@burdenoff/be-sdk 2026.622.1 → 2026.624.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (27) hide show
  1. package/dist/{chunk-L2P4CJUR.js → chunk-B527JLOB.js} +6 -2
  2. package/dist/chunk-B527JLOB.js.map +1 -0
  3. package/dist/{chunk-Z2423JIB.js → chunk-DZK5UGDA.js} +3 -3
  4. package/dist/{chunk-Z2423JIB.js.map → chunk-DZK5UGDA.js.map} +1 -1
  5. package/dist/{chunk-Y7GCABRS.js → chunk-F5BPKP75.js} +3 -3
  6. package/dist/{chunk-Y7GCABRS.js.map → chunk-F5BPKP75.js.map} +1 -1
  7. package/dist/{chunk-3H4TRD6E.js → chunk-OWUVYM2S.js} +3 -3
  8. package/dist/{chunk-3H4TRD6E.js.map → chunk-OWUVYM2S.js.map} +1 -1
  9. package/dist/{chunk-PHKK7725.js → chunk-UCLDHOZC.js} +100 -3
  10. package/dist/chunk-UCLDHOZC.js.map +1 -0
  11. package/dist/{chunk-WD2TUTAS.js → chunk-UJI2S556.js} +3 -3
  12. package/dist/{chunk-WD2TUTAS.js.map → chunk-UJI2S556.js.map} +1 -1
  13. package/dist/export/index.js +3 -3
  14. package/dist/gateway/index.js +2 -2
  15. package/dist/gateway/security/index.js +1 -1
  16. package/dist/graph/index.js +3 -3
  17. package/dist/index-DgWLSDv2.d.ts +302 -0
  18. package/dist/index.d.ts +1 -1
  19. package/dist/index.js +21 -21
  20. package/dist/init/index.js +3 -3
  21. package/dist/platform/index.d.ts +1 -1
  22. package/dist/platform/index.js +1 -1
  23. package/dist/telemetry/index.js.map +1 -1
  24. package/package.json +1 -1
  25. package/dist/chunk-L2P4CJUR.js.map +0 -1
  26. package/dist/chunk-PHKK7725.js.map +0 -1
  27. package/dist/index-BQ1yJn1K.d.ts +0 -222
package/dist/chunk-L2P4CJUR.js.map DELETED
@@ -1 +0,0 @@
1
- {"version":3,"sources":["../src/gateway/security/index.ts","../src/gateway/security/actor.ts","../src/gateway/security/cost-map.ts","../src/gateway/security/tiers.ts","../src/gateway/security/defaults.ts","../src/gateway/security/valkey.ts","../src/gateway/security/metrics.ts","../src/gateway/security/plugins/armor.ts","../src/gateway/security/plugins/operation-timeout.ts","../src/gateway/security/plugins/otel.ts","../src/gateway/security/plugins/query-complexity.ts","../src/gateway/security/plugins/rate-limit.ts","../src/gateway/security/plugins/index.ts"],"names":["firstIp","header","undefined","split","trim","classify","actorType","actorRole","resolveActor","getHeader","actorId","workspaceId","tenantId","orgId","appId","ip","tier","identity","headers","DEFAULT_COST_MAP","mergeCostMap","base","override","DEFAULT_TIERS","public","points","duration","burst","user","app","service","super_admin","Number","MAX_SAFE_INTEGER","positiveInt","value","fallback","parsed","parseInt","isFinite","resolveTiersFromEnv","out","Object","keys","forEach","upper","toUpperCase","process","env","boolEnv","key","v","intEnv","strEnv","DEFAULT_ARMOR_CONFIG","maxAliases","maxTokens","maxDirectives","characterLimit","costLimit","observe","resolveSecurityOptionsFromEnv","gatewayName","costMapOverride","enabled","armor","queryComplexity","maxCost","costMap","rateLimit","tiers","keyPrefix","observeOnly","failClosed","operationTimeout","timeoutMs","otel","serviceName","endpoint","environment","version","IoRedisAdapter","client","get","set","options","EX","incrBy","amount","incrby","expire","seconds","result","ttl","ping","buildIoRedisClient","url","spec","mod","Ctor","default","Redis","Error","on","err","e","String","logger","warn","error","message","MemoryValkey","store","Map","prune","expiresAt","Date","now","delete","Promise","resolve","next","Math","max","ceil","singleton","bootPromise","initializeSecurityValkey","required","clientKind","msg","attempts","push","kind","factory","getValkeyClient","lastError","attempt","pong","info","getSecurityValkey","__setSecurityValkeyForTest","metrics","initializing","promMod","noopCounter","inc","noopMetrics","complexityRejected","armorRejected","valkeyFailover","initializeMetrics","imported","Counter","name","help","labelNames","getMetrics","scrapeMetrics","register","body","contentType","__resetMetricsForTest","tryImport","specifier","pickFactory","candidates","fn","createMaxAliasesRule","context","aliases","Field","node","alias","reportError","GraphQLError","nodes","extensions","code","createMaxDirectivesRule","directives","Directive","isLean","loadRules","cfg","lean","aliasesMod","directivesMod","costMod","blockSuggestionsMod","all","loaded","maxAliasesFactory","maxAliasesRule","n","exposeLimits","maxDirectivesFactory","maxDirectivesRule","costLimitFactory","costLimitRule","objectCost","scalarCost","depthCostFactor","ignoreIntrospection","blockSuggestionsFactory","blockSuggestionsPlugin","createArmorPlugins","rules","enabledRules","rule","armorValidationPlugin","onParse","params","source","length","limit","mode","http","status","onValidate","setResult","armorErrors","errs","graphqlValidate","schema","documentAST","wrapped","originalError","plugins","createTimeoutHandle","timerRef","promise","_","reject","setTimeout","timer","createOperationTimeoutPlugin","deps","timeoutError","config","onExecute","executeFn","setExecuteFn","args","handle","race","clearTimeout","shutdownHook","buildResource","resMod","attrs","resourceFromAttributes","Resource","resolveSemanticKeys","semcon","SemanticResourceAttributes","SERVICE_NAME","deploymentEnv","DEPLOYMENT_ENVIRONMENT","serviceVersion","SERVICE_VERSION","ATTR_SERVICE_NAME","ATTR_DEPLOYMENT_ENVIRONMENT_NAME","ATTR_DEPLOYMENT_ENVIRONMENT","ATTR_SERVICE_VERSION","loadOtelPeerDeps","sdkSpec","otlpSpec","resSpec","semSpec","modules","sdkMod","otlpMod","NodeSDK","OTLPTraceExporter","initializeOtel","resourceAttributes","sdk","resource","traceExporter","start","shutdown","shutdownOtel","createOtelPlugin","useOpenTelemetry","spans","execute","parse","validate","subscribe","resolvers","PAGINATION_ARGUMENTS","Set","MAX_LIST_MULTIPLIER","MAX_FAILURE_LOG_VARIANTS","complexityFailureMessages","isRecord","unwrapNamedType","type","current","getSchemaLike","getOperationRootType","operation","schemaLike","getMutationType","getSubscriptionType","getQueryType","getTypeByName","getType","getField","parentType","fieldName","getFields","getCostMapValue","numericValueFromAst","Kind","INT","FLOAT","STRING","listMultiplierFromArgs","arg","has","raw","min","trunc","calculateFieldComplexity","fieldNode","fragments","activeFragments","field","baseCost","namedFieldType","childCost","selectionSet","calculateSelectionSetComplexity","arguments","total","selection","selections","calculateSelectionComplexity","FIELD","INLINE_FRAGMENT","fragmentParent","typeCondition","fragmentName","fragment","add","complexity","calculateDocumentComplexity","operations","definition","definitions","FRAGMENT_DEFINITION","OPERATION_DEFINITION","maxComplexity","rootType","logComplexityFailure","seen","size","suppressedRepeats","debug","createQueryComplexityPlugin","gateway","cost","keyFor","prefix","stamp","checkRateLimit","actor","decision","allowed","remaining","resetAtMs","count","valkey","createRateLimitPlugin","onRequest","request","fetchAPI","endResponse","__rateLimitResult","__rateLimitActor","retryAfterS","JSON","stringify","errors","resetAt","toISOString","response","Response","floor","onResponse","stash","buildSecurityPlugins","otelPlugin","armorPlugins"],"mappings":";;;;;AAAA,IAAA,gBAAA,GAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACgBA,IAAMA,OAAAA,2BAAWC,MAAAA,KAAAA;AACf,EAAA,IAAI,CAACA,QAAQ,OAAOC,MAAAA;AAEpB,EAAA,OAAOD,OAAOE,KAAAA,CAAM,GAAA,EAAK,CAAA,CAAA,EAAIC,MAAAA,IAAUF,MAAAA;AACzC,CAAA,EAJgB,SAAA,CAAA;AAMhB,IAAMG,QAAAA,mBAAW,MAAA,CAAA,CAACC,SAAAA,EAA+BC,SAAAA,KAAAA;AAC/C,EAAA,IAAIA,SAAAA,KAAc,eAAe,OAAO,aAAA;AACxC,EAAA,QAAQD,SAAAA;IACN,KAAK,MAAA;AACH,MAAA,OAAO,MAAA;IACT,KAAK,KAAA;AACH,MAAA,OAAO,KAAA;IACT,KAAK,SAAA;IACL,KAAK,iBAAA;AACH,MAAA,OAAO,SAAA;IACT,KAAK,aAAA;AACH,MAAA,OAAO,aAAA;AACT,IAAA;AACE,MAAA,OAAO,QAAA;AACX;AACF,CAAA,EAfiB,UAAA,CAAA;AAqBV,IAAME,YAAAA,2BAAgBC,SAAAA,KAAAA;AAC3B,EAAA,MAAMC,OAAAA,GAAUD,SAAAA,CAAU,YAAA,CAAA,IAAiBP,MAAAA;AAC3C,EAAA,MAAMI,SAAAA,GAAYG,SAAAA,CAAU,cAAA,CAAA,IAAmBP,MAAAA;AAC/C,EAAA,MAAMK,SAAAA,GAAYE,SAAAA,CAAU,cAAA,CAAA,IAAmBP,MAAAA;AAC/C,EAAA,MAAMS,WAAAA,GAAcF,SAAAA,CAAU,gBAAA,CAAA,IAAqBP,MAAAA;AACnD,EAAA,MAAMU,QAAAA,GAAWH,SAAAA,CAAU,aAAA,CAAA,IAAkBP,MAAAA;AAC7C,EAAA,MAAMW,KAAAA,GAAQJ,SAAAA,CAAU,UAAA,CAAA,IAAeP,MAAAA;AACvC,EAAA,MAAMY,KAAAA,GAAQL,SAAAA,CAAU,UAAA,CAAA,IAAeP,MAAAA;AACvC,EAAA,MAAMa,EAAAA,GACJf,OAAAA,CAAQS,SAAAA,CAAU,iBAAA,CAAA,CAAA,IAAuBA,SAAAA,CAAU,WAAA,CAAA,IAAgBA,SAAAA,CAAU,kBAAA,CAAA,IAAuBP,MAAAA;AAEtG,EAAA,MAAMc,IAAAA,GAAOX,QAAAA,CAASC,SAAAA,EAAWC,SAAAA,CAAAA;AAEjC,EAAA,IAAIU,QAAAA;AACJ,EAAA,QAAQD,IAAAA;IACN,KAAK,aAAA;AACHC,MAAAA,QAAAA,GAAW,QAAA;AACX,MAAA;IACF,KAAK,SAAA;AACHA,MAAAA,QAAAA,GAAW,CAAA,IAAA,EAAOP,WAAW,SAAA,CAAA,CAAA;AAC7B,MAAA;IACF,KAAK,KAAA;AACHO,MAAAA,QAAAA,GAAW,GAAGL,QAAAA,IAAY,UAAA,CAAA,CAAA,EAAcE,KAAAA,IAASJ,WAAW,SAAA,CAAA,CAAA;AAC5D,MAAA;IACF,KAAK,MAAA;AACHO,MAAAA,QAAAA,GAAW,CAAA,EAAGN,WAAAA,IAAe,MAAA,CAAA,CAAA,EAAUD,WAAW,SAAA,CAAA,CAAA;AAClD,MAAA;IACF,KAAK,QAAA;AACL,IAAA;AACEO,MAAAA,QAAAA,GAAW,CAAA,GAAA,EAAMF,MAAM,SAAA,CAAA,CAAA;AAC3B;AAEA,EAAA,OAAO;AACLC,IAAAA,IAAAA;AACAC,IAAAA,QAAAA;IACAC,OAAAA,EAAS;AACPR,MAAAA,OAAAA;AACAJ,MAAAA,SAAAA;AACAC,MAAAA,SAAAA;AACAI,MAAAA,WAAAA;AACAC,MAAAA,QAAAA;AACAC,MAAAA,KAAAA;AACAC,MAAAA,KAAAA;AACAC,MAAAA;AACF;AACF,GAAA;AACF,CAAA,EA9C4B,cAAA;;;AC1BrB,IAAMI,gBAAAA,GAA4B;;EAEvC,wBAAA,EAA0B,GAAA;EAC1B,wBAAA,EAA0B,GAAA;EAC1B,kBAAA,EAAoB,EAAA;;EAGpB,uBAAA,EAAyB,GAAA;EACzB,mBAAA,EAAqB,GAAA;EACrB,qBAAA,EAAuB,GAAA;EACvB,gBAAA,EAAkB,GAAA;;EAGlB,iBAAA,EAAmB,EAAA;EACnB,sBAAA,EAAwB,EAAA;EACxB,iBAAA,EAAmB,EAAA;EACnB,gBAAA,EAAkB,EAAA;EAClB,gBAAA,EAAkB,EAAA;;EAGlB,mBAAA,EAAqB,CAAA;EACrB,iBAAA,EAAmB,EAAA;EACnB,WAAA,EAAa,CAAA;EACb,eAAA,EAAiB,CAAA;;EAGjB,gBAAA,EAAkB,GAAA;EAClB,cAAA,EAAgB,GAAA;;EAGhB,qBAAA,EAAuB,GAAA;EACvB,yBAAA,EAA2B;AAC7B;AAEO,IAAMC,YAAAA,mBAAe,MAAA,CAAA,CAACC,IAAAA,EAAeC,QAAAA,MAAgC;EAC1E,GAAGD,IAAAA;EACH,GAAGC;AACL,CAAA,CAAA,EAH4B,cAAA;;;ACvCrB,IAAMC,aAAAA,GAA0C;;;;;;;EAOrDC,MAAAA,EAAQ;IACNC,MAAAA,EAAQ,GAAA;IACRC,QAAAA,EAAU,EAAA;IACVC,KAAAA,EAAO;AACT,GAAA;EACAC,IAAAA,EAAM;IACJH,MAAAA,EAAQ,GAAA;IACRC,QAAAA,EAAU,EAAA;IACVC,KAAAA,EAAO;AACT,GAAA;EACAE,GAAAA,EAAK;IACHJ,MAAAA,EAAQ,GAAA;IACRC,QAAAA,EAAU,EAAA;IACVC,KAAAA,EAAO;AACT,GAAA;EACAG,OAAAA,EAAS;IACPL,MAAAA,EAAQ,GAAA;IACRC,QAAAA,EAAU,EAAA;IACVC,KAAAA,EAAO;AACT,GAAA;EACAI,WAAAA,EAAa;AACXN,IAAAA,MAAAA,EAAQO,MAAAA,CAAOC,gBAAAA;IACfP,QAAAA,EAAU,EAAA;AACVC,IAAAA,KAAAA,EAAOK,MAAAA,CAAOC;AAChB;AACF;AAEA,IAAMC,WAAAA,mBAAc,MAAA,CAAA,CAACC,KAAAA,EAA2BC,QAAAA,KAAAA;AAC9C,EAAA,IAAI,CAACD,OAAO,OAAOC,QAAAA;AACnB,EAAA,MAAMC,MAAAA,GAASC,QAAAA,CAASH,KAAAA,EAAO,EAAA,CAAA;AAC/B,EAAA,OAAOH,OAAOO,QAAAA,CAASF,MAAAA,CAAAA,IAAWA,MAAAA,GAAS,IAAIA,MAAAA,GAASD,QAAAA;AAC1D,CAAA,EAJoB,aAAA,CAAA;AAYb,IAAMI,mBAAAA,mBAAsB,MAAA,CAAA,CAACnB,IAAAA,GAAiCE,aAAAA,KAAa;AAChF,EAAA,MAAMkB,GAAAA,GAAgC;IAAE,GAAGpB;AAAK,GAAA;AAC/CqB,EAAAA,MAAAA,CAAOC,IAAAA,CAAKtB,IAAAA,CAAAA,CAAiBuB,OAAAA,CAAQ,CAAC5B,IAAAA,KAAAA;AACrC,IAAA,MAAM6B,KAAAA,GAAQ7B,KAAK8B,WAAAA,EAAW;AAC9BL,IAAAA,GAAAA,CAAIzB,IAAAA,CAAAA,GAAQ;MACVS,MAAAA,EAAQS,WAAAA,CAAYa,OAAAA,CAAQC,GAAAA,CAAI,CAAA,WAAA,EAAcH,KAAAA,SAAc,CAAA,EAAGxB,IAAAA,CAAKL,IAAAA,CAAAA,CAAMS,MAAM,CAAA;MAChFC,QAAAA,EAAUQ,WAAAA,CAAYa,OAAAA,CAAQC,GAAAA,CAAI,CAAA,WAAA,EAAcH,KAAAA,WAAgB,CAAA,EAAGxB,IAAAA,CAAKL,IAAAA,CAAAA,CAAMU,QAAQ,CAAA;MACtFC,KAAAA,EAAOO,WAAAA,CAAYa,OAAAA,CAAQC,GAAAA,CAAI,CAAA,WAAA,EAAcH,KAAAA,QAAa,CAAA,EAAGxB,IAAAA,CAAKL,IAAAA,CAAAA,CAAMW,KAAK;AAC/E,KAAA;EACF,CAAA,CAAA;AACA,EAAA,OAAOc,GAAAA;AACT,CAAA,EAXmC,qBAAA;;;AC1CnC,IAAMQ,OAAAA,mBAAU,MAAA,CAAA,CAACC,GAAAA,EAAad,QAAAA,KAAAA;AAC5B,EAAA,MAAMe,CAAAA,GAAIJ,OAAAA,CAAQC,GAAAA,CAAIE,GAAAA,CAAAA;AACtB,EAAA,IAAIC,CAAAA,KAAMjD,QAAW,OAAOkC,QAAAA;AAC5B,EAAA,OAAOe,CAAAA,KAAM,UAAUA,CAAAA,KAAM,GAAA;AAC/B,CAAA,EAJgB,SAAA,CAAA;AAMhB,IAAMC,MAAAA,mBAAS,MAAA,CAAA,CAACF,GAAAA,EAAad,QAAAA,KAAAA;AAC3B,EAAA,MAAMe,CAAAA,GAAIJ,OAAAA,CAAQC,GAAAA,CAAIE,GAAAA,CAAAA;AACtB,EAAA,IAAI,CAACC,GAAG,OAAOf,QAAAA;AACf,EAAA,MAAMC,MAAAA,GAASC,QAAAA,CAASa,CAAAA,EAAG,EAAA,CAAA;AAC3B,EAAA,OAAOnB,MAAAA,CAAOO,QAAAA,CAASF,MAAAA,CAAAA,GAAUA,MAAAA,GAASD,QAAAA;AAC5C,CAAA,EALe,QAAA,CAAA;AAOf,IAAMiB,MAAAA,2BAAUH,GAAAA,EAAad,QAAAA,KAA6BW,QAAQC,GAAAA,CAAIE,GAAAA,KAAQd,QAAAA,EAA/D,QAAA,CAAA;AAKR,IAAMkB,oBAAAA,GAAoC;EAC/CC,UAAAA,EAAY,EAAA;EACZC,SAAAA,EAAW,GAAA;EACXC,aAAAA,EAAe,EAAA;EACfC,cAAAA,EAAgB,IAAA;EAChBC,SAAAA,EAAW,GAAA;EACXC,OAAAA,EAAS;AACX;AASO,IAAMC,6BAAAA,mBAAgC,MAAA,CAAA,CAC3CC,WAAAA,EACAC,eAAAA,KAAAA;AAEA,EAAA,OAAO;AACLD,IAAAA,WAAAA;IACAE,OAAAA,EAASf,OAAAA,CAAQ,4BAA4B,IAAA,CAAA;IAC7CgB,KAAAA,EAAO;MACLV,UAAAA,EAAYH,MAAAA,CAAO,mBAAA,EAAqBE,oBAAAA,CAAqBC,UAAU,CAAA;MACvEC,SAAAA,EAAWJ,MAAAA,CAAO,kBAAA,EAAoBE,oBAAAA,CAAqBE,SAAS,CAAA;MACpEC,aAAAA,EAAeL,MAAAA,CAAO,sBAAA,EAAwBE,oBAAAA,CAAqBG,aAAa,CAAA;MAChFC,cAAAA,EAAgBN,MAAAA,CAAO,uBAAA,EAAyBE,oBAAAA,CAAqBI,cAAc,CAAA;MACnFC,SAAAA,EAAWP,MAAAA,CAAO,kBAAA,EAAoBE,oBAAAA,CAAqBK,SAAS,CAAA;MACpEC,OAAAA,EAASX,OAAAA,CAAQ,iBAAiB,IAAA;AACpC,KAAA;IACAiB,eAAAA,EAAiB;MACfF,OAAAA,EAASf,OAAAA,CAAQ,4BAA4B,IAAA,CAAA;MAC7CkB,OAAAA,EAASf,MAAAA,CAAO,wBAAwB,GAAA,CAAA;AACxCgB,MAAAA,OAAAA,EAASL,eAAAA,GAAkB3C,YAAAA,CAAaD,gBAAAA,EAAkB4C,eAAAA,CAAAA,GAAmB5C,gBAAAA;MAC7EyC,OAAAA,EAASX,OAAAA,CAAQ,4BAA4B,IAAA;AAC/C,KAAA;IACAoB,SAAAA,EAAW;AACTC,MAAAA,KAAAA,EAAO9B,mBAAAA,EAAAA;MACP+B,SAAAA,EAAWlB,MAAAA,CAAO,qBAAqBS,WAAAA,CAAAA;MACvCU,WAAAA,EAAavB,OAAAA,CAAQ,2BAA2B,IAAA,CAAA;MAChDwB,UAAAA,EAAYxB,OAAAA,CAAQ,0BAA0B,KAAA;AAChD,KAAA;IACAyB,gBAAAA,EAAkB;;;;;;MAMhBC,SAAAA,EAAWvB,MAAAA,CAAO,wBAAwB,IAAA;AAC5C,KAAA;IACAwB,IAAAA,EAAM;MACJZ,OAAAA,EAASf,OAAAA,CAAQ,gBAAgB,IAAA,CAAA;MACjC4B,WAAAA,EAAaxB,MAAAA,CAAO,qBAAqBS,WAAAA,CAAAA;MACzCgB,QAAAA,EAAUzB,MAAAA,CAAO,+BAA+B,6DAAA,CAAA;MAChD0B,WAAAA,EAAa1B,MAAAA,CAAO,YAAY,aAAA,CAAA;MAChC2B,OAAAA,EAASjC,OAAAA,CAAQC,IAAI,aAAA;AACvB;AACF,GAAA;AACF,CAAA,EA3C6C,+BAAA;;;ACpB7C,IAAMiC,cAAAA,GAAN,MAAMA,eAAAA,CAAAA;EA9BN;;;;AA+BE,EAAA,WAAA,CAA6BC,MAAAA,EAAyB;SAAzBA,MAAAA,GAAAA,MAAAA;AAA0B,EAAA;AAEvDC,EAAAA,GAAAA,CAAIjC,GAAAA,EAAqC;AACvC,IAAA,OAAO,IAAA,CAAKgC,MAAAA,CAAOC,GAAAA,CAAIjC,GAAAA,CAAAA;AACzB,EAAA;EAEAkC,GAAAA,CAAIlC,GAAAA,EAAaf,OAAekD,OAAAA,EAAmD;AACjF,IAAA,IAAIA,SAASC,EAAAA,EAAI;AACf,MAAA,OAAO,KAAKJ,MAAAA,CAAOE,GAAAA,CAAIlC,KAAKf,KAAAA,EAAO,IAAA,EAAMkD,QAAQC,EAAE,CAAA;AACrD,IAAA;AACA,IAAA,OAAO,IAAA,CAAKJ,MAAAA,CAAOE,GAAAA,CAAIlC,GAAAA,EAAKf,KAAAA,CAAAA;AAC9B,EAAA;AAEAoD,EAAAA,MAAAA,CAAOrC,KAAasC,MAAAA,EAAiC;AACnD,IAAA,OAAO,IAAA,CAAKN,MAAAA,CAAOO,MAAAA,CAAOvC,GAAAA,EAAKsC,MAAAA,CAAAA;AACjC,EAAA;EAEA,MAAME,MAAAA,CAAOxC,KAAayC,OAAAA,EAAmC;AAC3D,IAAA,MAAMC,SAAS,MAAM,IAAA,CAAKV,MAAAA,CAAOQ,MAAAA,CAAOxC,KAAKyC,OAAAA,CAAAA;AAC7C,IAAA,OAAOC,MAAAA,KAAW,CAAA;AACpB,EAAA;AAEAC,EAAAA,GAAAA,CAAI3C,GAAAA,EAA8B;AAChC,IAAA,OAAO,IAAA,CAAKgC,MAAAA,CAAOW,GAAAA,CAAI3C,GAAAA,CAAAA;AACzB,EAAA;EAEA4C,IAAAA,GAAwB;AACtB,IAAA,OAAO,IAAA,CAAKZ,OAAOY,IAAAA,EAAI;AACzB,EAAA;AACF,CAAA;AAEA,IAAMC,kBAAAA,iCAA4BC,GAAAA,KAAAA;AAChC,EAAA,MAAMC,IAAAA,GAAO,SAAA;AACb,EAAA,MAAMC,MAAO,MAAM;;AAA0BD,IAAAA;;AAI7C,EAAA,MAAME,IAAAA,GAAOD,GAAAA,CAAIE,OAAAA,IAAWF,GAAAA,CAAIG,KAAAA;AAChC,EAAA,IAAI,CAACF,IAAAA,EAAM;AACT,IAAA,MAAM,IAAIG,MAAM,yCAAA,CAAA;AAClB,EAAA;AACA,EAAA,MAAMpB,MAAAA,GAAS,IAAIiB,IAAAA,CAAKH,GAAAA,CAAAA;AACxBd,EAAAA,MAAAA,CAAOqB,EAAAA,CAAG,OAAA,EAAS,CAACC,GAAAA,KAAAA;AAClB,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,wCAAA,EAA0C;AAAEC,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KAAQ,CAAA;EAC3E,CAAA,CAAA;AACA,EAAA,OAAO,IAAI7B,eAAeC,MAAAA,CAAAA;AAC5B,CAAA,EAhB2B,oBAAA,CAAA;AA2B3B,IAAM6B,YAAAA,GAAN,MAAMA,aAAAA,CAAAA;EAzFN;;;AA0FUC,EAAAA,KAAAA,uBAAYC,GAAAA,EAAAA;AAEZC,EAAAA,KAAAA,CAAMhE,GAAAA,EAAsC;AAClD,IAAA,MAAMuD,CAAAA,GAAI,IAAA,CAAKO,KAAAA,CAAM7B,GAAAA,CAAIjC,GAAAA,CAAAA;AACzB,IAAA,IAAI,CAACuD,GAAG,OAAOvG,MAAAA;AACf,IAAA,IAAIuG,EAAEU,SAAAA,GAAY,CAAA,IAAKV,EAAEU,SAAAA,IAAaC,IAAAA,CAAKC,KAAG,EAAI;AAChD,MAAA,IAAA,CAAKL,KAAAA,CAAMM,OAAOpE,GAAAA,CAAAA;AAClB,MAAA,OAAOhD,MAAAA;AACT,IAAA;AACA,IAAA,OAAOuG,CAAAA;AACT,EAAA;AAEAtB,EAAAA,GAAAA,CAAIjC,GAAAA,EAAqC;AACvC,IAAA,MAAMuD,CAAAA,GAAI,IAAA,CAAKS,KAAAA,CAAMhE,GAAAA,CAAAA;AACrB,IAAA,OAAOqE,OAAAA,CAAQC,OAAAA,CAAQf,CAAAA,EAAGtE,KAAAA,IAAS,IAAA,CAAA;AACrC,EAAA;EAEAiD,GAAAA,CAAIlC,GAAAA,EAAaf,OAAekD,OAAAA,EAAmD;AACjF,IAAA,IAAA,CAAK2B,KAAAA,CAAM5B,IAAIlC,GAAAA,EAAK;AAClBf,MAAAA,KAAAA;AACAgF,MAAAA,SAAAA,EAAW9B,SAASC,EAAAA,GAAK8B,IAAAA,CAAKC,KAAG,GAAKhC,OAAAA,CAAQC,KAAK,GAAA,GAAO;KAC5D,CAAA;AACA,IAAA,OAAOiC,OAAAA,CAAQC,QAAQ,IAAA,CAAA;AACzB,EAAA;AAEAjC,EAAAA,MAAAA,CAAOrC,KAAasC,MAAAA,EAAiC;AACnD,IAAA,MAAMiB,CAAAA,GAAI,IAAA,CAAKS,KAAAA,CAAMhE,GAAAA,CAAAA;AACrB,IAAA,MAAMuE,IAAAA,GAAAA,CAAQhB,IAAInE,QAAAA,CAASmE,CAAAA,CAAEtE,OAAO,EAAA,CAAA,IAAO,IAAI,CAAA,IAAKqD,MAAAA;AACpD,IAAA,IAAA,CAAKwB,KAAAA,CAAM5B,IAAIlC,GAAAA,EAAK;AAAEf,MAAAA,KAAAA,EAAOuE,OAAOe,IAAAA,CAAAA;AAAON,MAAAA,SAAAA,EAAWV,GAAGU,SAAAA,IAAa;KAAE,CAAA;AACxE,IAAA,OAAOI,OAAAA,CAAQC,QAAQC,IAAAA,CAAAA;AACzB,EAAA;AAEA/B,EAAAA,MAAAA,CAAOxC,KAAayC,OAAAA,EAAmC;AACrD,IAAA,MAAMc,CAAAA,GAAI,IAAA,CAAKO,KAAAA,CAAM7B,GAAAA,CAAIjC,GAAAA,CAAAA;AACzB,IAAA,IAAI,CAACuD,CAAAA,EAAG,OAAOc,OAAAA,CAAQC,QAAQ,KAAA,CAAA;AAC/Bf,IAAAA,CAAAA,CAAEU,SAAAA,GAAYC,IAAAA,CAAKC,GAAAA,EAAG,GAAK1B,OAAAA,GAAU,GAAA;AACrC,IAAA,OAAO4B,OAAAA,CAAQC,QAAQ,IAAA,CAAA;AACzB,EAAA;AAEA3B,EAAAA,GAAAA,CAAI3C,GAAAA,EAA8B;AAChC,IAAA,MAAMuD,CAAAA,GAAI,IAAA,CAAKS,KAAAA,CAAMhE,GAAAA,CAAAA;AACrB,IAAA,IAAI,CAACuD,CAAAA,EAAG,OAAOc,OAAAA,CAAQC,QAAQ,EAAC,CAAA;AAChC,IAAA,IAAIf,EAAEU,SAAAA,KAAc,CAAA,EAAG,OAAOI,OAAAA,CAAQC,QAAQ,EAAC,CAAA;AAC/C,IAAA,OAAOD,OAAAA,CAAQC,OAAAA,CAAQE,IAAAA,CAAKC,GAAAA,CAAI,GAAGD,IAAAA,CAAKE,IAAAA,CAAAA,CAAMnB,CAAAA,CAAEU,SAAAA,GAAYC,IAAAA,CAAKC,GAAAA,EAAG,IAAM,GAAA,CAAA,CAAA,CAAA;AAC5E,EAAA;EAEAvB,IAAAA,GAAwB;AACtB,IAAA,OAAOyB,OAAAA,CAAQC,QAAQ,MAAA,CAAA;AACzB,EAAA;AACF;AAEA,IAAIK,SAAAA,GAAyC,IAAA;AAC7C,IAAIC,WAAAA,GAAoD,IAAA;AAUjD,IAAMC,wBAAAA,iCAAkCjE,WAAAA,KAAAA;AAC7C,EAAA,IAAI+D,WAAW,OAAOA,SAAAA;AACtB,EAAA,IAAIC,aAAa,OAAOA,WAAAA;AAExBA,EAAAA,WAAAA,GAAAA,CAAe,YAAA;AACb,IAAA,MAAM9B,MAAMjD,OAAAA,CAAQC,GAAAA,CAAI,YAAA,CAAA,IAAiBD,OAAAA,CAAQC,IAAI,WAAA,CAAA;AACrD,IAAA,MAAMgF,QAAAA,GAAWjF,OAAAA,CAAQC,GAAAA,CAAI,iBAAA,CAAA,KAAuB,MAAA;AACpD,IAAA,MAAMiF,UAAAA,GAAalF,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA,IAAoB,SAAA;AAEnD,IAAA,IAAI,CAACgD,GAAAA,EAAK;AACR,MAAA,MAAMkC,GAAAA,GAAM,uCAAA;AACZ,MAAA,IAAIF,UAAU,MAAM,IAAI1B,KAAAA,CAAM,CAAA,EAAG4B,GAAAA,CAAAA,yBAAAA,CAA8B,CAAA;AAC/DvB,MAAAA,MAAAA,CAAOC,IAAAA,CAAK,CAAA,EAAGsB,GAAAA,CAAAA,qDAAAA,CAAAA,EAAuD;AACpEpE,QAAAA;OACF,CAAA;AACA+D,MAAAA,SAAAA,GAAY,IAAId,YAAAA,EAAAA;AAChB,MAAA,OAAOc,SAAAA;AACT,IAAA;AAEA,IAAA,MAAMM,WAGD,EAAA;AAEL,IAAA,IAAIF,eAAe,SAAA,EAAW;AAC5BE,MAAAA,QAAAA,CAASC,IAAAA,CAAK;QAAEC,IAAAA,EAAM,SAAA;QAAWC,OAAAA,kBAAS,MAAA,CAAA,MAAMvC,kBAAAA,CAAmBC,GAAAA,CAAAA,EAAzB,SAAA;OAA8B,CAAA;AACxEmC,MAAAA,QAAAA,CAASC,IAAAA,CAAK;QACZC,IAAAA,EAAM,kBAAA;AACNC,QAAAA,OAAAA,kBAAS,MAAA,CAAA,YAAA;AACP,UAAA,MAAM,EAAEC,eAAAA,EAAe,GAAK,MAAM,OAAO,kBAAA,CAAA;AACzC,UAAA,OAAOA,eAAAA,EAAAA;QACT,CAAA,EAHS,SAAA;OAIX,CAAA;IACF,CAAA,MAAO;AACLJ,MAAAA,QAAAA,CAASC,IAAAA,CAAK;QACZC,IAAAA,EAAM,OAAA;AACNC,QAAAA,OAAAA,kBAAS,MAAA,CAAA,YAAA;AACP,UAAA,MAAM,EAAEC,eAAAA,EAAe,GAAK,MAAM,OAAO,kBAAA,CAAA;AACzC,UAAA,OAAOA,eAAAA,EAAAA;QACT,CAAA,EAHS,SAAA;OAIX,CAAA;AACAJ,MAAAA,QAAAA,CAASC,IAAAA,CAAK;QAAEC,IAAAA,EAAM,oBAAA;QAAsBC,OAAAA,kBAAS,MAAA,CAAA,MAAMvC,kBAAAA,CAAmBC,GAAAA,CAAAA,EAAzB,SAAA;OAA8B,CAAA;AACrF,IAAA;AAEA,IAAA,IAAIwC,SAAAA,GAA0B,IAAA;AAC9B,IAAA,KAAA,MAAWC,WAAWN,QAAAA,EAAU;AAC9B,MAAA,IAAI;AACF,QAAA,MAAMjD,MAAAA,GAAS,MAAMuD,OAAAA,CAAQH,OAAAA,EAAO;AACpC,QAAA,MAAMI,IAAAA,GAAO,MAAMxD,MAAAA,CAAOY,IAAAA,EAAI;AAC9B,QAAA,IAAI4C,SAAS,MAAA,EAAQ;AACnB,UAAA,MAAM,IAAIpC,KAAAA,CAAM,CAAA,cAAA,EAAiBoC,IAAAA,CAAAA,CAAM,CAAA;AACzC,QAAA;AACA/B,QAAAA,MAAAA,CAAOgC,KAAK,qCAAA,EAAuC;AACjD7E,UAAAA,WAAAA;AACAkC,UAAAA,GAAAA;AACAd,UAAAA,MAAAA,EAAQuD,OAAAA,CAAQJ;SAClB,CAAA;AACAR,QAAAA,SAAAA,GAAY3C,MAAAA;AACZ,QAAA,OAAOA,MAAAA;AACT,MAAA,CAAA,CAAA,OAASsB,GAAAA,EAAK;AACZgC,QAAAA,SAAAA,GAAYhC,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AAC1DG,QAAAA,MAAAA,CAAOC,KAAK,6DAAA,EAA+D;AACzE9C,UAAAA,WAAAA;AACAoB,UAAAA,MAAAA,EAAQuD,OAAAA,CAAQJ,IAAAA;AAChBxB,UAAAA,KAAAA,EAAO2B,SAAAA,CAAU1B;SACnB,CAAA;AACF,MAAA;AACF,IAAA;AAEA,IAAA,IAAIkB,QAAAA,EAAU;AACZrB,MAAAA,MAAAA,CAAOE,MAAM,+DAAA,EAAiE;AAC5E/C,QAAAA,WAAAA;AACA+C,QAAAA,KAAAA,EAAO2B,WAAW1B,OAAAA,IAAW;OAC/B,CAAA;AACA,MAAA,MAAM0B,SAAAA,IAAa,IAAIlC,KAAAA,CAAM,0BAAA,CAAA;AAC/B,IAAA;AACAK,IAAAA,MAAAA,CAAOC,KAAK,8EAAA,EAA2E;AACrF9C,MAAAA,WAAAA;AACA+C,MAAAA,KAAAA,EAAO2B,WAAW1B,OAAAA,IAAW;KAC/B,CAAA;AACAe,IAAAA,SAAAA,GAAY,IAAId,YAAAA,EAAAA;AAChB,IAAA,OAAOc,SAAAA;EACT,CAAA,GAAA;AAEA,EAAA,OAAOC,WAAAA;AACT,CAAA,EArFwC,0BAAA;AA2FjC,IAAMc,oCAAoB,MAAA,CAAA,MAAA;AAC/B,EAAA,IAAI,CAACf,SAAAA,EAAW;AACd,IAAA,MAAM,IAAIvB,MAAM,wFAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOuB,SAAAA;AACT,CAAA,EALiC,mBAAA;AAW1B,IAAMgB,0BAAAA,2BAA8B3D,MAAAA,KAAAA;AACzC2C,EAAAA,SAAAA,GAAY3C,MAAAA;AACZ4C,EAAAA,WAAAA,GAAc5C,MAAAA,GAASqC,OAAAA,CAAQC,OAAAA,CAAQtC,MAAAA,CAAAA,GAAU,IAAA;AACnD,CAAA,EAH0C,4BAAA;;;ACzM1C,IAAI4D,OAAAA,GAA0B,IAAA;AAC9B,IAAIC,YAAAA,GAAe,KAAA;AACnB,IAAIC,OAAAA,GAAmC,IAAA;AAEvC,IAAMC,WAAAA,GAA2B;AAC/BC,EAAAA,GAAAA,+BAAWhJ,MAAAA,EAAN,KAAA;AACP,CAAA;AAEA,IAAMiJ,WAAAA,GAAuB;EAC3B9E,SAAAA,EAAW4E,WAAAA;EACXG,kBAAAA,EAAoBH,WAAAA;EACpBI,aAAAA,EAAeJ,WAAAA;EACfK,cAAAA,EAAgBL,WAAAA;EAChBvE,gBAAAA,EAAkBuE;AACpB,CAAA;AAMO,IAAMM,oCAAoB,MAAA,CAAA,YAAA;AAC/B,EAAA,IAAIT,SAAS,OAAOA,OAAAA;AACpB,EAAA,IAAIC,YAAAA,EAAc;AAEhB,IAAA,OAAOI,WAAAA;AACT,EAAA;AACA,EAAA,IAAIpG,OAAAA,CAAQC,GAAAA,CAAI,4BAAA,CAAA,KAAkC,MAAA,EAAQ;AACxD2D,IAAAA,MAAAA,CAAOgC,KAAK,mFAAA,CAAA;AACZG,IAAAA,OAAAA,GAAUK,WAAAA;AACV,IAAA,OAAOL,OAAAA;AACT,EAAA;AAEAC,EAAAA,YAAAA,GAAe,IAAA;AACf,EAAA,IAAI;AACF,IAAA,MAAM9C,IAAAA,GAAO,aAAA;AACb,IAAA,MAAMuD,WAAY,MAAM;;AAA0BvD,MAAAA;;AAClD+C,IAAAA,OAAAA,GAAUQ,QAAAA;AACV,IAAA,IAAI,OAAOA,QAAAA,CAASC,OAAAA,KAAY,UAAA,EAAY;AAC1C9C,MAAAA,MAAAA,CAAOC,KAAK,6EAAA,CAAA;AACZkC,MAAAA,OAAAA,GAAUK,WAAAA;AACV,MAAA,OAAOL,OAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEW,SAAO,GAAKD,QAAAA;AACpBV,IAAAA,OAAAA,GAAU;AACRzE,MAAAA,SAAAA,EAAW,IAAIoF,OAAAA,CAAQ;QACrBC,IAAAA,EAAM,mCAAA;QACNC,IAAAA,EAAM,+CAAA;QACNC,UAAAA,EAAY;AAAC,UAAA,SAAA;AAAW,UAAA,MAAA;AAAQ,UAAA;;OAClC,CAAA;AACAR,MAAAA,kBAAAA,EAAoB,IAAIK,OAAAA,CAAQ;QAC9BC,IAAAA,EAAM,4CAAA;QACNC,IAAAA,EAAM,oCAAA;QACNC,UAAAA,EAAY;AAAC,UAAA,SAAA;AAAW,UAAA;;OAC1B,CAAA;AACAP,MAAAA,aAAAA,EAAe,IAAII,OAAAA,CAAQ;QACzBC,IAAAA,EAAM,uCAAA;QACNC,IAAAA,EAAM,+BAAA;QACNC,UAAAA,EAAY;AAAC,UAAA,SAAA;AAAW,UAAA,MAAA;AAAQ,UAAA;;OAClC,CAAA;AACAN,MAAAA,cAAAA,EAAgB,IAAIG,OAAAA,CAAQ;QAC1BC,IAAAA,EAAM,wCAAA;QACNC,IAAAA,EAAM,8DAAA;QACNC,UAAAA,EAAY;AAAC,UAAA;;OACf,CAAA;AACAlF,MAAAA,gBAAAA,EAAkB,IAAI+E,OAAAA,CAAQ;QAC5BC,IAAAA,EAAM,0CAAA;QACNC,IAAAA,EAAM,iCAAA;QACNC,UAAAA,EAAY;AAAC,UAAA;;OACf;AACF,KAAA;AACAjD,IAAAA,MAAAA,CAAOgC,KAAK,mDAAA,CAAA;AACZ,IAAA,OAAOG,OAAAA;AACT,EAAA,CAAA,CAAA,OAAStC,GAAAA,EAAK;AACZ,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,sEAAA,EAAmE;AAC7EC,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KACX,CAAA;AACAgC,IAAAA,OAAAA,GAAUK,WAAAA;AACV,IAAA,OAAOL,OAAAA;EACT,CAAA,SAAA;AACEC,IAAAA,YAAAA,GAAe,KAAA;AACjB,EAAA;AACF,CAAA,EA/DiC,mBAAA;AAsE1B,IAAMc,UAAAA,mBAAa,MAAA,CAAA,MAAef,OAAAA,IAAWK,WAAAA,EAA1B,YAAA;AAMnB,IAAMW,gCAAgB,MAAA,CAAA,YAAA;AAC3B,EAAA,IAAI,CAACd,OAAAA,EAASe,QAAAA,EAAU,OAAO,IAAA;AAC/B,EAAA,MAAMC,IAAAA,GAAO,MAAMhB,OAAAA,CAAQe,QAAAA,CAASjB,OAAAA,EAAO;AAC3C,EAAA,OAAO;AAAEkB,IAAAA,IAAAA;AAAMC,IAAAA,WAAAA,EAAajB,QAAQe,QAAAA,CAASE;AAAY,GAAA;AAC3D,CAAA,EAJ6B,eAAA;AAStB,IAAMC,wCAAwB,MAAA,CAAA,MAAA;AACnCpB,EAAAA,OAAAA,GAAU,IAAA;AACVC,EAAAA,YAAAA,GAAe,KAAA;AACfC,EAAAA,OAAAA,GAAU,IAAA;AACZ,CAAA,EAJqC,uBAAA;AChHrC,IAAMmB,SAAAA,iCAAmBC,SAAAA,KAAAA;AACvB,EAAA,IAAI;AACF,IAAA,OAAQ,MAAM,OAAOA,SAAAA,CAAAA;AACvB,EAAA,CAAA,CAAA,OAAS5D,GAAAA,EAAK;AACZ,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,oEAAA,EAAiE;AAC3EwD,MAAAA,SAAAA;AACAvD,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KACX,CAAA;AACA,IAAA,OAAO,IAAA;AACT,EAAA;AACF,CAAA,EAXkB,WAAA,CAAA;AAalB,IAAMuD,WAAAA,mBAAc,MAAA,CAAA,CAACnE,GAAAA,EAAyBoE,UAAAA,KAAAA;AAC5C,EAAA,IAAI,CAACpE,KAAK,OAAO,IAAA;AACjB,EAAA,KAAA,MAAWwD,QAAQY,UAAAA,EAAY;AAC7B,IAAA,MAAMC,EAAAA,GAAKrE,IAAIwD,IAAAA,CAAAA;AACf,IAAA,IAAI,OAAOa,EAAAA,KAAO,UAAA,EAAY,OAAOA,EAAAA;AACvC,EAAA;AACA,EAAA,OAAO,IAAA;AACT,CAAA,EAPoB,aAAA,CAAA;AASpB,IAAMC,oBAAAA,2BAAwBjH,UAAAA,KAAAA;AAC5B,EAAA,OAAO,CAACkH,OAAAA,KAAAA;AACN,IAAA,IAAIC,OAAAA,GAAU,CAAA;AAEd,IAAA,OAAO;AACLC,MAAAA,KAAAA,CAAMC,IAAAA,EAAI;AACR,QAAA,IAAI,CAACA,KAAKC,KAAAA,EAAO;AACjBH,QAAAA,OAAAA,IAAW,CAAA;AACX,QAAA,IAAIA,UAAUnH,UAAAA,EAAY;AACxBkH,UAAAA,OAAAA,CAAQK,WAAAA,CACN,IAAIC,YAAAA,CAAa,yBAAA,EAA2B;YAC1CC,KAAAA,EAAOJ,IAAAA;YACPK,UAAAA,EAAY;cAAEC,IAAAA,EAAM;AAAoB;AAC1C,WAAA,CAAA,CAAA;AAEJ,QAAA;AACF,MAAA;AACF,KAAA;AACF,EAAA,CAAA;AACF,CAAA,EAnB6B,sBAAA,CAAA;AAqB7B,IAAMC,uBAAAA,2BAA2B1H,aAAAA,KAAAA;AAC/B,EAAA,OAAO,CAACgH,OAAAA,KAAAA;AACN,IAAA,IAAIW,UAAAA,GAAa,CAAA;AAEjB,IAAA,OAAO;AACLC,MAAAA,SAAAA,CAAUT,IAAAA,EAAI;AACZQ,QAAAA,UAAAA,IAAc,CAAA;AACd,QAAA,IAAIA,aAAa3H,aAAAA,EAAe;AAC9BgH,UAAAA,OAAAA,CAAQK,WAAAA,CACN,IAAIC,YAAAA,CAAa,sBAAA,EAAwB;YACvCC,KAAAA,EAAOJ,IAAAA;YACPK,UAAAA,EAAY;cAAEC,IAAAA,EAAM;AAAuB;AAC7C,WAAA,CAAA,CAAA;AAEJ,QAAA;AACF,MAAA;AACF,KAAA;AACF,EAAA,CAAA;AACF,CAAA,EAlBgC,yBAAA,CAAA;AAyChC,IAAMI,yBAAS,MAAA,CAAA,MAAA;AACb,EAAA,MAAMnI,CAAAA,GAAIJ,OAAAA,CAAQC,GAAAA,CAAI,YAAA,CAAA;AACtB,EAAA,OAAOG,CAAAA,KAAM,UAAUA,CAAAA,KAAM,GAAA;AAC/B,CAAA,EAHe,QAAA,CAAA;AAKf,IAAMoI,SAAAA,iCAAmBC,GAAAA,KAAAA;AACvB,EAAA,MAAMC,OAAOH,MAAAA,EAAAA;AAEb,EAAA,MAAM,CAACI,YAAYC,aAAAA,EAAeC,OAAAA,EAASC,mBAAAA,CAAAA,GAAuB,MAAMtE,QAAQuE,GAAAA,CAAI;AAClFL,IAAAA,IAAAA,GAAOlE,OAAAA,CAAQC,OAAAA,CAAQ,IAAA,CAAA,GAAQ2C,UAAU,wCAAA,CAAA;AACzCsB,IAAAA,IAAAA,GAAOlE,OAAAA,CAAQC,OAAAA,CAAQ,IAAA,CAAA,GAAQ2C,UAAU,2CAAA,CAAA;AACzCA,IAAAA,SAAAA,CAAU,uCAAA,CAAA;AACVsB,IAAAA,IAAAA,GAAOlE,OAAAA,CAAQC,OAAAA,CAAQ,IAAA,CAAA,GAAQ2C,UAAU,oDAAA;AAC1C,GAAA,CAAA;AAED,EAAA,MAAM4B,SAAsB,EAAC;AAE7B,EAAA,MAAMC,iBAAAA,GAAoB3B,YAAYqB,UAAAA,EAAY;AAAC,IAAA;AAAiB,GAAA,CAAA;AACpEK,EAAAA,MAAAA,CAAOE,cAAAA,GAAiBD,oBACpBA,iBAAAA,CAAkB;AAAEE,IAAAA,CAAAA,EAAGV,GAAAA,CAAIjI,UAAAA;AAAY4I,IAAAA,YAAAA,EAAcX,GAAAA,CAAI5H;GAAQ,CAAA,GACjE4G,oBAAAA,CAAqBgB,GAAAA,CAAIjI,UAAU,CAAA;AAEvC,EAAA,MAAM6I,oBAAAA,GAAuB/B,YAAYsB,aAAAA,EAAe;AAAC,IAAA;AAAoB,GAAA,CAAA;AAC7EI,EAAAA,MAAAA,CAAOM,iBAAAA,GAAoBD,uBACvBA,oBAAAA,CAAqB;AACnBF,IAAAA,CAAAA,EAAGV,GAAAA,CAAI/H,aAAAA;AACP0I,IAAAA,YAAAA,EAAcX,GAAAA,CAAI5H;GACpB,CAAA,GACAuH,uBAAAA,CAAwBK,GAAAA,CAAI/H,aAAa,CAAA;AAE7C,EAAA,MAAM6I,gBAAAA,GAAmBjC,YAAYuB,OAAAA,EAAS;AAAC,IAAA;AAAgB,GAAA,CAAA;AAC/D,EAAA,IAAIU,gBAAAA,EAAkB;AACpBP,IAAAA,MAAAA,CAAOQ,gBAAgBD,gBAAAA,CAAiB;AACtCnI,MAAAA,OAAAA,EAASqH,GAAAA,CAAI7H,SAAAA;MACb6I,UAAAA,EAAY,CAAA;MACZC,UAAAA,EAAY,CAAA;MACZC,eAAAA,EAAiB,GAAA;MACjBC,mBAAAA,EAAqB,IAAA;AACrBR,MAAAA,YAAAA,EAAcX,GAAAA,CAAI5H;KACpB,CAAA;AACF,EAAA;AAEA,EAAA,MAAMgJ,uBAAAA,GAA0BvC,YAAYwB,mBAAAA,EAAqB;AAAC,IAAA,6BAAA;AAA+B,IAAA;AAAU,GAAA,CAAA;AAC3G,EAAA,IAAIe,uBAAAA,EAAyB;AAC3Bb,IAAAA,MAAAA,CAAOc,sBAAAA,GAAyBD,uBAAAA,CAAwB,EAAC,CAAA;AAC3D,EAAA;AAEA,EAAA,IAAInB,IAAAA,EAAM;AACR9E,IAAAA,MAAAA,CAAOgC,IAAAA,CAAK,wFAAA,EAAqF,EAAC,CAAA;AACpG,EAAA;AAEA,EAAA,OAAOoD,MAAAA;AACT,CAAA,EA/CkB,WAAA,CAAA;AA0DX,IAAMe,kBAAAA,iCAA4BtB,GAAAA,KAAAA;AACvC,EAAA,MAAMuB,KAAAA,GAAQ,MAAMxB,SAAAA,CAAUC,GAAAA,CAAAA;AAE9B,EAAA,MAAM1C,WAAUe,UAAAA,EAAAA;AAMhB,EAAA,MAAMmD,eAA8D,EAAA;AACpE,EAAA,IAAID,MAAMd,cAAAA,EAAgB;AACxBe,IAAAA,YAAAA,CAAa5E,IAAAA,CAAK;MAAEsB,IAAAA,EAAM,aAAA;AAAeuD,MAAAA,IAAAA,EAAMF,KAAAA,CAAMd;KAAe,CAAA;AACtE,EAAA;AACA,EAAA,IAAIc,MAAMV,iBAAAA,EAAmB;AAC3BW,IAAAA,YAAAA,CAAa5E,IAAAA,CAAK;MAAEsB,IAAAA,EAAM,gBAAA;AAAkBuD,MAAAA,IAAAA,EAAMF,KAAAA,CAAMV;KAAkB,CAAA;AAC5E,EAAA;AACA,EAAA,IAAIU,MAAMR,aAAAA,EAAe;AACvBS,IAAAA,YAAAA,CAAa5E,IAAAA,CAAK;MAAEsB,IAAAA,EAAM,YAAA;AAAcuD,MAAAA,IAAAA,EAAMF,KAAAA,CAAMR;KAAc,CAAA;AACpE,EAAA;AAEA,EAAA,MAAMW,qBAAAA,GAAgC;IACpCC,OAAAA,CAAQ,EAAEC,QAAM,EAAE;AAIhB,MAAA,MAAMC,MAAAA,GAAS,OAAOD,MAAAA,CAAOC,MAAAA,KAAW,WAAWD,MAAAA,CAAOC,MAAAA,GAASD,OAAOC,MAAAA,EAAQrD,IAAAA;AAClF,MAAA,IAAI,OAAOqD,MAAAA,KAAW,QAAA,IAAYA,MAAAA,CAAOC,MAAAA,GAAS9B,IAAI9H,cAAAA,EAAgB;AACpE,QAAA,IAAI8H,IAAI5H,OAAAA,EAAS;AACf+C,UAAAA,MAAAA,CAAOC,KAAK,6DAAA,EAA+D;AACzE0G,YAAAA,MAAAA,EAAQD,MAAAA,CAAOC,MAAAA;AACfC,YAAAA,KAAAA,EAAO/B,GAAAA,CAAI9H;WACb,CAAA;AACAoF,UAAAA,QAAAA,CAAQO,cAAcH,GAAAA,CAAI;YAAE+D,IAAAA,EAAM,iBAAA;YAAmBO,IAAAA,EAAM;AAAU,WAAA,EAAG,CAAA,CAAA;AACxE,UAAA;AACF,QAAA;AACA1E,QAAAA,QAAAA,CAAQO,cAAcH,GAAAA,CAAI;UAAE+D,IAAAA,EAAM,iBAAA;UAAmBO,IAAAA,EAAM;AAAU,SAAA,EAAG,CAAA,CAAA;AACxE,QAAA,MAAM,IAAIzC,aAAa,sDAAA,EAAwD;UAC7EE,UAAAA,EAAY;YACVC,IAAAA,EAAM,0BAAA;YACNuC,IAAAA,EAAM;cAAEC,MAAAA,EAAQ;AAAI;AACtB;SACF,CAAA;AACF,MAAA;AACF,IAAA,CAAA;IACAC,UAAAA,CAAW,EAAEP,MAAAA,EAAQQ,SAAAA,EAAS,EAAE;AAC9B,MAAA,IAAIZ,YAAAA,CAAaM,WAAW,CAAA,EAAG;AAe/B,MAAA,MAAMO,cAA8B,EAAA;AACpC,MAAA,KAAA,MAAW,EAAEnE,IAAAA,EAAMuD,IAAAA,EAAI,IAAMD,YAAAA,EAAc;AACzC,QAAA,IAAI;AACF,UAAA,MAAMc,IAAAA,GAAOC,QAAAA,CAAgBX,MAAAA,CAAOY,MAAAA,EAAQZ,OAAOa,WAAAA,EAAa;AAAChB,YAAAA;AAAK,WAAA,CAAA;AACtEY,UAAAA,WAAAA,CAAYzF,IAAAA,CAAI,GAAI0F,IAAAA,CAAAA;AACtB,QAAA,CAAA,CAAA,OAAStH,GAAAA,EAAK;AAUZ,UAAA,MAAMM,UAAUN,GAAAA,YAAeF,KAAAA,GAAQE,GAAAA,CAAIM,OAAAA,GAAUJ,OAAOF,GAAAA,CAAAA;AAC5D,UAAA,MAAM0H,OAAAA,GAAU,IAAInD,YAAAA,CAAajE,OAAAA,EAAS;YACxCqH,aAAAA,EAAe3H,GAAAA,YAAeF,QAAQE,GAAAA,GAAMtG,MAAAA;YAC5C+K,UAAAA,EAAY;cACVC,IAAAA,EAAM,iBAAA;cACN+B,IAAAA,EAAMvD;AACR;WACF,CAAA;AACAmE,UAAAA,WAAAA,CAAYzF,KAAK8F,OAAAA,CAAAA;AACnB,QAAA;AACF,MAAA;AAEA,MAAA,IAAIL,WAAAA,CAAYP,WAAW,CAAA,EAAG;AAE9B,MAAA,KAAA,MAAW9G,OAAOqH,WAAAA,EAAa;AAC7BlH,QAAAA,MAAAA,CAAOC,KAAK,yCAAA,EAA2C;AACrDE,UAAAA,OAAAA,EAASN,GAAAA,CAAIM,OAAAA;AACblD,UAAAA,OAAAA,EAAS4H,GAAAA,CAAI5H;SACf,CAAA;AACF,MAAA;AAEAkF,MAAAA,QAAAA,CAAQO,cAAcH,GAAAA,CACpB;QACE+D,IAAAA,EAAM,OAAA;QACNO,IAAAA,EAAMhC,GAAAA,CAAI5H,UAAU,SAAA,GAAY;AAClC,OAAA,EACAiK,YAAYP,MAAM,CAAA;AAGpB,MAAA,IAAI9B,IAAI5H,OAAAA,EAAS;AAMjBgK,MAAAA,SAAAA,CAAUC,WAAAA,CAAAA;AACZ,IAAA;AACF,GAAA;AAEA,EAAA,MAAMO,OAAAA,GAAoB;AAAClB,IAAAA;;AAC3B,EAAA,IAAIH,MAAMF,sBAAAA,EAAwB;AAChCuB,IAAAA,OAAAA,CAAQhG,IAAAA,CAAK2E,MAAMF,sBAAsB,CAAA;AAC3C,EAAA;AACA,EAAA,OAAOuB,OAAAA;AACT,CAAA,EAvHkC,oBAAA;AClKlC,IAAMC,mBAAAA,mBAAsB,MAAA,CAAA,CAAC1J,SAAAA,EAAmBkC,KAAAA,KAAAA;AAC9C,EAAA,IAAIyH,QAAAA;AACJ,EAAA,MAAMC,OAAAA,GAAU,IAAIhH,OAAAA,CAAe,CAACiH,GAAGC,MAAAA,KAAAA;AACrCH,IAAAA,QAAAA,GAAWI,UAAAA,CAAW,MAAMD,MAAAA,CAAO5H,KAAAA,GAAQlC,SAAAA,CAAAA;EAC7C,CAAA,CAAA;AACA,EAAA,OAAO;IAAEgK,KAAAA,EAAOL,QAAAA;AAA2CC,IAAAA;AAAQ,GAAA;AACrE,CAAA,EAN4B,qBAAA,CAAA;AAQrB,IAAMK,4BAAAA,2BAAgCC,IAAAA,KAAAA;AAC3C,EAAA,MAAMC,YAAAA,GAAe,IAAI/D,YAAAA,CAAa,mBAAA,EAAqB;IACzDE,UAAAA,EAAY;MAAEC,IAAAA,EAAM,mBAAA;AAAqBvG,MAAAA,SAAAA,EAAWkK,KAAKE,MAAAA,CAAOpK;AAAU;GAC5E,CAAA;AAEA,EAAA,OAAO;AACLqK,IAAAA,SAAAA,kBAAW,MAAA,CAAA,CAAC,EAAEC,SAAAA,EAAWC,YAAAA,EAAY,KAAE;AACrCA,MAAAA,YAAAA,CAAa,OAAOC,IAAAA,KAAAA;AAClB,QAAA,MAAMC,MAAAA,GAASf,mBAAAA,CAAoBQ,IAAAA,CAAKE,MAAAA,CAAOpK,WAAWmK,YAAAA,CAAAA;AAC1D,QAAA,IAAI;AACF,UAAA,OAAO,MAAMvH,QAAQ8H,IAAAA,CAAK;AAACJ,YAAAA,SAAAA,CAAUE,IAAAA,CAAAA;YAAOC,MAAAA,CAAOb;AAAQ,WAAA,CAAA;QAC7D,CAAA,SAAA;AACEe,UAAAA,YAAAA,CAAaF,OAAOT,KAAK,CAAA;AAC3B,QAAA;MACF,CAAA,CAAA;IACF,CAAA,EATW,WAAA;AAUb,GAAA;AACF,CAAA,EAjB4C,8BAAA;;;ACjB5C,IAAIY,YAAAA,GAA6C,IAAA;AAoCjD,IAAMC,aAAAA,mBAAgB,MAAA,CAAA,CAACC,MAAAA,EAAwBC,KAAAA,KAAAA;AAC7C,EAAA,IAAI,OAAOD,MAAAA,CAAOE,sBAAAA,KAA2B,UAAA,EAAY;AACvD,IAAA,OAAOF,MAAAA,CAAOE,uBAAuBD,KAAAA,CAAAA;AACvC,EAAA;AACA,EAAA,IAAI,OAAOD,MAAAA,CAAOG,QAAAA,KAAa,UAAA,EAAY;AACzC,IAAA,OAAO,IAAIH,MAAAA,CAAOG,QAAAA,CAASF,KAAAA,CAAAA;AAC7B,EAAA;AACA,EAAA,MAAM,IAAIpJ,MAAM,qFAAA,CAAA;AAClB,CAAA,EARsB,eAAA,CAAA;AAgBtB,IAAMuJ,mBAAAA,2BACJC,MAAAA,KAAAA;AAEA,EAAA,IAAIA,OAAOC,0BAAAA,EAA4B;AACrC,IAAA,OAAO;AACLlL,MAAAA,WAAAA,EAAaiL,OAAOC,0BAAAA,CAA2BC,YAAAA;AAC/CC,MAAAA,aAAAA,EAAeH,OAAOC,0BAAAA,CAA2BG,sBAAAA;AACjDC,MAAAA,cAAAA,EAAgBL,OAAOC,0BAAAA,CAA2BK;AACpD,KAAA;AACF,EAAA;AACA,EAAA,OAAO;AACLvL,IAAAA,WAAAA,EAAaiL,OAAOO,iBAAAA,IAAqB,cAAA;IACzCJ,aAAAA,EACEH,MAAAA,CAAOQ,gCAAAA,IAAoCR,MAAAA,CAAOS,2BAAAA,IAA+B,wBAAA;AACnFJ,IAAAA,cAAAA,EAAgBL,OAAOU,oBAAAA,IAAwB;AACjD,GAAA;AACF,CAAA,EAhB4B,qBAAA,CAAA;AAkB5B,IAAMC,mCAAmB,MAAA,CAAA,YAAA;AAOvB,EAAA,MAAMC,OAAAA,GAAU,yBAAA;AAChB,EAAA,MAAMC,QAAAA,GAAW,yCAAA;AACjB,EAAA,MAAMC,OAAAA,GAAU,0BAAA;AAChB,EAAA,MAAMC,OAAAA,GAAU,qCAAA;AAChB,EAAA,MAAMC,OAAAA,GAAW,MAAMvJ,OAAAA,CAAQuE,GAAAA,CAAI;AACjC,IAAA;;AAA0B4E,MAAAA;;AAC1B,IAAA;;AAA0BC,MAAAA;;AAC1B,IAAA;;AAA0BC,MAAAA;;AAC1B,IAAA;;AAA0BC,MAAAA;;AAC3B,GAAA,CAAA;AACD,EAAA,MAAM,CAACE,MAAAA,EAAQC,OAAAA,EAASvB,MAAAA,EAAQK,MAAAA,CAAAA,GAAUgB,OAAAA;AAC1C,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASF,MAAAA,CAAOE,OAAAA;AAChBC,IAAAA,iBAAAA,EAAmBF,OAAAA,CAAQE,iBAAAA;AAC3BzB,IAAAA,MAAAA;AACAK,IAAAA;AACF,GAAA;AACF,CAAA,EAxByB,kBAAA,CAAA;AA0BlB,IAAMqB,cAAAA,iCAAwB3F,GAAAA,KAAAA;AACnC,EAAA,IAAI,CAACA,IAAIxH,OAAAA,EAAS;AAChB2C,IAAAA,MAAAA,CAAOgC,KAAK,4CAAA,CAAA;AACZ,IAAA;AACF,EAAA;AACA,EAAA,IAAI4G,YAAAA,EAAc;AAChB,IAAA;AACF,EAAA;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,EAAE0B,OAAAA,EAASC,iBAAAA,EAAmBzB,QAAQK,MAAAA,EAAM,GAAK,MAAMW,gBAAAA,EAAAA;AAC7D,IAAA,MAAM9N,IAAAA,GAAOkN,oBAAoBC,MAAAA,CAAAA;AAEjC,IAAA,MAAMsB,kBAAAA,GAA6C;MACjD,CAACzO,IAAAA,CAAKkC,WAAW,GAAG2G,GAAAA,CAAI3G,WAAAA;MACxB,CAAClC,IAAAA,CAAKsN,aAAa,GAAGzE,GAAAA,CAAIzG;AAC5B,KAAA;AACA,IAAA,IAAIyG,IAAIxG,OAAAA,EAAS;AACfoM,MAAAA,kBAAAA,CAAmBzO,IAAAA,CAAKwN,cAAc,CAAA,GAAI3E,GAAAA,CAAIxG,OAAAA;AAChD,IAAA;AAEA,IAAA,MAAMqM,GAAAA,GAAM,IAAIJ,OAAAA,CAAQ;MACtBK,QAAAA,EAAU9B,aAAAA,CAAcC,QAAQ2B,kBAAAA,CAAAA;AAChCG,MAAAA,aAAAA,EAAe,IAAIL,iBAAAA,CAAkB;AAAElL,QAAAA,GAAAA,EAAKwF,GAAAA,CAAI1G;OAAS;KAC3D,CAAA;AAEAuM,IAAAA,GAAAA,CAAIG,KAAAA,EAAK;AACTjC,IAAAA,YAAAA,mBAAe,MAAA,CAAA,MAAqB8B,GAAAA,CAAII,QAAAA,EAAQ,EAAjC,cAAA,CAAA;AACf9K,IAAAA,MAAAA,CAAOgC,KAAK,qCAAA,EAAuC;AACjD9D,MAAAA,WAAAA,EAAa2G,GAAAA,CAAI3G,WAAAA;AACjBC,MAAAA,QAAAA,EAAU0G,GAAAA,CAAI1G;KAChB,CAAA;AACF,EAAA,CAAA,CAAA,OAAS0B,GAAAA,EAAK;AACZ,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,uEAAA,EAAoE;AAC9EC,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KACX,CAAA;AACF,EAAA;AACF,CAAA,EAtC8B,gBAAA;AAwCvB,IAAM4K,+BAAe,MAAA,CAAA,YAAA;AAC1B,EAAA,IAAInC,YAAAA,EAAc;AAChB,IAAA,IAAI;AACF,MAAA,MAAMA,YAAAA,EAAAA;AACR,IAAA,CAAA,CAAA,OAAS/I,GAAAA,EAAK;AACZ,MAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,MAAAA,MAAAA,CAAOC,KAAK,wCAAA,EAA0C;AAAEC,QAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;OAAQ,CAAA;AAC3E,IAAA;AACAyI,IAAAA,YAAAA,GAAe,IAAA;AACjB,EAAA;AACF,CAAA,EAV4B,cAAA;AAgBrB,IAAMoC,gBAAAA,iCAA0BnG,GAAAA,KAAAA;AACrC,EAAA,IAAI,CAACA,GAAAA,CAAIxH,OAAAA,EAAS,OAAO,EAAC;AAC1B,EAAA,IAAI;AACF,IAAA,MAAMiC,IAAAA,GAAO,wBAAA;AACb,IAAA,MAAMC,MAAO,MAAM;;AAA0BD,MAAAA;;AAM7C,IAAA,IAAI,OAAOC,GAAAA,CAAI0L,gBAAAA,KAAqB,UAAA,EAAY;AAC9CjL,MAAAA,MAAAA,CAAOC,KAAK,sFAAA,CAAA;AACZ,MAAA,OAAO,EAAC;AACV,IAAA;AACA,IAAA,OAAOV,IAAI0L,gBAAAA,CAAiB;MAC1BC,KAAAA,EAAO;QAAEC,OAAAA,EAAS,IAAA;QAAMC,KAAAA,EAAO,IAAA;QAAMC,QAAAA,EAAU,IAAA;QAAMC,SAAAA,EAAW;AAAK,OAAA;MACrEC,SAAAA,EAAW;KACb,CAAA;AACF,EAAA,CAAA,CAAA,OAAS1L,GAAAA,EAAK;AACZ,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,+EAAA,EAA4E;AACtFC,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KACX,CAAA;AACA,IAAA,OAAO,EAAC;AACV,EAAA;AACF,CAAA,EAzBgC,kBAAA;AChJhC,IAAMqL,oBAAAA,uBAA2BC,GAAAA,CAAI;AAAC,EAAA,OAAA;AAAS,EAAA,OAAA;AAAS,EAAA;AAAW,CAAA,CAAA;AACnE,IAAMC,mBAAAA,GAAsB,GAAA;AAC5B,IAAMC,wBAAAA,GAA2B,CAAA;AACjC,IAAMC,yBAAAA,uBAAgCH,GAAAA,EAAAA;AAmBtC,IAAMI,2BAAW,MAAA,CAAA,CAACrQ,KAAAA,KAAqD,OAAOA,KAAAA,KAAU,QAAA,IAAYA,UAAU,IAAA,EAA7F,UAAA,CAAA;AAEjB,IAAMsQ,eAAAA,2BAAmBC,IAAAA,KAAAA;AACvB,EAAA,IAAIC,OAAAA,GAAUD,IAAAA;AACd,EAAA,OAAOF,SAASG,OAAAA,CAAAA,IAAYA,OAAAA,CAAQ,QAAA,MAAczS,MAAAA,EAAW;AAC3DyS,IAAAA,OAAAA,GAAUA,QAAQ,QAAA,CAAA;AACpB,EAAA;AACA,EAAA,OAAOH,QAAAA,CAASG,OAAAA,CAAAA,GAAWA,OAAAA,GAAU,IAAA;AACvC,CAAA,EANwB,iBAAA,CAAA;AAQxB,IAAMC,aAAAA,mBAAgB,MAAA,CAAA,CAAC5E,MAAAA,KAA6CA,MAAAA,EAA9C,eAAA,CAAA;AAEtB,IAAM6E,oBAAAA,mBAAuB,MAAA,CAAA,CAC3B7E,MAAAA,EACA8E,SAAAA,KAAAA;AAEA,EAAA,MAAMC,UAAAA,GAAaH,cAAc5E,MAAAA,CAAAA;AACjC,EAAA,IAAI8E,UAAUA,SAAAA,KAAc,UAAA,EAAY,OAAOC,UAAAA,CAAWC,mBAAe,IAAQ,IAAA;AACjF,EAAA,IAAIF,UAAUA,SAAAA,KAAc,cAAA,EAAgB,OAAOC,UAAAA,CAAWE,uBAAmB,IAAQ,IAAA;AACzF,EAAA,OAAOF,UAAAA,CAAWG,gBAAY,IAAQ,IAAA;AACxC,CAAA,EAR6B,sBAAA,CAAA;AAU7B,IAAMC,aAAAA,mBAAgB,MAAA,CAAA,CAACnF,MAAAA,EAAuBtE,IAAAA,KAAAA;AAC5C,EAAA,OAAOkJ,aAAAA,CAAc5E,MAAAA,CAAAA,CAAQoF,OAAAA,GAAU1J,IAAAA,CAAAA,IAAS,IAAA;AAClD,CAAA,EAFsB,eAAA,CAAA;AAItB,IAAM2J,QAAAA,mBAAW,MAAA,CAAA,CAACC,UAAAA,EAAkCC,SAAAA,KAAAA;AAClD,EAAA,OAAOD,UAAAA,CAAWE,SAAAA,IAAS,CAAKD,SAAAA,CAAAA;AAClC,CAAA,EAFiB,UAAA,CAAA;AAIjB,IAAME,eAAAA,mBAAkB,MAAA,CAAA,CAACrP,OAAAA,EAAkBkP,UAAAA,EAAkCC,SAAAA,KAAAA;AAC3E,EAAA,IAAI,CAACD,UAAAA,CAAW5J,IAAAA,EAAM,OAAO,CAAA;AAC7B,EAAA,OAAOtF,QAAQ,CAAA,EAAGkP,UAAAA,CAAW5J,IAAI,CAAA,CAAA,EAAI6J,SAAAA,EAAW,CAAA,IAAK,CAAA;AACvD,CAAA,EAHwB,iBAAA,CAAA;AAKxB,IAAMG,mBAAAA,2BAAuBvR,KAAAA,KAAAA;AAC3B,EAAA,IAAIA,MAAMkG,IAAAA,KAASsL,IAAAA,CAAKC,OAAOzR,KAAAA,CAAMkG,IAAAA,KAASsL,KAAKE,KAAAA,EAAO;AACxD,IAAA,MAAMxR,MAAAA,GAASL,MAAAA,CAAOG,KAAAA,CAAMA,KAAK,CAAA;AACjC,IAAA,OAAOH,MAAAA,CAAOO,QAAAA,CAASF,MAAAA,CAAAA,GAAUA,MAAAA,GAASnC,MAAAA;AAC5C,EAAA;AACA,EAAA,IAAIiC,KAAAA,CAAMkG,IAAAA,KAASsL,IAAAA,CAAKG,MAAAA,EAAQ;AAC9B,IAAA,MAAMzR,MAAAA,GAASL,MAAAA,CAAOG,KAAAA,CAAMA,KAAK,CAAA;AACjC,IAAA,OAAOH,MAAAA,CAAOO,QAAAA,CAASF,MAAAA,CAAAA,GAAUA,MAAAA,GAASnC,MAAAA;AAC5C,EAAA;AACA,EAAA,OAAOA,MAAAA;AACT,CAAA,EAV4B,qBAAA,CAAA;AAY5B,IAAM6T,sBAAAA,2BAA0B5E,IAAAA,KAAAA;AAC9B,EAAA,IAAI,CAACA,MAAM,OAAO,CAAA;AAClB,EAAA,KAAA,MAAW6E,OAAO7E,IAAAA,EAAM;AACtB,IAAA,IAAI,CAACgD,oBAAAA,CAAqB8B,GAAAA,CAAID,GAAAA,CAAItK,IAAAA,CAAKvH,KAAK,CAAA,EAAG;AAC/C,IAAA,MAAM+R,GAAAA,GAAMR,mBAAAA,CAAoBM,GAAAA,CAAI7R,KAAK,CAAA;AACzC,IAAA,IAAI,OAAO+R,GAAAA,KAAQ,QAAA,EAAU,OAAO,CAAA;AACpC,IAAA,OAAOxM,IAAAA,CAAKyM,GAAAA,CAAIzM,IAAAA,CAAKC,GAAAA,CAAI,CAAA,EAAGD,KAAK0M,KAAAA,CAAMF,GAAAA,CAAAA,CAAAA,EAAO7B,mBAAAA,CAAAA;AAChD,EAAA;AACA,EAAA,OAAO,CAAA;AACT,CAAA,EAT+B,wBAAA,CAAA;AAW/B,IAAMgC,2CAA2B,MAAA,CAAA,CAC/BrG,MAAAA,EACAsG,WACAhB,UAAAA,EACAiB,SAAAA,EACAnQ,SACAoQ,eAAAA,KAAAA;AAEA,EAAA,MAAMjB,SAAAA,GAAYe,UAAU5K,IAAAA,CAAKvH,KAAAA;AACjC,EAAA,MAAMsS,KAAAA,GAAQpB,QAAAA,CAASC,UAAAA,EAAYC,SAAAA,CAAAA;AACnC,EAAA,MAAMmB,QAAAA,GAAWjB,eAAAA,CAAgBrP,OAAAA,EAASkP,UAAAA,EAAYC,SAAAA,CAAAA;AACtD,EAAA,MAAMoB,cAAAA,GAAiBlC,eAAAA,CAAgBgC,KAAAA,EAAO/B,IAAAA,CAAAA;AAC9C,EAAA,MAAMkC,SAAAA,GACJN,SAAAA,CAAUO,YAAAA,IAAgBF,cAAAA,GACtBG,+BAAAA,CACE9G,MAAAA,EACAsG,SAAAA,CAAUO,YAAAA,EACVF,cAAAA,EACAJ,SAAAA,EACAnQ,OAAAA,EACAoQ,eAAAA,CAAAA,GAEF,CAAA;AACN,EAAA,OAAA,CAAQE,QAAAA,GAAWE,SAAAA,IAAab,sBAAAA,CAAuBO,SAAAA,CAAUS,SAAS,CAAA;AAC5E,CAAA,EAxBiC,0BAAA,CAAA;AA0BjC,IAAMD,kDAAkC,MAAA,CAAA,CACtC9G,MAAAA,EACA6G,cACAvB,UAAAA,EACAiB,SAAAA,EACAnQ,SACAoQ,eAAAA,KAAAA;AAEA,EAAA,IAAIQ,KAAAA,GAAQ,CAAA;AAEZ,EAAA,KAAA,MAAWC,SAAAA,IAAaJ,aAAaK,UAAAA,EAAY;AAC/CF,IAAAA,KAAAA,IAASG,6BAA6BnH,MAAAA,EAAQiH,SAAAA,EAAW3B,UAAAA,EAAYiB,SAAAA,EAAWnQ,SAASoQ,eAAAA,CAAAA;AAC3F,EAAA;AAEA,EAAA,OAAOQ,KAAAA;AACT,CAAA,EAfwC,iCAAA,CAAA;AAiBxC,IAAMG,+CAA+B,MAAA,CAAA,CACnCnH,MAAAA,EACAiH,WACA3B,UAAAA,EACAiB,SAAAA,EACAnQ,SACAoQ,eAAAA,KAAAA;AAEA,EAAA,IAAIS,SAAAA,CAAU5M,IAAAA,KAASsL,IAAAA,CAAKyB,KAAAA,EAAO;AACjC,IAAA,OAAOf,yBAAyBrG,MAAAA,EAAQiH,SAAAA,EAAW3B,UAAAA,EAAYiB,SAAAA,EAAWnQ,SAASoQ,eAAAA,CAAAA;AACrF,EAAA;AAEA,EAAA,IAAIS,SAAAA,CAAU5M,IAAAA,KAASsL,IAAAA,CAAK0B,eAAAA,EAAiB;AAC3C,IAAA,MAAMC,eAAAA,GAAiBL,SAAAA,CAAUM,aAAAA,GAC5BpC,aAAAA,CAAcnF,MAAAA,EAAQiH,UAAUM,aAAAA,CAAc7L,IAAAA,CAAKvH,KAAK,CAAA,IAAKmR,UAAAA,GAC9DA,UAAAA;AACJ,IAAA,OAAOwB,gCACL9G,MAAAA,EACAiH,SAAAA,CAAUJ,cACVS,eAAAA,EACAf,SAAAA,EACAnQ,SACAoQ,eAAAA,CAAAA;AAEJ,EAAA;AAEA,EAAA,MAAMgB,YAAAA,GAAeP,UAAUvL,IAAAA,CAAKvH,KAAAA;AACpC,EAAA,IAAIqS,eAAAA,CAAgBP,GAAAA,CAAIuB,YAAAA,CAAAA,EAAe,OAAO,CAAA;AAC9C,EAAA,MAAMC,QAAAA,GAAWlB,SAAAA,CAAUpP,GAAAA,CAAIqQ,YAAAA,CAAAA;AAC/B,EAAA,IAAI,CAACC,UAAU,OAAO,CAAA;AAEtBjB,EAAAA,eAAAA,CAAgBkB,IAAIF,YAAAA,CAAAA;AACpB,EAAA,MAAMF,iBAAiBnC,aAAAA,CAAcnF,MAAAA,EAAQyH,SAASF,aAAAA,CAAc7L,IAAAA,CAAKvH,KAAK,CAAA,IAAKmR,UAAAA;AACnF,EAAA,MAAMqC,UAAAA,GAAab,gCACjB9G,MAAAA,EACAyH,QAAAA,CAASZ,cACTS,cAAAA,EACAf,SAAAA,EACAnQ,SACAoQ,eAAAA,CAAAA;AAEFA,EAAAA,eAAAA,CAAgBlN,OAAOkO,YAAAA,CAAAA;AACvB,EAAA,OAAOG,UAAAA;AACT,CAAA,EA3CqC,8BAAA,CAAA;AA6CrC,IAAMC,2BAAAA,mBAA8B,MAAA,CAAA,CAClC5H,MAAAA,EACAC,WAAAA,EACA7J,OAAAA,KAAAA;AAEA,EAAA,MAAMmQ,SAAAA,uBAAgBtN,GAAAA,EAAAA;AACtB,EAAA,MAAM4O,aAAwC,EAAA;AAE9C,EAAA,KAAA,MAAWC,UAAAA,IAAc7H,YAAY8H,WAAAA,EAAa;AAChD,IAAA,IAAI,CAACvD,SAASsD,UAAAA,CAAAA,IAAe,OAAOA,UAAAA,CAAW,MAAA,MAAY,QAAA,EAAU;AACrE,IAAA,IAAIA,UAAAA,CAAW,MAAA,CAAA,KAAYnC,IAAAA,CAAKqC,mBAAAA,EAAqB;AACnD,MAAA,MAAMP,QAAAA,GAAWK,UAAAA;AACjBvB,MAAAA,SAAAA,CAAUnP,GAAAA,CAAIqQ,QAAAA,CAAS/L,IAAAA,CAAKvH,KAAAA,EAAOsT,QAAAA,CAAAA;AACrC,IAAA,CAAA,MAAA,IAAWK,UAAAA,CAAW,MAAA,CAAA,KAAYnC,IAAAA,CAAKsC,oBAAAA,EAAsB;AAC3DJ,MAAAA,UAAAA,CAAWzN,KAAK0N,UAAAA,CAAAA;AAClB,IAAA;AACF,EAAA;AAEA,EAAA,IAAII,aAAAA,GAAgB,CAAA;AACpB,EAAA,KAAA,MAAWpD,aAAa+C,UAAAA,EAAY;AAClC,IAAA,MAAMM,QAAAA,GAAWtD,oBAAAA,CAAqB7E,MAAAA,EAAQ8E,SAAAA,CAAAA;AAC9C,IAAA,IAAI,CAACqD,QAAAA,EAAU;AACf,IAAA,MAAMR,UAAAA,GAAab,+BAAAA,CACjB9G,MAAAA,EACA8E,SAAAA,CAAU+B,YAAAA,EACVsB,UACA5B,SAAAA,EACAnQ,OAAAA,kBACA,IAAIgO,GAAAA,EAAAA,CAAAA;AAEN8D,IAAAA,aAAAA,GAAgBxO,IAAAA,CAAKC,GAAAA,CAAIuO,aAAAA,EAAeP,UAAAA,CAAAA;AAC1C,EAAA;AAEA,EAAA,OAAOO,aAAAA;AACT,CAAA,EAlCoC,6BAAA,CAAA;AAoCpC,IAAME,oBAAAA,2BAAwBvP,KAAAA,KAAAA;AAC5B,EAAA,MAAMwP,IAAAA,GAAO9D,yBAAAA,CAA0B0B,GAAAA,CAAIpN,KAAAA,CAAMC,OAAO,CAAA;AACxD,EAAA,IAAI,CAACuP,IAAAA,IAAQ9D,yBAAAA,CAA0B+D,IAAAA,GAAOhE,wBAAAA,EAA0B;AACtEC,IAAAA,yBAAAA,CAA0BmD,GAAAA,CAAI7O,MAAMC,OAAO,CAAA;AAC3CH,IAAAA,MAAAA,CAAOC,KAAK,+DAAA,EAA4D;AACtEC,MAAAA,KAAAA,EAAOA,KAAAA,CAAMC,OAAAA;MACbyP,iBAAAA,EAAmB;KACrB,CAAA;AACA,IAAA;AACF,EAAA;AAEA5P,EAAAA,MAAAA,CAAO6P,MAAM,mEAAA,EAAqE;AAChF3P,IAAAA,KAAAA,EAAOA,KAAAA,CAAMC;GACf,CAAA;AACF,CAAA,EAd6B,sBAAA,CAAA;AAoBtB,IAAM2P,2BAAAA,2BAA+B5H,IAAAA,KAAAA;AAC1C,EAAA,OAAO;AACLlB,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEP,MAAAA,EAAQQ,SAAAA,EAAS,KAAE;AAChC,MAAA,IAAI;AACF,QAAA,MAAM+H,UAAAA,GAAaC,4BAA4BxI,MAAAA,CAAOY,MAAAA,EAAQZ,OAAOa,WAAAA,EAAaY,IAAAA,CAAKE,OAAO3K,OAAO,CAAA;AAErG,QAAA,IAAIuR,UAAAA,GAAa9G,IAAAA,CAAKE,MAAAA,CAAO5K,OAAAA,EAAS;AACpC0F,UAAAA,UAAAA,EAAAA,CAAaT,mBAAmBF,GAAAA,CAAI;YAClCwN,OAAAA,EAAS,SAAA;YACT9S,OAAAA,EAASiL,IAAAA,CAAKE,MAAAA,CAAOnL,OAAAA,GAAU,MAAA,GAAS;WAC1C,CAAA;AACA,UAAA,IAAIiL,IAAAA,CAAKE,OAAOnL,OAAAA,EAAS;AACvB+C,YAAAA,MAAAA,CAAOgC,KAAK,sDAAA,EAAwD;AAClEgN,cAAAA,UAAAA;AACAxR,cAAAA,OAAAA,EAAS0K,KAAKE,MAAAA,CAAO5K;aACvB,CAAA;AACA,YAAA;AACF,UAAA;AACAyJ,UAAAA,