@kindgi/api 0.0.0-bootstrap.0 → 0.1.0

package/dist/routes/providers.js

@@ -0,0 +1,490 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { FEATURES, } from '@kindgi/capabilities';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+export function providersRouter(binding, onWrite) {
+    const r = new Hono();
+    // ---------- GET / (list, cursor-paginated) ----------
+    r.get('/', async (c) => {
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        const featureRaw = c.req.query('feature');
+        const page = await binding.list({
+            tenantId,
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+            ...(featureRaw !== undefined && featureRaw.length > 0 && { featureFilter: featureRaw }),
+        });
+        return c.json({
+            data: page.data.map(serializeProvider),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- GET /:providerId ----------
+    r.get('/:providerId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const providerId = c.req.param('providerId');
+        const provider = await binding.get({ tenantId, providerId });
+        if (provider === null) {
+            c.status(statusFor('provider-not-found'));
+            return c.json(toWireError({
+                code: 'provider-not-found',
+                message: `No provider registered with id "${providerId}"`,
+                providerId,
+            }, requestId));
+        }
+        return c.json(serializeProvider(provider));
+    });
+    // ---------- GET /:providerId/capabilities (sub-resource) ----------
+    r.get('/:providerId/capabilities', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const providerId = c.req.param('providerId');
+        const capabilities = await binding.capabilitiesFor({ tenantId, providerId });
+        if (capabilities === null) {
+            c.status(statusFor('provider-not-found'));
+            return c.json(toWireError({
+                code: 'provider-not-found',
+                message: `No provider registered with id "${providerId}"`,
+                providerId,
+            }, requestId));
+        }
+        return c.json({
+            data: capabilities.map(serializeCapability),
+        });
+    });
+    // ---------- POST / (register) ----------
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        // Wire body shape:
+        //   {
+        //     "metadata":   ProviderMetadata (required),
+        //     "adapter_id": string           (required — an adapter registered
+        //                                     for the tenant),
+        //     "secret_ref": { envName, name } (optional — tenant-scoped
+        //                                     credential pointer for the
+        //                                     runtime bridge),
+        //     "adapter_config": { … }         (optional — the adapter's flat,
+        //                                     non-secret connection settings)
+        //   }
+        const bodyObj = body;
+        if (bodyObj.metadata === undefined) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({
+                code: 'bad-input',
+                message: 'Request body must include a `metadata` object with the ProviderMetadata shape.',
+            }, requestId));
+        }
+        if (typeof bodyObj.adapter_id !== 'string' || bodyObj.adapter_id.length === 0) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({
+                code: 'bad-input',
+                message: 'Request body must include a non-empty string `adapter_id` naming a registered adapter.',
+            }, requestId));
+        }
+        const secretRefResult = parseSecretRef(bodyObj.secret_ref);
+        if (secretRefResult.kind === 'err') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: secretRefResult.error }, requestId));
+        }
+        const adapterConfigResult = parseAdapterConfig(bodyObj.adapter_config);
+        if (adapterConfigResult.kind === 'err') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: adapterConfigResult.error }, requestId));
+        }
+        // Shape validation matches `@kindgi/capabilities.createProviderRegistry`
+        // internal `validate()` — same rules as the runtime primitive, so a
+        // provider registered through the API is byte-identical to one
+        // registered in-process.
+        const validation = validateProviderMetadata(bodyObj.metadata);
+        if (validation.kind === 'err') {
+            c.status(statusFor('invalid-provider'));
+            return c.json(toWireError({
+                code: 'invalid-provider',
+                message: validation.error.message,
+                reason: validation.error.reason,
+            }, requestId));
+        }
+        const outcome = await binding.register({
+            tenantId,
+            metadata: validation.value,
+            adapterId: bodyObj.adapter_id,
+            ...(secretRefResult.value !== undefined && { secretRef: secretRefResult.value }),
+            ...(adapterConfigResult.value !== undefined && { adapterConfig: adapterConfigResult.value }),
+        });
+        if (outcome.kind === 'already-registered') {
+            c.status(statusFor('provider-already-registered'));
+            return c.json(toWireError({
+                code: 'provider-already-registered',
+                message: `Provider "${outcome.providerId}" is already registered`,
+                providerId: outcome.providerId,
+            }, requestId));
+        }
+        if (outcome.kind === 'invalid') {
+            c.status(statusFor('invalid-provider'));
+            return c.json(toWireError({
+                code: 'invalid-provider',
+                message: outcome.message,
+                providerId: outcome.providerId,
+                ...(outcome.reason !== undefined && { reason: outcome.reason }),
+            }, requestId));
+        }
+        if (onWrite !== undefined) {
+            try {
+                await onWrite({ tenantId, providerId: outcome.providerId, kind: 'register' });
+            }
+            catch {
+                // Post-write hooks are advisory (cache invalidation etc.).
