@microsoft/agents-hosting 1.6.1 → 1.7.0-beta.1.g8bcd4f11a7

package/dist/src/auth/sidecar/sidecarHttpClient.js

@@ -0,0 +1,406 @@
+"use strict";
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SidecarHttpClient = void 0;
+const node_net_1 = require("node:net");
+const agents_telemetry_1 = require("@microsoft/agents-telemetry");
+const agents_activity_1 = require("@microsoft/agents-activity");
+const errorHelper_1 = require("../../errorHelper");
+const sidecarModels_1 = require("./sidecarModels");
+const logger = (0, agents_telemetry_1.debug)('agents:sidecar');
+const DEFAULT_RETRY_BACKOFF_BASE_MS = 2000;
+/**
+ * Reusable HTTP client for communicating with the Microsoft Entra Agent ID sidecar (agent container).
+ * Handles URL construction, query parameter building, response parsing, retry, and SSRF-safe base
+ * URL validation. Uses the native `fetch` API (Node.js 20+).
+ */
+class SidecarHttpClient {
+    /**
+     * Creates a new {@link SidecarHttpClient}.
+     * @param baseUrl The resolved (and validated) sidecar base URL.
+     * @param timeoutMs Per-attempt request timeout in milliseconds.
+     * @param retryCount Number of retry attempts for transient failures (0 disables retries).
+     * @param retryBackoffBaseMs Base delay for exponential backoff; primarily a test seam.
+     */
+    constructor(baseUrl, timeoutMs = SidecarHttpClient.DEFAULT_TIMEOUT_MS, retryCount = SidecarHttpClient.DEFAULT_RETRY_COUNT, retryBackoffBaseMs = DEFAULT_RETRY_BACKOFF_BASE_MS) {
+        this._baseUrl = SidecarHttpClient.stripTrailingSlashes(baseUrl !== null && baseUrl !== void 0 ? baseUrl : SidecarHttpClient.resolveBaseUrl());
+        this._timeoutMs = Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : SidecarHttpClient.DEFAULT_TIMEOUT_MS;
+        this._retryCount = Number.isFinite(retryCount) ? Math.max(0, Math.floor(retryCount)) : SidecarHttpClient.DEFAULT_RETRY_COUNT;
+        this._retryBackoffBaseMs = Number.isFinite(retryBackoffBaseMs) && retryBackoffBaseMs >= 0 ? retryBackoffBaseMs : DEFAULT_RETRY_BACKOFF_BASE_MS;
+    }
+    /**
+     * Removes any trailing `/` characters from `value` using a linear scan. Avoids a regular
+     * expression so untrusted input with many `/` characters cannot trigger super-linear
+     * backtracking (ReDoS).
+     * @param value The string to trim.
+     * @returns `value` without trailing slashes.
+     */
+    static stripTrailingSlashes(value) {
+        let end = value.length;
+        while (end > 0 && value.charCodeAt(end - 1) === 47 /* '/' */) {
+            end--;
+        }
+        return end === value.length ? value : value.slice(0, end);
+    }
+    /**
+     * Resolves the sidecar base URL. Resolution order: `SIDECAR_URL` environment variable >
+     * `configuredUrl` > {@link DEFAULT_SIDECAR_BASE_URL}. Empty/whitespace values are treated as unset.
+     * @param configuredUrl The optional base URL from configuration.
+     * @returns The resolved base URL.
+     */
+    static resolveBaseUrl(configuredUrl) {
+        const envUrl = process.env.SIDECAR_URL;
+        if (envUrl && envUrl.trim()) {
+            return envUrl.trim();
+        }
+        return configuredUrl && configuredUrl.trim() ? configuredUrl.trim() : sidecarModels_1.DEFAULT_SIDECAR_BASE_URL;
+    }
+    /**
+     * Returns a copy of `raw` with any userinfo (credentials) removed, safe to include in logs and
+     * error messages. Falls back to a regex strip when `raw` is not a parseable URL.
+     */
+    static redactUrl(raw) {
+        try {
+            const u = new URL(raw);
+            if (u.username || u.password) {
+                u.username = '';
+                u.password = '';
+            }
+            return u.toString();
+        }
+        catch {
+            return raw.replace(/\/\/[^/@]*@/, '//');
+        }
+    }
+    /**
+     * Validates that the resolved sidecar base URL is safe to call. The URL must be a well-formed
+     * absolute http/https URL without userinfo. Unless `bypassLocalNetworkRestriction` is set, the host
+     * must also be a loopback address or a private network address (RFC 1918 / RFC 4193 / link-local) to
+     * avoid sending agent credentials off-box (SSRF safety).
