@cat-factory/server 0.67.0 → 0.68.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agents/ContainerAgentExecutor.d.ts +34 -0
- package/dist/agents/ContainerAgentExecutor.d.ts.map +1 -1
- package/dist/agents/ContainerAgentExecutor.js +66 -3
- package/dist/agents/ContainerAgentExecutor.js.map +1 -1
- package/dist/auth/signing.d.ts +18 -2
- package/dist/auth/signing.d.ts.map +1 -1
- package/dist/auth/signing.js +76 -20
- package/dist/auth/signing.js.map +1 -1
- package/dist/github/WebCryptoWebhookVerifier.d.ts.map +1 -1
- package/dist/github/WebCryptoWebhookVerifier.js +4 -0
- package/dist/github/WebCryptoWebhookVerifier.js.map +1 -1
- package/dist/http/cors.d.ts +12 -3
- package/dist/http/cors.d.ts.map +1 -1
- package/dist/http/cors.js +32 -7
- package/dist/http/cors.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/modules/webSearch/upstreams.d.ts +6 -0
- package/dist/modules/webSearch/upstreams.d.ts.map +1 -1
- package/dist/modules/webSearch/upstreams.js +22 -3
- package/dist/modules/webSearch/upstreams.js.map +1 -1
- package/package.json +6 -6
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { type AgentContextRecorder, type AgentJobHandle, type AgentJobUpdate, type AgentRunContext, type AgentRunResult, type AsyncAgentExecutor, type HarnessKind, type LlmTraceSink, type ModelRef, type SubscriptionVendor } from '@cat-factory/kernel';
|
|
2
2
|
import { type AgentRouting } from '@cat-factory/agents';
|
|
3
|
+
import { type HarnessCallsRecordInput } from '@cat-factory/orchestration';
|
|
3
4
|
import type { ContainerSessionService } from '../containers/ContainerSessionService.js';
|
|
4
5
|
import { type ResolveRunnerTransport } from './RunnerJobClient.js';
|
|
5
6
|
export type { ResolveRunnerTransport };
|
|
@@ -60,6 +61,15 @@ export type RecordSubscriptionUsage = (workspaceId: string, tokenId: string, usa
|
|
|
60
61
|
inputTokens: number;
|
|
61
62
|
outputTokens: number;
|
|
62
63
|
}) => Promise<void>;
|
|
64
|
+
/**
|
|
65
|
+
* Record a finished subscription harness's per-call telemetry into `llm_call_metrics`
|
|
66
|
+
* — the proxy-bypassing analogue of the per-call rows the LLM proxy writes for Pi. The
|
|
67
|
+
* facade maps each harness call metric onto the observability sink. NOT gated on a
|
|
68
|
+
* pooled token id (a personal/individual subscription leases no tokenId yet still
|
|
69
|
+
* produces telemetry), unlike {@link RecordSubscriptionUsage}. The payload is the
|
|
70
|
+
* orchestration recorder's own {@link HarnessCallsRecordInput}, so the two can't drift.
|
|
71
|
+
*/
|
|
72
|
+
export type RecordHarnessCalls = (input: HarnessCallsRecordInput) => Promise<void>;
|
|
63
73
|
/**
|
|
64
74
|
* Strip any embedded `user:pass@` userinfo from a URL before it is stored in an
|
|
65
75
|
* observability snapshot. The allow-list promises "never a credential-bearing URL", but
|
|
@@ -126,6 +136,12 @@ export interface ContainerAgentExecutorDependencies {
|
|
|
126
136
|
leasePersonalSubscriptionToken?: LeasePersonalSubscriptionToken;
|
|
127
137
|
/** Attribute a finished subscription job's usage to its leased token (usage-aware rotation). */
|
|
128
138
|
recordSubscriptionUsage?: RecordSubscriptionUsage;
|
|
139
|
+
/**
|
|
140
|
+
* Record a finished subscription harness's per-call telemetry into `llm_call_metrics`
|
|
141
|
+
* (the proxy-bypassing analogue of the LLM proxy's per-call rows for Pi). Best-effort;
|
|
142
|
+
* absent ⇒ no subscription-harness call telemetry is captured. See {@link RecordHarnessCalls}.
|
|
143
|
+
*/
|
|
144
|
+
recordHarnessCalls?: RecordHarnessCalls;
|
|
129
145
|
/**
|
|
130
146
|
* NATIVE LOCAL EXECUTION (local facade only, opt-in via `LOCAL_NATIVE_AGENTS`): when this
|
|
131
147
|
* returns true for a resolved subscription harness + vendor, the job carries
|
|
@@ -222,6 +238,13 @@ export declare class ContainerAgentExecutor implements AsyncAgentExecutor {
|
|
|
222
238
|
* worst case (one extra job's tokens on one row), never silent over-counting.
|
|
223
239
|
*/
|
|
224
240
|
private readonly recordedUsageJobs;
|
|
241
|
+
/**
|
|
242
|
+
* Job ids whose per-call telemetry (`llm_call_metrics`) has already been recorded.
|
|
243
|
+
* Separate from {@link recordedUsageJobs} because the two recorders are independently
|
|
244
|
+
* wired and gated (telemetry records even for a personal subscription that leases no
|
|
245
|
+
* pooled token id). Same replay-safety rationale + bound as the usage guard.
|
|
246
|
+
*/
|
|
247
|
+
private readonly recordedCallMetricJobs;
|
|
225
248
|
/** Resolves which model + subscription path a step runs on (routing policy). */
|
|
226
249
|
private readonly modelRouter;
|
|
227
250
|
constructor(deps: ContainerAgentExecutorDependencies);
|
|
@@ -236,6 +259,17 @@ export declare class ContainerAgentExecutor implements AsyncAgentExecutor {
|
|
|
236
259
|
startJob(context: AgentRunContext): Promise<AgentJobHandle>;
|
|
237
260
|
/** Poll a dispatched job for its state, mapping the runner view into an update. */
|
|
238
261
|
pollJob(handle: AgentJobHandle): Promise<AgentJobUpdate>;
|
|
262
|
+
/**
|
|
263
|
+
* Record the subscription harness's per-call telemetry into `llm_call_metrics` — the
|
|
264
|
+
* proxy-bypassing analogue of the rows the LLM proxy writes for Pi. NOT gated on a
|
|
265
|
+
* pooled token id, so a personal (individual-usage) subscription run is observed too.
|
|
266
|
+
* Runs on every terminal state (success and failure alike). Best-effort: an unwired
|
|
267
|
+
* recorder or an empty metric list is a no-op. An in-memory once-per-job guard skips
|
|
268
|
+
* the redundant DB round-trip within this process; the recorder additionally mints
|
|
269
|
+
* deterministic per-call ids off the job id, so even a durable-driver replay in a
|
|
270
|
+
* fresh isolate (empty guard) re-records idempotently rather than duplicating rows.
|
|
271
|
+
*/
|
|
272
|
+
private recordHarnessCallsOnce;
|
|
239
273
|
/**
|
|
240
274
|
* Stop a running job and reclaim its backing runner: resolve the same transport
|
|
241
275
|
* the job dispatched to (by workspace) and `release` it — for the Cloudflare
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ContainerAgentExecutor.d.ts","sourceRoot":"","sources":["../../src/agents/ContainerAgentExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,kBAAkB,
|
|
1
|
+
{"version":3,"file":"ContainerAgentExecutor.d.ts","sourceRoot":"","sources":["../../src/agents/ContainerAgentExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAEvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,QAAQ,EAKb,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAA;AAS5B,OAAO,EACL,KAAK,YAAY,EAKlB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AAC/F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAA;AACvF,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAGnF,YAAY,EAAE,sBAAsB,EAAE,CAAA;AAItC,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;AAEpG;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,cAAc,EAAE,MAAM,EACtB,GAAG,CAAC,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,KAChD,OAAO,CAAC,MAAM,CAAC,CAAA;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,KACzB,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED,gFAAgF;AAChF,MAAM,MAAM,sBAAsB,GAAG,CACnC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC,uBAAuB,CAAC,CAAA;AAErC;;;;;;GAMG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAC3C,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,KACvB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAEhC,kFAAkF;AAClF,MAAM,MAAM,uBAAuB,GAAG,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,KACjD,OAAO,CAAC,IAAI,CAAC,CAAA;AAElB;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAsClF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWzD;AAuFD,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,UAAU,CAAA;AA6EhE,MAAM,WAAW,kCAAkC;IACjD,6FAA6F;IAC7F,gBAAgB,EAAE,sBAAsB,CAAA;IACxC,yEAAyE;IACzE,YAAY,EAAE,YAAY,CAAA;IAC1B,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,QAAQ,GAAG,SAAS,CAAA;IACxE;;;OAGG;IACH,4BAA4B,CAAC,EAAE,CAC7B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,KACnB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChC,2DAA2D;IAC3D,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IAC9E,iFAAiF;IACjF,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,gFAAgF;IAChF,cAAc,EAAE,uBAAuB,CAAA;IACvC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAA;IAC/C;;;;OAIG;IACH,8BAA8B,CAAC,EAAE,8BAA8B,CAAA;IAC/D,gGAAgG;IAChG,uBAAuB,CAAC,EAAE,uBAAuB,CAAA;IACjD;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,GAAG,SAAS,KAAK,OAAO,CAAA;IAC7F;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5F;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1F;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACnE;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,oBAAoB,CAAA;CACjD;AAKD;;;;;;;;;;;;;GAaG;AACH,qBAAa,sBAAuB,YAAW,kBAAkB;IA2BnD,OAAO,CAAC,QAAQ,CAAC,IAAI;IA1BjC,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IAEtC;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;IAEtD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAoB;IAE3D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IAEzC,YAA6B,IAAI,EAAE,kCAAkC,EASpE;IAED,qFAAqF;IACrF,SAAS,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAE5C;IAED;;;;;OAKG;IACG,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAkChE;IAED,mFAAmF;IAC7E,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAuF7D;IAED;;;;;;;;;OASG;YACW,sBAAsB;IA+BpC;;;;;;OAMG;IACG,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnD;IAED;;;;OAIG;IACG,GAAG,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAY3D;IAED;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5D;IAED;;;;;;;OAOG;IACG,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAI7D;IAED;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAiBvB,uFAAuF;IACvF,OAAO,CAAC,UAAU;IAalB,qFAAqF;YACvE,YAAY;IAmJ1B;;;;OAIG;YACW,WAAW;CAmG1B"}
|
|
@@ -35,6 +35,13 @@ function stepJobId(executionId, agentKind, dispatchEpoch = 0) {
|
|
|
35
35
|
const base = `${executionId}-${agentKind}`;
|
|
36
36
|
return dispatchEpoch > 0 ? `${base}-${dispatchEpoch}` : base;
|
|
37
37
|
}
|
|
38
|
+
/** The provider slug from a handle's `provider:model` string (fallback when the handle omits `provider`). */
|
|
39
|
+
function providerOf(model) {
|
|
40
|
+
if (!model)
|
|
41
|
+
return 'unknown';
|
|
42
|
+
const colon = model.indexOf(':');
|
|
43
|
+
return colon > 0 ? model.slice(0, colon) : model;
|
|
44
|
+
}
|
|
38
45
|
/**
|
|
39
46
|
* Strip any embedded `user:pass@` userinfo from a URL before it is stored in an
|
|
40
47
|
* observability snapshot. The allow-list promises "never a credential-bearing URL", but
|
|
@@ -232,6 +239,13 @@ export class ContainerAgentExecutor {
|
|
|
232
239
|
* worst case (one extra job's tokens on one row), never silent over-counting.
