@axiom-lattice/gateway 4.7.0 → 4.8.0

package/dist/open-STFMNRO5.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/routes/open.ts","../src/services/open/openRateLimiter.ts","../src/services/open/openMcpServer.ts"],"sourcesContent":["/**\n * Open API surface routes: POST/DELETE /open/mcp.\n *\n * The route is a thin shell — credential resolution (OpenAuthService),\n * catalog filtering and invocation (OpenLattice), and session lifecycle\n * (mcpTransportRegistry) live in services/open/*. The transport writes the\n * response itself, so the reply is hijacked (same precedent as the Project\n * Room SSE route).\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport { isInitializeRequest } from \"@modelcontextprotocol/sdk/types.js\";\nimport { getStoreLattice } from \"@axiom-lattice/core\";\nimport type { A2AApiKeyStore, OpenAuditStore, OpenGrant, ProjectStore } from \"@axiom-lattice/protocols\";\nimport { OpenCredentialService } from \"../services/open/openCredentialService\";\nimport { OpenAuditService } from \"../services/open/openAuditService\";\nimport { OpenRateLimiter } from \"../services/open/openRateLimiter\";\nimport type { OpenCredential } from \"../services/open/openCredentialService\";\nimport {\n  openLattice,\n  ActionNotFoundError,\n  GrantDeniedError,\n  ValidationError,\n} from \"../services/open/openLattice\";\nimport { buildSessionServer } from \"../services/open/openMcpServer\";\nimport { collectExposedPluginUiResources } from \"../services/open/registerExposedPlugins\";\nimport {\n  buildTenantOpenPlugins,\n  mergeOpenCatalog,\n  type TenantOpenPlugins,\n} from \"../services/open/tenantOpenPlugins\";\nimport { getSession, deleteSession } from \"../services/open/mcpTransportRegistry\";\n\nexport interface OpenRouteDeps {\n  openAuth?: OpenCredentialService;\n  grantsSource?: (ctx: OpenCredential) => OpenGrant[];\n  audit?: OpenAuditService;\n  rateLimiter?: OpenRateLimiter;\n  /**\n   * Test seam: build the credential's tenant sandbox plugin bundle. Defaults to\n   * {@link buildTenantOpenPlugins} with the global catalog's tool names reserved\n   * so a tenant tool can never shadow a global/built-in one.\n   */\n  tenantPlugins?: (\n    tenantId: string,\n    grants: OpenGrant[],\n    reservedToolNames: ReadonlySet<string>,\n  ) => Promise<TenantOpenPlugins>;\n}\n\nfunction extractBearer(request: FastifyRequest): string | undefined {\n  const header = request.headers.authorization;\n  if (!header?.startsWith(\"Bearer \")) return undefined;\n  return header.slice(\"Bearer \".length).trim() || undefined;\n}\n\nfunction readSessionId(request: FastifyRequest): string | undefined {\n  const raw = request.headers[\"mcp-session-id\"];\n  const value = Array.isArray(raw) ? raw[0] : raw;\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\n/**\n * Degraded tenant plugin bundle used when the sandbox catalog cannot be read.\n *\n * A catalog read failure must not 500 the session: the MCP server still builds\n * and serves the global tools. `invoke` is unreachable through normal routing\n * (`hasTool` is always false, so calls route to OpenLattice) but returns an\n * error result if it is ever reached.\n */\nfunction emptyTenantPlugins(): TenantOpenPlugins {\n  return {\n    tools: [],\n    uiResources: new Map(),\n    hasTool: () => false,\n    degraded: true,\n    invoke: async (toolName) => ({\n      content: [\n        { type: \"text\", text: `Tenant plugin catalog unavailable for ${toolName}` },\n      ],\n      isError: true,\n    }),\n  };\n}\n\n/** JSON-RPC error codes used on the Open surface. */\nconst RPC_ERROR = {\n  GRANT_DENIED: -32001,\n  ACTION_NOT_FOUND: -32002,\n  VALIDATION_FAILED: -32003,\n  EXECUTION_ERROR: -32004,\n  RATE_LIMITED: -32005,\n} as const;\n\nexport function registerOpenRoutes(\n  app: FastifyInstance,\n  deps: OpenRouteDeps = {},\n): void {\n  const openAuth =\n    deps.openAuth ??