+     * @param resolvedUrl The resolved sidecar base URL.
+     * @param bypassLocalNetworkRestriction Skip the loopback/private-address check (UNSAFE).
+     * @throws When the URL is malformed or points to a disallowed address.
+     */
+    static validateBaseUrl(resolvedUrl, bypassLocalNetworkRestriction) {
+        let uri;
+        try {
+            uri = new URL(resolvedUrl);
+        }
+        catch {
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.SidecarBaseUrlInvalid, undefined, { url: SidecarHttpClient.redactUrl(resolvedUrl) });
+        }
+        if (uri.protocol !== 'http:' && uri.protocol !== 'https:') {
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.SidecarBaseUrlInsecureScheme, undefined, { url: SidecarHttpClient.redactUrl(resolvedUrl) });
+        }
+        if (uri.username || uri.password) {
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.SidecarBaseUrlUserInfo, undefined, { url: SidecarHttpClient.redactUrl(resolvedUrl) });
+        }
+        if (bypassLocalNetworkRestriction) {
+            return;
+        }
+        if (SidecarHttpClient.isLoopbackOrPrivateHost(uri.hostname)) {
+            return;
+        }
+        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.SidecarBaseUrlNotLocal, undefined, { url: SidecarHttpClient.redactUrl(resolvedUrl) });
+    }
+    static isLoopbackOrPrivateHost(host) {
+        // URL.hostname wraps IPv6 literals in brackets (e.g. "[::1]"); strip them before classification.
+        const normalized = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+        const ipVersion = (0, node_net_1.isIP)(normalized);
+        if (ipVersion === 0) {
+            // DNS host: only "localhost" (and subdomains) is treated as safe.
+            const lower = normalized.toLowerCase();
+            return lower === 'localhost' || lower.endsWith('.localhost');
+        }
+        if (ipVersion === 4) {
+            return SidecarHttpClient.isPrivateOrLoopbackIPv4(normalized);
+        }
+        return SidecarHttpClient.isPrivateOrLoopbackIPv6(normalized);
+    }
+    static isPrivateOrLoopbackIPv4(host) {
+        const b = host.split('.').map((p) => parseInt(p, 10));
+        if (b.length !== 4 || b.some((n) => Number.isNaN(n) || n < 0 || n > 255)) {
+            return false;
+        }
+        if (b[0] === 127)
+            return true; // 127.0.0.0/8 loopback
+        if (b[0] === 10)
+            return true; // 10.0.0.0/8
+        if (b[0] === 172 && b[1] >= 16 && b[1] <= 31)
+            return true; // 172.16.0.0/12
+        if (b[0] === 192 && b[1] === 168)
+            return true; // 192.168.0.0/16
+        if (b[0] === 169 && b[1] === 254)
+            return true; // 169.254.0.0/16 link-local
+        return false;
+    }
+    static isPrivateOrLoopbackIPv6(host) {
+        const lower = host.toLowerCase();
+        if (lower === '::1' || lower === '0:0:0:0:0:0:0:1')
+            return true; // loopback (`::` is the unspecified address, not loopback)
+        // IPv4-mapped/-translated addresses in either dotted (::ffff:127.0.0.1)
+        // or hex-compressed (::ffff:7f00:1) form.
+        const mappedIPv4 = SidecarHttpClient.extractMappedIPv4(lower);
+        if (mappedIPv4) {
+            return SidecarHttpClient.isPrivateOrLoopbackIPv4(mappedIPv4);
+        }
+        const firstHextet = parseInt(lower.split(':')[0], 16);
+        if (!Number.isNaN(firstHextet)) {
+            if ((firstHextet & 0xfe00) === 0xfc00)
+                return true; // fc00::/7 unique local
+            if ((firstHextet & 0xffc0) === 0xfe80)
+                return true; // fe80::/10 link-local
+            if ((firstHextet & 0xffc0) === 0xfec0)
+                return true; // fec0::/10 site-local (deprecated)
+        }
+        return false;
+    }
+    /**
+     * Extracts the embedded IPv4 address from an IPv4-mapped/-translated IPv6 literal, returning it
+     * in dotted-quad form, or `undefined` if `host` is not such an address. Handles both the dotted
+     * form (`::ffff:127.0.0.1`) and the hex-compressed form Node emits (`::ffff:7f00:1`).
+     */
+    static extractMappedIPv4(host) {
+        const dotted = host.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+        if (dotted) {
+            return dotted[1];
+        }
+        const hex = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+        if (hex) {
+            const high = parseInt(hex[1], 16);
+            const low = parseInt(hex[2], 16);
+            return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+        }
+        return undefined;
+    }
+    /**
+     * Calls `GET /AuthorizationHeaderUnauthenticated/{serviceName}` with the specified options.