SAAAA,CAAU;AACR,YAAA,IAAI7C,aAAa,CAAA,0BAAA,EAA6B4K,UAAAA,YAAsB9G,IAAAA,CAAKE,MAAAA,CAAO5K,OAAO,CAAA,CAAA,CAAA,EAAK;cAC1F8G,UAAAA,EAAY;gBACVC,IAAAA,EAAM,qBAAA;gBACNyL,IAAAA,EAAMhB,UAAAA;AACNxR,gBAAAA,OAAAA,EAAS0K,KAAKE,MAAAA,CAAO5K;AACvB;aACF;AACD,WAAA,CAAA;AACH,QAAA;AACF,MAAA,CAAA,CAAA,OAASqC,GAAAA,EAAK;AACZ,QAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxD4P,QAAAA,oBAAAA,CAAqB3P,CAAAA,CAAAA;AACvB,MAAA;IACF,CAAA,EA9BY,YAAA;AA+Bd,GAAA;AACF,CAAA,EAlC2C,6BAAA;;;AChO3C,IAAMmQ,MAAAA,mBAAS,MAAA,CAAA,CAACC,MAAAA,EAAgB7V,IAAAA,EAAcC,QAAAA,KAA6B,CAAA,GAAA,EAAM4V,MAAAA,CAAAA,CAAAA,EAAU7V,IAAAA,CAAAA,CAAAA,EAAQC,QAAAA,CAAAA,CAAAA,EAApF,QAAA,CAAA;AAEf,IAAM6V,KAAAA,mBAAQ,MAAA,CAAA,MAAc1P,IAAAA,CAAKC,GAAAA,EAAG,EAAtB,OAAA,CAAA;AAQP,IAAM0P,cAAAA,mBAAiB,MAAA,CAAA,OAAOlI,IAAAA,EAA2BmI,KAAAA,KAAAA;AAC9D,EAAA,MAAMhW,IAAAA,GAAO6N,IAAAA,CAAKE,MAAAA,CAAOzK,KAAAA,CAAM0S,MAAMhW,IAAI,CAAA;AACzC,EAAA,MAAM8H,WAAUe,UAAAA,EAAAA;AAChB,EAAA,MAAM6M,OAAAA,GAAU7H,KAAKE,MAAAA,CAAOxK,SAAAA;AAE5B,EAAA,IAAIvD,IAAAA,CAAKS,MAAAA,KAAWO,MAAAA,CAAOC,gBAAAA,EAAkB;AAC3C6G,IAAAA,QAAAA,CAAQzE,UAAU6E,GAAAA,CAAI;AAAEwN,MAAAA,OAAAA;AAAS1V,MAAAA,IAAAA,EAAMgW,KAAAA,CAAMhW,IAAAA;MAAMiW,QAAAA,EAAU;KAAU,CAAA;AACvE,IAAA,OAAO;MAAEC,OAAAA,EAAS,IAAA;AAAMC,MAAAA,SAAAA,EAAWnV,MAAAA,CAAOC,gBAAAA;MAAkBmV,SAAAA,EAAW,CAAA;AAAG7J,MAAAA,KAAAA,EAAOvM,IAAAA,CAAKS;AAAO,KAAA;AAC/F,EAAA;AAEA,EAAA,MAAMyB,GAAAA,GAAM0T,OAAO/H,IAAAA,CAAKE,MAAAA,CAAOxK,WAAWyS,KAAAA,CAAMhW,IAAAA,EAAMgW,MAAM/V,QAAQ,CAAA;AACpE,EAAA,MAAMsM,KAAAA,GAAQvM,IAAAA,CAAKS,MAAAA,GAAST,IAAAA,CAAKW,KAAAA;AAEjC,EAAA,IAAI;AACF,IAAA,MAAM0V,QAAQ,MAAMxI,IAAAA,CAAKyI,MAAAA,CAAO/R,MAAAA,CAAOrC,KAAK,CAAA,CAAA;AAC5C,IAAA,IAAImU,UAAU,CAAA,EAAG;AACf,MAAA,MAAMxI,IAAAA,CAAKyI,MAAAA,CAAO5R,MAAAA,CAAOxC,GAAAA,EAAKlC,KAAKU,QAAQ,CAAA;AAC7C,IAAA;AACA,IAAA,MAAMmE,GAAAA,GAAM,MAAMgJ,IAAAA,CAAKyI,MAAAA,CAAOzR,IAAI3C,GAAAA,CAAAA;AAClC,IAAA,MAAMkU,YAAYN,KAAAA,EAAAA,GAAUpP,KAAKC,GAAAA,CAAI,CAAA,EAAG9B,GAAAA,CAAAA,GAAO,GAAA;AAE/C,IAAA,IAAIwR,QAAQ9J,KAAAA,EAAO;AACjBzE,MAAAA,QAAAA,CAAQzE,UAAU6E,GAAAA,CAAI;AACpBwN,QAAAA,OAAAA;AACA1V,QAAAA,IAAAA,EAAMgW,KAAAA,CAAMhW,IAAAA;QACZiW,QAAAA,EAAUpI,IAAAA,CAAKE,MAAAA,CAAOvK,WAAAA,GAAc,iBAAA,GAAoB;OAC1D,CAAA;AACA,MAAA,OAAO;QAAE0S,OAAAA,EAAS,KAAA;QAAOC,SAAAA,EAAW,CAAA;AAAGC,QAAAA,SAAAA;AAAW7J,QAAAA;AAAM,OAAA;AAC1D,IAAA;AACAzE,IAAAA,QAAAA,CAAQzE,UAAU6E,GAAAA,CAAI;AAAEwN,MAAAA,OAAAA;AAAS1V,MAAAA,IAAAA,EAAMgW,KAAAA,CAAMhW,IAAAA;MAAMiW,QAAAA,EAAU;KAAU,CAAA;AACvE,IAAA,OAAO;MAAEC,OAAAA,EAAS,IAAA;AAAMC,MAAAA,SAAAA,EAAWzP,IAAAA,CAAKC,GAAAA,CAAI,CAAA,EAAG4F,KAAAA,GAAQ8J,KAAAA,CAAAA;AAAQD,MAAAA,SAAAA;AAAW7J,MAAAA;AAAM,KAAA;AAClF,EAAA,CAAA,CAAA,OAAS/G,GAAAA,EAAK;AACZ,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,6DAAA,EAA0D;AACpE1D,MAAAA,GAAAA;AACA2D,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KACX,CAAA;AACAgC,IAAAA,QAAAA,CAAQQ,eAAeJ,GAAAA,CAAI;AAAEwN,MAAAA;KAAQ,CAAA;AACrC,IAAA,IAAI7H,IAAAA,CAAKE,OAAOtK,UAAAA,EAAY;AAC1BqE,MAAAA,QAAAA,CAAQzE,UAAU6E,GAAAA,CAAI;AAAEwN,QAAAA,OAAAA;AAAS1V,QAAAA,IAAAA,EAAMgW,KAAAA,CAAMhW,IAAAA;QAAMiW,QAAAA,EAAU;OAAW,CAAA;AACxE,MAAA,OAAO;QAAEC,OAAAA,EAAS,KAAA;QAAOC,SAAAA,EAAW,CAAA;QAAGC,SAAAA,EAAWN,KAAAA,EAAAA,GAAU9V,IAAAA,CAAKU,QAAAA,GAAW,GAAA;AAAM6L,QAAAA;AAAM,OAAA;AAC1F,IAAA;AACAzE,IAAAA,QAAAA,CAAQzE,UAAU6E,GAAAA,CAAI;AAAEwN,MAAAA,OAAAA;AAAS1V,MAAAA,IAAAA,EAAMgW,KAAAA,CAAMhW,IAAAA;MAAMiW,QAAAA,EAAU;KAAU,CAAA;AACvE,IAAA,OAAO;MAAEC,OAAAA,EAAS,IAAA;MAAMC,SAAAA,EAAW,EAAA;MAAIC,SAAAA,EAAW,CAAA;AAAG7J,MAAAA;AAAM,KAAA;AAC7D,EAAA;AACF,CAAA,EA7C8B,gBAAA;AAkDvB,IAAMgK,qBAAAA,2BAAyB1I,IAAAA,KAAAA;AACpC,EAAA,OAAO;AACL2I,IAAAA,SAAAA,kBAAW,MAAA,CAAA,OAAO,EAAEC,OAAAA,EAASC,QAAAA,EAAUC,aAAW,KAAE;AAClD,MAAA,MAAMX,KAAAA,GAAQxW,aAAa,CAACkJ,IAAAA,KAAS+N,QAAQvW,OAAAA,CAAQiE,GAAAA,CAAIuE,IAAAA,CAAAA,CAAAA;AACzD,MAAA,MAAM9D,MAAAA,GAAS,MAAMmR,cAAAA,CAAelI,IAAAA,EAAMmI,KAAAA,CAAAA;AAIzCS,MAAAA,OAAAA,CAA8FG,iBAAAA,GAC7FhS,MAAAA;AACD6R,MAAAA,OAAAA,CAA8FI,gBAAAA,GAC7Fb,KAAAA;AAEF,MAAA,IAAI,CAACpR,OAAOsR,OAAAA,EAAS;AACnB,QAAA,IAAIrI,IAAAA,CAAKE,OAAOvK,WAAAA,EAAa;AAC3BmC,UAAAA,MAAAA,CAAOgC,KAAK,sDAAA,EAAwD;AAClE3H,YAAAA,IAAAA,EAAMgW,KAAAA,CAAMhW,IAAAA;AACZC,YAAAA,QAAAA,EAAU+V,KAAAA,CAAM/V,QAAAA;AAChBsM,YAAAA,KAAAA,EAAO3H,MAAAA,CAAO2H;WAChB,CAAA;AACA,UAAA;AACF,QAAA;AACA,QAAA,MAAMuK,WAAAA,GAAcpQ,IAAAA,CAAKC,GAAAA,CAAI,CAAA,EAAGD,IAAAA,CAAKE,IAAAA,CAAAA,CAAMhC,MAAAA,CAAOwR,SAAAA,GAAYN,KAAAA,EAAAA,IAAW,GAAA,CAAA,CAAA;AACzE,QAAA,MAAM9M,IAAAA,GAAO+N,KAAKC,SAAAA,CAAU;UAC1BC,MAAAA,EAAQ;AACN,YAAA;cACEnR,OAAAA,EAAS,qBAAA;cACTmE,UAAAA,EAAY;gBACVC,IAAAA,EAAM,cAAA;AACNgN,gBAAAA,OAAAA,EAAS,IAAI9Q,IAAAA,CAAKxB,MAAAA,CAAOwR,SAAS,EAAEe,WAAAA;AACtC;AACF;;SAEJ,CAAA;AACA,QAAA,MAAMC,QAAAA,GAAW,IAAIV,QAAAA,CAASW,QAAAA,CAASrO,IAAAA,EAAM;UAC3C0D,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAAS;YACP,cAAA,EAAgB,kBAAA;AAChB,YAAA,aAAA,EAAewF,OAAOoR,WAAAA,CAAAA;YACtB,mBAAA,EAAqBpR,MAAAA,CAAOd,OAAO2H,KAAK,CAAA;YACxC,uBAAA,EAAyB,GAAA;AACzB,YAAA,mBAAA,EAAqB7G,OAAOgB,IAAAA,CAAK4Q,KAAAA,CAAM1S,MAAAA,CAAOwR,SAAAA,GAAY,GAAA,CAAA;AAC5D;SACF,CAAA;AACAO,QAAAA,WAAAA,CAAYS,QAAAA,CAAAA;AACd,MAAA;IACF,CAAA,EA5CW,WAAA,CAAA;AA6CXG,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEd,OAAAA,EAASW,QAAAA,EAAQ,KAAE;AAChC,MAAA,MAAMI,QAASf,OAAAA,CAA+DG,iBAAAA;AAC9E,MAAA,IAAI,CAACY,KAAAA,EAAO;AACZJ,MAAAA,QAAAA,CAASlX,QAAQkE,GAAAA,CAAI,mBAAA,EAAqBsB,MAAAA,CAAO8R,KAAAA,CAAMjL,KAAK,CAAA,CAAA;AAC5D6K,MAAAA,QAAAA,CAASlX,OAAAA,CAAQkE,GAAAA,CAAI,uBAAA,EAAyBsB,MAAAA,CAAOgB,IAAAA,CAAKC,IAAI,CAAA,EAAG6Q,KAAAA,CAAMrB,SAAS,CAAA,CAAA,CAAA;AAChF,MAAA,IAAIqB,KAAAA,CAAMpB,YAAY,CAAA,EAAG;AACvBgB,QAAAA,QAAAA,CAASlX,OAAAA,CAAQkE,GAAAA,CAAI,mBAAA,EAAqBsB,MAAAA,CAAOgB,IAAAA,CAAK4Q,MAAME,KAAAA,CAAMpB,SAAAA,GAAY,GAAA,CAAA,CAAA,CAAA;AAChF,MAAA;IACF,CAAA,EARY,YAAA;AASd,GAAA;AACF,CAAA,EAzDqC,uBAAA;;;ACzD9B,IAAMqB,oBAAAA,iCAA8BpT,OAAAA,KAAAA;AACzC,EAAA,IAAI,CAACA,QAAQrB,OAAAA,EAAS;AACpB2C,IAAAA,MAAAA,CAAOC,KAAK,2EAAA,EAAwE;AAClF9C,MAAAA,WAAAA,EAAauB,OAAAA,CAAQvB;KACvB,CAAA;AACA,IAAA,OAAO,EAAA;AACT,EAAA;AAIA,EAAA,MAAMyF,iBAAAA,EAAAA;AACN,EAAA,MAAM+N,MAAAA,GAAS,MAAMvP,wBAAAA,CAAyB1C,OAAAA,CAAQvB,WAAW,CAAA;AAEjE,EAAA,MAAMsK,UAAoB,EAAA;AAE1B,EAAA,MAAMsK,UAAAA,GAAa,MAAM/G,gBAAAA,CAAiBtM,OAAAA,CAAQT,IAAI,CAAA;AACtDwJ,EAAAA,OAAAA,CAAQhG,KAAKsQ,UAAAA,CAAAA;AAEb,EAAA,MAAMC,YAAAA,GAAe,MAAM7L,kBAAAA,CAAmBzH,OAAAA,CAAQpB,KAAK,CAAA;AAC3DmK,EAAAA,OAAAA,CAAQhG,IAAAA,CAAI,GAAIuQ,YAAAA,CAAAA;AAEhB,EAAA,IAAItT,OAAAA,CAAQnB,gBAAgBF,OAAAA,EAAS;AACnCoK,IAAAA,OAAAA,CAAQhG,KAAKqO,2BAAAA,CAA4B;AAAE1H,MAAAA,MAAAA,EAAQ1J,OAAAA,CAAQnB;AAAgB,KAAA,CAAA,CAAA;AAC7E,EAAA;AACAkK,EAAAA,OAAAA,CAAQhG,KAAKmP,qBAAAA,CAAsB;AAAED,IAAAA,MAAAA;AAAQvI,IAAAA,MAAAA,EAAQ1J,OAAAA,CAAQhB;AAAU,GAAA,CAAA,CAAA;AACvE+J,EAAAA,OAAAA,CAAQhG,KAAKwG,4BAAAA,CAA6B;AAAEG,IAAAA,MAAAA,EAAQ1J,OAAAA,CAAQX;AAAiB,GAAA,CAAA,CAAA;AAE7EiC,EAAAA,MAAAA,CAAOgC,KAAK,kCAAA,EAAoC;AAC9C7E,IAAAA,WAAAA,EAAauB,OAAAA,CAAQvB,WAAAA;AACrBuT,IAAAA,KAAAA,EAAOjJ,OAAAA,CAAQd,MAAAA;IACf1J,OAAAA,EAAS;AACPK,MAAAA,KAAAA,EAAOoB,QAAQpB,KAAAA,CAAML,OAAAA;AACrB+R,MAAAA,UAAAA,EAAYtQ,QAAQnB,eAAAA,CAAgBN,OAAAA;AACpCS,MAAAA,SAAAA,EAAWgB,QAAQhB,SAAAA,CAAUG;AAC/B,KAAA;IACAR,OAAAA,EAAS;AACP2R,MAAAA,UAAAA,EAAYtQ,QAAQnB,eAAAA,CAAgBF;AACtC;GACF,CAAA;AAEA,EAAA,OAAOoK,OAAAA;AACT,CAAA,EAzCoC,sBAAA","file":"chunk-L2P4CJUR.js","sourcesContent":["/**\n * Gateway Security Module — public API\n *\n * Plug-in stack for public GraphQL federation gateways:\n * graphql-armor, per-field query complexity, per-actor rate limiting,\n * operation-level AbortController, OpenTelemetry spans.\n *\n * Consumed by each public gateway via:\n * ```ts\n * import { buildSecurityPlugins, resolveSecurityOptionsFromEnv } from '@burdenoff/be-sdk/gateway/security';\n *\n * const plugins = await buildSecurityPlugins(\n * resolveSecurityOptionsFromEnv('wspace-public-gateway', { 'Query.customField': 100 })\n * );\n * // pass plugins into createGatewayRuntime({ plugins })\n * ```\n *\n * @module gateway/security\n * @category Gateway\n */\n\nexport { resolveActor } from './actor.js';\nexport { DEFAULT_COST_MAP, mergeCostMap } from './cost-map.js';\nexport { DEFAULT_ARMOR_CONFIG, resolveSecurityOptionsFromEnv } from './defaults.js';\nexport { DEFAULT_TIERS, resolveTiersFromEnv } from './tiers.js';\nexport type {\n ActorContext,\n ArmorConfig,\n CostMap,\n GatewaySecurityOptions,\n OperationTimeoutConfig,\n OtelConfig,\n QueryComplexityConfig,\n RateLimitConfig,\n RateLimitResult,\n SecurityValkeyClient,\n Tier,\n TierLimits,\n} from './types.js';\nexport { __setSecurityValkeyForTest, getSecurityValkey, initializeSecurityValkey, MemoryValkey } from './valkey.js';\nexport { __resetMetricsForTest, getMetrics, initializeMetrics, scrapeMetrics } from './metrics.js';\n\nexport {\n buildSecurityPlugins,\n createArmorPlugins,\n createOperationTimeoutPlugin,\n createOtelPlugin,\n createQueryComplexityPlugin,\n createRateLimitPlugin,\n checkRateLimit,\n initializeOtel,\n shutdownOtel,\n} from './plugins/index.js';\n","/**\n * Actor Resolver\n *\n * Derives an ActorContext from the headers that the gateway's auth middleware\n * already injects (`x-actor-*`, `x-workspace-id`, `x-tenant-id`, `x-org-id`,\n * `x-forwarded-for`). This is the identity used for rate-limit buckets and\n * OTel span enrichment.\n *\n * @module gateway/security/actor\n * @category Gateway\n */\n\nimport type { ActorContext, Tier } from './types.js';\n\ntype HeaderGetter = (name: string) => string | null | undefined;\n\nconst firstIp = (header: string | null | undefined): string | undefined => {\n if (!header) return undefined;\n // x-forwarded-for is a comma-separated list; take the left-most (client).\n return header.split(',')[0]?.trim() || undefined;\n};\n\nconst classify = (actorType: string | undefined, actorRole: string | undefined): Tier => {\n if (actorRole === 'super_admin') return 'super_admin';\n switch (actorType) {\n case 'user':\n return 'user';\n case 'app':\n return 'app';\n case 'service':\n case 'service_account':\n return 'service';\n case 'super_admin':\n return 'super_admin';\n default:\n return 'public';\n }\n};\n\n/**\n * Resolve the canonical ActorContext for a request.\n * Accepts a `HeaderGetter` so it is trivially testable with a plain function.\n */\nexport const resolveActor = (getHeader: HeaderGetter): ActorContext => {\n const actorId = getHeader('x-actor-id') ?? undefined;\n const actorType = getHeader('x-actor-type') ?? undefined;\n const actorRole = getHeader('x-actor-role') ?? undefined;\n const workspaceId = getHeader('x-workspace-id') ?? undefined;\n const tenantId = getHeader('x-tenant-id') ?? undefined;\n const orgId = getHeader('x-org-id') ?? undefined;\n const appId = getHeader('x-app-id') ?? undefined;\n const ip =\n firstIp(getHeader('x-forwarded-for')) || getHeader('x-real-ip') || getHeader('cf-connecting-ip') || undefined;\n\n const tier = classify(actorType, actorRole);\n\n let identity: string;\n switch (tier) {\n case 'super_admin':\n identity = 'bypass';\n break;\n case 'service':\n identity = `svc:${actorId ?? 'unknown'}`;\n break;\n case 'app':\n identity = `${tenantId ?? 'notenant'}:${appId ?? actorId ?? 'unknown'}`;\n break;\n case 'user':\n identity = `${workspaceId ?? 'nows'}:${actorId ?? 'unknown'}`;\n break;\n case 'public':\n default:\n identity = `ip:${ip ?? 'unknown'}`;\n }\n\n return {\n tier,\n identity,\n headers: {\n actorId,\n actorType,\n actorRole,\n workspaceId,\n tenantId,\n orgId,\n appId,\n ip,\n },\n };\n};\n","/**\n * Default query complexity cost map.\n *\n * Key format: \"TypeName.fieldName\". Values are base costs. List fields multiply\n * by the requested page size (up to 100) via the plugin's list-multiplier.\n *\n * Seeded from known high-cost queries across the Burdenoff federation:\n * search, analytics, reports, enumerations, introspection.\n *\n * Extend via `mergeCostMap(DEFAULT_COST_MAP, override)` in each gateway.\n *\n * @module gateway/security/cost-map\n * @category Gateway\n */\n\nimport type { CostMap } from './types.js';\n\nexport const DEFAULT_COST_MAP: CostMap = {\n // Cross-subgraph search — fanout\n 'Query.searchBigConsole': 200,\n 'Query.searchWorkspaces': 100,\n 'Query.searchTags': 80,\n\n // Aggregations\n 'Query.analyticsReport': 300,\n 'Query.usageReport': 250,\n 'Query.billingReport': 250,\n 'Query.auditLog': 150,\n\n // Enumeration risk (paginated lists)\n 'Query.listUsers': 50,\n 'Query.listWorkspaces': 50,\n 'Query.listFiles': 40,\n 'Query.listTags': 20,\n 'Query.listApps': 40,\n\n // Nested lists\n 'Workspace.members': 5,\n 'User.workspaces': 10,\n 'User.apps': 5,\n 'Tag.appliedTo': 5,\n\n // Introspection — expensive and abuse-prone in prod\n 'Query.__schema': 1000,\n 'Query.__type': 500,\n\n // Heavy writers\n 'Mutation.bulkImport': 500,\n 'Mutation.webhookTrigger': 100,\n};\n\nexport const mergeCostMap = (base: CostMap, override: CostMap): CostMap => ({\n ...base,\n ...override,\n});\n","/**\n * Default rate-limit tiers for public gateways.\n *\n * These defaults target a single pod; cross-pod fairness is provided by the\n * Valkey-backed counter. Tune via `GATEWAY_RATE_LIMIT_*` env vars.\n *\n * @module gateway/security/tiers\n * @category Gateway\n */\n\nimport type { Tier, TierLimits } from './types.js';\n\nexport const DEFAULT_TIERS: Record<Tier, TierLimits> = {\n // Public (anonymous) traffic is keyed per-IP. The previous 60+20=80/60s\n // ceiling (1.33 req/s sustained) was tight enough that a single heavy\n // frontend page load (≈15–30 GraphQL queries) plus a NAT-shared second\n // user could blow the bucket on benign traffic. Bumping to 120+60=180/60s\n // (3 req/s sustained) gives 2× headroom while staying ~40× below the\n // ~130 req/s single-pod compute floor measured under realistic load.\n public: {\n points: 120,\n duration: 60,\n burst: 60,\n },\n user: {\n points: 600,\n duration: 60,\n burst: 120,\n },\n app: {\n points: 3000,\n duration: 60,\n burst: 500,\n },\n service: {\n points: 6000,\n duration: 60,\n burst: 1000,\n },\n super_admin: {\n points: Number.MAX_SAFE_INTEGER,\n duration: 60,\n burst: Number.MAX_SAFE_INTEGER,\n },\n};\n\nconst positiveInt = (value: string | undefined, fallback: number): number => {\n if (!value) return fallback;\n const parsed = parseInt(value, 10);\n return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n};\n\n/**\n * Read tier overrides from env.\n *\n * Env var pattern: `GATEWAY_RL_{TIER}_{POINTS|DURATION|BURST}`\n * Example: `GATEWAY_RL_USER_POINTS=1200`\n */\nexport const resolveTiersFromEnv = (base: Record<Tier, TierLimits> = DEFAULT_TIERS): Record<Tier, TierLimits> => {\n const out: Record<Tier, TierLimits> = { ...base };\n (Object.keys(base) as Tier[]).forEach((tier) => {\n const upper = tier.toUpperCase();\n out[tier] = {\n points: positiveInt(process.env[`GATEWAY_RL_${upper}_POINTS`], base[tier].points),\n duration: positiveInt(process.env[`GATEWAY_RL_${upper}_DURATION`], base[tier].duration),\n burst: positiveInt(process.env[`GATEWAY_RL_${upper}_BURST`], base[tier].burst),\n };\n });\n return out;\n};\n","/**\n * Gateway Security Defaults\n *\n * Production-safe defaults for the security plugin stack, and helpers to\n * assemble `GatewaySecurityOptions` from environment variables. Each field\n * honors an `*_OBSERVE*` flag so the hardening pass can soft-launch\n * observe-only before flipping to enforce.\n *\n * @module gateway/security/defaults\n * @category Gateway\n */\n\nimport { DEFAULT_COST_MAP, mergeCostMap } from './cost-map.js';\nimport { resolveTiersFromEnv } from './tiers.js';\nimport type { ArmorConfig, CostMap, GatewaySecurityOptions } from './types.js';\n\nconst boolEnv = (key: string, fallback: boolean): boolean => {\n const v = process.env[key];\n if (v === undefined) return fallback;\n return v === 'true' || v === '1';\n};\n\nconst intEnv = (key: string, fallback: number): number => {\n const v = process.env[key];\n if (!v) return fallback;\n const parsed = parseInt(v, 10);\n return Number.isFinite(parsed) ? parsed : fallback;\n};\n\nconst strEnv = (key: string, fallback: string): string => process.env[key] ?? fallback;\n\n/**\n * Default armor thresholds for public gateways.\n */\nexport const DEFAULT_ARMOR_CONFIG: ArmorConfig = {\n maxAliases: 15,\n maxTokens: 1000,\n maxDirectives: 50,\n characterLimit: 15000,\n costLimit: 5000,\n observe: true,\n};\n\n/**\n * Build `GatewaySecurityOptions` by reading env vars.\n *\n * All defaults are production-safe but begin in observe-only mode so the\n * first deploy does not reject any traffic. Flip observe flags to `false`\n * after the 48h bake.\n */\nexport const resolveSecurityOptionsFromEnv = (\n gatewayName: string,\n costMapOverride?: CostMap\n): GatewaySecurityOptions => {\n return {\n gatewayName,\n enabled: boolEnv('SECURITY_PLUGINS_ENABLED', true),\n armor: {\n maxAliases: intEnv('ARMOR_MAX_ALIASES', DEFAULT_ARMOR_CONFIG.maxAliases),\n maxTokens: intEnv('ARMOR_MAX_TOKENS', DEFAULT_ARMOR_CONFIG.maxTokens),\n maxDirectives: intEnv('ARMOR_MAX_DIRECTIVES', DEFAULT_ARMOR_CONFIG.maxDirectives),\n characterLimit: intEnv('ARMOR_CHARACTER_LIMIT', DEFAULT_ARMOR_CONFIG.characterLimit),\n costLimit: intEnv('ARMOR_COST_LIMIT', DEFAULT_ARMOR_CONFIG.costLimit),\n observe: boolEnv('ARMOR_OBSERVE', true),\n },\n queryComplexity: {\n enabled: boolEnv('QUERY_COMPLEXITY_ENABLED', true),\n maxCost: intEnv('QUERY_COMPLEXITY_MAX', 2000),\n costMap: costMapOverride ? mergeCostMap(DEFAULT_COST_MAP, costMapOverride) : DEFAULT_COST_MAP,\n observe: boolEnv('QUERY_COMPLEXITY_OBSERVE', true),\n },\n rateLimit: {\n tiers: resolveTiersFromEnv(),\n keyPrefix: strEnv('VALKEY_KEY_PREFIX', gatewayName),\n observeOnly: boolEnv('RATE_LIMIT_OBSERVE_ONLY', true),\n failClosed: boolEnv('RATE_LIMIT_FAIL_CLOSED', false),\n },\n operationTimeout: {\n // Default 15s — shorter than the 30s request-limiter queueTimeout, and\n // aligned with typical client-side timeouts so load-shedding fires at\n // the same edge a saturated client would already give up. Mutations\n // that legitimately take longer can override per-deployment via the\n // OPERATION_TIMEOUT_MS env var.\n timeoutMs: intEnv('OPERATION_TIMEOUT_MS', 15000),\n },\n otel: {\n enabled: boolEnv('OTEL_ENABLED', true),\n serviceName: strEnv('OTEL_SERVICE_NAME', gatewayName),\n endpoint: strEnv('OTEL_EXPORTER_OTLP_ENDPOINT', 'https://tempo.tooling.internal.burdenoff.com:4318/v1/traces'),\n environment: strEnv('NODE_ENV', 'development'),\n version: process.env['APP_VERSION'],\n },\n };\n};\n","/**\n * Valkey Client Bootstrap for Gateway Security\n *\n * Wraps the SDK's existing getValkeyClient() (@valkey/valkey-glide) to expose a\n * minimal, stable surface for the rate-limit plugin. Falls back to an\n * in-memory stub so unit tests and local dev without Valkey do not error.\n *\n * @module gateway/security/valkey\n * @category Gateway\n */\n\nimport { logger } from '../../logger/index.js';\nimport type { SecurityValkeyClient } from './types.js';\n\n/**\n * `ioredis` adapter. Used when `VALKEY_CLIENT=ioredis` or as the Bun-compat\n * fallback when `@valkey/valkey-glide` throws at runtime (known issue:\n * `util.Buffer.byteLength` under Bun 1.3.x).\n */\ntype IoRedisInstance = {\n get(key: string): Promise<string | null>;\n set(key: string, value: string, mode?: string, duration?: number): Promise<string | null>;\n incrby(key: string, amount: number): Promise<number>;\n expire(key: string, seconds: number): Promise<number>;\n ttl(key: string): Promise<number>;\n ping(): Promise<string>;\n quit(): Promise<string>;\n on(event: string, listener: (...args: unknown[]) => void): void;\n};\n\nclass IoRedisAdapter implements SecurityValkeyClient {\n constructor(private readonly client: IoRedisInstance) {}\n\n get(key: string): Promise<string | null> {\n return this.client.get(key);\n }\n\n set(key: string, value: string, options?: { EX?: number }): Promise<string | null> {\n if (options?.EX) {\n return this.client.set(key, value, 'EX', options.EX);\n }\n return this.client.set(key, value);\n }\n\n incrBy(key: string, amount: number): Promise<number> {\n return this.client.incrby(key, amount);\n }\n\n async expire(key: string, seconds: number): Promise<boolean> {\n const result = await this.client.expire(key, seconds);\n return result === 1;\n }\n\n ttl(key: string): Promise<number> {\n return this.client.ttl(key);\n }\n\n ping(): Promise<string> {\n return this.client.ping();\n }\n}\n\nconst buildIoRedisClient = async (url: string): Promise<SecurityValkeyClient> => {\n const spec = 'ioredis';\n const mod = (await import(/* @vite-ignore */ spec)) as unknown as {\n default?: new (url: string) => IoRedisInstance;\n Redis?: new (url: string) => IoRedisInstance;\n };\n const Ctor = mod.default ?? mod.Redis;\n if (!Ctor) {\n throw new Error('ioredis module has no Redis constructor');\n }\n const client = new Ctor(url);\n client.on('error', (err) => {\n const e = err instanceof Error ? err : new Error(String(err));\n logger.warn('[gateway-security] ioredis error event', { error: e.message });\n });\n return new IoRedisAdapter(client);\n};\n\ntype MemoryEntry = {\n value: string;\n expiresAt: number;\n};\n\n/**\n * Tiny in-memory fallback. Not cross-pod safe; used only when Valkey is\n * absent (e.g., unit tests, local dev without `docker compose up`).