@framers/agentos 0.13.63 → 0.13.65

package/dist/io/channels/meetings/IMeetingBotProvider.d.ts

@@ -0,0 +1,128 @@
+import type { MeetingBotCapabilities, MeetingLeaveReason, MeetingPlatform, MeetingRunRecord, NormalizedMeetingEvent } from './types.js';
+/** What reached the product's events route: the provider authenticates and parses it. */
+export interface ProviderEventContext {
+    /** The provider the route names. */
+    providerName: string;
+    /** The request's HTTP method. */
+    method: string;
+    /** The request's URL. */
+    url: string;
+    /** The request's headers. */
+    headers: Record<string, string | string[] | undefined>;
+    /** The request's body as it arrived, before any parse. */
+    body: string | Buffer;
+    /** The run the report names, when the route can read it before parsing (a path parameter). */
+    runId?: string;
+}
+/** A provider's verdict on whether a report is authentic. */
+export interface ProviderVerificationResult {
+    /** Whether the report is authentic. */
+    valid: boolean;
+    /** Why the report was refused. */
+    error?: string;
+}
+/** The channel's events that one report holds. */
+export interface ProviderParseResult {
+    /** The report's events, each with a stable id. */
+    events: NormalizedMeetingEvent[];
+    /** The report as the provider decoded it. */
+    rawData?: unknown;
+}
+/** What dispatch hands a provider. The tokens are minted at dispatch and never stored in clear. */
+export interface DispatchInput {
+    /** The run to start: its link, its bot's name, its notice, its stop phrase and its limits. */
+    run: MeetingRunRecord;
+    /** The run's room: the server's url, the room's name and the bot's publish-only token. */
+    room: {
+        url: string;
+        name: string;
+        publishToken: string;
+    };
+    /** The per-run bearer token the worker presents on every report. */
+    workerToken: string;
+    /** Where the worker sends its reports. */
+    reportUrl: string;
+}
+/** What a provider answers a dispatch with; the manager keeps both on the run's dispatch record. */
+export interface DispatchResult {
+    /** The worker that took the run. */
+    workerId?: string;
+    /** The provider's own reference for the run. */
+    providerRunRef?: string;
+}
+/**
+ * A command the manager sends to a run's bot: `startCapture` and
+ * `suspendCapture` start and stop the audio it passes on, `postChat` posts to
+ * the meeting's chat, `leave` leaves the meeting with a reason, and `kill`
+ * stops the bot at once.
+ */
+export type ProviderCommand = {
+    name: 'startCapture';
+} | {
+    name: 'suspendCapture';
+} | {
+    name: 'postChat';
+    text: string;
+} | {
+    name: 'leave';
+    reason: MeetingLeaveReason;
+} | {
+    name: 'kill';
+};
+/** One run as a provider's workers report it. */
+export interface ProviderUsage {
+    /** The run. */
+    runId: string;
+    /** Whether a worker still holds the run. */
+    alive: boolean;
+    /** The seconds the worker has counted for the run. */
+    seconds: number;
+}
+/**
+ * One way of joining meetings. A provider ships as an extension pack with the
+ * kind `meeting-provider`; the host registers it on the manager.
+ */
+export interface IMeetingBotProvider {
+    /** The name the manager registers the provider under; runs and reports carry it. */
+    readonly name: string;
+    /** The platforms the provider joins. */
+    readonly platforms: readonly MeetingPlatform[];
+    /** What the provider declares about itself; the notice and the stop path follow from it. */
+    readonly capabilities: MeetingBotCapabilities;
+    /** The provider's own authentication of a report: a platform's signature scheme, or the worker's per-run token against the run's dispatch record. */
+    verifyEvent(ctx: ProviderEventContext, run: MeetingRunRecord | undefined): ProviderVerificationResult;
+    /**
+     * Turns a verified report into the channel's events, each with a stable id; throws on a report it cannot read. When the
+     * report was verified against a run, its caller applies only the events that name that run: a worker's per-run token
+     * speaks for its own run alone.
+     */
+    parseEvent(ctx: ProviderEventContext): ProviderParseResult;
+    /** Tells a join url's platform, or why it is refused. */
+    checkJoinUrl(url: string): {
+        ok: true;
+        platform: MeetingPlatform;
+    } | {
+        ok: false;
+        message: string;
+    };
+    /** Hands the run to a worker with the room and the tokens minted for it; rejects when the run cannot start. */
+    dispatch(input: DispatchInput): Promise<DispatchResult>;
+    /**
+     * Sends a command to the run's bot. A provider passes on no audio of a run
+     * before the run's first `startCapture`, and none after a `suspendCapture`
+     * until the next `startCapture`: the manager sends `startCapture` only once
+     * the run's notice is confirmed posted and its stop monitor is healthy.
+     */
+    command(runId: string, command: ProviderCommand): Promise<void>;
+    /** Deletes a provider's own copies of a run. Ours keep none; the method stands so a purge always has an answer. */
+    deleteRun(input: {
+        runId: string;
+    }): Promise<{
+        deleted: boolean;
+    }>;
+    /** Each run asked for (every run the provider knows when `runIds` is absent), alive or not, with the seconds it has counted. */
+    usage(input: {
+        runIds?: string[];
+    }): Promise<ProviderUsage[]>;
+}
+//# sourceMappingURL=IMeetingBotProvider.d.ts.map

