC;AAC7B,aAAW,YAAY,aAAa,CAAC,GAAG;AACtC,eAAW,QAAQ,SAAS,OAAO;AACjC,UAAI,KAAK,SAAS,OAAQ;AAC1B,YAAM,OAAO,KAAK;AAClB,UAAI,EAAE,SAAS,MAAO;AACtB,WAAK,KAAK;AAAA,QACR,KAAK,KAAK;AAAA,QACV,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,QACvC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,QACnD,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAA8B;AAClD,QAAM,aAAa,KAAK,UAAU;AAClC,QAAM,YAAY,MAAM,QAAQ,UAAU,IAAI,WAAW,OAAO,SAAS,IAAI,CAAC;AAC9E,SAAO,CAAC,GAAG,WAAW,GAAG,iBAAiB,KAAK,SAAS,CAAC;AAC3D;AAEA,SAAS,oBAAoB,WAA8C;AACzE,UAAQ,aAAa,CAAC,GACnB,IAAI,CAAC,aAAa,YAAY,SAAS,KAAK,CAAC,EAC7C,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAChC,KAAK,IAAI;AACd;AASA,SAAS,0BAA0B,SAA2C;AAC5E,QAAM,WAAW,WAAW,CAAC;AAC7B,MAAI,gBAAgB;AACpB,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK,GAAG;AAC3C,QAAI,SAAS,CAAC,EAAE,SAAS,OAAQ,iBAAgB;AAAA,EACnD;AACA,SAAO,SACJ,MAAM,gBAAgB,CAAC,EACvB,OAAO,CAAC,YAAY,QAAQ,SAAS,OAAO,EAC5C,IAAI,CAAC,YAAY,YAAY,QAAQ,KAAK,CAAC,EAC3C,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAChC,KAAK,EAAE;AACZ;AAEA,SAAS,eAAe,OAA8B;AACpD,SAAO,UAAU,YAAY,UAAU;AACzC;AAEA,SAAS,qBAAqB,MAAmC;AAC/D,MAAI,CAAC,eAAe,KAAK,OAAO,KAAK,KAAK,CAAC,KAAK,OAAO,QAAS,QAAO;AACvE,SAAO,YAAY,KAAK,OAAO,QAAQ,KAAK;AAC9C;AAEA,SAAS,oBAAoB,MAAe,QAAiB,eAAgC;AAC3F,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU;AAAA,IACxD,OAAO,KAAK,OAAO;AAAA,IACnB,WAAW,KAAK,OAAO;AAAA,IACvB,SAAS,KAAK,OAAO;AAAA,IACrB;AAAA,IACA;AAAA,EACF,CAAC,CAAC,EAAE,OAAO,KAAK;AAChB,SAAO,0BAA0B,KAAK,EAAE,IAAI,MAAM;AACpD;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK;AAC7E,SAAO,qBAAqB,KAAK,EAAE,IAAI,MAAM;AAC/C;AAEA,SAAS,sBAAsB,OAA8B;AAC3D,SAAO,UAAU,eAAe,UAAU,YAAY,UAAU,cAC9D,UAAU,oBAAoB,UAAU;AAC5C;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,SACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAAkB,OAAO,YACjC,OAAQ,MAAkB,WAAW,YACpC,MAAkB,WAAW;AAElC;AAEA,SAAS,iBAAiB,OAAoC;AAC5D,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS,IACxE,QACA;AACN;AASO,IAAM,sBAAN,MAAkD;AAAA,EAOvD,YAAY,SAAqC;AAFjD,SAAiB,oBAAoB,oBAAI,IAAoB;AAG3D,SAAK,YAAY,QAAQ;AACzB,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,YAAY,QAAQ;AACzB,SAAK,QAAQ,QAAQ;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,MAA8B;AACvC,UAAM,EAAE,SAAS,IAAI,KAAK;AAC1B,UAAM,EAAE,OAAO,YAAY,IAAI,2BAA2B,IAAI;AAC9D,UAAM,QAAQ,aAAa,IAAI;AAC/B,UAAM,SACJ,KAAK,OAAO,UAAU,cAClB,oBAAoB,KAAK,SAAS,KAClC,0BAA0B,KAAK,OAAO,IACtC;AACN,UAAM,gBAAgB,qBAAqB,IAAI;AAC/C,UAAM,UAAmC;AAAA,MACvC,cAAc,KAAK;AAAA,MACnB,UAAU,SAAS,KAAK,UAAU,QAAQ;AAAA,MAC1C,SAAS;AAAA,IACX;AAEA,QAAI,WAAW,MAAM,KAAK,UAAU,QAAQ,UAAU,KAAK,EAAE;AAC7D,QAAI,UAAU;AACZ,WAAK,aAAa,UAAU,KAAK,EAAE;AACnC,YAAM,KAAK,eAAe,MAAM,QAAQ;AAAA,IAC1C,OAAO;AACL,UAAI;AACF,mBAAW,MAAM,KAAK,UAAU,OAAO;AAAA,UACrC,IAAI,KAAK;AAAA,UACT;AAAA,UACA,WAAW;AAAA,UACX,SAAS,KAAK,MAAM;AAAA,UACpB,WAAW,KAAK,MAAM;AAAA,UACtB;AAAA,UACA;AAAA,UACA,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,cAAc,cAAc,KAAK,UAAU,YAAY;AAAA,UACvD;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AACd,mBAAW,MAAM,KAAK,UAAU,QAAQ,UAAU,KAAK,EAAE;AACzD,YAAI,CAAC,SAAU,OAAM;AACrB,aAAK,aAAa,UAAU,KAAK,EAAE;AAAA,MACrC;AACA,YAAM,KAAK,eAAe,MAAM,QAAQ;AAAA,IAC1C;AAEA,UAAM,QAAQ,OAAO,KAAK,MAAM,WAAW;AAC3C,UAAM,WAAW,SAAS,KAAK,UAAU,QAAQ;AACjD,QAAI,KAAK,OAAO,UAAU,WAAW;AACnC,UAAI,SAAS,WAAW,WAAW;AACjC,cAAM,KAAK,wBAAwB,SAAS,KAAK,IAAI,MAAM,KAAK,UAAU,UAAU;AAAA,UAClF;AAAA,UAAU,QAAQ,KAAK;AAAA,UAAI;AAAA,UAAO,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,QACnE,CAAC,CAAC;AAAA,MACJ;AACA;AAAA,IACF;AACA,QAAI,CAAC,sBAAsB,KAAK,OAAO,KAAK,EAAG;AAC/C,UAAM,KAAK,kBAAkB,MAAM,UAAU,QAAQ,aAAa;AAClE,QAAI,CAAC,aAAa,UAAU,WAAW,EAAE,SAAS,SAAS,MAAM,EAAG;AACpE,QAAI,KAAK,OAAO,UAAU,oBAAoB,KAAK,0BAA0B,MAAM,QAAQ,EAAG;AAC9F,QAAI,SAAS,WAAW,WAAW;AACjC,YAAM,UAAU,MAAM,KAAK,wBAAwB,SAAS,KAAK,IAAI,MAAM,KAAK,UAAU,UAAU;AAAA,QAClG;AAAA,QAAU,QAAQ,KAAK;AAAA,QAAI;AAAA,QAAO,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACnE,CAAC,CAAC;AACF,iBAAW,QAAQ;AAAA,IACrB;AACA,UAAM,KAAK,iBAAiB,MAAM,aAAa;AAAA,EACjD;AAAA,EAEA,MAAc,eAAe,MAAe,MAA+B;AACzE,UAAM,mBAAmB,iBAAiB,KAAK,UAAU,gBAAgB,KAAK;AAC9E,UAAM,kBAAkB,KAAK,kBAAkB,IAAI,KAAK,EAAE,KAAK;AAC/D,UAAM,WAAW,KAAK,IAAI,kBAAkB,eAAe,IAAI;AAC/D,SAAK,kBAAkB,IAAI,KAAK,IAAI,QAAQ;AAC5C,UAAM,gBAAyB;AAAA,MAC7B,GAAG;AAAA,MACH,UAAU,EAAE,GAAI,KAAK,YAAY,CAAC,GAAI,kBAAkB,SAAS;AAAA,IACnE;AACA,UAAM,WAAW,iBAAiB,aAAa;AAC/C,UAAM,KAAK,cAAc,yBAAyB;AAAA,MAChD,UAAU,KAAK,MAAM;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb,WAAW,KAAK,MAAM;AAAA,MACtB,QAAQ;AAAA,MACR,OAAO,OAAO,KAAK,MAAM,WAAW;AAAA,MACpC,SAAS;AAAA,MACT,QAAQ,EAAE,MAAM,qBAAqB,kBAAkB,UAAU,UAAU,MAAM,cAAc;AAAA,MAC/F;AAAA,MACA,GAAI,SAAS,KAAK,UAAU,QAAQ,IAAI,EAAE,UAAU,SAAS,KAAK,UAAU,QAAQ,EAAE,IAAI,CAAC;AAAA,MAC3F,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,IAC9D,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,kBACZ,MACA,MACA,QACA,eACe;AACf,UAAM,KAAK,cAAc,yBAAyB;AAAA,MAChD,UAAU,KAAK,MAAM;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb,WAAW,KAAK,MAAM;AAAA,MACtB,QAAQ;AAAA,MACR,OAAO,OAAO,KAAK,MAAM,WAAW;AAAA,MACpC,SAAS,gBAAgB,KAAK,OAAO,KAAK;AAAA,MAC1C,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,OAAO,KAAK,OAAO;AAAA,QACnB,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;AAAA,QACzC,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,cAAc;AAAA,QACvD,GAAI,KAAK,OAAO,UAAU,EAAE,SAAS,YAAY,KAAK,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC;AAAA,MACnF;AAAA,MACA,UAAU,oBAAoB,MAAM,QAAQ,aAAa;AAAA,MACzD,GAAI,SAAS,KAAK,UAAU,QAAQ,IAAI,EAAE,UAAU,SAAS,KAAK,UAAU,QAAQ,EAAE,IAAI,CAAC;AAAA,MAC3F,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