@komaa/standin-sdk 0.1.0

package/dist/fetch.js

@@ -0,0 +1,240 @@
+// Copyright (c) 2026 Komaa DigiTech
+// SPDX-License-Identifier: MIT
+/**
+ * Fetching a URL an agent chose, without fetching your own infrastructure.
+ *
+ * An agent that can show the caller a picture will sooner or later be handed a
+ * URL by its own model, and that model is steered by whoever is on the call. So
+ * the URL is untrusted input wearing a trusted costume, and a naive GET of it is
+ * a server-side request forgery: `169.254.169.254` is cloud credentials,
+ * `127.0.0.1` is whatever else you run, and `10.0.0.0/8` is the rest of your
+ * network.
+ *
+ * {@link fetchPublicImage} is the guarded way to do it: http and https only, no
+ * embedded credentials, and no host that resolves into private, loopback,
+ * link-local or reserved space.
+ *
+ * The subtle half is the rebind. Validating a hostname resolves it once, and the
+ * resolution the HTTP stack does a moment later can answer differently, so the
+ * request is made through a guarded `lookup` that re-checks the address the
+ * socket will actually connect to. One redirect hop is followed, because image
+ * CDNs habitually redirect to the real asset, and the target goes through the
+ * whole guard again rather than being trusted for having come from a host that
+ * passed.
+ *
+ * Identical in shape to the Python SDK's `standin.fetch`.
+ */
+import { lookup } from "node:dns/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+function ipv4ToInt(ip) {
+    return (ip.split(".").reduce((acc, octet) => (acc << 8) + Number(octet), 0) >>> 0);
+}
+function inCidr4(ip, base, maskBits) {
+    const mask = maskBits === 0 ? 0 : (~0 << (32 - maskBits)) >>> 0;
+    return (ip & mask) === (ipv4ToInt(base) & mask);
+}
+/** True for any IPv4 address that must never be fetched server-side. */
+export function isForbiddenIpv4(ip) {
+    const n = ipv4ToInt(ip);
+    return (inCidr4(n, "0.0.0.0", 8) || // "this" network
+        inCidr4(n, "10.0.0.0", 8) || // RFC1918
+        inCidr4(n, "100.64.0.0", 10) || // carrier-grade NAT
+        inCidr4(n, "127.0.0.0", 8) || // loopback
+        inCidr4(n, "169.254.0.0", 16) || // link-local, including cloud metadata
+        inCidr4(n, "172.16.0.0", 12) || // RFC1918
+        inCidr4(n, "192.0.0.0", 24) || // IETF protocol assignments
+        inCidr4(n, "192.168.0.0", 16) || // RFC1918
+        inCidr4(n, "198.18.0.0", 15) || // benchmarking
+        inCidr4(n, "224.0.0.0", 3) // multicast, reserved and broadcast
+    );
+}
+/** True for any IPv6 address that must never be fetched server-side. */
+export function isForbiddenIpv6(ip) {
+    const lower = ip.toLowerCase();
+    // A v4 address wearing a v6 spelling is still that v4 address, so judge what
+    // it embeds. Otherwise the whole v4 table above is one notation away from
+    // being bypassed.
+    if (lower.startsWith("::ffff:") || lower.startsWith("64:ff9b:")) {
+        const dotted = lower.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+        if (dotted?.[1])
+            return isForbiddenIpv4(dotted[1]);
+        const groups = (lower.split("::").pop() ?? "").split(":").filter(Boolean);
+        if (groups.length <= 2) {
+            const hi = groups.length === 2 ? parseInt(groups[0] ?? "0", 16) : 0;
+            const lo = parseInt(groups[groups.length - 1] ?? "0", 16) || 0;
+            return isForbiddenIpv4(`${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`);
+        }
+        return true; // a malformed mapped form: refuse rather than guess
+    }
+    if (lower === "::" || lower === "::1")
+        return true;
+    const firstGroup = lower.split(":")[0] || "0";
+    const first16 = parseInt(firstGroup === "" ? "0" : firstGroup, 16);
+    if ((first16 & 0xfe00) === 0xfc00)
+        return true; // fc00::/7 unique-local
+    if ((first16 & 0xffc0) === 0xfe80)
+        return true; // fe80::/10 link-local
+    return false;
+}
+/**
+ * True for any address that must never be fetched server-side.
