@nocobase/app-plugin-agents 0.0.0-stage → 0.1.0-beta.10

package/dist/server/core/runs/run-requests.js

@@ -0,0 +1,475 @@
+import { isDeepStrictEqual } from 'node:util';
+import { conflict, forbidden, notFound, precondition, } from '../../kernel/errors.js';
+import { asJson, cleanList, stringArray } from '../../kernel/values.js';
+import { findAgent, lockAgentForClaim } from '../agents/index.js';
+/** How long a request waits for its responsible: seven days. */
+export const RUN_REQUEST_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+/** How many requests one sweep expires at most; the next sweep takes the rest. */
+const EXPIRE_BATCH = 100;
+export function runRequestsRepo(conn) {
+    return conn.repository('agRunRequests');
+}
+export function toRunRequest(record) {
+    return {
+        id: record.id,
+        agentId: record.agentId,
+        subject: { kind: record.subjectKind, id: record.subjectId },
+        threadScope: record.threadScope,
+        freshSession: Boolean(record.freshSession),
+        responsibleUserId: record.responsibleUserId,
+        requestedByUserId: record.requestedByUserId,
+        ownerUserId: record.ownerUserId,
+        fireAt: record.fireAt,
+        maxAttempts: record.maxAttempts === null ? null : Number(record.maxAttempts),
+        input: {
+            type: record.inputType,
+            actor: {
+                kind: record.inputActorKind,
+                id: record.inputActorId,
+                name: record.inputActorName,
+            },
+            text: record.inputText,
+            payload: record.inputPayload ?? null,
+        },
+        status: record.status,
+        settledById: record.settledById,
+        settledAt: record.settledAt,
+        note: record.note,
+        expiresAt: record.expiresAt,
+        runId: record.runId,
+        supersededById: record.supersededById,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+    };
+}
+/** Stores a pending request in `unit` and announces it; it expires `RUN_REQUEST_TTL_MS` from now. */
+export async function insertRunRequest(unit, deps, request) {
+    const now = deps.clock.now();
+    const fireAt = request.fireAt === null ? null : new Date(request.fireAt).getTime();
+    // Serializes retries for this agent; duplicate input never creates another inbox entry or renews its expiry.
+    await lockAgentForClaim(unit.conn, request.agentId, now.toISOString());
+    const pending = await runRequestsRepo(unit.conn).findMany({
+        filter: {
+            agentId: request.agentId,
+            subjectKind: request.subject.kind,
+            subjectId: request.subject.id,
+            threadScope: request.threadScope,
+            responsibleUserId: request.responsibleUserId,
+            requestedByUserId: request.requestedByUserId,
+            status: 'pending',
+        },
+    });
+    const duplicate = pending.find((record) => Date.parse(record.expiresAt) > now.getTime() &&
+        record.ownerUserId === request.ownerUserId &&
+        Number(record.priority) === request.priority &&
+        Boolean(record.freshSession) === (request.freshSession === true) &&
+        isDeepStrictEqual(stringArray(record.requires), cleanList([...request.requires])) &&
+        (record.fireAt === null ? null : new Date(record.fireAt).getTime()) ===
+            fireAt &&
+        (record.maxAttempts === null ? null : Number(record.maxAttempts)) ===
+            request.maxAttempts &&
+        record.inputType === request.input.type &&
+        record.inputActorKind === request.input.actor.kind &&
+        record.inputActorId === request.input.actor.id &&
+        record.inputActorName === request.input.actor.name &&
+        record.inputText === request.input.text &&
+        isDeepStrictEqual(record.inputPayload ?? null, asJson(request.input.payload)));
+    if (duplicate)
+        return toRunRequest(duplicate);
+    const id = deps.ids.next();
+    await runRequestsRepo(unit.conn).createOne({
+        values: {
+            id,
+            agentId: request.agentId,
+            subjectKind: request.subject.kind,
+            subjectId: request.subject.id,
+            threadScope: request.threadScope,
+            freshSession: request.freshSession === true,
+            responsibleUserId: request.responsibleUserId,
+            requestedByUserId: request.requestedByUserId,
+            ownerUserId: request.ownerUserId,
+            priority: request.priority,
+            requires: cleanList([...request.requires]),
+            fireAt: request.fireAt,
+            maxAttempts: request.maxAttempts,
+            inputType: request.input.type,
+            inputActorKind: request.input.actor.kind,
+            inputActorId: request.input.actor.id,
+            inputActorName: request.input.actor.name,
+            inputText: request.input.text,
+            inputPayload: asJson(request.input.payload),
+            status: 'pending',
+            settledById: null,
+            settledAt: null,
+            note: null,
+            expiresAt: new Date(now.getTime() + RUN_REQUEST_TTL_MS).toISOString(),
+            runId: null,
+            supersededById: null,
+            createdAt: now.toISOString(),
+            updatedAt: now.toISOString(),
+        },
+    });
+    const created = toRunRequest((await runRequestsRepo(unit.conn).findOne({ filter: { id } })));
+    unit.emit({ type: 'runRequest.created', request: created });
+    return created;
+}
+function settled(record, status = record.status) {
+    return precondition('RUN_REQUEST_SETTLED', status === 'expired'
+        ? 'The request expired.'
