@axiom-lattice/gateway 5.0.0 → 6.0.1

package/dist/sandboxOpenCredentialProvider-USIU7Z7H.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/services/open/sandboxOpenCredentialProvider.ts","../src/services/open/sandboxOpenReflection.ts"],"sourcesContent":["/**\n * Gateway composition-root implementation of the sandbox open-credential seam.\n *\n * Mints a short-lived, self-bound `sandbox_token` for sandbox code so it can call\n * the Open MCP endpoint. Core stays credential-agnostic; only the gateway knows\n * the signing secret and the public URL.\n */\n\nimport type { OpenGrant } from \"@axiom-lattice/protocols\";\nimport type { SandboxOpenCredentialProvider } from \"@axiom-lattice/core\";\nimport { registerSandboxOpenCredentialProvider } from \"@axiom-lattice/core\";\nimport { signOpenToken } from \"./openToken\";\nimport {\n  createDefaultAgentReflectionDeps,\n  createDefaultPluginReflectionDeps,\n  mergeGrantsByDomain,\n  resolveAgentOpenGrants,\n  resolvePluginOpenGrants,\n} from \"./sandboxOpenReflection\";\n\n/** Conservative default grants for sandbox-initiated Open calls (B0). */\nexport const DEFAULT_SANDBOX_OPEN_GRANTS: OpenGrant[] = [\n  { domain: \"sandbox\", items: [\"files_read\", \"files_list\", \"files_write\", \"shell_exec\"] },\n  { domain: \"kb\", items: [\"search\", \"entries_read\"] },\n];\n\n/** Maximum nested sandbox Open orchestration depth before minting is refused. */\nexport const MAX_SANDBOX_OPEN_DEPTH = 5;\n\n/** Reflection seam: how the provider derives caller grants for a mint. */\nexport interface SandboxOpenReflection {\n  /** Reflect an agent caller's own Open capabilities. */\n  agent: (tenantId: string, assistantId: string) => Promise<OpenGrant[]>;\n  /** Reflect the tenant's grantable Open catalog for a plugin handler caller. */\n  plugin: (tenantId: string) => Promise<OpenGrant[]>;\n}\n\n/** Options for {@link createSandboxOpenCredentialProvider}. */\nexport interface SandboxOpenCredentialProviderFactoryOptions {\n  /** Public base URL of this gateway (`PUBLIC_GATEWAY_URL`). Absent ⇒ inject nothing. */\n  gatewayUrl?: string;\n  /** Best-effort hook for structured warnings (e.g. depth cap reached). */\n  onError?: (error: unknown) => void;\n  /** Test seam replacing the live reflection resolvers. */\n  reflection?: SandboxOpenReflection;\n}\n\n/** Default reflection wired to the live tenant registries. */\nfunction defaultReflection(): SandboxOpenReflection {\n  return {\n    agent: (tenantId, assistantId) =>\n      resolveAgentOpenGrants(tenantId, assistantId, createDefaultAgentReflectionDeps(tenantId)),\n    plugin: (tenantId) =>\n      resolvePluginOpenGrants(tenantId, createDefaultPluginReflectionDeps()),\n  };\n}\n\n/**\n * Build the provider.\n *\n * Grants are the union of the conservative B0 defaults with grants reflected\n * from the caller's identity (`assistantId` ⇒ agent reflection, otherwise the\n * tenant Open catalog). Each mint increments the orchestration `depth`; past\n * {@link MAX_SANDBOX_OPEN_DEPTH} the provider refuses to mint, breaking cycles.\n *\n * @param options - Gateway URL, error hook, and optional reflection seam.\n * @returns A {@link SandboxOpenCredentialProvider}\n */\nexport function createSandboxOpenCredentialProvider(\n  options: SandboxOpenCredentialProviderFactoryOptions,\n): SandboxOpenCredentialProvider {\n  const reflection = options.reflection ?? defaultReflection();\n  return async (context) => {\n    if (!options.gatewayUrl) return undefined;\n    const depth = (context.depth ?? 