@kindgi/api 0.0.0-bootstrap.0 → 0.1.0

package/dist/memory-binding.d.ts

@@ -0,0 +1,209 @@
+import type { Fact, MemoryScope, Retention } from '@kindgi/memory';
+import type { Scope as PlatformScope } from '@kindgi/platform';
+import type { Cursor, FactId, TenantId } from '@kindgi/types';
+/**
+ * Caller-plugged surface for the memory resource. Same shape as
+ * `AgentRegistryBinding` / `ToolRegistryBinding` / `GuardrailRegistryBinding`:
+ * the API package does NOT own memory persistence or retrieval logic.
+ * Deployments plug in a binding that wraps the memory subsystem (the
+ * Kindgi runtime provides one) together with their own
+ * `EmbeddingProviderRegistry` and per-type retrieval policies.
+ *
+ * Every method is tenant-scoped: callers pass `tenantId` explicitly so
+ * multi-tenant deployments can partition storage without exposing the
+ * scoping inside the API package.
+ *
+ * Cursors are opaque — the binding chooses its encoding (page number,
+ * ISO timestamp, `id@version`, whatever). The API layer only validates
+ * that a cursor round-trips as a string; it never inspects the payload.
+ *
+ * Supersession, not delete: facts are append-only. `supersedeFact`
+ * writes a new revision that supersedes the target; the historical row
+ * remains readable until retention sweeps it. There is no hard delete;
+ * the retention sweep handles physical removal.
+ */
+export interface MemoryBinding {
+    /**
+     * Cursor-paginated list of facts under the tenant. Filters:
+     *   - `type` — exact fact-type match.
+     *   - `scope` — partial-match filter (see `Scope` in the memory subsystem).
+     *
+     * Sort order is binding-defined — for example, the latest version
+     * per `(type, id)` sorted by `createdAt desc`.
+     */
+    listFacts(input: MemoryListFactsInput): Promise<MemoryFactPage>;
+    /**
+     * The fact with the given id, or `null` if unknown. Latest version
+     * by default; bindings MAY accept a `version` in the input to select
+     * a specific historical revision (not exposed on the route today).
+     * The route surfaces `null` as `404 fact-not-found`.
+     */
+    getFact(input: MemoryGetFactInput): Promise<Fact | null>;
+    /**
+     * Persist a new fact. The binding validates the write against its
+     * retrieval-policy registry (populates keyword / semantic indexes
+     * per type) and its embedding registry (for semantic-indexed types).
+     *
+     * When the fact type declares semantic indexing but no embedding
+     * provider is bound, the binding MUST return an `err` result — the
+     * route maps that to `400 bad-input`.
+     */
+    writeFact(input: MemoryWriteFactInput): Promise<MemoryWriteFactOutcome>;
+    /**
+     * Mark a fact as superseded. The binding writes a superseding
+     * revision (or flags the row, depending on its runtime semantics).
+     * Idempotent — superseding an already-superseded fact returns
+     * `{ superseded: true }` without error. When the fact id is unknown,
+     * returns `{ superseded: false }` and the route flips that to `404`.
+     */
+    supersedeFact(input: MemorySupersedeFactInput): Promise<MemorySupersedeFactOutcome>;
+    /**
+     * Cross-history retrieval. The `intent` mirrors the shape agents use
+     * for declarative retrieval (`packages/agents/src/retrieval.ts`):
+     *
+     *   - `mode: 'list'`     — plain scoped list, no query needed.
+     *   - `mode: 'keyword'`  — full-text keyword search.
+     *   - `mode: 'semantic'` — vector cosine similarity. Requires an
+     *     embedding registry in the binding; if absent, the binding
+     *     MUST return `{ kind: 'embedding-unavailable' }` so the route
+     *     can respond `400 bad-input`.
+     *   - `mode: 'both'`     — keyword + semantic union, dedup by fact id.
+     *
+     * Semantic modes MAY accept `embeddingModel` on the intent to select
+     * a specific registered provider; omit to fall back to the sole one.
