@jini-ai/admin 0.1.0

package/dist/react/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @file `@jini-ai/admin/react` — the React layer. Presentational primitives the admin shell and its
+ * panels are built from.
+ *
+ * ## What belongs here
+ *
+ * Components and hooks that are genuinely reusable across hosts. Anything that decides *policy* —
+ * which panels exist, what a route means, who may see a section — lives in `/core` and is passed in
+ * as data. `Sidebar` is the worked example: it renders an `AdminNavGroup[]` produced by `/core`'s
+ * `buildNav`, and has no nav list of its own.
+ *
+ * ## Styling contract
+ *
+ * **Every component here is unstyled**, with one narrow exception. Most emit stable class names
+ * (`.cms-nav`, `.row-menu-*`, `.confirm-dialog`, `.btn-danger`, `.btn-warning`, `.btn-secondary`,
+ * `.visually-hidden`) and ship no CSS whatsoever — the host owns the stylesheet. Inline styles
+ * appear only where a value must be measured at runtime — portal coordinates in `Sidebar`'s rail
+ * tooltip and `RowMenu`'s popup. `InteractiveHtmlEditor` is the exception: it (transitively, via
+ * `@jini-ai/ui/html-editor`, which this file's own `InteractiveHtmlEditor` composes with a
+ * Tovu-specific embed-protection predicate) imports GrapesJS's own vendor stylesheet, because it
+ * wraps a third-party editor whose chrome does not render without it — see that primitive's file
+ * header for why this isn't authored styling the exception undoes.
+ *
+ * A few behaviors documented in these files assume the host defines a matching rule (for instance
+ * that `.visually-hidden` is `position: absolute`, so `ConfirmButton`'s live region does not
+ * consume layout). Those assumptions are called out where they are load-bearing.
+ *
+ * ## Runtime
+ *
+ * `browser` — `react-dom`'s `createPortal` into `document.body`, `localStorage`, and `window`
+ * listeners. Declared as such in `jini.entries`. React and react-dom are optional peers of this
+ * package, so a host importing only `/core`, `/browser`, or `/server` never installs them.
+ */
+export { resolveTone, toneClassName } from './types.js';
+export type { ConfirmTone } from './types.js';
+export { ConfirmButton } from './components/ConfirmButton/ConfirmButton.js';
+export type { ConfirmButtonProps } from './components/ConfirmButton/ConfirmButton.js';
+export { ConfirmDialog } from './components/ConfirmDialog/ConfirmDialog.js';
+export type { ConfirmDialogProps } from './components/ConfirmDialog/ConfirmDialog.js';
+export type { ConfirmDialogController, UseConfirmDialog } from './components/ConfirmDialog/ConfirmDialog.hooks.js';
+export { DataTable } from './components/DataTable.js';
+export type { DataTableColumn, DataTableProps } from './components/DataTable.js';
+export { InteractiveHtmlEditor } from './components/InteractiveHtmlEditor/InteractiveHtmlEditor.js';
+export type { InteractiveHtmlEditorProps } from './components/InteractiveHtmlEditor/InteractiveHtmlEditor.js';
+export { RowMenu } from './components/RowMenu/RowMenu.js';
+export type { RowMenuItem, RowMenuProps } from './components/RowMenu/RowMenu.js';
+export { Sidebar, useSidebar } from './components/Sidebar.js';
+export type { RailTooltipHandlers, SidebarContextValue, SidebarFooterProps, SidebarMobileHeaderProps, SidebarNavProps, SidebarProps, SidebarRailToggleProps, } from './components/Sidebar.js';
+export { DEFAULT_SIDEBAR_RAIL_STORAGE_KEY, useSidebarRail } from './hooks/use-sidebar-rail.js';
+export type { SidebarRail } from './hooks/use-sidebar-rail.js';
+export { DEFAULT_NAV_SECTIONS_STORAGE_KEY, useNavSections } from './hooks/use-nav-sections.js';
+export type { NavSections, NavSectionState } from './hooks/use-nav-sections.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/react/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/react/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAC;AAC5E,YAAY,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAC;AAC5E,YAAY,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AAGtF,YAAY,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAC;AAInH,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAKjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,YAAY,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AAE9G,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAKjF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC9D,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gCAAgC,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC/F,YAAY,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,gCAAgC,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC/F,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/react/index.js