+                // A hook failure does NOT roll back the register — the row
+                // is durably stored; a stale in-memory cache will self-heal
+                // on the next boot.
+            }
+        }
+        c.status(201);
+        return c.json({ providerId: outcome.providerId });
+    });
+    // ---------- POST /:providerId/unregister ----------
+    r.post('/:providerId/unregister', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const providerId = c.req.param('providerId');
+        const outcome = await binding.unregister({ tenantId, providerId });
+        if (!outcome.unregistered) {
+            c.status(statusFor('provider-not-found'));
+            return c.json(toWireError({
+                code: 'provider-not-found',
+                message: `No provider "${providerId}" to unregister`,
+                providerId,
+            }, requestId));
+        }
+        if (onWrite !== undefined) {
+            try {
+                await onWrite({ tenantId, providerId, kind: 'unregister' });
+            }
+            catch {
+                // See register path — hooks are advisory.
+            }
+        }
+        return c.json({ providerId, unregistered: true });
+    });
+    return r;
+}
+function serializeProvider(m) {
+    return {
+        id: m.id,
+        region: m.region,
+        models: m.models.map((model) => ({
+            name: model.name,
+            contextWindow: model.contextWindow,
+            features: model.features,
+            cost: {
+                promptUsdPer1kTokens: model.cost.promptUsdPer1kTokens,
+                completionUsdPer1kTokens: model.cost.completionUsdPer1kTokens,
+            },
+            ...(model.p95LatencyMs !== undefined && { p95LatencyMs: model.p95LatencyMs }),
+            ...(model.maxOutputTokens !== undefined && { maxOutputTokens: model.maxOutputTokens }),
+            ...(model.description !== undefined && { description: model.description }),
+        })),
+        ...(m.attributes !== undefined && { attributes: m.attributes }),
+        ...(m.description !== undefined && { description: m.description }),
+        ...(m.capabilityKind !== undefined && { capabilityKind: m.capabilityKind }),
+        ...(m.fallback !== undefined && { fallback: m.fallback }),
+    };
+}
+function serializeCapability(d) {
+    return {
+        id: d.id,
+        feature: d.feature,
+        description: d.description,
+        ...(d.kind !== undefined && { kind: d.kind }),
+        ...(d.paramsSchema !== undefined && { paramsSchema: d.paramsSchema }),
+    };
+}
+/**
+ * Wire-shape validator for `ProviderMetadata`. Mirrors the private
+ * `validate()` inside `@kindgi/capabilities.createProviderRegistry` —
+ * kept in sync with the runtime so a provider registered through the
+ * API is byte-identical to one registered in-process. The wire path
+ * additionally enforces `features ⊆ FEATURES` (closed enum) since it
+ * receives untyped JSON; the runtime primitive receives already-typed
+ * `Feature[]` from its callers. Returns a `Result`-ish shape rather
+ * than throwing.
+ */
+/** `metadata.region`: one DNS label (`us-central1`, `eu-west-1`, `global`, `unspecified`). */
+const REGION = /^[a-z][a-z0-9-]{0,62}$/;
+function validateProviderMetadata(body) {
+    const b = body;
+    if (typeof b.id !== 'string' || b.id.length === 0) {
+        return { kind: 'err', error: { message: 'metadata.id required', reason: 'empty-id' } };
+    }
+    if (typeof b.region !== 'string' || b.region.length === 0) {
+        return {
+            kind: 'err',
+            error: { message: `provider "${b.id}" missing metadata.region`, reason: 'empty-region' },
+        };
+    }
+    // An adapter may build a hostname from the region (Vertex AI:
+    // `<region>-aiplatform.googleapis.com`), so it must stay one DNS label.