+     * @param serviceName The sidecar downstream API name.
+     * @param options The request options used to build the query string.
+     * @param signal Optional abort signal supplied by the caller.
+     * @returns The parsed token result.
+     */
+    async getAuthorizationHeaderUnauthenticated(serviceName, options, signal) {
+        const url = this.buildUrl(`/AuthorizationHeaderUnauthenticated/${encodeURIComponent(serviceName)}`, options);
+        return this.sendAndParse(url, signal);
+    }
+    /**
+     * Checks sidecar health via `GET /healthz`.
+     * @returns `true` when the sidecar responds with a success status, `false` otherwise.
+     */
+    async isHealthy() {
+        try {
+            const response = await this.fetchWithTimeout(`${this._baseUrl}/healthz`);
+            return response.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    buildUrl(path, options) {
+        const url = `${this._baseUrl}${path}`;
+        if (!options) {
+            return url;
+        }
+        // AgentUsername (UPN) and AgentUserId (object id) are mutually exclusive per the sidecar contract.
+        if (options.agentUsername && options.agentUserId) {
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.SidecarUserIdentityMutuallyExclusive);
+        }
+        const params = new URLSearchParams();
+        if (options.agentIdentity) {
+            params.append('AgentIdentity', options.agentIdentity);
+        }
+        if (options.agentUsername) {
+            params.append('AgentUsername', options.agentUsername);
+        }
+        if (options.agentUserId) {
+            params.append('AgentUserId', options.agentUserId);
+        }
+        if (options.scopes) {
+            for (const scope of options.scopes) {
+                if (scope && scope.trim()) {
+                    params.append('optionsOverride.Scopes', scope);
+                }
+            }
+        }
+        if (options.requestAppToken === true) {
+            params.append('optionsOverride.RequestAppToken', 'true');
+        }
+        if (options.tenant) {
+            params.append('optionsOverride.AcquireTokenOptions.Tenant', options.tenant);
+        }
+        if (options.forceRefresh === true) {
+            params.append('optionsOverride.AcquireTokenOptions.ForceRefresh', 'true');
+        }
+        const query = params.toString();
+        return query ? `${url}?${query}` : url;
+    }
+    async withTimeout(signal, op) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this._timeoutMs);
+        const onAbort = () => controller.abort();
+        if (signal) {
+            if (signal.aborted) {
+                controller.abort();
+            }
+            else {
+                signal.addEventListener('abort', onAbort, { once: true });
+            }
+        }
+        try {
+            return await op(controller.signal);
+        }
+        finally {
+            clearTimeout(timer);
+            signal === null || signal === void 0 ? void 0 : signal.removeEventListener('abort', onAbort);
+        }
+    }
+    async fetchWithTimeout(url, signal) {
+        return this.withTimeout(signal, (innerSignal) => fetch(url, { method: 'GET', signal: innerSignal }));
+    }
+    /**
+     * Performs the request and reads the full response body within a single timeout window, so a
+     * sidecar that streams response headers and then stalls the body cannot hang token acquisition
+     * beyond `requestTimeout`.
+     */
+    async fetchAndReadText(url, signal) {
+        return this.withTimeout(signal, async (innerSignal) => {
+            const response = await fetch(url, { method: 'GET', signal: innerSignal });
+            const body = await response.text().catch(() => '');
+            return { response, body };
+        });
+    }
+    async sendAndParse(url, signal) {
+        var _a, _b, _c;
+        const maxAttempts = this._retryCount + 1;
+        // Log only the request path, never the query string, which can carry PII (UPN, object id, tenant).
+        const requestPath = url.split('?')[0];
+        for (let attempt = 1;; attempt++) {
+            logger.debug('Sidecar request (attempt %d/%d): GET %s', attempt, maxAttempts, requestPath);
+            let response;
+            let body;
+            try {
+                ({ response, body } = await this.fetchAndReadText(url, signal));
+            }
+            catch (err) {
+                // A caller-requested cancellation is not transient — propagate it.