0) + 1;\n    if (depth > MAX_SANDBOX_OPEN_DEPTH) {\n      options.onError?.(new Error(\"sandbox open credential depth exceeded\"));\n      return undefined;\n    }\n    const reflected = context.assistantId\n      ? await reflection.agent(context.tenantId, context.assistantId)\n      : await reflection.plugin(context.tenantId);\n    const grants = mergeGrantsByDomain([...DEFAULT_SANDBOX_OPEN_GRANTS, ...reflected]);\n    const token = signOpenToken({\n      kind: \"sandbox_token\",\n      tenantId: context.tenantId,\n      workspaceId: context.workspaceId ?? \"\",\n      projectId: context.projectId ?? \"\",\n      sandboxName: context.sandboxName,\n      grants,\n      depth,\n    });\n    return { gatewayUrl: options.gatewayUrl, token };\n  };\n}\n\n/**\n * Register the gateway provider from `PUBLIC_GATEWAY_URL`.\n *\n * @param onError - Optional hook for structured warnings when resolution fails\n * @returns An unregister function (for tests/shutdown)\n */\nexport function registerGatewaySandboxOpenCredentialProvider(\n  onError?: (error: unknown) => void,\n): () => void {\n  return registerSandboxOpenCredentialProvider(\n    createSandboxOpenCredentialProvider({\n      gatewayUrl: process.env.PUBLIC_GATEWAY_URL?.trim() || undefined,\n      onError,\n    }),\n    { onError },\n  );\n}\n","/**\n * Agent Open-grant reflection (B1).\n *\n * Computes the extra Open grants a sandbox caller may use, derived from the\n * caller agent's own configuration (never from author declarations). The\n * invariant is: *what sandbox code can call ⊆ what the caller could already\n * call*. Grants are additive to the conservative B0 defaults and are bounded by\n * tenant-scoped resolution plus depth/rate/audit on the Open door.\n *\n * Mapping (`middleware[].enabled !== false`):\n * - middleware `type` whose plugin declares `meta.openExpose` → same-name domain\n *   (identity; covers `task`, `document-parser`, and plugin types);\n * - `subAgents` (DeepAgentConfig) intersected with tenant-resolvable assistants\n *   → the `agent` domain;\n * - anything else → ignored.\n *\n * Results are cached per `(tenantId, assistantId)` for\n * {@link AGENT_REFLECTION_CACHE_TTL_MS}. Any resolution error degrades to `[]`\n * so the caller falls back to the default grants rather than failing.\n */\n\nimport type { AssistantStore, OpenGrant } from \"@axiom-lattice/protocols\";\nimport {\n  PluginRegistry,\n  agentLatticeManager,\n  ensureBuiltinAgentsForTenant,\n  getSandboxPluginCatalog,\n  getStoreLattice,\n} from \"@axiom-lattice/core\";\n\n/** The subset of an agent config relevant to Open-grant reflection. */\nexport interface SandboxOpenReflectionContext {\n  middleware?: Array<{ type: string; enabled?: boolean; allowedTools?: string[] }>;\n  subAgents?: string[];\n}\n\n/** Injectable sources for {@link resolveAgentOpenGrants}. */\nexport interface AgentReflectionDeps {\n  /** Optional: hydrate stored/builtin/plugin agents for the tenant before resolution. */\n  ensure?: (tenantId: string) => Promise<void>;\n  /** Resolve an agent's config (middleware + subAgents) or undefined. */\n  getAgentConfig?: (tenantId: string, assistantId: string) => SandboxOpenReflectionContext | undefined;\n  /** Fallback: the assistant's persisted middleware. */\n  getAssistantMiddleware?: (tenantId: string, assistantId: string) => Promise<Array<{ type: string; enabled?: boolean; allowedTools?: string[] }> | undefined>;\n  /** Normalized exposed action names for a middleware/plugin type, or [] if none. */\n  exposedActionsByType: (type: string) => string[];\n  /** Assistant ids resolvable in the tenant (for subAgents filtering). */\n  resolvableAssistants?: (tenantId: string) => Promise<Set<string>>;\n  /** Clock seam for cache TTL tests. */\n  now?: () => number;\n}\n\n/** How long a per-agent reflection result is reused. */\nexport const AGENT_REFLECTION_CACHE_TTL_MS = 60_000;\n\ninterface CacheEntry {\n  grants: OpenGrant[];\n  expiresAt: number;\n}\n\nconst cache = new Map<string, CacheEntry>();\n\n/** Clear the reflection cache. Test-only seam. */\nexport function clearAgentReflectionCacheForTests(): void {\n  cache.clear();\n}\n\nfunction cloneGrants(grants: OpenGrant[]): OpenGrant[] {\n  return grants.map((grant) => ({\n    ...grant,\n    items: grant.items ? [...grant.items] : undefined,\n  }));\n}\n\n/** Normalize `meta.openExpose` (`string[] | {name}[]`) to action names. */\nexport function normalizeOpenExpose(value: unknown): string[] {\n  if (!Array.isArray(value)) return [];\n  const out: string[] = [];\n  for (const entry of value) {\n    if (typeof entry === \"string\") {\n      if (entry) out.push(entry);\n    } else if (entry && typeof entry === \"object\") {\n      const name = (entry as { name?: unknown }).name;\n      if (typeof name === \"string\" && name) out.push(name);\n    }\n  }\n  return out;\n}\n\n/** Extract middleware type list from an agent config / graphDefinition. */\nfunction extractMiddleware(\n  container: unknown,\n): Array<{ type: string; enabled?: boolean; allowedTools?: string[] }> | undefined {\n  if (!container || typeof container !== \"object\") return undefined;\n  const raw = (container as { middleware?: unknown }).middleware;\n  if (!Array.isArray(raw)) return undefined;\n  const out: Array<{ type: string; enabled?: boolean; allowedTools?: string[] }> = [];\n  for (const entry of raw) {\n    if (!entry || typeof entry !== \"object\") continue;\n    const type = (entry as { type?: unknown }).type;\n    if (typeof type !== \"string\" || type.length === 0) continue;\n    const enabled = (entry as { enabled?: unknown }).enabled;\n    const rawAllowed = (entry as { allowedTools?: unknown }).allowedTools;\n    const allowedTools = Array.isArray(rawAllowed)\n      ? rawAllowed.filter((t): t is string => typeof t === \"string\" && t.length > 0)\n      : undefined;\n    out.push({ type, enabled: typeof enabled === \"boolean\" ? enabled : undefined, allowedTools });\n  }\n  return out;\n}\n\n/** Extract subAgent ids from an agent config. */\nfunction extractSubAgents(config: unknown): string[] | undefined {\n  if (!config || typeof config !== \"object\") return undefined;\n  const raw = (config as { subAgents?: unknown }).subAgents;\n  if (!Array.isArray(raw)) return undefined;\n  const out = raw.filter((id): id is string => typeof id === \"string\" && id.length > 0);\n  return out.length > 0 ? out : undefined;\n}\n\nasync function computeGrants(\n  tenantId: string,\n  assistantId: string,\n  deps: AgentReflectionDeps,\n): Promise<OpenGrant[]> {\n  await deps.ensure?.(tenantId);\n\n  let context = await deps.getAgentConfig?.(tenantId, assistantId);\n  if (context === undefined) {\n    const middleware = await deps.getAssistantMiddleware?.(tenantId, assistantId);\n    if (middleware === undefined) return [];\n    context = { middleware };\n  }\n\n  const byDomain = new Map<string, Set<string>>();\n  const add = (domain: string, items: Iterable<string>): void => {\n    let bucket = byDomain.get(domain);\n    if (!bucket) {\n      bucket = new Set<string>();\n      byDomain.set(domain, bucket);\n    }\n    for (const item of items) bucket.add(item);\n  };\n\n  for (const entry of context.middleware ?? []) {\n    if (!entry || entry.enabled === false) continue;\n    if (typeof entry.type !