+    if (!REGION.test(b.region)) {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${b.id}" metadata.region must be one DNS label: lowercase letters, digits and hyphens (e.g. us-central1)`,
+                reason: 'invalid-region',
+            },
+        };
+    }
+    if (!Array.isArray(b.models) || b.models.length === 0) {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${b.id}" must expose at least one model in metadata.models[]`,
+                reason: 'empty-models',
+            },
+        };
+    }
+    const seenNames = new Set();
+    const validatedModels = [];
+    for (const rawModel of b.models) {
+        const modelResult = validateModelInfo(b.id, rawModel);
+        if (modelResult.kind === 'err')
+            return modelResult;
+        if (seenNames.has(modelResult.value.name)) {
+            return {
+                kind: 'err',
+                error: {
+                    message: `provider "${b.id}" declares model "${modelResult.value.name}" more than once in metadata.models[]`,
+                    reason: 'duplicate-model-name',
+                },
+            };
+        }
+        seenNames.add(modelResult.value.name);
+        validatedModels.push(modelResult.value);
+    }
+    if (b.attributes !== undefined) {
+        if (!Array.isArray(b.attributes) || b.attributes.some((a) => typeof a !== 'string')) {
+            return {
+                kind: 'err',
+                error: {
+                    message: `provider "${b.id}" attributes must be an array of strings`,
+                    reason: 'invalid-attributes',
+                },
+            };
+        }
+    }
+    if (b.description !== undefined && typeof b.description !== 'string') {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${b.id}" description must be a string`,
+                reason: 'invalid-description',
+            },
+        };
+    }
+    if (b.capabilityKind !== undefined && typeof b.capabilityKind !== 'string') {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${b.id}" capabilityKind must be a string`,
+                reason: 'invalid-capability-kind',
+            },
+        };
+    }
+    if (b.fallback !== undefined && typeof b.fallback !== 'boolean') {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${b.id}" fallback must be a boolean`,
+                reason: 'invalid-fallback',
+            },
+        };
+    }
+    const value = {
+        id: b.id,
+        region: b.region,
+        models: validatedModels,
+        ...(b.attributes !== undefined && { attributes: b.attributes }),
+        ...(b.description !== undefined && { description: b.description }),
+        ...(b.capabilityKind !== undefined && { capabilityKind: b.capabilityKind }),
+        ...(b.fallback !== undefined && { fallback: b.fallback }),
+    };
+    return { kind: 'ok', value };
+}
+/**
+ * Wire-shape validator for a single `ModelInfo` inside `metadata.models[]`.
+ * Enforces the same guardrails as `createProviderRegistry.validate()`
+ * plus the closed-enum `features` check (wire-only — the runtime
+ * primitive receives already-typed `Feature[]`).
+ */
+function validateModelInfo(providerId, raw) {
+    if (raw === null || typeof raw !== 'object') {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${providerId}" metadata.models[] entries must be objects`,
+                reason: 'invalid-model-shape',
+            },
+        };
+    }
+    const m = raw;
+    if (typeof m.name !== 'string' || m.name.length === 0) {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${providerId}" has a model with empty name`,
+                reason: 'empty-model-name',
+            },
+        };
+    }
+    if (typeof m.contextWindow !== 'number' ||
+        m.contextWindow <= 0 ||
+        !Number.isInteger(m.contextWindow)) {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${providerId}" model "${m.name}" contextWindow must be a positive integer`,
+                reason: 'invalid-context-window',
+            },
+        };
+    }
