@cleocode/core 2026.6.13 → 2026.6.14

package/dist/store/service-connections-accessor.js

@@ -0,0 +1,464 @@
+/**
+ * Service-vault accessor — store-level CRUD + policy-before-decrypt egress.
+ *
+ * EP-UNIVERSAL-SERVICE-VAULT (epic T11765 · saga SG-VAULT-CORE T10409 · M2 W1a ·
+ * task T11937 · AC3). The store layer for the universal SERVICE-credential vault
+ * (`service_connections` / `service_configs` / `agent_service_grants`).
+ *
+ * ## DB Open Guard (Gate 3 — strict)
+ *
+ * EVERY open goes through {@link openDualScopeDb}`('global')` (or its path-aware
+ * sibling {@link openDualScopeDbAtPath} for an injected test DB) — there is ZERO
+ * raw `new DatabaseSync(`. The typed Drizzle handle drives all CRUD; the accessor
+ * never constructs a native handle itself.
+ *
+ * ## Crypto reuse (DRY — no new crypto · T11710)
+ *
+ * `credentials_enc` holds the {@link encryptGlobal} ciphertext of the
+ * `{access_token, refresh_token}` JSON, keyed `id = service:${provider}:${label}`.
+ * The accessor calls {@link encryptGlobal}/{@link decryptGlobal} from
+ * `crypto/credentials.ts` — it adds no crypto of its own. The crypto functions are
+ * injectable ({@link ServiceVaultDeps}) so a test can spy on `decryptGlobal` and
+ * PROVE it is never invoked on a denied access (policy-before-decrypt, AC4).
+ *
+ * ## Policy-before-decrypt egress (AC4)
+ *
+ * {@link resolveSealedConnection} evaluates the {@link evaluateServiceAccess}
+ * trust gate FIRST (a pure decision from the agent's grant rows). It calls
+ * `decryptGlobal` ONLY when the gate returns `allowed: true`. A denied agent
+ * returns `null` BEFORE the decrypt call — the decrypt closure never runs. On
+ * allow, the plaintext is not surfaced inline: it is wrapped in a
+ * {@link makeSealedCredential} handle whose `resolveToken` thunk performs the
+ * decrypt at the wire (the same egress the LLM credential pool uses).
+ *
+ * ## OAuth seam (T11939)
+ *
+ * The OAuth build/exchange/refresh dance is the FOLLOW-UP (T11939). This accessor
+ * leaves the clean seam: {@link connectService} accepts an already-obtained token
+ * blob and writes its `encryptGlobal` ciphertext into `credentials_enc`; the OAuth
+ * flow simply calls `connectService` (or `updateConnectionCredentials`) with the
+ * tokens it negotiates. No OAuth logic lives here.
+ *
+ * @module store/service-connections-accessor
+ * @task T11937
+ * @epic T11765
+ * @saga T10409
+ * @see ./schema/cleo-global/services.ts — the three tables
+ * @see ./service-trust-gate.ts — the policy-before-decrypt decision
+ * @see ../crypto/credentials.ts — `encryptGlobal` / `decryptGlobal` (reused, not re-implemented)
+ * @see ../llm/sealed-credential.ts — `makeSealedCredential` (the shared egress handle)
+ */
+import { and, eq } from 'drizzle-orm';
+import { decryptGlobal, encryptGlobal } from '../crypto/credentials.js';
+import { makeSealedCredential, tokenPreview } from '../llm/sealed-credential.js';
+import { openDualScopeDb, openDualScopeDbAtPath } from './dual-scope-db.js';
+import { agentServiceGrants, serviceConnections, } from './schema/cleo-global/services.js';
+import { evaluateServiceAccess, parseSessionPolicy, } from './service-trust-gate.js';
+/** The `encryptGlobal`/`decryptGlobal` id for a connection's token blob. */
+function credentialId(provider, label) {
+    return `service:${provider}:${label}`;
+}
+/**
+ * Open the global service-vault handle at an EXPLICIT path (test seam).
+ *
+ * Production callers MUST use {@link openDualScopeDb}`('global')` (resolved
+ * canonical path). This path-aware variant exists so tests open a temp-dir
+ * `cleo.db` — never `.cleo/*.db`. Returns the typed global Drizzle handle.