\n */\nclass MemoryValkey implements SecurityValkeyClient {\n private store = new Map<string, MemoryEntry>();\n\n private prune(key: string): MemoryEntry | undefined {\n const e = this.store.get(key);\n if (!e) return undefined;\n if (e.expiresAt > 0 && e.expiresAt <= Date.now()) {\n this.store.delete(key);\n return undefined;\n }\n return e;\n }\n\n get(key: string): Promise<string | null> {\n const e = this.prune(key);\n return Promise.resolve(e?.value ?? null);\n }\n\n set(key: string, value: string, options?: { EX?: number }): Promise<string | null> {\n this.store.set(key, {\n value,\n expiresAt: options?.EX ? Date.now() + options.EX * 1000 : 0,\n });\n return Promise.resolve('OK');\n }\n\n incrBy(key: string, amount: number): Promise<number> {\n const e = this.prune(key);\n const next = (e ? parseInt(e.value, 10) || 0 : 0) + amount;\n this.store.set(key, { value: String(next), expiresAt: e?.expiresAt ?? 0 });\n return Promise.resolve(next);\n }\n\n expire(key: string, seconds: number): Promise<boolean> {\n const e = this.store.get(key);\n if (!e) return Promise.resolve(false);\n e.expiresAt = Date.now() + seconds * 1000;\n return Promise.resolve(true);\n }\n\n ttl(key: string): Promise<number> {\n const e = this.prune(key);\n if (!e) return Promise.resolve(-2);\n if (e.expiresAt === 0) return Promise.resolve(-1);\n return Promise.resolve(Math.max(0, Math.ceil((e.expiresAt - Date.now()) / 1000)));\n }\n\n ping(): Promise<string> {\n return Promise.resolve('PONG');\n }\n}\n\nlet singleton: SecurityValkeyClient | null = null;\nlet bootPromise: Promise<SecurityValkeyClient> | null = null;\n\n/**\n * Initialize the Valkey client for the gateway. Reads `VALKEY_URL` (or\n * `REDIS_URL`) + `VALKEY_PASSWORD` from env. On failure: if `VALKEY_REQUIRED`\n * is set to `\"true\"`, throws; otherwise logs a warning and returns the memory\n * fallback so the gateway still boots.\n *\n * Safe to call multiple times — the result is memoized.\n */\nexport const initializeSecurityValkey = async (gatewayName: string): Promise<SecurityValkeyClient> => {\n if (singleton) return singleton;\n if (bootPromise) return bootPromise;\n\n bootPromise = (async (): Promise<SecurityValkeyClient> => {\n const url = process.env['VALKEY_URL'] || process.env['REDIS_URL'];\n const required = process.env['VALKEY_REQUIRED'] === 'true';\n const clientKind = process.env['VALKEY_CLIENT'] ?? 'ioredis';\n\n if (!url) {\n const msg = '[gateway-security] VALKEY_URL not set';\n if (required) throw new Error(`${msg} and VALKEY_REQUIRED=true`);\n logger.warn(`${msg} — using in-memory fallback (not cross-pod safe)`, {\n gatewayName,\n });\n singleton = new MemoryValkey();\n return singleton;\n }\n\n const attempts: Array<{\n kind: string;\n factory: () => Promise<SecurityValkeyClient>;\n }> = [];\n\n if (clientKind === 'ioredis') {\n attempts.push({ kind: 'ioredis', factory: () => buildIoRedisClient(url) });\n attempts.push({\n kind: 'glide (fallback)',\n factory: async () => {\n const { getValkeyClient } = await import('../../cache/index.js');\n return getValkeyClient();\n },\n });\n } else {\n attempts.push({\n kind: 'glide',\n factory: async () => {\n const { getValkeyClient } = await import('../../cache/index.js');\n return getValkeyClient();\n },\n });\n attempts.push({ kind: 'ioredis (fallback)', factory: () => buildIoRedisClient(url) });\n }\n\n let lastError: Error | null = null;\n for (const attempt of attempts) {\n try {\n const client = await attempt.factory();\n const pong = await client.ping();\n if (pong !== 'PONG') {\n throw new Error(`ping returned ${pong}`);\n }\n logger.info('[gateway-security] Valkey connected', {\n gatewayName,\n url,\n client: attempt.kind,\n });\n singleton = client;\n return client;\n } catch (err) {\n lastError = err instanceof Error ? err : new Error(String(err));\n logger.warn('[gateway-security] Valkey client init failed, will try next', {\n gatewayName,\n client: attempt.kind,\n error: lastError.message,\n });\n }\n }\n\n if (required) {\n logger.error('[gateway-security] Valkey connection failed and required=true', {\n gatewayName,\n error: lastError?.message ?? 'all attempts failed',\n });\n throw lastError ?? new Error('Valkey connection failed');\n }\n logger.warn('[gateway-security] All Valkey clients failed — using in-memory fallback', {\n gatewayName,\n error: lastError?.message ?? 'unknown',\n });\n singleton = new MemoryValkey();\n return singleton;\n })();\n\n return bootPromise;\n};\n\n/**\n * Return the initialized client. Throws if `initializeSecurityValkey` was not\n * called first — keeps the plugin wiring explicit.\n */\nexport const getSecurityValkey = (): SecurityValkeyClient => {\n if (!singleton) {\n throw new Error('[gateway-security] Valkey not initialized — call initializeSecurityValkey() first');\n }\n return singleton;\n};\n\n/**\n * Test-only seam. Replaces the singleton with a stub.\n * Do NOT use in production code.\n */\nexport const __setSecurityValkeyForTest = (client: SecurityValkeyClient | null): void => {\n singleton = client;\n bootPromise = client ? Promise.resolve(client) : null;\n};\n\nexport { MemoryValkey };\n","/**\n * Prometheus Metrics for Gateway Security Plugins\n *\n * Thin wrapper over `prom-client` — optional peer dep. When prom-client is\n * not installed or `PROMETHEUS_METRICS_ENABLED !== 'true'`, every emit is a\n * no-op so the SDK remains consumable without pulling the dependency.\n *\n * Metrics:\n * - `gateway_security_rate_limit_total{gateway,tier,decision}`\n * decision ∈ allowed | rejected | observed_reject\n * - `gateway_security_complexity_rejected_total{gateway,observe}`\n * - `gateway_security_armor_rejected_total{gateway,rule}` (reserved —\n * wiring depends on armor plugin emitting hooks)\n * - `gateway_security_valkey_failover_total{gateway}`\n * - `gateway_security_operation_timeout_total{gateway}`\n *\n * Labels:\n * - `gateway` — gateway name (wspace-public-gateway | global-public-gateway)\n * - `tier` — public | user | app | service | super_admin\n * - `decision` — allowed | rejected | observed_reject\n * - `observe` — 'true' | 'false'\n * - `rule` — armor rule ref (max_aliases, max_tokens, …)\n *\n * All metrics are global singletons across plugin instances. Safe to call\n * `initializeMetrics()` multiple times; subsequent calls are no-ops.\n *\n * @module gateway/security/metrics\n * @category Gateway\n */\n\nimport { logger } from '../../logger/index.js';\n\n// Lightweight type shims for prom-client — keeps this file usable without\n// the peer dep installed.\ntype CounterLike = {\n inc(labels?: Record<string, string>, value?: number): void;\n};\n\ntype CounterCtor = new (opts: { name: string; help: string; labelNames?: string[] }) => CounterLike;\n\ntype PromClientModule = {\n Counter?: CounterCtor;\n register?: { metrics(): Promise<string>; contentType: string };\n};\n\ninterface Metrics {\n rateLimit: CounterLike;\n complexityRejected: CounterLike;\n armorRejected: CounterLike;\n valkeyFailover: CounterLike;\n operationTimeout: CounterLike;\n}\n\nlet metrics: Metrics | null = null;\nlet initializing = false;\nlet promMod: PromClientModule | null = null;\n\nconst noopCounter: CounterLike = {\n inc: () => undefined,\n};\n\nconst noopMetrics: Metrics = {\n rateLimit: noopCounter,\n complexityRejected: noopCounter,\n armorRejected: noopCounter,\n valkeyFailover: noopCounter,\n operationTimeout: noopCounter,\n};\n\n/**\n * Initialize the metrics registry. Safe to call multiple times.\n * Returns a no-op metrics object if prom-client is unavailable.\n */\nexport const initializeMetrics = async (): Promise<Metrics> => {\n if (metrics) return metrics;\n if (initializing) {\n // Another caller is mid-init; return noop to avoid races.\n return noopMetrics;\n }\n if (process.env['PROMETHEUS_METRICS_ENABLED'] !== 'true') {\n logger.info('[gateway-security] Prometheus metrics disabled (PROMETHEUS_METRICS_ENABLED!=true)');\n metrics = noopMetrics;\n return metrics;\n }\n\n initializing = true;\n try {\n const spec = 'prom-client';\n const imported = (await import(/* @vite-ignore */ spec)) as unknown as PromClientModule;\n promMod = imported;\n if (typeof imported.Counter !== 'function') {\n logger.warn('[gateway-security] prom-client has unexpected shape — metrics disabled');\n metrics = noopMetrics;\n return metrics;\n }\n\n const { Counter } = imported;\n metrics = {\n rateLimit: new Counter({\n name: 'gateway_security_rate_limit_total',\n help: 'Rate-limit plugin decisions by tier + gateway',\n labelNames: ['gateway', 'tier', 'decision'],\n }),\n complexityRejected: new Counter({\n name: 'gateway_security_complexity_rejected_total',\n help: 'Query complexity plugin rejections',\n labelNames: ['gateway', 'observe'],\n }),\n armorRejected: new Counter({\n name: 'gateway_security_armor_rejected_total',\n help: 'graphql-armor rule rejections',\n labelNames: ['gateway', 'rule', 'mode'],\n }),\n valkeyFailover: new Counter({\n name: 'gateway_security_valkey_failover_total',\n help: 'Rate-limit plugin fail-open events due to Valkey unreachable',\n labelNames: ['gateway'],\n }),\n operationTimeout: new Counter({\n name: 'gateway_security_operation_timeout_total',\n help: 'Operation timeout plugin aborts',\n labelNames: ['gateway'],\n }),\n };\n logger.info('[gateway-security] Prometheus metrics initialized');\n return metrics;\n } catch (err) {\n const e = err instanceof Error ? err : new Error(String(err));\n logger.warn('[gateway-security] prom-client not installed — metrics disabled', {\n error: e.message,\n });\n metrics = noopMetrics;\n return metrics;\n } finally {\n initializing = false;\n }\n};\n\n/**\n * Get the current metrics handle. Returns a noop object if\n * `initializeMetrics()` has not been called or prom-client is unavailable.\n * Always safe to call.\n */\nexport const getMetrics = (): Metrics => metrics ?? noopMetrics;\n\n/**\n * Return the Prometheus registry's default `/metrics` output. Returns\n * `null` if prom-client is not installed.\n */\nexport const scrapeMetrics = async (): Promise<{ body: string; contentType: string } | null> => {\n if (!promMod?.register) return null;\n const body = await promMod.register.metrics();\n return { body, contentType: promMod.register.contentType };\n};\n\n/**\n * Test-only reset. Drops the initialized counters. Do NOT use in production.\n */\nexport const __resetMetricsForTest = (): void => {\n metrics = null;\n initializing = false;\n promMod = null;\n};\n","/**\n * GraphQL Armor Plugin Bundle\n *\n * Wraps the `@escape.tech/graphql-armor-*` validation rules into a single\n * Envelop plugin that runs them inside `onValidate` and sets rejection via\n * `setResult(errors)` — the same pattern that `query-complexity` uses and\n * that Hive Gateway Runtime is confirmed to honor.\n *\n * Why not just use each armor package's own `plugin` factory (which wraps\n * the rule via `addValidationRule`)? Because Hive Gateway Runtime's plugin\n * system does not honor the `addValidationRule` registration path during\n * query validation — rules registered that way are silently dropped. Nor\n * does Hive honor `afterValidate` hooks returned from `onValidate`, which\n * was the first workaround we tried. Only `setResult(errors)` called\n * synchronously inside `onValidate` actually propagates to the client.\n *\n * Rule coverage:\n * - max-aliases (graphql-armor rule)\n * - max-directives (graphql-armor rule)\n * - cost-limit (graphql-armor rule; heuristic pre-pass)\n * - character-limit (implemented inline via `onParse.source.length`\n * because the armor package hooks `onParams` which\n * is not exposed by Envelop — equivalent protection)\n * - block-field-suggestions (still uses the armor plugin — hooks onValidate\n * via `setResult`, which does work)\n * - max-tokens (covered by query-complexity, not re-implemented;\n * token blowup shows up as high cost)\n *\n * In observe mode, rule errors are logged but not attached to the final\n * result — the query proceeds as if nothing happened.\n *\n * @module gateway/security/plugins/armor\n * @category Gateway\n */\n\nimport { GraphQLError, validate as graphqlValidate, type ValidationContext, type ValidationRule } from 'graphql';\nimport type { Plugin } from 'graphql-yoga';\n\nimport { logger } from '../../../logger/index.js';\nimport { getMetrics } from '../metrics.js';\nimport type { ArmorConfig } from '../types.js';\n\ntype RuleFactory = (options: Record<string, unknown>) => ValidationRule;\n\ntype ArmorModule = Record<string, unknown>;\n\nconst tryImport = async (specifier: string): Promise<ArmorModule | null> => {\n try {\n return (await import(specifier)) as ArmorModule;\n } catch (err) {\n const e = err instanceof Error ? err : new Error(String(err));\n logger.warn('[gateway-security] armor package not installed — rule skipped', {\n specifier,\n error: e.message,\n });\n return null;\n }\n};\n\nconst pickFactory = (mod: ArmorModule | null, candidates: string[]): RuleFactory | null => {\n if (!mod) return null;\n for (const name of candidates) {\n const fn = mod[name];\n if (typeof fn === 'function') return fn as RuleFactory;\n }\n return null;\n};\n\nconst createMaxAliasesRule = (maxAliases: number): ValidationRule => {\n return (context: ValidationContext) => {\n let aliases = 0;\n\n return {\n Field(node) {\n if (!node.alias) return;\n aliases += 1;\n if (aliases > maxAliases) {\n context.reportError(\n new GraphQLError('Too many field aliases.', {\n nodes: node,\n extensions: { code: 'ARMOR_MAX_ALIASES' },\n })\n );\n }\n },\n };\n };\n};\n\nconst createMaxDirectivesRule = (maxDirectives: number): ValidationRule => {\n return (context: ValidationContext) => {\n let directives = 0;\n\n return {\n Directive(node) {\n directives += 1;\n if (directives > maxDirectives) {\n context.reportError(\n new GraphQLError('Too many directives.', {\n nodes: node,\n extensions: { code: 'ARMOR_MAX_DIRECTIVES' },\n })\n );\n }\n },\n };\n };\n};\n\ninterface LoadedRules {\n maxAliasesRule?: ValidationRule;\n maxDirectivesRule?: ValidationRule;\n costLimitRule?: ValidationRule;\n blockSuggestionsPlugin?: Plugin;\n}\n\n/**\n * When `ARMOR_LEAN=true` (default: false), the gateway loads only the cost-limit\n * rule and skips `max-aliases`, `max-directives`, and `block-field-suggestions`.\n *\n * Rationale: each `@escape.tech/graphql-armor-*` rule runs its own\n * `graphqlValidate(document, [rule])` — a full AST traversal per request. On\n * busy public gateways this shows up as a measurable fraction of total CPU.\n * The cost-limit rule already covers the DoS surface (it rejects expensive\n * aliased-or-deeply-nested queries via the heuristic cost function), and\n * character-limit is handled inline in `onParse`, so the other three rules\n * are refinements rather than load-bearing defences.\n *\n * Opt-in via env so existing services see no behavior change.\n */\nconst isLean = (): boolean => {\n const v = process.env['ARMOR_LEAN'];\n return v === 'true' || v === '1';\n};\n\nconst loadRules = async (cfg: ArmorConfig): Promise<LoadedRules> => {\n const lean = isLean();\n\n const [aliasesMod, directivesMod, costMod, blockSuggestionsMod] = await Promise.all([\n lean ? Promise.resolve(null) : tryImport('@escape.tech/graphql-armor-max-aliases'),\n lean ? Promise.resolve(null) : tryImport('@escape.tech/graphql-armor-max-directives'),\n tryImport('@escape.tech/graphql-armor-cost-limit'),\n lean ? Promise.resolve(null) : tryImport('@escape.tech/graphql-armor-block-field-suggestions'),\n ]);\n\n const loaded: LoadedRules = {};\n\n const maxAliasesFactory = pickFactory(aliasesMod, ['maxAliasesRule']);\n loaded.maxAliasesRule = maxAliasesFactory\n ? maxAliasesFactory({ n: cfg.maxAliases, exposeLimits: cfg.observe })\n : createMaxAliasesRule(cfg.maxAliases);\n\n const maxDirectivesFactory = pickFactory(directivesMod, ['maxDirectivesRule']);\n loaded.maxDirectivesRule = maxDirectivesFactory\n ? maxDirectivesFactory({\n n: cfg.maxDirectives,\n exposeLimits: cfg.observe,\n })\n : createMaxDirectivesRule(cfg.maxDirectives);\n\n const costLimitFactory = pickFactory(costMod, ['costLimitRule']);\n if (costLimitFactory) {\n loaded.costLimitRule = costLimitFactory({\n maxCost: cfg.costLimit,\n objectCost: 2,\n scalarCost: 1,\n depthCostFactor: 1.5,\n ignoreIntrospection: true,\n exposeLimits: cfg.observe,\n });\n }\n\n const blockSuggestionsFactory = pickFactory(blockSuggestionsMod, ['blockFieldSuggestionsPlugin', 'default']);\n if (blockSuggestionsFactory) {\n loaded.blockSuggestionsPlugin = blockSuggestionsFactory({}) as unknown as Plugin;\n }\n\n if (lean) {\n logger.info('[gateway-security] ARMOR_LEAN enabled — running only cost-limit + character-limit', {});\n }\n\n return loaded;\n};\n\n/**\n * Build the Envelop/Yoga plugin list for graphql-armor. Returns the\n * block-field-suggestions plugin (armor's own — this one actually works via\n * `setResult`) plus a custom `onValidate` plugin that runs the rule-based\n * armor checks (max-aliases, max-directives, cost-limit) manually inside\n * `AfterValidate.setResult`.\n *\n * The custom plugin also handles character-limit inline via `onParse`.\n */\nexport const createArmorPlugins = async (cfg: ArmorConfig): Promise<Plugin[]> => {\n const rules = await loadRules(cfg);\n\n const metrics = getMetrics();\n\n // Collect the ValidationRule array once per plugin creation. Envelop's\n // `validateFn` takes an array of rules, but we're bypassing that path and\n // running the rules ourselves inside the afterValidate hook. Each rule is\n // a factory returning a visitor, so this reuse is safe.\n const enabledRules: Array<{ name: string; rule: ValidationRule }> = [];\n if (rules.maxAliasesRule) {\n enabledRules.push({ name: 'max-aliases', rule: rules.maxAliasesRule });\n }\n if (rules.maxDirectivesRule) {\n enabledRules.push({ name: 'max-directives', rule: rules.maxDirectivesRule });\n }\n if (rules.costLimitRule) {\n enabledRules.push({ name: 'cost-limit', rule: rules.costLimitRule });\n }\n\n const armorValidationPlugin: Plugin = {\n onParse({ params }) {\n // Character limit — rejects oversized raw queries before parse even\n // starts. Doing it here is equivalent to graphql-armor-character-limit\n // hooking `onParams`, which is not exposed by Envelop.\n const source = typeof params.source === 'string' ? params.source : params.source?.body;\n if (typeof source === 'string' && source.length > cfg.characterLimit) {\n if (cfg.observe) {\n logger.warn('[gateway-security] armor character-limit exceeded (observe)', {\n length: source.length,\n limit: cfg.characterLimit,\n });\n metrics.armorRejected.inc({ rule: 'character-limit', mode: 'observe' }, 1);\n return;\n }\n metrics.armorRejected.inc({ rule: 'character-limit', mode: 'enforce' }, 1);\n throw new GraphQLError('Syntax Error: Query exceeds maximum character limit.', {\n extensions: {\n code: 'CHARACTER_LIMIT_EXCEEDED',\n http: { status: 400 },\n },\n });\n }\n },\n onValidate({ params, setResult }) {\n if (enabledRules.length === 0) return;\n // Run armor rules manually inside `onValidate`. We initially tried\n // returning an `afterValidate` hook here, but Hive Gateway Runtime\n // silently drops those callbacks — the same class of bug that causes\n // `addValidationRule` not to fire. Doing the work in the synchronous\n // body of `onValidate` + calling `setResult` directly is the pattern\n // that query-complexity uses and it is confirmed to work end-to-end\n // against Hive Gateway.\n //\n // IMPORTANT: graphql-armor rules throw `GraphQLError` synchronously\n // when a limit is exceeded, instead of using the conventional\n // `context.reportError()` path. This propagates as an exception out\n // of `graphqlValidate`, which is why we wrap each rule in an\n // isolated try/catch — otherwise the first throwing rule would hide\n // any subsequent rule failures.\n const armorErrors: GraphQLError[] = [];\n for (const { name, rule } of enabledRules) {\n try {\n const errs = graphqlValidate(params.schema, params.documentAST, [rule]);\n armorErrors.push(...errs);\n } catch (err) {\n // `err instanceof GraphQLError` is NOT reliable here because\n // `@escape.tech/graphql-armor-*` bundles its own copy of\n // `graphql`, so the thrown error's prototype chain does not\n // match the `GraphQLError` class we imported at the top of this\n // file even when both resolve to the same package semver range.\n // We therefore detect armor rule violations by looking at the\n // error shape (either GraphQLError-like or Error-like with a\n // message). Any thrown value from a rule is treated as a\n // violation — rules don't throw for any other reason.