== \"string\" || entry.type.length === 0) continue;\n    let actions = deps.exposedActionsByType(entry.type);\n    if (actions.length === 0) continue;\n    const allowedTools = entry.allowedTools;\n    if (Array.isArray(allowedTools) && allowedTools.length > 0) {\n      const allowed = new Set(allowedTools);\n      actions = actions.filter((action) => allowed.has(action));\n      if (actions.length === 0) continue;\n    }\n    add(entry.type, actions);\n  }\n\n  const subAgents = context.subAgents ?? [];\n  if (subAgents.length > 0 && deps.resolvableAssistants) {\n    const resolvable = await deps.resolvableAssistants(tenantId);\n    const kept = subAgents.filter(\n      (id) => typeof id === \"string\" && id.length > 0 && resolvable.has(id),\n    );\n    if (kept.length > 0) add(\"agent\", kept);\n  }\n\n  return [...byDomain].map(([domain, items]) => ({ domain, items: [...items] }));\n}\n\n/**\n * Resolve the reflected Open grants for an agent caller.\n *\n * @param tenantId - Tenant scope (grants never cross tenants).\n * @param assistantId - Caller agent id.\n * @param deps - Resolvers; {@link createDefaultAgentReflectionDeps} wires the\n *   real registries/store.\n * @returns Reflected grants (possibly `[]`); never throws.\n */\nexport async function resolveAgentOpenGrants(\n  tenantId: string,\n  assistantId: string,\n  deps: AgentReflectionDeps,\n): Promise<OpenGrant[]> {\n  try {\n    const key = `${tenantId}:${assistantId}`;\n    const now = deps.now ? deps.now() : Date.now();\n    const hit = cache.get(key);\n    if (hit && hit.expiresAt > now) return cloneGrants(hit.grants);\n\n    const grants = await computeGrants(tenantId, assistantId, deps);\n    cache.set(key, { grants, expiresAt: now + AGENT_REFLECTION_CACHE_TTL_MS });\n    return cloneGrants(grants);\n  } catch {\n    return [];\n  }\n}\n\n/**\n * Default reflection deps wired to the live registries.\n *\n * Reads the agent lattice manager (seeded with built-ins for the tenant),\n * falls back to the assistant store, resolves plugin exposes from\n * {@link PluginRegistry}, and filters subAgents against tenant-resolvable\n * assistants.\n *\n * @param tenantId - Tenant whose built-in/plugin agents are ensured.\n * @returns Deps for {@link resolveAgentOpenGrants}.\n */\nexport function createDefaultAgentReflectionDeps(tenantId: string): AgentReflectionDeps {\n  ensureBuiltinAgentsForTenant(tenantId);\n  return {\n    ensure: (t) => agentLatticeManager.initializeStoredAssistantsForTenant(t),\n    getAgentConfig: (t, assistantId) => {\n      const config = agentLatticeManager.getAgentConfigWithTenant(t, assistantId);\n      if (!config) return undefined;\n      return {\n        middleware: extractMiddleware(config),\n        subAgents: extractSubAgents(config),\n      };\n    },\n    getAssistantMiddleware: async (t, assistantId) => {\n      const store = getStoreLattice(\"default\", \"assistant\").store as AssistantStore;\n      const assistant = await store.getAssistantById(t, assistantId);\n      return extractMiddleware(assistant?.graphDefinition);\n    },\n    exposedActionsByType: (type) => {\n      const plugin = PluginRegistry.get(type);\n      return plugin ? normalizeOpenExpose(plugin.meta.openExpose) : [];\n    },\n    resolvableAssistants: async (t) =>\n      new Set(\n        agentLatticeManager.getAllAgentLatticesByTenant(t).map((lattice) => lattice.config.key),\n      ),\n  };\n}\n\n/** How long a per-tenant plugin reflection result is reused. */\nexport const PLUGIN_REFLECTION_CACHE_TTL_MS = 60_000;\n\n/**\n * Injectable sources for {@link resolvePluginOpenGrants}.