\n    new OpenCredentialService(\n      getStoreLattice(\"default\", \"a2aApiKey\").store as A2AApiKeyStore,\n      getStoreLattice(\"default\", \"project\").store as ProjectStore,\n    );\n  const grantsSource =\n    deps.grantsSource ?? ((ctx: OpenCredential) => ctx.grants);\n  const audit =\n    deps.audit ??\n    (() => {\n      try {\n        const store = getStoreLattice(\"default\", \"openAudit\").store as OpenAuditStore;\n        return new OpenAuditService(store);\n      } catch {\n        return undefined;\n      }\n    })();\n\n  const rateLimiter = deps.rateLimiter ?? new OpenRateLimiter();\n\n  app.post(\"/open/mcp\", async (request: FastifyRequest, reply: FastifyReply) => {\n    const context = await openAuth.resolve(extractBearer(request));\n    if (!context) {\n      return reply.status(401).send({ error: \"AUTH_FAILED\" });\n    }\n\n    const body: unknown = request.body;\n    const sessionId = readSessionId(request);\n\n    // Existing session: reuse its server/transport. Bearer must match the\n    // session's credential — a session is not usable by another key.\n    if (sessionId) {\n      const session = await getSession(sessionId);\n      if (\n        !session ||\n        session.credential.credentialId !== context.credentialId\n      ) {\n        return reply.status(404).send({ error: \"SESSION_NOT_FOUND\" });\n      }\n      reply.hijack();\n      await session.transport.handleRequest(request.raw, reply.raw, body);\n      return;\n    }\n\n    // New session: only initialize may create one. Registration into the\n    // session registry happens inside sessionIdGenerator (see openMcpServer).\n    if (!isInitializeRequest(body)) {\n      return reply.status(400).send({ error: \"SESSION_REQUIRED\" });\n    }\n\n    const grants = grantsSource(context);\n    const catalog = await openLattice.catalogFor(grants, { tenantId: context.tenantId });\n    // Tenant sandbox plugins are volume-resident and outside the OpenLattice\n    // registry; merge their grant-filtered tools/UI alongside the globals.\n    // Global/built-in tool names are reserved so a tenant plugin of the same\n    // type (kb/sandbox/agent) can neither crash `registerTool` with a duplicate\n    // nor capture the invoke routing for a global tool.\n    const globalToolNames = new Set(catalog.map((t) => t.toolName));\n    const buildTenant =\n      deps.tenantPlugins ??\n      ((tenantId, tenantGrants, reservedToolNames) =>\n        buildTenantOpenPlugins(tenantId, tenantGrants, { reservedToolNames }));\n    let tenant: TenantOpenPlugins;\n    try {\n      tenant = await buildTenant(context.tenantId, grants, globalToolNames);\n      if (tenant.degraded) {\n        // The catalog's common failure mode is a diagnostic, not a throw\n        // (`ensureLoaded` returns error-level diagnostics). Surface it and\n        // serve global tools only.\n        request.log.warn(\n          { tenantId: context.tenantId },\n          \"open mcp: tenant plugin catalog degraded; serving global tools only\",\n        );\n      }\n    } catch (error) {\n      // Sandbox catalogs are volume-resident and can be transiently\n      // unavailable; degrade to globals-only rather than failing the whole\n      // session so external hosts can still connect. `err` keeps the stack.