,IAC9D,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,iBACZ,MACA,eACe;AACf,UAAM,QAAQ,OAAO,KAAK,MAAM,WAAW;AAC3C,UAAM,WAAW,SAAS,KAAK,UAAU,QAAQ;AACjD,QAAI,KAAK,OAAO,UAAU,YAAY;AACpC,YAAM,KAAK,wBAAwB,UAAU,KAAK,IAAI,MAAM,KAAK,UAAU,WAAW;AAAA,QACpF,UAAU,KAAK,MAAM;AAAA,QAAU,QAAQ,KAAK;AAAA,QAAI;AAAA,QAChD,SAAS;AAAA,QAAyB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACnE,CAAC,CAAC;AACF;AAAA,IACF;AACA,QAAI,eAAe,KAAK,OAAO,KAAK,GAAG;AACrC,YAAM,KAAK,wBAAwB,QAAQ,KAAK,IAAI,MAAM,KAAK,UAAU,SAAS;AAAA,QAChF,UAAU,KAAK,MAAM;AAAA,QAAU,QAAQ,KAAK;AAAA,QAC5C,eAAe,eAAe,KAAK,KAAK,gBAAgB,KAAK,OAAO,KAAK;AAAA,QACzE;AAAA,QAAO,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACxC,CAAC,CAAC;AACF;AAAA,IACF;AACA,QAAI,KAAK,OAAO,UAAU,kBAAkB;AAC1C,YAAM,KAAK,wBAAwB,aAAa,KAAK,IAAI,MAAM,KAAK,UAAU,cAAc;AAAA,QAC1F,UAAU,KAAK,MAAM;AAAA,QAAU,QAAQ,KAAK;AAAA,QAAI,MAAM;AAAA,QACtD,SAAS,KAAK,OAAO,UAAU,YAAY,KAAK,OAAO,QAAQ,KAAK,EAAE,KAAK,KAAK,uBAAuB;AAAA,QACvG;AAAA,QAAO,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACxC,CAAC,CAAC;AACF;AAAA,IACF;AAEA,UAAM,YAAY,MAAM,KAAK,UAAU,QAAQ,KAAK,MAAM,UAAU,KAAK,EAAE;AAC3E,QAAI,CAAC,aAAa,CAAC,KAAK,UAAU,SAAS,GAAG;AAC5C,YAAM,IAAI,MAAM,2DAA2D,KAAK,EAAE,EAAE;AAAA,IACtF;AACA,QAAI,UAAU,WAAW,YAAa;AACtC,UAAM,IAAI;AAAA,MACR,sDAAsD,UAAU,MAAM,SAAS,KAAK,EAAE;AAAA,IACxF;AAAA,EACF;AAAA,EAEA,MAAc,wBACZ,WACA,QACA,QACsD;AACtD,QAAI,OAAO,SAAS;AAClB,UAAI,OAAO,UAAU,QAAQ;AAC3B,gBAAQ,KAAK,EAAE,OAAO,0BAA0B,WAAW,QAAQ,UAAU,OAAO,SAAS,CAAC;AAAA,MAChG;AACA,aAAO;AAAA,IACT;AACA,UAAM,IAAI,MAAM,iBAAiB,SAAS,YAAY,OAAO,IAAI,KAAK,OAAO,KAAK,EAAE;AAAA,EACtF;AAAA,EAEQ,0BAA0B,MAAe,MAAyB;AACxE,UAAM,WAAW,KAAK,UAAU;AAChC,UAAM,YAAY,KAAK,SAAS;AAChC,QAAI,KAAK,WAAW,iBAAiB,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACzF,QAAI,YAAY,OAAO,aAAa,SAAU,QAAO,kBAAkB,UAAU,SAAS;AAC1F,UAAM,kBAAkB,KAAK,OAAO,UAAU,YAAY,KAAK,OAAO,QAAQ,KAAK,EAAE,KAAK,IAAI;AAC9F,WAAO,gBAAgB,SAAS,KAC7B,UAAsC,YAAY;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,QAA8C;AACvD,UAAM,OAAO,MAAM,KAAK,UAAU,QAAQ,KAAK,MAAM,UAAU,MAAM;AACrE,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,IAAI,EAAG,QAAO;AAE3C,UAAM,WAAW;AACjB,QAAI;AACJ,aAAS,SAAS,KAAK,UAAU,UAAU;AACzC,YAAM,aAAa,MAAM,KAAK,cAAc,KAAK;AAAA,QAC/C,UAAU,KAAK,MAAM;AAAA,QACrB;AAAA,QACA,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AACD,iBAAW,YAAY,YAAY;AACjC,YAAI,SAAS,QAAQ,SAAS,uBAAuB,CAAC,kBAAkB,SAAS,OAAO,IAAI,EAAG;AAC/F,cAAM,WAAW,iBAAiB,SAAS,OAAO,gBAAgB,KAChE,iBAAiB,SAAS,OAAO,KAAK,UAAU,gBAAgB;AAClE,cAAM,YAAY;AAAA,UAChB,MAAM,SAAS,OAAO;AAAA,UACtB;AAAA,UACA,UAAU,SAAS,SAAS,OAAO,QAAQ,KAAK,SAAS,YACvD,iBAAiB,SAAS,OAAO,IAAI;AAAA,UACvC,iBAAiB,KAAK,MAAM,SAAS,OAAO,KAAK,OAAO,aAAa,EAAE;AAAA,UACvE,WAAW,SAAS;AAAA,UACpB,IAAI,SAAS;AAAA,QACf;AACA,YAAI,CAAC,YAAY,KAAK,gBAAgB,WAAW,QAAQ,EAAG,YAAW;AAAA,MACzE;AACA,UAAI,WAAW,SAAS,SAAU;AAAA,IACpC;AACA,UAAM,WAAW,UAAU,QAAQ,KAAK,SAAS;AACjD,QAAI,CAAC,kBAAkB,QAAQ,EAAG,QAAO;AACzC,UAAM,mBAAmB,UAAU,YAAY,iBAAiB,SAAS,UAAU,gBAAgB;AACnG,QAAI,qBAAqB,QAAW;AAClC,WAAK,kBAAkB,IAAI,QAAQ,KAAK,IAAI,KAAK,kBAAkB,IAAI,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAAA,IACxG;AAEA,UAAM,QAAQ,wBAAwB,KAAK,MAAM;AACjD,UAAM,eAAe,KAAK,SAAS;AACnC,UAAM,WAAW;AAAA,MACf,GAAI,SAAS,YAAY,CAAC;AAAA,MAC1B,GAAI,gBAAgB,OAAO,iBAAiB,WAAW,EAAE,aAAa,IAAI,CAAC;AAAA,IAC7E;AACA,UAAM,sBAAsB,SAAS,aAAa,CAAC,GAAG,OAAO,CAAC,aAAa,SAAS,SAAS,QAAQ;AACrG,UAAM,YAAY,KAAK,WAAW,eAAe,KAAK,QAAQ,KAAK,IAC/D,CAAC,GAAG,oBAAoB;AAAA,MACtB,YAAY,GAAG,KAAK,EAAE;AAAA,MACtB,MAAM;AAAA,MACN,OAAO,CAAC,EAAE,MAAM,QAAiB,MAAM,KAAK,OAAO,CAAC;AAAA,IACtD,CAAC,IACD;AACJ,UAAM,UAAU,UAAU,YAAY,KAAK,eAAe,KAAK,IAC3D;AAAA,MACE,MAAM;AAAA,MACN,WAAW,GAAG,KAAK,EAAE;AAAA,MACrB,MAAM;AAAA,MACN,OAAO,CAAC,EAAE,MAAM,QAAiB,MAAM,KAAK,cAAc,CAAC;AAAA,IAC7D,IACA,gBAAgB,OAAO,iBAAiB,YACxC,OAAQ,aAAyC,YAAY,WAC7D;AAAA,MACE,MAAM;AAAA,MACN,WAAW,GAAG,KAAK,EAAE;AAAA,MACrB,MAAM;AAAA,MACN,OAAO,CAAC,EAAE,MAAM,QAAiB,MAAO,aAAyC,QAAkB,CAAC;AAAA,IACtG,IACE,SAAS,OAAO;AACtB,WAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,MACA,GAAI,UAAU,SAAS,IAAI,EAAE,UAAU,IAAI,EAAE,WAAW,OAAU;AAAA,MAClE,QAAQ;AAAA,QACN,GAAG,SAAS;AAAA,QACZ;AAAA,QACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,MAAyB;AACzC,WACE,KAAK,aAAa,KAAK,MAAM,YAC7B,KAAK,cAAc,KAAK,MAAM,aAC9B,KAAK,cAAc,WACnB,KAAK,YAAY,KAAK,MAAM,eAC5B,KAAK,aAAa;AAAA,EAEtB;AAAA,EAEQ,aAAa,MAAgB,QAAsB;AACzD,QAAI,CAAC,KAAK,UAAU,IAAI,EAAG,OAAM,IAAI,0BAA0B,MAAM;AAAA,EACvE;AAAA,EAEQ,gBACN,WACA,UACS;AACT,QAAI,UAAU,aAAa,UAAa,SAAS,aAAa,QAAW;AACvE,UAAI,UAAU,aAAa,OAAW,QAAO;AAC7C,UAAI,SAAS,aAAa,OAAW,QAAO;AAC5C,UAAI,UAAU,aAAa,SAAS,SAAU,QAAO,UAAU,WAAW,SAAS;AAInF,YAAM,qBAAqB,OAAO,MAAM,UAAU,eAAe,IAAI,OAAO,oBAAoB,UAAU;AAC1G,YAAM,oBAAoB,OAAO,MAAM,SAAS,eAAe,IAAI,OAAO,oBAAoB,SAAS;AACvG,UAAI,uBAAuB,kBAAmB,QAAO,qBAAqB;AAC1E,aAAO,UAAU,WAAW,SAAS;AAAA,IACvC;AACA,WAAO,UAAU,UAAU,QAAQ,IAAI,SAAS,UAAU,QAAQ,KAC/D,UAAU,UAAU,QAAQ,MAAM,SAAS,UAAU,QAAQ,KAAK,UAAU,KAAK,SAAS;AAAA,EAC/F;AACF;;;ACjkBA,SAAS,MAAM,cAAc;AAC7B,SAAS,4BAA4B;AACrC,SAAS,yBAAyB;;;ACe3B,SAAS,gBACd,OACA,SACe;AACf,QAAM,OAAsB,CAAC;AAE7B,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,SAAS,OAAQ;AAE1B,UAAM,OAAO,KAAK;AAClB,QAAI,WAAW,MAAM;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,SAAK,KAAK;AAAA,MACR,KAAK,KAAK;AAAA,MACV,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACvC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAiBA,eAAsB,0BACpB,OACA,SACA,UACA,eACA,WACwB;AACxB,MAAI,CAAC,UAAU;AACb,WAAO,gBAAgB,OAAO,OAAO;AAAA,EACvC;AAEA,QAAM,OAAsB,CAAC;AAC7B,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,OAAO,MAAM,KAAK;AACxB,QAAI,KAAK,SAAS,OAAQ;AAC1B,UAAM,YAAY,GAAG,aAAa,IAAI,KAAK;AAC3C,SAAK,KAAK,MAAM,SAAS,OAAO,MAAM,WAAW,WAAW,OAAO,CAAC;AAAA,EACtE;AACA,SAAO;AACT;;;ADnCA,SAAS,SAAiB;AACxB,UAAO,oBAAI,KAAK,GAAE,YAAY;AAChC;AAEA,SAASC,UAAS,OAAoC;AACpD,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAASC,aAAY,OAA0B;AAC7C,SAAO,MACJ,OAAO,CAAC,SAAqD,KAAK,SAAS,MAAM,EACjF,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,KAAK,IAAI;AACd;AAEA,SAAS,aAAa,MAA0B;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,OAAO;AAAA,IAClB,MAAM;AAAA,IACN,OAAO,CAAC,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA,EAChC;AACF;AAOO,SAAS,yBAAyB,WAA+B;AACtE,QAAM,QAAQ,UAAU;AACxB,QAAM,aAAa,SAAS,OAAO,UAAU,WACxC,MAAmC,aACpC;AACJ,QAAM,iBAAiB,MAAM,QAAQ,UAAU,IAC3C,WAAW,KAAK,CAAC,UACf,CAAC,CAAC,SAAS,OAAO,UAAU,YAC3B,MAAkC,SAAS,UAC3C,MAAkC,YAAY,IAAI,IACrD;AACJ,QAAM,eAAe,gBAAgB;AACrC,SAAO,CAAC,CAAC,mBACP,iBAAiB,UAChB,MAAM,QAAQ,YAAY,MAAM,aAAa,WAAW,KAAK,aAAa,SAAS,aAAa;AAErG;AAaO,IAAM,sBAAN,MAAM,oBAA4C;AAAA,EAOvD,YAAY,SAAoC;AAC9C,SAAK,QAAQ,QAAQ;AACrB,SAAK,YAAY,QAAQ;AACzB,SAAK,YAAY,QAAQ;AACzB,SAAK,WAAW,QAAQ;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,KAAqB,KAAuC;AACxE,UAAM,YAAY,EAAE,UAAU,MAAM;AACpC,UAAM,UAAU,KAAK,QAAQ,IAAI,MAAM;AACvC,UAAM,SAAS,oBAAmB,WAAW,IAAI,OAAO,KAAK,oBAAI,IAAI;AACrE,WAAO,IAAI,SAAS;AACpB,wBAAmB,WAAW,IAAI,SAAS,MAAM;AACjD,UAAM,OAAOA,aAAY,IAAI,YAAY,KAAK;AAC9C,UAAM,WAAW,IAAI;AACrB,UAAM,WAAWD,UAAS,UAAU,UAAU,QAAQ,KAAK,OAAO;AAClE,UAAM,eAAe,IAAI,gBAAgB,IAAI,CAAC,SAAS,KAAK,EAAE,KAAK,CAAC;AAEpE,UAAM,aAAa,CAAC,gBAAwC;AAAA,MACxD,MAAM;AAAA,MACN,IAAI,IAAI;AAAA,MACR,WAAW,IAAI;AAAA,MACf,GAAI,UAAU,UAAU,EAAE,SAAS,SAAS,QAAQ,IAAI,CAAC;AAAA,MACzD,GAAI,UAAU,YAAY,EAAE,WAAW,SAAS,UAAU,IAAI,CAAC;AAAA,MAC/D,QAAQ,EAAE,OAAO,WAAW,WAAW,OAAO,EAAE;AAAA,MAChD,UAAU,EAAE,UAAU,cAAc,WAAW;AAAA,IACjD;AAEF,UAAM,gBAAgB,CAAC,QAAuB;AAC5C,UAAI,QAAQ;AAAA,QACV,MAAM;AAAA,QACN,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,QACf,QAAQ;AAAA,UACN,OAAO;AAAA,UACP,SAAS,aAAa,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UACtE,WAAW,OAAO;AAAA,QACpB;AAAA,QACA,OAAO;AAAA,MACT,CAA0B;AAAA,IAC5B;AAEA,QAAI;AACF,UAAI,CAAC,KAAK,WAAW;AACnB,cAAME,eAAc,WAAW,CAAC,CAAC;AACjC,YAAI,QAAQA,YAAW;AACvB,sBAAc,IAAI,MAAM,+CAA+C,CAAC;AACxE;AAAA,MACF;AAIA,YAAM,WAAW,KAAK,0BAA0B;AAEhD,YAAM,eAAe,UAAU,UAAU;AACzC,YAAM,qBAAqB,gBAAgB,OAAO,iBAAiB,YAChE,aAAyC,SAAS;AACrD,YAAM,gBAAgB,qBAClB,KAAK,cAAc,IAAI,IACvB;AACJ,UAAI,sBAAsB,CAAC,eAAe;AACxC,YAAI,QAAQ,aAAa,2EAA2E,CAAC;AACrG;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,qBAAa,MAAM;AAAA,UACjB,IAAI,YAAY;AAAA,UAChB;AAAA,UACA,KAAK;AAAA,UACL,IAAI;AAAA,UACJ,KAAK,MAAM;AAAA,QACb;AAAA,MACF,SAAS,KAAK;AAIZ,cAAMA,eAAc,WAAW,CAAC,CAAC;AACjC,YAAI,KAAK,UAAW,OAAM,KAAK,UAAU,KAAKA,YAAW;AACzD,YAAI,QAAQA,YAAW;AACvB,sBAAc,GAAG;AACjB;AAAA,MACF;AAEA,YAAM,cAAc,WAAW,UAAU;AACzC,YAAM,KAAK,UAAU,KAAK,WAAW;AACrC,UAAI,QAAQ,WAAW;AACvB,UAAI;AACJ,cAAM,QAAQ,qBAAqB,SAAS;AAAA,UAC1C,cAAc,KAAK,MAAM;AAAA,UACzB,WAAW;AAAA,UACX,WAAW,KAAK,MAAM;AAAA,UACtB,YAAY,KAAK,MAAM;AAAA,QACzB,CAAC;AAMD,cAAM,cACJ,WAAW,SAAS,IAChB,GAAG,IAAI;AAAA;AAAA,EAAO,sBAAsB,UAAU,CAAC,KAC/C;AACN,cAAM,cAAc,WAChB;AAAA,UACE,uEAAuE,IAAI,MAAM;AAAA,UACjF;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,KAAK,IAAI,IACX;AAEJ,cAAM,sBAAsB,gBAAgB,OAAO,iBAAiB,WAChE,EAAE,QAAQ,KAAK,IACf;AACJ,cAAM,EAAE,UAAU,IAAI,MAAM,MAAM,WAAW;AAAA,UAC3C,OAAO,EAAE,SAAS,YAAY;AAAA,UAC9B,GAAI,iBAAiB,sBACjB,EAAE,SAAS,iBAAiB,oBAAoB,IAChD,CAAC;AAAA,UACL,mBAAmB,EAAE,QAAQ,IAAI,OAAO;AAAA,QAC1C,CAAC;AAED,cAAM,SAAS,MAAM,YAAY,WAAW;AAAA,UAC1C,kBAAkB;AAAA,QACpB,CAAC;AAED,YAAI,aAAa;AACjB,YAAI,cAAc;AAClB,yBAAiB,SAAS,QAAQ;AAChC,cAAI,UAAU,SAAU;AACxB,gBAAM,YAAY,MAAM;AACxB,gBAAM,YAAY,MAAM,MAAM,WAAW;AAEzC,cAAI,cAAc,kBAAkB,WAAW;AAC7C,0BAAc;AACd;AAAA,UACF;AAEA,cAAI,cAAc,kBAAkB,MAAM,WAAW;AACnD,0BAAc;AAAA,UAChB;AAEA,cACE,cAAc,kBAAkB,MAChC,cAAc,kBAAkB,MAChC;AACA,gBAAI,WAAW;AACb,kBAAI,QAAQ;AAAA,gBACV,MAAM;AAAA,gBACN,QAAQ,IAAI;AAAA,gBACZ,WAAW,IAAI;AAAA,gBACf,QAAQ;AAAA,kBACN,OAAO;AAAA,kBACP,SAAS,aAAa,SAAS;AAAA,kBAC/B,WAAW,OAAO;AAAA,gBACpB;AAAA,gBACA,OAAO;AAAA,cACT,CAA0B;AAAA,YAC5B;AAAA,UACF;AAAA,QACF;AAEA,YAAI,UAAU,SAAU;AAExB,YAAI,CAAC,UAAU;AACb,cAAI,aAAa;AACf,kBAAM,SAAS;AAAA,cACb,GAAG,WAAW,UAAU;AAAA,cACxB,QAAQ,EAAE,OAAO,kBAAkB,WAAW,OAAO,EAAE;AAAA,YACzD;AACA,kBAAM,KAAK,UAAU,KAAK,MAAM;AAChC,gBAAI,QAAQ;AAAA,cACV,MAAM;AAAA,cACN,QAAQ,IAAI;AAAA,cACZ,WAAW,IAAI;AAAA,cACf,QAAQ,EAAE,OAAO,kBAAkB,WAAW,OAAO,EAAE;AAAA,cACvD,OAAO;AAAA,YACT,CAA0B;AAC1B;AAAA,UACF;AACA,gBAAM,iBAAiB;AAAA,YACrB,YAAY,OAAO;AAAA,YACnB,MAAM;AAAA,YACN,OAAO,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,CAAC;AAAA,UAC5C;AACA,gBAAM,YAAY;AAAA,YAChB,GAAG,WAAW,UAAU;AAAA,YACxB,WAAW,CAAC,GAAI,UAAU,aAAa,CAAC,GAAI,cAAc;AAAA,YAC1D,QAAQ,EAAE,OAAO,aAAa,WAAW,OAAO,EAAE;AAAA,UACpD;AACA,gBAAM,KAAK,UAAU,KAAK,SAAS;AACnC,cAAI,QAAQ;AAAA,YACV,MAAM;AAAA,YACN,QAAQ,IAAI;AAAA,YACZ,WAAW,IAAI;AAAA,YACf,UAAU;AAAA,UACZ,CAA4B;AAC5B,cAAI,QAAQ;AAAA,YACV,MAAM;AAAA,YACN,QAAQ,IAAI;AAAA,YACZ,WAAW,IAAI;AAAA,YACf,QAAQ,EAAE,OAAO,aAAa,WAAW,OAAO,EAAE;AAAA,YAClD,OAAO;AAAA,UACT,CAA0B;AAC1B;AAAA,QACF;AAEA,cAAM,YAAY,MAAM,KAAK,UAAU,KAAK,IAAI,MAAM;AACtD,cAAM,iBAAiB,WAAW,OAAO;AACzC,YAAI,mBAAmB,aAAa;AAClC,gBAAM,iBAAiB,WAAW,WAAW,KAAK,CAAC,aAAa,SAAS,SAAS,QAAQ;AAC1F,cAAI,CAAC,gBAAgB;AACnB,kBAAM,IAAI,MAAM,4BAA4B,IAAI,MAAM,yBAAyB;AAAA,UACjF;AACA,cAAI,UAAU,SAAU;AACxB,cAAI,QAAQ;AAAA,YACV,MAAM;AAAA,YACN,QAAQ,IAAI;AAAA,YACZ,WAAW,IAAI;AAAA,YACf,UAAU;AAAA,UACZ,CAA4B;AAAA,QAC9B;AACA,YAAI,mBAAmB,eAAe,mBAAmB,YAAY,mBAAmB,YAAY;AAClG,cAAI,UAAU,SAAU;AACxB,cAAI,QAAQ;AAAA,YACV,MAAM;AAAA,YACN,QAAQ,IAAI;AAAA,YACZ,WAAW,IAAI;AAAA,YACf,QAAQ;AAAA,cACN,OAAO;AAAA,cACP,GAAI,WAAW,OAAO,UAAU,EAAE,SAAS,UAAU,OAAO,QAAQ,IAAI,CAAC;AAAA,cACzE,WAAW,OAAO;AAAA,YACpB;AAAA,YACA,OAAO;AAAA,UACT,CAA0B;AAC1B;AAAA,QACF;AACA,YAAI,mBAAmB,kBAAkB;AACvC,cAAI,QAAQ;AAAA,YACV,MAAM;AAAA,YACN,QAAQ,IAAI;AAAA,YACZ,WAAW,IAAI;AAAA,YACf,QAAQ;AAAA,cACN,OAAO;AAAA,cACP,GAAI,WAAW,OAAO,UAAU,EAAE,SAAS,UAAU,OAAO,QAAQ,IAAI,CAAC;AAAA,cACzE,WAAW,OAAO;AAAA,YACpB;AAAA,YACA,OAAO;AAAA,UACT,CAA0B;AAC1B;AAAA,QACF;AACA,YAAI,QAAQ;AAAA,UACV,MAAM;AAAA,UACN,QAAQ,IAAI;AAAA,UACZ,WAAW,IAAI;AAAA,UACf,QAAQ;AAAA,YACN,OAAO;AAAA,YACP,SAAS,aAAa,gDAAgD;AAAA,YACtE,WAAW,OAAO;AAAA,UACpB;AAAA,UACA,OAAO;AAAA,QACT,CAA0B;AAAA,MAC1B,SAAS,KAAK;AACZ,sBAAc,GAAG;AAAA,MACnB;AAAA,IACF,UAAE;AACA,aAAO,OAAO,SAAS;AACvB,UAAI,OAAO,SAAS,EAAG,qBAAmB,WAAW,OAAO,OAAO;AAAA,IACrE;AAAA,EACF;AAAA,EAEQ,cAAc,MACyE;AAC7F,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,aAAa,QAAQ,YAAY;AACvC,QAAI,eAAe,UAAW,QAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE;AACrE,QAAI,eAAe,UAAU;AAC3B,aAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,MAAM,EAAE,MAAM,qBAAqB,EAAE,EAAE;AAAA,IAC9E;AACA,UAAM,eAAe,qBAAqB,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK;AACnE,QAAI,cAAc;AAChB,aAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,MAAM,EAAE,MAAM,aAAa,EAAE,EAAE;AAAA,IACtE;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,QAAQ,QAAwB;AACtC,WAAO,GAAG,KAAK,MAAM,QAAQ,IAAI,KAAK,MAAM,SAAS,IAAI,KAAK,MAAM,WAAW,IAAI,MAAM;AAAA,EAC3F;AAAA,EAEQ,4BAAqC;AAC3C,WAAO,yBAAyB,KAAK,SAAS;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,QAAgB,KAAuC;AACtE,eAAW,aAAa,oBAAmB,WAAW,IAAI,KAAK,QAAQ,MAAM,CAAC,KAAK,CAAC,GAAG;AACrF,gBAAU,WAAW;AAAA,IACvB;AACA,UAAM,OAAO,KAAK,YAAY,MAAM,KAAK,UAAU,KAAK,MAAM,IAAI;AAClE,UAAM,WAAW,OAAOF,UAAS,KAAK,UAAU,QAAQ,IAAI;AAE5D,QAAI,UAAU;AACZ,UAAI;AACF,cAAM,QAAQ,qBAAqB,SAAS;AAAA,UAC1C,cAAc,KAAK,MAAM;AAAA,UACzB,WAAW;AAAA,UACX,WAAW,KAAK,MAAM;AAAA,UACtB,YAAY,KAAK,MAAM;AAAA,QACzB,CAAC;AACD,cAAM,MAAM,MAAM;AAAA,MACpB,SAAS,KAAK;AAEZ,gBAAQ,KAAK;AAAA,UACX,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QACxD,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,QAAQ;AAAA,MACV,MAAM;AAAA,MACN;AAAA,MACA,WAAW,MAAM,aAAa;AAAA,MAC9B,QAAQ,EAAE,OAAO,YAAY,WAAW,OAAO,EAAE;AAAA,MACjD,OAAO;AAAA,IACT,CAA0B;AAAA,EAC5B;AACF;AA3Va,oBACa,aAAa,oBAAI,IAAwC;AAD5E,IAAM,qBAAN;;;AE3EP,IAAM,oBAAoB,MAAM,OAAO;AAOvC,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EACvC;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AACxD,CAAC;AAED,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,aAAa,OAA2B;AAC/C,SAAO,IAAI,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC;AACpD;AAQA,SAAS,oBAAoB,UAA0B;AACrD,SAAO,KAAK,KAAM,WAAW,IAAK,CAAC,IAAI;AACzC;AAOA,SAAS,oBAAoB,SAAiB,UAA0B;AACtE,QAAM,UAAU,QACb,QAAQ,qBAAqB,GAAG,EAChC,QAAQ,WAAW,GAAG,EACtB,QAAQ,kBAAkB,EAAE;AAC/B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AASA,SAAS,mBACP,WACA,MACgC;AAChC,QAAM,iBAAiB,UAAU,YAAY,GAAG;AAChD,QAAM,UAAU,kBAAkB,IAAI,UAAU,MAAM,GAAG,cAAc,IAAI;AAC3E,QAAM,WAAW,kBAAkB,IAAI,UAAU,MAAM,iBAAiB,CAAC,IAAI;AAC7E,SAAO;AAAA,IACL,MAAM,OAAO,oBAAoB,SAAS,MAAM,CAAC;AAAA,IACjD,MAAM,GAAG,oBAAoB,UAAU,GAAG,CAAC,IAAI,oBAAoB,MAAM,MAAM,CAAC;AAAA,EAClF;AACF;AAEA,SAAS,YAAY,MAAsB;AAAG,SAAO,KAAK,SAAS,GAAG,IAChE,KAAK,MAAM,KAAK,YAAY,GAAG,CAAC,EAAE,YAAY,IAC9C;AACN;AAEA,SAAS,sBAAsB,MAAc,UAAoC;AAC/E,MAAI,sBAAsB,IAAI,YAAY,IAAI,CAAC,GAAG;AAChD,UAAM,IAAI,MAAM,uCAAuC,IAAI,GAAG;AAAA,EAChE;AACA,MAAI,YAAY,sBAAsB,IAAI,SAAS,YAAY,CAAC,GAAG;AACjE,UAAM,IAAI,MAAM,uCAAuC,IAAI,GAAG;AAAA,EAChE;AACF;AAUO,IAAM,kBAAN,MAAsB;AAAA,EAK3B,YAAY,SAAiC;AAF7C,SAAiB,QAAQ,oBAAI,IAAoB;AAG/C,SAAK,kBAAkB,QAAQ;AAC/B,SAAK,WAAW,QAAQ,YAAY;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,OACJ,MACA,WACA,WACA,SACsB;AACtB,UAAM,OAAO,KAAK;AAElB,QAAI,SAAS,MAAM;AACjB,aAAO;AAAA,QACL,KAAK,KAAK;AAAA,QACV,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,QACvC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,KAAK,QAAQ;AAC1B,0BAAsB,MAAM,KAAK,QAAQ;AAEzC,QAAI,KAAK,MAAM,SAAS,oBAAoB,KAAK,QAAQ,GAAG;AAC1D,YAAM,IAAI;AAAA,QACR,6BAA6B,KAAK,QAAQ;AAAA,MAC5C;AAAA,IACF;AAEA,UAAM,QAAQ,aAAa,KAAK,KAAK;AACrC,QAAI,MAAM,SAAS,KAAK,UAAU;AAChC,YAAM,IAAI;AAAA,QACR,6BAA6B,KAAK,QAAQ;AAAA,MAC5C;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,MAAM,IAAI,SAAS;AACvC,QAAI,WAAW,QAAW;AACxB,aAAO;AAAA,QACL,KAAK;AAAA,QACL,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,QACvC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,mBAAmB,WAAW,IAAI;AACnD,UAAM,EAAE,IAAI,IAAI,MAAM,KAAK,gBAAgB;AAAA,MACzC;AAAA,MACA,MAAM,SAAS;AAAA,MACf,MAAM,SAAS;AAAA,MACf;AAAA,MACA,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,IACrD,CAAC;AACD,SAAK,MAAM,IAAI,WAAW,GAAG;AAE7B,WAAO;AAAA,MACL;AAAA,MACA,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACvC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACF;;;AC1MA;AAAA,EACE;AAAA,OAGK;AAGP,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB,KAAK,KAAK;AAG/B,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,WAAmB;AAC7B,UAAM,iCAAiC,SAAS,eAAe;AAC/D,SAAK,OAAO;AAAA,EACd;AACF;AA0BA,IAAM,iCAAN,MAAyE;AAAA,EAIvE,YAAY,OAAmB;AAH/B,SAAiB,QAAQ,oBAAI,IAA+B;AAI1D,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,oBAAoB,QAAmC;AACrD,SAAK,MAAM;AACX,UAAM,WAAW,KAAK,MAAM,IAAI,MAAM;AACtC,QAAI,SAAU,QAAO;AAErB,UAAM,MAAM,IAAI,yBAAyB;AACzC,SAAK,MAAM,IAAI,QAAQ,GAAG;AAC1B,WAAO;AAAA,EACT;AAAA,EAEA,YAAY,QAA+C;AACzD,SAAK,MAAM;AACX,WAAO,KAAK,MAAM,IAAI,MAAM;AAAA,EAC9B;AAAA,EAEA,gBAAgB,QAAsB;AACpC,SAAK,MAAM;AACX,UAAM,MAAM,KAAK,MAAM,IAAI,MAAM;AACjC,SAAK,mBAAmB;AACxB,SAAK,MAAM,OAAO,MAAM;AAAA,EAC1B;AAAA,EAEA,IAAI,iBAAyB;AAC3B,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,QAAc;AACZ,eAAW,OAAO,KAAK,MAAM,OAAO,GAAG;AACrC,UAAI,mBAAmB;AAAA,IACzB;