|
|
233
240
|
*/
|
|
234
241
|
recordedUsageJobs = new Set();
|
|
242
|
+
/**
|
|
243
|
+
* Job ids whose per-call telemetry (`llm_call_metrics`) has already been recorded.
|
|
244
|
+
* Separate from {@link recordedUsageJobs} because the two recorders are independently
|
|
245
|
+
* wired and gated (telemetry records even for a personal subscription that leases no
|
|
246
|
+
* pooled token id). Same replay-safety rationale + bound as the usage guard.
|
|
247
|
+
*/
|
|
248
|
+
recordedCallMetricJobs = new Set();
|
|
235
249
|
/** Resolves which model + subscription path a step runs on (routing policy). */
|
|
236
250
|
modelRouter;
|
|
237
251
|
constructor(deps) {
|
|
@@ -257,7 +271,7 @@ export class ContainerAgentExecutor {
|
|
|
257
271
|
*/
|
|
258
272
|
async startJob(context) {
|
|
259
273
|
const { workspaceId, executionId } = this.requireIds(context);
|
|
260
|
-
const { body, model, kind, subscriptionTokenId } = await this.buildJobBody(context);
|
|
274
|
+
const { body, model, provider, kind, subscriptionTokenId } = await this.buildJobBody(context);
|
|
261
275
|
// The job's id is per-STEP (run id + agent kind), so sibling steps that share this
|
|
262
276
|
// run's container never collide in the harness's per-kind job registries; the run
|
|
263
277
|
// itself is addressed by the execution id, so its container is reclaimed as a unit.
|
|
@@ -283,6 +297,7 @@ export class ContainerAgentExecutor {
|
|
|
283
297
|
jobId,
|
|
284
298
|
runId: executionId,
|
|
285
299
|
model,
|
|
300
|
+
provider,
|
|
286
301
|
workspaceId,
|
|
287
302
|
agentKind: context.agentKind,
|
|
288
303
|
...(subscriptionTokenId ? { subscriptionTokenId } : {}),
|
|
@@ -337,12 +352,17 @@ export class ContainerAgentExecutor {
|
|
|
337
352
|
...(view.failureCause ? { failureCause: view.failureCause } : {}),
|
|
338
353
|
...(view.detail ? { detail: view.detail } : {}),
|
|
339
354
|
};
|
|
355
|
+
// Completed OR failed: a subscription harness attaches its per-call telemetry to
|
|
356
|
+
// BOTH — a failed token-spending run (no changes / unusable output / unresolved
|
|
357
|
+
// conflicts) is exactly what an operator needs to inspect — so record it before the
|
|
358
|
+
// terminal returns below, on every terminal state.
|
|
359
|
+
const result = view.result ?? {};
|
|
360
|
+
await this.recordHarnessCallsOnce(handle, result);
|
|
340
361
|
if (view.state === 'failed') {
|
|
341
362
|
return { state: 'failed', error: view.error ?? 'Implementation job failed', ...failureMeta };
|
|
342
363
|
}
|
|
343
364
|
// Completed: a structured `error` (e.g. "no file changes") is still a failure. The harness
|
|
344
365
|
// carries the cause on the view even for these clean-exit failures, so forward it too.
|
|
345
|
-
const result = view.result ?? {};
|
|
346
366
|
if (result.error) {
|
|
347
367
|
return { state: 'failed', error: `Implementation failed: ${result.error}`, ...failureMeta };
|
|
348
368
|
}
|
|
@@ -365,6 +385,43 @@ export class ContainerAgentExecutor {
|
|
|
365
385
|
}
|
|
366
386
|
return { state: 'done', result: toRunResult(result, handle.agentKind), ...followUps };
|
|
367
387
|
}
|
|
388
|
+
/**
|
|
389
|
+
* Record the subscription harness's per-call telemetry into `llm_call_metrics` — the
|
|
390
|
+
* proxy-bypassing analogue of the rows the LLM proxy writes for Pi. NOT gated on a
|
|
391
|
+
* pooled token id, so a personal (individual-usage) subscription run is observed too.
|
|
392
|
+
* Runs on every terminal state (success and failure alike). Best-effort: an unwired
|
|
393
|
+
* recorder or an empty metric list is a no-op. An in-memory once-per-job guard skips
|
|
394
|
+
* the redundant DB round-trip within this process; the recorder additionally mints
|
|
395
|
+
* deterministic per-call ids off the job id, so even a durable-driver replay in a
|
|
396
|
+
* fresh isolate (empty guard) re-records idempotently rather than duplicating rows.
|
|
397
|
+
*/
|
|
398
|
+
async recordHarnessCallsOnce(handle, result) {
|
|
399
|
+
if (!handle.workspaceId ||
|
|
400
|
+
!result.callMetrics ||
|
|
401
|
+
result.callMetrics.length === 0 ||
|
|
402
|
+
!this.deps.recordHarnessCalls ||
|
|
403
|
+
this.recordedCallMetricJobs.has(handle.jobId)) {
|
|
404
|
+
return;
|
|
405
|
+
}
|
|
406
|
+
try {
|
|
407
|
+
await this.deps.recordHarnessCalls({
|
|
408
|
+
workspaceId: handle.workspaceId,
|
|
409
|
+
executionId: handle.runId ?? null,
|
|
410
|
+
agentKind: handle.agentKind ?? 'agent',
|
|
411
|
+
provider: handle.provider ?? providerOf(handle.model),
|
|
412
|
+
model: handle.model ?? '',
|
|
413
|
+
jobId: handle.jobId,
|
|
414
|
+
calls: result.callMetrics,
|
|
415
|
+
});
|
|
416
|
+
if (this.recordedCallMetricJobs.size >= 10_000)
|
|
417
|
+
this.recordedCallMetricJobs.clear();
|
|
418
|
+
this.recordedCallMetricJobs.add(handle.jobId);
|
|
419
|
+
}
|
|
420
|
+
catch {
|
|
421
|
+
// Swallowed: telemetry is observability, never a reason to fail (or fail to
|
|
422
|
+
// complete) a run.
|
|
423
|
+
}
|
|
424
|
+
}
|
|
368
425
|
/**
|
|
369
426
|
* Stop a running job and reclaim its backing runner: resolve the same transport
|
|
370
427
|
* the job dispatched to (by workspace) and `release` it — for the Cloudflare
|
|
@@ -564,7 +621,13 @@ export class ContainerAgentExecutor {
|
|
|
564
621
|
workBranch,
|
|
565
622
|
workBranchReady,
|
|
566
623
|
});
|
|
567
|
-
return {
|
|
624
|
+
return {
|
|
625
|
+
subscriptionTokenId,
|
|
626
|
+
body,
|
|
627
|
+
model: `${ref.provider}:${ref.model}`,
|
|
628
|
+
provider: ref.provider,
|
|
629
|
+
kind,
|
|
630
|
+
};
|
|
568
631
|
}
|
|
569
632
|
/**
|
|
570
633
|
* Resolve the per-job auth the harness carries: the proxy session token for Pi, or a
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ContainerAgentExecutor.js","sourceRoot":"","sources":["../../src/agents/ContainerAgentExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,EAiBN,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAEL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAA+B,MAAM,sBAAsB,CAAA;AAgFnF;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,SAAS,CAAC,WAAmB,EAAE,SAAiB,EAAE,aAAa,GAAG,CAAC;IAC1E,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,SAAS,EAAE,CAAA;IAC1C,OAAO,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAChD,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAA;QACjB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAA;QACjB,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7E,MAAM,IAAI,GAAG,EAAE,GAAI,KAAiC,EAAE,CAAA;IACtD,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAC9B,OAAwB,EACxB,IAA6B,EAC7B,KAAa,EACb,GAAiD;IAEjD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACpE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QACnD,CAAC,CAAE,IAAI,CAAC,YAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAoB,EAAE;YAC3D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAA;YACjD,OAAO;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;gBACtB,GAAG,EAAE,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;aAC3B,CAAA;QACH,CAAC,CAAC;QACJ,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,SAAS,GAA2B,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7F,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,IAAI,EAAE,EAAE,CAAC,IAAI;KACd,CAAC,CAAC,CAAA;IACH,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK;QACL,+EAA+E;QAC/E,iFAAiF;QACjF,oBAAoB;QACpB,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC/D,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACpC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;QAChC,SAAS;QACT,YAAY;QACZ,MAAM,EAAE;YACN,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK;YAClC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,QAAQ;gBAClB,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE;gBAC/E,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAsB;IAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;AACrE,CAAC;AAkBD,MAAM,gBAAgB,GAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,QAAQ,EAAE,sBAAsB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,MAAM;IAC7D,QAAQ,EAAE,QAAQ;CACnB,CAAC,CAAA;AAEF,SAAS,aAAa,CAAC,IAAgB,EAAE,MAAkB;IACzD,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,IAAY,EAAE,IAAiB;IACtD,MAAM,IAAI,GACR,IAAI;SACD,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;IAC9B,IAAI,IAAI,GAAG,GAAG,IAAI,KAAK,CAAA;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAA;IAC7D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACd,OAAO,IAAI,CAAA;AACb,CAAC;AAKD;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,OAAwB;IAKjD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IACnD,MAAM,KAAK,GAAoE,EAAE,CAAA;IACjF,MAAM,QAAQ,GAAiB,EAAE,CAAA;IACjC,MAAM,SAAS,GAAkB,EAAE,CAAA;IACnC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE,MAAM;QAC/C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,sFAAsF;IACtF,qEAAqE;IACrE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,QAAgB,EAAE,GAAW,EAAW,EAAE;QACjF,MAAM,OAAO,GAAG,KAAK,KAAK,aAAa,GAAG,OAAO,GAAG,EAAE,CAAA;QACtD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;QACrD,IAAI,KAAK,GAAG,IAAI,GAAG,cAAc,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAA;QACnE,KAAK,IAAI,IAAI,CAAA;QACb,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1E,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,KAAK,MAAM,GAAG,IAAI,WAAW,IAAI,EAAE;QACjC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrF,KAAK,MAAM,IAAI,IAAI,YAAY,IAAI,EAAE;QACnC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACjF,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;AAClE,CAAC;AAsHD,0GAA0G;AAC1G,MAAM,oBAAoB,GAAG,KAAK,CAAA;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,sBAAsB;IAmBJ,IAAI;IAlBjC,uFAAuF;IACtE,IAAI,CAAiB;IAEtC;;;;;;;;;OASG;IACc,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAA;IAEtD,gFAAgF;IAC/D,WAAW,CAAa;IAEzC,YAA6B,IAAwC;oBAAxC,IAAI;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACtD,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC;YACjC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,4BAA4B,EAAE,IAAI,CAAC,4BAA4B;YAC/D,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;SACtD,CAAC,CAAA;IACJ,CAAC;IAED,qFAAqF;IACrF,SAAS,CAAC,QAAyB;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAwB;QACrC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACnF,mFAAmF;QACnF,kFAAkF;QAClF,oFAAoF;QACpF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAe,CAAA;QAClC,MAAM,GAAG,GAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;QACvD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QACrF,qFAAqF;QACrF,kFAAkF;QAClF,sFAAsF;QACtF,IAAI,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAC9C,uBAAuB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAC5E,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;QACH,CAAC;QACD,kFAAkF;QAClF,8EAA8E;QAC9E,gFAAgF;QAChF,sDAAsD;QACtD,OAAO;YACL,KAAK;YACL,KAAK,EAAE,WAAW;YAClB,KAAK;YACL,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAA;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,OAAO,CAAC,MAAsB;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,gFAAgF;QAChF,gFAAgF;QAChF,mFAAmF;QACnF,+BAA+B;QAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,CAC1C;oBACE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;oBACvC,WAAW,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;oBACzC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,OAAO;iBACvC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6EAA6E;YAC/E,CAAC;QACH,CAAC;QACD,yFAAyF;QACzF,yFAAyF;QACzF,8EAA8E;QAC9E,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;YACtB,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAC,CAAA;QACH,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACtF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,4EAA4E;YAC5E,kFAAkF;YAClF,mFAAmF;YACnF,iFAAiF;YACjF,+EAA+E;YAC/E,MAAM,aAAa,GAAG;gBACpB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAA;YACD,OAAO,IAAI,CAAC,QAAQ;gBAClB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,aAAa,EAAE;gBAC/E,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,GAAG,aAAa,EAAE,CAAA;QAC1D,CAAC;QACD,wFAAwF;QACxF,mFAAmF;QACnF,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAA;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,2BAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;QAC9F,CAAC;QACD,2FAA2F;QAC3F,uFAAuF;QACvF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;QAChC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,CAAA;QAC7F,CAAC;QACD,6EAA6E;QAC7E,8EAA8E;QAC9E,+EAA+E;QAC/E,2EAA2E;QAC3E,IACE,MAAM,CAAC,mBAAmB;YAC1B,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,KAAK;YACZ,IAAI,CAAC,IAAI,CAAC,uBAAuB;YACjC,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CACrC,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,KAAK,CACb,CAAA;YACD,8EAA8E;YAC9E,6EAA6E;YAC7E,yEAAyE;YACzE,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAI,MAAM;gBAAE,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAA;YACzE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,EAAE,CAAA;IACvF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,MAAsB;QAClC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IACnE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,OAAwB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC3C,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACzC,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC5B,sEAAsE;gBACtE,yEAAyE;gBACzE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;YAC/E,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC5D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAwB;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QACtD,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAA;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,OAAwB;QACzC,IAAI,CAAC,OAAO,CAAC,WAAW;YAAE,OAAO,KAAK,CAAA;QACtC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QACxF,OAAO,GAAG,CAAC,OAAO,KAAK,aAAa,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,CAAA;IACjE,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,OAAwB;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAA;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,YAAY,CAAA;QAC1C,kFAAkF;QAClF,4EAA4E;QAC5E,MAAM,KAAK,GAAqB,OAAO,CAAC,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7F,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAClD,OAAO;YACL,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,6EAA6E;YAC7E,6EAA6E;YAC7E,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAA;IACH,CAAC;IAED,uFAAuF;IAC/E,UAAU,CAAC,OAAwB;QAKzC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAA;QAChC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;QAC1F,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;IAC9C,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,YAAY,CAAC,OAAwB;QAMjD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QACtE,kFAAkF;QAClF,mFAAmF;QACnF,qFAAqF;QACrF,mFAAmF;QACnF,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;QAE9E,+EAA+E;QAC/E,iFAAiF;QACjF,yEAAyE;QACzE,+EAA+E;QAC/E,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAC5E,OAAO,EACP,WAAW,CACZ,CAAA;QACD,MAAM,OAAO,GAAgB,GAAG,CAAC,OAAO,IAAI,IAAI,CAAA;QAEhD,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,6EAA6E;QAC7E,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,iEAAiE;gBAC/D,wEAAwE;gBACxE,IAAI,GAAG,CAAC,QAAQ,2DAA2D;gBAC3E,oFAAoF;gBACpF,sDAAsD,CACzD,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,uDAAuD,WAAW,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;YACzE,WAAW;YACX,WAAW,EAAE,OAAO,CAAC,iBAAiB;SACvC,CAAC,CAAA;QAEF,qFAAqF;QACrF,wFAAwF;QACxF,uFAAuF;QACvF,wFAAwF;QACxF,wFAAwF;QACxF,kFAAkF;QAClF,mFAAmF;QACnF,kFAAkF;QAClF,8CAA8C;QAC9C,MAAM,UAAU,GAAG,eAAe,OAAO,EAAE,CAAA;QAC3C,MAAM,eAAe,GACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU;YAC9C,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;gBAC1B,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE;oBACjD,MAAM,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC;iBAChD,CAAC;gBACJ,CAAC,CAAC,KAAK,CAAA;QAEb,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE;YACpE,OAAO;YACP,GAAG;YACH,kBAAkB;YAClB,WAAW;YACX,WAAW;SACZ,CAAC,CAAA;QAEF,+EAA+E;QAC/E,wEAAwE;QACxE,oFAAoF;QACpF,oFAAoF;QACpF,oFAAoF;QACpF,MAAM,EACJ,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,QAAQ,EACrB,YAAY,EAAE,SAAS,GACxB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;QAC9B,qFAAqF;QACrF,uFAAuF;QACvF,uFAAuF;QACvF,iFAAiF;QACjF,wEAAwE;QACxE,MAAM,cAAc,GAClB,OAAO,CAAC,SAAS,KAAK,oBAAoB;YAC1C,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YACrC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YACnC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,mBAAmB,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5E,CAAC,CAAC,SAAS,CAAA;QACf,mFAAmF;QACnF,iFAAiF;QACjF,oFAAoF;QACpF,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG;YACb,KAAK;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,IAAI;YACP,OAAO;YACP,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAA;QACD,oFAAoF;QACpF,mFAAmF;QACnF,wDAAwD;QACxD,MAAM,aAAa,GAAoB,YAAY,CAAC,MAAM;YACxD,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE;YAC7F,CAAC,CAAC,OAAO,CAAA;QACX,gFAAgF;QAChF,sFAAsF;QACtF,uFAAuF;QACvF,mFAAmF;QACnF,8DAA8D;QAC9D,MAAM,gBAAgB,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAA;QAC1F,MAAM,QAAQ,GAAG;YACf,gBAAgB,EAAE,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC5E,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAA;QAED,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,aAAa,EAAE;YAClD,MAAM;YACN,QAAQ;YACR,IAAI;YACJ,UAAU;YACV,eAAe;SAChB,CAAC,CAAA;QACF,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAA;IACnF,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CACvB,OAAwB,EACxB,IAMC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,IAAI,CAAA;QAC3E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB;gBAC1C,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;gBAC/C,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;gBACvD,WAAW;gBACX,SAAS,EAAE,SAAS,IAAI,SAAS;gBACjC,MAAM,EAAE,OAAO,CAAC,iBAAiB;gBACjC,WAAW;gBACX,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC,CAAA;YACF,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,EAAE,CAAA;QAClF,CAAC;QACD,oFAAoF;QACpF,wFAAwF;QACxF,mFAAmF;QACnF,kFAAkF;QAClF,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAA;QACjD,CAAC;QACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,2DAA2D;gBACvE,+CAA+C,CAClD,CAAA;QACH,CAAC;QACD,kFAAkF;QAClF,gFAAgF;QAChF,gFAAgF;QAChF,+CAA+C;QAC/C,IAAI,MAAc,CAAA;QAClB,IAAI,mBAAuC,CAAA;QAC3C,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CACb,YAAY,kBAAkB,4CAA4C;oBACxE,yDAAyD,CAC5D,CAAA;YACH,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,yEAAyE;gBACzE,4EAA4E;gBAC5E,MAAM,IAAI,uBAAuB,CAC/B,aAAa,kBAAkB,gEAAgE,EAC/F,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAC1D,CAAA;YACH,CAAC;YACD,6EAA6E;YAC7E,4EAA4E;YAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAC3D,WAAW,EACX,OAAO,CAAC,iBAAiB,EACzB,kBAAkB,CACnB,CAAA;YACD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,2DAA2D;oBACvE,+CAA+C,CAClD,CAAA;YACH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAA;YACtF,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAA;YACpC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QACxB,CAAC;QACD,iFAAiF;QACjF,iFAAiF;QACjF,gFAAgF;QAChF,4EAA4E;QAC5E,gFAAgF;QAChF,6EAA6E;QAC7E,iFAAiF;QACjF,iEAAiE;QACjE,8EAA8E;QAC9E,wFAAwF;QACxF,MAAM,OAAO,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAA;QAChE,OAAO;YACL,IAAI,EAAE;gBACJ,OAAO;gBACP,iBAAiB,EAAE,MAAM;gBACzB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD;YACD,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAA;IACH,CAAC;CACF"}
|
|
1
|
+