\n *\n * Plugin handlers have no `assistantId`, so reflection targets the tenant's\n * grantable Open catalog instead of a caller's own configuration.\n *\n * @property ensure - Optional: hydrate stored/builtin/plugin agents before reflecting the agent domain.\n * @property globalExposedDomains - Global plugin `openExpose` domains (tenant-agnostic).\n * @property tenantExposedDomains - Tenant sandbox plugin exposed domains.\n * @property resolvableAssistants - Tenant-resolvable assistant ids for the `agent` domain.\n * @property now - Clock seam for cache TTL tests.\n */\nexport interface PluginReflectionDeps {\n  /** Optional: hydrate stored/builtin/plugin agents before reflecting the agent domain. */\n  ensure?: (tenantId: string) => Promise<void>;\n  globalExposedDomains?: () => OpenGrant[];\n  tenantExposedDomains?: (tenantId: string) => Promise<OpenGrant[]>;\n  resolvableAssistants?: (tenantId: string) => Promise<Set<string>>;\n  now?: () => number;\n}\n\ninterface PluginCacheEntry {\n  grants: OpenGrant[];\n  expiresAt: number;\n}\n\nconst pluginCache = new Map<string, PluginCacheEntry>();\n\n/** Clear the plugin reflection cache. Test-only seam. */\nexport function clearPluginReflectionCacheForTests(): void {\n  pluginCache.clear();\n}\n\n/**\n * Merge grants by domain, preserving first-seen domain order and unioning items.\n *\n * An absent/empty `items` list means \"every action in the domain\" per\n * {@link OpenGrant}, so a domain carrying one collapses to `{ domain }`.\n *\n * @param grants - Raw grants from every reflection source.\n * @returns One normalized grant per domain.\n */\nexport function mergeGrantsByDomain(grants: OpenGrant[]): OpenGrant[] {\n  const order: string[] = [];\n  const items = new Map<string, Set<string>>();\n  const unrestricted = new Set<string>();\n\n  for (const grant of grants) {\n    if (!grant || typeof grant.domain !== \"string\" || grant.domain.length === 0) continue;\n    if (!items.has(grant.domain)) {\n      items.set(grant.domain, new Set());\n      order.push(grant.domain);\n    }\n    if (!grant.items || grant.items.length === 0) {\n      unrestricted.add(grant.domain);\n      continue;\n    }\n    const bucket = items.get(grant.domain);\n    if (!bucket) continue;\n    for (const item of grant.items) {\n      if (typeof item === \"string\" && item.length > 0) bucket.add(item);\n    }\n  }\n\n  return order.map((domain) => {\n    if (unrestricted.has(domain)) return { domain };\n    return { domain, items: [...(items.get(domain) ?? [])] };\n  });\n}\n\nasync function computePluginGrants(\n  tenantId: string,\n  deps: PluginReflectionDeps,\n): Promise<OpenGrant[]> {\n  const grants: OpenGrant[] = [...(deps.globalExposedDomains?.() ?? [])];\n  if (deps.tenantExposedDomains) {\n    grants.push(...(await deps.tenantExposedDomains(tenantId)));\n  }\n  if (deps.resolvableAssistants) {\n    const resolvable = await deps.resolvableAssistants(tenantId);\n    if (resolvable.size > 0) {\n      grants.push({ domain: \"agent\", items: [...resolvable] });\n    }\n  }\n  return mergeGrantsByDomain(grants);\n}\n\n/**\n * Resolve the reflected Open grants for a plugin handler caller.