+     */
+    retrieve(input: MemoryRetrieveInput): Promise<MemoryRetrieveOutcome>;
+}
+export interface MemoryListFactsInput {
+    readonly tenantId: TenantId;
+    readonly limit: number;
+    readonly cursor?: Cursor;
+    /** Exact match on `Fact.type`. Undefined = no type filter. */
+    readonly type?: string;
+    /**
+     * Partial `MemoryScope` filter from the memory subsystem — the
+     * flat-struct memory scope (tenantId + optional userId / orgId /
+     * projectId / threadId / sessionId). Every provided key must match.
+     */
+    readonly scope?: Partial<MemoryScope>;
+    /**
+     * Narrow the list to a specific scope using the platform-wide
+     * discriminated `Scope` primitive from `@kindgi/platform`.
+     * Absent = no scope narrow (return every row in the tenant the
+     * caller can see — admin/audit default).
+     *
+     * Content-scoped semantics (this binding — memory facts attribute
+     * to the project via `Scope.projectId`):
+     * - `{ kind: 'project', projectId }` — rows in that project.
+     * - `{ kind: 'org', orgId }` — rows in every project belonging to
+     *   that org.
+     * - `{ kind: 'tenant', tenantId }` — every row in the tenant.
+     *
+     * Content rows always belong to a project, so `inherit` has no
+     * effect here.
+     *
+     * The `scope` field above and `platformScope` are additive filters —
+     * pass either, or both (AND-composed).
+     */
+    readonly platformScope?: PlatformScope;
+    /**
+     * `false` = literal-at-this-scope only (admin/audit view).
+     * `true` (default) = inheritance walk (user-facing view).
+     * No-op for content-scoped bindings (rows only exist at
+     * project-level — there is no upward hierarchy to walk). Kept for
+     * uniformity: scope-aware bindings share one filter shape.
+     */
+    readonly inherit?: boolean;
+}
+export interface MemoryFactPage {
+    readonly data: readonly Fact[];
+    readonly nextCursor?: Cursor;
+}
+export interface MemoryGetFactInput {
+    readonly tenantId: TenantId;
+    readonly factId: FactId;
+}
+export interface MemoryWriteFactInput {
+    /**
+     * The caller's tenant (from the token) — the tenant the fact is written
+     * to. The route rejects a `scope.tenantId` that differs from it, and an
+     * implementation must write under `tenantId`, never a tenant taken
+     * from `scope`.
+     */
+    readonly tenantId: TenantId;
+    readonly type: string;
+    readonly scope: MemoryScope;
+    readonly content: unknown;
+    readonly retention?: Retention;
+    readonly contentHash?: string;
+}
+export type MemoryWriteFactOutcome = {
+    readonly kind: 'ok';
+    readonly fact: Fact;
+} | {
+    /**
+     * The type declared semantic indexing but the binding has no
+     * embedding registry (or the registry resolves no provider).
+     * Route maps to `400 bad-input`.
+     */
+    readonly kind: 'embedding-unavailable';
+    readonly message: string;
+} | {
+    /** Any other write failure — persistence error, invalid content, etc. */
+    readonly kind: 'error';
+    readonly code: string;
+    readonly message: string;
+};
+export interface MemorySupersedeFactInput {
+    readonly tenantId: TenantId;
+    readonly factId: FactId;
+}
+export interface MemorySupersedeFactOutcome {
+    readonly superseded: boolean;
+}
+/**
+ * Retrieval intent shape used on the wire. Mirrors the agent-side
+ * `RetrievalIntent` in `packages/agents/src/types.ts` but widened to
+ * accept explicit filters + limits — the agent path derives filters
+ * from `Conversation` context, while the direct-HTTP path takes them
+ * verbatim from the request body.
+ */
+export interface MemoryRetrieveIntent {
+    readonly mode: 'list' | 'keyword' | 'semantic' | 'both';
+    /**
+     * Freeform text query. Required for `keyword` / `semantic` / `both`;
+     * ignored for `list`.
+     */
+    readonly query?: string;
+    /**
+     * Fact type filter. Passed through to the binding as a single-type
+     * lookup; multi-type queries call `retrieve` per type today.