@@ -0,0 +1,53 @@
+/**
+ * @file `@jini-ai/admin/react` — the React layer. Presentational primitives the admin shell and its
+ * panels are built from.
+ *
+ * ## What belongs here
+ *
+ * Components and hooks that are genuinely reusable across hosts. Anything that decides *policy* —
+ * which panels exist, what a route means, who may see a section — lives in `/core` and is passed in
+ * as data. `Sidebar` is the worked example: it renders an `AdminNavGroup[]` produced by `/core`'s
+ * `buildNav`, and has no nav list of its own.
+ *
+ * ## Styling contract
+ *
+ * **Every component here is unstyled**, with one narrow exception. Most emit stable class names
+ * (`.cms-nav`, `.row-menu-*`, `.confirm-dialog`, `.btn-danger`, `.btn-warning`, `.btn-secondary`,
+ * `.visually-hidden`) and ship no CSS whatsoever — the host owns the stylesheet. Inline styles
+ * appear only where a value must be measured at runtime — portal coordinates in `Sidebar`'s rail
+ * tooltip and `RowMenu`'s popup. `InteractiveHtmlEditor` is the exception: it (transitively, via
+ * `@jini-ai/ui/html-editor`, which this file's own `InteractiveHtmlEditor` composes with a
+ * Tovu-specific embed-protection predicate) imports GrapesJS's own vendor stylesheet, because it
+ * wraps a third-party editor whose chrome does not render without it — see that primitive's file
+ * header for why this isn't authored styling the exception undoes.
+ *
+ * A few behaviors documented in these files assume the host defines a matching rule (for instance
+ * that `.visually-hidden` is `position: absolute`, so `ConfirmButton`'s live region does not
+ * consume layout). Those assumptions are called out where they are load-bearing.
+ *
+ * ## Runtime
+ *
+ * `browser` — `react-dom`'s `createPortal` into `document.body`, `localStorage`, and `window`
+ * listeners. Declared as such in `jini.entries`. React and react-dom are optional peers of this
+ * package, so a host importing only `/core`, `/browser`, or `/server` never installs them.
+ */
+// Shared vocabulary. Lives outside any one component so taking `RowMenu` alone does not imply a
+// dependency on `ConfirmDialog` — see `types.ts`.
+export { resolveTone, toneClassName } from './types.js';
+export { ConfirmButton } from './components/ConfirmButton/ConfirmButton.js';
+export { ConfirmDialog } from './components/ConfirmDialog/ConfirmDialog.js';
+// The list table. Deliberately has no sorting, pagination or row selection — see its file header
+// for the corpus evidence behind each omission.
+export { DataTable } from './components/DataTable.js';
+// Visual click-into-text editing surface for a bespoke HTML document, built on GrapesJS. See its
+// own file header for the styling-contract exception it carries (vendor CSS import) and the
+// embed-placeholder protection it owns.
+export { InteractiveHtmlEditor } from './components/InteractiveHtmlEditor/InteractiveHtmlEditor.js';
+export { RowMenu } from './components/RowMenu/RowMenu.js';
+// Compound: `Sidebar.MobileHeader`, `.Nav`, `.Footer`, `.RailToggle` hang off the root. `useSidebar`
+// is exported so a host's own control (a log-out button, a workspace switcher) can read the rail
+// state and opt into rail tooltips rather than losing that behavior by not being ours.
+export { Sidebar, useSidebar } from './components/Sidebar.js';
+export { DEFAULT_SIDEBAR_RAIL_STORAGE_KEY, useSidebarRail } from './hooks/use-sidebar-rail.js';
+export { DEFAULT_NAV_SECTIONS_STORAGE_KEY, useNavSections } from './hooks/use-nav-sections.js';
+//# sourceMappingURL=index.js.map