package/dist/io/channels/meetings/IMeetingBotProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IMeetingBotProvider.d.ts","sourceRoot":"","sources":["../../../../src/io/channels/meetings/IMeetingBotProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,yFAAyF;AACzF,MAAM,WAAW,oBAAoB;IACnC,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,0DAA0D;IAC1D,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6DAA6D;AAC7D,MAAM,WAAW,0BAA0B;IACzC,uCAAuC;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,8FAA8F;IAC9F,GAAG,EAAE,gBAAgB,CAAC;IACtB,0FAA0F;IAC1F,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,eAAe;IACf,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,qJAAqJ;IACrJ,WAAW,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,gBAAgB,GAAG,SAAS,GAAG,0BAA0B,CAAC;IACtG;;;;OAIG;IACH,UAAU,CAAC,GAAG,EAAE,oBAAoB,GAAG,mBAAmB,CAAC;IAC3D,yDAAyD;IACzD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACpG,+GAA+G;IAC/G,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,mHAAmH;IACnH,SAAS,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnE,gIAAgI;IAChI,KAAK,CAAC,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC/D"}

package/dist/io/channels/meetings/IMeetingBotProvider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=IMeetingBotProvider.js.map

package/dist/io/channels/meetings/IMeetingBotProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IMeetingBotProvider.js","sourceRoot":"","sources":["../../../../src/io/channels/meetings/IMeetingBotProvider.ts"],"names":[],"mappings":""}