\n      request.log.warn(\n        { tenantId: context.tenantId, err: error },\n        \"open mcp: tenant plugin catalog unavailable; serving global tools only\",\n      );\n      tenant = emptyTenantPlugins();\n    }\n    const mergedCatalog = mergeOpenCatalog(catalog, tenant.tools);\n    const uiResources = new Map([\n      ...collectExposedPluginUiResources(grants),\n      ...tenant.uiResources,\n    ]);\n    const built = await buildSessionServer({\n      credential: { credentialId: context.credentialId, kind: context.kind },\n      grants,\n      catalog: mergedCatalog,\n      uiResources,\n      invoke: async (toolName, args) => {\n        const startedAt = Date.now();\n        const sep = toolName.indexOf(\"_\");\n        const auditDomain = sep > 0 ? toolName.slice(0, sep) : toolName;\n        const auditAction = sep > 0 ? toolName.slice(sep + 1) : \"\";\n\n        const decision = rateLimiter.check(context.credentialId, auditDomain);\n        if (!decision.allowed) {\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode: \"RATE_LIMITED\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(\n              `RATE_LIMITED: retry after ${decision.retryAfterMs ?? 1000}ms`,\n            ),\n            { rpcCode: RPC_ERROR.RATE_LIMITED },\n          );\n        }\n\n        try {\n          const isTenantRoute = tenant.hasTool(toolName) && !globalToolNames.has(toolName);\n          const runConfig: Record<string, unknown> = {\n            sandboxName: context.sandboxName,\n            credentialId: context.credentialId,\n          };\n          const result = isTenantRoute\n            ? await tenant.invoke(toolName, args, {\n                tenantId: context.tenantId,\n                projectId: context.projectId,\n                workspaceId: context.workspaceId,\n                runConfig,\n              })\n            : await openLattice.invoke(\n                grants,\n                {\n                  tenantId: context.tenantId,\n                  projectId: context.projectId,\n                  workspaceId: context.workspaceId,\n                  runConfig,\n                },\n                toolName,\n                args,\n              );\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: result.isError ? \"error\" : \"ok\",\n            ...(result.isError ? { errorCode: \"EXECUTION_ERROR\" } : {}),\n            durationMs: Date.now() - startedAt,\n          });\n          return result;\n        } catch (err) {\n          const code =\n            err instanceof GrantDeniedError\n              ? RPC_ERROR.GRANT_DENIED\n              : err instanceof ActionNotFoundError\n                ? RPC_ERROR.ACTION_NOT_FOUND\n                : err instanceof ValidationError\n                  ? RPC_ERROR.VALIDATION_FAILED\n                  : RPC_ERROR.EXECUTION_ERROR;\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode:\n              err instanceof GrantDeniedError\n                ? \"GRANT_DENIED\"\n                : err instanceof ActionNotFoundError\n                  ? \"ACTION_NOT_FOUND\"\n                  : err instanceof ValidationError\n                    ? \"VALIDATION_FAILED\"\n                    : \"EXECUTION_ERROR\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(err instanceof Error ? err.message : String(err)),\n            { rpcCode: code },\n          );\n        }\n      },\n    });\n    // buildSessionServer no longer connects internally (so it is testable\n    // over InMemoryTransport); the transport still needs an onmessage handler\n    // before handleRequest or initialize is swallowed and the request hangs.