package/dist/react/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/react/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,gGAAgG;AAChG,kDAAkD;AAClD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGxD,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAC;AAG5E,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAC;AAM5E,iGAAiG;AACjG,gDAAgD;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAGtD,iGAAiG;AACjG,4FAA4F;AAC5F,wCAAwC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AAGpG,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAG1D,qGAAqG;AACrG,iGAAiG;AACjG,uFAAuF;AACvF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAW9D,OAAO,EAAE,gCAAgC,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/F,OAAO,EAAE,gCAAgC,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/react/types.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @file Vocabulary shared across this layer's components, so picking one does not drag in another.
+ *
+ * `ConfirmTone` lived in `ConfirmDialog.tsx` and was imported from there by `RowMenu.tsx`. The
+ * import was type-only and therefore free at runtime, but it still said something untrue about the
+ * package: that a host wanting only a row menu depends on the confirm dialog. In a layer whose
+ * whole premise is "take the pieces you need", that is the wrong signal to send.
+ */
+/**
+ * The three action tiers this vocabulary distinguishes: `"default"` for a neutral action,
+ * `"warning"` for reversible-but-access-affecting ones (e.g. Disable), `"danger"` for genuinely
+ * destructive ones (e.g. Delete).
+ *
+ * Deliberately shared between `ConfirmDialog` and `RowMenu`: a caller wiring up "Disable opens
+ * nothing, Delete opens a ConfirmDialog" from one item list should not have to reconcile two tone
+ * enums to keep the colors matching.
+ */
+export type ConfirmTone = 'default' | 'warning' | 'danger';
+/** Maps a tone onto the class name the host stylesheet is expected to define. `"default"` yields
+ *  `undefined` — the plain button, no class. */
+export declare function toneClassName(tone: ConfirmTone): string | undefined;
+/** `tone` wins when both `tone` and the deprecated `destructive` are passed; `destructive: true`
+ *  alone still maps to `"danger"` (its only prior meaning) for callers that haven't migrated. */
+export declare function resolveTone(source: {
+    tone?: ConfirmTone;
+    destructive?: boolean;
+}): ConfirmTone;
+//# sourceMappingURL=types.d.ts.map

package/dist/react/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/react/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE3D;gDACgD;AAChD,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAInE;AAED;iGACiG;AACjG,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAAE,IAAI,CAAC,EAAE,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,WAAW,CAE9F"}

package/dist/react/types.js

@@ -0,0 +1,23 @@
+/**
+ * @file Vocabulary shared across this layer's components, so picking one does not drag in another.
+ *
+ * `ConfirmTone` lived in `ConfirmDialog.tsx` and was imported from there by `RowMenu.tsx`. The
+ * import was type-only and therefore free at runtime, but it still said something untrue about the
+ * package: that a host wanting only a row menu depends on the confirm dialog. In a layer whose
+ * whole premise is "take the pieces you need", that is the wrong signal to send.
+ */
+/** Maps a tone onto the class name the host stylesheet is expected to define. `"default"` yields
+ *  `undefined` — the plain button, no class. */
+export function toneClassName(tone) {
+    if (tone === 'danger')
+        return 'btn-danger';
+    if (tone === 'warning')
+        return 'btn-warning';
+    return undefined;
+}
+/** `tone` wins when both `tone` and the deprecated `destructive` are passed; `destructive: true`
+ *  alone still maps to `"danger"` (its only prior meaning) for callers that haven't migrated. */
+export function resolveTone(source) {
+    return source.tone ?? (source.destructive ? 'danger' : 'default');
+}
+//# sourceMappingURL=types.js.map

package/dist/react/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/react/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH;gDACgD;AAChD,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAC7C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;iGACiG;AACjG,MAAM,UAAU,WAAW,CAAC,MAAqD;IAC/E,OAAO,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACpE,CAAC"}

package/dist/server/composio/bounded-data.d.ts

@@ -0,0 +1,36 @@
+import type { JsonValue } from '@jini-ai/protocol';
+export declare const COMPOSIO_MAX_RESPONSE_BYTES: number;
+export declare const COMPOSIO_MAX_ERROR_RESPONSE_BYTES: number;
+export declare const COMPOSIO_MAX_CACHE_BYTES: number;
+export declare const COMPOSIO_MAX_SECRET_STORE_BYTES: number;
+export interface JsonStructureLimits {
+    maxDepth: number;
+    maxNodes: number;
+    maxArrayItems: number;
+    maxObjectKeys: number;
+    maxStringBytes: number;
+}
+export declare const COMPOSIO_REMOTE_JSON_LIMITS: JsonStructureLimits;
+export declare class BoundedDataError extends Error {
+    constructor(message: string);
+}
+/** Reads at most `maxBytes` from a response body before allocating/decoding it. */
+export declare function readBoundedResponseText(response: Response, maxBytes: number, label?: string): Promise<string>;
+/** Reads and parses a response body only after its byte size is bounded. */
+export declare function readBoundedResponseJson(response: Response, maxBytes?: number, label?: string): Promise<unknown>;
+/** Reads a local UTF-8 file without allowing it to grow past `maxBytes`. */
+export declare function readBoundedUtf8File(filePath: string, maxBytes: number): string;
+/**
+ * Opens a secret-bearing regular file without following its final symlink,
+ * enforces owner-only mode on the opened inode, and reads it within a byte cap.
+ *
+ * @complexity Time: O(n). Space: O(n), where n is capped by `maxBytes`.
+ * @overallScore 100/100
+ */
+export declare function readPrivateBoundedUtf8File(filePath: string, maxBytes: number): string;
+/**
+ * Converts an unknown value into JSON while enforcing depth, node, collection,
+ * and string bounds before recursive copies are allocated.
+ */
+export declare function toStructurallyBoundedJsonValue(value: unknown, limits?: JsonStructureLimits): JsonValue;
+//# sourceMappingURL=bounded-data.d.ts.map