+ *
+ * @param dbPath - Absolute path to the temp `cleo.db`.
+ * @returns The typed {@link CleoGlobalDb} handle.
+ * @task T11937
+ */
+export async function openServiceVaultAtPath(dbPath) {
+    const handle = await openDualScopeDbAtPath('global', dbPath);
+    return handle.db;
+}
+/** Resolve the global Drizzle handle — injected, else canonical open. */
+async function resolveDb(deps) {
+    if (deps?.db !== undefined)
+        return deps.db;
+    const handle = await openDualScopeDb('global');
+    return handle.db;
+}
+/**
+ * CONNECT a service: encrypt the token blob and upsert the connection row.
+ *
+ * The token blob is JSON-serialized and {@link encryptGlobal}-encrypted under
+ * `id = service:${provider}:${label}` — only the ciphertext is written. On a
+ * repeat `connect` for the same `(provider, label)` the row's credentials/scopes/
+ * metadata/expiry are REFRESHED in place and `status` is reset to `active` (an
+ * expired/revoked connection is re-activated by re-connecting).
+ *
+ * @returns The connection id.
+ * @task T11937
+ */
+export async function connectService(params, deps) {
+    const db = await resolveDb(deps);
+    const encrypt = deps?.encrypt ?? encryptGlobal;
+    const id = credentialId(params.provider, params.label);
+    const credentialsEnc = await encrypt(JSON.stringify(params.tokens), id);
+    const now = new Date().toISOString().replace('T', ' ').slice(0, 19);
+    const scopesJson = JSON.stringify(params.scopes ?? []);
+    const metadataJson = JSON.stringify(params.metadata ?? {});
+    const existing = await db
+        .select({ id: serviceConnections.id })
+        .from(serviceConnections)
+        .where(and(eq(serviceConnections.provider, params.provider), eq(serviceConnections.label, params.label)))
+        .limit(1);
+    if (existing.length > 0 && existing[0] !== undefined) {
+        const connId = existing[0].id;
+        await db
+            .update(serviceConnections)
+            .set({
+            status: 'active',
+            credentialsEnc,
+            scopes: scopesJson,
+            expiresAt: params.expiresAt ?? null,
+            metadata: metadataJson,
+            updatedAt: now,
+        })
+            .where(eq(serviceConnections.id, connId));
+        return connId;
+    }
+    const inserted = await db
+        .insert(serviceConnections)
+        .values({
+        provider: params.provider,
+        label: params.label,
+        status: 'active',
+        credentialsEnc,
+        scopes: scopesJson,
+        expiresAt: params.expiresAt ?? null,
+        metadata: metadataJson,
+    })
+        .returning({ id: serviceConnections.id });
+    const row = inserted[0];
+    if (row === undefined) {
+        throw new Error('service connect: insert returned no id');
+    }
+    return row.id;
+}
+/**
+ * UPDATE a connection's encrypted token blob + expiry in place (OAuth refresh
+ * persistence seam — T11939).
+ *
+ * The self-heal path ({@link import('./service-oauth.js').selfHealConnection})
+ * calls this after a refresh: the new `{accessToken, refreshToken}` blob is
+ * {@link encryptGlobal}-encrypted under the SAME `id = service:${provider}:${label}`
+ * and written back, with `expires_at` bumped and `status` kept `active`. Only the
+ * ciphertext is persisted — exactly like {@link connectService}.
+ *
+ * @returns `true` if a row was updated, `false` when no such `(provider, label)`.
+ * @task T11939
+ */
+export async function updateConnectionTokens(params, deps) {
+    const db = await resolveDb(deps);
+    const encrypt = deps?.encrypt ?? encryptGlobal;
+    const id = credentialId(params.provider, params.label);
+    const credentialsEnc = await encrypt(JSON.stringify(params.tokens), id);
+    const now = new Date().toISOString().replace('T', ' ').slice(0, 19);
+    const updated = await db
+        .update(serviceConnections)
+        .set({
+        credentialsEnc,
+        ...(params.expiresAt !== undefined ? { expiresAt: params.expiresAt } : {}),
+        updatedAt: now,
+    })
+        .where(and(eq(serviceConnections.provider, params.provider), eq(serviceConnections.label, params.label)))
+        .returning({ id: serviceConnections.id });
+    return updated.length > 0;
+}
+/**
+ * RESOLVE a connection's DECRYPTED token blob — **policy-before-decrypt** (T11939).