{"version":3,"file":"ContainerAgentExecutor.js","sourceRoot":"","sources":["../../src/agents/ContainerAgentExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,EAkBN,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAEL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,oBAAoB,EAAgC,MAAM,4BAA4B,CAAA;AAE/F,OAAO,EAAE,eAAe,EAA+B,MAAM,sBAAsB,CAAA;AA0FnF;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,SAAS,CAAC,WAAmB,EAAE,SAAiB,EAAE,aAAa,GAAG,CAAC;IAC1E,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,SAAS,EAAE,CAAA;IAC1C,OAAO,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9D,CAAC;AAED,6GAA6G;AAC7G,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAChD,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAA;QACjB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAA;QACjB,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7E,MAAM,IAAI,GAAG,EAAE,GAAI,KAAiC,EAAE,CAAA;IACtD,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAC9B,OAAwB,EACxB,IAA6B,EAC7B,KAAa,EACb,GAAiD;IAEjD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACpE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QACnD,CAAC,CAAE,IAAI,CAAC,YAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAoB,EAAE;YAC3D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAA;YACjD,OAAO;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;gBACtB,GAAG,EAAE,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;aAC3B,CAAA;QACH,CAAC,CAAC;QACJ,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,SAAS,GAA2B,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7F,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,IAAI,EAAE,EAAE,CAAC,IAAI;KACd,CAAC,CAAC,CAAA;IACH,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK;QACL,+EAA+E;QAC/E,iFAAiF;QACjF,oBAAoB;QACpB,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC/D,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACpC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;QAChC,SAAS;QACT,YAAY;QACZ,MAAM,EAAE;YACN,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK;YAClC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,QAAQ;gBAClB,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE;gBAC/E,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAsB;IAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;AACrE,CAAC;AAkBD,MAAM,gBAAgB,GAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,QAAQ,EAAE,sBAAsB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,MAAM;IAC7D,QAAQ,EAAE,QAAQ;CACnB,CAAC,CAAA;AAEF,SAAS,aAAa,CAAC,IAAgB,EAAE,MAAkB;IACzD,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,IAAY,EAAE,IAAiB;IACtD,MAAM,IAAI,GACR,IAAI;SACD,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAA;IAC9B,IAAI,IAAI,GAAG,GAAG,IAAI,KAAK,CAAA;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAA;IAC7D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACd,OAAO,IAAI,CAAA;AACb,CAAC;AAKD;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,OAAwB;IAKjD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IACnD,MAAM,KAAK,GAAoE,EAAE,CAAA;IACjF,MAAM,QAAQ,GAAiB,EAAE,CAAA;IACjC,MAAM,SAAS,GAAkB,EAAE,CAAA;IACnC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE,MAAM;QAC/C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,sFAAsF;IACtF,qEAAqE;IACrE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,QAAgB,EAAE,GAAW,EAAW,EAAE;QACjF,MAAM,OAAO,GAAG,KAAK,KAAK,aAAa,GAAG,OAAO,GAAG,EAAE,CAAA;QACtD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;QACrD,IAAI,KAAK,GAAG,IAAI,GAAG,cAAc,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAA;QACnE,KAAK,IAAI,IAAI,CAAA;QACb,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1E,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,KAAK,MAAM,GAAG,IAAI,WAAW,IAAI,EAAE;QACjC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrF,KAAK,MAAM,IAAI,IAAI,YAAY,IAAI,EAAE;QACnC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACjF,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;AAClE,CAAC;AA4HD,0GAA0G;AAC1G,MAAM,oBAAoB,GAAG,KAAK,CAAA;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,sBAAsB;IA2BJ,IAAI;IA1BjC,uFAAuF;IACtE,IAAI,CAAiB;IAEtC;;;;;;;;;OASG;IACc,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAA;IAEtD;;;;;OAKG;IACc,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAA;IAE3D,gFAAgF;IAC/D,WAAW,CAAa;IAEzC,YAA6B,IAAwC;oBAAxC,IAAI;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACtD,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC;YACjC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,4BAA4B,EAAE,IAAI,CAAC,4BAA4B;YAC/D,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;SACtD,CAAC,CAAA;IACJ,CAAC;IAED,qFAAqF;IACrF,SAAS,CAAC,QAAyB;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAwB;QACrC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QAC7F,mFAAmF;QACnF,kFAAkF;QAClF,oFAAoF;QACpF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAe,CAAA;QAClC,MAAM,GAAG,GAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;QACvD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QACrF,qFAAqF;QACrF,kFAAkF;QAClF,sFAAsF;QACtF,IAAI,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAC9C,uBAAuB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAC5E,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;QACH,CAAC;QACD,kFAAkF;QAClF,8EAA8E;QAC9E,gFAAgF;QAChF,sDAAsD;QACtD,OAAO;YACL,KAAK;YACL,KAAK,EAAE,WAAW;YAClB,KAAK;YACL,QAAQ;YACR,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAA;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,OAAO,CAAC,MAAsB;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,gFAAgF;QAChF,gFAAgF;QAChF,mFAAmF;QACnF,+BAA+B;QAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,CAC1C;oBACE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;oBACvC,WAAW,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;oBACzC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,OAAO;iBACvC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6EAA6E;YAC/E,CAAC;QACH,CAAC;QACD,yFAAyF;QACzF,yFAAyF;QACzF,8EAA8E;QAC9E,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;YACtB,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAC,CAAA;QACH,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACtF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,4EAA4E;YAC5E,kFAAkF;YAClF,mFAAmF;YACnF,iFAAiF;YACjF,+EAA+E;YAC/E,MAAM,aAAa,GAAG;gBACpB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAA;YACD,OAAO,IAAI,CAAC,QAAQ;gBAClB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,aAAa,EAAE;gBAC/E,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,GAAG,aAAa,EAAE,CAAA;QAC1D,CAAC;QACD,wFAAwF;QACxF,mFAAmF;QACnF,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAA;QACD,iFAAiF;QACjF,gFAAgF;QAChF,oFAAoF;QACpF,mDAAmD;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;QAChC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,2BAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;QAC9F,CAAC;QACD,2FAA2F;QAC3F,uFAAuF;QACvF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,CAAA;QAC7F,CAAC;QACD,6EAA6E;QAC7E,8EAA8E;QAC9E,+EAA+E;QAC/E,2EAA2E;QAC3E,IACE,MAAM,CAAC,mBAAmB;YAC1B,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,KAAK;YACZ,IAAI,CAAC,IAAI,CAAC,uBAAuB;YACjC,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CACrC,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,KAAK,CACb,CAAA;YACD,8EAA8E;YAC9E,6EAA6E;YAC7E,yEAAyE;YACzE,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAI,MAAM;gBAAE,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAA;YACzE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,EAAE,CAAA;IACvF,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,sBAAsB,CAClC,MAAsB,EACtB,MAA6C;QAE7C,IACE,CAAC,MAAM,CAAC,WAAW;YACnB,CAAC,MAAM,CAAC,WAAW;YACnB,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAC7B,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAC7C,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC;gBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,WAAW,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;gBACjC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,OAAO;gBACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;gBACrD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,WAAW;aAC1B,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,IAAI,MAAM;gBAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAA;YACnF,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,mBAAmB;QACrB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,MAAsB;QAClC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IACnE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,OAAwB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC3C,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACzC,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC5B,sEAAsE;gBACtE,yEAAyE;gBACzE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;YAC/E,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC5D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAwB;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QACtD,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAA;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,OAAwB;QACzC,IAAI,CAAC,OAAO,CAAC,WAAW;YAAE,OAAO,KAAK,CAAA;QACtC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QACxF,OAAO,GAAG,CAAC,OAAO,KAAK,aAAa,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,CAAA;IACjE,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,OAAwB;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAA;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,YAAY,CAAA;QAC1C,kFAAkF;QAClF,4EAA4E;QAC5E,MAAM,KAAK,GAAqB,OAAO,CAAC,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7F,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAClD,OAAO;YACL,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,6EAA6E;YAC7E,6EAA6E;YAC7E,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAA;IACH,CAAC;IAED,uFAAuF;IAC/E,UAAU,CAAC,OAAwB;QAKzC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAA;QAChC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;QAC1F,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;IAC9C,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,YAAY,CAAC,OAAwB;QAOjD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QACtE,kFAAkF;QAClF,mFAAmF;QACnF,qFAAqF;QACrF,mFAAmF;QACnF,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;QAE9E,+EAA+E;QAC/E,iFAAiF;QACjF,yEAAyE;QACzE,+EAA+E;QAC/E,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAC5E,OAAO,EACP,WAAW,CACZ,CAAA;QACD,MAAM,OAAO,GAAgB,GAAG,CAAC,OAAO,IAAI,IAAI,CAAA;QAEhD,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,6EAA6E;QAC7E,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,iEAAiE;gBAC/D,wEAAwE;gBACxE,IAAI,GAAG,CAAC,QAAQ,2DAA2D;gBAC3E,oFAAoF;gBACpF,sDAAsD,CACzD,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,uDAAuD,WAAW,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;YACzE,WAAW;YACX,WAAW,EAAE,OAAO,CAAC,iBAAiB;SACvC,CAAC,CAAA;QAEF,qFAAqF;QACrF,wFAAwF;QACxF,uFAAuF;QACvF,wFAAwF;QACxF,wFAAwF;QACxF,kFAAkF;QAClF,mFAAmF;QACnF,kFAAkF;QAClF,8CAA8C;QAC9C,MAAM,UAAU,GAAG,eAAe,OAAO,EAAE,CAAA;QAC3C,MAAM,eAAe,GACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU;YAC9C,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;gBAC1B,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE;oBACjD,MAAM,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC;iBAChD,CAAC;gBACJ,CAAC,CAAC,KAAK,CAAA;QAEb,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE;YACpE,OAAO;YACP,GAAG;YACH,kBAAkB;YAClB,WAAW;YACX,WAAW;SACZ,CAAC,CAAA;QAEF,+EAA+E;QAC/E,wEAAwE;QACxE,oFAAoF;QACpF,oFAAoF;QACpF,oFAAoF;QACpF,MAAM,EACJ,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,QAAQ,EACrB,YAAY,EAAE,SAAS,GACxB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;QAC9B,qFAAqF;QACrF,uFAAuF;QACvF,uFAAuF;QACvF,iFAAiF;QACjF,wEAAwE;QACxE,MAAM,cAAc,GAClB,OAAO,CAAC,SAAS,KAAK,oBAAoB;YAC1C,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YACrC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YACnC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,mBAAmB,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5E,CAAC,CAAC,SAAS,CAAA;QACf,mFAAmF;QACnF,iFAAiF;QACjF,oFAAoF;QACpF,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG;YACb,KAAK;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,IAAI;YACP,OAAO;YACP,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAA;QACD,oFAAoF;QACpF,mFAAmF;QACnF,wDAAwD;QACxD,MAAM,aAAa,GAAoB,YAAY,CAAC,MAAM;YACxD,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE;YAC7F,CAAC,CAAC,OAAO,CAAA;QACX,gFAAgF;QAChF,sFAAsF;QACtF,uFAAuF;QACvF,mFAAmF;QACnF,8DAA8D;QAC9D,MAAM,gBAAgB,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAA;QAC1F,MAAM,QAAQ,GAAG;YACf,gBAAgB,EAAE,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC5E,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAA;QAED,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,aAAa,EAAE;YAClD,MAAM;YACN,QAAQ;YACR,IAAI;YACJ,UAAU;YACV,eAAe;SAChB,CAAC,CAAA;QACF,OAAO;YACL,mBAAmB;YACnB,IAAI;YACJ,KAAK,EAAE,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE;YACrC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI;SACL,CAAA;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CACvB,OAAwB,EACxB,IAMC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,IAAI,CAAA;QAC3E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB;gBAC1C,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;gBAC/C,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;gBACvD,WAAW;gBACX,SAAS,EAAE,SAAS,IAAI,SAAS;gBACjC,MAAM,EAAE,OAAO,CAAC,iBAAiB;gBACjC,WAAW;gBACX,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC,CAAA;YACF,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,EAAE,CAAA;QAClF,CAAC;QACD,oFAAoF;QACpF,wFAAwF;QACxF,mFAAmF;QACnF,kFAAkF;QAClF,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAA;QACjD,CAAC;QACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,2DAA2D;gBACvE,+CAA+C,CAClD,CAAA;QACH,CAAC;QACD,kFAAkF;QAClF,gFAAgF;QAChF,gFAAgF;QAChF,+CAA+C;QAC/C,IAAI,MAAc,CAAA;QAClB,IAAI,mBAAuC,CAAA;QAC3C,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CACb,YAAY,kBAAkB,4CAA4C;oBACxE,yDAAyD,CAC5D,CAAA;YACH,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,yEAAyE;gBACzE,4EAA4E;gBAC5E,MAAM,IAAI,uBAAuB,CAC/B,aAAa,kBAAkB,gEAAgE,EAC/F,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAC1D,CAAA;YACH,CAAC;YACD,6EAA6E;YAC7E,4EAA4E;YAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAC3D,WAAW,EACX,OAAO,CAAC,iBAAiB,EACzB,kBAAkB,CACnB,CAAA;YACD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,2DAA2D;oBACvE,+CAA+C,CAClD,CAAA;YACH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAA;YACtF,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAA;YACpC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QACxB,CAAC;QACD,iFAAiF;QACjF,iFAAiF;QACjF,gFAAgF;QAChF,4EAA4E;QAC5E,gFAAgF;QAChF,6EAA6E;QAC7E,iFAAiF;QACjF,iEAAiE;QACjE,8EAA8E;QAC9E,wFAAwF;QACxF,MAAM,OAAO,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAA;QAChE,OAAO;YACL,IAAI,EAAE;gBACJ,OAAO;gBACP,iBAAiB,EAAE,MAAM;gBACzB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD;YACD,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAA;IACH,CAAC;CACF"}
|
package/dist/auth/signing.d.ts
CHANGED
|
@@ -55,7 +55,8 @@ export interface MachinePayload {
|
|
|
55
55
|
export declare function signerFor(secret: string): HmacSigner;
|
|
56
56
|
export declare class HmacSigner {
|
|
57
57
|
private readonly secret;
|
|
58
|
-
|
|
58
|
+
/** Per-audience signing keys, keyed by the `aud` string (`''` = the raw-secret base key). */
|
|
59
|
+
private readonly keyCache;
|
|
59
60
|
constructor(secret: string);
|
|
60
61
|
sign(payload: object): Promise<string>;
|
|
61
62
|
/**
|
|
@@ -71,6 +72,21 @@ export declare class HmacSigner {
|
|
|
71
72
|
aud?: TokenAudience;
|
|
72
73
|
}): Promise<T | null>;
|
|
73
74
|
private mac;
|
|
74
|
-
|
|
75
|
+
/**
|
|
76
|
+
* The HMAC signing key for an audience (HKDF-derived), memoised. Only a {@link
|
|
77
|
+
* KNOWN_AUDIENCES} value gets a derived subkey; an absent OR unrecognised `aud` uses the
|
|
78
|
+
* raw-secret base key (cache slot `''`). Bounding the derive/cache to the known set is
|
|
79
|
+
* what stops an attacker-chosen `aud` (read before the MAC check in `verify`) from
|
|
80
|
+
* ballooning the cache or forcing a per-request key derivation.
|
|
81
|
+
*/
|
|
82
|
+
private keyFor;
|
|
83
|
+
/** Raw-secret HMAC key — the fallback for audience-less (test/legacy) payloads. */
|
|
84
|
+
private importBaseKey;
|
|
85
|
+
/**
|
|
86
|
+
* Derive an independent 256-bit HMAC key for one audience: import the master secret as
|
|
87
|
+
* HKDF key material, expand it with a per-audience `info` tag, and import the result as
|
|
88
|
+
* the signing key. Isolates each token class cryptographically from the others.
|
|
89
|
+
*/
|
|
90
|
+
private deriveAudienceKey;
|
|
75
91
|
}
|
|
76
92
|
//# sourceMappingURL=signing.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AA8BA,yEAAyE;AACzE,eAAO,MAAM,cAAc;IACzB,gDAAgD;aAChD,OAAO,EAAE,SAAS;IAClB,iCAAiC;aACjC,UAAU,EAAE,aAAa;IACzB,kDAAkD;aAClD,SAAS,EAAE,WAAW;IACtB,sDAAsD;aACtD,QAAQ,EAAE,IAAI;IACd;;;;OAIG;aACH,OAAO,EAAE,SAAS;CACV,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEhF,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAA;IACV,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,0DAA0D;IAC1D,GAAG,EAAE,OAAO,cAAc,CAAC,OAAO,CAAA;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,cAAc,CAAC,OAAO,CAAA;IAClC,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAA;IACd,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/B,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAwBD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOpD;AACD,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IAEjE,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3C;IAED;;;;;;;;OAQG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,EAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,aAAa,CAAA;KAAE,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CA8BnB;YAEa,GAAG;IAKjB;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAUd,mFAAmF;IACnF,OAAO,CAAC,aAAa;IAUrB;;;;OAIG;YACW,iBAAiB;CAoBhC"}
|
package/dist/auth/signing.js
CHANGED
|
@@ -7,12 +7,21 @@ import { base64url, base64urlToBytes, timingSafeEqual } from '../crypto/encoding
|
|
|
7
7
|
// - the *container* token an implementation container uses against the LLM proxy
|
|
8
8
|
// - the short-lived *ws ticket* that authorises one WebSocket event stream
|
|
9
9
|
//
|
|
10
|
-
// Because they share a
|
|
10
|
+
// Because they share a secret and verifier, every token MUST carry an `aud`
|
|
11
11
|
// (audience) claim and every verifier MUST pin the audience it expects, so a
|
|
12
12
|
// token minted for one purpose cannot be replayed as another (e.g. a container
|
|
13
13
|
// proxy token acting as a full user session). `verify` rejects any token whose
|
|
14
14
|
// `aud` does not match the caller's expected audience.
|
|
15
15
|
//
|
|
16
|
+
// Beyond that pin, each audience is signed with its OWN key: the master secret is
|
|
17
|
+
// run through HKDF-SHA256 with a per-audience `info` tag to derive an independent
|
|
18
|
+
// 256-bit subkey. So a token class is cryptographically isolated — a signature made
|
|
19
|
+
// under one audience's key can't validate under another's even before the `aud`
|
|
20
|
+
// check — and the effective HMAC key is a full-entropy 32 bytes rather than the raw
|
|
21
|
+
// secret string. (Audience-less — or unrecognised-audience — payloads fall back to the
|
|
22
|
+
// raw secret; only the fixed known audiences get a derived subkey, so an attacker-chosen
|
|
23
|
+
// `aud` can't grow the key cache.)
|
|
24
|
+
//
|
|
16
25
|
// Format: `base64url(JSON payload).base64url(HMAC(base64url(JSON payload)))`.
|
|
17
26
|
// The payload is base64url (no dots), so the dot split is unambiguous. Payloads
|
|
18
27
|
// carrying an `exp` (epoch ms) are rejected once expired. There is no server-side
|
|
@@ -34,9 +43,22 @@ export const TOKEN_AUDIENCE = {
|
|
|
34
43
|
*/
|
|
35
44
|
machine: 'machine',
|
|
36
45
|
};
|
|
46
|
+
/** HKDF `info` tag for a token audience's derived signing subkey. */
|
|
47
|
+
function audienceInfo(aud) {
|
|
48
|
+
return `cat-factory:token:${aud}`;
|
|
49
|
+
}
|
|
50
|
+
/**
|
|
51
|
+
* The fixed set of audiences that get their own derived subkey. `verify` reads a token's
|
|
52
|
+
* CLAIMED `aud` before checking the MAC (to pick the key), and that claim is fully
|
|
53
|
+
* attacker-controlled — so the derive/cache path MUST be bounded to this known set.
|
|
54
|
+
* Otherwise a stream of tokens carrying distinct junk `aud` values would force an HKDF
|
|
55
|
+
* derivation per request AND grow the key cache without bound (an unauthenticated CPU +
|
|
56
|
+
* memory DoS). An unrecognised (or absent) audience falls back to the raw-secret base key.
|
|
57
|
+
*/
|
|
58
|
+
const KNOWN_AUDIENCES = new Set(Object.values(TOKEN_AUDIENCE));
|
|
37
59
|
/**
|
|
38
60
|
* Process-wide signer cache keyed by secret, so per-request verifications reuse the
|
|
39
|
-
* instance's imported HMAC `CryptoKey` instead of re-running
|
|
61
|
+
* instance's derived/imported HMAC `CryptoKey`s instead of re-running the key setup
|
|
40
62
|
* on every call. The secrets are few and config-derived, so the map stays tiny.