+ *
+ * Unparseable input is forbidden too: something that is not an address cannot be
+ * proven safe, and failing closed is the only correct direction here.
+ */
+export function isForbiddenIp(ip) {
+    const family = isIP(ip);
+    if (family === 4)
+        return isForbiddenIpv4(ip);
+    if (family === 6)
+        return isForbiddenIpv6(ip);
+    return true;
+}
+/**
+ * Check a URL is safe to fetch, or throw saying why.
+ *
+ * http and https only, no embedded credentials, and every address the host
+ * resolves to must be public.
+ */
+export async function assertPublicHttpUrl(raw, lookupFn = lookup, isForbiddenFn = isForbiddenIp) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error("not a valid URL");
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new Error(`forbidden protocol ${url.protocol}`);
+    }
+    if (url.username || url.password) {
+        throw new Error("URLs with embedded credentials are not allowed");
+    }
+    // The WHATWG URL keeps the brackets on an IPv6 literal, which isIP rejects.
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    if (isIP(host)) {
+        if (isForbiddenFn(host))
+            throw new Error(`address ${host} is private or reserved`);
+        return url;
+    }
+    let addrs;
+    try {
+        addrs = await lookupFn(host, { all: true, verbatim: true });
+    }
+    catch {
+        throw new Error(`cannot resolve host ${host}`);
+    }
+    if (addrs.length === 0)
+        throw new Error(`host ${host} resolves to no addresses`);
+    for (const addr of addrs) {
+        if (isForbiddenFn(addr.address)) {
+            throw new Error(`host ${host} resolves to private or reserved address ${addr.address}`);
+        }
+    }
+    return url;
+}
+/**
+ * Fetch an image from an untrusted URL.
+ *
+ * Bounded in every direction that matters: total time, declared length, streamed
+ * length, and one redirect hop. Throws for anything that fails, so a caller can
+ * hand the reason straight back to the agent that supplied the URL.
+ */
+export async function fetchPublicImage(rawUrl, maxBytes, timeoutMs = 10_000, lookupFn = lookup, isForbiddenFn = isForbiddenIp, redirectsLeft = 1) {
+    const url = await assertPublicHttpUrl(rawUrl, lookupFn, isForbiddenFn);
+    // The HTTP stack calls this to resolve the host, so an answer that was public
+    // during validation and private a moment later is refused here rather than
+    // quietly connecting to something internal.
+    const guardedLookup = (hostname, options, cb) => {
+        lookupFn(hostname, { all: true, verbatim: true }).then((addrs) => {
+            const bad = addrs.find((a) => isForbiddenFn(a.address));
+            if (bad || addrs.length === 0) {
+                cb(new Error(`DNS rebind blocked: ${hostname} resolved to ${bad?.address ?? "nothing"}`), null);
+                return;
+            }
+            if (options.all) {
+                cb(null, addrs);
+                return;
+            }
+            const first = addrs[0];
+            if (first === undefined) {
+                cb(new Error(`${hostname} resolved to nothing`), null);
+                return;
+            }
+            cb(null, first.address, first.family);
+        }, (err) => cb(err, null));
+    };
+    return new Promise((resolve, reject) => {
+        const req = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, 
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        { lookup: guardedLookup, headers: { accept: "image/*" } }, (res) => {
+            if (REDIRECT_STATUSES.has(res.statusCode ?? 0)) {
+                const location = res.headers.location;
+                res.resume();
+                if (!location) {
+                    reject(new Error(`fetch ${rawUrl} returned HTTP ${res.statusCode} with no Location`));
+                    return;
+                }
+                if (redirectsLeft <= 0) {
+                    reject(new Error(`fetch ${rawUrl} followed too many redirects`));
+                    return;
+                }
+                let next;
+                try {
+                    next = new URL(location, url).toString();
+                }
+                catch {
+                    reject(new Error(`fetch ${rawUrl} returned an invalid redirect location`));
+                    return;
+                }
+                // Resolved against the CURRENT url, then put through the whole guard
+                // again. A target is not trustworthy for having been named by a host
+                // that passed.