+ *
+ * The self-heal seam: the OAuth flow needs the REFRESH token (inside the encrypted
+ * blob) plus `expires_at` to decide whether to refresh. Like
+ * {@link resolveSealedConnection}, the trust gate runs FIRST and `decryptGlobal`
+ * is invoked ONLY on allow — a denied agent gets `null` with NO decrypt. Unlike
+ * the sealed resolve, this returns the plaintext blob inline (the caller is the
+ * refresh machinery, which re-encrypts immediately) so it MUST NOT cross a
+ * logging/serialization boundary.
+ *
+ * @returns The decrypted blob + expiry on allow; `null` when denied / missing /
+ *   not `active` / no stored credential.
+ * @task T11939
+ */
+export async function loadDecryptedTokenBlob(params, deps) {
+    const db = await resolveDb(deps);
+    const decrypt = deps?.decrypt ?? decryptGlobal;
+    const rows = await db
+        .select()
+        .from(serviceConnections)
+        .where(and(eq(serviceConnections.provider, params.provider), eq(serviceConnections.label, params.label)))
+        .limit(1);
+    const conn = rows[0];
+    if (conn === undefined || conn.status !== 'active' || conn.credentialsEnc === null) {
+        return null;
+    }
+    // POLICY BEFORE DECRYPT — no crypto has run yet.
+    const grants = await loadAgentGrants(db, params.agentId);
+    const decision = evaluateServiceAccess(grants, {
+        agentId: params.agentId,
+        serviceConnectionId: conn.id,
+        approved: params.approved,
+    });
+    if (!decision.allowed) {
+        return null;
+    }
+    const id = credentialId(params.provider, params.label);
+    const plaintext = await decrypt(conn.credentialsEnc, id);
+    const blob = JSON.parse(plaintext);
+    return { id: conn.id, blob, expiresAt: conn.expiresAt };
+}
+/** Map a raw connection row to a non-secret {@link ServiceConnectionView}. */
+function toView(row) {
+    let scopes = [];
+    let metadata = {};
+    try {
+        const parsed = JSON.parse(row.scopes);
+        if (Array.isArray(parsed))
+            scopes = parsed.filter((s) => typeof s === 'string');
+    }
+    catch {
+        // malformed scopes JSON → empty list (non-secret display only)
+    }
+    try {
+        const parsed = JSON.parse(row.metadata);
+        if (typeof parsed === 'object' && parsed !== null) {
+            metadata = parsed;
+        }
+    }
+    catch {
+        // malformed metadata JSON → empty object
+    }
+    return {
+        id: row.id,
+        provider: row.provider,
+        label: row.label,
+        status: row.status,
+        scopes,
+        expiresAt: row.expiresAt,
+        metadata,
+        connectedAt: row.connectedAt,
+        updatedAt: row.updatedAt,
+        hasCredentials: row.credentialsEnc !== null && row.credentialsEnc !== '',
+    };
+}
+/**
+ * GET one connection as a non-secret view (NEVER decrypts the token).
+ *
+ * @returns The view, or `null` when no such `(provider, label)` exists.
+ * @task T11937
+ */
+export async function getConnection(provider, label, deps) {
+    const db = await resolveDb(deps);
+    const rows = await db
+        .select()
+        .from(serviceConnections)
+        .where(and(eq(serviceConnections.provider, provider), eq(serviceConnections.label, label)))
+        .limit(1);
+    const row = rows[0];
+    return row === undefined ? null : toView(row);
+}
+/**
+ * LIST connections as non-secret views (NEVER decrypts), optionally by provider.
+ *
+ * @param provider - When set, restrict to one provider; otherwise all.
+ * @task T11937
+ */
+export async function listConnections(provider, deps) {
+    const db = await resolveDb(deps);
+    const rows = provider === undefined
+        ? await db.select().from(serviceConnections)
+        : await db.select().from(serviceConnections).where(eq(serviceConnections.provider, provider));
+    return rows.map(toView);
+}
+/**
+ * LIST every agent grant as a NON-SECRET {@link AgentGrantView}, joined to its
+ * connection's `provider`/`label` for display. NEVER decrypts and never carries
+ * a token — the dashboard read path (T11943).