\n const message = err instanceof Error ? err.message : String(err);\n const wrapped = new GraphQLError(message, {\n originalError: err instanceof Error ? err : undefined,\n extensions: {\n code: 'ARMOR_VIOLATION',\n rule: name,\n },\n });\n armorErrors.push(wrapped);\n }\n }\n\n if (armorErrors.length === 0) return;\n\n for (const err of armorErrors) {\n logger.warn('[gateway-security] armor rule triggered', {\n message: err.message,\n observe: cfg.observe,\n });\n }\n\n metrics.armorRejected.inc(\n {\n rule: 'armor',\n mode: cfg.observe ? 'observe' : 'enforce',\n },\n armorErrors.length\n );\n\n if (cfg.observe) return;\n\n // Calling `setResult` inside `onValidate` replaces the validation\n // result and skips envelop's own validate invocation. That is exactly\n // what we want — armor violations are fatal, no point running the\n // default graphql-js validation afterwards.\n setResult(armorErrors);\n },\n };\n\n const plugins: Plugin[] = [armorValidationPlugin];\n if (rules.blockSuggestionsPlugin) {\n plugins.push(rules.blockSuggestionsPlugin);\n }\n return plugins;\n};\n","/**\n * Operation Timeout Plugin\n *\n * Races each operation against a configurable timer (default 15s, aligned\n * with typical client-side timeouts and shorter than the 30s request-limiter\n * cap). When the timer fires, the execution errors out with a proper\n * GraphQL error (`OPERATION_TIMEOUT`) rather than the client seeing an\n * abrupt TCP drop.\n *\n * This is implemented via `onExecute` with a promise race — the subgraph\n * fetch already honors AbortController from Yoga, so upstream work is\n * cancelled naturally.\n *\n * @module gateway/security/plugins/operation-timeout\n * @category Gateway\n */\n\nimport { GraphQLError } from 'graphql';\nimport type { Plugin } from 'graphql-yoga';\n\nimport type { OperationTimeoutConfig } from '../types.js';\n\nexport interface OperationTimeoutPluginDeps {\n config: OperationTimeoutConfig;\n}\n\ninterface TimerHandle {\n timer: ReturnType<typeof setTimeout>;\n promise: Promise<never>;\n}\n\nconst createTimeoutHandle = (timeoutMs: number, error: GraphQLError): TimerHandle => {\n let timerRef: ReturnType<typeof setTimeout> | undefined;\n const promise = new Promise<never>((_, reject) => {\n timerRef = setTimeout(() => reject(error), timeoutMs);\n });\n return { timer: timerRef as ReturnType<typeof setTimeout>, promise };\n};\n\nexport const createOperationTimeoutPlugin = (deps: OperationTimeoutPluginDeps): Plugin => {\n const timeoutError = new GraphQLError('Operation timeout', {\n extensions: { code: 'OPERATION_TIMEOUT', timeoutMs: deps.config.timeoutMs },\n });\n\n return {\n onExecute: ({ executeFn, setExecuteFn }) => {\n setExecuteFn(async (args) => {\n const handle = createTimeoutHandle(deps.config.timeoutMs, timeoutError);\n try {\n return await Promise.race([executeFn(args), handle.promise]);\n } finally {\n clearTimeout(handle.timer);\n }\n });\n },\n };\n};\n","/**\n * OpenTelemetry Plugin\n *\n * Initializes an OTLP HTTP exporter pointed at Tempo (or any OTLP/HTTP\n * endpoint) and installs `@envelop/opentelemetry` spans around `parse`,\n * `validate`, and `execute`. Imports are dynamic so the SDK stays usable\n * when OTel is disabled or the peer packages are absent.\n *\n * Enrichment: spans carry `gateway.name`, `deployment.environment`, and\n * `service.version` resource attrs. Per-request context (actor, workspace)\n * is propagated via headers because the SDK does not yet wire\n * `propagators` — see the gateway handler edits for `traceparent` forwarding.\n *\n * @module gateway/security/plugins/otel\n * @category Gateway\n */\n\nimport type { Plugin } from 'graphql-yoga';\n\nimport { logger } from '../../../logger/index.js';\nimport type { OtelConfig } from '../types.js';\n\nlet shutdownHook: (() => Promise<void>) | null = null;\n\n// Structural types for the optional OTel peer deps. Constructors accept\n// `unknown` opts because we only need the start/shutdown surface here.\ntype ResourceCtor = new (attrs: Record<string, string>) => unknown;\ntype ResourceFactory = (attrs: Record<string, string>) => unknown;\ntype OtlpExporterCtor = new (opts: { url: string }) => unknown;\ntype NodeSdkInstance = { start(): void; shutdown(): Promise<void> };\ntype NodeSdkCtor = new (opts: { resource: unknown; traceExporter: unknown }) => NodeSdkInstance;\n\ntype ResourceModule = {\n // v1 API\n Resource?: ResourceCtor;\n // v2 API\n resourceFromAttributes?: ResourceFactory;\n};\n\ntype SemanticAttrs = {\n // v1 API\n SemanticResourceAttributes?: {\n SERVICE_NAME: string;\n DEPLOYMENT_ENVIRONMENT: string;\n SERVICE_VERSION: string;\n };\n // v2 API — string constants directly\n ATTR_SERVICE_NAME?: string;\n ATTR_SERVICE_VERSION?: string;\n ATTR_DEPLOYMENT_ENVIRONMENT?: string;\n ATTR_DEPLOYMENT_ENVIRONMENT_NAME?: string;\n};\n\n/**\n * Build an OTel Resource across the v1 → v2 API migration.\n * - v1 (`@opentelemetry/resources` 1.x): `new Resource(attrs)`\n * - v2 (`@opentelemetry/resources` 2.x): `resourceFromAttributes(attrs)`\n */\nconst buildResource = (resMod: ResourceModule, attrs: Record<string, string>): unknown => {\n if (typeof resMod.resourceFromAttributes === 'function') {\n return resMod.resourceFromAttributes(attrs);\n }\n if (typeof resMod.Resource === 'function') {\n return new resMod.Resource(attrs);\n }\n throw new Error('@opentelemetry/resources module exposes neither Resource nor resourceFromAttributes');\n};\n\n/**\n * Resolve semantic attribute keys across the v1 → v2 API migration.\n * - v1: `semcon.SemanticResourceAttributes.SERVICE_NAME` etc.\n * - v2: top-level `ATTR_SERVICE_NAME` string constants. Deployment\n * environment was renamed to `ATTR_DEPLOYMENT_ENVIRONMENT_NAME`.\n */\nconst resolveSemanticKeys = (\n semcon: SemanticAttrs\n): { serviceName: string; deploymentEnv: string; serviceVersion: string } => {\n if (semcon.SemanticResourceAttributes) {\n return {\n serviceName: semcon.SemanticResourceAttributes.SERVICE_NAME,\n deploymentEnv: semcon.SemanticResourceAttributes.DEPLOYMENT_ENVIRONMENT,\n serviceVersion: semcon.SemanticResourceAttributes.SERVICE_VERSION,\n };\n }\n return {\n serviceName: semcon.ATTR_SERVICE_NAME ?? 'service.name',\n deploymentEnv:\n semcon.ATTR_DEPLOYMENT_ENVIRONMENT_NAME ?? semcon.ATTR_DEPLOYMENT_ENVIRONMENT ?? 'deployment.environment',\n serviceVersion: semcon.ATTR_SERVICE_VERSION ?? 'service.version',\n };\n};\n\nconst loadOtelPeerDeps = async (): Promise<{\n NodeSDK: NodeSdkCtor;\n OTLPTraceExporter: OtlpExporterCtor;\n resMod: ResourceModule;\n semcon: SemanticAttrs;\n}> => {\n // Optional peer deps — indirect specifiers so TS does not try to resolve.\n const sdkSpec = '@opentelemetry/sdk-node';\n const otlpSpec = '@opentelemetry/exporter-trace-otlp-http';\n const resSpec = '@opentelemetry/resources';\n const semSpec = '@opentelemetry/semantic-conventions';\n const modules = (await Promise.all([\n import(/* @vite-ignore */ sdkSpec),\n import(/* @vite-ignore */ otlpSpec),\n import(/* @vite-ignore */ resSpec),\n import(/* @vite-ignore */ semSpec),\n ])) as [{ NodeSDK: NodeSdkCtor }, { OTLPTraceExporter: OtlpExporterCtor }, ResourceModule, SemanticAttrs];\n const [sdkMod, otlpMod, resMod, semcon] = modules;\n return {\n NodeSDK: sdkMod.NodeSDK,\n OTLPTraceExporter: otlpMod.OTLPTraceExporter,\n resMod,\n semcon,\n };\n};\n\nexport const initializeOtel = async (cfg: OtelConfig): Promise<void> => {\n if (!cfg.enabled) {\n logger.info('[gateway-security] OTel disabled by config');\n return;\n }\n if (shutdownHook) {\n return; // already initialized\n }\n\n try {\n const { NodeSDK, OTLPTraceExporter, resMod, semcon } = await loadOtelPeerDeps();\n const keys = resolveSemanticKeys(semcon);\n\n const resourceAttributes: Record<string, string> = {\n [keys.serviceName]: cfg.serviceName,\n [keys.deploymentEnv]: cfg.environment,\n };\n if (cfg.version) {\n resourceAttributes[keys.serviceVersion] = cfg.version;\n }\n\n const sdk = new NodeSDK({\n resource: buildResource(resMod, resourceAttributes),\n traceExporter: new OTLPTraceExporter({ url: cfg.endpoint }),\n });\n\n sdk.start();\n shutdownHook = (): Promise<void> => sdk.shutdown();\n logger.info('[gateway-security] OTel initialized', {\n serviceName: cfg.serviceName,\n endpoint: cfg.endpoint,\n });\n } catch (err) {\n const e = err instanceof Error ? err : new Error(String(err));\n logger.warn('[gateway-security] OTel init failed — continuing without tracing', {\n error: e.message,\n });\n }\n};\n\nexport const shutdownOtel = async (): Promise<void> => {\n if (shutdownHook) {\n try {\n await shutdownHook();\n } catch (err) {\n const e = err instanceof Error ? err : new Error(String(err));\n logger.warn('[gateway-security] OTel shutdown error', { error: e.message });\n }\n shutdownHook = null;\n }\n};\n\n/**\n * Returns an Envelop plugin that adds spans around parse/validate/execute.\n * Returns an empty plugin when @envelop/opentelemetry is absent.\n */\nexport const createOtelPlugin = async (cfg: OtelConfig): Promise<Plugin> => {\n if (!cfg.enabled) return {};\n try {\n const spec = '@envelop/opentelemetry';\n const mod = (await import(/* @vite-ignore */ spec)) as unknown as {\n useOpenTelemetry?: (opts: {\n spans?: { execute?: boolean; parse?: boolean; validate?: boolean; subscribe?: boolean };\n resolvers?: boolean;\n }) => Plugin;\n };\n if (typeof mod.useOpenTelemetry !== 'function') {\n logger.warn('[gateway-security] @envelop/opentelemetry has unexpected shape — plugin skipped');\n return {};\n }\n return mod.useOpenTelemetry({\n spans: { execute: true, parse: true, validate: true, subscribe: true },\n resolvers: false,\n });\n } catch (err) {\n const e = err instanceof Error ? err : new Error(String(err));\n logger.warn('[gateway-security] @envelop/opentelemetry not installed — plugin skipped', {\n error: e.message,\n });\n return {};\n }\n};\n","/**\n * Query Complexity Plugin\n *\n * Scores each incoming query against a per-field cost map. Scoring happens in\n * the validate phase so rejection is cheap and subgraph fanout is prevented.\n *\n * Observe mode logs the computed cost without rejecting — used during the\n * 48h bake of the hardening pass.\n *\n * @module gateway/security/plugins/query-complexity\n * @category Gateway\n */\n\nimport { GraphQLError, Kind } from 'graphql';\nimport type {\n ArgumentNode,\n FieldNode,\n FragmentDefinitionNode,\n GraphQLSchema,\n OperationDefinitionNode,\n SelectionNode,\n SelectionSetNode,\n ValueNode,\n} from 'graphql';\nimport type { Plugin } from 'graphql-yoga';\n\nimport { logger } from '../../../logger/index.js';\nimport { getMetrics } from '../metrics.js';\nimport type { CostMap, QueryComplexityConfig } from '../types.js';\n\nconst PAGINATION_ARGUMENTS = new Set(['first', 'limit', 'pageSize']);\nconst MAX_LIST_MULTIPLIER = 100;\nconst MAX_FAILURE_LOG_VARIANTS = 5;\nconst complexityFailureMessages = new Set<string>();\n\ninterface GraphQLNamedTypeLike {\n name?: string;\n getFields?: () => Record<string, GraphQLFieldLike | undefined>;\n}\n\ninterface GraphQLFieldLike {\n name?: string;\n type?: unknown;\n}\n\ninterface GraphQLSchemaLike {\n getQueryType?: () => GraphQLNamedTypeLike | null;\n getMutationType?: () => GraphQLNamedTypeLike | null;\n getSubscriptionType?: () => GraphQLNamedTypeLike | null;\n getType?: (name: string) => GraphQLNamedTypeLike | undefined | null;\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null;\n\nconst unwrapNamedType = (type: unknown): GraphQLNamedTypeLike | null => {\n let current = type;\n while (isRecord(current) && current['ofType'] !== undefined) {\n current = current['ofType'];\n }\n return isRecord(current) ? current : null;\n};\n\nconst getSchemaLike = (schema: GraphQLSchema): GraphQLSchemaLike => schema as unknown as GraphQLSchemaLike;\n\nconst getOperationRootType = (\n schema: GraphQLSchema,\n operation: OperationDefinitionNode\n): GraphQLNamedTypeLike | null => {\n const schemaLike = getSchemaLike(schema);\n if (operation.operation === 'mutation') return schemaLike.getMutationType?.() ?? null;\n if (operation.operation === 'subscription') return schemaLike.getSubscriptionType?.() ?? null;\n return schemaLike.getQueryType?.() ?? null;\n};\n\nconst getTypeByName = (schema: GraphQLSchema, name: string): GraphQLNamedTypeLike | null => {\n return getSchemaLike(schema).getType?.(name) ?? null;\n};\n\nconst getField = (parentType: GraphQLNamedTypeLike, fieldName: string): GraphQLFieldLike | undefined => {\n return parentType.getFields?.()[fieldName];\n};\n\nconst getCostMapValue = (costMap: CostMap, parentType: GraphQLNamedTypeLike, fieldName: string): number => {\n if (!parentType.name) return 1;\n return costMap[`${parentType.name}.${fieldName}`] ?? 1;\n};\n\nconst numericValueFromAst = (value: ValueNode): number | undefined => {\n if (value.kind === Kind.INT || value.kind === Kind.FLOAT) {\n const parsed = Number(value.value);\n return Number.isFinite(parsed) ? parsed : undefined;\n }\n if (value.kind === Kind.STRING) {\n const parsed = Number(value.value);\n return Number.isFinite(parsed) ? parsed : undefined;\n }\n return undefined;\n};\n\nconst listMultiplierFromArgs = (args: readonly ArgumentNode[] | undefined): number => {\n if (!args) return 1;\n for (const arg of args) {\n if (!PAGINATION_ARGUMENTS.has(arg.name.value)) continue;\n const raw = numericValueFromAst(arg.value);\n if (typeof raw !== 'number') return 1;\n return Math.min(Math.max(1, Math.trunc(raw)), MAX_LIST_MULTIPLIER);\n }\n return 1;\n};\n\nconst calculateFieldComplexity = (\n schema: GraphQLSchema,\n fieldNode: FieldNode,\n parentType: GraphQLNamedTypeLike,\n fragments: ReadonlyMap<string, FragmentDefinitionNode>,\n costMap: CostMap,\n activeFragments: Set<string>\n): number => {\n const fieldName = fieldNode.name.value;\n const field = getField(parentType, fieldName);\n const baseCost = getCostMapValue(costMap, parentType, fieldName);\n const namedFieldType = unwrapNamedType(field?.type);\n const childCost =\n fieldNode.selectionSet && namedFieldType\n ? calculateSelectionSetComplexity(\n schema,\n fieldNode.selectionSet,\n namedFieldType,\n fragments,\n costMap,\n activeFragments\n )\n : 0;\n return (baseCost + childCost) * listMultiplierFromArgs(fieldNode.arguments);\n};\n\nconst calculateSelectionSetComplexity = (\n schema: GraphQLSchema,\n selectionSet: SelectionSetNode,\n parentType: GraphQLNamedTypeLike,\n fragments: ReadonlyMap<string, FragmentDefinitionNode>,\n costMap: CostMap,\n activeFragments: Set<string>\n): number => {\n let total = 0;\n\n for (const selection of selectionSet.selections) {\n total += calculateSelectionComplexity(schema, selection, parentType, fragments, costMap, activeFragments);\n }\n\n return total;\n};\n\nconst calculateSelectionComplexity = (\n schema: GraphQLSchema,\n selection: SelectionNode,\n parentType: GraphQLNamedTypeLike,\n fragments: ReadonlyMap<string, FragmentDefinitionNode>,\n costMap: CostMap,\n activeFragments: Set<string>\n): number => {\n if (selection.kind === Kind.FIELD) {\n return calculateFieldComplexity(schema, selection, parentType, fragments, costMap, activeFragments);\n }\n\n if (selection.kind === Kind.INLINE_FRAGMENT) {\n const fragmentParent = selection.typeCondition\n ? (getTypeByName(schema, selection.typeCondition.name.value) ?? parentType)\n : parentType;\n return calculateSelectionSetComplexity(\n schema,\n selection.selectionSet,\n fragmentParent,\n fragments,\n costMap,\n activeFragments\n );\n }\n\n const fragmentName = selection.name.value;\n if (activeFragments.has(fragmentName)) return 0;\n const fragment = fragments.get(fragmentName);\n if (!fragment) return 0;\n\n activeFragments.add(fragmentName);\n const fragmentParent = getTypeByName(schema, fragment.typeCondition.name.value) ?? parentType;\n const complexity = calculateSelectionSetComplexity(\n schema,\n fragment.selectionSet,\n fragmentParent,\n fragments,\n costMap,\n activeFragments\n );\n activeFragments.delete(fragmentName);\n return complexity;\n};\n\nconst calculateDocumentComplexity = (\n schema: GraphQLSchema,\n documentAST: { definitions: readonly unknown[] },\n costMap: CostMap\n): number => {\n const fragments = new Map<string, FragmentDefinitionNode>();\n const operations: OperationDefinitionNode[] = [];\n\n for (const definition of documentAST.definitions) {\n if (!isRecord(definition) || typeof definition['kind'] !== 'string') continue;\n if (definition['kind'] === Kind.FRAGMENT_DEFINITION) {\n const fragment = definition as unknown as FragmentDefinitionNode;\n fragments.set(fragment.name.value, fragment);\n } else if (definition['kind'] === Kind.OPERATION_DEFINITION) {\n operations.push(definition as unknown as OperationDefinitionNode);\n }\n }\n\n let maxComplexity = 0;\n for (const operation of operations) {\n const rootType = getOperationRootType(schema, operation);\n if (!rootType) continue;\n const complexity = calculateSelectionSetComplexity(\n schema,\n operation.selectionSet,\n rootType,\n fragments,\n costMap,\n new Set<string>()\n );\n maxComplexity = Math.max(maxComplexity, complexity);\n }\n\n return maxComplexity;\n};\n\nconst logComplexityFailure = (error: Error): void => {\n const seen = complexityFailureMessages.has(error.message);\n if (!seen && complexityFailureMessages.size < MAX_FAILURE_LOG_VARIANTS) {\n complexityFailureMessages.add(error.message);\n logger.warn('[gateway-security] complexity scoring failed — fail-open', {\n error: error.message,\n suppressedRepeats: true,\n });\n return;\n }\n\n logger.debug('[gateway-security] repeated complexity scoring failure suppressed', {\n error: error.message,\n });\n};\n\nexport interface QueryComplexityPluginDeps {\n config: QueryComplexityConfig;\n}\n\nexport const createQueryComplexityPlugin = (deps: QueryComplexityPluginDeps): Plugin => {\n return {\n onValidate: ({ params, setResult }) => {\n try {\n const complexity = calculateDocumentComplexity(params.schema, params.documentAST, deps.config.costMap);\n\n if (complexity > deps.config.maxCost) {\n getMetrics().complexityRejected.inc({\n gateway: 'unknown',\n observe: deps.config.observe ? 'true' : 'false',\n });\n if (deps.config.observe) {\n logger.info('[gateway-security] complexity would_reject (observe)', {\n complexity,\n maxCost: deps.config.maxCost,\n });\n return;\n }\n setResult([\n new GraphQLError(`Query too expensive (cost ${complexity} > limit ${deps.config.maxCost})`, {\n extensions: {\n code: 'COMPLEXITY_TOO_HIGH',\n cost: complexity,\n maxCost: deps.config.maxCost,\n },\n }),\n ]);\n }\n } catch (err) {\n const e = err instanceof Error ? err : new Error(String(err));\n logComplexityFailure(e);\n }\n },\n };\n};\n","/**\n * Rate-Limit Plugin\n *\n * Per-actor token-bucket rate limiter backed by Valkey. Tier classification\n * from ActorContext. Increments a counter with a window-scoped TTL and\n * rejects when the bucket is exhausted. Emits rate-limit response headers\n * on every request (X-RateLimit-Limit / Remaining / Reset).\n *\n * Failure policy: **fail open** by default (availability > strictness during\n * Valkey outages). Flip with `failClosed: true`.\n *\n * Observe mode: when `observeOnly: true`, counts and logs but never rejects.\n * Used during the 48h bake of this hardening pass.\n *\n * @module gateway/security/plugins/rate-limit\n * @category Gateway\n */\n\nimport type { Plugin } from 'graphql-yoga';\n\nimport { logger } from '../../../logger/index.js';\nimport { resolveActor } from '../actor.js';\nimport { getMetrics } from '../metrics.js';\nimport type { ActorContext, RateLimitConfig, RateLimitResult, SecurityValkeyClient } from '../types.js';\n\nexport interface RateLimitPluginDeps {\n valkey: SecurityValkeyClient;\n config: RateLimitConfig;\n}\n\nconst keyFor = (prefix: string, tier: string, identity: string): string => `rl:${prefix}:${tier}:${identity}`;\n\nconst stamp = (): number => Date.now();\n\n/**\n * Atomic-ish INCR + EXPIRE. Valkey does not guarantee atomicity between the\n * two without a Lua script; the race window here loses at most 1 event per\n * window-start collision, which is acceptable for a limiter and avoids the\n * Lua script registration dance.\n */\nexport const checkRateLimit = async (deps: RateLimitPluginDeps, actor: ActorContext): Promise<RateLimitResult> => {\n const tier = deps.config.tiers[actor.tier];\n const metrics = getMetrics();\n const gateway = deps.config.keyPrefix;\n // Super admin passes through.\n if (tier.points === Number.MAX_SAFE_INTEGER) {\n metrics.rateLimit.inc({ gateway, tier: actor.tier, decision: 'allowed' });\n return { allowed: true, remaining: Number.MAX_SAFE_INTEGER, resetAtMs: 0, limit: tier.points };\n }\n\n const key = keyFor(deps.config.keyPrefix, actor.tier, actor.identity);\n const limit = tier.points + tier.burst;\n\n try {\n const count = await deps.valkey.incrBy(key, 1);\n if (count === 1) {\n await deps.valkey.expire(key, tier.duration);\n }\n const ttl = await deps.valkey.ttl(key);\n const resetAtMs = stamp() + Math.max(0, ttl) * 1000;\n\n if (count > limit) {\n metrics.rateLimit.inc({\n gateway,\n tier: actor.tier,\n decision: deps.config.observeOnly ? 