\n *\n * Plugin handlers carry no `assistantId`, so grants come from the tenant's\n * grantable Open catalog (global plugin exposes ∪ tenant sandbox plugin\n * exposes) plus the `agent` domain for tenant-resolvable assistants. Results\n * are cached per tenant for {@link PLUGIN_REFLECTION_CACHE_TTL_MS}; any\n * resolution error degrades to `[]` so the caller falls back to the default\n * grants rather than failing.\n *\n * @param tenantId - Tenant scope (grants never cross tenants).\n * @param deps - Resolvers; {@link createDefaultPluginReflectionDeps} wires the\n *   real registries/catalog.\n * @returns Reflected grants (possibly `[]`); never throws.\n */\nexport async function resolvePluginOpenGrants(\n  tenantId: string,\n  deps: PluginReflectionDeps,\n): Promise<OpenGrant[]> {\n  try {\n    const now = deps.now ? deps.now() : Date.now();\n    const hit = pluginCache.get(tenantId);\n    if (hit && hit.expiresAt > now) return cloneGrants(hit.grants);\n\n    await deps.ensure?.(tenantId);\n    const grants = await computePluginGrants(tenantId, deps);\n    pluginCache.set(tenantId, { grants, expiresAt: now + PLUGIN_REFLECTION_CACHE_TTL_MS });\n    return cloneGrants(grants);\n  } catch {\n    return [];\n  }\n}\n\n/**\n * Map validated tenant plugin manifests to exposed Open grants.\n *\n * Only tools declaring `expose === true` become grant items; plugins with no\n * exposed tools are skipped. The domain is the plugin `type`.\n *\n * @param manifests - Validated tenant plugin manifests (or any shape with a\n *   `type` and `tools[].name`/`tools[].expose`).\n * @returns One grant per plugin that exposes at least one tool.\n */\nexport function buildTenantExposedGrants(\n  manifests: Array<{ type: string; tools?: Array<{ name: string; expose?: boolean }> }>,\n): OpenGrant[] {\n  const grants: OpenGrant[] = [];\n  for (const manifest of manifests) {\n    const items = (manifest.tools ?? [])\n      .filter((tool) => tool.expose === true)\n      .map((tool) => tool.name);\n    if (items.length > 0) grants.push({ domain: manifest.type, items });\n  }\n  return grants;\n}\n\n/**\n * Default plugin reflection deps wired to the live registries.\n *\n * Ensures stored/builtin/plugin agents for the tenant, then reads global plugin\n * exposes from {@link PluginRegistry}, tenant sandbox plugin exposes from\n * {@link getSandboxPluginCatalog} manifests, and tenant-resolvable assistants\n * from the agent lattice manager.\n *\n * @returns Deps for {@link resolvePluginOpenGrants}.\n */\nexport function createDefaultPluginReflectionDeps(): PluginReflectionDeps {\n  return {\n    ensure: (tenantId) => agentLatticeManager.initializeStoredAssistantsForTenant(tenantId),\n    globalExposedDomains: () => {\n      const grants: OpenGrant[] = [];\n      for (const type of PluginRegistry.list()) {\n        const plugin = PluginRegistry.get(type);\n        const items = normalizeOpenExpose(plugin?.meta.openExpose);\n        if (items.length > 0) grants.push({ domain: type, items });\n      }\n      return grants;\n    },\n    tenantExposedDomains: async (tenantId) => {\n      const { manifests } = await getSandboxPluginCatalog().ensureLoaded(tenantId);\n      return buildTenantExposedGrants(Object.values(manifests));\n    },\n    resolvableAssistants: async (tenantId) =>\n      new Set(\n        agentLatticeManager\n          .getAllAgentLatticesByTenant(tenantId)\n          .map((lattice) => lattice.config.key),\n      ),\n  };\n}\n"],"mappings":";;;;;;;AAWA;AADA,SAAS,6CAA6C;;;ACYtD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAyBA,IAAM,gCAAgC;AAO7C,IAAM,QAAQ,oBAAI,IAAwB;AAO1C,SAAS,YAAY,QAAkC;AACrD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,OAAO,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK,IAAI;AAAA,EAC1C,EAAE;AACJ;AAGO,SAAS,oBAAoB,OAA0B;AAC5D,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,MAAgB,CAAC;AACvB,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI,MAAO,KAAI,KAAK,KAAK;AAAA,IAC3B,WAAW,SAAS,OAAO,UAAU,UAAU;AAC7C,YAAM,OAAQ,MAA6B;AAC3C,UAAI,OAAO,SAAS,YAAY,KAAM,KAAI,KAAK,IAAI;AAAA,IACrD;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,kBACP,WACiF;AACjF,MAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,QAAM,MAAO,UAAuC;AACpD,MAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO;AAChC,QAAM,MAA2E,CAAC;AAClF,aAAW,SAAS,KAAK;AACvB,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,UAAM,OAAQ,MAA6B;AAC3C,QAAI,OAAO,SAAS,YAAY,KAAK,WAAW,EAAG;AACnD,UAAM,UAAW,MAAgC;AACjD,UAAM,aAAc,MAAqC;AACzD,UAAM,eAAe,MAAM,QAAQ,UAAU,IACzC,WAAW,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC,IAC3E;AACJ,QAAI,KAAK,EAAE,MAAM,SAAS,OAAO,YAAY,YAAY,UAAU,QAAW,aAAa,CAAC;AAAA,EAC9F;AACA,SAAO;AACT;AAGA,SAAS,iBAAiB,QAAuC;AAC/D,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,MAAO,OAAmC;AAChD,MAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO;AAChC,QAAM,MAAM,IAAI,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACpF,SAAO,IAAI,SAAS,IAAI,MAAM;AAChC;AAEA,eAAe,cACb,UACA,aACA,MACsB;AACtB,QAAM,KAAK,SAAS,QAAQ;AAE5B,MAAI,UAAU,MAAM,KAAK,iBAAiB,UAAU,WAAW;AAC/D,MAAI,YAAY,QAAW;AACzB,UAAM,aAAa,MAAM,KAAK,yBAAyB,UAAU,WAAW;AAC5E,QAAI,eAAe,OAAW,QAAO,CAAC;AACtC,cAAU,EAAE,WAAW;AAAA,EACzB;AAEA,QAAM,WAAW,oBAAI,IAAyB;AAC9C,QAAM,MAAM,CAAC,QAAgB,UAAkC;AAC7D,QAAI,SAAS,SAAS,IAAI,MAAM;AAChC,QAAI,CAAC,QAAQ;AACX,eAAS,oBAAI,IAAY;AACzB,eAAS,IAAI,QAAQ,MAAM;AAAA,IAC7B;AACA,eAAW,QAAQ,MAAO,QAAO,IAAI,IAAI;AAAA,EAC3C;AAEA,aAAW,SAAS,QAAQ,cAAc,CAAC,GAAG;AAC5C,QAAI,CAAC,SAAS,MAAM,YAAY,MAAO;AACvC,QAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,WAAW,EAAG;AAC/D,QAAI,UAAU,KAAK,qBAAqB,MAAM,IAAI;AAClD,QAAI,QAAQ,WAAW,EAAG;AAC1B,UAAM,eAAe,MAAM;AAC3B,QAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AAC1D,YAAM,UAAU,IAAI,IAAI,YAAY;AACpC,gBAAU,QAAQ,OAAO,CAAC,WAAW,QAAQ,IAAI,MAAM,CAAC;AACxD,UAAI,QAAQ,WAAW,EAAG;AAAA,IAC5B;AACA,QAAI,MAAM,MAAM,OAAO;AAAA,EACzB;AAEA,QAAM,YAAY,QAAQ,aAAa,CAAC;AACxC,MAAI,UAAU,SAAS,KAAK,KAAK,sBAAsB;AACrD,UAAM,aAAa,MAAM,KAAK,qBAAqB,QAAQ;AAC3D,UAAM,OAAO,UAAU;AAAA,MACrB,CAAC,OAAO,OAAO,OAAO,YAAY,GAAG,SAAS,KAAK,WAAW,IAAI,EAAE;AAAA,IACtE;AACA,QAAI,KAAK,SAAS,EAAG,KAAI,SAAS,IAAI;AAAA,EACxC;AAEA,SAAO,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,QAAQ,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE;AAC/E;AAWA,eAAsB,uBACpB,UACA,aACA,MACsB;AACtB,MAAI;AACF,UAAM,MAAM,GAAG,QAAQ,IAAI,WAAW;AACtC,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI;AAC7C,UAAM,MAAM,MAAM,IAAI,GAAG;AACzB,QAAI,OAAO,IAAI,YAAY,IAAK,QAAO,YAAY,IAAI,MAAM;AAE7D,UAAM,SAAS,MAAM,cAAc,UAAU,aAAa,IAAI;AAC9D,UAAM,IAAI,KAAK,EAAE,QAAQ,WAAW,MAAM,8BAA8B,CAAC;AACzE,WAAO,YAAY,MAAM;AAAA,EAC3B,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAaO,SAAS,iCAAiC,UAAuC;AACtF,+BAA6B,QAAQ;AACrC,SAAO;AAAA,IACL,QAAQ,CAAC,MAAM,oBAAoB,oCAAoC,CAAC;AAAA,IACxE,gBAAgB,CAAC,GAAG,gBAAgB;AAClC,YAAM,SAAS,oBAAoB,yBAAyB,GAAG,WAAW;AAC1E,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,YAAY,kBAAkB,MAAM;AAAA,QACpC,WAAW,iBAAiB,MAAM;AAAA,MACpC;AAAA,IACF;AAAA,IACA,wBAAwB,OAAO,GAAG,gBAAgB;AAChD,YAAM,QAAQ,gBAAgB,WAAW,WAAW,EAAE;AACtD,YAAM,YAAY,MAAM,MAAM,iBAAiB,GAAG,WAAW;AAC7D,aAAO,kBAAkB,WAAW,eAAe;AAAA,IACrD;AAAA,IACA,sBAAsB,CAAC,SAAS;AAC9B,YAAM,SAAS,eAAe,IAAI,IAAI;AACtC,aAAO,SAAS,oBAAoB,OAAO,KAAK,UAAU,IAAI,CAAC;AAAA,IACjE;AAAA,IACA,sBAAsB,OAAO,MAC3B,IAAI;AAAA,MACF,