+ *
+ * The join is performed in-memory (one `agent_service_grants` scan + one
+ * `service_connections` scan, both already redacted) so the accessor stays a
+ * pure read with no second round-trip per grant. A grant whose connection was
+ * deleted out-of-band resolves `provider`/`label` to `null` (defensive — the
+ * cascade should prevent this, but the view must not throw).
+ *
+ * @param agentId - When set, restrict to one agent's grants; otherwise all.
+ * @task T11943
+ */
+export async function listAllGrants(agentId, deps) {
+    const db = await resolveDb(deps);
+    const grantRows = agentId === undefined
+        ? await db.select().from(agentServiceGrants)
+        : await db.select().from(agentServiceGrants).where(eq(agentServiceGrants.agentId, agentId));
+    // Build a connection-id → identity map once (redacted views, no token).
+    const connRows = await db.select().from(serviceConnections);
+    const identityById = new Map();
+    for (const c of connRows)
+        identityById.set(c.id, { provider: c.provider, label: c.label });
+    return grantRows.map((g) => {
+        const identity = identityById.get(g.serviceConnectionId) ?? null;
+        const policy = parseSessionPolicy(g.sessionPolicy);
+        return {
+            agentId: g.agentId,
+            serviceConnectionId: g.serviceConnectionId,
+            provider: identity?.provider ?? null,
+            label: identity?.label ?? null,
+            mode: policy.mode,
+            manualApproval: policy.manualApproval ?? false,
+            createdAt: g.createdAt,
+            updatedAt: g.updatedAt,
+        };
+    });
+}
+/**
+ * REVOKE a connection: flip `status` to `revoked` and CLEAR the credential blob.
+ *
+ * Clearing `credentials_enc` makes the secret unrecoverable (the ciphertext is
+ * gone) — a revoke is permanent until a fresh `connect`. The row is kept (not
+ * deleted) so grants/audit referencing it remain coherent.
+ *
+ * @returns `true` if a row was revoked, `false` if no such connection.
+ * @task T11937
+ */
+export async function revokeConnection(provider, label, deps) {
+    const db = await resolveDb(deps);
+    const now = new Date().toISOString().replace('T', ' ').slice(0, 19);
+    const updated = await db
+        .update(serviceConnections)
+        .set({ status: 'revoked', credentialsEnc: null, updatedAt: now })
+        .where(and(eq(serviceConnections.provider, provider), eq(serviceConnections.label, label)))
+        .returning({ id: serviceConnections.id });
+    return updated.length > 0;
+}
+/**
+ * DELETE a connection and CASCADE its agent grants (the hard `service revoke`).
+ *
+ * Unlike {@link revokeConnection} (a soft status flip that keeps the row), this
+ * REMOVES the `service_connections` row entirely and first deletes every
+ * `agent_service_grants` row that references it. The cascade is performed
+ * EXPLICITLY in application code — the in-file FK on `service_connection_id` is
+ * declared without `ON DELETE CASCADE`, and `foreign_keys` is not assumed ON —
+ * so grants are deleted FIRST, then the connection, leaving no dangling grant.
+ *
+ * @returns A {@link DeleteConnectionResult} reporting the cascade outcome.
+ * @task T11941
+ */
+export async function deleteConnectionCascade(provider, label, deps) {
+    const db = await resolveDb(deps);
+    const rows = await db
+        .select({ id: serviceConnections.id })
+        .from(serviceConnections)
+        .where(and(eq(serviceConnections.provider, provider), eq(serviceConnections.label, label)))
+        .limit(1);
+    const row = rows[0];
+    if (row === undefined) {
+        return { deleted: false, connectionId: null, grantsRemoved: 0 };
+    }
+    const connectionId = row.id;
+    // Cascade grants FIRST (no ON DELETE CASCADE on the FK), then the connection.