|
|
41
63
|
*/
|
|
42
64
|
const signers = new Map();
|
|
@@ -50,13 +72,14 @@ export function signerFor(secret) {
|
|
|
50
72
|
}
|
|
51
73
|
export class HmacSigner {
|
|
52
74
|
secret;
|
|
53
|
-
|
|
75
|
+
/** Per-audience signing keys, keyed by the `aud` string (`''` = the raw-secret base key). */
|
|
76
|
+
keyCache = new Map();
|
|
54
77
|
constructor(secret) {
|
|
55
78
|
this.secret = secret;
|
|
56
79
|
}
|
|
57
80
|
async sign(payload) {
|
|
58
81
|
const body = base64url(JSON.stringify(payload));
|
|
59
|
-
return `${body}.${base64url(await this.mac(body))}`;
|
|
82
|
+
return `${body}.${base64url(await this.mac(body, audienceOf(payload)))}`;
|
|
60
83
|
}
|
|
61
84
|
/**
|
|
62
85
|
* Return the payload when the signature is valid, unexpired, and (when an
|
|
@@ -74,25 +97,24 @@ export class HmacSigner {
|
|
|
74
97
|
if (dot <= 0 || dot === token.length - 1)
|
|
75
98
|
return null;
|
|
76
99
|
const body = token.slice(0, dot);
|
|
77
|
-
// Decode the signature
|
|
78
|
-
// fail closed (null → 401), never throw out of `atob` into a 500.
|
|
100
|
+
// Decode the signature + payload defensively: a malformed base64url tail or a
|
|
101
|
+
// non-JSON body must fail closed (null → 401), never throw out of `atob` into a 500.
|
|
79
102
|
let provided;
|
|
103
|
+
let payload;
|
|
80
104
|
try {
|
|
81
105
|
provided = base64urlToBytes(token.slice(dot + 1));
|
|
106
|
+
payload = JSON.parse(new TextDecoder().decode(base64urlToBytes(body)));
|
|
82
107
|
}
|
|
83
108
|
catch {
|
|
84
109
|
return null;
|
|
85
110
|
}
|
|
86
|
-
|
|
111
|
+
// Select the signing key from the token's CLAIMED audience so it matches whatever
|
|
112
|
+
// `sign` used. Reading the claimed `aud` before verifying is safe: it only chooses
|
|
113
|
+
// which key the MAC is checked against, and forging still requires that key. The
|
|
114
|
+
// caller's `opts.aud` pin below is the actual cross-token-confusion defence.
|
|
115
|
+
const expected = new Uint8Array(await this.mac(body, audienceOf(payload)));
|
|
87
116
|
if (!timingSafeEqual(provided, expected))
|
|
88
117
|
return null;
|
|
89
|
-
let payload;
|
|
90
|
-
try {
|
|
91
|
-
payload = JSON.parse(new TextDecoder().decode(base64urlToBytes(body)));
|
|
92
|
-
}
|
|
93
|
-
catch {
|
|
94
|
-
return null;
|
|
95
|
-
}
|
|
96
118
|
const exp = payload.exp;
|
|
97
119
|
if (typeof exp === 'number' && exp < Date.now())
|
|
98
120
|
return null;
|
|
@@ -102,15 +124,49 @@ export class HmacSigner {
|
|
|
102
124
|
return null;
|
|
103
125
|
return payload;
|
|
104
126
|
}
|
|
105
|
-
async mac(input) {
|
|
106
|
-
const key = await this.
|
|
127
|
+
async mac(input, aud) {
|
|
128
|
+
const key = await this.keyFor(aud);
|
|
107
129
|
return crypto.subtle.sign('HMAC', key, new TextEncoder().encode(input));
|
|
108
130
|
}
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
131
|
+
/**
|
|
132
|
+
* The HMAC signing key for an audience (HKDF-derived), memoised. Only a {@link
|
|
133
|
+
* KNOWN_AUDIENCES} value gets a derived subkey; an absent OR unrecognised `aud` uses the
|
|
134
|
+
* raw-secret base key (cache slot `''`). Bounding the derive/cache to the known set is
|
|
135
|
+
* what stops an attacker-chosen `aud` (read before the MAC check in `verify`) from
|
|
136
|
+
* ballooning the cache or forcing a per-request key derivation.
|
|
137
|
+
*/
|
|
138
|
+
keyFor(aud) {
|
|
139
|
+
const cacheKey = aud !== undefined && KNOWN_AUDIENCES.has(aud) ? aud : '';
|
|
140
|
+
let key = this.keyCache.get(cacheKey);
|
|
141
|
+
if (!key) {
|
|
142
|
+
key = cacheKey === '' ? this.importBaseKey() : this.deriveAudienceKey(cacheKey);
|
|
143
|
+
this.keyCache.set(cacheKey, key);
|
|
112
144
|
}
|
|
113
|
-
return
|
|
145
|
+
return key;
|
|
114
146
|
}
|
|
147
|
+
/** Raw-secret HMAC key — the fallback for audience-less (test/legacy) payloads. */
|
|
148
|
+
importBaseKey() {
|
|
149
|
+
return crypto.subtle.importKey('raw', new TextEncoder().encode(this.secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
|
|
150
|
+
}
|
|
151
|
+
/**
|
|
152
|
+
* Derive an independent 256-bit HMAC key for one audience: import the master secret as
|
|
153
|
+
* HKDF key material, expand it with a per-audience `info` tag, and import the result as
|
|
154
|
+
* the signing key. Isolates each token class cryptographically from the others.
|
|
155
|
+
*/
|
|
156
|
+
async deriveAudienceKey(aud) {
|
|
157
|
+
const material = await crypto.subtle.importKey('raw', new TextEncoder().encode(this.secret), 'HKDF', false, ['deriveBits']);
|
|
158
|
+
const bits = await crypto.subtle.deriveBits({
|
|
159
|
+
name: 'HKDF',
|
|
160
|
+
hash: 'SHA-256',
|
|
161
|
+
salt: new Uint8Array(0),
|
|
162
|
+
info: new TextEncoder().encode(audienceInfo(aud)),
|
|
163
|
+
}, material, 256);
|
|
164
|
+
return crypto.subtle.importKey('raw', bits, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
|
|
165
|
+
}
|
|
166
|
+
}
|
|
167
|
+
/** The `aud` claim of a payload as a string, or undefined (⇒ the raw-secret base key). */
|
|
168
|
+
function audienceOf(payload) {
|
|
169
|
+
const aud = payload.aud;
|
|
170
|
+
return typeof aud === 'string' ? aud : undefined;
|
|
115
171
|
}
|
|
116
172
|
//# sourceMappingURL=signing.js.map
|
package/dist/auth/signing.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEpF,iFAAiF;AACjF,kFAAkF;AAClF,qFAAqF;AACrF,qEAAqE;AACrE,2EAA2E;AAC3E,mFAAmF;AACnF,6EAA6E;AAC7E,EAAE;AACF,
|
|
1
|
+
{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEpF,iFAAiF;AACjF,kFAAkF;AAClF,qFAAqF;AACrF,qEAAqE;AACrE,2EAA2E;AAC3E,mFAAmF;AACnF,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,gFAAgF;AAChF,oFAAoF;AACpF,uFAAuF;AACvF,yFAAyF;AACzF,mCAAmC;AACnC,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,0EAA0E;AAE1E,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,gDAAgD;IAChD,OAAO,EAAE,SAAS;IAClB,iCAAiC;IACjC,UAAU,EAAE,aAAa;IACzB,kDAAkD;IAClD,SAAS,EAAE,WAAW;IACtB,sDAAsD;IACtD,QAAQ,EAAE,IAAI;IACd;;;;OAIG;IACH,OAAO,EAAE,SAAS;CACV,CAAA;AAyCV,qEAAqE;AACrE,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,qBAAqB,GAAG,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;AAEnF;;;;GAIG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;AAE7C,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AACD,MAAM,OAAO,UAAU;IAIQ,MAAM;IAHnC,6FAA6F;IAC5E,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEjE,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QAC/C,OAAO,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,KAAgC,EAChC,IAA8B;QAE9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAEhC,8EAA8E;QAC9E,qFAAqF;QACrF,IAAI,QAAoB,CAAA;QACxB,IAAI,OAAU,CAAA;QACd,IAAI,CAAC;YACH,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;YACjD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAM,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QAED,kFAAkF;QAClF,mFAAmF;QACnF,iFAAiF;QACjF,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC1E,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;QAErD,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAA;QAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAA;QAC5D,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,IAAI,EAAE,GAAG,KAAK,SAAS,IAAK,OAA6B,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QAC3F,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,GAAY;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACzE,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,GAAY;QACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;YAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,mFAAmF;IAC3E,aAAa;QACnB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACzC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;SAClD,EACD,QAAQ,EACR,GAAG,CACJ,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IACjG,CAAC;CACF;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAA;IAC9C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"WebCryptoWebhookVerifier.d.ts","sourceRoot":"","sources":["../../src/github/WebCryptoWebhookVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAY1D,qBAAa,wBAAyB,YAAW,eAAe;IAGlD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,UAAU,CAAC,CAAoB;IAEvC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,
|
|
1
|
+
{"version":3,"file":"WebCryptoWebhookVerifier.d.ts","sourceRoot":"","sources":["../../src/github/WebCryptoWebhookVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAY1D,qBAAa,wBAAyB,YAAW,eAAe;IAGlD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,UAAU,CAAC,CAAoB;IAEvC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnF;IAED,OAAO,CAAC,SAAS;CAYlB"}
|
|
@@ -13,6 +13,10 @@ export class WebCryptoWebhookVerifier {
|
|
|
13
13
|
this.secret = secret;
|
|
14
14
|
}
|
|
15
15
|
async verify(rawBody, signatureHeader) {
|
|
16
|
+
// Fail closed on an unconfigured secret: an empty HMAC key would let an attacker
|
|
17
|
+
// forge a signature over their own body (matches the GitLab verifier's guard).