+    if (!Array.isArray(m.features)) {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${providerId}" model "${m.name}" features must be an array`,
+                reason: 'invalid-features',
+            },
+        };
+    }
+    for (const f of m.features) {
+        if (typeof f !== 'string' || !FEATURES.includes(f)) {
+            return {
+                kind: 'err',
+                error: {
+                    message: `provider "${providerId}" model "${m.name}" features contains unknown value "${String(f)}"`,
+                    reason: 'unknown-feature',
+                },
+            };
+        }
+    }
+    const cost = m.cost;
+    if (cost === undefined ||
+        typeof cost.promptUsdPer1kTokens !== 'number' ||
+        cost.promptUsdPer1kTokens < 0 ||
+        typeof cost.completionUsdPer1kTokens !== 'number' ||
+        cost.completionUsdPer1kTokens < 0) {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${providerId}" model "${m.name}" cost table must have non-negative promptUsdPer1kTokens + completionUsdPer1kTokens`,
+                reason: 'invalid-cost',
+            },
+        };
+    }
+    if (m.p95LatencyMs !== undefined) {
+        if (typeof m.p95LatencyMs !== 'number' || m.p95LatencyMs < 0) {
+            return {
+                kind: 'err',
+                error: {
+                    message: `provider "${providerId}" model "${m.name}" p95LatencyMs must be a non-negative number`,
+                    reason: 'invalid-p95-latency',
+                },
+            };
+        }
+    }
+    if (m.maxOutputTokens !== undefined) {
+        if (typeof m.maxOutputTokens !== 'number' ||
+            m.maxOutputTokens <= 0 ||
+            !Number.isInteger(m.maxOutputTokens)) {
+            return {
+                kind: 'err',
+                error: {
+                    message: `provider "${providerId}" model "${m.name}" maxOutputTokens must be a positive integer`,
+                    reason: 'invalid-max-output-tokens',
+                },
+            };
+        }
+    }
+    if (m.description !== undefined && typeof m.description !== 'string') {
+        return {
+            kind: 'err',
+            error: {
+                message: `provider "${providerId}" model "${m.name}" description must be a string`,
+                reason: 'invalid-description',
+            },
+        };
+    }
+    const value = {
+        name: m.name,
+        contextWindow: m.contextWindow,
+        features: m.features,
+        cost: {
+            promptUsdPer1kTokens: cost.promptUsdPer1kTokens,
+            completionUsdPer1kTokens: cost.completionUsdPer1kTokens,
+        },
+        ...(m.p95LatencyMs !== undefined && { p95LatencyMs: m.p95LatencyMs }),
+        ...(m.maxOutputTokens !== undefined && { maxOutputTokens: m.maxOutputTokens }),
+        ...(m.description !== undefined && { description: m.description }),
+    };
+    return { kind: 'ok', value };
+}
+/**
+ * Parse the optional `adapter_config` on the register request body: a
+ * flat object of string, number or boolean values. Credentials don't
+ * belong here (they ride on `secret_ref`); the adapter validates its
+ * own keys when it is instantiated.
+ */
+function parseAdapterConfig(raw) {
+    if (raw === undefined || raw === null)
+        return { kind: 'ok', value: undefined };
+    if (typeof raw !== 'object' || Array.isArray(raw)) {
+        return { kind: 'err', error: '`adapter_config` must be an object.' };
+    }
+    const bad = Object.entries(raw).filter(([, v]) => typeof v !== 'string' && typeof v !== 'number' && typeof v !== 'boolean');
+    if (bad.length > 0) {
+        return {
+            kind: 'err',
+            error: `\`adapter_config\` values must be strings, numbers or booleans (${bad.map(([k]) => k).join(', ')}).`,
+        };
+    }
+    return { kind: 'ok', value: raw };
+}
+/**
+ * Parse the optional `secret_ref` on the register request body.
+ * Accepts `undefined` (no credential — dev-echo, local models),
+ * `{envName: string, name: string}`, or rejects any other shape.