package/dist/io/channels/meetings/providers/mock.d.ts

@@ -0,0 +1,46 @@
+import type { DispatchInput, DispatchResult, IMeetingBotProvider, ProviderCommand, ProviderEventContext, ProviderParseResult, ProviderUsage, ProviderVerificationResult } from '../IMeetingBotProvider.js';
+import type { MeetingBotCapabilities, MeetingPlatform, MeetingRunRecord, NormalizedMeetingEvent, ProviderEventType } from '../types.js';
+/** Builds the context a worker's report would produce, for tests. */
+export declare function mockEventContext(runId: string, type: ProviderEventType, data: NormalizedMeetingEvent['data'], at: number, workerToken: string): ProviderEventContext;
+/** A provider for tests: it records dispatches and commands, and its reports are driven by the test through {@link mockEventContext}. */
+export declare class MockMeetingBotProvider implements IMeetingBotProvider {
+    readonly name = "mock";
+    readonly platforms: readonly MeetingPlatform[];
+    readonly capabilities: MeetingBotCapabilities;
+    /** Each run's dispatch input, by run id. */
+    readonly dispatched: Map<string, DispatchInput>;
+    /** Each run's commands, in the order they were sent. */
+    readonly commands: Map<string, ProviderCommand[]>;
+    /** The run ids `deleteRun` was called with, in order. */
+    readonly deleted: string[];
+    /** What `usage()` answers; tests set it. */
+    alive: Map<string, number>;
+    /** When set, dispatch rejects with it (a worker with no slot). */
+    dispatchError: Error | undefined;
+    /** Runs inside `dispatch`, before it records anything: a test puts a race here (a cancel while the dispatch is in flight). */
+    beforeDispatch: ((input: DispatchInput) => Promise<void>) | undefined;
+    verifyEvent(ctx: ProviderEventContext, run: MeetingRunRecord | undefined): ProviderVerificationResult;
+    parseEvent(ctx: ProviderEventContext): ProviderParseResult;
+    checkJoinUrl(url: string): {
+        ok: true;
+        platform: MeetingPlatform;
+    } | {
+        ok: false;
+        message: string;
+    };
+    dispatch(input: DispatchInput): Promise<DispatchResult>;
+    command(runId: string, command: ProviderCommand): Promise<void>;
+    deleteRun(input: {
+        runId: string;
+    }): Promise<{
+        deleted: boolean;
+    }>;
+    usage(input: {
+        runIds?: string[];
+    }): Promise<ProviderUsage[]>;
+    /** The token a run was dispatched with, for a test that drives its reports. */
+    tokenOf(runId: string): string;
+    /** For a test that wants the hash a run store would hold. */
+    static hash(token: string): string;
+}
+//# sourceMappingURL=mock.d.ts.map

package/dist/io/channels/meetings/providers/mock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.d.ts","sourceRoot":"","sources":["../../../../../src/io/channels/meetings/providers/mock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,0BAA0B,EAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAExI,qEAAqE;AACrE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,iBAAiB,EACvB,IAAI,EAAE,sBAAsB,CAAC,MAAM,CAAC,EACpC,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,oBAAoB,CAStB;AAMD,yIAAyI;AACzI,qBAAa,sBAAuB,YAAW,mBAAmB;IAChE,QAAQ,CAAC,IAAI,UAAU;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAsC;IACpF,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAS3C;IACF,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,6BAAoC;IACvD,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,iCAAwC;IACzD,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAM;IAChC,4CAA4C;IAC5C,KAAK,sBAA6B;IAClC,kEAAkE;IAClE,aAAa,EAAE,KAAK,GAAG,SAAS,CAAC;IACjC,8HAA8H;IAC9H,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IAEtE,WAAW,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,gBAAgB,GAAG,SAAS,GAAG,0BAA0B;IASrG,UAAU,CAAC,GAAG,EAAE,oBAAoB,GAAG,mBAAmB;IAgB1D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAM7F,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAQvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/D,SAAS,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAKlE,KAAK,CAAC,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKnE,+EAA+E;IAC/E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAM9B,6DAA6D;IAC7D,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAGnC"}