|
|
18
|
+
if (!this.secret)
|
|
19
|
+
return false;
|
|
16
20
|
if (!signatureHeader || !signatureHeader.startsWith(PREFIX))
|
|
17
21
|
return false;
|
|
18
22
|
const provided = hexToBytes(signatureHeader.slice(PREFIX.length));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"WebCryptoWebhookVerifier.js","sourceRoot":"","sources":["../../src/github/WebCryptoWebhookVerifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,kFAAkF;AAClF,iEAAiE;AACjE,wEAAwE;AACxE,mFAAmF;AACnF,qFAAqF;AACrF,uEAAuE;AAEvE,MAAM,MAAM,GAAG,SAAS,CAAA;AAExB,MAAM,OAAO,wBAAwB;IAGN,MAAM;IAF3B,UAAU,CAAqB;IAEvC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,MAAM,CAAC,OAAoB,EAAE,eAA8B;QAC/D,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAE3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;QAC/E,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC5C,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACrF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3F,OAAO,KAAK,CAAA;AACd,CAAC"}
|
|
1
|
+
{"version":3,"file":"WebCryptoWebhookVerifier.js","sourceRoot":"","sources":["../../src/github/WebCryptoWebhookVerifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,kFAAkF;AAClF,iEAAiE;AACjE,wEAAwE;AACxE,mFAAmF;AACnF,qFAAqF;AACrF,uEAAuE;AAEvE,MAAM,MAAM,GAAG,SAAS,CAAA;AAExB,MAAM,OAAO,wBAAwB;IAGN,MAAM;IAF3B,UAAU,CAAqB;IAEvC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,MAAM,CAAC,OAAoB,EAAE,eAA8B;QAC/D,iFAAiF;QACjF,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAC9B,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAE3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;QAC/E,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC5C,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACrF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3F,OAAO,KAAK,CAAA;AACd,CAAC"}
|
package/dist/http/cors.d.ts
CHANGED
|
@@ -1,3 +1,10 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Whether an unset `CORS_ALLOWED_ORIGINS` should reflect any origin: yes only when
|
|
3
|
+
* `ENVIRONMENT` is an explicitly recognised development value (dev/test convenience), no
|
|
4
|
+
* otherwise — an UNSET, unknown, or production `ENVIRONMENT` all default-deny. Pass the
|
|
5
|
+
* deployment's `ENVIRONMENT` env value.
|
|
6
|
+
*/
|
|
7
|
+
export declare function corsReflectsWhenUnset(environment: string | undefined): boolean;
|
|
1
8
|
/**
|
|
2
9
|
* The request headers the browser is allowed to send cross-origin (the preflight
|
|
3
10
|
* `Access-Control-Allow-Headers` response). Shared by every runtime facade so the
|
|
@@ -17,9 +24,11 @@ export declare function parseAllowedOrigins(configured: string | undefined): str
|
|
|
17
24
|
* request's `Origin` and the configured allowlist. Returns the origin to echo
|
|
18
25
|
* back (so it works without credentials), or `null` to omit the header.
|
|
19
26
|
*
|
|
20
|
-
* -
|
|
21
|
-
* -
|
|
27
|
+
* - Allowlist contains `*` → allow any origin (explicit opt-in).
|
|
28
|
+
* - Allowlist has entries → echo the origin only when it's explicitly listed.
|
|
29
|
+
* - Allowlist unset/empty → reflect any origin when `reflectWhenUnset` (non-production),
|
|
30
|
+
* else `null` (production default-deny).
|
|
22
31
|
* - No request Origin (non-browser caller) → `null`; CORS doesn't apply.
|
|
23
32
|
*/
|
|
24
|
-
export declare function resolveCorsOrigin(requestOrigin: string | undefined | null, configured: string | undefined): string | null;
|
|
33
|
+
export declare function resolveCorsOrigin(requestOrigin: string | undefined | null, configured: string | undefined, reflectWhenUnset?: boolean): string | null;
|
|
25
34
|
//# sourceMappingURL=cors.d.ts.map
|
package/dist/http/cors.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/http/cors.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/http/cors.ts"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9E;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,UAKhC,CAAA;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAK5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACxC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,gBAAgB,UAAO,GACtB,MAAM,GAAG,IAAI,CAMf"}
|
package/dist/http/cors.js
CHANGED
|
@@ -1,8 +1,29 @@
|
|
|
1
1
|
// CORS origin policy. The set of allowed browser Origins is configuration, not
|
|
2
2
|
// code: this is a self-hosted system, so each provisioning org declares its own
|
|
3
|
-
// frontend origin(s) (comma-separated). A lone `*`
|
|
4
|
-
// any origin
|
|
5
|
-
//
|
|
3
|
+
// frontend origin(s) (comma-separated). A lone `*` explicitly opts into reflecting
|
|
4
|
+
// any origin. An UNSET allowlist reflects any origin ONLY when ENVIRONMENT is an
|
|
5
|
+
// explicitly recognised development value (dev/test convenience); an unset, unknown, or
|
|
6
|
+
// production ENVIRONMENT default-denies, so a deployment that forgets to set
|
|
7
|
+
// CORS_ALLOWED_ORIGINS fails safe rather than silently reflecting. Auth is a bearer
|
|
8
|
+
// header (not cookies) and credentials mode is off, so this is defense-in-depth.
|
|
9
|
+
/**
|
|
10
|
+
* Deployment ENVIRONMENT values that are EXPLICITLY non-production, where an unset
|
|
11
|
+
* `CORS_ALLOWED_ORIGINS` may reflect any origin as a dev/test convenience. The reflect
|
|
12
|
+
* behaviour is opt-in on one of these values — NOT the default — so a production
|
|
13
|
+
* deployment that sets neither `ENVIRONMENT` nor `CORS_ALLOWED_ORIGINS` fails safe
|
|
14
|
+
* (default-deny) rather than silently reflecting. e2e/dev set their own
|
|
15
|
+
* `CORS_ALLOWED_ORIGINS` anyway, so they're unaffected by the stricter default.
|
|
16
|
+
*/
|
|
17
|
+
const DEVELOPMENT_ENVIRONMENTS = new Set(['development', 'dev', 'test', 'testing', 'local', 'e2e']);
|
|
18
|
+
/**
|
|
19
|
+
* Whether an unset `CORS_ALLOWED_ORIGINS` should reflect any origin: yes only when
|
|
20
|
+
* `ENVIRONMENT` is an explicitly recognised development value (dev/test convenience), no
|
|
21
|
+
* otherwise — an UNSET, unknown, or production `ENVIRONMENT` all default-deny. Pass the
|
|
22
|
+
* deployment's `ENVIRONMENT` env value.
|
|
23
|
+
*/
|
|
24
|
+
export function corsReflectsWhenUnset(environment) {
|
|
25
|
+
return DEVELOPMENT_ENVIRONMENTS.has((environment ?? '').trim().toLowerCase());
|
|
26
|
+
}
|
|
6
27
|
/**
|
|
7
28
|
* The request headers the browser is allowed to send cross-origin (the preflight
|
|
8
29
|
* `Access-Control-Allow-Headers` response). Shared by every runtime facade so the
|
|
@@ -32,16 +53,20 @@ export function parseAllowedOrigins(configured) {
|
|
|
32
53
|
* request's `Origin` and the configured allowlist. Returns the origin to echo
|
|
33
54
|
* back (so it works without credentials), or `null` to omit the header.
|
|
34
55
|
*
|
|
35
|
-
* -
|
|
36
|
-
* -
|
|
56
|
+
* - Allowlist contains `*` → allow any origin (explicit opt-in).
|
|
57
|
+
* - Allowlist has entries → echo the origin only when it's explicitly listed.
|
|
58
|
+
* - Allowlist unset/empty → reflect any origin when `reflectWhenUnset` (non-production),
|
|
59
|
+
* else `null` (production default-deny).
|
|
37
60
|
* - No request Origin (non-browser caller) → `null`; CORS doesn't apply.
|
|
38
61
|
*/
|
|
39
|
-
export function resolveCorsOrigin(requestOrigin, configured) {
|
|
62
|
+
export function resolveCorsOrigin(requestOrigin, configured, reflectWhenUnset = true) {
|
|
40
63
|
if (!requestOrigin)
|
|
41
64
|
return null;
|
|
42
65
|
const allowed = parseAllowedOrigins(configured);
|
|
43
|
-
if (allowed.