+ */
+function parseSecretRef(raw) {
+    if (raw === undefined || raw === null)
+        return { kind: 'ok', value: undefined };
+    if (typeof raw !== 'object') {
+        return { kind: 'err', error: '`secret_ref` must be an object with `envName` and `name`.' };
+    }
+    const r = raw;
+    if (typeof r.envName !== 'string' || r.envName.length === 0) {
+        return { kind: 'err', error: '`secret_ref.envName` must be a non-empty string.' };
+    }
+    if (typeof r.name !== 'string' || r.name.length === 0) {
+        return { kind: 'err', error: '`secret_ref.name` must be a non-empty string.' };
+    }
+    return { kind: 'ok', value: { envName: r.envName, name: r.name } };
+}
+//# sourceMappingURL=providers.js.map

package/dist/routes/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../src/routes/providers.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAEL,QAAQ,GAIT,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA6B7C,MAAM,UAAU,eAAe,CAC7B,OAAgC,EAChC,OAA2B;IAE3B,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;SACxF,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACtC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAU,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,mCAAmC,UAAU,GAAG;gBACzD,UAAU;aACX,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE7C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7E,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAU,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,mCAAmC,UAAU,GAAG;gBACzD,UAAU;aACX,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,MAAM;QACN,iDAAiD;QACjD,uEAAuE;QACvE,uDAAuD;QACvD,gEAAgE;QAChE,iEAAiE;QACjE,uDAAuD;QACvD,sEAAsE;QACtE,sEAAsE;QACtE,MAAM;QACN,MAAM,OAAO,GAAG,IAKf,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EACL,gFAAgF;aACnF,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EACL,wFAAwF;aAC3F,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,eAAe,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACnC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,mBAAmB,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACvC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAClF,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,+DAA+D;QAC/D,yBAAyB;QACzB,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;gBACjC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;aAChC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;YACrC,QAAQ;YACR,QAAQ,EAAE,UAAU,CAAC,KAAK;YAC1B,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC;YAChF,GAAG,CAAC,mBAAmB,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,EAAE,CAAC;SAC7F,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,6BAA6B,CAAU,CAAC,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,aAAa,OAAO,CAAC,UAAU,yBAAyB;gBACjE,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aAChE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;gBAC3D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,qDAAqD;IACrD,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAU,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,gBAAgB,UAAU,iBAAiB;gBACpD,UAAU;aACX,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAmB;IAC5C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE;gBACJ,oBAAoB,EAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB;gBACrD,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB;aAC9D;YACD,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7E,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;YACtF,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/D,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;QAC3E,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAuB;IAClD,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,8FAA8F;AAC9F,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC,SAAS,wBAAwB,CAC/B,IAAa;IAIb,MAAM,CAAC,GAAG,IAA2D,CAAC;IACtE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,2BAA2B,EAAE,MAAM,EAAE,cAAc,EAAE;SACzF,CAAC;IACJ,CAAC;IACD,8DAA8D;IAC9D,wEAAwE;IACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,mGAAmG;gBAC7H,MAAM,EAAE,gBAAgB;aACzB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,uDAAuD;gBACjF,MAAM,EAAE,cAAc;aACvB;SACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,eAAe,GAAgB,EAAE,CAAC;IACxC,KAAK,MAAM,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,WAAW,CAAC;QACnD,IAAI,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,qBAAqB,WAAW,CAAC,KAAK,CAAC,IAAI,uCAAuC;oBAC5G,MAAM,EAAE,sBAAsB;iBAC/B;aACF,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACpF,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,0CAA0C;oBACpE,MAAM,EAAE,oBAAoB;iBAC7B;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACrE,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,gCAAgC;gBAC1D,MAAM,EAAE,qBAAqB;aAC9B;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC3E,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,mCAAmC;gBAC7D,MAAM,EAAE,yBAAyB;aAClC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,8BAA8B;gBACxD,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAqB;QAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,eAAe