package/dist/io/channels/meetings/providers/mock.js

@@ -0,0 +1,101 @@
+import { createHash } from 'node:crypto';
+import { hashWorkerToken, workerTokenMatches } from '../signing.js';
+/** Builds the context a worker's report would produce, for tests. */
+export function mockEventContext(runId, type, data, at, workerToken) {
+    return {
+        providerName: 'mock',
+        method: 'POST',
+        url: `/events/mock/${runId}`,
+        headers: { authorization: `Bearer ${workerToken}` },
+        body: JSON.stringify({ runId, type, at, data }),
+        runId,
+    };
+}
+// The join links the mock accepts: a Meet meeting code link, and a Teams meeting link on either of Microsoft's hosts.
+const MEET = /^https:\/\/meet\.google\.com\/[a-z]{3}-[a-z]{4}-[a-z]{3}(\?.*)?$/;
+const TEAMS = /^https:\/\/teams\.(microsoft\.com|live\.com)\/(l\/)?meet(up-join)?\//;
+/** A provider for tests: it records dispatches and commands, and its reports are driven by the test through {@link mockEventContext}. */
+export class MockMeetingBotProvider {
+    constructor() {
+        this.name = 'mock';
+        this.platforms = ['google_meet', 'microsoft_teams'];
+        this.capabilities = {
+            joinsAsParticipant: true,
+            postsChat: true,
+            readsChat: true,
+            audioPath: 'livekit_room',
+            recordsAudio: false,
+            transcribes: false,
+            keeps: 'nothing',
+            stopPath: 'chat',
+        };
+        /** Each run's dispatch input, by run id. */
+        this.dispatched = new Map();
+        /** Each run's commands, in the order they were sent. */
+        this.commands = new Map();
+        /** The run ids `deleteRun` was called with, in order. */
+        this.deleted = [];
+        /** What `usage()` answers; tests set it. */
+        this.alive = new Map();
+    }
+    verifyEvent(ctx, run) {
+        const header = ctx.headers.authorization ?? ctx.headers.Authorization;
+        const value = Array.isArray(header) ? header[0] : header;
+        const token = value?.startsWith('Bearer ') ? value.slice(7) : undefined;
+        if (!token)
+            return { valid: false, error: 'no bearer token' };
+        if (!run?.dispatch)
+            return { valid: false, error: 'no dispatch record for the run' };
+        return workerTokenMatches(token, run.dispatch.workerTokenHash) ? { valid: true } : { valid: false, error: 'token mismatch' };
+    }
+    parseEvent(ctx) {
+        const body = typeof ctx.body === 'string' ? ctx.body : ctx.body.toString('utf8');
+        const raw = JSON.parse(body);
+        // the report's run, type and time, then a digest of the whole report: a repeated report keeps its id, and two reports of one type at one time do not share one
+        const digest = createHash('sha256').update(body).digest('hex').slice(0, 12);
+        return {
+            events: [{ eventId: `mock:${raw.runId}:${raw.type}:${raw.at}:${digest}`, runId: raw.runId, type: raw.type, at: raw.at, data: raw.data }],
+            rawData: raw,
+        };
+    }
+    checkJoinUrl(url) {
+        if (MEET.test(url))
+            return { ok: true, platform: 'google_meet' };
+        if (TEAMS.test(url))
+            return { ok: true, platform: 'microsoft_teams' };
+        return { ok: false, message: 'not a Google Meet or Microsoft Teams join link' };
+    }
+    async dispatch(input) {
+        if (this.dispatchError)
+            throw this.dispatchError;
+        await this.beforeDispatch?.(input);
+        this.dispatched.set(input.run.runId, input);
+        this.alive.set(input.run.runId, 0);
+        return { workerId: 'mock-worker', providerRunRef: `mock-${input.run.runId}` };
+    }
+    async command(runId, command) {
+        const list = this.commands.get(runId) ?? [];
+        list.push(command);
+        this.commands.set(runId, list);
+    }
+    async deleteRun(input) {
+        this.deleted.push(input.runId);
+        return { deleted: false };
+    }
+    async usage(input) {
+        const ids = input.runIds ?? [...this.alive.keys()];
+        return ids.map((runId) => ({ runId, alive: this.alive.has(runId), seconds: this.alive.get(runId) ?? 0 }));
+    }
+    /** The token a run was dispatched with, for a test that drives its reports. */
+    tokenOf(runId) {
+        const d = this.dispatched.get(runId);
+        if (!d)
+            throw new Error(`no dispatch for ${runId}`);
+        return d.workerToken;
+    }
+    /** For a test that wants the hash a run store would hold. */
+    static hash(token) {
+        return hashWorkerToken(token);
+    }
+}
+//# sourceMappingURL=mock.js.map