+    const removedGrants = await db
+        .delete(agentServiceGrants)
+        .where(eq(agentServiceGrants.serviceConnectionId, connectionId))
+        .returning({ agentId: agentServiceGrants.agentId });
+    await db.delete(serviceConnections).where(eq(serviceConnections.id, connectionId));
+    return { deleted: true, connectionId, grantsRemoved: removedGrants.length };
+}
+/**
+ * GRANT an agent access to a connection with a session policy.
+ *
+ * @param agentId - The agent to grant.
+ * @param serviceConnectionId - The connection id (from {@link connectService}).
+ * @param policy - The {@link SessionPolicy}; defaults to a bare allow.
+ * @task T11937
+ */
+export async function grantAgentAccess(agentId, serviceConnectionId, policy = { mode: 'allow' }, deps) {
+    const db = await resolveDb(deps);
+    const now = new Date().toISOString().replace('T', ' ').slice(0, 19);
+    const policyJson = JSON.stringify(policy);
+    const existing = await db
+        .select({ agentId: agentServiceGrants.agentId })
+        .from(agentServiceGrants)
+        .where(and(eq(agentServiceGrants.agentId, agentId), eq(agentServiceGrants.serviceConnectionId, serviceConnectionId)))
+        .limit(1);
+    if (existing.length > 0) {
+        await db
+            .update(agentServiceGrants)
+            .set({ sessionPolicy: policyJson, updatedAt: now })
+            .where(and(eq(agentServiceGrants.agentId, agentId), eq(agentServiceGrants.serviceConnectionId, serviceConnectionId)));
+        return;
+    }
+    await db
+        .insert(agentServiceGrants)
+        .values({ agentId, serviceConnectionId, sessionPolicy: policyJson });
+}
+/** Load an agent's grants as the gate-shaped {@link ServiceGrant} projection. */
+async function loadAgentGrants(db, agentId) {
+    const rows = await db
+        .select()
+        .from(agentServiceGrants)
+        .where(eq(agentServiceGrants.agentId, agentId));
+    return rows.map((r) => ({
+        agentId: r.agentId,
+        serviceConnectionId: r.serviceConnectionId,
+        sessionPolicy: parseSessionPolicy(r.sessionPolicy),
+    }));
+}
+/**
+ * RESOLVE a connection to a sealed credential — **policy-before-decrypt** egress.
+ *
+ * The trust gate runs FIRST (a pure {@link evaluateServiceAccess} decision over
+ * the agent's grants). `decryptGlobal` is invoked ONLY when the gate returns
+ * `allowed: true` — and even then NOT inline: the plaintext is materialized lazily
+ * inside the {@link makeSealedCredential} `resolveToken` thunk at the wire. A
+ * denied agent returns `null` BEFORE the decrypt closure is ever built or run, so
+ * a spy on `decryptGlobal` records ZERO calls on a deny (AC4 proof).
+ *
+ * @returns A {@link SealedCredential} on allow; `null` when denied or when the
+ *   connection is missing / not `active` / has no stored credential.
+ * @task T11937
+ */
+export async function resolveSealedConnection(params, deps) {
+    const db = await resolveDb(deps);
+    const decrypt = deps?.decrypt ?? decryptGlobal;
+    // 1. Load the connection (non-secret) — needed for the gate's connection id.
+    const rows = await db
+        .select()
+        .from(serviceConnections)
+        .where(and(eq(serviceConnections.provider, params.provider), eq(serviceConnections.label, params.label)))
+        .limit(1);
+    const conn = rows[0];
+    if (conn === undefined || conn.status !== 'active' || conn.credentialsEnc === null) {
+        return null;
+    }
+    // 2. POLICY BEFORE DECRYPT — evaluate the trust gate. No crypto has run yet.
+    const grants = await loadAgentGrants(db, params.agentId);
+    const decision = evaluateServiceAccess(grants, {
+        agentId: params.agentId,
+        serviceConnectionId: conn.id,
+        approved: params.approved,
+    });
+    if (!decision.allowed) {
+        // Denied — return BEFORE building/running the decrypt thunk. `decrypt`
+        // (the spied `decryptGlobal`) is never called on this path (AC4).
+        return null;
+    }
+    // 3. Allowed — wrap in a sealed handle whose resolveToken decrypts AT THE WIRE.