+     */
+    readonly type?: string;
+    /** Partial scope predicate. */
+    readonly scope?: Partial<MemoryScope>;
+    readonly limit?: number;
+    /** Selects a specific embedding provider registered on the binding. */
+    readonly embeddingModel?: string;
+}
+export interface MemoryRetrieveInput {
+    readonly tenantId: TenantId;
+    readonly intent: MemoryRetrieveIntent;
+}
+export interface MemoryRetrievalHit {
+    readonly fact: Fact;
+    readonly score?: number;
+}
+export type MemoryRetrieveOutcome = {
+    readonly kind: 'ok';
+    readonly results: readonly MemoryRetrievalHit[];
+} | {
+    /** Semantic mode requested but no embedding provider bound. */
+    readonly kind: 'embedding-unavailable';
+    readonly message: string;
+} | {
+    readonly kind: 'error';
+    readonly code: string;
+    readonly message: string;
+};
+//# sourceMappingURL=memory-binding.d.ts.map

package/dist/memory-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-binding.d.ts","sourceRoot":"","sources":["../src/memory-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,IAAI,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;;;;OAQG;IACH,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxE;;;;;;OAMG;IACH,aAAa,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACpF;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtE;AAID,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAID,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACD;IACE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAIN,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAID;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACjD,GACD;IACE,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC"}

package/dist/memory-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=memory-binding.js.map

package/dist/memory-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-binding.js","sourceRoot":"","sources":["../src/memory-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,168 @@
+import type { MiddlewareHandler } from 'hono';
+import type { ReviewerRole } from '@kindgi/authz';
+import type { ApiTokenId, SessionId, TenantId, UserId } from '@kindgi/types';
+import type { SigningKeyBinding } from '@kindgi/crypto';
+import type { SessionStoreBinding } from '../session-store-binding.js';
+/**
+ * Resolve an API token → tenant identity. For static bearer tokens this
+ * is a caller-injected function: the platform's actual token store (auth
+ * service, database, …) plugs in. Signature stays stable across
+ * implementations.
+ *
+ * Return `null` for missing / expired / revoked tokens; the middleware
+ * translates to 401 with a specific error code.
+ */
+export type TokenResolver = (token: string) => Promise<TokenResolution | null>;
+export interface TokenResolution {
+    readonly tenantId: TenantId;
+    /**
+     * Optional expiration; if set and in the past, the middleware treats
+     * as expired even if the resolver returned a value.
+     */
+    readonly expiresAt?: Date;
+    /** Optional revocation marker; `true` → 401 auth-revoked. */
+    readonly revoked?: boolean;
+    /**
+     * Optional reviewer role granted to this token. When present, the
+     * middleware surfaces it as `c.get('reviewerRole')` and approvals
+     * routes gate visibility / decisions on the `standard < senior < admin`
+     * hierarchy. Absent for tokens that were never provisioned with a
+     * reviewer role — such tokens can still hit `/v1/runs` etc., but any
+     * approvals route returns `403 permission-denied`.
+     */
+    readonly reviewerRole?: ReviewerRole;
+    /**
+     * Optional user identity behind the token. Approvals routes forward
+     * this to a `ReviewerBinding` to translate `UserId → ReviewerId`
+     * before calling `hitl.submitReview` (which needs the reviewer id).
+     */
+    readonly userId?: UserId;
+    /**
+     * The id of a durable API key (`POST /v1/tokens`). The caller is then
+     * the key's service account (`service_account:<tokenId>`), not a user;
+     * the middleware surfaces it as `c.get('tokenId')`.
+     */
+    readonly tokenId?: ApiTokenId;
+    /**
+     * Optional session id. Populated by the session-token verifier path
+     * (`kgi_sk_*` tokens) so `/v1/identity/whoami` and `/v1/auth/logout`
+     * can introspect / revoke the caller's own session without a second
+     * lookup. Absent for static bearer tokens.
+     */
+    readonly sessionId?: SessionId;
+    /**
+     * Optional identity-provider id that authenticated the caller. Only
+     * populated by session-token verification.