+                fetchPublicImage(next, maxBytes, timeoutMs, lookupFn, isForbiddenFn, redirectsLeft - 1).then(resolve, reject);
+                return;
+            }
+            if (res.statusCode !== 200) {
+                res.resume();
+                reject(new Error(`fetch ${rawUrl} returned HTTP ${res.statusCode}`));
+                return;
+            }
+            const declared = Number(res.headers["content-length"] ?? NaN);
+            if (Number.isFinite(declared) && declared > maxBytes) {
+                res.destroy();
+                reject(new Error(`response too large (${declared} bytes, max ${maxBytes})`));
+                return;
+            }
+            const mime = (res.headers["content-type"] ?? "image/jpeg").split(";")[0]?.trim() ??
+                "image/jpeg";
+            const chunks = [];
+            let total = 0;
+            res.on("data", (chunk) => {
+                // The declared length is a claim, not a promise. Counting what
+                // actually arrives is what bounds a lying or chunked response.
+                total += chunk.length;
+                if (total > maxBytes) {
+                    res.destroy();
+                    reject(new Error(`response exceeded ${maxBytes} bytes; aborting read`));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            res.on("end", () => resolve({ bytes: Buffer.concat(chunks), mime }));
+            res.on("error", reject);
+        });
+        // A hard total deadline: the socket's own timeout option is only an idle
+        // timer, so a slow drip would never trip it.
+        const deadline = setTimeout(() => req.destroy(new Error(`fetch ${rawUrl} timed out after ${timeoutMs}ms`)), timeoutMs);
+        deadline.unref?.();
+        req.on("error", (err) => {
+            clearTimeout(deadline);
+            reject(err);
+        });
+        req.on("close", () => clearTimeout(deadline));
+        req.end();
+    });
+}
+//# sourceMappingURL=fetch.js.map

package/dist/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,+BAA+B;AAE/B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAWhC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7D,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,CACL,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,EAAU,EAAE,IAAY,EAAE,QAAgB;IACzD,MAAM,IAAI,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,MAAM,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACxB,OAAO,CACL,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,iBAAiB;QAC7C,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,UAAU;QACvC,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,oBAAoB;QACpD,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,WAAW;QACzC,OAAO,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,uCAAuC;QACxE,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,UAAU;QAC1C,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,4BAA4B;QAC3D,OAAO,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,UAAU;QAC3C,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,eAAe;QAC/C,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,oCAAoC;KAChE,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/B,6EAA6E;IAC7E,0EAA0E;IAC1E,kBAAkB;IAClB,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACpE,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/D,OAAO,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACnE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACxE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAW,EACX,WAAqB,MAAkB,EACvC,gBAA+B,aAAa;IAE5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,4EAA4E;IAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,IAAI,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,yBAAyB,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAiD,CAAC;IACtD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,2BAA2B,CAAC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,QAAQ,IAAI,4CAA4C,IAAI,CAAC,OAAO,EAAE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,QAAgB,EAChB,SAAS,GAAG,MAAM,EAClB,WAAqB,MAAkB,EACvC,gBAA+B,aAAa,EAC5C,aAAa,GAAG,CAAC;IAEjB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEvE,8EAA8E;IAC9E,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,aAAa,GAAG,CACpB,QAAgB,EAChB,OAA0B,EAC1B,EAIS,EACH,EAAE;QACR,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACxD,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,EAAE,CACA,IAAI,KAAK,CACP,uBAAuB,QAAQ,gBAAgB,GAAG,EAAE,OAAO,IAAI,SAAS,EAAE,CAC3E,EACD,IAAa,CACd,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,QAAQ,sBAAsB,CAAC,EAAE,IAAa,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YACD,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,EACD,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,GAA4B,EAAE,IAAa,CAAC,CACzD,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAClE,GAAG;QACH,8DAA8D;QAC9D,EAAE,MAAM,EAAE,aAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAChE,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACtC,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,CACJ,IAAI,KAAK,CACP,SAAS,MAAM,kBAAkB,GAAG,CAAC,UAAU,mBAAmB,CACnE,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;oBACvB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,MAAM,8BAA8B,CAAC,CAAC,CAAC;oBACjE,OAAO;gBACT,CAAC;gBACD,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CACJ,IAAI,KAAK,CACP,SAAS,MAAM,wCAAwC,CACxD,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,qEAAqE;gBACrE,qEAAqE;gBACrE,eAAe;gBACf,gBAAgB,CACd,IAAI,EACJ,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,aAAa,EACb,aAAa,GAAG,CAAC,CAClB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,MAAM,kBAAkB,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;YAC9D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBACrD,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CACJ,IAAI,KAAK,CACP,uBAAuB,QAAQ,eAAe,QAAQ,GAAG,CAC1D,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GACR,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;gBACnE,YAAY,CAAC;YACf,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,+DAA+D;gBAC/D,+DAA+D;gBAC/D,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBACtB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACrB,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,CACJ,IAAI,KAAK,CAAC,qBAAqB,QAAQ,uBAAuB,CAAC,CAChE,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CACF,CAAC;QACF,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,UAAU,CACzB,GAAG,EAAE,CACH,GAAG,CAAC,OAAO,CACT,IAAI,KAAK,CAAC,SAAS,MAAM,oBAAoB,SAAS,IAAI,CAAC,CAC5D,EACH,SAAS,CACV,CAAC;QACF,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/gate.d.ts

@@ -0,0 +1,80 @@
+/**
+ * True when the utterance, AS A WHOLE, is a verbal interrupt.