+    const ciphertext = conn.credentialsEnc;
+    const id = credentialId(params.provider, params.label);
+    return makeSealedCredential({
+        provider: params.provider,
+        account: params.label,
+        // Non-secret preview: we have not decrypted, so name the credential by id.
+        tokenPreview: tokenPreview('', 'oauth'),
+        resolveToken: async () => {
+            // The SOLE decrypt point — runs only when the wire calls fetch(). Returns
+            // the access token (the wire-bound bearer); refresh stays in the blob.
+            const plaintext = await decrypt(ciphertext, id);
+            const blob = JSON.parse(plaintext);
+            return blob.accessToken;
+        },
+    });
+}
+//# sourceMappingURL=service-connections-accessor.js.map

package/dist/store/service-connections-accessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-connections-accessor.js","sourceRoot":"","sources":["../../src/store/service-connections-accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAGH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAqB,eAAe,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EACL,kBAAkB,EAElB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,qBAAqB,EACrB,kBAAkB,GAGnB,MAAM,yBAAyB,CAAC;AAsEjC,4EAA4E;AAC5E,SAAS,YAAY,CAAC,QAAgB,EAAE,KAAa;IACnD,OAAO,WAAW,QAAQ,IAAI,KAAK,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAc;IACzD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,IAAI,EAAE,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA4B,EAC5B,IAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,aAAa,CAAC;IAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC;SACrC,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAChD,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAC3C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,MAAM,EAAE,QAAQ;YAChB,cAAc;YACd,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACnC,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,kBAAkB,CAAC;SAC1B,MAAM,CAAC;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,QAAQ;QAChB,cAAc;QACd,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,QAAQ,EAAE,YAAY;KACvB,CAAC;SACD,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAKC,EACD,IAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,aAAa,CAAC;IAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,kBAAkB,CAAC;SAC1B,GAAG,CAAC;QACH,cAAc;QACd,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,SAAS,EAAE,GAAG;KACf,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAChD,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAC3C,CACF;SACA,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5B,CAAC;AAYD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAA4B,EAC5B,IAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,aAAa,CAAC;IAE/C,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAChD,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAC3C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE;QAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,mBAAmB,EAAE,IAAI,CAAC,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAqB,CAAC;IACvD,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,SAAS,MAAM,CAAC,GAA2C;IACzD,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,QAAQ,GAAG,MAAiC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ;QACR,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,KAAK,EAAE;KACzE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,KAAa,EACb,IAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;SAC1F,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAiB,EACjB,IAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GACR,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAC5C,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AA8BD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,IAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,SAAS,GACb,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAC5C,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAEhG,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,GAAG,EAA+C,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAE3F,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC;QACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;YAC1C,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI;YACpC,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;YAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;YAC9C,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,KAAa,EACb,IAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,kBAAkB,CAAC;SAC1B,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SAChE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;SAC1F,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5B,CAAC;AAYD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,KAAa,EACb,IAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC;SACrC,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;SAC1F,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,MAAM,aAAa,GAAG,MAAM,EAAE;SAC3B,MAAM,CAAC,kBAAkB,CAAC;SAC1B,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;SAC/D,SAAS,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACnF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,mBAA2B,EAC3B,SAAwB,EAAE,IAAI,EAAE,OAAO,EAAE,EACzC,IAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,EAAE,CAAC;SAC/C,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,EACvC,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAChE,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;aAClD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,EACvC,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAChE,CACF,CAAC;QACJ,OAAO;IACT,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,kBAAkB,CAAC;SAC1B,MAAM,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,eAAe,CAAC,EAAgB,EAAE,OAAe;IAC9D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC;KACnD,CAAC,CAAC,CAAC;AACN,CAAC;AAcD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA4B,EAC5B,IAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,aAAa,CAAC;IAE/C,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAChD,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAC3C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE;QAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,mBAAmB,EAAE,IAAI,CAAC,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,uEAAuE;QACvE,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gFAAgF;IAChF,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC;IACvC,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,oBAAoB,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,KAAK;QACrB,2EAA2E;QAC3E,YAAY,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC;QACvC,YAAY,EAAE,KAAK,IAAqB,EAAE;YACxC,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAqB,CAAC;YACvD,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/store/service-host-matcher.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Service host/path → provider matcher (T11940 · M2-W3 · AC1).