+     */
+    readonly providerId?: string;
+    /**
+     * Optional OAuth scopes granted to the session. Only populated by
+     * session-token verification.
+     */
+    readonly scopes?: readonly string[];
+    /**
+     * Optional last-observed-activity timestamp. Populated by
+     * `resolveSessionToken` when the session-store adapter carries
+     * `lastActiveAt` on the row. Used by the middleware to enforce the
+     * `inactivityTimeoutMs` policy. Absent → inactivity check is
+     * skipped.
+     */
+    readonly lastActiveAt?: Date;
+    /**
+     * Optional flag set by `resolveSessionToken` when the session was
+     * revoked specifically via rotation (`POST /v1/auth/refresh`). The
+     * middleware maps this to `401 refresh-token-invalid` instead of
+     * the generic `401 auth-revoked`, matching OAuth 2.1 BCP refresh-
+     * token-reuse semantics.
+     */
+    readonly rotated?: boolean;
+    /**
+     * Optional framework capabilities granted to the bearer. Route
+     * handlers gate write / reveal ops on
+     * specific capability strings (`env:write`, `secrets:write`,
+     * `secrets:rotate`, `secrets:revoke`, `secrets:revoke:hard`,
+     * `secrets:reveal`, `kindgi:system`). Callers that plug their
+     * own resolver populate this list from their token store; deployments
+     * without capability data leave it absent — routes that require a
+     * capability then return 403 `permission-denied`.
+     *
+     * Kindgi's stance: fail-closed on writes when the capability is
+     * unset (a token without an explicit `secrets:write` claim cannot
+     * mutate the secrets store). Deployments that want any authenticated
+     * bearer to be able to write grant the capability on every token.
+     */
+    readonly capabilities?: readonly string[];
+}
+/**
+ * Session-token prefix. Framework-issued opaque tokens minted by
+ * `POST /v1/auth/callback/:providerId` carry this prefix so the auth
+ * middleware can route them to the session store instead of the caller-
+ * plugged `TokenResolver`. Distinct prefix means a static bearer token
+ * and a session token can coexist byte-shape-identical on the wire.
+ */
+export declare const SESSION_TOKEN_PREFIX: "kgi_sk_";
+/**
+ * Compose the on-wire session token from a `SessionId`. Session tokens
+ * are opaque to clients — the shape below is a framework convention,
+ * not part of the wire contract. Do NOT parse it in downstream code
+ * outside the middleware.
+ */
+export declare function encodeSessionToken(sessionId: SessionId): string;
+/**
+ * Optional wiring for the session-token flavor. Provided to the
+ * middleware via `bearerAuthMiddleware(resolveToken, { sessionStore })`
+ * when the deployment mounts `SessionStoreBinding`. Absent → session-
+ * shape tokens fall through to `TokenResolver` (which will typically
+ * `null` them → 401 auth-missing) so a deployment without a session
+ * store still behaves consistently.
+ */
+export interface BearerAuthMiddlewareOptions {
+    readonly sessionStore?: SessionStoreBinding;
+    /**
+     * Inactivity timeout — sessions whose `lastActiveAt` is older than
+     * `Date.now() - inactivityTimeoutMs` are rejected with 401
+     * `session-inactive`. Absent → inactivity enforcement disabled
+     * (only absolute TTL applies).
+     *
+     * Sensible default: 4 hours (`4 * 60 * 60 * 1000`). Deployments
+     * customize via `CreateAppInput.session.inactivityTimeout`.
+     */
+    readonly inactivityTimeoutMs?: number;
+    /**
+     * How often (per session) the middleware should call
+     * `sessionStore.touch` to bump `lastActiveAt`. Higher throttle ⇒
+     * fewer writes but coarser inactivity enforcement. Defaults to 60s.
+     */
+    readonly touchThrottleMs?: number;
+    /**
+     * Accept public run tokens (`kgi_pt_…`), verified against
+     * `signingKey`, on the routes `isAllowed` admits (every other route
+     * answers 403). Absent → such tokens are not recognized (401).