+                if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
+                    throw err;
+                }
+                if (attempt >= maxAttempts) {
+                    logger.error('Sidecar request to %s failed after %d attempt(s).', requestPath, attempt);
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.SidecarRequestFailed, err, {
+                        attempts: String(attempt),
+                        message: (_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : 'network error'
+                    });
+                }
+                logger.warn('Sidecar request to %s failed (attempt %d/%d); retrying.', requestPath, attempt, maxAttempts);
+                await this.delayBeforeRetry(attempt, signal);
+                continue;
+            }
+            if (!response.ok) {
+                if (SidecarHttpClient.isTransientStatus(response.status) && attempt < maxAttempts) {
+                    logger.warn('Sidecar returned transient status %d from %s (attempt %d/%d); retrying.', response.status, requestPath, attempt, maxAttempts);
+                    await this.delayBeforeRetry(attempt, signal);
+                    continue;
+                }
+                const problem = SidecarHttpClient.tryParseProblemDetails(body);
+                // Never surface problem.detail: the sidecar can echo request parameters (UPN, object id,
+                // tenant) into it. Use only the non-sensitive title/status in logs and the thrown error.
+                const message = (_b = problem === null || problem === void 0 ? void 0 : problem.title) !== null && _b !== void 0 ? _b : `Sidecar returned ${response.status}`;
+                logger.error('Sidecar returned error. Status: %d, URL: %s, Title: %s', response.status, requestPath, (_c = problem === null || problem === void 0 ? void 0 : problem.title) !== null && _c !== void 0 ? _c : '(none)');
+                throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.SidecarErrorResponse, undefined, {
+                    status: String(response.status),
+                    message
+                });
+            }
+            const result = SidecarHttpClient.parseTokenResponse(body);
+            logger.debug('Sidecar token acquired from %s. Scheme: %s, TokenLength: %d', requestPath, result.scheme, result.token.length);
+            return result;
+        }
+    }
+    async delayBeforeRetry(attempt, signal) {
+        const multiplier = Math.pow(2, attempt - 1);
+        const delay = this._retryBackoffBaseMs * multiplier;
+        if (delay <= 0) {
+            return;
+        }
+        // Resolve after the backoff delay, but reject immediately if the caller aborts so a pending
+        // retry wait does not keep the caller blocked for the full (potentially several second) delay.
+        await new Promise((resolve, reject) => {
+            let onAbort;
+            const timer = setTimeout(() => {
+                if (signal && onAbort) {
+                    signal.removeEventListener('abort', onAbort);
+                }
+                resolve();
+            }, delay);
+            if (signal) {
+                onAbort = () => {
+                    var _a;
+                    clearTimeout(timer);
+                    reject((_a = signal.reason) !== null && _a !== void 0 ? _a : new Error('Aborted'));
+                };
+                if (signal.aborted) {
+                    onAbort();
+                    return;
+                }
+                signal.addEventListener('abort', onAbort, { once: true });
+            }
+        });
+    }
+    static isTransientStatus(status) {
+        return status === 408 || status === 429 || status >= 500;
+    }
+    static parseTokenResponse(responseContent) {
+        let body;
+        try {
+            body = JSON.parse(responseContent);
+        }
+        catch (err) {
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.SidecarResponseUnparsable, err);
+        }
+        const headerValue = typeof body.authorizationHeader === 'string' ? body.authorizationHeader.trim() : '';
+        if (headerValue) {
+            const spaceIndex = headerValue.indexOf(' ');
+            if (spaceIndex > 0) {
+                // "{scheme} {token}" form: the token after the separator must be non-empty.
+                const token = headerValue.substring(spaceIndex + 1).trim();
+                if (token.length > 0) {
+                    return { scheme: headerValue.substring(0, spaceIndex), token };
+                }
+            }
+            else if (!SidecarHttpClient.isKnownAuthScheme(headerValue)) {
+                // No separator: treat the whole value as a raw token and default the scheme to
+                // Bearer. A lone scheme name (e.g. "Bearer") is not a valid token and falls
+                // through to the error below.