package/dist/io/channels/meetings/providers/mock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.js","sourceRoot":"","sources":["../../../../../src/io/channels/meetings/providers/mock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAapE,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,IAAuB,EACvB,IAAoC,EACpC,EAAU,EACV,WAAmB;IAEnB,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,gBAAgB,KAAK,EAAE;QAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;QACnD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/C,KAAK;KACN,CAAC;AACJ,CAAC;AAED,sHAAsH;AACtH,MAAM,IAAI,GAAG,kEAAkE,CAAC;AAChF,MAAM,KAAK,GAAG,sEAAsE,CAAC;AAErF,yIAAyI;AACzI,MAAM,OAAO,sBAAsB;IAAnC;QACW,SAAI,GAAG,MAAM,CAAC;QACd,cAAS,GAA+B,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QAC3E,iBAAY,GAA2B;YAC9C,kBAAkB,EAAE,IAAI;YACxB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,cAAc;YACzB,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,MAAM;SACjB,CAAC;QACF,4CAA4C;QACnC,eAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;QACvD,wDAAwD;QAC/C,aAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;QACzD,yDAAyD;QAChD,YAAO,GAAa,EAAE,CAAC;QAChC,4CAA4C;QAC5C,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAwEpC,CAAC;IAlEC,WAAW,CAAC,GAAyB,EAAE,GAAiC;QACtE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzD,MAAM,KAAK,GAAG,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACrF,OAAO,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC/H,CAAC;IAED,UAAU,CAAC,GAAyB;QAClC,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAK1B,CAAC;QACF,+JAA+J;QAC/J,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,OAAO;YACL,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACxI,OAAO,EAAE,GAAG;SACb,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,GAAW;QACtB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,CAAC,aAAa,CAAC;QACjD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,QAAQ,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,OAAwB;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAwB;QACtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA4B;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,+EAA+E;IAC/E,OAAO,CAAC,KAAa;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,WAAW,CAAC;IACvB,CAAC;IAED,6DAA6D;IAC7D,MAAM,CAAC,IAAI,CAAC,KAAa;QACvB,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/io/channels/meetings/signing.d.ts