+ *
+ * EP-UNIVERSAL-SERVICE-VAULT (epic T11765 · saga SG-VAULT-CORE T10409). The first
+ * half of the injection-at-tool-boundary seam: given the host (and optional path)
+ * of an outbound request a harness tool is about to make, resolve which
+ * {@link ServiceProviderDef} (and therefore which `service_connections` provider)
+ * the request's host belongs to, plus the matching {@link ServiceHostRule} that
+ * declares HOW the credential is injected (the {@link HostAuthStrategy}).
+ *
+ * Pure, side-effect-free, decrypt-free: it consults ONLY the declarative
+ * {@link SERVICE_PROVIDERS} registry (frozen DATA in `@cleocode/contracts`). It
+ * never opens a DB, never decrypts, never touches the network — so it is NOT a DB
+ * chokepoint concern (Gate 3) and carries no credential material.
+ *
+ * ## Matching model (mirrors onecli `apps.rs::match_host`)
+ *
+ * `host` matches EXACTLY against `ServiceHostRule.host`, with one well-defined
+ * suffix case: a rule host beginning with `.` (or a registry host that is a bare
+ * apex like `amazonaws.com`) matches any sub-domain suffix — used for wildcard
+ * families like AWS. `pathPrefix`, when present on a rule, further narrows the
+ * match to requests whose path starts with it (e.g. the legacy
+ * `www.googleapis.com/gmail/` endpoints). When multiple rules match, the MOST
+ * SPECIFIC wins: a `pathPrefix` rule beats a host-only rule, and a longer
+ * `pathPrefix` beats a shorter one.
+ *
+ * @module store/service-host-matcher
+ * @task T11940
+ * @epic T11765
+ * @saga T10409
+ * @see @cleocode/contracts/vault/service-provider — SERVICE_PROVIDERS + ServiceHostRule
+ * @see ./service-injection.ts — the injector that consumes a match to mutate a request
+ */
+import { type HostAuthStrategy, type ServiceHostRule, type ServiceProviderDef } from '@cleocode/contracts';
+/** The result of resolving an outbound request's host/path to a service provider. */
+export interface ServiceHostMatch {
+    /** The matched provider definition. */
+    readonly provider: ServiceProviderDef;
+    /** The specific host rule that matched (declares the injection strategy). */
+    readonly rule: ServiceHostRule;
+    /** Convenience: the injection strategy from {@link rule}. */
+    readonly strategy: HostAuthStrategy;
+}
+/**
+ * Resolve an outbound request's host (+ optional path) to the matching service
+ * provider + host rule, or `null` when no provider claims the host (T11940 AC1).
+ *
+ * When several rules match (e.g. a host-only rule and a `pathPrefix` rule on the
+ * same host), the MOST SPECIFIC wins: a rule with a `pathPrefix` beats one without,
+ * and a longer `pathPrefix` beats a shorter one. Among equally-specific matches the
+ * first registry entry wins (stable iteration order of {@link SERVICE_PROVIDERS}).
+ *
+ * @param host - The request host (e.g. `api.github.com`; a `:port` / trailing dot
+ *   is tolerated).
+ * @param path - The request path (defaults to `/`); narrows `pathPrefix` rules.
+ * @returns The {@link ServiceHostMatch}, or `null` when no provider matches.
+ * @task T11940
+ */
+export declare function matchServiceHost(host: string, path?: string): ServiceHostMatch | null;
+/**
+ * Resolve the matching provider for a full URL string (convenience over
+ * {@link matchServiceHost} that parses the URL's host + path).
+ *
+ * @param url - The absolute request URL (e.g. `https://api.github.com/user`).
+ * @returns The {@link ServiceHostMatch}, or `null` when the URL is unparseable or
+ *   no provider matches.
+ * @task T11940
+ */
+export declare function matchServiceUrl(url: string): ServiceHostMatch | null;
+//# sourceMappingURL=service-host-matcher.d.ts.map

package/dist/store/service-host-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-host-matcher.d.ts","sourceRoot":"","sources":["../../src/store/service-host-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;CACrC;AAwCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,gBAAgB,GAAG,IAAI,CAmBlF;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAQpE"}