+                return { scheme: 'Bearer', token: headerValue };
+            }
+        }
+        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.SidecarResponseMissingAuthorizationHeader);
+    }
+    static isKnownAuthScheme(value) {
+        const lower = value.toLowerCase();
+        return lower === 'bearer' || lower === 'pop';
+    }
+    static tryParseProblemDetails(content) {
+        if (!content) {
+            return undefined;
+        }
+        try {
+            return JSON.parse(content);
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+exports.SidecarHttpClient = SidecarHttpClient;
+/** Default per-attempt request timeout (milliseconds). */
+SidecarHttpClient.DEFAULT_TIMEOUT_MS = sidecarModels_1.DEFAULT_REQUEST_TIMEOUT_MS;
+/** Default number of retry attempts for transient failures. */
+SidecarHttpClient.DEFAULT_RETRY_COUNT = sidecarModels_1.DEFAULT_RETRY_COUNT;
+//# sourceMappingURL=sidecarHttpClient.js.map

package/dist/src/auth/sidecar/sidecarHttpClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecarHttpClient.js","sourceRoot":"","sources":["../../../../src/auth/sidecar/sidecarHttpClient.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,uCAA+B;AAC/B,kEAAmD;AACnD,gEAA4D;AAC5D,mDAA0C;AAC1C,mDAOwB;AAExB,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,gBAAgB,CAAC,CAAA;AAEtC,MAAM,6BAA6B,GAAG,IAAI,CAAA;AAE1C;;;;GAIG;AACH,MAAa,iBAAiB;IAY5B;;;;;;OAMG;IACH,YACE,OAAe,EACf,YAAoB,iBAAiB,CAAC,kBAAkB,EACxD,aAAqB,iBAAiB,CAAC,mBAAmB,EAC1D,qBAA6B,6BAA6B;QAE1D,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC,oBAAoB,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAA;QACrG,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,kBAAkB,CAAA;QAChH,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,mBAAmB,CAAA;QAC5H,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,6BAA6B,CAAA;IAChJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,oBAAoB,CAAE,KAAa;QAChD,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAA;QACtB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC;YAC7D,GAAG,EAAE,CAAA;QACP,CAAC;QACD,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAE,aAAsB;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;QACtC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAA;QACtB,CAAC;QACD,OAAO,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,wCAAwB,CAAA;IAChG,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,SAAS,CAAE,GAAW;QACnC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC7B,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAA;gBACf,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAA;YACjB,CAAC;YACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,eAAe,CAAE,WAAmB,EAAE,6BAAsC;QACjF,IAAI,GAAQ,CAAA;QACZ,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,qBAAqB,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAC5I,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,4BAA4B,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QACnJ,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,sBAAsB,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAC7I,CAAC;QAED,IAAI,6BAA6B,EAAE,CAAC;YAClC,OAAM;QACR,CAAC;QAED,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAM;QACR,CAAC;QAED,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,sBAAsB,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IAC7I,CAAC;IAEO,MAAM,CAAC,uBAAuB,CAAE,IAAY;QAClD,iGAAiG;QACjG,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACxF,MAAM,SAAS,GAAG,IAAA,eAAI,EAAC,UAAU,CAAC,CAAA;QAClC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,kEAAkE;YAClE,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;YACtC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,iBAAiB,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,iBAAiB,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAEO,MAAM,CAAC,uBAAuB,CAAE,IAAY;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,uBAAuB;QACrD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA,CAAC,aAAa;QAC1C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA,CAAC,gBAAgB;QAC1E,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,iBAAiB;QAC/D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,4BAA4B;QAC1E,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,MAAM,CAAC,uBAAuB,CAAE,IAAY;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAChC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAA,CAAC,2DAA2D;QAC3H,wEAAwE;QACxE,0CAA0C;QAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;QAC7D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,iBAAiB,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAA,CAAC,wBAAwB;YAC3E,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAA,CAAC,uBAAuB;YAC1E,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAA,CAAC,oCAAoC;QACzF,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,iBAAiB,CAAE,IAAY;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC1E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,CAAC,CAAC,CAAA;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAClE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAChC,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAA;QAChE,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qCAAqC,CACzC,WAAmB,EACnB,OAA+B,EAC/B,MAAoB;QAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,uCAAuC,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QAC5G,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,QAAQ,UAAU,CAAC,CAAA;YACxE,OAAO,QAAQ,CAAC,EAAE,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAE,IAAY,EAAE,OAA+B;QAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,mGAAmG;QACnG,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,oCAAoC,CAAC,CAAA;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnC,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC1B,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAA;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,4CAA4C,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7E,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,kDAAkD,EAAE,MAAM,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACxC,CAAC;IAEO,KAAK,CAAC,WAAW,CAAK,MAA+B,EAAE,EAA4C;QACzG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,UAAU,CAAC,KAAK,EAAE,CAAA;YACpB