+ *
+ * Deterministic and conservative: lowercase, punctuation stripped, surrounding
+ * filler AND the configured wake phrases removed - "hey <name>, stop" must cut as
+ * instantly as a bare "stop", because addressing the bot by name is how people
+ * interrupt it in a meeting - then an exact phrase-set match capped at four
+ * words. A longer sentence that merely contains "stop" does not match.
+ */
+export declare const DEFAULT_FOLLOW_UP_WINDOW_MS = 12000;
+/**
+ * Is this call attached to a Microsoft Teams meeting or channel thread?
+ *
+ * The group signal that actually arrives. The participant count that used to
+ * carry this does not reach a bot that joined through the meeting, so a gate
+ * keyed on it alone never fires.
+ */
+export declare function isMeetingThread(threadId: string | undefined): boolean;
+/** The outcome for one finished caller turn. */
+export interface GateDecision {
+    /** Speak an answer to this turn. */
+    readonly respond: boolean;
+    /**
+     * The turn named the assistant. Opens the follow-up window, and is worth
+     * knowing separately from `respond`: a turn inside the window is answered
+     * without having been addressed.
+     */
+    readonly addressed: boolean;
+}
+/**
+ * Case-insensitive, word-boundary match of any wake phrase.
+ *
+ * Boundaries rather than substrings, so "assistant" matches and "assistants"
+ * does not. The boundary is expressed as "not a word character" so a non-Latin
+ * wake phrase behaves the same as a Latin one. An empty phrase list never
+ * matches.
+ */
+export declare function isAddressed(transcript: string, wakePhrases: readonly string[]): boolean;
+/** Options for {@link GroupGate}. */
+export interface GroupGateOptions {
+    wakePhrases: readonly string[];
+    requireAddress?: boolean;
+    followUpWindowMs?: number;
+    threadId?: string;
+}
+/**
+ * The group-call gate for one call. Holds the follow-up window's state.
+ *
+ * An agent in a meeting that answers every sentence is worse than one that says
+ * nothing. The gate keeps it quiet until somebody names it, then leaves the
+ * floor open for a short while so a follow-up does not need the name again.
+ */
+export declare class GroupGate {
+    #private;
+    readonly wakePhrases: readonly string[];
+    readonly requireAddress: boolean;
+    readonly followUpWindowMs: number;
+    constructor(options: GroupGateOptions);
+    /** More than one human on this call, by either signal. */
+    get isGroup(): boolean;
+    /**
+     * Is the gate actually muting anything right now?
+     *
+     * A gate with no wake phrase configured can never be opened, so it would mute
+     * the assistant for the whole call. Treat "no trigger configured" as gate off.
+     */
+    get active(): boolean;
+    /**
+     * Record a participant count from call context.
+     *
+     * Corroborating, never authoritative: a count that says 1 does not clear a
+     * meeting thread. The count is the signal that goes missing, so it may add
+     * certainty and must not remove it.