AACA,SAAK,MAAM,MAAM;AAAA,EACnB;AACF;AAQO,IAAM,qBAAN,MAAyB;AAAA,EAO9B,YAAY,UAAqC,CAAC,GAAG;AANrD,SAAiB,UAAU,oBAAI,IAA0B;AAIzD,SAAQ,SAAS;AAGf,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,MAAM,QAAQ,OAAO,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,QAAQ,OAAkD;AACxD,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,gCAAgC;AAEjE,UAAM,MAAM,KAAK,IAAI;AACrB,SAAK,aAAa,GAAG;AACrB,UAAM,MAAM,KAAK,UAAU;AAAA,MACzB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AACD,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,UAAM,QAAQ,YAAY,KAAK,YAAY,KAAK,GAAG;AACnD,UAAM,iBAAiB;AACvB,UAAM,cAAc;AACpB,QAAI,WAAW;AACf,WAAO;AAAA,MACL,SAAS,MAAM;AAAA,MACf,SAAS,MAAY;AACnB,YAAI,SAAU;AACd,mBAAW;AACX,cAAM,cAAc;AACpB,cAAM,iBAAiB,KAAK,IAAI;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,QAAI,KAAK,OAAQ;AACjB,SAAK,SAAS;AACd,eAAW,SAAS,KAAK,QAAQ,OAAO,GAAG;AACzC,YAAM,QAAQ,MAAM;AAAA,IACtB;AACA,SAAK,QAAQ,MAAM;AAAA,EACrB;AAAA,EAEQ,aAAa,KAAmB;AACtC,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,SAAS;AACvC,UACE,CAAC,KAAK,SAAS,KAAK,KACpB,MAAM,MAAM,iBAAiB,KAAK,WAClC;AACA,cAAM,QAAQ,MAAM;AACpB,aAAK,QAAQ,OAAO,GAAG;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,eAAqB;AAC3B,QAAI,KAAK,QAAQ,OAAO,KAAK,UAAW;AAExC,QAAI;AACJ,eAAW,aAAa,KAAK,SAAS;AACpC,UAAI,KAAK,SAAS,UAAU,CAAC,CAAC,EAAG;AACjC,UAAI,CAAC,UAAU,UAAU,CAAC,EAAE,iBAAiB,OAAO,CAAC,EAAE,gBAAgB;AACrE,iBAAS;AAAA,MACX;AAAA,IACF;AAEA,QAAI,CAAC,OAAQ,OAAM,IAAI,wBAAwB,KAAK,SAAS;AAC7D,WAAO,CAAC,EAAE,QAAQ,MAAM;AACxB,SAAK,QAAQ,OAAO,OAAO,CAAC,CAAC;AAAA,EAC/B;AAAA,EAEQ,YAAY,KAAa,KAA2B;AAC1D,SAAK,aAAa;AAClB,UAAM,QAAsB;AAAA,MAC1B,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,SAAS,IAAI,+BAA+B,MAAM;AAChD,cAAM,iBAAiB,KAAK,IAAI;AAAA,MAClC,CAAC;AAAA,IACH;AACA,SAAK,QAAQ,IAAI,KAAK,KAAK;AAC3B,WAAO;AAAA,EACT;AAAA,EAEQ,SAAS,OAA8B;AAC7C,WAAO,MAAM,aAAa,KAAK,MAAM,QAAQ,iBAAiB;AAAA,EAChE;AACF;;;ALpIA,SAAS,UAAU,OAA0D;AAC3E,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,CAAC;AACxC,SAAO;AACT;AAGA,SAAS,eACP,SAC+C;AAC/C,SAAQ,QACL;AACL;AAMA,SAAS,aAAa,SAAiC;AACrD,QAAM,WACJ,UAAU,QAAQ,QAAQ,mBAAmB,CAAC,KAAK,QAAQ;AAC7D,QAAM,gBAAgB,UAAU,QAAQ,QAAQ,kBAAkB,CAAC;AACnE,QAAM,OAAO,gBACT,cAAc,MAAM,GAAG,EAAE,CAAC,EAAG,KAAK,IAClC,QAAQ;AACZ,SAAO,GAAG,QAAQ,MAAM,IAAI;AAC9B;AAMA,SAAS,iBACP,UACA,cACiB;AACjB,SAAO,IAAI,gBAAgB;AAAA,IACzB,iBAAiB,CAAC,WAChB,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAAC;AAAA,IACzC,GAAI,iBAAiB,SAAY,EAAE,UAAU,aAAa,IAAI,CAAC;AAAA,EACjE,CAAC;AACH;AAEA,SAAS,iBAAiB,MAAuC;AAC/D,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,QAAQ,MAAM;AAC7D,UAAM,KAAM,KAA0B;AACtC,QAAI,OAAO,OAAO,YAAY,OAAO,OAAO,YAAY,OAAO,MAAM;AACnE,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,mBAAmB,YAA4B;AACtD,UAAQ,YAAY;AAAA,IAClB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,aACP,IACA,MACA,SACiB;AACjB,SAAO,EAAE,SAAS,OAAO,IAAI,OAAO,EAAE,MAAM,QAAQ,EAAE;AACxD;AAEA,SAAS,iBACP,OAC2D;AAC3D,SACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MACN,OAAO,aACT,MAAM;AAEV;AAEA,IAAM,cAAsC;AAAA,EAC1C,gBAAgB;AAAA,EAChB,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,+BAA+B;AAAA,EAC/B,eAAe;AACjB;AAOO,SAAS,0BACd,KACA,MACM;AACN,QAAM,cAAc,KAAK;AACzB,QAAM,eACJ,KAAK,wBACJ,MAAM,gBAAgB,WAAW,MAAM,EAAE;AAC5C,QAAM,uBAAuB,KAAK,yBAC/B,MAAM,gBAAgB,WAAW,cAAc,EAAE;AACpD,QAAM,oBACJ,KAAK,sBACJ,MAAM,gBAAgB,WAAW,WAAW,EAAE;AACjD,QAAM,kBACJ,KAAK,oBACJ,MAAM,gBAAgB,WAAW,SAAS,EAAE;AAC/C,QAAM,kBAAkB,KAAK,mBAAmB,IAAI,mBAAmB;AACvE,MAAI,QAAQ,WAAW,YAAY;AACjC,oBAAgB,MAAM;AAAA,EACxB,CAAC;AAGD,MAAI;AAAA,IACF;AAAA,IACA,OAAO,SAAS,UAAU;AAGxB,YAAM,OAAO,MAAM,YAAY;AAAA,QAC7B,UAAU,QAAQ,QAAQ,aAAa,KACrC,UAAU,QAAQ,QAAQ,WAAW,CAAC;AAAA,MAC1C;AACA,UAAI,CAAC,KAAK,eAAe;AACvB,cAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAChD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,oBAAY,MAAM,YAAY;AAAA,UAC5B;AAAA,UACA,QAAQ,OAAO;AAAA,QACjB;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,cAAc;AAC/B,gBAAM,OAAO,IAAI,UAAU,EAAE,KAAK,EAAE,OAAO,IAAI,QAAQ,CAAC;AACxD;AAAA,QACF;AACA,gBAAQ,IAAI,MAAM,EAAE,IAAI,GAAG,qBAAqB;AAChD,cAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAClD;AAAA,MACF;AAEA,YAAM,OAAO,eAAe,KAAK;AACjC,YACG,OAAO,GAAG,EACV;AAAA,QACC,2BAA2B;AAAA,UACzB;AAAA,UACA,SAAS,aAAa,OAAO;AAAA,QAC/B,CAAC;AAAA,MACH;AAAA,IACJ;AAAA,EACF;AAGA,MAAI;AAAA,IACF;AAAA,IACA,OAAO,SAAS,UAAU;AACxB,YAAM,YAAY,iBAAiB,QAAQ,IAAI;AAC/C,YAAM,OAAO,MAAM,YAAY;AAAA,QAC7B,UAAU,QAAQ,QAAQ,aAAa,KACrC,UAAU,QAAQ,QAAQ,WAAW,CAAC;AAAA,MAC1C;AAEA,UAAI,CAAC,KAAK,eAAe;AACvB,cAAM,OAAO,GAAG,EAAE,KAAK,aAAa,WAAW,QAAQ,cAAc,CAAC;AACtE;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,oBAAY,MAAM,YAAY;AAAA,UAC5B;AAAA,UACA,QAAQ,OAAO;AAAA,QACjB;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,cAAc;AAC/B,gBACG,OAAO,IAAI,UAAU,EACrB;AAAA,YACC;AAAA,cACE;AAAA,cACA,mBAAmB,IAAI,UAAU;AAAA,cACjC,IAAI;AAAA,YACN;AAAA,UACF;AACF;AAAA,QACF;AACA,gBAAQ,IAAI,MAAM,EAAE,IAAI,GAAG,kBAAkB;AAC7C,cACG,OAAO,GAAG,EACV,KAAK,aAAa,WAAW,QAAQ,gBAAgB,CAAC;AACzD;AAAA,MACF;AAEA,YAAM,QAAQ;AAAA,QACZ,UAAU,KAAK,YAAY;AAAA,QAC3B,WAAW,KAAK,aAAa;AAAA,QAC7B,aAAa,UAAU;AAAA,MACzB;AACA,YAAM,gBAAgB,aAAa;AACnC,YAAM,YAAY,qBAAqB;AAGvC,YAAM,YAA0B,yBAAyB,SAAS,IAC9D,IAAI,oBAAoB;AAAA,QACtB,WAAW;AAAA,QACX,eAAe;AAAA,QACf,WAAW,2BAA2B;AAAA,UACpC,WAAW;AAAA,UACX,eAAe;AAAA,QACjB,CAAC;AAAA,QACD;AAAA,MACF,CAAC,IACA,IAAI,kBAAkB;AAC3B,YAAM,WAAW,iBAAiB,MAAM,UAAU,KAAK,YAAY;AACnE,YAAM,WAAW,IAAI,mBAAmB,EAAE,OAAO,WAAW,WAAW,SAAS,CAAC;AACjF,YAAM,OAAO,2BAA2B;AAAA,QACtC;AAAA,QACA,SAAS,aAAa,OAAO;AAAA,MAC/B,CAAC;AACD,UAAI;AACJ,UAAI;AACF,uBAAe,gBAAgB,QAAQ,KAAK;AAAA,MAC9C,SAAS,KAAK;AACZ,YAAI,eAAe,yBAAyB;AAC1C,kBAAQ,IAAI,MAAM,EAAE,KAAK,MAAM,GAAG,8BAA8B;AAChE,gBACG,OAAO,GAAG,EACV,KAAK,aAAa,WAAW,QAAQ,gCAAgC,CAAC;AACzE;AAAA,QACF;AACA,cAAM;AAAA,MACR;AACA,UAAI;AACJ,UAAI;AACF,cAAM,UAAU,IAAI;AAAA,UAClB;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa;AAAA,QACf;AACA,cAAM,YAAY,IAAI,wBAAwB,OAAO;AACrD,cAAM,OAAO,eAAe,KAAK;AACjC,iBAAS,MAAM,UAAU,OAAO,QAAQ,IAAI;AAAA,MAC9C,SAAS,KAAK;AACZ,qBAAa,QAAQ;AACrB,gBAAQ,IAAI,MAAM,EAAE,IAAI,GAAG,qBAAqB;AAChD,cACG,OAAO,GAAG,EACV,KAAK,aAAa,WAAW,QAAQ,gBAAgB,CAAC;AACzD;AAAA,MACF;AAEA,UAAI,iBAAiB,MAAM,GAAG;AAC5B,cAAM,OAAO;AACb,cAAM,IAAI,UAAU,KAAK,WAAW;AACpC,YAAI;AACF,2BAAiB,OAAO,QAAQ;AAC9B,kBAAM,IAAI,MAAM,SAAS,KAAK,UAAU,GAAG,CAAC;AAAA;AAAA,CAAM;AAAA,UACpD;AAAA,QACF,SAAS,KAAK;AACZ,kBAAQ,IAAI,MAAM,EAAE,IAAI,GAAG,oBAAoB;AAC/C,gBAAM,gBAAgB;AAAA,YACpB,SAAS;AAAA,YACT,IAAI;AAAA,YACJ,OAAO,SAAS;AAAA,cACd,eAAe,QAAQ,IAAI,UAAU;AAAA,YACvC,EAAE,eAAe;AAAA,UACnB;AACA,gBAAM,IAAI,MAAM;AAAA,QAAuB,KAAK,UAAU,aAAa,CAAC;AAAA;AAAA,CAAM;AAAA,QAC5E,UAAE;AACA,uBAAa,QAAQ;AACrB,gBAAM,IAAI,IAAI;AAAA,QAChB;AACA;AAAA,MACF;AAEA,mBAAa,QAAQ;AACrB,YAAM,KAAK,MAAM;AAAA,IACnB;AAAA,EACF;AAGA,MAAI;AAAA,IAIF;AAAA,IACA,OAAO,SAAS,UAAU;AACxB,YAAM,OAAO,eAAe,OAAO;AACnC,UAAI,CAAC,MAAM,UAAU;AACnB,cAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,eAAe,CAAC;AAChE;AAAA,MACF;AACA,YAAM,WAAW,KAAK;AACtB,YAAM,OAAO,QAAQ,QAAQ,CAAC;AAC9B,YAAM,EAAE,WAAW,QAAQ,IAAI;AAE/B,UAAI,CAAC,WAAW;AACd,cAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,wBAAwB,CAAC;AACzD;AAAA,MACF;AACA,UAAI,CAAC,WAAW,CAAC,QAAQ,KAAK,GAAG;AAC/B,cAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sBAAsB,CAAC;AACvD;AAAA,MACF;AAEA,YAAM,YAAY,MAAM,kBAAkB,EAAE;AAAA,QAC1C;AAAA,QACA,QAAQ,OAAO;AAAA,MACjB;AACA,UAAI,CAAC,WAAW;AACd,cAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sBAAsB,CAAC;AACvD;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,gBAAgB,EAAE;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,WAAW,QAAQ,aAAa,UAAU;AAC7C,cAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AACrD;AAAA,MACF;AAEA,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA;AAAA,QACA,aAAa,UAAU;AAAA,MACzB;AACA,YAAM,WAAW,iBAAiB,MAAM,UAAU,KAAK,YAAY;AACnE,YAAM,gBAAgB,aAAa;AACnC,YAAM,YAAY,qBAAqB;AAGvC,YAAM,YAA0B,yBAAyB,SAAS,IAC9D,IAAI,oBAAoB;AAAA,QACtB,WAAW;AAAA,QACX,eAAe;AAAA,QACf,WAAW,2BAA2B;AAAA,UACpC,WAAW;AAAA,UACX,eAAe;AAAA,QACjB,CAAC;AAAA,QACD;AAAA,MACF,CAAC,IACA,IAAI,kBAAkB;AAC3B,YAAM,WAAW,IAAI,mBAAmB,EAAE,OAAO,WAAW,WAAW,SAAS,CAAC;AAEjF,YAAM,SAASG,QAAO;AACtB,YAAM,YAAYA,QAAO;AACzB,YAAM,cAAuB;AAAA,QAC3B,MAAM;AAAA,QACN,WAAWA,QAAO;AAAA,QAClB,MAAM;AAAA,QACN,OAAO,CAAC,EAAE,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,MACzC;AACA,YAAM,iBAAiB,IAAI,eAAe,aAAa,QAAQ,SAAS;AACxE,YAAM,MAAM,IAAIC,0BAAyB;AAEzC,YAAM,OAAO;AACb,YAAM,IAAI,UAAU,KAAK,WAAW;AAEpC,YAAM,YAAY,CAAC,OAAe,SAAwB;AACxD,cAAM,IAAI,MAAM,UAAU,KAAK;AAAA,QAAW,KAAK,UAAU,IAAI,CAAC;AAAA;AAAA,CAAM;AAAA,MACtE;AAEA,UAAI,GAAG,SAAS,CAAC,UAA+B;AAC9C,kBAAU,MAAM,MAAM,KAAK;AAAA,MAC7B,CAAC;AAED,UAAI;AACF,cAAM,SAAS,QAAQ,gBAAgB,GAAG;AAAA,MAC5C,SAAS,KAAK;AACZ,gBAAQ,IAAI,MAAM,EAAE,IAAI,GAAG,yBAAyB;AACpD,kBAAU,iBAAiB;AAAA,UACzB,MAAM;AAAA,UACN;AAAA,UACA;AAAA,UACA,QAAQ,EAAE,OAAO,UAAU,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,UAC/D,OAAO;AAAA,QACT,CAAC;AAAA,MACH,UAAE;AACA,cAAM,IAAI,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACF;","names":["uuidv4","DefaultExecutionEventBus","asString","extractText","initialTask","uuidv4","DefaultExecutionEventBus"]}

package/dist/chunk-GF4GGTWJ.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/services/open/openLattice.ts"],"sourcesContent":["/**\n * OpenLattice — the registry + invocation kernel for the Open API surface.\n *\n * Every credential-driven execution flows through exactly one path:\n *   catalogFor(grants)  → what the credential may see\n *   invoke(grants, ...) → authorize → validate → execute → result\n *\n * Built-in providers (kb, sandbox, agent) and plugin-exposed tools all\n * register the same OpenProviderDeclaration contract.\n */\n\nimport { z } from \"zod\";\nimport type {\n  OpenCapabilitySource,\n  OpenCatalogDomain,\n  OpenCatalogItem,\n  OpenExecutionContext,\n  OpenExecutionResult,\n  OpenGrant,\n} from \"@axiom-lattice/protocols\";\n\nexport interface OpenActionDeclaration {\n  name: string;\n  /** Explicit MCP tool name override (defaults to `{domain}_{name}`). */\n  toolName?: string;\n  /** Friendly display label (falls back to the action name). */\n  label?: string;\n  description: string;\n  schema: z.ZodRawShape | z.ZodTypeAny;\n  annotations: { readOnlyHint: boolean; destructiveHint: boolean };\n}\n\n/** Request-scoped context available while deriving the catalog. */\nexport interface OpenCatalogContext {\n  tenantId?: string;\n}\n\nexport interface OpenProviderDeclaration {\n  domain: string;\n  /** Human label for the management catalog (defaults to domain). */\n  label?: string;\n  /** Catalog provenance (defaults to \"builtin\"). */\n  source?: OpenCapabilitySource;\n  /** \"action\" (kb/plugins) or \"instance\" (agent); defaults to \"action\". */\n  itemKind?: \"action\" | \"instance\";\n  /** Display-only scope hint (defaults to \"tenant\"). */\n  scopeKind?: \"tenant\" | \"workspace\" | \"project\";\n  actions: OpenActionDeclaration[];\n  /**\n   * Dynamic actions derived from the credential's grants — used by instance\n   * domains (e.g. agent: one tool per granted assistant).