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACpC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAE,GAAW,EAAE,MAAoB;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IACtG,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAE,GAAW,EAAE,MAAoB;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YACzE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CAAE,GAAW,EAAE,MAAoB;;QAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC,CAAA;QACxC,mGAAmG;QACnG,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAErC,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;YAE1F,IAAI,QAAkB,CAAA;YACtB,IAAI,IAAY,CAAA;YAChB,IAAI,CAAC;gBACH,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;YACjE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mEAAmE;gBACnE,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,EAAE,CAAC;oBACpB,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;oBAC3B,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;oBACvF,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,oBAAoB,EAAE,GAAY,EAAE;wBACxF,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;wBACzB,OAAO,EAAE,MAAC,GAAa,aAAb,GAAG,uBAAH,GAAG,CAAY,OAAO,mCAAI,eAAe;qBACpD,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;gBACzG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC5C,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;oBAClF,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;oBAC1I,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;oBAC5C,SAAQ;gBACV,CAAC;gBAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAA;gBAC9D,yFAAyF;gBACzF,yFAAyF;gBACzF,MAAM,OAAO,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,mCAAI,oBAAoB,QAAQ,CAAC,MAAM,EAAE,CAAA;gBACvE,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,mCAAI,QAAQ,CAAC,CAAA;gBAChI,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,oBAAoB,EAAE,SAAS,EAAE;oBACrF,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC/B,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAA;YACzD,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC5H,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAE,OAAe,EAAE,MAAoB;QACnE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAA;QACnD,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,OAAM;QACR,CAAC;QACD,4FAA4F;QAC5F,+FAA+F;QAC/F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,OAAiC,CAAA;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;oBACtB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC,EAAE,KAAK,CAAC,CAAA;YACT,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,GAAG,GAAG,EAAE;;oBACb,YAAY,CAAC,KAAK,CAAC,CAAA;oBACnB,MAAM,CAAC,MAAA,MAAM,CAAC,MAAM,mCAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;gBAC/C,CAAC,CAAA;gBACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,EAAE,CAAA;oBACT,OAAM;gBACR,CAAC;gBACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAAE,MAAc;QAC9C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAA;IAC1D,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAAE,eAAuB;QACxD,IAAI,IAAuC,CAAA;QAC3C,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,yBAAyB,EAAE,GAAY,CAAC,CAAA;QAChG,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACvG,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACnB,4EAA4E;gBAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAA;gBAChE,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,+EAA+E;gBAC/E,4EAA4E;gBAC5E,8BAA8B;gBAC9B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;YACjD,CAAC;QACH,CAAC;QAED,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,yCAAyC,CAAC,CAAA;IAClG,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAAE,KAAa;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAA;IAC9C,CAAC;IAEO,MAAM,CAAC,sBAAsB,CAAE,OAAe;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA0B,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;;AA9ZH,8CA+ZC;AA9ZC,0DAA0D;AAC1C,oCAAkB,GAAG,0CAA0B,CAAA;AAE/D,+DAA+D;AAC/C,qCAAmB,GAAG,mCAAmB,CAAA"}

package/dist/src/auth/sidecar/sidecarModels.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+import { AuthConfiguration } from '../authConfiguration';
+/**
+ * Default base URL of the Entra Agent ID sidecar (agent container).
+ */
+export declare const DEFAULT_SIDECAR_BASE_URL = "http://localhost:5178";
+/**
+ * Default per-attempt HTTP request timeout (in milliseconds) for sidecar calls.
+ */
+export declare const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
+/**
+ * Default number of retry attempts for transient sidecar failures.
+ */
+export declare const DEFAULT_RETRY_COUNT = 3;
+/**
+ * Resolved (normalized) connection settings for the sidecar-based token provider, derived from a
+ * connection's {@link AuthConfiguration} with all sidecar defaults applied. Distinct from the
+ * configuration-level {@link SidecarConnectionSettings} (which has optional properties): this is the
+ * runtime shape consumed by the provider after normalization via {@link toSidecarConnectionSettings}.
+ */
+export interface ResolvedSidecarConnectionSettings {
+    /**
+     * The configured downstream API service name in the sidecar's DownstreamApis configuration.
+     * Defaults to `'default'`.
+     */
+    serviceName: string;
+    /**
+     * The sidecar downstream API name used to acquire the Blueprint (agent application) token for the
+     * agentic FIC chain. Defaults to `'agenticblueprint'`.
+     */
+    blueprintServiceName: string;
+    /**
+     * Optional base URL of the Entra Agent ID sidecar (agent container). Resolution order:
+     * `SIDECAR_URL` environment variable > this setting > {@link DEFAULT_SIDECAR_BASE_URL}.
+     */
+    sidecarBaseUrl?: string;
+    /**
+     * When `true`, disables the loopback/private-address safety check on the resolved sidecar base
+     * URL. UNSAFE; leave `false` in all normal deployments.
+     */
+    bypassLocalNetworkRestriction: boolean;
+    /**
+     * Per-attempt HTTP request timeout (in milliseconds) for sidecar calls. Defaults to 30000.
+     */
+    requestTimeout: number;
+    /**
+     * Number of retry attempts for transient sidecar failures. Defaults to 3.
+     */
+    retryCount: number;
+    /**
+     * The OAuth scopes to request, used to override the sidecar's configured downstream API scopes.