;QACvB,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAA+B,EAAE,CAAC;QACpF,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,cAAwB,EAAE,CAAC;QACrF,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAmB,EAAE,CAAC;KACrE,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,UAAkB,EAClB,GAAY;IAEZ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,UAAU,6CAA6C;gBAC7E,MAAM,EAAE,qBAAqB;aAC9B;SACF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,GAAmD,CAAC;IAC9D,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,UAAU,+BAA+B;gBAC/D,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,CAAC,CAAC,aAAa,IAAI,CAAC;QACpB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,EAClC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,UAAU,YAAY,CAAC,CAAC,IAAI,4CAA4C;gBAC9F,MAAM,EAAE,wBAAwB;aACjC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,UAAU,YAAY,CAAC,CAAC,IAAI,6BAA6B;gBAC/E,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAE,QAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,OAAO,EAAE,aAAa,UAAU,YAAY,CAAC,CAAC,IAAI,sCAAsC,MAAM,CAAC,CAAC,CAAC,GAAG;oBACpG,MAAM,EAAE,iBAAiB;iBAC1B;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAqC,CAAC;IACrD,IACE,IAAI,KAAK,SAAS;QAClB,OAAO,IAAI,CAAC,oBAAoB,KAAK,QAAQ;QAC7C,IAAI,CAAC,oBAAoB,GAAG,CAAC;QAC7B,OAAO,IAAI,CAAC,wBAAwB,KAAK,QAAQ;QACjD,IAAI,CAAC,wBAAwB,GAAG,CAAC,EACjC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,UAAU,YAAY,CAAC,CAAC,IAAI,qFAAqF;gBACvI,MAAM,EAAE,cAAc;aACvB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,OAAO,EAAE,aAAa,UAAU,YAAY,CAAC,CAAC,IAAI,8CAA8C;oBAChG,MAAM,EAAE,qBAAqB;iBAC9B;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACpC,IACE,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;YACrC,CAAC,CAAC,eAAe,IAAI,CAAC;YACtB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,EACpC,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,OAAO,EAAE,aAAa,UAAU,YAAY,CAAC,CAAC,IAAI,8CAA8C;oBAChG,MAAM,EAAE,2BAA2B;iBACpC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACrE,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,OAAO,EAAE,aAAa,UAAU,YAAY,CAAC,CAAC,IAAI,gCAAgC;gBAClF,MAAM,EAAE,qBAAqB;aAC9B;SACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,QAAQ,EAAE,CAAC,CAAC,QAA8B;QAC1C,IAAI,EAAE;YACJ,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;SACxD;QACD,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;QACrE,GAAG,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC;QAC9E,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;KACnE,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,GAAY;IAIZ,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC/E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,CACpF,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,mEAAmE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAC7G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAoB,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,GAAY;IAIZ,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC/E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAC7F,CAAC;IACD,MAAM,CAAC,GAAG,GAA8D,CAAC;IACzE,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC"}

package/dist/routes/public-run-tokens.d.ts

@@ -0,0 +1,17 @@
+import { Hono } from 'hono';
+import type { RunBinding } from '@kindgi/runtime';
+import type { RunId, TenantId } from '@kindgi/types';
+import type { Authorizer } from '../middleware/authorize.js';
+import { type MintPublicRunTokenResult } from '../public-run-token.js';
+import type { AppEnv } from '../types.js';
+export interface PublicRunTokenIssuer {
+    readonly mint: (tenantId: TenantId, runIds: readonly RunId[], ttlSeconds: number) => MintPublicRunTokenResult;
+    readonly defaultTtlSeconds: number;
+    readonly maxTtlSeconds: number;
+}
+/**
+ * `POST /v1/tokens/public`: mint a public run token for runs the caller
+ * may read. The token itself can't reach this route.
+ */
+export declare function publicRunTokensRouter(runBinding: RunBinding, issuer: PublicRunTokenIssuer, authorizer?: Authorizer): Hono<AppEnv>;
+//# sourceMappingURL=public-run-tokens.d.ts.map

package/dist/routes/public-run-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-run-tokens.d.ts","sourceRoot":"","sources":["../../src/routes/public-run-tokens.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAA6B,KAAK,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,CACb,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,SAAS,KAAK,EAAE,EACxB,UAAU,EAAE,MAAM,KACf,wBAAwB,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAID;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,oBAAoB,EAC5B,UAAU,CAAC,EAAE,UAAU,GACtB,IAAI,CAAC,MAAM,CAAC,CAqEd"}

package/dist/routes/public-run-tokens.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { ref } from '@kindgi/authz';
+import { statusFor, toWireError } from '../errors.js';
+import { MAX_PUBLIC_RUN_TOKEN_RUNS } from '../public-run-token.js';
+const BODY_FIELDS = new Set(['runIds', 'expiresInSeconds']);
+/**
+ * `POST /v1/tokens/public`: mint a public run token for runs the caller
+ * may read. The token itself can't reach this route.