+     */
+    readonly publicRunTokens?: {
+        readonly signingKey: SigningKeyBinding;
+        readonly isAllowed: (method: string, path: string) => boolean;
+    };
+}
+/**
+ * Bearer-token middleware. Fails 401 on missing / malformed / expired /
+ * revoked. On success, sets `c.set('tenantId', tenantId)` for downstream
+ * handlers.
+ *
+ * Two token flavors are accepted:
+ * - `kgi_sk_<sessionId>` — framework-issued OAuth session tokens.
+ *   Verified via `sessionStore.get`; expiration + revocation are pulled
+ *   from the session row.
+ * - anything else — caller-plugged static bearer tokens. Verified via
+ *   `resolveToken`. Byte-shape-identical with the session-less contract.
+ */
+export declare function bearerAuthMiddleware(resolve: TokenResolver, options?: BearerAuthMiddlewareOptions): MiddlewareHandler;
+/**
+ * Sentinel `tenantId` value the middleware passes to
+ * `SessionStoreBinding.get` when it needs to look up a session by its
+ * id without knowing the tenant in advance. Session-store adapters
+ * MUST honor this by skipping the tenant filter — the tenant is not
+ * known until the session row has been read.
+ */
+export declare const MULTI_TENANT_LOOKUP: TenantId;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,iBAAiB,EAAQ,MAAM,MAAM,CAAC;AAE7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAE/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAG,SAAkB,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAE/D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE;QACzB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;QACvC,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KAC/D,CAAC;CACH;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,2BAAgC,GACxC,iBAAiB,CA+JnB;AAiDD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAA0D,QAAQ,CAAC"}

package/dist/middleware/auth.js

@@ -0,0 +1,247 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { statusFor, toWireError } from '../errors.js';
+import { PUBLIC_RUN_TOKEN_PREFIX, verifyPublicRunToken } from '../public-run-token.js';
+/**
+ * Session-token prefix. Framework-issued opaque tokens minted by
+ * `POST /v1/auth/callback/:providerId` carry this prefix so the auth
+ * middleware can route them to the session store instead of the caller-
+ * plugged `TokenResolver`. Distinct prefix means a static bearer token
+ * and a session token can coexist byte-shape-identical on the wire.
+ */
+export const SESSION_TOKEN_PREFIX = 'kgi_sk_';
+/**
+ * Compose the on-wire session token from a `SessionId`. Session tokens
+ * are opaque to clients — the shape below is a framework convention,
+ * not part of the wire contract. Do NOT parse it in downstream code
+ * outside the middleware.
+ */
+export function encodeSessionToken(sessionId) {
+    return `${SESSION_TOKEN_PREFIX}${sessionId}`;
+}
+const DEFAULT_TOUCH_THROTTLE_MS = 60_000;
+/**
+ * Bearer-token middleware. Fails 401 on missing / malformed / expired /
+ * revoked. On success, sets `c.set('tenantId', tenantId)` for downstream
+ * handlers.
+ *
+ * Two token flavors are accepted:
+ * - `kgi_sk_<sessionId>` — framework-issued OAuth session tokens.
+ *   Verified via `sessionStore.get`; expiration + revocation are pulled
+ *   from the session row.
+ * - anything else — caller-plugged static bearer tokens. Verified via
+ *   `resolveToken`. Byte-shape-identical with the session-less contract.
+ */
+export function bearerAuthMiddleware(resolve, options = {}) {
+    const { sessionStore, inactivityTimeoutMs } = options;
+    const touchThrottleMs = options.touchThrottleMs ?? DEFAULT_TOUCH_THROTTLE_MS;
+    // Per-process throttle bucket: session id → last touch millis.
+    // A shared Map is fine — session ids are opaque strings and the
+    // bucket is bounded by the number of active sessions the process
+    // has recently observed.