+     */
+    noteParticipants(count: number): void;
+    /** Answer this turn, or stay out of the meeting? */
+    decide(transcript: string, nowMs: number): GateDecision;
+}
+export declare function isVerbalInterrupt(text: string | undefined, wakePhrases?: string[]): boolean;
+//# sourceMappingURL=gate.d.ts.map

package/dist/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAoHA;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAQlD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAErE;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAgBT;AAED,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,qBAAa,SAAS;;IACpB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAKtB,OAAO,EAAE,gBAAgB;IAQrC,0DAA0D;IAC1D,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,OAAO,CAMpB;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIrC,oDAAoD;IACpD,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY;CAexD;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,OAAO,CAiCT"}

package/dist/gate.js

@@ -0,0 +1,249 @@
+// Copyright (c) 2026 Komaa DigiTech
+// SPDX-License-Identifier: MIT
+/**
+ * Deterministic verbal interrupts: "stop", "hold on", "never mind".
+ *
+ * These are handled in code rather than left to the model because the model is
+ * mid-generation when they arrive. Waiting for its own interruption handling is
+ * what makes a cut feel late; matching the phrase ourselves and flushing the
+ * caller's playback queue is what makes it feel instant.
+ *
+ * Matching is WHOLE-UTTERANCE only, after stripping filler and the configured
+ * wake phrases, so "stop by the store on your way" never triggers.
+ */
+/** Normalized utterances that mean "stop talking / hold on". */
+const INTERRUPT_PHRASES = new Set([
+    "stop",
+    "stop it",
+    "stop talking",
+    "wait",
+    "wait wait",
+    "wait a second",
+    "wait a minute",
+    "hold on",
+    "hang on",
+    "never mind",
+    "nevermind",
+    "be quiet",
+    "quiet",
+    "shut up",
+    "enough",
+    "thats enough",
+    "pause",
+    "one second",
+    "one sec",
+    "give me a second",
+    // Arabic: the deterministic cut has to work in both call languages, because the
+    // model mirrors the caller's. Whole-utterance matching plus the normalizer's
+    // tashkeel stripping keep these as conservative as the English set.
+    "توقف", // stop
+    "قف", // halt
+    "اسكت", // be quiet
+    "اصمت", // silence
+    "انتظر", // wait
+    "انتظر لحظة", // wait a moment
+    "استنى", // wait (colloquial)
+    "استنا",
+    "لحظة", // one moment
+    "لحظه",
+    "لحظة واحدة", // just a moment
+    "ثانية", // one second
+    "ثانيه",
+    "ثانية واحدة",
+    "دقيقة", // one minute
+    "دقيقه",
+    "مهلا", // hold on
+    "خلاص", // enough / that is it
+    "كفى", // enough
+    "كفاية",
+    "كفايه",
+    "بس", // enough/stop (colloquial; safe only because matching is whole-utterance)
+]);
+/**
+ * Leading and trailing filler stripped before matching ("ok stop", "no wait",
+ * "stop please"; Arabic "طيب توقف" = "ok stop", "يا" = the vocative that precedes
+ * a name).
+ */
+const FILLER_TOKENS = new Set([
+    "ok",
+    "okay",
+    "oh",
+    "no",
+    "hey",
+    "please",
+    "now",
+    "طيب",
+    "لا",
+    "يا",
+]);
+function normalizeWords(text) {
+    return ((text ?? "")
+        .toLowerCase()
+        .replace(/['’]/g, "") // "that's" -> "thats", not "that s"
+        // Combining marks (Arabic tashkeel, accents) and the Arabic tatweel attach
+        // INSIDE a word - delete them outright so "تَوَقَّف" normalizes to "توقف"
+        // instead of splitting apart.
+        .replace(/[\p{M}ـ]/gu, "")
+        // Letters in ANY script survive: an Arabic "توقف" must cut as instantly as
+        // "stop". Everything else separates words.
+        .replace(/[^\p{L}\s]/gu, " ")
+        .split(/\s+/)
+        .filter(Boolean));
+}
+function startsWithSeq(words, seq) {
+    return (seq.length > 0 &&
+        seq.length <= words.length &&
+        seq.every((w, i) => words[i] === w));
+}
+function endsWithSeq(words, seq) {
+    const offset = words.length - seq.length;
+    return (seq.length > 0 &&
+        offset >= 0 &&
+        seq.every((w, i) => words[offset + i] === w));
+}
+/**
+ * True when the utterance, AS A WHOLE, is a verbal interrupt.
+ *
+ * Deterministic and conservative: lowercase, punctuation stripped, surrounding
+ * filler AND the configured wake phrases removed - "hey <name>, stop" must cut as
+ * instantly as a bare "stop", because addressing the bot by name is how people
+ * interrupt it in a meeting - then an exact phrase-set match capped at four
+ * words. A longer sentence that merely contains "stop" does not match.