'observed_reject' : 'rejected',\n });\n return { allowed: false, remaining: 0, resetAtMs, limit };\n }\n metrics.rateLimit.inc({ gateway, tier: actor.tier, decision: 'allowed' });\n return { allowed: true, remaining: Math.max(0, limit - count), resetAtMs, limit };\n } catch (err) {\n const e = err instanceof Error ? err : new Error(String(err));\n logger.warn('[gateway-security] rate-limit valkey error — fail-open', {\n key,\n error: e.message,\n });\n metrics.valkeyFailover.inc({ gateway });\n if (deps.config.failClosed) {\n metrics.rateLimit.inc({ gateway, tier: actor.tier, decision: 'rejected' });\n return { allowed: false, remaining: 0, resetAtMs: stamp() + tier.duration * 1000, limit };\n }\n metrics.rateLimit.inc({ gateway, tier: actor.tier, decision: 'allowed' });\n return { allowed: true, remaining: -1, resetAtMs: 0, limit };\n }\n};\n\n/**\n * Yoga/Envelop plugin factory.\n */\nexport const createRateLimitPlugin = (deps: RateLimitPluginDeps): Plugin => {\n return {\n onRequest: async ({ request, fetchAPI, endResponse }): Promise<void> => {\n const actor = resolveActor((name) => request.headers.get(name));\n const result = await checkRateLimit(deps, actor);\n\n // Headers are set via onResponse (below). Stash the result on the request\n // so onResponse can read it without re-running the Valkey call.\n (request as unknown as { __rateLimitResult: RateLimitResult; __rateLimitActor: ActorContext }).__rateLimitResult =\n result;\n (request as unknown as { __rateLimitResult: RateLimitResult; __rateLimitActor: ActorContext }).__rateLimitActor =\n actor;\n\n if (!result.allowed) {\n if (deps.config.observeOnly) {\n logger.info('[gateway-security] rate-limit would_reject (observe)', {\n tier: actor.tier,\n identity: actor.identity,\n limit: result.limit,\n });\n return;\n }\n const retryAfterS = Math.max(1, Math.ceil((result.resetAtMs - stamp()) / 1000));\n const body = JSON.stringify({\n errors: [\n {\n message: 'Rate limit exceeded',\n extensions: {\n code: 'RATE_LIMITED',\n resetAt: new Date(result.resetAtMs).toISOString(),\n },\n },\n ],\n });\n const response = new fetchAPI.Response(body, {\n status: 429,\n headers: {\n 'content-type': 'application/json',\n 'retry-after': String(retryAfterS),\n 'x-ratelimit-limit': String(result.limit),\n 'x-ratelimit-remaining': '0',\n 'x-ratelimit-reset': String(Math.floor(result.resetAtMs / 1000)),\n },\n });\n endResponse(response);\n }\n },\n onResponse: ({ request, response }): void => {\n const stash = (request as unknown as { __rateLimitResult?: RateLimitResult }).__rateLimitResult;\n if (!stash) return;\n response.headers.set('x-ratelimit-limit', String(stash.limit));\n response.headers.set('x-ratelimit-remaining', String(Math.max(0, stash.remaining)));\n if (stash.resetAtMs > 0) {\n response.headers.set('x-ratelimit-reset', String(Math.floor(stash.resetAtMs / 1000)));\n }\n },\n };\n};\n","/**\n * Gateway Security Plugin Orchestrator\n *\n * Builds the ordered Yoga/Envelop plugin array consumed by each public\n * gateway via `createGatewayRuntime({ plugins: [...] })`.\n *\n * Order (cheapest rejection first, span wrapping everything):\n * otel spans → armor (6 sub-plugins) → query-complexity → rate-limit → timeout\n *\n * @module gateway/security/plugins\n * @category Gateway\n */\n\nimport type { Plugin } from 'graphql-yoga';\n\nimport { logger } from '../../../logger/index.js';\nimport { initializeMetrics } from '../metrics.js';\nimport type { GatewaySecurityOptions } from '../types.js';\nimport { initializeSecurityValkey } from '../valkey.js';\nimport { createArmorPlugins } from './armor.js';\nimport { createOperationTimeoutPlugin } from './operation-timeout.js';\nimport { createOtelPlugin } from './otel.js';\nimport { createQueryComplexityPlugin } from './query-complexity.js';\nimport { createRateLimitPlugin } from './rate-limit.js';\n\n/**\n * Bootstraps Valkey + OTel side effects and returns the ordered plugin list.\n * Safe to call once at gateway boot; subsequent calls reuse the initialized\n * singletons.\n *\n * If `options.enabled === false`, returns an empty array — the master kill\n * switch for instant rollback via env flag.\n */\nexport const buildSecurityPlugins = async (options: GatewaySecurityOptions): Promise<Plugin[]> => {\n if (!options.enabled) {\n logger.warn('[gateway-security] SECURITY_PLUGINS_ENABLED=false — plugins disabled', {\n gatewayName: options.gatewayName,\n });\n return [];\n }\n\n // Side-effect init (both are idempotent). OTel exporter bootstrap belongs to\n // `bootstrapTelemetry()`; this stack only wires Envelop span hooks.\n await initializeMetrics();\n const valkey = await initializeSecurityValkey(options.gatewayName);\n\n const plugins: Plugin[] = [];\n\n const otelPlugin = await createOtelPlugin(options.otel);\n plugins.push(otelPlugin);\n\n const armorPlugins = await createArmorPlugins(options.armor);\n plugins.push(...armorPlugins);\n\n if (options.queryComplexity.enabled) {\n plugins.push(createQueryComplexityPlugin({ config: options.queryComplexity }));\n }\n plugins.push(createRateLimitPlugin({ valkey, config: options.rateLimit }));\n plugins.push(createOperationTimeoutPlugin({ config: options.operationTimeout }));\n\n logger.info('[gateway-security] plugins wired', {\n gatewayName: options.gatewayName,\n count: plugins.length,\n observe: {\n armor: options.armor.observe,\n complexity: options.queryComplexity.observe,\n rateLimit: options.rateLimit.observeOnly,\n },\n enabled: {\n complexity: options.queryComplexity.enabled,\n },\n });\n\n return plugins;\n};\n\nexport { createArmorPlugins } from './armor.js';\nexport { createOperationTimeoutPlugin } from './operation-timeout.js';\nexport { createOtelPlugin, initializeOtel, shutdownOtel } from './otel.js';\nexport { createQueryComplexityPlugin } from './query-complexity.js';\nexport { checkRateLimit, createRateLimitPlugin } from './rate-limit.js';\n"]}
package/dist/chunk-PHKK7725.js.map DELETED
@@ -1 +0,0 @@
1
- {"version":3,"sources":["../src/platform/index.ts","../src/platform/httpClient.ts","../src/platform/leaderLock.ts","../src/platform/rateLimit.ts","../src/platform/paginator.ts","../src/platform/dataLoaderFactory.ts","../src/platform/cacheInvalidation.ts","../src/platform/pgPartition.ts","../src/platform/llmClient.ts"],"names":["breakers","Map","hostOf","url","URL","host","getBreaker","b","get","failures","openedAt","state","set","defaultRetryOn","status","jitter","delay","Math","floor","random","sleep","ms","Promise","r","setTimeout","CircuitBreakerOpenError","Error","name","__resetHttpClientBreakers","clear","executeOnce","init","timeoutMs","signal","AbortSignal","timeout","fetch","httpClient","config","fullUrl","baseUrl","test","replace","breaker","breakerThreshold","threshold","cooldownMs","Date","now","logger","info","attempts","retry","initialDelay","initialDelayMs","maxDelay","maxDelayMs","retryOn","defaultTimeoutMs","headers","defaultHeaders","lastErr","attempt","response","warn","min","err","error","String","createHttpClient","RELEASE_LUA","RENEW_LUA","generateToken","toString","slice","process","pid","withLeaderLock","redis","fn","options","key","token","ttlMs","renewMs","max","ttlSeconds","ceil","acquired","stopped","renewTimer","setInterval","eval","catch","unref","result","clearInterval","rateLimitIncr","input","fullKey","count","incr","pexpire","windowMs","ttl","pttl","resetAt","remaining","limit","allowed","clampLimit","opts","def","defaultLimit","maxLimit","minLimit","Number","isNaN","paginate","model","take","undefined","items","findMany","skip","cursor","id","where","orderBy","hasMore","length","trimmed","nextCursor","buildLoaders","ctx","builder","resolveReferenceLoader","loaderName","keyField","reference","loader","loaders","load","VERSION_PREFIX","getNamespaceVersion","namespace","v","n","parseInt","isFinite","buildCacheKey","parts","ver","join","invalidateNamespace","pad2","monthlyPartitionName","table","year","month","ensureMonthlyPartitions","prisma","created","cur","UTC","from","getUTCFullYear","getUTCMonth","end","to","y","m","next","partition","lower","upper","$executeRawUnsafe","push","setUTCMonth","dropOldPartitions","rows","$queryRawUnsafe","dropped","cutoffYear","beforeDate","cutoffMonth","row","partitionRe","exec","partition_name","mo","DEFAULTS","maxAttempts","maxOutputTokensCap","LLMRouter","adapters","register","adapter","resolveChain","envChain","env","trim","split","map","s","filter","Boolean","Array","keys","complete","req","cappedReq","maxTokens","chain","providerName","ctrl","AbortController","t","abort","provider","clearTimeout"],"mappings":";;;;AAAA,IAAA,gBAAA,GAAA;;;;;;;;;;;;;;;;;;;;;;ACgDA,IAAMA,QAAAA,uBAAeC,GAAAA,EAAAA;AAErB,SAASC,OAAOC,GAAAA,EAAW;AACzB,EAAA,IAAI;AACF,IAAA,OAAO,IAAIC,GAAAA,CAAID,GAAAA,CAAAA,CAAKE,IAAAA;EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAOF,GAAAA;AACT,EAAA;AACF;AANSD,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAQT,SAASI,WAAWD,IAAAA,EAAY;AAC9B,EAAA,IAAIE,CAAAA,GAAIP,QAAAA,CAASQ,GAAAA,CAAIH,IAAAA,CAAAA;AACrB,EAAA,IAAI,CAACE,CAAAA,EAAG;AACNA,IAAAA,CAAAA,GAAI;MAAEE,QAAAA,EAAU,CAAA;MAAGC,QAAAA,EAAU,IAAA;MAAMC,KAAAA,EAAO;AAAS,KAAA;AACnDX,IAAAA,QAAAA,CAASY,GAAAA,CAAIP,MAAME,CAAAA,CAAAA;AACrB,EAAA;AACA,EAAA,OAAOA,CAAAA;AACT;AAPSD,MAAAA,CAAAA,UAAAA,EAAAA,YAAAA,CAAAA;AAST,SAASO,eAAeC,MAAAA,EAAc;AACpC,EAAA,OAAOA,MAAAA,KAAW,OAAOA,MAAAA,KAAW,GAAA,IAAOA,WAAW,GAAA,IAAQA,MAAAA,IAAU,OAAOA,MAAAA,IAAU,GAAA;AAC3F;AAFSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAIT,SAASE,OAAOC,KAAAA,EAAa;AAC3B,EAAA,OAAOC,IAAAA,CAAKC,KAAAA,CAAMD,IAAAA,CAAKE,MAAAA,KAAWH,KAAAA,CAAAA;AACpC;AAFSD,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAIT,SAASK,MAAMC,EAAAA,EAAU;AACvB,EAAA,OAAO,IAAIC,OAAAA,CAAQ,CAACC,MAAMC,UAAAA,CAAWD,CAAAA,EAAGF,EAAAA,CAAAA,CAAAA;AAC1C;AAFSD,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAIF,IAAMK,uBAAAA,GAAN,cAAsCC,KAAAA,CAAAA;EA/E7C;;;AAgFE,EAAA,WAAA,CAAYrB,IAAAA,EAAc;AACxB,IAAA,KAAA,CAAM,CAAA,8BAAA,EAAiCA,IAAAA,CAAAA,CAAM,CAAA;AAC7C,IAAA,IAAA,CAAKsB,IAAAA,GAAO,yBAAA;AACd,EAAA;AACF;AAUO,SAASC,yBAAAA,GAAAA;AACd5B,EAAAA,QAAAA,CAAS6B,KAAAA,EAAK;AAChB;AAFgBD,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AAIhB,eAAeE,WAAAA,CAAY3B,GAAAA,EAAa4B,IAAAA,EAAsBC,SAAAA,EAAiB;AAC7E,EAAA,MAAMC,MAAAA,GAASF,IAAAA,CAAKE,MAAAA,IAAUC,WAAAA,CAAYC,QAAQH,SAAAA,CAAAA;AAClD,EAAA,OAAOI,MAAMjC,GAAAA,EAAK;IAAE,GAAG4B,IAAAA;AAAME,IAAAA;GAAO,CAAA;AACtC;AAHeH,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAKf,eAAsBO,WACpBlC,GAAAA,EACA4B,IAAAA,GAAuB,EAAC,EACxBO,MAAAA,GAA2B,EAAC,EAAC;AAE7B,EAAA,MAAMC,OAAAA,GACJD,OAAOE,OAAAA,IAAW,CAAC,gBAAgBC,IAAAA,CAAKtC,GAAAA,IACpC,CAAA,EAAGmC,MAAAA,CAAOE,QAAQE,OAAAA,CAAQ,KAAA,EAAO,EAAA,CAAA,CAAA,CAAA,EAAOvC,IAAIuC,OAAAA,CAAQ,KAAA,EAAO,EAAA,CAAA,CAAA,CAAA,GAC3DvC,GAAAA;AACN,EAAA,MAAME,IAAAA,GAAOH,OAAOqC,OAAAA,CAAAA;AACpB,EAAA,MAAMI,OAAAA,GAAUrC,WAAWD,IAAAA,CAAAA;AAC3B,EAAA,MAAMuC,gBAAAA,GAAmBN,MAAAA,CAAOK,OAAAA,EAASE,SAAAA,IAAa,CAAA;AACtD,EAAA,MAAMC,UAAAA,GAAaR,MAAAA,CAAOK,OAAAA,EAASG,UAAAA,IAAc,GAAA;AAEjD,EAAA,IAAIH,OAAAA,CAAQhC,UAAU,MAAA,EAAQ;AAC5B,IAAA,IAAIgC,QAAQjC,QAAAA,IAAYqC,IAAAA,CAAKC,KAAG,GAAKL,OAAAA,CAAQjC,YAAYoC,UAAAA,EAAY;AACnEH,MAAAA,OAAAA,CAAQhC,KAAAA,GAAQ,WAAA;AAChBsC,MAAAA,MAAAA,CAAOC,KAAK,6BAAA,EAA+B;AAAE7C,QAAAA;OAAK,CAAA;IACpD,CAAA,MAAO;AACL,MAAA,MAAM,IAAIoB,wBAAwBpB,IAAAA,CAAAA;AACpC,IAAA;AACF,EAAA;AAEA,EAAA,MAAM8C,WAAWpB,IAAAA,CAAKqB,KAAAA,EAAOD,QAAAA,IAAYb,MAAAA,CAAOc,OAAOD,QAAAA,IAAY,CAAA;AACnE,EAAA,MAAME,eAAetB,IAAAA,CAAKqB,KAAAA,EAAOE,cAAAA,IAAkBhB,MAAAA,CAAOc,OAAOE,cAAAA,IAAkB,GAAA;AACnF,EAAA,MAAMC,WAAWxB,IAAAA,CAAKqB,KAAAA,EAAOI,UAAAA,IAAclB,MAAAA,CAAOc,OAAOI,UAAAA,IAAc,GAAA;AACvE,EAAA,MAAMC,UAAU1B,IAAAA,CAAKqB,KAAAA,EAAOK,OAAAA,IAAWnB,MAAAA,CAAOc,OAAOK,OAAAA,IAAW5C,cAAAA;AAChE,EAAA,MAAMmB,SAAAA,GAAYD,IAAAA,CAAKC,SAAAA,IAAaM,MAAAA,CAAOoB,gBAAAA,IAAoB,GAAA;AAE/D,EAAA,MAAMC,OAAAA,GAAU;IAAE,GAAIrB,MAAAA,CAAOsB,kBAAkB,EAAC;IAAI,GAAK7B,IAAAA,CAAK4B,WAAkD;AAAI,GAAA;AAEpH,EAAA,IAAIE,OAAAA;AACJ,EAAA,KAAA,IAASC,OAAAA,GAAU,CAAA,EAAGA,OAAAA,IAAWX,QAAAA,EAAUW,OAAAA,EAAAA,EAAW;AACpD,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAMjC,WAAAA,CAAYS,OAAAA,EAAS;QAAE,GAAGR,IAAAA;AAAM4B,QAAAA;AAAQ,OAAA,EAAG3B,SAAAA,CAAAA;AAClE,MAAA,IAAI+B,QAAAA,CAASjD,UAAU,GAAA,EAAK;AAC1B6B,QAAAA,OAAAA,CAAQlC,QAAAA,IAAY,CAAA;AACpB,QAAA,IAAIkC,OAAAA,CAAQlC,YAAYmC,gBAAAA,EAAkB;AACxCD,UAAAA,OAAAA,CAAQhC,KAAAA,GAAQ,MAAA;AAChBgC,UAAAA,OAAAA,CAAQjC,QAAAA,GAAWqC,KAAKC,GAAAA,EAAG;AAC3BC,UAAAA,MAAAA,CAAOe,KAAK,yBAAA,EAA2B;AAAE3D,YAAAA,IAAAA;AAAMI,YAAAA,QAAAA,EAAUkC,OAAAA,CAAQlC;WAAS,CAAA;AAC5E,QAAA;AACA,QAAA,IAAIqD,OAAAA,GAAUX,QAAAA,IAAYM,OAAAA,CAAQM,QAAAA,CAASjD,MAAM,CAAA,EAAG;AAClD,UAAA,MAAME,QAAQC,IAAAA,CAAKgD,GAAAA,CAAIZ,eAAe,CAAA,KAAMS,OAAAA,GAAU,IAAIP,QAAAA,CAAAA;AAC1D,UAAA,MAAMnC,KAAAA,CAAML,MAAAA,CAAOC,KAAAA,CAAAA,CAAAA;AACnB,UAAA;AACF,QAAA;AACA,QAAA,OAAO+C,QAAAA;AACT,MAAA;AAEApB,MAAAA,OAAAA,CAAQlC,QAAAA,GAAW,CAAA;AACnB,MAAA,IAAIkC,OAAAA,CAAQhC,UAAU,WAAA,EAAa;AACjCgC,QAAAA,OAAAA,CAAQhC,KAAAA,GAAQ,QAAA;AAChBgC,QAAAA,OAAAA,CAAQjC,QAAAA,GAAW,IAAA;AACnBuC,QAAAA,MAAAA,CAAOC,KAAK,2BAAA,EAA6B;AAAE7C,UAAAA;SAAK,CAAA;AAClD,MAAA;AACA,MAAA,IAAIyD,OAAAA,GAAUX,QAAAA,IAAYM,OAAAA,CAAQM,QAAAA,CAASjD,MAAM,CAAA,EAAG;AAClD,QAAA,MAAME,QAAQC,IAAAA,CAAKgD,GAAAA,CAAIZ,eAAe,CAAA,KAAMS,OAAAA,GAAU,IAAIP,QAAAA,CAAAA;AAC1D,QAAA,MAAMnC,KAAAA,CAAML,MAAAA,CAAOC,KAAAA,CAAAA,CAAAA;AACnB,QAAA;AACF,MAAA;AACA,MAAA,OAAO+C,QAAAA;AACT,IAAA,CAAA,CAAA,OAASG,GAAAA,EAAK;AACZL,MAAAA,OAAAA,GAAUK,GAAAA;AACVvB,MAAAA,OAAAA,CAAQlC,QAAAA,IAAY,CAAA;AACpB,MAAA,IAAIkC,OAAAA,CAAQlC,YAAYmC,gBAAAA,EAAkB;AACxCD,QAAAA,OAAAA,CAAQhC,KAAAA,GAAQ,MAAA;AAChBgC,QAAAA,OAAAA,CAAQjC,QAAAA,GAAWqC,KAAKC,GAAAA,EAAG;AAC3BC,QAAAA,MAAAA,CAAOe,KAAK,yBAAA,EAA2B;AAAE3D,UAAAA,IAAAA;AAAMI,UAAAA,QAAAA,EAAUkC,OAAAA,CAAQlC;SAAS,CAAA;AAC5E,MAAA;AACA,MAAA,IAAIqD,WAAWX,QAAAA,EAAU;AACzB,MAAA,MAAMnC,QAAQC,IAAAA,CAAKgD,GAAAA,CAAIZ,eAAe,CAAA,KAAMS,OAAAA,GAAU,IAAIP,QAAAA,CAAAA;AAC1D,MAAA,MAAMnC,KAAAA,CAAML,MAAAA,CAAOC,KAAAA,CAAAA,CAAAA;AACrB,IAAA;AACF,EAAA;AAEAiC,EAAAA,MAAAA,CAAOkB,MAAM,sBAAA,EAAwB;IAAEhE,GAAAA,EAAKoC,OAAAA;AAASY,IAAAA,QAAAA;AAAU9C,IAAAA;GAAK,CAAA;AACpE,EAAA,MAAMwD,OAAAA,YAAmBnC,QAAQmC,OAAAA,GAAU,IAAInC,MAAM,CAAA,mBAAA,EAAsB0C,MAAAA,CAAOP,OAAAA,CAAAA,CAAAA,CAAU,CAAA;AAC9F;AA9EsBxB,MAAAA,CAAAA,UAAAA,EAAAA,YAAAA,CAAAA;AAgFf,SAASgC,gBAAAA,CACd/B,MAAAA,GAA2B,EAAC,EAAC;AAE7B,EAAA,OAAO,CAACnC,KAAa4B,IAAAA,GAAuB,OAAOM,UAAAA,CAAWlC,GAAAA,EAAK4B,MAAMO,MAAAA,CAAAA;AAC3E;AAJgB+B,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;;;ACtJhB,IAAMC,WAAAA,GAAc;;;;;;;AAQpB,IAAMC,SAAAA,GAAY;;;;;;;AAQlB,SAASC,aAAAA,GAAAA;AACP,EAAA,OAAO,GAAGzB,IAAAA,CAAKC,GAAAA,EAAG,CAAA,CAAA,EAAM/B,KAAKE,MAAAA,EAAM,CAAGsD,QAAAA,CAAS,EAAA,EAAIC,KAAAA,CAAM,CAAA,CAAA,CAAA,CAAA,EAAMC,QAAQC,GAAG,CAAA,CAAA;AAC5E;AAFSJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAIT,eAAsBK,cAAAA,CACpBC,KAAAA,EACAnD,IAAAA,EACAoD,EAAAA,EACAC,OAAAA,EAA0B;AAE1B,EAAA,MAAMC,GAAAA,GAAM,gBAAgBtD,IAAAA,CAAAA,CAAAA;AAC5B,EAAA,MAAMuD,QAAQV,aAAAA,EAAAA;AACd,EAAA,MAAMW,QAAQH,OAAAA,CAAQG,KAAAA;AACtB,EAAA,MAAMC,OAAAA,GAAUJ,OAAAA,CAAQI,OAAAA,IAAWnE,IAAAA,CAAKoE,GAAAA,CAAI,KAAOpE,IAAAA,CAAKC,KAAAA,CAAMiE,KAAAA,GAAQ,CAAA,CAAA,CAAA;AACtE,EAAA,MAAMG,UAAAA,GAAarE,KAAKoE,GAAAA,CAAI,CAAA,EAAGpE,KAAKsE,IAAAA,CAAKJ,KAAAA,GAAQ,GAAA,CAAA,CAAA;AAEjD,EAAA,MAAMK,QAAAA,GAAW,MAAMV,KAAAA,CAAMlE,GAAAA,CAAIqE,KAAKC,KAAAA,EAAO,IAAA,EAAMI,YAAY,IAAA,CAAA;AAC/D,EAAA,IAAIE,aAAa,IAAA,EAAM;AACrB,IAAA,OAAO;MAAEA,QAAAA,EAAU;AAAM,KAAA;AAC3B,EAAA;AAEAvC,EAAAA,MAAAA,CAAOC,KAAK,qBAAA,EAAuB;AAAEvB,IAAAA,IAAAA;AAAMuD,IAAAA,KAAAA;AAAOC,IAAAA;GAAM,CAAA;AAExD,EAAA,IAAIM,OAAAA,GAAU,KAAA;AACd,EAAA,MAAMC,UAAAA,GAAaC,YAAY,MAAA;AAC7B,IAAA,IAAIF,OAAAA,EAAS;AACbX,IAAAA,KAAAA,CAAMc,IAAAA,CAAKrB,SAAAA,EAAW,CAAA,EAAGU,GAAAA,EAAKC,KAAAA,EAAOd,MAAAA,CAAOe,KAAAA,CAAAA,CAAAA,CAAQU,KAAAA,CAAM,CAAC3B,GAAAA,KAAAA;AACzDjB,MAAAA,MAAAA,CAAOe,KAAK,yBAAA,EAA2B;AAAErC,QAAAA,IAAAA;AAAMuC,QAAAA,GAAAA,EAAKE,OAAOF,GAAAA;OAAK,CAAA;IAClE,CAAA,CAAA;AACF,EAAA,CAAA,EAAGkB,OAAAA,CAAAA;AAEH,EAAA,IAAI,OAAQM,UAAAA,CAAiDI,KAAAA,KAAU,UAAA,EAAY;AAChFJ,IAAAA,UAAAA,CAAgDI,KAAAA,EAAK;AACxD,EAAA;AAEA,EAAA,IAAI;AACF,IAAA,MAAMC,MAAAA,GAAS,MAAMhB,EAAAA,EAAAA;AACrB,IAAA,OAAO;MAAES,QAAAA,EAAU,IAAA;AAAMO,MAAAA;AAAO,KAAA;EAClC,CAAA,SAAA;AACEN,IAAAA,OAAAA,GAAU,IAAA;AACVO,IAAAA,aAAAA,CAAcN,UAAAA,CAAAA;AACd,IAAA,IAAI;AACF,MAAA,MAAMZ,KAAAA,CAAMc,IAAAA,CAAKtB,WAAAA,EAAa,CAAA,EAAGW,KAAKC,KAAAA,CAAAA;AACtCjC,MAAAA,MAAAA,CAAOC,KAAK,qBAAA,EAAuB;AAAEvB,QAAAA,IAAAA;AAAMuD,QAAAA;OAAM,CAAA;AACnD,IAAA,CAAA,CAAA,OAAShB,GAAAA,EAAK;AACZjB,MAAAA,MAAAA,CAAOe,KAAK,2BAAA,EAA6B;AAAErC,QAAAA,IAAAA;AAAMuC,QAAAA,GAAAA,EAAKE,OAAOF,GAAAA;OAAK,CAAA;AACpE,IAAA;AACF,EAAA;AACF;AA5CsBW,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;;;ACpBtB,eAAsBoB,aAAAA,CAAcnB,OAAuBoB,KAAAA,EAAqB;AAC9E,EAAA,MAAMC,OAAAA,GAAU,CAAA,SAAA,EAAYD,KAAAA,CAAMjB,GAAG,CAAA,CAAA;AACrC,EAAA,MAAMmB,KAAAA,GAAQ,MAAMtB,KAAAA,CAAMuB,IAAAA,CAAKF,OAAAA,CAAAA;AAC/B,EAAA,IAAIC,UAAU,CAAA,EAAG;AACf,IAAA,MAAMtB,KAAAA,CAAMwB,OAAAA,CAAQH,OAAAA,EAASD,KAAAA,CAAMK,QAAQ,CAAA;AAC7C,EAAA;AACA,EAAA,IAAIC,GAAAA,GAAM,EAAA;AACV,EAAA,IAAI;AACFA,IAAAA,GAAAA,GAAM,MAAM1B,KAAAA,CAAM2B,IAAAA,CAAKN,OAAAA,CAAAA;EACzB,CAAA,CAAA,MAAQ;AACNK,IAAAA,GAAAA,GAAMN,KAAAA,CAAMK,QAAAA;AACd,EAAA;AACA,EAAA,MAAMG,UAAU3D,IAAAA,CAAKC,GAAAA,MAASwD,GAAAA,GAAM,CAAA,GAAIA,MAAMN,KAAAA,CAAMK,QAAAA,CAAAA;AACpD,EAAA,MAAMI,YAAY1F,IAAAA,CAAKoE,GAAAA,CAAI,CAAA,EAAGa,KAAAA,CAAMU,QAAQR,KAAAA,CAAAA;AAC5C,EAAA,OAAO;AACLS,IAAAA,OAAAA,EAAST,SAASF,KAAAA,CAAMU,KAAAA;AACxBR,IAAAA,KAAAA;AACAO,IAAAA,SAAAA;AACAD,IAAAA;AACF,GAAA;AACF;AApBsBT,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;;;AClBf,SAASa,UAAAA,CAAWZ,KAAAA,EAAkCa,IAAAA,GAA0B,EAAC,EAAC;AACvF,EAAA,MAAMC,GAAAA,GAAMD,KAAKE,YAAAA,IAAgB,EAAA;AACjC,EAAA,MAAM5B,GAAAA,GAAM0B,KAAKG,QAAAA,IAAY,GAAA;AAC7B,EAAA,MAAMjD,GAAAA,GAAM8C,KAAKI,QAAAA,IAAY,CAAA;AAC7B,EAAA,IAAIjB,SAAS,IAAA,IAAQkB,MAAAA,CAAOC,KAAAA,CAAMnB,KAAAA,GAAQ,OAAOc,GAAAA;AACjD,EAAA,OAAO/F,IAAAA,CAAKgD,GAAAA,CAAIhD,IAAAA,CAAKoE,GAAAA,CAAIpE,IAAAA,CAAKC,MAAMgF,KAAAA,CAAAA,EAAQjC,GAAAA,CAAAA,EAAMoB,GAAAA,CAAAA;AACpD;AANgByB,MAAAA,CAAAA,UAAAA,EAAAA,YAAAA,CAAAA;AA+BhB,eAAsBQ,QAAAA,CACpBC,KAAAA,EACArB,KAAAA,EACAa,IAAAA,GAA0B,EAAC,EAAC;AAE5B,EAAA,MAAMS,IAAAA,GAAOV,UAAAA,CAAWZ,KAAAA,CAAMsB,IAAAA,IAAQC,QAAWV,IAAAA,CAAAA;AAEjD,EAAA,MAAMW,KAAAA,GAAQ,MAAMH,KAAAA,CAAMI,QAAAA,CAAS;AACjCH,IAAAA,IAAAA,EAAMA,IAAAA,GAAO,CAAA;IACbI,IAAAA,EAAM1B,KAAAA,CAAM2B,SAAS,CAAA,GAAI,CAAA;AACzBA,IAAAA,MAAAA,EAAQ3B,MAAM2B,MAAAA,GAAS;AAAEC,MAAAA,EAAAA,EAAI5B,KAAAA,CAAM2B;KAAO,GAAIJ,MAAAA;AAC9CM,IAAAA,KAAAA,EAAO7B,KAAAA,CAAM6B,KAAAA;AACbC,IAAAA,OAAAA,EAAS9B,KAAAA,CAAM8B;GACjB,CAAA;AACA,EAAA,MAAMC,OAAAA,GAAUP,MAAMQ,MAAAA,GAASV,IAAAA;AAC/B,EAAA,MAAMW,UAAUF,OAAAA,GAAUP,KAAAA,CAAMhD,KAAAA,CAAM,CAAA,EAAG8C,IAAAA,CAAAA,GAAQE,KAAAA;AACjD,EAAA,MAAMU,UAAAA,GAAaH,OAAAA,IAAWE,OAAAA,CAAQD,MAAAA,GAAS,CAAA,GAAKC,QAAQA,OAAAA,CAAQD,MAAAA,GAAS,CAAA,CAAA,CAAsBJ,EAAAA,GAAK,IAAA;AACxG,EAAA,OAAO;IAAEJ,KAAAA,EAAOS,OAAAA;AAASF,IAAAA,OAAAA;AAASG,IAAAA;AAAW,GAAA;AAC/C;AAlBsBd,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;;;ACTf,SAASe,YAAAA,CAAuCC,KAAUC,OAAAA,EAA8B;AAC7F,EAAA,OAAOA,QAAQD,GAAAA,CAAAA;AACjB;AAFgBD,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAiBT,SAASG,sBAAAA,CACdC,UAAAA,EACAC,QAAAA,GAAmB,IAAA,EAAI;AAEvB,EAAA,OAAO,OAAOC,WAAWL,GAAAA,KAAAA;AACvB,IAAA,MAAMM,MAAAA,GAASN,GAAAA,CAAIO,OAAAA,CAAQJ,UAAAA,CAAAA;AAC3B,IAAA,IAAI,CAACG,MAAAA,EAAQ;AACX,MAAA,MAAM,IAAIlH,KAAAA,CAAM,CAAA,gCAAA,EAAmC+G,UAAAA,CAAAA,0BAAAA,CAAsC,CAAA;AAC3F,IAAA;AACA,IAAA,MAAMxD,GAAAA,GAAM0D,UAAUD,QAAAA,CAAAA;AACtB,IAAA,IAAI,OAAOzD,QAAQ,QAAA,EAAU;AAC3B,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAO2D,MAAAA,CAAOE,KAAK7D,GAAAA,CAAAA;AACrB,EAAA,CAAA;AACF;AAfgBuD,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;;;ACrChB,IAAMO,cAAAA,GAAiB,WAAA;AAEvB,eAAsBC,mBAAAA,CAAoBlE,OAA0BmE,SAAAA,EAAiB;AACnF,EAAA,MAAMC,CAAAA,GAAI,MAAMpE,KAAAA,CAAMtE,GAAAA,CAAI,GAAGuI,cAAAA,CAAAA,EAAiBE,SAAAA,CAAAA,CAAW,CAAA;AACzD,EAAA,IAAI,CAACC,GAAG,OAAO,CAAA;AACf,EAAA,MAAMC,CAAAA,GAAI/B,MAAAA,CAAOgC,QAAAA,CAASF,CAAAA,EAAG,EAAA,CAAA;AAC7B,EAAA,OAAO9B,OAAOiC,QAAAA,CAASF,CAAAA,CAAAA,IAAMA,CAAAA,GAAI,IAAIA,CAAAA,GAAI,CAAA;AAC3C;AALsBH,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAOtB,eAAsBM,aAAAA,CAAcxE,KAAAA,EAA0BmE,SAAAA,EAAAA,GAAsBM,KAAAA,EAAe;AACjG,EAAA,MAAMC,GAAAA,GAAM,MAAMR,mBAAAA,CAAoBlE,KAAAA,EAAOmE,SAAAA,CAAAA;AAC7C,EAAA,OAAO,CAAA,EAAGA,SAAAA,CAAAA,EAAAA,EAAcO,GAAAA,IAAOD,KAAAA,CAAME,IAAAA,CAAK,GAAA,CAAA,CAAA,CAAA;AAC5C;AAHsBH,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAKtB,eAAsBI,mBAAAA,CAAoB5E,OAA0BmE,SAAAA,EAAiB;AACnF,EAAA,OAAOnE,MAAMuB,IAAAA,CAAK,CAAA,EAAG0C,cAAAA,CAAAA,EAAiBE,SAAAA,CAAAA,CAAW,CAAA;AACnD;AAFsBS,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;;;ACbtB,SAASC,KAAKR,CAAAA,EAAS;AACrB,EAAA,OAAOA,IAAI,EAAA,GAAK,CAAA,CAAA,EAAIA,CAAAA,CAAAA,CAAAA,GAAM,GAAGA,CAAAA,CAAAA,CAAAA;AAC/B;AAFSQ,MAAAA,CAAAA,IAAAA,EAAAA,MAAAA,CAAAA;AAIF,SAASC,oBAAAA,CAAqBC,KAAAA,EAAeC,IAAAA,EAAcC,KAAAA,EAAa;AAC7E,EAAA,OAAO,GAAGF,KAAAA,CAAAA,EAAAA,EAAUC,IAAAA,CAAAA,CAAAA,EAAQH,IAAAA,CAAKI,KAAAA,CAAAA,CAAAA,CAAAA;AACnC;AAFgBH,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAUhB,eAAsBI,uBAAAA,CAAwBC,QAAyBlD,IAAAA,EAA0B;AAC/F,EAAA,MAAMmD,UAAoB,EAAA;AAC1B,EAAA,MAAMC,GAAAA,GAAM,IAAIpH,IAAAA,CAAKA,IAAAA,CAAKqH,IAAIrD,IAAAA,CAAKsD,IAAAA,CAAKC,cAAAA,EAAc,EAAIvD,IAAAA,CAAKsD,IAAAA,CAAKE,WAAAA,EAAW,EAAI,CAAA,CAAA,CAAA;AACnF,EAAA,MAAMC,GAAAA,GAAM,IAAIzH,IAAAA,CAAKA,IAAAA,CAAKqH,IAAIrD,IAAAA,CAAK0D,EAAAA,CAAGH,cAAAA,EAAc,EAAIvD,IAAAA,CAAK0D,EAAAA,CAAGF,WAAAA,EAAW,EAAI,CAAA,CAAA,CAAA;AAC/E,EAAA,OAAOJ,OAAOK,GAAAA,EAAK;AACjB,IAAA,MAAME,CAAAA,GAAIP,IAAIG,cAAAA,EAAc;AAC5B,IAAA,MAAMK,CAAAA,GAAIR,GAAAA,CAAII,WAAAA,EAAW,GAAK,CAAA;AAC9B,IAAA,MAAMK,IAAAA,GAAO,IAAI7H,IAAAA,CAAKA,IAAAA,CAAKqH,IAAIM,CAAAA,EAAGC,CAAAA,EAAG,CAAA,CAAA,CAAA;AACrC,IAAA,MAAME,SAAAA,GAAYjB,oBAAAA,CAAqB7C,IAAAA,CAAK8C,KAAAA,EAAOa,GAAGC,CAAAA,CAAAA;AACtD,IAAA,MAAMG,QAAQ,CAAA,EAAGJ,CAAAA,CAAAA,CAAAA,EAAKf,IAAAA,CAAKgB,CAAAA,CAAAA,CAAAA,GAAAA,CAAAA;AAC3B,IAAA,MAAMI,KAAAA,GAAQ,CAAA,EAAGH,IAAAA,CAAKN,cAAAA,EAAc,CAAA,CAAA,EAAMX,IAAAA,CAAKiB,IAAAA,CAAKL,WAAAA,EAAW,GAAK,CAAA,CAAA,CAAA,GAAA,CAAA;AACpE,IAAA,MAAMN,MAAAA,CAAOe,iBAAAA,CACX,CAAA,4BAAA,EAA+BH,SAAAA,CAAAA,gBAAAA,EAA4B9D,IAAAA,CAAK8C,KAAK,CAAA,oBAAA,EAAuBiB,KAAAA,CAAAA,QAAAA,EAAgBC,KAAAA,CAAAA,GAAAA,CAAU,CAAA;AAExHb,IAAAA,OAAAA,CAAQe,KAAKJ,SAAAA,CAAAA;AACbV,IAAAA,GAAAA,CAAIe,WAAAA,CAAYf,GAAAA,CAAII,WAAAA,EAAW,GAAK,CAAA,CAAA;AACtC,EAAA;AACA,EAAA,OAAOL,OAAAA;AACT;AAlBsBF,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA6BtB,eAAsBmB,iBAAAA,CAAkBlB,QAAyBlD,IAAAA,EAAoB;AAEnF,EAAA,MAAMqE,IAAAA,GAAO,MAAMnB,MAAAA,CAAOoB,eAAAA,CACxB,CAAA;;;;AAKAtE,8BAAAA,CAAAA,EAAAA,IAAAA,CAAK8C,KAAK,CAAA;AAEZ,EAAA,MAAMyB,UAAoB,EAAA;AAC1B,EAAA,MAAMC,UAAAA,GAAaxE,IAAAA,CAAKyE,UAAAA,CAAWlB,cAAAA,EAAc;AACjD,EAAA,MAAMmB,WAAAA,GAAc1E,IAAAA,CAAKyE,UAAAA,CAAWjB,WAAAA,EAAW,GAAK,CAAA;AACpD,EAAA,KAAA,MAAWmB,OAAON,IAAAA,EAAM;AACtB,IAAA,MAAMO,WAAAA,GAAc,oBAAA;AACpB,IAAA,MAAMhB,CAAAA,GAAIgB,WAAAA,CAAYC,IAAAA,CAAKF,GAAAA,CAAIG,cAAc,CAAA;AAC7C,IAAA,IAAI,CAAClB,CAAAA,EAAG;AACR,IAAA,MAAMD,CAAAA,GAAItD,MAAAA,CAAOuD,CAAAA,CAAE,CAAA,CAAE,CAAA;AACrB,IAAA,MAAMmB,EAAAA,GAAK1E,MAAAA,CAAOuD,CAAAA,CAAE,CAAA,CAAE,CAAA;AACtB,IAAA,IAAID,CAAAA,GAAIa,UAAAA,IAAeb,CAAAA,KAAMa,UAAAA,IAAcO,KAAKL,WAAAA,EAAc;AAC5D,MAAA,MAAMxB,MAAAA,CAAOe,iBAAAA,CAAkB,CAAA,sBAAA,EAAyBU,GAAAA,CAAIG,cAAc,CAAA,EAAA,CAAI,CAAA;AAC9EP,MAAAA,OAAAA,CAAQL,IAAAA,CAAKS,IAAIG,cAAc,CAAA;AACjC,IAAA;AACF,EAAA;AACA,EAAA,OAAOP,OAAAA;AACT;AAzBsBH,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;;;ACbtB,IAAMY,QAAAA,GAAuC;EAC3C/J,SAAAA,EAAW,GAAA;EACXgK,WAAAA,EAAa,CAAA;EACb1I,cAAAA,EAAgB,GAAA;EAChB2I,kBAAAA,EAAoB;AACtB,CAAA;AAEA,SAASlL,QAAOoI,CAAAA,EAAS;AACvB,EAAA,OAAOlI,IAAAA,CAAKC,KAAAA,CAAMD,IAAAA,CAAKE,MAAAA,KAAWgI,CAAAA,CAAAA;AACpC;AAFSpI,MAAAA,CAAAA,OAAAA,EAAAA,QAAAA,CAAAA;AAIT,SAASK,OAAMC,EAAAA,EAAU;AACvB,EAAA,OAAO,IAAIC,OAAAA,CAAQ,CAACC,MAAMC,UAAAA,CAAWD,CAAAA,EAAGF,EAAAA,CAAAA,CAAAA;AAC1C;AAFSD,MAAAA,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA;AAIF,IAAM8K,YAAN,MAAMA;EA/Db;;;AAgEmBC,EAAAA,QAAAA,uBAAgDlM,GAAAA,EAAAA;AAChD8G,EAAAA,IAAAA;EAEjB,WAAA,CAAYA,IAAAA,GAAyB,EAAC,EAAG;AACvC,IAAA,IAAA,CAAKA,IAAAA,GAAO;MAAE,GAAGgF,QAAAA;MAAU,GAAGhF;AAAK,KAAA;AACrC,EAAA;AAEAqF,EAAAA,QAAAA,CAASC,OAAAA,EAAmC;AAC1C,IAAA,IAAA,CAAKF,QAAAA,CAASvL,GAAAA,CAAIyL,OAAAA,CAAQ1K,IAAAA,EAAM0K,OAAAA,CAAAA;AAClC,EAAA;EAEQC,YAAAA,GAAyB;AAC/B,IAAA,MAAMC,QAAAA,GAAW5H,OAAAA,CAAQ6H,GAAAA,CAAI,oBAAA,GAAuBC,IAAAA,EAAAA;AACpD,IAAA,IAAIF,QAAAA,EAAU;AACZ,MAAA,OAAOA,QAAAA,CACJG,KAAAA,CAAM,GAAA,CAAA,CACNC,GAAAA,CAAI,CAACC,CAAAA,KAAMA,CAAAA,CAAEH,IAAAA,EAAI,CAAA,CACjBI,MAAAA,CAAOC,OAAAA,CAAAA;AACZ,IAAA;AACA,IAAA,OAAOC,KAAAA,CAAM1C,IAAAA,CAAK,IAAA,CAAK8B,QAAAA,CAASa,MAAI,CAAA;AACtC,EAAA;AAEA,EAAA,MAAMC,SAASC,GAAAA,EAAuC;AACpD,IAAA,MAAMC,SAAAA,GAAwB;MAC5B,GAAGD,GAAAA;MACHE,SAAAA,EAAWnM,IAAAA,CAAKgD,IAAIiJ,GAAAA,CAAIE,SAAAA,IAAa,KAAKrG,IAAAA,CAAKkF,kBAAAA,EAAoB,IAAA,CAAKlF,IAAAA,CAAKkF,kBAAkB;AACjG,KAAA;AACA,IAAA,MAAMoB,KAAAA,GAAQ,KAAKf,YAAAA,EAAY;AAC/B,IAAA,IAAIe,KAAAA,CAAMnF,WAAW,CAAA,EAAG;AACtB,MAAA,MAAM,IAAIxG,MAAM,oCAAA,CAAA;AAClB,IAAA;AAEA,IAAA,IAAImC,OAAAA,GAAmB,IAAA;AACvB,IAAA,KAAA,IAASC,UAAU,CAAA,EAAGA,OAAAA,GAAU,IAAA,CAAKiD,IAAAA,CAAKiF,aAAalI,OAAAA,EAAAA,EAAW;AAChE,MAAA,MAAMwJ,YAAAA,GAAeD,KAAAA,CAAMvJ,OAAAA,GAAUuJ,KAAAA,CAAMnF,MAAM,CAAA;AACjD,MAAA,MAAMmE,UAAUiB,YAAAA,GAAe,IAAA,CAAKnB,QAAAA,CAAS3L,GAAAA,CAAI8M,YAAAA,CAAAA,GAAgB7F,MAAAA;AACjE,MAAA,IAAI,CAAC4E,OAAAA,EAAS;AACZpJ,QAAAA,MAAAA,CAAOe,KAAK,kCAAA,EAAoC;AAAEsJ,UAAAA;SAAa,CAAA;AAC/D,QAAA;AACF,MAAA;AACA,MAAA,MAAMtL,SAAAA,GAAYkL,GAAAA,CAAIlL,SAAAA,IAAa,IAAA,CAAK+E,IAAAA,CAAK/E,SAAAA;AAC7C,MAAA,MAAMuL,IAAAA,GAAO,IAAIC,eAAAA,EAAAA;AACjB,MAAA,MAAMC,IAAIjM,UAAAA,CAAW,MAAM+L,IAAAA,CAAKG,KAAAA,IAAS1L,SAAAA,CAAAA;AACzC,MAAA,IAAI;AACF,QAAA,MAAM+B,WAAW,MAAMsI,OAAAA,CAAQY,QAAAA,CAASE,SAAAA,EAAWI,KAAKtL,MAAM,CAAA;AAC9D,QAAA,OAAO8B,QAAAA;AACT,MAAA,CAAA,CAAA,OAASG,GAAAA,EAAK;AACZL,QAAAA,OAAAA,GAAUK,GAAAA;AACVjB,QAAAA,MAAAA,CAAOe,KAAK,0BAAA,EAA4B;AAAE2J,UAAAA,QAAAA,EAAUtB,OAAAA,CAAQ1K,IAAAA;AAAMmC,UAAAA,OAAAA;AAASI,UAAAA,GAAAA,EAAKE,OAAOF,GAAAA;SAAK,CAAA;AAC5F,QAAA,IAAIJ,OAAAA,GAAU,IAAA,CAAKiD,IAAAA,CAAKiF,WAAAA,GAAc,CAAA,EAAG;AACvC,UAAA,MAAMhL,KAAAA,GAAQ,IAAA,CAAK+F,IAAAA,CAAKzD,cAAAA,GAAiB,CAAA,IAAKQ,OAAAA;AAC9C,UAAA,MAAM1C,MAAAA,CAAML,OAAAA,CAAOC,KAAAA,CAAAA,CAAAA;AACrB,QAAA;MACF,CAAA,SAAA;AACE4M,QAAAA,YAAAA,CAAaH,CAAAA,CAAAA;AACf,MAAA;AACF,IAAA;AACA,IAAA,MAAM5J,OAAAA,YAAmBnC,QAAQmC,OAAAA,GAAU,IAAInC,MAAM,CAAA,oBAAA,EAAuB,IAAA,CAAKqF,IAAAA,CAAKiF,WAAW,CAAA,SAAA,CAAW,CAAA;AAC9G,EAAA;AACF","file":"chunk-PHKK7725.js","sourcesContent":["/**\n * @burdenoff/be-sdk/platform\n *\n * Reusable platform primitives consumed fleet-wide by Burdenoff svcs.\n */\nexport { httpClient, createHttpClient, CircuitBreakerOpenError, __resetHttpClientBreakers } from './httpClient.js';\nexport type { HttpClientConfig, HttpClientInit, RetryConfig, BreakerConfig } from './httpClient.js';\n\nexport { withLeaderLock } from './leaderLock.js';\nexport type { LeaderLockRedis, LeaderLockOptions, LeaderLockResult } from './leaderLock.js';\n\nexport { rateLimitIncr } from './rateLimit.js';\nexport type { RateLimitRedis, RateLimitInput, RateLimitResult } from './rateLimit.js';\n\nexport { clampLimit, paginate } from './paginator.js';\nexport type { ClampLimitOptions, PaginateInput, PaginateResult, PrismaModelLike } from './paginator.js';\n\nexport { buildLoaders, resolveReferenceLoader } from './dataLoaderFactory.js';\nexport type { DataLoaderLike, LoaderMap, LoaderBuilder, ReferenceObject } from './dataLoaderFactory.js';\n\nexport { buildCacheKey, getNamespaceVersion, invalidateNamespace } from './cacheInvalidation.js';\nexport type { CacheVersionRedis } from './cacheInvalidation.js';\n\nexport { monthlyPartitionName, ensureMonthlyPartitions, dropOldPartitions } from './pgPartition.js';\nexport type { PrismaRawClient, EnsureMonthlyOptions, DropOldOptions } from './pgPartition.js';\n\nexport { LLMRouter } from './llmClient.js';\nexport type { LLMRequest, LLMResponse, LLMProviderAdapter, LLMRouterOptions } from './llmClient.js';\n","/**\n * httpClient — hardened wrapper around global `fetch` with:\n * - per-request AbortSignal.timeout (default 5s)\n * - retries (default 3) with exponential backoff + full jitter\n * - per-host circuit breaker (opens at 5 consecutive 5xx, half-open after 30s)\n * - structured logging via existing be-sdk logger\n *\n * No required upstream dependency — we use the runtime `fetch` so the same\n * code path works on Bun and Node 20+. Consumers may pass an undici Agent\n * via `init.dispatcher` if they need keep-alive pooling; we forward unknown\n * init fields through.\n */\n\nimport { logger } from '../logger/index.js';\n\nexport interface RetryConfig {\n /** Total attempts including the first (default 3) */\n attempts?: number;\n /** Initial backoff in ms (default 100) */\n initialDelayMs?: number;\n /** Maximum backoff in ms (default 2000) */\n maxDelayMs?: number;\n /** Status codes that trigger a retry (default 408, 425, 429, 5xx) */\n retryOn?: (status: number) => boolean;\n}\n\nexport interface BreakerConfig {\n /** Consecutive 5xx failures to open breaker (default 5) */\n threshold?: number;\n /** Time in ms before HALF_OPEN trial (default 30000) */\n cooldownMs?: number;\n}\n\nexport interface HttpClientConfig {\n baseUrl?: string;\n defaultTimeoutMs?: number;\n retry?: RetryConfig;\n breaker?: BreakerConfig;\n /** Default headers merged into every request */\n defaultHeaders?: Record<string, string>;\n}\n\ninterface BreakerState {\n failures: number;\n openedAt: number | null;\n state: 'CLOSED' | 'OPEN' | 'HALF_OPEN';\n}\n\nconst breakers = new Map<string, BreakerState>();\n\nfunction hostOf(url: string): string {\n try {\n return new URL(url).host;\n } catch {\n return url;\n }\n}\n\nfunction getBreaker(host: string): BreakerState {\n let b = breakers.get(host);\n if (!b) {\n b = { failures: 0, openedAt: null, state: 'CLOSED' };\n breakers.set(host, b);\n }\n return b;\n}\n\nfunction defaultRetryOn(status: number): boolean {\n return status === 408 || status === 425 || status === 429 || (status >= 500 && status <= 599);\n}\n\nfunction jitter(delay: number): number {\n return Math.floor(Math.random() * delay);\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((r) => setTimeout(r, ms));\n}\n\nexport class CircuitBreakerOpenError extends Error {\n constructor(host: string) {\n super(`circuit breaker OPEN for host=${host}`);\n this.name = 'CircuitBreakerOpenError';\n }\n}\n\nexport interface HttpClientInit extends RequestInit {\n timeoutMs?: number;\n retry?: RetryConfig;\n}\n\n/**\n * Reset all breaker state (test helper).\n */\nexport function __resetHttpClientBreakers(): void {\n breakers.clear();\n}\n\nasync function executeOnce(url: string, init: HttpClientInit, timeoutMs: number): Promise<Response> {\n const signal = init.signal ?? AbortSignal.timeout(timeoutMs);\n return fetch(url, { ...init, signal });\n}\n\nexport async function httpClient(\n url: string,\n init: HttpClientInit = {},\n config: HttpClientConfig = {}\n): Promise<Response> {\n const fullUrl =\n config.baseUrl && !/^https?:\\/\\//i.test(url)\n ? `${config.baseUrl.replace(/\\/$/, '')}/${url.replace(/^\\//, '')}`\n : url;\n const host = hostOf(fullUrl);\n const breaker = getBreaker(host);\n const breakerThreshold = config.breaker?.threshold ?? 5;\n const cooldownMs = config.breaker?.cooldownMs ?? 30_000;\n\n if (breaker.state === 'OPEN') {\n if (breaker.openedAt && Date.now() - breaker.openedAt >= cooldownMs) {\n breaker.state = 'HALF_OPEN';\n logger.info('httpClient.breaker.halfOpen', { host });\n } else {\n throw new CircuitBreakerOpenError(host);\n }\n }\n\n const attempts = init.retry?.attempts ?? config.retry?.attempts ?? 3;\n const initialDelay = init.retry?.initialDelayMs ?? config.retry?.initialDelayMs ?? 100;\n const maxDelay = init.retry?.maxDelayMs ?? config.retry?.maxDelayMs ?? 2_000;\n const retryOn = init.retry?.retryOn ?? config.retry?.retryOn ?? defaultRetryOn;\n const timeoutMs = init.timeoutMs ?? config.defaultTimeoutMs ?? 5_000;\n\n const headers = { ...(config.defaultHeaders ?? {}), ...((init.headers as Record<string, string> | undefined) ?? {}) };\n\n let lastErr: unknown;\n for (let attempt = 1; attempt <= attempts; attempt++) {\n try {\n const response = await executeOnce(fullUrl, { ...init, headers }, timeoutMs);\n if (response.status >= 500) {\n breaker.failures += 1;\n if (breaker.failures >= breakerThreshold) {\n breaker.state = 'OPEN';\n breaker.openedAt = Date.now();\n logger.warn('httpClient.breaker.open', { host, failures: breaker.failures });\n }\n if (attempt < attempts && retryOn(response.status)) {\n const delay = Math.min(initialDelay * 2 ** (attempt - 1), maxDelay);\n await sleep(jitter(delay));\n continue;\n }\n return response;\n }\n // success path\n breaker.failures = 0;\n if (breaker.state === 'HALF_OPEN') {\n breaker.state = 'CLOSED';\n breaker.openedAt = null;\n logger.info('httpClient.breaker.closed', { host });\n }\n if (attempt < attempts && retryOn(response.status)) {\n const delay = Math.min(initialDelay * 2 ** (attempt - 1), maxDelay);\n await sleep(jitter(delay));\n continue;\n }\n return response;\n } catch (err) {\n lastErr = err;\n breaker.failures += 1;\n if (breaker.failures >= breakerThreshold) {\n breaker.state = 'OPEN';\n breaker.openedAt = Date.now();\n logger.warn('httpClient.breaker.open', { host, failures: breaker.failures });\n }\n if (attempt >= attempts) break;\n const delay = Math.min(initialDelay * 2 ** (attempt - 1), maxDelay);\n await sleep(jitter(delay));\n }\n }\n\n logger.error('httpClient.exhausted', { url: fullUrl, attempts, host });\n throw lastErr instanceof Error ? lastErr : new Error(`httpClient failed: ${String(lastErr)}`);\n}\n\nexport function createHttpClient(\n config: HttpClientConfig = {}\n): (url: string, init?: HttpClientInit) => Promise<Response> {\n return (url: string, init: HttpClientInit = {}) => httpClient(url, init, config);\n}\n","/**\n * withLeaderLock — Redis-based leader election.\n *\n * Acquires `SET NX EX` on `besdk:leader:{name}`. If acquired, runs fn() and\n * auto-renews the lease every `renewMs` (default ttlMs/3). On exit (success\n * or throw) the holder DELs the key only if it still owns it (token check\n * via a Redis LUA script — Redis-side, NOT JS eval).\n * If the lock cannot be acquired, fn() is NOT called and the function\n * resolves with `{ acquired: false }`.\n *\n * Redis client is duck-typed (ioredis-compatible) so consumers can pass\n * either ioredis or the be-sdk cache provider's underlying client.\n */\n\nimport { logger } from '../logger/index.js';\n\nexport interface LeaderLockRedis {\n /** ioredis: set(key, val, 'EX', seconds, 'NX') -> 'OK' | null */\n set(key: string, value: string, ex: 'EX', seconds: number, nx: 'NX'): Promise<'OK' | null>;\n /** Redis LUA EVAL for compare-and-delete / compare-and-renew (server-side script) */\n eval(script: string, numKeys: number, ...args: string[]): Promise<unknown>;\n}\n\nexport interface LeaderLockOptions {\n ttlMs: number;\n renewMs?: number;\n}\n\nexport interface LeaderLockResult<T> {\n acquired: boolean;\n result?: T;\n}\n\nconst RELEASE_LUA = `\nif redis.call(\"get\", KEYS[1]) == ARGV[1] then\n return redis.call(\"del\", KEYS[1])\nelse\n return 0\nend\n`;\n\nconst RENEW_LUA = `\nif redis.call(\"get\", KEYS[1]) == ARGV[1] then\n return redis.call(\"pexpire\", KEYS[1], ARGV[2])\nelse\n return 0\nend\n`;\n\nfunction generateToken(): string {\n return `${Date.now()}-${Math.random().toString(36).slice(2)}-${process.pid}`;\n}\n\nexport async function withLeaderLock<T>(\n redis: LeaderLockRedis,\n name: string,\n fn: () => Promise<T>,\n options: LeaderLockOptions\n): Promise<LeaderLockResult<T>> {\n const key = `besdk:leader:${name}`;\n const token = generateToken();\n const ttlMs = options.ttlMs;\n const renewMs = options.renewMs ?? Math.max(1_000, Math.floor(ttlMs / 3));\n const ttlSeconds = Math.max(1, Math.ceil(ttlMs / 1000));\n\n const acquired = await redis.set(key, token, 'EX', ttlSeconds, 'NX');\n if (acquired !== 'OK') {\n return { acquired: false };\n }\n\n logger.info('leaderLock.acquired', { name, token, ttlMs });\n\n let stopped = false;\n const renewTimer = setInterval(() => {\n if (stopped) return;\n redis.eval(RENEW_LUA, 1, key, token, String(ttlMs)).catch((err: unknown) => {\n logger.warn('leaderLock.renew.failed', { name, err: String(err) });\n });\n }, renewMs);\n // Don't keep the process alive just for this timer.\n if (typeof (renewTimer as unknown as { unref?: () => void }).unref === 'function') {\n (renewTimer as unknown as { unref: () => void }).unref();\n }\n\n try {\n const result = await fn();\n return { acquired: true, result };\n } finally {\n stopped = true;\n clearInterval(renewTimer);\n try {\n await redis.eval(RELEASE_LUA, 1, key, token);\n logger.info('leaderLock.released', { name, token });\n } catch (err) {\n logger.warn('leaderLock.release.failed', { name, err: String(err) });\n }\n }\n}\n","/**\n * rateLimitIncr — atomic INCR-based rate limit using EXPIRE NX.\n *\n * Strategy:\n * 1. INCR key\n * 2. If returned value === 1 (i.e. first increment), EXPIRE key with windowMs\n * 3. Compute remaining + resetAt\n *\n * This is two round-trips in the worst case. A future Lua/EVALSHA variant\n * can collapse it into a single round-trip; the public API is stable.\n *\n * Returns `allowed=false` if `count > limit`. The key is `besdk:rl:{key}`.\n */\n\nexport interface RateLimitRedis {\n incr(key: string): Promise<number>;\n pexpire(key: string, ms: number): Promise<number | 'OK'>;\n pttl(key: string): Promise<number>;\n}\n\nexport interface RateLimitInput {\n key: string;\n limit: number;\n windowMs: number;\n}\n\nexport interface RateLimitResult {\n allowed: boolean;\n count: number;\n remaining: number;\n resetAt: number;\n}\n\nexport async function rateLimitIncr(redis: RateLimitRedis, input: RateLimitInput): Promise<RateLimitResult> {\n const fullKey = `besdk:rl:${input.key}`;\n const count = await redis.incr(fullKey);\n if (count === 1) {\n await redis.pexpire(fullKey, input.windowMs);\n }\n let ttl = -1;\n try {\n ttl = await redis.pttl(fullKey);\n } catch {\n ttl = input.windowMs;\n }\n const resetAt = Date.now() + (ttl > 0 ? ttl : input.windowMs);\n const remaining = Math.max(0, input.limit - count);\n return {\n allowed: count <= input.limit,\n count,\n remaining,\n resetAt,\n };\n}\n","/**\n * Paginator — Relay-style cursor pagination + safe limit clamping.\n *\n * Use `clampLimit` at resolver entry to enforce sane defaults/maxes.\n * Use `paginate` to translate a Relay-style { first, after } into a\n * Prisma-ready { take, skip, cursor } and return a connection-shaped\n * result.\n */\n\nexport interface ClampLimitOptions {\n defaultLimit?: number;\n maxLimit?: number;\n minLimit?: number;\n}\n\nexport function clampLimit(input: number | undefined | null, opts: ClampLimitOptions = {}): number {\n const def = opts.defaultLimit ?? 50;\n const max = opts.maxLimit ?? 200;\n const min = opts.minLimit ?? 1;\n if (input == null || Number.isNaN(input)) return def;\n return Math.min(Math.max(Math.floor(input), min), max);\n}\n\nexport interface PaginateInput<TWhere, TOrderBy> {\n take?: number | null;\n cursor?: string | null;\n where?: TWhere;\n orderBy?: TOrderBy;\n}\n\nexport interface PaginateResult<TItem> {\n items: TItem[];\n hasMore: boolean;\n nextCursor: string | null;\n}\n\nexport interface PrismaModelLike<TItem, TWhere, TOrderBy> {\n findMany(args: {\n take?: number;\n skip?: number;\n cursor?: { id: string };\n where?: TWhere;\n orderBy?: TOrderBy;\n }): Promise<TItem[]>;\n}\n\nexport async function paginate<TItem extends { id: string }, TWhere = unknown, TOrderBy = unknown>(\n model: PrismaModelLike<TItem, TWhere, TOrderBy>,\n input: PaginateInput<TWhere, TOrderBy>,\n opts: ClampLimitOptions = {}\n): Promise<PaginateResult<TItem>> {\n const take = clampLimit(input.take ?? undefined, opts);\n // fetch +1 to detect hasMore\n const items = await model.findMany({\n take: take + 1,\n skip: input.cursor ? 1 : 0,\n cursor: input.cursor ? { id: input.cursor } : undefined,\n where: input.where,\n orderBy: input.orderBy,\n });\n const hasMore = items.length > take;\n const trimmed = hasMore ? items.slice(0, take) : items;\n const nextCursor = hasMore && trimmed.length > 0 ? (trimmed[trimmed.length - 1] as { id: string }).id : null;\n return { items: trimmed, hasMore, nextCursor };\n}\n","/**\n * DataLoaderFactory — per-request DataLoader collection.\n *\n * Each GraphQL request creates a fresh loader set scoped to its context\n * (db, workspaceId, requestId). Loaders are addressed by name and reused\n * within the request to coalesce N+1 fan-outs into a single batched query.\n *\n * Also ships `resolveReferenceLoader` — a convenience for Apollo Federation\n * `__resolveReference` resolvers so entity hydration stays N+1-free.\n *\n * This module is intentionally framework-agnostic; consumers may pair it\n * with the existing `SimpleDataLoader` in `src/dataloader/index.ts` or the\n * upstream `dataloader` npm package.\n */\n\nexport interface DataLoaderLike<K, V> {\n load(key: K): Promise<V>;\n loadMany(keys: readonly K[]): Promise<(V | Error)[]>;\n clear(key: K): this;\n clearAll(): this;\n prime(key: K, value: V): this;\n}\n\nexport type LoaderMap = Record<string, DataLoaderLike<unknown, unknown>>;\n\nexport type LoaderBuilder<Ctx, M extends LoaderMap> = (ctx: Ctx) => M;\n\n/**\n * Build a fresh loader collection from a context.\n *\n * @example\n * const loaders = buildLoaders(ctx, (c) => ({\n * userById: createSimpleLoader(async ids => c.db.user.findMany({ where: { id: { in: [...ids] } } }), u => u.id),\n * tagById: createSimpleLoader(...),\n * }));\n * await loaders.userById.load('user-123');\n */\nexport function buildLoaders<Ctx, M extends LoaderMap>(ctx: Ctx, builder: LoaderBuilder<Ctx, M>): M {\n return builder(ctx);\n}\n\n/**\n * `__resolveReference` helper for Apollo Federation.