+    const touchBucket = new Map();
+    return async (c, next) => {
+        const requestId = c.get('requestId');
+        const header = c.req.header('authorization');
+        if (header === undefined || header.length === 0) {
+            const body = toWireError({ code: 'auth-missing', message: 'Authorization header is required' }, requestId);
+            return c.json(body, statusFor('auth-missing'));
+        }
+        const match = /^Bearer\s+(.+)$/i.exec(header);
+        if (match === null) {
+            const body = toWireError({
+                code: 'auth-missing',
+                message: 'Authorization header must be "Bearer <token>"',
+            }, requestId);
+            return c.json(body, statusFor('auth-missing'));
+        }
+        const token = match[1]?.trim() ?? '';
+        if (token.length === 0) {
+            const body = toWireError({ code: 'auth-missing', message: 'Bearer token is empty' }, requestId);
+            return c.json(body, statusFor('auth-missing'));
+        }
+        if (token.startsWith(PUBLIC_RUN_TOKEN_PREFIX)) {
+            return authenticatePublicRunToken(c, next, token, requestId, options.publicRunTokens);
+        }
+        const isSessionToken = sessionStore !== undefined && token.startsWith(SESSION_TOKEN_PREFIX);
+        const resolution = isSessionToken
+            ? await resolveSessionToken(sessionStore, token)
+            : await resolve(token);
+        if (resolution === null) {
+            const body = toWireError({ code: 'auth-missing', message: 'Bearer token is not recognized' }, requestId);
+            return c.json(body, statusFor('auth-missing'));
+        }
+        if (resolution.revoked === true) {
+            // Rotated sessions surface as `refresh-token-invalid` — OAuth 2.1
+            // BCP reuse detection. The old session token is no longer valid,
+            // but the semantic distinction from an explicit revoke matters
+            // to compliant clients (they retry with the fresh token instead
+            // of prompting the user to re-authenticate).
+            if (resolution.rotated === true) {
+                const body = toWireError({
+                    code: 'refresh-token-invalid',
+                    message: 'Session token was rotated — retry with the fresh token from the last refresh',
+                }, requestId);
+                return c.json(body, statusFor('refresh-token-invalid'));
+            }
+            const body = toWireError({ code: 'auth-revoked', message: 'Bearer token has been revoked' }, requestId);
+            return c.json(body, statusFor('auth-revoked'));
+        }
+        if (resolution.expiresAt !== undefined && resolution.expiresAt.getTime() < Date.now()) {
+            // Session tokens report `session-expired` so callers can
+            // distinguish absolute session TTL from bearer-token expiry.
+            const expiredCode = isSessionToken ? 'session-expired' : 'auth-expired';
+            const expiredMsg = isSessionToken
+                ? 'Session has expired (absolute TTL reached)'
+                : 'Bearer token has expired';
+            const body = toWireError({ code: expiredCode, message: expiredMsg }, requestId);
+            return c.json(body, statusFor(expiredCode));
+        }
+        // Inactivity timeout enforcement. Only applies when the deployment
+        // opted in via `inactivityTimeoutMs` AND the token is a session
+        // token AND the store populated `lastActiveAt`. Skipping the check
+        // preserves the default contract for deployments that don't wire
+        // the config.
+        if (isSessionToken &&
+            inactivityTimeoutMs !== undefined &&
+            inactivityTimeoutMs > 0 &&
+            resolution.lastActiveAt !== undefined) {
+            const cutoff = Date.now() - inactivityTimeoutMs;
+            if (resolution.lastActiveAt.getTime() < cutoff) {
+                const body = toWireError({
+                    code: 'session-inactive',
+                    message: 'Session has been idle beyond the inactivity timeout',
+                }, requestId);
+                return c.json(body, statusFor('session-inactive'));
+            }
+        }
+        c.set('tenantId', resolution.tenantId);
+        if (resolution.reviewerRole !== undefined) {
+            c.set('reviewerRole', resolution.reviewerRole);
+        }
+        if (resolution.userId !== undefined) {
+            c.set('userId', resolution.userId);
+        }
+        if (resolution.tokenId !== undefined) {
+            c.set('tokenId', resolution.tokenId);
+        }
+        if (resolution.sessionId !== undefined) {
+            c.set('sessionId', resolution.sessionId);
+        }
+        if (resolution.providerId !== undefined) {
+            c.set('providerId', resolution.providerId);
+        }
+        if (resolution.scopes !== undefined) {
+            c.set('scopes', resolution.scopes);
+        }
+        if (resolution.capabilities !== undefined) {
+            c.set('capabilities', resolution.capabilities);
+        }
+        // Bump `lastActiveAt` (throttled) so the inactivity timeout has
+        // a fresh signal to compare against. Only meaningful for session
+        // tokens with a wired `touch()`; bearer tokens are skipped.