|
|
66
|
+
if (allowed.includes('*'))
|
|
44
67
|
return requestOrigin;
|
|
68
|
+
if (allowed.length === 0)
|
|
69
|
+
return reflectWhenUnset ? requestOrigin : null;
|
|
45
70
|
return allowed.includes(requestOrigin) ? requestOrigin : null;
|
|
46
71
|
}
|
|
47
72
|
//# sourceMappingURL=cors.js.map
|
package/dist/http/cors.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/http/cors.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF
|
|
1
|
+
{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/http/cors.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAChF,mFAAmF;AACnF,iFAAiF;AACjF,wFAAwF;AACxF,6EAA6E;AAC7E,oFAAoF;AACpF,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;AAEnG;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA+B;IACnE,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc;IACd,eAAe;IACf,qBAAqB;IACrB,iBAAiB;CAClB,CAAA;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,UAA8B;IAChE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,OAAO,CAAC,CAAA;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAwC,EACxC,UAA8B,EAC9B,gBAAgB,GAAG,IAAI;IAEvB,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAA;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IACxE,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/D,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -29,7 +29,7 @@ export { InAppNotificationChannel } from './events/InAppNotificationChannel.js';
|
|
|
29
29
|
export { mountAuthGate } from './http/authGate.js';
|
|
30
30
|
export { param } from './http/params.js';
|
|
31
31
|
export { handleError } from './http/errorHandler.js';
|
|
32
|
-
export { CORS_ALLOWED_HEADERS, parseAllowedOrigins, resolveCorsOrigin } from './http/cors.js';
|
|
32
|
+
export { CORS_ALLOWED_HEADERS, corsReflectsWhenUnset, parseAllowedOrigins, resolveCorsOrigin, } from './http/cors.js';
|
|
33
33
|
export { base64url, base64urlToBytes, pkcs8PemToDer, timingSafeEqual } from './crypto/encoding.js';
|
|
34
34
|
export { WebCryptoSecretCipher, type WebCryptoSecretCipherOptions, } from './crypto/WebCryptoSecretCipher.js';
|
|
35
35
|
export { WebCryptoPersonalSecretCipher } from './crypto/WebCryptoPersonalSecretCipher.js';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EAAE,aAAa,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACzF,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAKpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAI5E,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}
|
package/dist/index.js
CHANGED
|
@@ -38,7 +38,7 @@ export { InAppNotificationChannel } from './events/InAppNotificationChannel.js';
|
|
|
38
38
|
export { mountAuthGate } from './http/authGate.js';
|
|
39
39
|
export { param } from './http/params.js';
|
|
40
40
|
export { handleError } from './http/errorHandler.js';
|
|
41
|
-
export { CORS_ALLOWED_HEADERS, parseAllowedOrigins, resolveCorsOrigin } from './http/cors.js';
|
|
41
|
+
export { CORS_ALLOWED_HEADERS, corsReflectsWhenUnset, parseAllowedOrigins, resolveCorsOrigin, } from './http/cors.js';
|
|
42
42
|
export { base64url, base64urlToBytes, pkcs8PemToDer, timingSafeEqual } from './crypto/encoding.js';
|
|
43
43
|
// Runtime-neutral (Web Crypto) credential encryption + GitHub-App authentication,
|
|
44
44
|
// shared by both facades so the Node service can mint installation tokens and
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAA+D,MAAM,eAAe,CAAA;AAC3F,OAAO,EAYN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GAQvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,GAElC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,GAEvB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAA+D,MAAM,eAAe,CAAA;AAC3F,OAAO,EAYN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GAQvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,GAElC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,GAEvB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EAAE,aAAa,EAAkC,MAAM,2BAA2B,CAAA;AACzF,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AACpF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AAsB3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAE5E,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}
|
|
@@ -1,4 +1,10 @@
|
|
|
1
1
|
import type { WebSearchResponse, WebSearchUpstream } from '../../runtime/gateways.js';
|
|
2
|
+
export declare const WEB_SEARCH_URL_SAFETY_POLICY: {
|
|
3
|
+
readonly schemes: readonly ['http', 'https'];
|
|
4
|
+
readonly allowHosts: readonly [];
|
|
5
|
+
};
|
|
6
|
+
/** Assert an account-supplied web-search URL is not an SSRF vector. Throws on a bad host. */
|
|
7
|
+
export declare function assertSafeWebSearchUrl(url: string): void;
|
|
2
8
|
/** Default number of results requested per search. */
|
|
3
9
|
export declare const DEFAULT_WEB_SEARCH_COUNT = 5;
|
|
4
10
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"upstreams.d.ts","sourceRoot":"","sources":["../../../src/modules/webSearch/upstreams.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"upstreams.d.ts","sourceRoot":"","sources":["../../../src/modules/webSearch/upstreams.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAOrF,eAAO,MAAM,4BAA4B;aAAK,OAAO,YAAG,MAAM,EAAE,OAAO;aAAG,UAAU;CAAe,CAAA;AAEnG,6FAA6F;AAC7F,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAExD;AAeD,sDAAsD;AACtD,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAgBzC;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,iBAAiB;IAE5D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAF3B,YACmB,MAAM,EAAE,MAAM,EACd,QAAQ,SAAmD,EAC1E;IAEE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAClD,OAAO,CAAC,iBAAiB,CAAC,CAkB5B;CACF;AAOD;;;;;;;GAOG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;IAI9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAH1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,YACE,OAAO,EAAE,MAAM,EACE,MAAM,CAAC,EAAE,MAAM,YAAA,EAGjC;IAEK,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAClD,OAAO,CAAC,iBAAiB,CAAC,CAgC5B;CACF;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,GAAG,iBAAiB,GAAG,SAAS,CAMhC"}
|
|
@@ -1,3 +1,18 @@
|
|
|
1
|
+
import { environmentsLogic, readCappedText, safeFetch } from '@cat-factory/integrations';
|
|
2
|
+
// SearXNG is reached at an account-configured URL, so — unlike the hardcoded Brave
|
|
3
|
+
// endpoint — it MUST be SSRF-guarded: block private/internal/metadata hosts (the SSRF
|
|
4
|
+
// target) while still allowing a public self-hosted instance over http or https. The
|
|
5
|
+
// same policy guards the write boundary (AccountSettingsService), so a bad URL is
|
|
6
|
+
// rejected when saved AND re-checked (with per-hop redirect revalidation) when fetched.
|
|
7
|
+
export const WEB_SEARCH_URL_SAFETY_POLICY = { schemes: ['http', 'https'], allowHosts: [] };
|
|
8
|
+
/** Assert an account-supplied web-search URL is not an SSRF vector. Throws on a bad host. */
|
|
9
|
+
export function assertSafeWebSearchUrl(url) {
|
|
10
|
+
environmentsLogic.assertSafeEnvironmentUrl(url, 'SearXNG URL', WEB_SEARCH_URL_SAFETY_POLICY);
|
|
11
|
+
}
|
|
12
|
+
/** Redirect/size failures from the shared SSRF-safe fetch surface as a plain search error. */
|
|
13
|
+
const makeSearchError = (status, message) => new Error(`Web search ${message.toLowerCase()} (HTTP ${status})`);
|
|
14
|
+
/** Hard cap on the bytes read off a search response body. */
|
|
15
|
+
const MAX_SEARCH_RESPONSE_BYTES = 2_000_000;
|
|
1
16
|
// Runtime-neutral web-search upstreams for the container search proxy. Each performs
|
|
2
17
|
// the actual search server-side (under the deployment's own provider key) and maps the
|
|
3
18
|
// provider's payload into the normalised SearXNG-style shape the proxy returns. They
|
|
@@ -65,17 +80,21 @@ export class SearxngWebSearchUpstream {
|
|
|
65
80
|
const url = new URL(`${this.base}/search`);
|
|
66
81
|
url.searchParams.set('q', query);
|
|
67
82
|
url.searchParams.set('format', 'json');
|
|
68
|
-
|
|
83
|
+
// Re-validate the (account-configured) host on every redirect hop so a permitted
|
|
84
|
+
// base can't 302 the request — with the optional bearer attached — to an internal
|
|
85
|
+
// or metadata host.
|
|
86
|
+
const res = await safeFetch(url.toString(), {
|
|
69
87
|
headers: {
|
|
70
88
|
accept: 'application/json',
|
|
71
89
|
...(this.apiKey ? { authorization: `Bearer ${this.apiKey}` } : {}),
|
|
72
90
|
},
|
|
73
91
|
...(opts.signal ? { signal: opts.signal } : {}),
|
|
74
|
-
});
|
|
92
|
+
}, assertSafeWebSearchUrl, makeSearchError);
|
|
75
93
|
if (!res.ok) {
|
|
76
94
|
throw new Error(`SearXNG search failed (HTTP ${res.status})`);
|
|
77
95
|
}
|
|
78
|
-
const
|
|
96
|
+
const text = await readCappedText(res, MAX_SEARCH_RESPONSE_BYTES, makeSearchError);
|
|
97
|
+
const json = JSON.parse(text);
|
|
79
98
|
const limit = clampCount(opts.count);
|
|
80
99
|
const results = (json.results ?? [])
|
|
81
100
|
.filter((r) => {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"upstreams.js","sourceRoot":"","sources":["../../../src/modules/webSearch/upstreams.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"upstreams.js","sourceRoot":"","sources":["../../../src/modules/webSearch/upstreams.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAGxF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,kFAAkF;AAClF,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,EAAW,CAAA;AAEnG,6FAA6F;AAC7F,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,EAAE,aAAa,EAAE,4BAA4B,CAAC,CAAA;AAC9F,CAAC;AAED,8FAA8F;AAC9F,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE,CAC1D,IAAI,KAAK,CAAC,cAAc,OAAO,CAAC,WAAW,EAAE,UAAU,MAAM,GAAG,CAAC,CAAA;AAEnE,6DAA6D;AAC7D,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAE3C,qFAAqF;AACrF,uFAAuF;AACvF,qFAAqF;AACrF,oFAAoF;AACpF,gFAAgF;AAEhF,sDAAsD;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC,4FAA4F;AAC5F,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAE/B,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,wBAAwB,CAAA;IACjF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAe,CAAC,EAAE,oBAAoB,CAAC,CAAA;AACpE,CAAC;AAOD;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAEd,MAAM;IACN,QAAQ;IAF3B,YACmB,MAAc,EACd,QAAQ,GAAG,gDAAgD;sBAD3D,MAAM;wBACN,QAAQ;IACxB,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,KAAa,EACb,IAAI,GAA6C,EAAE;QAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,EAAE;YAC5E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;QACtD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAA8D,EAAE;YACxE,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAA;QAClC,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QACnF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC3B,CAAC;CACF;AAOD;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IAIhB,MAAM;IAHR,IAAI,CAAQ;IAC7B,YACE,OAAe,EACE,MAAe;sBAAf,MAAM;QAEvB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,IAAI,GAA6C,EAAE;QAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,SAAS,CAAC,CAAA;QAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACtC,iFAAiF;QACjF,kFAAkF;QAClF,oBAAoB;QACpB,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,CAAC,QAAQ,EAAE,EACd;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,EACD,sBAAsB,EACtB,eAAe,CAChB,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,eAAe,CAAC,CAAA;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACjC,MAAM,CAAC,CAAC,CAAC,EAA0D,EAAE;YACpE,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAA;QAClC,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC3B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAIvC;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IACrC,IAAI,KAAK;QAAE,OAAO,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACtC,IAAI,OAAO;QAAE,OAAO,IAAI,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IACpF,OAAO,SAAS,CAAA;AAClB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cat-factory/server",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.68.1",
|
|
4
4
|
"description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -30,13 +30,13 @@
|
|
|
30
30
|
"hono": "^4.12.27",
|
|
31
31
|
"pino": "^10.3.1",
|
|
32
32
|
"valibot": "^1.4.2",
|
|
33
|
-
"@cat-factory/agents": "0.26.
|
|
33
|
+
"@cat-factory/agents": "0.26.14",
|
|
34
34
|
"@cat-factory/contracts": "0.82.0",
|
|
35
|
-
"@cat-factory/integrations": "0.56.
|
|
36
|
-
"@cat-factory/kernel": "0.
|
|
37
|
-
"@cat-factory/orchestration": "0.
|
|
35
|
+
"@cat-factory/integrations": "0.56.2",
|
|
36
|
+
"@cat-factory/kernel": "0.70.1",
|
|
37
|
+
"@cat-factory/orchestration": "0.59.1",
|
|
38
38
|
"@cat-factory/prompt-fragments": "0.9.42",
|
|
39
|
-
"@cat-factory/spend": "0.10.
|
|
39
|
+
"@cat-factory/spend": "0.10.75"
|
|
40
40
|
},
|
|
41
41
|
"devDependencies": {
|
|
42
42
|
"typescript": "7.0.1-rc",
|