+     */
+    scopes?: string[];
+}
+/**
+ * Builds a {@link ResolvedSidecarConnectionSettings} from a connection's {@link AuthConfiguration},
+ * applying the documented defaults.
+ * @param config The connection authentication configuration.
+ * @returns The resolved sidecar connection settings.
+ */
+export declare function toSidecarConnectionSettings(config?: AuthConfiguration): ResolvedSidecarConnectionSettings;
+/**
+ * Options used to build the query string for a sidecar token request. Mirrors the C#
+ * `SidecarRequestOptions` shape.
+ */
+export interface SidecarRequestOptions {
+    /** Agent app (client) ID for agent identity flows. Maps to `AgentIdentity`. */
+    agentIdentity?: string;
+    /** Agentic user principal name for delegated agent flows. Maps to `AgentUsername`. */
+    agentUsername?: string;
+    /** Agentic user object ID for delegated agent flows. Maps to `AgentUserId`. */
+    agentUserId?: string;
+    /** Override the configured downstream API scopes. Maps to `optionsOverride.Scopes`. */
+    scopes?: string[];
+    /**
+     * Request an app-only token instead of a user (delegated) token. Maps to
+     * `optionsOverride.RequestAppToken=true`.
+     */
+    requestAppToken?: boolean;
+    /** Override the tenant ID. Maps to `optionsOverride.AcquireTokenOptions.Tenant`. */
+    tenant?: string;
+    /**
+     * Force a fresh token acquisition, bypassing the sidecar cache. Maps to
+     * `optionsOverride.AcquireTokenOptions.ForceRefresh=true`.
+     */
+    forceRefresh?: boolean;
+}
+/**
+ * Result of a successful sidecar token acquisition. Mirrors the C# `SidecarTokenResult` shape.
+ */
+export interface SidecarTokenResult {
+    /** The authorization scheme (e.g., `'Bearer'` or `'PoP'`). */
+    scheme: string;
+    /** The raw access token. */
+    token: string;
+}
+/**
+ * RFC 7807 problem details returned by the sidecar on error. Mirrors the C# `SidecarProblemDetails`
+ * shape.
+ */
+export interface SidecarProblemDetails {
+    type?: string;
+    title?: string;
+    status?: number;
+    detail?: string;
+    instance?: string;
+}

package/dist/src/auth/sidecar/sidecarModels.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_RETRY_COUNT = exports.DEFAULT_REQUEST_TIMEOUT_MS = exports.DEFAULT_SIDECAR_BASE_URL = void 0;
+exports.toSidecarConnectionSettings = toSidecarConnectionSettings;
+/**
+ * Default sidecar downstream API name used for app-only and autonomous agent token acquisition.
+ */
+const DEFAULT_SERVICE_NAME = 'default';
+/**
+ * Default sidecar downstream API name used to acquire the Blueprint (agent application) token.
+ */
+const DEFAULT_BLUEPRINT_SERVICE_NAME = 'agenticblueprint';
+/**
+ * Default base URL of the Entra Agent ID sidecar (agent container).
+ */
+exports.DEFAULT_SIDECAR_BASE_URL = 'http://localhost:5178';
+/**
+ * Default per-attempt HTTP request timeout (in milliseconds) for sidecar calls.
+ */
+exports.DEFAULT_REQUEST_TIMEOUT_MS = 30000;
+/**
+ * Default number of retry attempts for transient sidecar failures.
+ */
+exports.DEFAULT_RETRY_COUNT = 3;
+/**
+ * Builds a {@link ResolvedSidecarConnectionSettings} from a connection's {@link AuthConfiguration},
+ * applying the documented defaults.
+ * @param config The connection authentication configuration.
+ * @returns The resolved sidecar connection settings.