+        if (isSessionToken && sessionStore?.touch !== undefined && resolution.sessionId !== undefined) {
+            const sid = resolution.sessionId;
+            const last = touchBucket.get(sid) ?? 0;
+            const now = Date.now();
+            if (now - last >= touchThrottleMs) {
+                touchBucket.set(sid, now);
+                // Fire-and-forget; we don't want the write path to hold the
+                // request. Adapter errors surface via observability, not the
+                // hot path (the next check catches a genuinely stale row).
+                void sessionStore
+                    .touch({
+                    tenantId: resolution.tenantId,
+                    sessionId: resolution.sessionId,
+                    at: new Date(now),
+                })
+                    .catch(() => {
+                    // Best-effort — the next request retries.
+                });
+            }
+        }
+        await next();
+        return;
+    };
+}
+/**
+ * Session-token verification path. Distinct from `TokenResolver` because
+ * a session carries structured OAuth context (userId + providerId +
+ * scopes + expiration + revocation) that the store returns natively —
+ * we don't want to squeeze that shape through the resolver contract.
+ *
+ * Session-token tenant scoping: the stored session is the source of
+ * truth for `tenantId`. We look up ACROSS tenants here — the resolved
+ * `tenantId` is whatever the session was written under, so everything
+ * downstream is scoped to that tenant only. A stolen session token still
+ * can't cross tenants because the session it points to belongs to
+ * exactly one tenant.
+ *
+ * Since `SessionStoreBinding.get` requires `tenantId`, the lookup is:
+ * extract `sessionId` from the token, then call
+ * `sessionStore.get({ tenantId: MULTI_TENANT_LOOKUP, sessionId })`.
+ * Session-store implementations MUST recognize the `MULTI_TENANT_LOOKUP`
+ * sentinel and skip the tenant filter; the `tenantId` on the stored
+ * session is authoritative.
+ */
+async function resolveSessionToken(sessionStore, token) {
+    const sessionIdStr = token.slice(SESSION_TOKEN_PREFIX.length);
+    if (sessionIdStr.length === 0)
+        return null;
+    const sessionId = sessionIdStr;
+    const session = await sessionStore.get({
+        tenantId: MULTI_TENANT_LOOKUP,
+        sessionId,
+    });
+    if (session === null)
+        return null;
+    return {
+        tenantId: session.tenantId,
+        userId: session.userId,
+        sessionId: session.id,
+        providerId: session.providerId,
+        scopes: session.scopes,
+        expiresAt: new Date(session.expiresAt),
+        revoked: session.revokedAt !== undefined,
+        ...(session.rotatedAt !== undefined && { rotated: true }),
+        ...(session.lastActiveAt !== undefined && {
+            lastActiveAt: new Date(session.lastActiveAt),
+        }),
+    };
+}
+/**
+ * Sentinel `tenantId` value the middleware passes to
+ * `SessionStoreBinding.get` when it needs to look up a session by its
+ * id without knowing the tenant in advance. Session-store adapters
+ * MUST honor this by skipping the tenant filter — the tenant is not
+ * known until the session row has been read.
+ */
+export const MULTI_TENANT_LOOKUP = '__kindgi_session_multi_tenant_lookup__';
+/**
+ * A public run token: verify it, admit only the routes it may use, and
+ * mark the request so the progress routes check it against the runs
+ * it names.