package/dist/server/composio/bounded-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-data.d.ts","sourceRoot":"","sources":["../../../src/server/composio/bounded-data.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAC3D,eAAO,MAAM,iCAAiC,QAAY,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAkB,CAAC;AACxD,eAAO,MAAM,+BAA+B,QAAc,CAAC;AAE3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,2BAA2B,EAAE,mBAMzC,CAAC;AAEF,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED,mFAAmF;AACnF,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,SAAsB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAoCjB;AAED,4EAA4E;AAC5E,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,QAAQ,EAClB,QAAQ,SAA8B,EACtC,KAAK,SAAsB,GAC1B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAO9E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAcrF;AAuBD;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,EACd,MAAM,GAAE,mBAAiD,GACxD,SAAS,CAyDX"}

package/dist/server/composio/bounded-data.js

@@ -0,0 +1,181 @@
+/**
+ * @module bounded-data
+ *
+ * Size and structural guards for untrusted remote and persisted JSON.
+ */
+import fs from 'node:fs';
+export const COMPOSIO_MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+export const COMPOSIO_MAX_ERROR_RESPONSE_BYTES = 64 * 1024;
+export const COMPOSIO_MAX_CACHE_BYTES = 8 * 1024 * 1024;
+export const COMPOSIO_MAX_SECRET_STORE_BYTES = 1024 * 1024;
+export const COMPOSIO_REMOTE_JSON_LIMITS = {
+    maxDepth: 40,
+    maxNodes: 50_000,
+    maxArrayItems: 10_000,
+    maxObjectKeys: 10_000,
+    maxStringBytes: 1024 * 1024,
+};
+export class BoundedDataError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'BoundedDataError';
+    }
+}
+/** Reads at most `maxBytes` from a response body before allocating/decoding it. */
+export async function readBoundedResponseText(response, maxBytes, label = 'Composio response') {
+    const declaredLength = response.headers.get('content-length');
+    if (declaredLength !== null && /^\d+$/.test(declaredLength)) {
+        const bytes = Number(declaredLength);
+        if (!Number.isSafeInteger(bytes) || bytes > maxBytes) {
+            throw new BoundedDataError(`${label} exceeds the ${maxBytes}-byte limit`);
+        }
+    }
+    if (response.body === null)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            totalBytes += value.byteLength;
+            if (totalBytes > maxBytes) {
+                await reader.cancel().catch(() => undefined);
+                throw new BoundedDataError(`${label} exceeds the ${maxBytes}-byte limit`);
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+}
+/** Reads and parses a response body only after its byte size is bounded. */
+export async function readBoundedResponseJson(response, maxBytes = COMPOSIO_MAX_RESPONSE_BYTES, label = 'Composio response') {
+    const text = await readBoundedResponseText(response, maxBytes, label);
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new BoundedDataError(`${label} is not valid JSON`);
+    }
+    return toStructurallyBoundedJsonValue(parsed);
+}
+/** Reads a local UTF-8 file without allowing it to grow past `maxBytes`. */
+export function readBoundedUtf8File(filePath, maxBytes) {
+    const descriptor = fs.openSync(filePath, 'r');
+    try {
+        return readBoundedUtf8Descriptor(descriptor, maxBytes);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+/**
+ * Opens a secret-bearing regular file without following its final symlink,
+ * enforces owner-only mode on the opened inode, and reads it within a byte cap.
+ *
+ * @complexity Time: O(n). Space: O(n), where n is capped by `maxBytes`.
+ * @overallScore 100/100
+ */
+export function readPrivateBoundedUtf8File(filePath, maxBytes) {
+    const descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    try {
+        if (!fs.fstatSync(descriptor).isFile()) {
+            throw new BoundedDataError('Secret JSON path must be a regular file');
+        }
+        fs.fchmodSync(descriptor, 0o600);
+        return readBoundedUtf8Descriptor(descriptor, maxBytes);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+function readBoundedUtf8Descriptor(descriptor, maxBytes) {
+    const chunks = [];
+    const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1));
+    let totalBytes = 0;
+    while (true) {
+        const bytesRead = fs.readSync(descriptor, buffer, 0, buffer.length, null);
+        if (bytesRead === 0)
+            break;
+        totalBytes += bytesRead;
+        if (totalBytes > maxBytes) {
+            throw new BoundedDataError(`JSON file exceeds the ${maxBytes}-byte limit`);
+        }
+        chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
+    }
+    return new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks, totalBytes));
+}
+/**
+ * Converts an unknown value into JSON while enforcing depth, node, collection,
+ * and string bounds before recursive copies are allocated.
+ */
+export function toStructurallyBoundedJsonValue(value, limits = COMPOSIO_REMOTE_JSON_LIMITS) {
+    const state = { nodes: 0, ancestors: new WeakSet() };
+    const visit = (current, depth) => {
+        state.nodes += 1;
+        if (state.nodes > limits.maxNodes) {
+            throw new BoundedDataError(`JSON value exceeds the ${limits.maxNodes}-node limit`);
+        }
+        if (depth > limits.maxDepth) {
+            throw new BoundedDataError(`JSON value exceeds the ${limits.maxDepth}-level depth limit`);
+        }
+        if (current === null || typeof current === 'boolean')
+            return current;
+        if (typeof current === 'number') {
+            if (!Number.isFinite(current))
+                throw new BoundedDataError('JSON value contains a non-finite number');
+            return current;
+        }
+        if (typeof current === 'string') {
+            if (Buffer.byteLength(current, 'utf8') > limits.maxStringBytes) {
+                throw new BoundedDataError(`JSON string exceeds the ${limits.maxStringBytes}-byte limit`);
+            }
+            return current;
+        }
+        if (typeof current !== 'object') {
+            throw new BoundedDataError('JSON value contains an unsupported runtime value');
+        }
+        if (state.ancestors.has(current))
+            throw new BoundedDataError('JSON value contains a cycle');
+        state.ancestors.add(current);
+        try {
+            if (Array.isArray(current)) {
+                if (current.length > limits.maxArrayItems) {
+                    throw new BoundedDataError(`JSON array exceeds the ${limits.maxArrayItems}-item limit`);
+                }
+                return current.map((item) => visit(item, depth + 1));
+            }
+            const entries = Object.entries(current);
+            if (entries.length > limits.maxObjectKeys) {
+                throw new BoundedDataError(`JSON object exceeds the ${limits.maxObjectKeys}-key limit`);
+            }
+            const output = {};
+            for (const [key, child] of entries) {
+                Object.defineProperty(output, key, {
+                    configurable: true,
+                    enumerable: true,
+                    value: visit(child, depth + 1),
+                    writable: true,
+                });
+            }
+            return output;
+        }
+        finally {
+            state.ancestors.delete(current);
+        }
+    };
+    return visit(value, 0);
+}
+//# sourceMappingURL=bounded-data.js.map