+ */
+export function publicRunTokensRouter(runBinding, issuer, authorizer) {
+    const r = new Hono();
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const error = (code, message, details = {}) => {
+            c.status(statusFor(code));
+            return c.json(toWireError({ code, message, ...details }, requestId));
+        };
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return error('bad-input', 'Request body must be valid JSON');
+        }
+        if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+            return error('bad-input', 'Request body must be a JSON object');
+        }
+        const fields = body;
+        const unknown = Object.keys(fields).find((key) => !BODY_FIELDS.has(key));
+        if (unknown !== undefined)
+            return error('unknown-field', `Unknown field \`${unknown}\``);
+        const runIds = fields.runIds;
+        if (!Array.isArray(runIds) ||
+            runIds.length === 0 ||
+            runIds.length > MAX_PUBLIC_RUN_TOKEN_RUNS ||
+            !runIds.every((id) => typeof id === 'string' && id.length > 0)) {
+            return error('bad-input', `\`runIds\` must be 1–${MAX_PUBLIC_RUN_TOKEN_RUNS} non-empty run ids`);
+        }
+        const ttl = fields.expiresInSeconds ?? issuer.defaultTtlSeconds;
+        if (!Number.isInteger(ttl) || ttl < 1 || ttl > issuer.maxTtlSeconds) {
+            return error('bad-input', `\`expiresInSeconds\` must be an integer in 1–${issuer.maxTtlSeconds}`);
+        }
+        const unique = [...new Set(runIds)];
+        for (const runId of unique) {
+            const row = await runBinding.getRun(tenantId, runId);
+            if (row === null) {
+                return error('run-not-found', `No run with id ${runId}`, { runId });
+            }
+            if (authorizer !== undefined &&
+                !(await authorizer.can(c, 'read', ref('project', row.projectId)))) {
+                return error('permission-denied', `Not allowed to read run ${runId}`, { runId });
+            }
+        }
+        const minted = issuer.mint(tenantId, unique, ttl);
+        if (minted.kind === 'err')
+            return error('token-mint-failed', minted.message);
+        c.status(201);
+        return c.json({
+            token: minted.token,
+            expiresAt: minted.expiresAt.toISOString(),
+            runIds: unique,
+        });
+    });
+    return r;
+}
+//# sourceMappingURL=public-run-tokens.js.map

package/dist/routes/public-run-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-run-tokens.js","sourceRoot":"","sources":["../../src/routes/public-run-tokens.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAIpC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,yBAAyB,EAAiC,MAAM,wBAAwB,CAAC;AAalG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAE5D;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAsB,EACtB,MAA4B,EAC5B,UAAuB;IAEvB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,UAAmC,EAAE,EAAE,EAAE;YACrF,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAU,CAAC,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC;QAEF,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC,WAAW,EAAE,oCAAoC,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,eAAe,EAAE,mBAAmB,OAAO,IAAI,CAAC,CAAC;QAEzF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACtB,MAAM,CAAC,MAAM,KAAK,CAAC;YACnB,MAAM,CAAC,MAAM,GAAG,yBAAyB;YACzC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAC9D,CAAC;YACD,OAAO,KAAK,CACV,WAAW,EACX,wBAAwB,yBAAyB,oBAAoB,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAK,GAAc,GAAG,CAAC,IAAK,GAAc,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YAC5F,OAAO,KAAK,CACV,WAAW,EACX,gDAAgD,MAAM,CAAC,aAAa,EAAE,CACvE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAkB,CAAC,CAAY,CAAC;QAC3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,eAAe,EAAE,kBAAkB,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,IACE,UAAU,KAAK,SAAS;gBACxB,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAA8B,CAAC,CAAC,CAAC,EACtF,CAAC;gBACD,OAAO,KAAK,CAAC,mBAAmB,EAAE,2BAA2B,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAa,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;YACzC,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/routes/retention.d.ts

@@ -0,0 +1,19 @@
+import { Hono } from 'hono';
+import type { Authorizer } from '../middleware/authorize.js';
+import type { RetentionBinding } from '../retention-binding.js';
+import type { AppEnv } from '../types.js';
+/**
+ * Retention resource routes — admin surface for the retention
+ * pipeline.
+ *
+ *   - `GET  /v1/retention/scheduled`      tombstoned rows scheduled for deletion
+ *                                         (`?pastGraceOnly=true`: only what a
+ *                                         sweep would purge now)
+ *   - `POST /v1/retention/sweep`          "purge every past-grace tombstone in this tenant"
+ *   - `POST /v1/retention/sweep/:domain`  same but narrowed to one domain
+ *
+ * PEP: reads and writes both require `admin` on `tenant:<tenantId>`,
+ * matching how the other tenant-scoped admin knobs gate.
+ */
+export declare function retentionRouter(binding: RetentionBinding, authorizer?: Authorizer): Hono<AppEnv>;
+//# sourceMappingURL=retention.d.ts.map

package/dist/routes/retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../src/routes/retention.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CA6HhG"}