+ */
+export const DEFAULT_FOLLOW_UP_WINDOW_MS = 12_000;
+/**
+ * Microsoft's thread-id prefix for a meeting or channel conversation. A 1:1 call
+ * has no such thread at all, so the presence of one is the signal.
+ */
+const MEETING_THREAD_PREFIX = "19:";
+/**
+ * Is this call attached to a Microsoft Teams meeting or channel thread?
+ *
+ * The group signal that actually arrives. The participant count that used to
+ * carry this does not reach a bot that joined through the meeting, so a gate
+ * keyed on it alone never fires.
+ */
+export function isMeetingThread(threadId) {
+    return (threadId ?? "").trim().startsWith(MEETING_THREAD_PREFIX);
+}
+/**
+ * Case-insensitive, word-boundary match of any wake phrase.
+ *
+ * Boundaries rather than substrings, so "assistant" matches and "assistants"
+ * does not. The boundary is expressed as "not a word character" so a non-Latin
+ * wake phrase behaves the same as a Latin one. An empty phrase list never
+ * matches.
+ */
+export function isAddressed(transcript, wakePhrases) {
+    if (!transcript || wakePhrases.length === 0)
+        return false;
+    const lowered = transcript.toLowerCase();
+    for (const raw of wakePhrases) {
+        const phrase = raw.trim().toLowerCase();
+        if (phrase === "")
+            continue;
+        const escaped = phrase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        if (new RegExp(`(?<![\\p{L}\\p{N}_])${escaped}(?![\\p{L}\\p{N}_])`, "u").test(lowered)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * The group-call gate for one call. Holds the follow-up window's state.
+ *
+ * An agent in a meeting that answers every sentence is worse than one that says
+ * nothing. The gate keeps it quiet until somebody names it, then leaves the
+ * floor open for a short while so a follow-up does not need the name again.
+ */
+export class GroupGate {
+    wakePhrases;
+    requireAddress;
+    followUpWindowMs;
+    #meetingThread;
+    #humanCount = 0;
+    #lastAddressedMs;
+    constructor(options) {
+        this.wakePhrases = options.wakePhrases;
+        this.requireAddress = options.requireAddress ?? true;
+        this.followUpWindowMs =
+            options.followUpWindowMs ?? DEFAULT_FOLLOW_UP_WINDOW_MS;
+        this.#meetingThread = isMeetingThread(options.threadId);
+    }
+    /** More than one human on this call, by either signal. */
+    get isGroup() {
+        return this.#meetingThread || this.#humanCount >= 2;
+    }
+    /**
+     * Is the gate actually muting anything right now?
+     *
+     * A gate with no wake phrase configured can never be opened, so it would mute
+     * the assistant for the whole call. Treat "no trigger configured" as gate off.
+     */
+    get active() {
+        return (this.isGroup &&
+            this.requireAddress &&
+            this.wakePhrases.some((p) => p.trim() !== ""));
+    }
+    /**
+     * Record a participant count from call context.
+     *
+     * Corroborating, never authoritative: a count that says 1 does not clear a
+     * meeting thread. The count is the signal that goes missing, so it may add
+     * certainty and must not remove it.
+     */
+    noteParticipants(count) {
+        this.#humanCount = Math.max(this.#humanCount, count);
+    }
+    /** Answer this turn, or stay out of the meeting? */
+    decide(transcript, nowMs) {
+        const addressed = isAddressed(transcript, this.wakePhrases);
+        if (!this.active)
+            return { respond: true, addressed };
+        if (addressed) {
+            this.#lastAddressedMs = nowMs;
+            return { respond: true, addressed: true };
+        }
+        if (this.#lastAddressedMs !== undefined &&
+            nowMs - this.#lastAddressedMs <= this.followUpWindowMs) {
+            return { respond: true, addressed: false };
+        }
+        return { respond: false, addressed: false };
+    }
+}
+export function isVerbalInterrupt(text, wakePhrases) {
+    let core = normalizeWords(text);
+    const wake = (wakePhrases ?? [])
+        .map(normalizeWords)
+        .filter((seq) => seq.length > 0);
+    // Strip surrounding filler and wake tokens until stable - they interleave
+    // ("ok <name> please stop").