\n *\n * Given a context that contains a `loaders` map, returns a resolver\n * function bound to a specific loader name. Field references shaped as\n * `{ id: string }` (or `{ __keyField: string }`) are forwarded to\n * `loader.load(...)`.\n */\nexport interface ReferenceObject {\n id?: string;\n [key: string]: unknown;\n}\n\nexport function resolveReferenceLoader<T, Ctx extends { loaders: LoaderMap }>(\n loaderName: string,\n keyField: string = 'id'\n): (reference: ReferenceObject, ctx: Ctx) => Promise<T | null> {\n return async (reference, ctx) => {\n const loader = ctx.loaders[loaderName] as DataLoaderLike<string, T> | undefined;\n if (!loader) {\n throw new Error(`resolveReferenceLoader: loader \"${loaderName}\" not found on ctx.loaders`);\n }\n const key = reference[keyField];\n if (typeof key !== 'string') {\n return null;\n }\n return loader.load(key);\n };\n}\n","/**\n * Versioned-key cache invalidation helper.\n *\n * Pattern:\n * - Store `v:{namespace}` integer in Redis\n * - Compose keys as `${namespace}:v${ver}:${rest}`\n * - Invalidate via INCR `v:{namespace}` — no KEYS / SCAN required\n *\n * Use this instead of cacheClearPattern() for Azure Managed Redis (O(N)\n * blocking on KEYS is unsafe in prod).\n */\n\nexport interface CacheVersionRedis {\n get(key: string): Promise<string | null>;\n incr(key: string): Promise<number>;\n}\n\nconst VERSION_PREFIX = 'besdk:cv:';\n\nexport async function getNamespaceVersion(redis: CacheVersionRedis, namespace: string): Promise<number> {\n const v = await redis.get(`${VERSION_PREFIX}${namespace}`);\n if (!v) return 1;\n const n = Number.parseInt(v, 10);\n return Number.isFinite(n) && n > 0 ? n : 1;\n}\n\nexport async function buildCacheKey(redis: CacheVersionRedis, namespace: string, ...parts: string[]): Promise<string> {\n const ver = await getNamespaceVersion(redis, namespace);\n return `${namespace}:v${ver}:${parts.join(':')}`;\n}\n\nexport async function invalidateNamespace(redis: CacheVersionRedis, namespace: string): Promise<number> {\n return redis.incr(`${VERSION_PREFIX}${namespace}`);\n}\n","/**\n * PG declarative partition + retention DSL.\n *\n * Helpers:\n * - ensureMonthlyPartitions(prisma, { table, from, to })\n * - dropOldPartitions(prisma, { table, beforeDate })\n *\n * Used by retention jobs / migrations to keep append-only tables\n * (ActivityLog, Message, TrackingEvent, ApplicationUsage, AuditLog)\n * bounded. Caller is responsible for ensuring the parent table is\n * already declared as PARTITION BY RANGE (created_at).\n */\n\nexport interface PrismaRawClient {\n $executeRawUnsafe(query: string, ...values: unknown[]): Promise<unknown>;\n $queryRawUnsafe<T = unknown>(query: string, ...values: unknown[]): Promise<T>;\n}\n\nfunction pad2(n: number): string {\n return n < 10 ? `0${n}` : `${n}`;\n}\n\nexport function monthlyPartitionName(table: string, year: number, month: number): string {\n return `${table}_y${year}m${pad2(month)}`;\n}\n\nexport interface EnsureMonthlyOptions {\n table: string;\n from: Date;\n to: Date;\n}\n\nexport async function ensureMonthlyPartitions(prisma: PrismaRawClient, opts: EnsureMonthlyOptions): Promise<string[]> {\n const created: string[] = [];\n const cur = new Date(Date.UTC(opts.from.getUTCFullYear(), opts.from.getUTCMonth(), 1));\n const end = new Date(Date.UTC(opts.to.getUTCFullYear(), opts.to.getUTCMonth(), 1));\n while (cur <= end) {\n const y = cur.getUTCFullYear();\n const m = cur.getUTCMonth() + 1;\n const next = new Date(Date.UTC(y, m, 1));\n const partition = monthlyPartitionName(opts.table, y, m);\n const lower = `${y}-${pad2(m)}-01`;\n const upper = `${next.getUTCFullYear()}-${pad2(next.getUTCMonth() + 1)}-01`;\n await prisma.$executeRawUnsafe(\n `CREATE TABLE IF NOT EXISTS \"${partition}\" PARTITION OF \"${opts.table}\" FOR VALUES FROM ('${lower}') TO ('${upper}');`\n );\n created.push(partition);\n cur.setUTCMonth(cur.getUTCMonth() + 1);\n }\n return created;\n}\n\nexport interface DropOldOptions {\n table: string;\n beforeDate: Date;\n}\n\ninterface PartitionRow {\n partition_name: string;\n}\n\nexport async function dropOldPartitions(prisma: PrismaRawClient, opts: DropOldOptions): Promise<string[]> {\n // Find inherited tables of the parent, parse year/month from suffix, drop ones before threshold.\n const rows = await prisma.$queryRawUnsafe<PartitionRow[]>(\n `SELECT child.relname AS partition_name\n FROM pg_inherits\n JOIN pg_class parent ON pg_inherits.inhparent = parent.oid\n JOIN pg_class child ON pg_inherits.inhrelid = child.oid\n WHERE parent.relname = $1`,\n opts.table\n );\n const dropped: string[] = [];\n const cutoffYear = opts.beforeDate.getUTCFullYear();\n const cutoffMonth = opts.beforeDate.getUTCMonth() + 1;\n for (const row of rows) {\n const partitionRe = /_y(\\d{4})m(\\d{2})$/;\n const m = partitionRe.exec(row.partition_name);\n if (!m) continue;\n const y = Number(m[1]);\n const mo = Number(m[2]);\n if (y < cutoffYear || (y === cutoffYear && mo < cutoffMonth)) {\n await prisma.$executeRawUnsafe(`DROP TABLE IF EXISTS \"${row.partition_name}\";`);\n dropped.push(row.partition_name);\n }\n }\n return dropped;\n}\n","/**\n * Multi-provider LLM wrapper with timeout, retries, jitter, provider\n * fallback chain, token cap, and streaming passthrough.\n *\n * No hard dependency on a specific SDK — consumers register adapters.\n * Provider chain order is controlled by env `LLM_PROVIDER_CHAIN`\n * (comma-separated, e.g. `anthropic,openai,openrouter`).\n *\n * The wrapper is intentionally minimal — callers should construct it\n * once at boot, register adapters, and inject the singleton.\n */\n\nimport { logger } from '../logger/index.js';\n\nexport interface LLMRequest {\n model?: string;\n messages: Array<{ role: 'system' | 'user' | 'assistant'; content: string }>;\n maxTokens?: number;\n temperature?: number;\n stream?: boolean;\n /** Override timeout for this request. */\n timeoutMs?: number;\n}\n\nexport interface LLMResponse {\n provider: string;\n content: string;\n inputTokens?: number;\n outputTokens?: number;\n raw?: unknown;\n}\n\nexport interface LLMProviderAdapter {\n name: string;\n complete(req: LLMRequest, signal: AbortSignal): Promise<LLMResponse>;\n}\n\nexport interface LLMRouterOptions {\n /** Default per-attempt timeout (ms). */\n timeoutMs?: number;\n /** Max attempts across providers. */\n maxAttempts?: number;\n /** Initial backoff (ms). */\n initialDelayMs?: number;\n /** Hard cap on output tokens regardless of caller request. */\n maxOutputTokensCap?: number;\n}\n\nconst DEFAULTS: Required<LLMRouterOptions> = {\n timeoutMs: 30_000,\n maxAttempts: 3,\n initialDelayMs: 500,\n maxOutputTokensCap: 4096,\n};\n\nfunction jitter(n: number): number {\n return Math.floor(Math.random() * n);\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((r) => setTimeout(r, ms));\n}\n\nexport class LLMRouter {\n private readonly adapters: Map<string, LLMProviderAdapter> = new Map();\n private readonly opts: Required<LLMRouterOptions>;\n\n constructor(opts: LLMRouterOptions = {}) {\n this.opts = { ...DEFAULTS, ...opts };\n }\n\n register(adapter: LLMProviderAdapter): void {\n this.adapters.set(adapter.name, adapter);\n }\n\n private resolveChain(): string[] {\n const envChain = process.env['LLM_PROVIDER_CHAIN']?.trim();\n if (envChain) {\n return envChain\n .split(',')\n .map((s) => s.trim())\n .filter(Boolean);\n }\n return Array.from(this.adapters.keys());\n }\n\n async complete(req: LLMRequest): Promise<LLMResponse> {\n const cappedReq: LLMRequest = {\n ...req,\n maxTokens: Math.min(req.maxTokens ?? this.opts.maxOutputTokensCap, this.opts.maxOutputTokensCap),\n };\n const chain = this.resolveChain();\n if (chain.length === 0) {\n throw new Error('LLMRouter: no providers registered');\n }\n\n let lastErr: unknown = null;\n for (let attempt = 0; attempt < this.opts.maxAttempts; attempt++) {\n const providerName = chain[attempt % chain.length];\n const adapter = providerName ? this.adapters.get(providerName) : undefined;\n if (!adapter) {\n logger.warn('llmRouter.provider.notRegistered', { providerName });\n continue;\n }\n const timeoutMs = req.timeoutMs ?? this.opts.timeoutMs;\n const ctrl = new AbortController();\n const t = setTimeout(() => ctrl.abort(), timeoutMs);\n try {\n const response = await adapter.complete(cappedReq, ctrl.signal);\n return response;\n } catch (err) {\n lastErr = err;\n logger.warn('llmRouter.attempt.failed', { provider: adapter.name, attempt, err: String(err) });\n if (attempt < this.opts.maxAttempts - 1) {\n const delay = this.opts.initialDelayMs * 2 ** attempt;\n await sleep(jitter(delay));\n }\n } finally {\n clearTimeout(t);\n }\n }\n throw lastErr instanceof Error ? lastErr : new Error(`LLMRouter exhausted ${this.opts.maxAttempts} attempts`);\n }\n}\n"]}
package/dist/index-BQ1yJn1K.d.ts DELETED
@@ -1,222 +0,0 @@
1
- interface RetryConfig {
2
- attempts?: number;
3
- initialDelayMs?: number;
4
- maxDelayMs?: number;
5
- retryOn?: (status: number) => boolean;
6
- }
7
- interface BreakerConfig {
8
- threshold?: number;
9
- cooldownMs?: number;
10
- }
11
- interface HttpClientConfig {
12
- baseUrl?: string;
13
- defaultTimeoutMs?: number;
14
- retry?: RetryConfig;
15
- breaker?: BreakerConfig;
16
- defaultHeaders?: Record<string, string>;
17
- }
18
- declare class CircuitBreakerOpenError extends Error {
19
- constructor(host: string);
20
- }
21
- interface HttpClientInit extends RequestInit {
22
- timeoutMs?: number;
23
- retry?: RetryConfig;
24
- }
25
- declare function __resetHttpClientBreakers(): void;
26
- declare function httpClient(url: string, init?: HttpClientInit, config?: HttpClientConfig): Promise<Response>;
27
- declare function createHttpClient(config?: HttpClientConfig): (url: string, init?: HttpClientInit) => Promise<Response>;
28
-
29
- interface LeaderLockRedis {
30
- set(key: string, value: string, ex: 'EX', seconds: number, nx: 'NX'): Promise<'OK' | null>;
31
- eval(script: string, numKeys: number, ...args: string[]): Promise<unknown>;
32
- }
33
- interface LeaderLockOptions {
34
- ttlMs: number;
35
- renewMs?: number;
36
- }
37
- interface LeaderLockResult<T> {
38
- acquired: boolean;
39
- result?: T;
40
- }
41
- declare function withLeaderLock<T>(redis: LeaderLockRedis, name: string, fn: () => Promise<T>, options: LeaderLockOptions): Promise<LeaderLockResult<T>>;
42
-
43
- interface RateLimitRedis {
44
- incr(key: string): Promise<number>;
45
- pexpire(key: string, ms: number): Promise<number | 'OK'>;
46
- pttl(key: string): Promise<number>;
47
- }
48
- interface RateLimitInput {
49
- key: string;
50
- limit: number;
51
- windowMs: number;
52
- }
53
- interface RateLimitResult {
54
- allowed: boolean;
55
- count: number;
56
- remaining: number;
57
- resetAt: number;
58
- }
59
- declare function rateLimitIncr(redis: RateLimitRedis, input: RateLimitInput): Promise<RateLimitResult>;
60
-
61
- interface ClampLimitOptions {
62
- defaultLimit?: number;
63
- maxLimit?: number;
64
- minLimit?: number;
65
- }
66
- declare function clampLimit(input: number | undefined | null, opts?: ClampLimitOptions): number;
67
- interface PaginateInput<TWhere, TOrderBy> {
68
- take?: number | null;
69
- cursor?: string | null;
70
- where?: TWhere;
71
- orderBy?: TOrderBy;
72
- }
73
- interface PaginateResult<TItem> {
74
- items: TItem[];
75
- hasMore: boolean;
76
- nextCursor: string | null;
77
- }
78
- interface PrismaModelLike<TItem, TWhere, TOrderBy> {
79
- findMany(args: {
80
- take?: number;
81
- skip?: number;
82
- cursor?: {
83
- id: string;
84
- };
85
- where?: TWhere;
86
- orderBy?: TOrderBy;
87
- }): Promise<TItem[]>;
88
- }
89
- declare function paginate<TItem extends {
90
- id: string;
91
- }, TWhere = unknown, TOrderBy = unknown>(model: PrismaModelLike<TItem, TWhere, TOrderBy>, input: PaginateInput<TWhere, TOrderBy>, opts?: ClampLimitOptions): Promise<PaginateResult<TItem>>;
92
-
93
- interface DataLoaderLike<K, V> {
94
- load(key: K): Promise<V>;
95
- loadMany(keys: readonly K[]): Promise<(V | Error)[]>;
96
- clear(key: K): this;
97
- clearAll(): this;
98
- prime(key: K, value: V): this;
99
- }
100
- type LoaderMap = Record<string, DataLoaderLike<unknown, unknown>>;
101
- type LoaderBuilder<Ctx, M extends LoaderMap> = (ctx: Ctx) => M;
102
- declare function buildLoaders<Ctx, M extends LoaderMap>(ctx: Ctx, builder: LoaderBuilder<Ctx, M>): M;
103
- interface ReferenceObject {
104
- id?: string;
105
- [key: string]: unknown;
106
- }
107
- declare function resolveReferenceLoader<T, Ctx extends {
108
- loaders: LoaderMap;
109
- }>(loaderName: string, keyField?: string): (reference: ReferenceObject, ctx: Ctx) => Promise<T | null>;
110
-
111
- interface CacheVersionRedis {
112
- get(key: string): Promise<string | null>;
113
- incr(key: string): Promise<number>;
114
- }
115
- declare function getNamespaceVersion(redis: CacheVersionRedis, namespace: string): Promise<number>;
116
- declare function buildCacheKey(redis: CacheVersionRedis, namespace: string, ...parts: string[]): Promise<string>;
117
- declare function invalidateNamespace(redis: CacheVersionRedis, namespace: string): Promise<number>;
118
-
119
- interface PrismaRawClient {
120
- $executeRawUnsafe(query: string, ...values: unknown[]): Promise<unknown>;
121
- $queryRawUnsafe<T = unknown>(query: string, ...values: unknown[]): Promise<T>;
122
- }
123
- declare function monthlyPartitionName(table: string, year: number, month: number): string;
124
- interface EnsureMonthlyOptions {
125
- table: string;
126
- from: Date;
127
- to: Date;
128
- }
129
- declare function ensureMonthlyPartitions(prisma: PrismaRawClient, opts: EnsureMonthlyOptions): Promise<string[]>;
130
- interface DropOldOptions {
131
- table: string;
132
- beforeDate: Date;
133
- }
134
- declare function dropOldPartitions(prisma: PrismaRawClient, opts: DropOldOptions): Promise<string[]>;
135
-
136
- interface LLMRequest {
137
- model?: string;
138
- messages: Array<{
139
- role: 'system' | 'user' | 'assistant';
140
- content: string;
141
- }>;
142
- maxTokens?: number;
143
- temperature?: number;
144
- stream?: boolean;
145
- timeoutMs?: number;
146
- }
147
- interface LLMResponse {
148
- provider: string;
149
- content: string;
150
- inputTokens?: number;
151
- outputTokens?: number;
152
- raw?: unknown;
153
- }
154
- interface LLMProviderAdapter {
155
- name: string;
156
- complete(req: LLMRequest, signal: AbortSignal): Promise<LLMResponse>;
157
- }
158
- interface LLMRouterOptions {
159
- timeoutMs?: number;
160
- maxAttempts?: number;
161
- initialDelayMs?: number;
162
- maxOutputTokensCap?: number;
163
- }
164
- declare class LLMRouter {
165
- private readonly adapters;
166
- private readonly opts;
167
- constructor(opts?: LLMRouterOptions);
168
- register(adapter: LLMProviderAdapter): void;
169
- private resolveChain;
170
- complete(req: LLMRequest): Promise<LLMResponse>;
171
- }
172
-
173
- type index_BreakerConfig = BreakerConfig;
174
- type index_CacheVersionRedis = CacheVersionRedis;
175
- type index_CircuitBreakerOpenError = CircuitBreakerOpenError;
176
- declare const index_CircuitBreakerOpenError: typeof CircuitBreakerOpenError;
177
- type index_ClampLimitOptions = ClampLimitOptions;
178
- type index_DataLoaderLike<K, V> = DataLoaderLike<K, V>;
179
- type index_DropOldOptions = DropOldOptions;
180
- type index_EnsureMonthlyOptions = EnsureMonthlyOptions;
181
- type index_HttpClientConfig = HttpClientConfig;
182
- type index_HttpClientInit = HttpClientInit;
183
- type index_LLMProviderAdapter = LLMProviderAdapter;
184
- type index_LLMRequest = LLMRequest;
185
- type index_LLMResponse = LLMResponse;
186
- type index_LLMRouter = LLMRouter;
187
- declare const index_LLMRouter: typeof LLMRouter;
188
- type index_LLMRouterOptions = LLMRouterOptions;
189
- type index_LeaderLockOptions = LeaderLockOptions;
190
- type index_LeaderLockRedis = LeaderLockRedis;
191
- type index_LeaderLockResult<T> = LeaderLockResult<T>;
192
- type index_LoaderBuilder<Ctx, M extends LoaderMap> = LoaderBuilder<Ctx, M>;
193
- type index_LoaderMap = LoaderMap;
194
- type index_PaginateInput<TWhere, TOrderBy> = PaginateInput<TWhere, TOrderBy>;
195
- type index_PaginateResult<TItem> = PaginateResult<TItem>;
196
- type index_PrismaModelLike<TItem, TWhere, TOrderBy> = PrismaModelLike<TItem, TWhere, TOrderBy>;
197
- type index_PrismaRawClient = PrismaRawClient;
198
- type index_RateLimitInput = RateLimitInput;
199
- type index_RateLimitRedis = RateLimitRedis;
200
- type index_RateLimitResult = RateLimitResult;
201
- type index_ReferenceObject = ReferenceObject;
202
- type index_RetryConfig = RetryConfig;
203
- declare const index___resetHttpClientBreakers: typeof __resetHttpClientBreakers;
204
- declare const index_buildCacheKey: typeof buildCacheKey;
205
- declare const index_buildLoaders: typeof buildLoaders;
206
- declare const index_clampLimit: typeof clampLimit;
207
- declare const index_createHttpClient: typeof createHttpClient;
208
- declare const index_dropOldPartitions: typeof dropOldPartitions;
209
- declare const index_ensureMonthlyPartitions: typeof ensureMonthlyPartitions;
210
- declare const index_getNamespaceVersion: typeof getNamespaceVersion;
211
- declare const index_httpClient: typeof httpClient;
212
- declare const index_invalidateNamespace: typeof invalidateNamespace;
213
- declare const index_monthlyPartitionName: typeof monthlyPartitionName;
214
- declare const index_paginate: typeof paginate;
215
- declare const index_rateLimitIncr: typeof rateLimitIncr;
216
- declare const index_resolveReferenceLoader: typeof resolveReferenceLoader;
217
- declare const index_withLeaderLock: typeof withLeaderLock;
218
- declare namespace index {
219
- export { type index_BreakerConfig as BreakerConfig, type index_CacheVersionRedis as CacheVersionRedis, index_CircuitBreakerOpenError as CircuitBreakerOpenError, type index_ClampLimitOptions as ClampLimitOptions, type index_DataLoaderLike as DataLoaderLike, type index_DropOldOptions as DropOldOptions, type index_EnsureMonthlyOptions as EnsureMonthlyOptions, type index_HttpClientConfig as HttpClientConfig, type index_HttpClientInit as HttpClientInit, type index_LLMProviderAdapter as LLMProviderAdapter, type index_LLMRequest as LLMRequest, type index_LLMResponse as LLMResponse, index_LLMRouter as LLMRouter, type index_LLMRouterOptions as LLMRouterOptions, type index_LeaderLockOptions as LeaderLockOptions, type index_LeaderLockRedis as LeaderLockRedis, type index_LeaderLockResult as LeaderLockResult, type index_LoaderBuilder as LoaderBuilder, type index_LoaderMap as LoaderMap, type index_PaginateInput as PaginateInput, type index_PaginateResult as PaginateResult, type index_PrismaModelLike as PrismaModelLike, type index_PrismaRawClient as PrismaRawClient, type index_RateLimitInput as RateLimitInput, type index_RateLimitRedis as RateLimitRedis, type index_RateLimitResult as RateLimitResult, type index_ReferenceObject as ReferenceObject, type index_RetryConfig as RetryConfig, index___resetHttpClientBreakers as __resetHttpClientBreakers, index_buildCacheKey as buildCacheKey, index_buildLoaders as buildLoaders, index_clampLimit as clampLimit, index_createHttpClient as createHttpClient, index_dropOldPartitions as dropOldPartitions, index_ensureMonthlyPartitions as ensureMonthlyPartitions, index_getNamespaceVersion as getNamespaceVersion, index_httpClient as httpClient, index_invalidateNamespace as invalidateNamespace, index_monthlyPartitionName as monthlyPartitionName, index_paginate as paginate, index_rateLimitIncr as rateLimitIncr, index_resolveReferenceLoader as resolveReferenceLoader, index_withLeaderLock as withLeaderLock };
220
- }
221
-
222
- export { ensureMonthlyPartitions as A, type BreakerConfig as B, type CacheVersionRedis as C, type DataLoaderLike as D, type EnsureMonthlyOptions as E, getNamespaceVersion as F, httpClient as G, type HttpClientConfig as H, invalidateNamespace as I, monthlyPartitionName as J, paginate as K, type LLMProviderAdapter as L, rateLimitIncr as M, resolveReferenceLoader as N, withLeaderLock as O, type PaginateInput as P, type RateLimitInput as R, __resetHttpClientBreakers as _, CircuitBreakerOpenError as a, type ClampLimitOptions as b, type DropOldOptions as c, type HttpClientInit as d, type LLMRequest as e, type LLMResponse as f, LLMRouter as g, type LLMRouterOptions as h, index as i, type LeaderLockOptions as j, type LeaderLockRedis as k, type LeaderLockResult as l, type LoaderBuilder as m, type LoaderMap as n, type PaginateResult as o, type PrismaModelLike as p, type PrismaRawClient as q, type RateLimitRedis as r, type RateLimitResult as s, type ReferenceObject as t, type RetryConfig as u, buildCacheKey as v, buildLoaders as w, clampLimit as x, createHttpClient as y, dropOldPartitions as z };