@@ -0,0 +1,102 @@
+/**
+ * @module channels/meetings/signing
+ *
+ * Three ways the channel authenticates, kept apart: the envelope a host signs
+ * its outbound deliveries with, the per-run bearer token a worker presents on
+ * its reports, and the box that seals a run's meeting url at rest. A
+ * provider's own scheme (a platform's webhook signature) lives in that
+ * provider.
+ */
+/** The three header names of the envelope. A host passes its own (a product's branded names are the product's policy, never the library's). */
+export interface EnvelopeHeaderNames {
+    /** The header that carries the delivery's id. */
+    id: string;
+    /** The header that carries the time the delivery was signed, in milliseconds since the epoch. */
+    timestamp: string;
+    /** The header that carries the signature. */
+    signature: string;
+}
+/** The header names the envelope uses when a host passes none. */
+export declare const DEFAULT_ENVELOPE_HEADERS: Readonly<EnvelopeHeaderNames>;
+/** How far a delivery's timestamp may be from the receiver's clock. */
+export declare const ENVELOPE_WINDOW_MS = 300000;
+/**
+ * `v1,` then the base64 HMAC-SHA256 of `<id>.<timestamp>.<payload>` under the destination's secret.
+ *
+ * @param secret - The destination's secret.
+ * @param id - The delivery's id.
+ * @param timestampMs - The time the delivery is signed, in milliseconds since the epoch.
+ * @param payload - The body exactly as it is sent.
+ */
+export declare function signEnvelope(secret: string, id: string, timestampMs: number, payload: string): string;
+/**
+ * The three headers of one delivery: its id, its time and its {@link signEnvelope} signature.
+ *
+ * @param secret - The destination's secret.
+ * @param id - The delivery's id.
+ * @param timestampMs - The time the delivery is signed, in milliseconds since the epoch.
+ * @param payload - The body exactly as it is sent.
+ * @param names - The header names; {@link DEFAULT_ENVELOPE_HEADERS} when absent.
+ */
+export declare function envelopeHeaders(secret: string, id: string, timestampMs: number, payload: string, names?: EnvelopeHeaderNames): Record<string, string>;
+/**
+ * The receiving side: the three headers, the raw payload and the receiver's clock.
+ *
+ * @param secret - The destination's secret.
+ * @param headers - The delivery's headers.
+ * @param payload - The body exactly as it arrived, before any parse.
+ * @param nowMs - The receiver's clock, in milliseconds since the epoch.
+ * @param options - `windowMs`, how far the delivery's time may be from `nowMs` ({@link ENVELOPE_WINDOW_MS} when absent); `names`, the header names ({@link DEFAULT_ENVELOPE_HEADERS} when absent).
+ * @returns `{ valid: true }`, or `valid: false` with why: a header missing, a timestamp that is not a number, a timestamp outside the window, or a signature that does not match.
+ */
+export declare function verifyEnvelope(secret: string, headers: Record<string, string | string[] | undefined>, payload: string, nowMs: number, options?: {
+    windowMs?: number;
+    names?: EnvelopeHeaderNames;
+}): {
+    valid: boolean;
+    error?: string;
+};
+/** 32 random bytes, base64url: the bearer a worker presents on every report of one run. */
+export declare function mintWorkerToken(): string;
+/** The SHA-256 of a worker token, in hex: what the run's dispatch record keeps, never the token itself. */
+export declare function hashWorkerToken(token: string): string;
+/**
+ * Whether `token` is the one whose hash is `hash`, compared in constant time.
+ *
+ * @param token - The bearer a report presented.
+ * @param hash - The {@link hashWorkerToken} hash the run's dispatch record keeps.
+ * @returns false as well when `hash` is not 64 hex digits.
+ */
+export declare function workerTokenMatches(token: string, hash: string): boolean;
+/**
+ * Seals a run's meeting url at rest under one 32-byte key the host holds, with
+ * the library's AES-256-GCM sealing ({@link sealSecret}, {@link openSecret}): a
+ * fresh nonce per seal, so one value seals to a different text each time, and
+ * the text `v1.box.<base64url(nonce | ciphertext | tag)>`. A context given to
+ * `seal` (the run's id) is bound into the text, so a text moved to another
+ * run's row does not open there.
+ */
+export declare class SecretBox {
+    private readonly key;
+    /**
+     * @param key - The host's key: 32 bytes. The box keeps a copy, so a host that wipes or reuses its buffer afterwards does not change the box's key.
+     * @throws RangeError when `key` is not 32 bytes.
+     */
+    constructor(key: Buffer);
+    /**
+     * Seals `plain`; the sealed text differs on every call.
+     *
+     * @param plain - The text to seal.
+     * @param context - What the text belongs to (the run's id), bound into the text as additional authenticated data; `open` must be given the same. Empty when absent.
+     */
+    seal(plain: string, context?: string): string;
+    /**
+     * Opens a text this box's key sealed.
+     *
+     * @param sealed - The sealed text.
+     * @param context - The context the text was sealed with; empty when absent.
+     * @throws SealedSecretError when the text is not a sealed text, was sealed under another key or with another context, or was changed.
+     */
+    open(sealed: string, context?: string): string;
+}
+//# sourceMappingURL=signing.d.ts.map

package/dist/io/channels/meetings/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../../../src/io/channels/meetings/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,+IAA+I;AAC/I,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,iGAAiG;IACjG,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,kEAAkE;AAClE,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,mBAAmB,CAA8F,CAAC;AAClK,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAE1C;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGrG;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,mBAA8C,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM/K;AAQD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAC/D;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAcpC;AAED,2FAA2F;AAC3F,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvE;AAKD;;;;;;;GAOG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IAEjC;;;OAGG;gBACS,GAAG,EAAE,MAAM;IAKvB;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,MAAM;IAIzC;;;;;;OAMG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,MAAM;CAG3C"}