\n    await built.server.connect(built.transport);\n    reply.hijack();\n    await built.transport.handleRequest(request.raw, reply.raw, body);\n  });\n\n  app.delete(\n    \"/open/mcp\",\n    async (request: FastifyRequest, reply: FastifyReply) => {\n      const sessionId = readSessionId(request);\n      if (!sessionId) {\n        return reply.status(400).send({ error: \"SESSION_REQUIRED\" });\n      }\n      await deleteSession(sessionId);\n      return reply.status(204).send();\n    },\n  );\n}\n","/**\n * In-memory per-credential rate limiter (token bucket). The agent domain gets\n * a stricter bucket because each call consumes LLM budget.\n *\n * Process-local by design (V1 single-gateway); a distributed limiter is V2.\n */\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  retryAfterMs?: number;\n}\n\ninterface Bucket {\n  tokens: number;\n  updatedAt: number;\n}\n\nexport interface OpenRateLimiterOptions {\n  /** Default requests per minute per credential. */\n  defaultPerMinute?: number;\n  /** Stricter limit for the agent domain. */\n  agentPerMinute?: number;\n}\n\nexport class OpenRateLimiter {\n  private readonly buckets = new Map<string, Bucket>();\n  private readonly defaultPerMinute: number;\n  private readonly agentPerMinute: number;\n\n  constructor(options: OpenRateLimiterOptions = {}) {\n    this.defaultPerMinute = options.defaultPerMinute ?? 60;\n    this.agentPerMinute = options.agentPerMinute ?? 10;\n  }\n\n  private bucketClass(domain: string): string {\n    return domain === \"agent\" ? \"agent\" : \"default\";\n  }\n\n  private limitFor(domain: string): number {\n    return domain === \"agent\" ? this.agentPerMinute : this.defaultPerMinute;\n  }\n\n  /** Consume one token; denied calls report how long to wait. */\n  check(credentialId: string, domain: string): RateLimitDecision {\n    const limit = this.limitFor(domain);\n    const key = `${this.bucketClass(domain)}:${credentialId}`;\n    const now = Date.now();\n    const bucket = this.buckets.get(key) ?? { tokens: limit, updatedAt: now };\n\n    const refillPerMs = limit / 60_000;\n    const elapsed = now - bucket.updatedAt;\n    bucket.tokens = Math.min(limit, bucket.tokens + elapsed * refillPerMs);\n    bucket.updatedAt = now;\n\n    if (bucket.tokens >= 1) {\n      bucket.tokens -= 1;\n      this.buckets.set(key, bucket);\n      return { allowed: true };\n    }\n\n    this.buckets.set(key, bucket);\n    const deficit = 1 - bucket.tokens;\n    return { allowed: false, retryAfterMs: Math.ceil(deficit / refillPerMs) };\n  }\n\n  /** Test helper. */\n  reset(): void {\n    this.buckets.clear();\n  }\n}\n","/**\n * Builds a per-session MCP server instance whose tool list is the\n * credential-filtered OpenLattice catalog. Per-session instances are what\n * make grant-filtered tools/list possible on the official SDK.\n *\n * Session registration happens inside sessionIdGenerator — the SDK invokes\n * it exactly once while handling initialize, which guarantees the registry\n * key equals the transport-generated id that the response header carries.\n *\n * Every tool executor routes through the OpenLattice invoke kernel, so\n * authorization is re-checked on each invocation (default-deny, live grants).