package/dist/server/composio/bounded-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-data.js","sourceRoot":"","sources":["../../../src/server/composio/bounded-data.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AAIzB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3D,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACxD,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,GAAG,IAAI,CAAC;AAU3D,MAAM,CAAC,MAAM,2BAA2B,GAAwB;IAC9D,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,MAAM;IAChB,aAAa,EAAE,MAAM;IACrB,aAAa,EAAE,MAAM;IACrB,cAAc,EAAE,IAAI,GAAG,IAAI;CAC5B,CAAC;AAEF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAkB,EAClB,QAAgB,EAChB,KAAK,GAAG,mBAAmB;IAE3B,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,cAAc,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,gBAAgB,QAAQ,aAAa,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,gBAAgB,QAAQ,aAAa,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAkB,EAClB,QAAQ,GAAG,2BAA2B,EACtC,KAAK,GAAG,mBAAmB;IAE3B,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,8BAA8B,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,QAAgB;IACpE,MAAM,UAAU,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,QAAgB;IAC3E,MAAM,UAAU,GAAG,EAAE,CAAC,QAAQ,CAC5B,QAAQ,EACR,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAChD,CAAC;IACF,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,CAAC,CAAC;QACxE,CAAC;QACD,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,UAAkB,EAAE,QAAgB;IACrE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,CAAC;YAAE,MAAM;QAC3B,UAAU,IAAI,SAAS,CAAC;QACxB,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,QAAQ,aAAa,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAC7F,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAc,EACd,SAA8B,2BAA2B;IAEzD,MAAM,KAAK,GAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,OAAO,EAAU,EAAE,CAAC;IAEjF,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,KAAa,EAAa,EAAE;QAC3D,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,MAAM,CAAC,QAAQ,aAAa,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,MAAM,CAAC,QAAQ,oBAAoB,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QACrE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,CAAC,CAAC;YACrG,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC/D,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,MAAM,CAAC,cAAc,aAAa,CAAC,CAAC;YAC5F,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,gBAAgB,CAAC,kDAAkD,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;QAE5F,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,MAAM,CAAC,aAAa,aAAa,CAAC,CAAC;gBAC1F,CAAC;gBACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,CAAC;YACnE,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC1C,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,MAAM,CAAC,aAAa,YAAY,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,MAAM,GAA8B,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACnC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;oBACjC,YAAY,EAAE,IAAI;oBAClB,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;oBAC9B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC"}