+    let changed = true;
+    while (changed && core.length > 0) {
+        changed = false;
+        while (core.length > 0 && FILLER_TOKENS.has(core[0] ?? "")) {
+            core.shift();
+            changed = true;
+        }
+        while (core.length > 0 && FILLER_TOKENS.has(core[core.length - 1] ?? "")) {
+            core.pop();
+            changed = true;
+        }
+        for (const seq of wake) {
+            if (startsWithSeq(core, seq)) {
+                core = core.slice(seq.length);
+                changed = true;
+            }
+            else if (endsWithSeq(core, seq)) {
+                core = core.slice(0, core.length - seq.length);
+                changed = true;
+            }
+        }
+    }
+    // The wake word alone ("<name>?") is an address, not an interrupt.
+    if (core.length === 0 || core.length > 4) {
+        return false;
+    }
+    return INTERRUPT_PHRASES.has(core.join(" "));
+}
+//# sourceMappingURL=gate.js.map

package/dist/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,+BAA+B;AAE/B;;;;;;;;;;GAUG;AAEH,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,SAAS;IACT,cAAc;IACd,MAAM;IACN,WAAW;IACX,eAAe;IACf,eAAe;IACf,SAAS;IACT,SAAS;IACT,YAAY;IACZ,WAAW;IACX,UAAU;IACV,OAAO;IACP,SAAS;IACT,QAAQ;IACR,cAAc;IACd,OAAO;IACP,YAAY;IACZ,SAAS;IACT,kBAAkB;IAClB,gFAAgF;IAChF,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,OAAO;IAChB,YAAY,EAAE,gBAAgB;IAC9B,OAAO,EAAE,oBAAoB;IAC7B,OAAO;IACP,MAAM,EAAE,aAAa;IACrB,MAAM;IACN,YAAY,EAAE,gBAAgB;IAC9B,OAAO,EAAE,aAAa;IACtB,OAAO;IACP,aAAa;IACb,OAAO,EAAE,aAAa;IACtB,OAAO;IACP,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,sBAAsB;IAC9B,KAAK,EAAE,SAAS;IAChB,OAAO;IACP,OAAO;IACP,IAAI,EAAE,0EAA0E;CACjF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,QAAQ;IACR,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;CACL,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,IAAwB;IAC9C,OAAO,CACL,CAAC,IAAI,IAAI,EAAE,CAAC;SACT,WAAW,EAAE;SACb,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,oCAAoC;QAC1D,2EAA2E;QAC3E,0EAA0E;QAC1E,8BAA8B;SAC7B,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC1B,2EAA2E;QAC3E,2CAA2C;SAC1C,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,GAAa;IACnD,OAAO,CACL,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;QAC1B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAe,EAAE,GAAa;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IACzC,OAAO,CACL,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,MAAM,IAAI,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;GAGG;AACH,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,QAA4B;IAC1D,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AACnE,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,UAAkB,EAClB,WAA8B;IAE9B,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,MAAM,KAAK,EAAE;YAAE,SAAS;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC9D,IACE,IAAI,MAAM,CAAC,uBAAuB,OAAO,qBAAqB,EAAE,GAAG,CAAC,CAAC,IAAI,CACvE,OAAO,CACR,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,OAAO,SAAS;IACX,WAAW,CAAoB;IAC/B,cAAc,CAAU;IACxB,gBAAgB,CAAS;IACzB,cAAc,CAAU;IACjC,WAAW,GAAG,CAAC,CAAC;IAChB,gBAAgB,CAAqB;IAErC,YAAY,OAAyB;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,gBAAgB;YACnB,OAAO,CAAC,gBAAgB,IAAI,2BAA2B,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,0DAA0D;IAC1D,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,CACL,IAAI,CAAC,OAAO;YACZ,IAAI,CAAC,cAAc;YACnB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAa;QAC5B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,oDAAoD;IACpD,MAAM,CAAC,UAAkB,EAAE,KAAa;QACtC,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QACD,IACE,IAAI,CAAC,gBAAgB,KAAK,SAAS;YACnC,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,EACtD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAwB,EACxB,WAAsB;IAEtB,IAAI,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;SAC7B,GAAG,CAAC,cAAc,CAAC;SACnB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,0EAA0E;IAC1E,6BAA6B;IAC7B,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,KAAK,CAAC;QAChB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBAClC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC"}