+ */
+function toSidecarConnectionSettings(config) {
+    var _a, _b, _c, _d, _e, _f;
+    const scopes = (_a = config === null || config === void 0 ? void 0 : config.scopes) !== null && _a !== void 0 ? _a : ((config === null || config === void 0 ? void 0 : config.scope) ? [config.scope] : undefined);
+    return {
+        serviceName: ((_b = config === null || config === void 0 ? void 0 : config.serviceName) === null || _b === void 0 ? void 0 : _b.trim()) ? config.serviceName : DEFAULT_SERVICE_NAME,
+        blueprintServiceName: ((_c = config === null || config === void 0 ? void 0 : config.blueprintServiceName) === null || _c === void 0 ? void 0 : _c.trim()) ? config.blueprintServiceName : DEFAULT_BLUEPRINT_SERVICE_NAME,
+        sidecarBaseUrl: config === null || config === void 0 ? void 0 : config.sidecarBaseUrl,
+        bypassLocalNetworkRestriction: (_d = config === null || config === void 0 ? void 0 : config.bypassLocalNetworkRestriction) !== null && _d !== void 0 ? _d : false,
+        requestTimeout: (_e = config === null || config === void 0 ? void 0 : config.requestTimeout) !== null && _e !== void 0 ? _e : exports.DEFAULT_REQUEST_TIMEOUT_MS,
+        retryCount: (_f = config === null || config === void 0 ? void 0 : config.retryCount) !== null && _f !== void 0 ? _f : exports.DEFAULT_RETRY_COUNT,
+        scopes
+    };
+}
+//# sourceMappingURL=sidecarModels.js.map

package/dist/src/auth/sidecar/sidecarModels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecarModels.js","sourceRoot":"","sources":["../../../../src/auth/sidecar/sidecarModels.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAkFH,kEAWC;AAzFD;;GAEG;AACH,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAEtC;;GAEG;AACH,MAAM,8BAA8B,GAAG,kBAAkB,CAAA;AAEzD;;GAEG;AACU,QAAA,wBAAwB,GAAG,uBAAuB,CAAA;AAE/D;;GAEG;AACU,QAAA,0BAA0B,GAAG,KAAK,CAAA;AAE/C;;GAEG;AACU,QAAA,mBAAmB,GAAG,CAAC,CAAA;AAiDpC;;;;;GAKG;AACH,SAAgB,2BAA2B,CAAE,MAA0B;;IACrE,MAAM,MAAM,GAAG,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,mCAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,EAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC7E,OAAO;QACL,WAAW,EAAE,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW,0CAAE,IAAI,EAAE,EAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB;QACpF,oBAAoB,EAAE,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,0CAAE,IAAI,EAAE,EAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,8BAA8B;QACzH,cAAc,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,cAAc;QACtC,6BAA6B,EAAE,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,6BAA6B,mCAAI,KAAK;QAC7E,cAAc,EAAE,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,cAAc,mCAAI,kCAA0B;QACpE,UAAU,EAAE,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,UAAU,mCAAI,2BAAmB;QACrD,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/src/auth/sidecar/sidecarTokenExpiry.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Resolves the absolute expiry (epoch milliseconds) of a sidecar-issued token. Prefers the token's
+ * own JWT `exp` claim; falls back to {@link FALLBACK_LIFETIME_MS} from now when the token is opaque
+ * or carries no readable expiry.
+ * @param token The raw access token returned by the sidecar.
+ * @param now The current time in epoch milliseconds (defaults to `Date.now()`); primarily a test seam.
+ * @returns The absolute UTC expiry of the token, in epoch milliseconds.
+ */
+export declare function resolveTokenExpiry(token: string, now?: number): number;

package/dist/src/auth/sidecar/sidecarTokenExpiry.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveTokenExpiry = resolveTokenExpiry;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+/**
+ * Conservative lifetime (in milliseconds) applied when the token is opaque or carries no readable
+ * JWT `exp` claim.
+ */
+const FALLBACK_LIFETIME_MS = 5 * 60 * 1000;
+/**
+ * Resolves the absolute expiry (epoch milliseconds) of a sidecar-issued token. Prefers the token's
+ * own JWT `exp` claim; falls back to {@link FALLBACK_LIFETIME_MS} from now when the token is opaque
+ * or carries no readable expiry.
+ * @param token The raw access token returned by the sidecar.
+ * @param now The current time in epoch milliseconds (defaults to `Date.now()`); primarily a test seam.
+ * @returns The absolute UTC expiry of the token, in epoch milliseconds.
+ */
+function resolveTokenExpiry(token, now = Date.now()) {
+    if (token) {
+        try {
+            const decoded = jsonwebtoken_1.default.decode(token);
+            if (decoded && typeof decoded.exp === 'number' && decoded.exp > 0) {
+                return decoded.exp * 1000;
+            }
+        }
+        catch {
+            // Opaque / non-JWT token — fall back below.
+        }
+    }
+    return now + FALLBACK_LIFETIME_MS;
+}
+//# sourceMappingURL=sidecarTokenExpiry.js.map

package/dist/src/auth/sidecar/sidecarTokenExpiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecarTokenExpiry.js","sourceRoot":"","sources":["../../../../src/auth/sidecar/sidecarTokenExpiry.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;AAkBH,gDAaC;AA7BD,gEAA8B;AAE9B;;;GAGG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAE1C;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAE,KAAa,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACzE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,CAA0B,CAAA;YAC1D,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;gBAClE,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAA;YAC3B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IAED,OAAO,GAAG,GAAG,oBAAoB,CAAA;AACnC,CAAC"}