package/dist/server/composio/catalog.d.ts

@@ -0,0 +1,147 @@
+/**
+ * @module catalog
+ *
+ * Product-neutral catalog and safety contracts used by the Composio adapter.
+ */
+import type { JsonValue } from '@jini-ai/protocol';
+export type JsonObject = {
+    [key: string]: JsonValue;
+};
+export type ConnectorStatus = 'available' | 'connected' | 'error' | 'disabled';
+export type ConnectorToolSideEffect = 'read' | 'write' | 'destructive' | 'unknown';
+export type ConnectorToolApproval = 'auto' | 'confirm' | 'disabled';
+export type ConnectorToolUseCase = string;
+export interface ConnectorToolSafety {
+    sideEffect: ConnectorToolSideEffect;
+    approval: ConnectorToolApproval;
+    reason: string;
+}
+export interface ConnectorToolCuration {
+    useCases?: ConnectorToolUseCase[];
+    reason?: string;
+}
+export interface ConnectorToolDetail {
+    name: string;
+    title: string;
+    description?: string;
+    inputSchemaJson?: JsonObject;
+    /** Present when the provider schema cannot be enforced safely. Such tools are never auto-callable. */
+    inputSchemaUnsupportedReason?: string | undefined;
+    outputSchemaJson?: JsonObject;
+    safety: ConnectorToolSafety;
+    refreshEligible: boolean;
+    curation?: ConnectorToolCuration;
+}
+export interface ConnectorCatalogToolDefinition extends ConnectorToolDetail {
+    /** Provider scopes required for this tool. Empty for local/read-only providers. */
+    requiredScopes: string[];
+    /** Provider-native tool identifier, when different from the package tool name. */
+    providerToolId?: string;
+}
+export interface ConnectorDetail {
+    id: string;
+    name: string;
+    provider: string;
+    category: string;
+    description?: string;
+    status: ConnectorStatus;
+    accountLabel?: string;
+    tools: ConnectorToolDetail[];
+    /**
+     * Runtime execution allowlist. Subset of `tools`. The agent layer
+     * only invokes tools whose names appear here. For Composio
+     * connectors hydration may only preserve static tool authority or add an
+     * exact package/host-curated provider identifier. Other discovered tools
+     * are display-only regardless of provider metadata.
+     *
+     * Optional in the type only for fixture brevity; daemon-built
+     * `ConnectorDetail` payloads always carry it.
+     */
+    allowedToolNames?: string[];
+    /**
+     * The hand-curated catalog subset. Stable across hydration: never
+     * extended by provider discovery, only ever the static catalog
+     * names. This preserves the static catalog baseline for consumers
+     * that need that curated subset, but it is not the advertised
+     * provider inventory count. UI summary badges should use `toolCount`
+     * when present; the drawer's rendered tool rows still come from
+     * `tools` directly.
+     *
+     * Optional in the type only for fixture brevity; daemon-built
+     * `ConnectorDetail` payloads always carry it.
+     */
+    curatedToolNames?: string[];
+    toolCount?: number;
+    toolsNextCursor?: string;
+    toolsHasMore?: boolean;
+    featuredToolNames?: string[];
+    minimumApproval?: ConnectorToolApproval;
+    lastError?: string;
+    auth?: ConnectorAuthDetail;
+}
+export interface ConnectorAuthDetail {
+    provider: 'local' | 'none' | 'oauth' | 'composio';
+    configured: boolean;
+}
+export interface ConnectorCatalogDefinition {
+    id: string;
+    name: string;
+    provider: string;
+    category: string;
+    description?: string;
+    tools: ConnectorCatalogToolDefinition[];
+    /** The complete allowlist of callable tool names for this connector. */
+    allowedToolNames: string[];
+    /**
+     * The hand-curated subset of `allowedToolNames` that is fixed at the