oBAAoB,4BAA4B,CAAC,EAAE,IAAI,CAAC,YAAY,QAAQ,OAAO,GAAG;AAAA,IACxF;AAAA,EACJ;AACF;AAGO,IAAM,iCAAiC;AA4B9C,IAAM,cAAc,oBAAI,IAA8B;AAgB/C,SAAS,oBAAoB,QAAkC;AACpE,QAAM,QAAkB,CAAC;AACzB,QAAM,QAAQ,oBAAI,IAAyB;AAC3C,QAAM,eAAe,oBAAI,IAAY;AAErC,aAAW,SAAS,QAAQ;AAC1B,QAAI,CAAC,SAAS,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,WAAW,EAAG;AAC7E,QAAI,CAAC,MAAM,IAAI,MAAM,MAAM,GAAG;AAC5B,YAAM,IAAI,MAAM,QAAQ,oBAAI,IAAI,CAAC;AACjC,YAAM,KAAK,MAAM,MAAM;AAAA,IACzB;AACA,QAAI,CAAC,MAAM,SAAS,MAAM,MAAM,WAAW,GAAG;AAC5C,mBAAa,IAAI,MAAM,MAAM;AAC7B;AAAA,IACF;AACA,UAAM,SAAS,MAAM,IAAI,MAAM,MAAM;AACrC,QAAI,CAAC,OAAQ;AACb,eAAW,QAAQ,MAAM,OAAO;AAC9B,UAAI,OAAO,SAAS,YAAY,KAAK,SAAS,EAAG,QAAO,IAAI,IAAI;AAAA,IAClE;AAAA,EACF;AAEA,SAAO,MAAM,IAAI,CAAC,WAAW;AAC3B,QAAI,aAAa,IAAI,MAAM,EAAG,QAAO,EAAE,OAAO;AAC9C,WAAO,EAAE,QAAQ,OAAO,CAAC,GAAI,MAAM,IAAI,MAAM,KAAK,CAAC,CAAE,EAAE;AAAA,EACzD,CAAC;AACH;AAEA,eAAe,oBACb,UACA,MACsB;AACtB,QAAM,SAAsB,CAAC,GAAI,KAAK,uBAAuB,KAAK,CAAC,CAAE;AACrE,MAAI,KAAK,sBAAsB;AAC7B,WAAO,KAAK,GAAI,MAAM,KAAK,qBAAqB,QAAQ,CAAE;AAAA,EAC5D;AACA,MAAI,KAAK,sBAAsB;AAC7B,UAAM,aAAa,MAAM,KAAK,qBAAqB,QAAQ;AAC3D,QAAI,WAAW,OAAO,GAAG;AACvB,aAAO,KAAK,EAAE,QAAQ,SAAS,OAAO,CAAC,GAAG,UAAU,EAAE,CAAC;AAAA,IACzD;AAAA,EACF;AACA,SAAO,oBAAoB,MAAM;AACnC;AAiBA,eAAsB,wBACpB,UACA,MACsB;AACtB,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI;AAC7C,UAAM,MAAM,YAAY,IAAI,QAAQ;AACpC,QAAI,OAAO,IAAI,YAAY,IAAK,QAAO,YAAY,IAAI,MAAM;AAE7D,UAAM,KAAK,SAAS,QAAQ;AAC5B,UAAM,SAAS,MAAM,oBAAoB,UAAU,IAAI;AACvD,gBAAY,IAAI,UAAU,EAAE,QAAQ,WAAW,MAAM,+BAA+B,CAAC;AACrF,WAAO,YAAY,MAAM;AAAA,EAC3B,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAYO,SAAS,yBACd,WACa;AACb,QAAM,SAAsB,CAAC;AAC7B,aAAW,YAAY,WAAW;AAChC,UAAM,SAAS,SAAS,SAAS,CAAC,GAC/B,OAAO,CAAC,SAAS,KAAK,WAAW,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI;AAC1B,QAAI,MAAM,SAAS,EAAG,QAAO,KAAK,EAAE,QAAQ,SAAS,MAAM,MAAM,CAAC;AAAA,EACpE;AACA,SAAO;AACT;AAYO,SAAS,oCAA0D;AACxE,SAAO;AAAA,IACL,QAAQ,CAAC,aAAa,oBAAoB,oCAAoC,QAAQ;AAAA,IACtF,sBAAsB,MAAM;AAC1B,YAAM,SAAsB,CAAC;AAC7B,iBAAW,QAAQ,eAAe,KAAK,GAAG;AACxC,cAAM,SAAS,eAAe,IAAI,IAAI;AACtC,cAAM,QAAQ,oBAAoB,QAAQ,KAAK,UAAU;AACzD,YAAI,MAAM,SAAS,EAAG,QAAO,KAAK,EAAE,QAAQ,MAAM,MAAM,CAAC;AAAA,MAC3D;AACA,aAAO;AAAA,IACT;AAAA,IACA,sBAAsB,OAAO,aAAa;AACxC,YAAM,EAAE,UAAU,IAAI,MAAM,wBAAwB,EAAE,aAAa,QAAQ;AAC3E,aAAO,yBAAyB,OAAO,OAAO,SAAS,CAAC;AAAA,IAC1D;AAAA,IACA,sBAAsB,OAAO,aAC3B,IAAI;AAAA,MACF,oBACG,4BAA4B,QAAQ,EACpC,IAAI,CAAC,YAAY,QAAQ,OAAO,GAAG;AAAA,IACxC;AAAA,EACJ;AACF;;;AD3YO,IAAM,8BAA2C;AAAA,EACtD,EAAE,QAAQ,WAAW,OAAO,CAAC,cAAc,cAAc,eAAe,YAAY,EAAE;AAAA,EACtF,EAAE,QAAQ,MAAM,OAAO,CAAC,UAAU,cAAc,EAAE;AACpD;AAGO,IAAM,yBAAyB;AAqBtC,SAAS,oBAA2C;AAClD,SAAO;AAAA,IACL,OAAO,CAAC,UAAU,gBAChB,uBAAuB,UAAU,aAAa,iCAAiC,QAAQ,CAAC;AAAA,IAC1F,QAAQ,CAAC,aACP,wBAAwB,UAAU,kCAAkC,CAAC;AAAA,EACzE;AACF;AAaO,SAAS,oCACd,SAC+B;AAC/B,QAAM,aAAa,QAAQ,cAAc,kBAAkB;AAC3D,SAAO,OAAO,YAAY;AACxB,QAAI,CAAC,QAAQ,WAAY,QAAO;AAChC,UAAM,SAAS,QAAQ,SAAS,KAAK;AACrC,QAAI,QAAQ,wBAAwB;AAClC,cAAQ,UAAU,IAAI,MAAM,wCAAwC,CAAC;AACrE,aAAO;AAAA,IACT;AACA,UAAM,YAAY,QAAQ,cACtB,MAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,WAAW,IAC5D,MAAM,WAAW,OAAO,QAAQ,QAAQ;AAC5C,UAAM,SAAS,oBAAoB,CAAC,GAAG,6BAA6B,GAAG,SAAS,CAAC;AACjF,UAAM,QAAQ,cAAc;AAAA,MAC1B,MAAM;AAAA,MACN,UAAU,QAAQ;AAAA,MAClB,aAAa,QAAQ,eAAe;AAAA,MACpC,WAAW,QAAQ,aAAa;AAAA,MAChC,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA;AAAA,IACF,CAAC;AACD,WAAO,EAAE,YAAY,QAAQ,YAAY,MAAM;AAAA,EACjD;AACF;AAQO,SAAS,6CACd,SACY;AACZ,SAAO;AAAA,IACL,oCAAoC;AAAA,MAClC,YAAY,QAAQ,IAAI,oBAAoB,KAAK,KAAK;AAAA,MACtD;AAAA,IACF,CAAC;AAAA,IACD,EAAE,QAAQ;AAAA,EACZ;AACF;","names":[]}