package/dist/io/channels/meetings/signing.js

@@ -0,0 +1,141 @@
+/**
+ * @module channels/meetings/signing
+ *
+ * Three ways the channel authenticates, kept apart: the envelope a host signs
+ * its outbound deliveries with, the per-run bearer token a worker presents on
+ * its reports, and the box that seals a run's meeting url at rest. A
+ * provider's own scheme (a platform's webhook signature) lives in that
+ * provider.
+ */
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { openSecret, sealSecret } from '../../../core/llm/auth/sealing.js';
+/** The header names the envelope uses when a host passes none. */
+export const DEFAULT_ENVELOPE_HEADERS = { id: 'x-webhook-id', timestamp: 'x-webhook-timestamp', signature: 'x-webhook-signature' };
+/** How far a delivery's timestamp may be from the receiver's clock. */
+export const ENVELOPE_WINDOW_MS = 300000;
+/**
+ * `v1,` then the base64 HMAC-SHA256 of `<id>.<timestamp>.<payload>` under the destination's secret.
+ *
+ * @param secret - The destination's secret.
+ * @param id - The delivery's id.
+ * @param timestampMs - The time the delivery is signed, in milliseconds since the epoch.
+ * @param payload - The body exactly as it is sent.
+ */
+export function signEnvelope(secret, id, timestampMs, payload) {
+    const mac = createHmac('sha256', secret).update(`${id}.${timestampMs}.${payload}`).digest('base64');
+    return `v1,${mac}`;
+}
+/**
+ * The three headers of one delivery: its id, its time and its {@link signEnvelope} signature.
+ *
+ * @param secret - The destination's secret.
+ * @param id - The delivery's id.
+ * @param timestampMs - The time the delivery is signed, in milliseconds since the epoch.
+ * @param payload - The body exactly as it is sent.
+ * @param names - The header names; {@link DEFAULT_ENVELOPE_HEADERS} when absent.
+ */
+export function envelopeHeaders(secret, id, timestampMs, payload, names = DEFAULT_ENVELOPE_HEADERS) {
+    return {
+        [names.id]: id,
+        [names.timestamp]: String(timestampMs),
+        [names.signature]: signEnvelope(secret, id, timestampMs, payload),
+    };
+}
+// A header by its name, or by its name in lower case (Node's form for incoming headers); the first of a repeated header.
+function header(headers, name) {
+    const v = headers[name] ?? headers[name.toLowerCase()];
+    return Array.isArray(v) ? v[0] : v;
+}
+/**
+ * The receiving side: the three headers, the raw payload and the receiver's clock.
+ *
+ * @param secret - The destination's secret.
+ * @param headers - The delivery's headers.
+ * @param payload - The body exactly as it arrived, before any parse.
+ * @param nowMs - The receiver's clock, in milliseconds since the epoch.
+ * @param options - `windowMs`, how far the delivery's time may be from `nowMs` ({@link ENVELOPE_WINDOW_MS} when absent); `names`, the header names ({@link DEFAULT_ENVELOPE_HEADERS} when absent).
+ * @returns `{ valid: true }`, or `valid: false` with why: a header missing, a timestamp that is not a number, a timestamp outside the window, or a signature that does not match.
+ */
+export function verifyEnvelope(secret, headers, payload, nowMs, options = {}) {
+    const names = options.names ?? DEFAULT_ENVELOPE_HEADERS;
+    const windowMs = options.windowMs ?? ENVELOPE_WINDOW_MS;
+    const id = header(headers, names.id);
+    const ts = header(headers, names.timestamp);
+    const sig = header(headers, names.signature);
+    if (!id || !ts || !sig)
+        return { valid: false, error: 'missing envelope header' };
+    const timestamp = Number(ts);
+    if (!Number.isFinite(timestamp))
+        return { valid: false, error: 'bad timestamp' };
+    if (Math.abs(nowMs - timestamp) > windowMs)
+        return { valid: false, error: 'outside the window' };
+    const expected = Buffer.from(signEnvelope(secret, id, timestamp, payload));
+    const given = Buffer.from(sig);
+    if (expected.length !== given.length || !timingSafeEqual(expected, given))
+        return { valid: false, error: 'signature mismatch' };
+    return { valid: true };
+}
+/** 32 random bytes, base64url: the bearer a worker presents on every report of one run. */
+export function mintWorkerToken() {
+    return randomBytes(32).toString('base64url');
+}
+/** The SHA-256 of a worker token, in hex: what the run's dispatch record keeps, never the token itself. */
+export function hashWorkerToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+/**
+ * Whether `token` is the one whose hash is `hash`, compared in constant time.
+ *
+ * @param token - The bearer a report presented.
+ * @param hash - The {@link hashWorkerToken} hash the run's dispatch record keeps.
+ * @returns false as well when `hash` is not 64 hex digits.
+ */
+export function workerTokenMatches(token, hash) {
+    // hex decoding stops at the first character that is not a hex digit, so a longer value that starts with the hash would decode to it
+    if (!/^[0-9a-f]{64}$/i.test(hash))
+        return false;
+    const a = Buffer.from(hashWorkerToken(token), 'hex');
+    const b = Buffer.from(hash, 'hex');
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+// The key id the box writes into each sealed text. It is part of the stored form: a text sealed under one id opens only under that id.
+const SECRET_BOX_KEY_ID = 'box';
+/**
+ * Seals a run's meeting url at rest under one 32-byte key the host holds, with
+ * the library's AES-256-GCM sealing ({@link sealSecret}, {@link openSecret}): a
+ * fresh nonce per seal, so one value seals to a different text each time, and
+ * the text `v1.box.<base64url(nonce | ciphertext | tag)>`. A context given to
+ * `seal` (the run's id) is bound into the text, so a text moved to another
+ * run's row does not open there.
+ */
+export class SecretBox {
+    /**
+     * @param key - The host's key: 32 bytes. The box keeps a copy, so a host that wipes or reuses its buffer afterwards does not change the box's key.
+     * @throws RangeError when `key` is not 32 bytes.
+     */
+    constructor(key) {
+        if (key.length !== 32)
+            throw new RangeError('SecretBox needs a 32-byte key');
+        this.key = { id: SECRET_BOX_KEY_ID, key: Buffer.from(key) };
+    }
+    /**
+     * Seals `plain`; the sealed text differs on every call.
+     *
+     * @param plain - The text to seal.
+     * @param context - What the text belongs to (the run's id), bound into the text as additional authenticated data; `open` must be given the same. Empty when absent.
+     */
+    seal(plain, context = '') {
+        return sealSecret(plain, this.key.key, this.key.id, context);
+    }
+    /**
+     * Opens a text this box's key sealed.
+     *
+     * @param sealed - The sealed text.
+     * @param context - The context the text was sealed with; empty when absent.
+     * @throws SealedSecretError when the text is not a sealed text, was sealed under another key or with another context, or was changed.
+     */
+    open(sealed, context = '') {
+        return Buffer.from(openSecret(sealed, [this.key], context)).toString('utf8');
+    }
+}
+//# sourceMappingURL=signing.js.map