+     * catalog level — never extended by provider discovery (issue #748).
+     * Optional: when omitted, serialized wire details fall back to
+     * `allowedToolNames`, which is the right preview subset for
+     * non-Composio connectors that don't have a dynamic discovery layer
+     * in the first place.
+     */
+    curatedToolNames?: string[];
+    /** Display-only count of provider tools. This may be known before tool schemas are hydrated. */
+    toolCount?: number;
+    /** Preview pagination state for hydrated tool definitions. Execution code must not rely on partial pages. */
+    toolsNextCursor?: string;
+    toolsHasMore?: boolean;
+    /** How the connector is made available. `none` and `local` connectors require no user OAuth state. */
+    authentication: 'local' | 'none' | 'oauth' | 'composio';
+    /** Provider toolkit slug used by external connector providers such as Composio. */
+    providerConnectorId?: string;
+    featuredToolNames?: string[];
+    minimumApproval?: ConnectorToolApproval;
+    disabled?: boolean;
+}
+export interface ConnectorToolSafetyClassificationInput {
+    name: string;
+    providerToolId?: string;
+    title?: string;
+    description?: string;
+    requiredScopes?: readonly string[];
+}
+/**
+ * Classifies a provider tool conservatively from its name, description, and
+ * scopes. Ambiguous tools require confirmation.
+ */
+export declare function classifyConnectorToolSafety(input: ConnectorToolSafetyClassificationInput): ConnectorToolSafety;
+/** Returns whether a tool is safe for unattended refresh execution. */
+export declare function isRefreshEligibleConnectorToolSafety(safety: ConnectorToolSafety): boolean;
+/**
+ * Builds a catalog tool and derives safety defaults when the caller omitted
+ * them.
+ *
+ * @overallScore 100/100
+ */
+export declare function defineConnectorTool(tool: Omit<ConnectorCatalogToolDefinition, 'safety' | 'refreshEligible'> & {
+    safety?: ConnectorToolSafety;
+    refreshEligible?: boolean;
+}): ConnectorCatalogToolDefinition;
+/**
+ * Creates a detached wire detail from a catalog definition.
+ *
+ * @overallScore 100/100
+ */
+export declare function connectorDefinitionToDetail(definition: ConnectorCatalogDefinition): ConnectorDetail;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/server/composio/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../src/server/composio/catalog.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAC/E,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;AACnF,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;AACpE,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,uBAAuB,CAAC;IACpC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,sGAAsG;IACtG,4BAA4B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,gBAAgB,CAAC,EAAE,UAAU,CAAC;IAC9B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAClC;AAED,MAAM,WAAW,8BAA+B,SAAQ,mBAAmB;IACzE,mFAAmF;IACnF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,eAAe,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IAClD,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACxC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sGAAsG;IACtG,cAAc,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IACxD,mFAAmF;IACnF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sCAAsC;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAYD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,sCAAsC,GAAG,mBAAmB,CA4B9G;AAED,uEAAuE;AACvE,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAEzF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,IAAI,CAAC,8BAA8B,EAAE,QAAQ,GAAG,iBAAiB,CAAC,GAAG;IACzE,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GACA,8BAA8B,CAahC;AA8BD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,0BAA0B,GAAG,eAAe,CA2BnG"}