\n */\n\nimport { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { randomUUID } from \"crypto\";\nimport type { McpUiCsp, OpenGrant } from \"@axiom-lattice/protocols\";\nimport type { OpenToolDescriptor } from \"./openLattice\";\nimport { registerSession } from \"./mcpTransportRegistry\";\n\nexport const OPEN_MCP_SERVER_INFO = {\n  name: \"axiom-open\",\n  version: \"0.1.0\",\n} as const;\n\n/**\n * A `ui://` HTML resource served by the session. `read` is invoked per\n * `resources/read`, so the caller can fetch plugin UI lazily.\n */\nexport interface OpenUiResource {\n  /** MIME for the resource; defaults to \"text/html;profile=mcp-app\". */\n  mimeType?: string;\n  csp?: McpUiCsp;\n  read: () => Promise<{ html: string; csp?: McpUiCsp }>;\n}\n\nexport interface BuiltSession {\n  server: McpServer;\n  transport: StreamableHTTPServerTransport;\n  tools: OpenToolDescriptor[];\n}\n\n/**\n * Builds (but does not connect) a per-session MCP server. The caller MUST\n * connect it to a transport (`await built.server.connect(built.transport)`)\n * before handling requests — otherwise the transport has no onmessage\n * handler and initialize is swallowed. Deferring connect is what lets tests\n * attach the server to an `InMemoryTransport`.\n */\nexport async function buildSessionServer(options: {\n  credential: { credentialId: string; kind: string };\n  grants: OpenGrant[];\n  catalog: OpenToolDescriptor[];\n  invoke: (\n    toolName: string,\n    args: unknown,\n  ) => Promise<{\n    content: Array<{ type: \"text\"; text: string }>;\n    isError?: boolean;\n  }>;\n  uiResources?: Map<string, OpenUiResource>;\n}): Promise<BuiltSession> {\n  const { credential, catalog, invoke, uiResources } = options;\n  const server = new McpServer(OPEN_MCP_SERVER_INFO, {\n    capabilities: {\n      // The SDK has no `extensions` field; MCP App hosts discover the UI\n      // extension through `experimental`.\n      experimental: { \"io.modelcontextprotocol/ui\": {} },\n    },\n  });\n  for (const tool of catalog) {\n    server.registerTool(\n      tool.toolName,\n      {\n        description: tool.description,\n        inputSchema: tool.schema,\n        annotations: {\n          readOnlyHint: tool.annotations.readOnlyHint,\n          destructiveHint: tool.annotations.destructiveHint,\n        },\n        ...(tool.ui ? { _meta: { ui: { resourceUri: tool.ui.resourceUri } } } : {}),\n      },\n      async (args: unknown) => {\n        const result = await invoke(tool.toolName, args);\n        return { content: result.content, isError: result.isError };\n      },\n    );\n  }\n  for (const [uri, res] of uiResources ?? []) {\n    const mimeType = res.mimeType ?? \"text/html;profile=mcp-app\";\n    server.registerResource(\n      `mcp-app:${uri}`,\n      uri,\n      {\n        mimeType,\n        ...(res.csp ? { _meta: { ui: { csp: res.csp } } } : {}),\n      },\n      async (u) => {\n        const { html, csp } = await res.read();\n        return {\n          contents: [\n            {\n              uri: u.href,\n              mimeType,\n              text: html,\n              ...(csp ? { _meta: { ui: { csp } } } : {}),\n            },\n          ],\n        };\n      },\n    );\n  }\n  const transport = new StreamableHTTPServerTransport({\n    sessionIdGenerator: () => {\n      const sessionId = randomUUID();\n      void registerSession(\n        sessionId,\n        { credentialId: credential.credentialId, kind: credential.kind },\n        { server, transport },\n      );\n      return sessionId;\n    },\n    enableJsonResponse: true,\n    onsessionclosed: (closedId: string) => {\n      void import(\"./mcpTransportRegistry\").then(({ deleteSession }) =>\n        deleteSession(closedId),\n      );\n    },\n  });\n  return { server, transport, tools: catalog };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;;;ACYzB,IAAM,kBAAN,MAAsB;AAAA,EAK3B,YAAY,UAAkC,CAAC,GAAG;AAJlD,SAAiB,UAAU,oBAAI,IAAoB;AAKjD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,iBAAiB,QAAQ,kBAAkB;AAAA,EAClD;AAAA,EAEQ,YAAY,QAAwB;AAC1C,WAAO,WAAW,UAAU,UAAU;AAAA,EACxC;AAAA,EAEQ,SAAS,QAAwB;AACvC,WAAO,WAAW,UAAU,KAAK,iBAAiB,KAAK;AAAA,EACzD;AAAA;AAAA,EAGA,MAAM,cAAsB,QAAmC;AAC7D,UAAM,QAAQ,KAAK,SAAS,MAAM;AAClC,UAAM,MAAM,GAAG,KAAK,YAAY,MAAM,CAAC,IAAI,YAAY;AACvD,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,SAAS,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,QAAQ,OAAO,WAAW,IAAI;AAExE,UAAM,cAAc,QAAQ;AAC5B,UAAM,UAAU,MAAM,OAAO;AAC7B,WAAO,SAAS,KAAK,IAAI,OAAO,OAAO,SAAS,UAAU,WAAW;AACrE,WAAO,YAAY;AAEnB,QAAI,OAAO,UAAU,GAAG;AACtB,aAAO,UAAU;AACjB,WAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAEA,SAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,UAAM,UAAU,IAAI,OAAO;AAC3B,WAAO,EAAE,SAAS,OAAO,cAAc,KAAK,KAAK,UAAU,WAAW,EAAE;AAAA,EAC1E;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,QAAQ,MAAM;AAAA,EACrB;AACF;;;ACxDA,SAAS,iBAAiB;AAC1B,SAAS,qCAAqC;AAC9C,SAAS,kBAAkB;AAKpB,IAAM,uBAAuB;AAAA,EAClC,MAAM;AAAA,EACN,SAAS;AACX;AA0BA,eAAsB,mBAAmB,SAYf;AACxB,QAAM,EAAE,YAAY,SAAS,QAAQ,YAAY,IAAI;AACrD,QAAM,SAAS,IAAI,UAAU,sBAAsB;AAAA,IACjD,cAAc;AAAA;AAAA;AAAA,MAGZ,cAAc,EAAE,8BAA8B,CAAC,EAAE;AAAA,IACnD;AAAA,EACF,CAAC;AACD,aAAW,QAAQ,SAAS;AAC1B,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,QACE,aAAa,KAAK;AAAA,QAClB,aAAa,KAAK;AAAA,QAClB,aAAa;AAAA,UACX,cAAc,KAAK,YAAY;AAAA,UAC/B,iBAAiB,KAAK,YAAY;AAAA,QACpC;AAAA,QACA,GAAI,KAAK,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,KAAK,GAAG,YAAY,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E;AAAA,MACA,OAAO,SAAkB;AACvB,cAAM,SAAS,MAAM,OAAO,KAAK,UAAU,IAAI;AAC/C,eAAO,EAAE,SAAS,OAAO,SAAS,SAAS,OAAO,QAAQ;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,eAAe,CAAC,GAAG;AAC1C,UAAM,WAAW,IAAI,YAAY;AACjC,WAAO;AAAA,MACL,WAAW,GAAG;AAAA,MACd;AAAA,MACA;AAAA,QACE;AAAA,QACA,GAAI,IAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,MACvD;AAAA,MACA,OAAO,MAAM;AACX,cAAM,EAAE,MAAM,IAAI,IAAI,MAAM,IAAI,KAAK;AACrC,eAAO;AAAA,UACL,UAAU;AAAA,YACR;AAAA,cACE,KAAK,EAAE;AAAA,cACP;AAAA,cACA,MAAM;AAAA,cACN,GAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,YAC1C;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,IAAI,8BAA8B;AAAA,IAClD,oBAAoB,MAAM;AACxB,YAAM,YAAY,WAAW;AAC7B,WAAK;AAAA,QACH;AAAA,QACA,EAAE,cAAc,WAAW,cAAc,MAAM,WAAW,KAAK;AAAA,QAC/D,EAAE,QAAQ,UAAU;AAAA,MACtB;AACA,aAAO;AAAA,IACT;AAAA,IACA,oBAAoB;AAAA,IACpB,iBAAiB,CAAC,aAAqB;AACrC,WAAK,OAAO,qCAAwB,EAAE;AAAA,QAAK,CAAC,EAAE,eAAAA,eAAc,MAC1DA,eAAc,QAAQ;AAAA,MACxB;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO,EAAE,QAAQ,WAAW,OAAO,QAAQ;AAC7C;;;AFhFA,SAAS,cAAc,SAA6C;AAClE,QAAM,SAAS,QAAQ,QAAQ;AAC/B,MAAI,CAAC,QAAQ,WAAW,SAAS,EAAG,QAAO;AAC3C,SAAO,OAAO,MAAM,UAAU,MAAM,EAAE,KAAK,KAAK;AAClD;AAEA,SAAS,cAAc,SAA6C;AAClE,QAAM,MAAM,QAAQ,QAAQ,gBAAgB;AAC5C,QAAM,QAAQ,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI;AAC5C,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAUA,SAAS,qBAAwC;AAC/C,SAAO;AAAA,IACL,OAAO,CAAC;AAAA,IACR,aAAa,oBAAI,IAAI;AAAA,IACrB,SAAS,MAAM;AAAA,IACf,UAAU;AAAA,IACV,QAAQ,OAAO,cAAc;AAAA,MAC3B,SAAS;AAAA,QACP,EAAE,MAAM,QAAQ,MAAM,yCAAyC,QAAQ,GAAG;AAAA,MAC5E;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAGA,IAAM,YAAY;AAAA,EAChB,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,cAAc;AAChB;AAEO,SAAS,mBACd,KACA,OAAsB,CAAC,GACjB;AACN,QAAM,WACJ,KAAK,YACL,IAAI;AAAA,IACF,gBAAgB,WAAW,WAAW,EAAE;AAAA,IACxC,gBAAgB,WAAW,SAAS,EAAE;AAAA,EACxC;AACF,QAAM,eACJ,KAAK,iBAAiB,CAAC,QAAwB,IAAI;AACrD,QAAM,QACJ,KAAK,UACJ,MAAM;AACL,QAAI;AACF,YAAM,QAAQ,gBAAgB,WAAW,WAAW,EAAE;AACtD,aAAO,IAAI,iBAAiB,KAAK;AAAA,IACnC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AAEL,QAAM,cAAc,KAAK,eAAe,IAAI,gBAAgB;AAE5D,MAAI,KAAK,aAAa,OAAO,SAAyB,UAAwB;AAC5E,UAAM,UAAU,MAAM,SAAS,QAAQ,cAAc,OAAO,CAAC;AAC7D,QAAI,CAAC,SAAS;AACZ,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,cAAc,CAAC;AAAA,IACxD;AAEA,UAAM,OAAgB,QAAQ;AAC9B,UAAM,YAAY,cAAc,OAAO;AAIvC,QAAI,WAAW;AACb,YAAM,UAAU,MAAM,WAAW,SAAS;AAC1C,UACE,CAAC,WACD,QAAQ,WAAW,iBAAiB,QAAQ,cAC5C;AACA,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC9D;AACA,YAAM,OAAO;AACb,YAAM,QAAQ,UAAU,cAAc,QAAQ,KAAK,MAAM,KAAK,IAAI;AAClE;AAAA,IACF;AAIA,QAAI,CAAC,oBAAoB,IAAI,GAAG;AAC9B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAAA,IAC7D;AAEA,UAAM,SAAS,aAAa,OAAO;AACnC,UAAM,UAAU,MAAM,YAAY,WAAW,QAAQ,EAAE,UAAU,QAAQ,SAAS,CAAC;AAMnF,UAAM,kBAAkB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAC9D,UAAM,cACJ,KAAK,kBACJ,CAAC,UAAU,cAAc,sBACxB,uBAAuB,UAAU,cAAc,EAAE,kBAAkB,CAAC;AACxE,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,YAAY,QAAQ,UAAU,QAAQ,eAAe;AACpE,UAAI,OAAO,UAAU;AAInB,gBAAQ,IAAI;AAAA,UACV,EAAE,UAAU,QAAQ,SAAS;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAId,cAAQ,IAAI;AAAA,QACV,EAAE,UAAU,QAAQ,UAAU,KAAK,MAAM;AAAA,QACzC;AAAA,MACF;AACA,eAAS,mBAAmB;AAAA,IAC9B;AACA,UAAM,gBAAgB,iBAAiB,SAAS,OAAO,KAAK;AAC5D,UAAM,cAAc,IAAI,IAAI;AAAA,MAC1B,GAAG,gCAAgC,MAAM;AAAA,MACzC,GAAG,OAAO;AAAA,IACZ,CAAC;AACD,UAAM,QAAQ,MAAM,mBAAmB;AAAA,MACrC,YAAY,EAAE,cAAc,QAAQ,cAAc,MAAM,QAAQ,KAAK;AAAA,MACrE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,MACA,QAAQ,OAAO,UAAU,SAAS;AAChC,cAAM,YAAY,KAAK,IAAI;AAC3B,cAAM,MAAM,SAAS,QAAQ,GAAG;AAChC,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,GAAG,GAAG,IAAI;AACvD,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,MAAM,CAAC,IAAI;AAExD,cAAM,WAAW,YAAY,MAAM,QAAQ,cAAc,WAAW;AACpE,YAAI,CAAC,SAAS,SAAS;AACrB,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI;AAAA,cACF,6BAA6B,SAAS,gBAAgB,GAAI;AAAA,YAC5D;AAAA,YACA,EAAE,SAAS,UAAU,aAAa;AAAA,UACpC;AAAA,QACF;AAEA,YAAI;AACF,gBAAM,gBAAgB,OAAO,QAAQ,QAAQ,KAAK,CAAC,gBAAgB,IAAI,QAAQ;AAC/E,gBAAM,YAAqC;AAAA,YACzC,aAAa,QAAQ;AAAA,YACrB,cAAc,QAAQ;AAAA,UACxB;AACA,gBAAM,SAAS,gBACX,MAAM,OAAO,OAAO,UAAU,MAAM;AAAA,YAClC,UAAU,QAAQ;AAAA,YAClB,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB;AAAA,UACF,CAAC,IACD,MAAM,YAAY;AAAA,YAChB;AAAA,YACA;AAAA,cACE,UAAU,QAAQ;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,aAAa,QAAQ;AAAA,cACrB;AAAA,YACF;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACJ,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ,OAAO,UAAU,UAAU;AAAA,YACnC,GAAI,OAAO,UAAU,EAAE,WAAW,kBAAkB,IAAI,CAAC;AAAA,YACzD,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,iBAAO;AAAA,QACT,SAAS,KAAK;AACZ,gBAAM,OACJ,eAAe,mBACX,UAAU,eACV,eAAe,sBACb,UAAU,mBACV,eAAe,kBACb,UAAU,oBACV,UAAU;AACpB,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WACE,eAAe,mBACX,iBACA,eAAe,sBACb,qBACA,eAAe,kBACb,sBACA;AAAA,YACV,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YAC1D,EAAE,SAAS,KAAK;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAID,UAAM,MAAM,OAAO,QAAQ,MAAM,SAAS;AAC1C,UAAM,OAAO;AACb,UAAM,MAAM,UAAU,cAAc,QAAQ,KAAK,MAAM,KAAK,IAAI;AAAA,EAClE,CAAC;AAED,MAAI;AAAA,IACF;AAAA,IACA,OAAO,SAAyB,UAAwB;AACtD,YAAM,YAAY,cAAc,OAAO;AACvC,UAAI,CAAC,WAAW;AACd,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAAA,MAC7D;AACA,YAAM,cAAc,SAAS;AAC7B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,IAChC;AAAA,EACF;AACF;","names":["deleteSession"]}