package/dist/io/channels/meetings/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../../../src/io/channels/meetings/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,mCAAmC,CAAC;AAW5F,kEAAkE;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAkC,EAAE,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;AAClK,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAO,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,EAAU,EAAE,WAAmB,EAAE,OAAe;IAC3F,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpG,OAAO,MAAM,GAAG,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,EAAU,EAAE,WAAmB,EAAE,OAAe,EAAE,QAA6B,wBAAwB;IACrJ,OAAO;QACL,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE;QACd,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC;QACtC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,yHAAyH;AACzH,SAAS,MAAM,CAAC,OAAsD,EAAE,IAAY;IAClF,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,OAAsD,EACtD,OAAe,EACf,KAAa,EACb,UAA8D,EAAE;IAEhE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,wBAAwB,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC;IACxD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAClF,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACjF,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAChI,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,eAAe;IAC7B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,IAAY;IAC5D,oIAAoI;IACpI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,uIAAuI;AACvI,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,OAAO,SAAS;IAGpB;;;OAGG;IACH,YAAY,GAAW;QACrB,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,+BAA+B,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,KAAa,EAAE,OAAO,GAAG,EAAE;QAC9B,OAAO,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,MAAc,EAAE,OAAO,GAAG,EAAE;QAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/E,CAAC;CACF"}