+ */
+async function authenticatePublicRunToken(c, next, token, requestId, config) {
+    const verified = config === undefined
+        ? { kind: 'err', reason: 'unknown-key' }
+        : verifyPublicRunToken(token, { signingKey: config.signingKey });
+    if (verified.kind === 'err') {
+        const expired = verified.reason === 'expired';
+        const code = expired ? 'auth-expired' : 'auth-missing';
+        const message = expired ? 'Public run token has expired' : 'Bearer token is not recognized';
+        return c.json(toWireError({ code, message }, requestId), statusFor(code));
+    }
+    if (config === undefined || !config.isAllowed(c.req.method, c.req.path)) {
+        return c.json(toWireError({
+            code: 'permission-denied',
+            message: 'A public run token can only follow the runs it names: GET /v1/runs/{runId}/progress and GET /v1/runs/{runId}/progress/stream',
+        }, requestId), statusFor('permission-denied'));
+    }
+    c.set('tenantId', verified.claims.tenantId);
+    c.set('tokenKind', 'public-run');
+    c.set('publicRunIds', verified.claims.runIds);
+    await next();
+    return undefined;
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AASjC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AA+FvF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAkB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAoB;IACrD,OAAO,GAAG,oBAAoB,GAAG,SAA8B,EAAE,CAAC;AACpE,CAAC;AAuCD,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,UAAuC,EAAE;IAEzC,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IACtD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAC7E,+DAA+D;IAC/D,gEAAgE;IAChE,iEAAiE;IACjE,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kCAAkC,EAAE,EACrE,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,WAAW,CACtB;gBACE,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,+CAA+C;aACzD,EACD,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAC1D,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC9C,OAAO,0BAA0B,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,cAAc,GAAG,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,MAAM,mBAAmB,CAAC,YAAa,EAAE,KAAK,CAAC;YACjD,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,gCAAgC,EAAE,EACnE,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAChC,kEAAkE;YAClE,iEAAiE;YACjE,+DAA+D;YAC/D,gEAAgE;YAChE,6CAA6C;YAC7C,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,WAAW,CACtB;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,8EAA8E;iBACxF,EACD,SAAS,CACV,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CACtB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAClE,SAAS,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtF,yDAAyD;YACzD,6DAA6D;YAC7D,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC;YACxE,MAAM,UAAU,GAAG,cAAc;gBAC/B,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,0BAA0B,CAAC;YAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;YAChF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;QACvD,CAAC;QACD,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,cAAc;QACd,IACE,cAAc;YACd,mBAAmB,KAAK,SAAS;YACjC,mBAAmB,GAAG,CAAC;YACvB,UAAU,CAAC,YAAY,KAAK,SAAS,EACrC,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC;YAChD,IAAI,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,WAAW,CACtB;oBACE,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,qDAAqD;iBAC/D,EACD,SAAS,CACV,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QAED,gEAAgE;QAChE,iEAAiE;QACjE,4DAA4D;QAC5D,IAAI,cAAc,IAAI,YAAY,EAAE,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9F,MAAM,GAAG,GAAG,UAAU,CAAC,SAA8B,CAAC;YACtD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,IAAI,IAAI,eAAe,EAAE,CAAC;gBAClC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1B,4DAA4D;gBAC5D,6DAA6D;gBAC7D,2DAA2D;gBAC3D,KAAK,YAAY;qBACd,KAAK,CAAC;oBACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;iBAClB,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE;oBACV,0CAA0C;gBAC5C,CAAC,CAAC,CAAC;YACP,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,YAAiC,EACjC,KAAa;IAEb,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,YAAoC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC;QACrC,QAAQ,EAAE,mBAAmB;QAC7B,SAAS;KACV,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAA2B;QAC3C,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAA8B,CAAC;QAC3D,OAAO,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS;QACxC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI;YACxC,YAAY,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAiC,CAAC;SAClE,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAA+D,CAAC;AAEnG;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,CAAU,EACV,IAAU,EACV,KAAa,EACb,SAAiB,EACjB,MAAsD;IAEtD,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS;QAClB,CAAC,CAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAY;QACnD,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,gCAAgC,CAAC;QAC5F,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,IAAI,CAAU,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;YACE,IAAI,EAAE,mBAAmB;YACzB,OAAO,EACL,8HAA8H;SACjI,EACD,SAAS,CACV,EACD,SAAS,CAAC,mBAAmB,CAAU,CACxC,CAAC;IACJ,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,EAAE,CAAC;IACb,OAAO,SAAS,CAAC;AACnB,CAAC"}