\n   */\n  instanceActions?: (grants: OpenGrant[], ctx?: OpenCatalogContext) => OpenActionDeclaration[] | Promise<OpenActionDeclaration[]>;\n  execute: (\n    action: string,\n    args: unknown,\n    ctx: OpenExecutionContext,\n  ) => Promise<OpenExecutionResult>;\n}\n\nexport interface OpenToolDescriptor {\n  /** MCP tool name, \"{domain}_{action}\". */\n  toolName: string;\n  domain: string;\n  action: string;\n  description: string;\n  schema: z.ZodRawShape | z.ZodTypeAny;\n  annotations: { readOnlyHint: boolean; destructiveHint: boolean };\n}\n\n/** Thrown when a credential has no grant covering the requested action. */\nexport class GrantDeniedError extends Error {\n  readonly code = \"GRANT_DENIED\";\n  constructor(toolName: string) {\n    super(`GRANT_DENIED: no grant covers ${toolName}`);\n    this.name = \"GrantDeniedError\";\n  }\n}\n\n/** Thrown when args fail the action's zod schema. */\nexport class ValidationError extends Error {\n  readonly code = \"VALIDATION_FAILED\";\n  constructor(detail: string) {\n    super(`VALIDATION_FAILED: ${detail}`);\n    this.name = \"ValidationError\";\n  }\n}\n\n/** Thrown for a toolName with no registered provider/action. */\nexport class ActionNotFoundError extends Error {\n  readonly code = \"ACTION_NOT_FOUND\";\n  constructor(toolName: string) {\n    super(`ACTION_NOT_FOUND: ${toolName}`);\n    this.name = \"ActionNotFoundError\";\n  }\n}\n\ninterface RegisteredProvider {\n  declaration: OpenProviderDeclaration;\n  actions: Map<string, OpenActionDeclaration>;\n}\n\n/** Effective MCP tool name: explicit override, else `{domain}_{name}`. */\nfunction effectiveToolName(domain: string, action: OpenActionDeclaration): string {\n  return action.toolName ?? `${domain}_${action.name}`;\n}\n\nfunction grantCoversAction(\n  grants: OpenGrant[],\n  domain: string,\n  action: string,\n): boolean {\n  return grants.some(\n    (g) => g.domain === domain && (!g.items || g.items.length === 0 || g.items.includes(action)),\n  );\n}\n\nexport class OpenLattice {\n  private providers = new Map<string, RegisteredProvider>();\n\n  /** Register a provider; domain+action collisions are rejected. */\n  register(declaration: OpenProviderDeclaration): void {\n    const existing = this.providers.get(declaration.domain);\n    if (existing) {\n      throw new Error(\n        `Open provider domain already registered: ${declaration.domain}`,\n      );\n    }\n    const actions = new Map<string, OpenActionDeclaration>();\n    for (const action of declaration.actions) {\n      actions.set(action.name, action);\n    }\n    this.providers.set(declaration.domain, { declaration, actions });\n  }\n\n  /** Tool descriptors visible under the given grants (default-deny). */\n  async catalogFor(grants: OpenGrant[], ctx?: OpenCatalogContext): Promise<OpenToolDescriptor[]> {\n    const catalog: OpenToolDescriptor[] = [];\n    for (const [domain, entry] of this.providers) {\n      // Static actions.\n      for (const [actionName, action] of entry.actions) {\n        if (!grantCoversAction(grants, domain, actionName)) continue;\n        catalog.push({\n          toolName: effectiveToolName(domain, action),\n          domain,\n          action: actionName,\n          description: action.description,\n          schema: action.schema,\n          annotations: action.annotations,\n        });\n      }\n      // Instance-derived actions (e.g. agent: one tool per granted assistant).\n      if (entry.declaration.instanceActions) {\n        const instances = await entry.declaration.instanceActions(grants, ctx);\n        for (const action of instances) {\n          catalog.push({\n            toolName: effectiveToolName(domain, action),\n            domain,\n            action: action.name,\n            description: action.description,\n            schema: action.schema,\n            annotations: action.annotations,\n          });\n        }\n      }\n    }\n    return catalog;\n  }\n\n  /**\n   * Full grantable catalog (unfiltered by grants) for the management picker.\n   * Instance domains (agent) return an empty item list — the catalog service\n   * fills their per-tenant instances.\n   */\n  describeCatalog(): OpenCatalogDomain[] {\n    const domains: OpenCatalogDomain[] = [];\n    for (const [domain, entry] of this.providers) {\n      const declaration = entry.declaration;\n      const items: OpenCatalogItem[] = [];\n      if ((declaration.itemKind ?? \"action\") === \"action\") {\n        for (const [actionName, action] of entry.actions) {\n          items.push({\n            id: actionName,\n            toolName: `${domain}_${actionName}`,\n            label: action.label ?? actionName,\n            description: action.description,\n            annotations: action.annotations,\n          });\n        }\n      }\n      domains.push({\n        domain,\n        label: declaration.label ?? domain,\n        source: declaration.source ?? \"builtin\",\n        scopeKind: declaration.scopeKind ?? \"tenant\",\n        itemKind: declaration.itemKind ?? \"action\",\n        items,\n      });\n    }\n    return domains;\n  }\n\n  private async resolveAction(\n    grants: OpenGrant[],\n    toolName: string,\n    ctx?: OpenCatalogContext,\n  ): Promise<{\n    domain: string;\n    entry: RegisteredProvider;\n    action: OpenActionDeclaration;\n    /** Grant-matching id: the action name (assistant id for agent instances). */\n    actionName: string;\n  } | null> {\n    for (const [domain, entry] of this.providers) {\n      for (const [actionName, action] of entry.actions) {\n        if (effectiveToolName(domain, action) === toolName) {\n          return { domain, entry, action, actionName };\n        }\n      }\n      if (entry.declaration.instanceActions) {\n        const instances = await entry.declaration.instanceActions(grants, ctx);\n        for (const action of instances) {\n          if (effectiveToolName(domain, action) === toolName) {\n            return { domain, entry, action, actionName: action.name };\n          }\n        }\n      }\n    }\n    return null;\n  }\n\n  /** Whether the given grants cover a tool (`{domain}_{action}`). */\n  isAllowed(grants: OpenGrant[], toolName: string): boolean {\n    const sep = toolName.indexOf(\"_\");\n    const domain = sep > 0 ? toolName.slice(0, sep) : toolName;\n    const action = sep > 0 ? toolName.slice(sep + 1) : \"\";\n    return grantCoversAction(grants, domain, action);\n  }\n\n  /** The single credential-driven execution path. */\n  async invoke(\n    grants: OpenGrant[],\n    ctx: OpenExecutionContext,\n    toolName: string,\n    args: unknown,\n  ): Promise<OpenExecutionResult> {\n    const resolved = await this.resolveAction(grants, toolName, { tenantId: ctx.tenantId });\n    if (!resolved) {\n      throw new ActionNotFoundError(toolName);\n    }\n    if (!grantCoversAction(grants, resolved.domain, resolved.actionName)) {\n      throw new GrantDeniedError(toolName);\n    }\n    const resolvedSchema = resolved.action.schema;\n    const parsed = (\n      \"safeParse\" in resolvedSchema\n        ? (resolvedSchema as z.ZodTypeAny).safeParse(args)\n        : z.object(resolvedSchema as z.ZodRawShape).safeParse(args)\n    );\n    if (!parsed.success) {\n      throw new ValidationError(parsed.error.issues.map((i) => `${i.path.join(\".\")}: ${i.message}`).join(\"; \"));\n    }\n    return resolved.entry.declaration.execute(resolved.actionName, parsed.data, ctx);\n  }\n}\n\n/** Process-wide singleton for the gateway's Open surface. */\nexport const openLattice = new OpenLattice();\n"],"mappings":";AAWA,SAAS,SAAS;AA4DX,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAE1C,YAAY,UAAkB;AAC5B,UAAM,iCAAiC,QAAQ,EAAE;AAFnD,SAAS,OAAO;AAGd,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAEzC,YAAY,QAAgB;AAC1B,UAAM,sBAAsB,MAAM,EAAE;AAFtC,SAAS,OAAO;AAGd,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAE7C,YAAY,UAAkB;AAC5B,UAAM,qBAAqB,QAAQ,EAAE;AAFvC,SAAS,OAAO;AAGd,SAAK,OAAO;AAAA,EACd;AACF;AAQA,SAAS,kBAAkB,QAAgB,QAAuC;AAChF,SAAO,OAAO,YAAY,GAAG,MAAM,IAAI,OAAO,IAAI;AACpD;AAEA,SAAS,kBACP,QACA,QACA,QACS;AACT,SAAO,OAAO;AAAA,IACZ,CAAC,MAAM,EAAE,WAAW,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,WAAW,KAAK,EAAE,MAAM,SAAS,MAAM;AAAA,EAC5F;AACF;AAEO,IAAM,cAAN,MAAkB;AAAA,EAAlB;AACL,SAAQ,YAAY,oBAAI,IAAgC;AAAA;AAAA;AAAA,EAGxD,SAAS,aAA4C;AACnD,UAAM,WAAW,KAAK,UAAU,IAAI,YAAY,MAAM;AACtD,QAAI,UAAU;AACZ,YAAM,IAAI;AAAA,QACR,4CAA4C,YAAY,MAAM;AAAA,MAChE;AAAA,IACF;AACA,UAAM,UAAU,oBAAI,IAAmC;AACvD,eAAW,UAAU,YAAY,SAAS;AACxC,cAAQ,IAAI,OAAO,MAAM,MAAM;AAAA,IACjC;AACA,SAAK,UAAU,IAAI,YAAY,QAAQ,EAAE,aAAa,QAAQ,CAAC;AAAA,EACjE;AAAA;AAAA,EAGA,MAAM,WAAW,QAAqB,KAAyD;AAC7F,UAAM,UAAgC,CAAC;AACvC,eAAW,CAAC,QAAQ,KAAK,KAAK,KAAK,WAAW;AAE5C,iBAAW,CAAC,YAAY,MAAM,KAAK,MAAM,SAAS;AAChD,YAAI,CAAC,kBAAkB,QAAQ,QAAQ,UAAU,EAAG;AACpD,gBAAQ,KAAK;AAAA,UACX,UAAU,kBAAkB,QAAQ,MAAM;AAAA,UAC1C;AAAA,UACA,QAAQ;AAAA,UACR,aAAa,OAAO;AAAA,UACpB,QAAQ,OAAO;AAAA,UACf,aAAa,OAAO;AAAA,QACtB,CAAC;AAAA,MACH;AAEA,UAAI,MAAM,YAAY,iBAAiB;AACrC,cAAM,YAAY,MAAM,MAAM,YAAY,gBAAgB,QAAQ,GAAG;AACrE,mBAAW,UAAU,WAAW;AAC9B,kBAAQ,KAAK;AAAA,YACX,UAAU,kBAAkB,QAAQ,MAAM;AAAA,YAC1C;AAAA,YACA,QAAQ,OAAO;AAAA,YACf,aAAa,OAAO;AAAA,YACpB,QAAQ,OAAO;AAAA,YACf,aAAa,OAAO;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAAuC;AACrC,UAAM,UAA+B,CAAC;AACtC,eAAW,CAAC,QAAQ,KAAK,KAAK,KAAK,WAAW;AAC5C,YAAM,cAAc,MAAM;AAC1B,YAAM,QAA2B,CAAC;AAClC,WAAK,YAAY,YAAY,cAAc,UAAU;AACnD,mBAAW,CAAC,YAAY,MAAM,KAAK,MAAM,SAAS;AAChD,gBAAM,KAAK;AAAA,YACT,IAAI;AAAA,YACJ,UAAU,GAAG,MAAM,IAAI,UAAU;AAAA,YACjC,OAAO,OAAO,SAAS;AAAA,YACvB,aAAa,OAAO;AAAA,YACpB,aAAa,OAAO;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,MACF;AACA,cAAQ,KAAK;AAAA,QACX;AAAA,QACA,OAAO,YAAY,SAAS;AAAA,QAC5B,QAAQ,YAAY,UAAU;AAAA,QAC9B,WAAW,YAAY,aAAa;AAAA,QACpC,UAAU,YAAY,YAAY;AAAA,QAClC;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,cACZ,QACA,UACA,KAOQ;AACR,eAAW,CAAC,QAAQ,KAAK,KAAK,KAAK,WAAW;AAC5C,iBAAW,CAAC,YAAY,MAAM,KAAK,MAAM,SAAS;AAChD,YAAI,kBAAkB,QAAQ,MAAM,MAAM,UAAU;AAClD,iBAAO,EAAE,QAAQ,OAAO,QAAQ,WAAW;AAAA,QAC7C;AAAA,MACF;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,cAAM,YAAY,MAAM,MAAM,YAAY,gBAAgB,QAAQ,GAAG;AACrE,mBAAW,UAAU,WAAW;AAC9B,cAAI,kBAAkB,QAAQ,MAAM,MAAM,UAAU;AAClD,mBAAO,EAAE,QAAQ,OAAO,QAAQ,YAAY,OAAO,KAAK;AAAA,UAC1D;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,UAAU,QAAqB,UAA2B;AACxD,UAAM,MAAM,SAAS,QAAQ,GAAG;AAChC,UAAM,SAAS,MAAM,IAAI,SAAS,MAAM,GAAG,GAAG,IAAI;AAClD,UAAM,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM,CAAC,IAAI;AACnD,WAAO,kBAAkB,QAAQ,QAAQ,MAAM;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,OACJ,QACA,KACA,UACA,MAC8B;AAC9B,UAAM,WAAW,MAAM,KAAK,cAAc,QAAQ,UAAU,EAAE,UAAU,IAAI,SAAS,CAAC;AACtF,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,oBAAoB,QAAQ;AAAA,IACxC;AACA,QAAI,CAAC,kBAAkB,QAAQ,SAAS,QAAQ,SAAS,UAAU,GAAG;AACpE,YAAM,IAAI,iBAAiB,QAAQ;AAAA,IACrC;AACA,UAAM,iBAAiB,SAAS,OAAO;AACvC,UAAM,SACJ,eAAe,iBACV,eAAgC,UAAU,IAAI,IAC/C,EAAE,OAAO,cAA+B,EAAE,UAAU,IAAI;AAE9D,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,gBAAgB,OAAO,MAAM,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IAC1G;AACA,WAAO,SAAS,MAAM,YAAY,QAAQ,SAAS,YAAY,OAAO,MAAM,GAAG;AAAA,EACjF;AACF;AAGO,IAAM,cAAc,IAAI,YAAY;","names":[]}