+        : `The request is ${status} already.`, { status });
+}
+export function createRunRequestService(deps) {
+    const { tx, clock } = deps;
+    const require = async (conn, id) => {
+        const record = await runRequestsRepo(conn).findOne({ filter: { id } });
+        if (!record)
+            throw notFound('Run request');
+        return record;
+    };
+    /** Whether a pending request's time ran out, whether or not the sweeper has noticed yet. */
+    const isDue = (record) => Date.parse(record.expiresAt) <= clock.now().getTime();
+    /**
+     * Expires a pending request whose time ran out and tells the person who asked; false when something else moved it
+     * first. The sweeper's pass and every other path that finds one due go through here.
+     */
+    async function expire(unit, record, reason = 'timeout') {
+        const result = await runRequestsRepo(unit.conn).updateMany({
+            filter: (f) => f.and([f.string('id').eq(record.id), f.string('status').eq('pending')]),
+            values: { status: 'expired', updatedAt: clock.now().toISOString() },
+        });
+        if (result.updatedCount !== 1)
+            return false;
+        const request = toRunRequest(await require(unit.conn, record.id));
+        unit.emit({ type: 'runRequest.expired', request });
+        const agentName = (await findAgent(unit.conn, record.agentId))?.name ?? record.agentId;
+        unit.emit({
+            type: 'notice',
+            notice: {
+                key: `run_request_expired:${record.id}`,
+                type: 'run_request_expired',
+                userIds: [record.requestedByUserId],
+                subject: { kind: 'runRequest', id: record.id, label: agentName },
+                title: `${agentName} did not run your request`,
+                body: `${reason === 'timeout' ? 'Nobody confirmed your request in time' : 'The new responsible cannot run your request'}, so your request to ${agentName} on ${record.subjectKind} ${record.subjectId} expired. You can still run it as yourself, on your own runner or a team runner.`,
+                params: {
+                    agentName,
+                    subjectKind: record.subjectKind,
+                    subjectId: record.subjectId,
+                    requestId: record.id,
+                    responsibleUserId: record.responsibleUserId,
+                    reason,
+                },
+            },
+        });
+        return true;
+    }
+    const requirePending = (record) => {
+        if (record.status !== 'pending')
+            throw settled(record);
+        if (isDue(record))
+            throw settled(record, 'expired');
+    };
+    async function requireCurrentResponsible(unit, record, byUserId) {
+        const current = await deps.currentResponsible?.(unit, {
+            kind: record.subjectKind,
+            id: record.subjectId,
+        });
+        if (current !== undefined && current !== byUserId)
+            throw forbidden('You no longer answer for this subject.');
+    }
+    /** Moves a pending request on, once: a concurrent change that moved it first wins. */
+    async function settle(unit, record, values) {
+        const result = await runRequestsRepo(unit.conn).updateMany({
+            filter: (f) => f.and([f.string('id').eq(record.id), f.string('status').eq('pending')]),
+            values: { ...values, updatedAt: clock.now().toISOString() },
+        });
+        if (result.updatedCount !== 1)
+            throw conflict('The request changed; read it again.');
+        return require(unit.conn, record.id);
+    }
+    async function setRun(unit, id, runId) {
+        await runRequestsRepo(unit.conn).updateMany({
+            filter: { id },
+            values: { runId, updatedAt: clock.now().toISOString() },
+        });
+        return require(unit.conn, id);
+    }
+    const inputOf = (record) => {
+        const view = toRunRequest(record).input;
+        return {
+            type: view.type,
+            actor: view.actor,
+            text: view.text,
+            ...(view.payload === null ? {} : { payload: view.payload }),
+        };
+    };
+    const workOf = (record, agent) => ({
+        agent,
+        subject: { kind: record.subjectKind, id: record.subjectId },
+        threadScope: record.threadScope,
+        freshSession: Boolean(record.freshSession),
+        ownerUserId: record.ownerUserId,
+        priority: Number(record.priority),
+        requires: stringArray(record.requires),
+        fireAt: record.fireAt,
+        maxAttempts: record.maxAttempts === null ? null : Number(record.maxAttempts),
+        input: inputOf(record),
+    });
+    async function itemsOf(records) {
+        const conn = tx.read();
+        const names = await deps.people.names(conn, [
+            ...new Set(records.flatMap((record) => [
+                record.responsibleUserId,
+                record.requestedByUserId,
+            ])),
+        ]);
+        const agents = new Map();
+        for (const record of records)
+            if (!agents.has(record.agentId))
+                agents.set(record.agentId, (await findAgent(conn, record.agentId))?.name ?? null);
+        return records.map((record) => ({
+            ...toRunRequest(record),
+            agentName: agents.get(record.agentId) ?? null,
+            responsibleName: names.get(record.responsibleUserId) ?? null,
+            requestedByName: names.get(record.requestedByUserId) ?? null,
+        }));
+    }
+    return {
+        async get(requestId) {
+            const [item] = await itemsOf([await require(tx.read(), requestId)]);
+            return item;
+        },
+        async list(filter) {
+            const records = await runRequestsRepo(tx.read()).findMany({
+                filter: (f) => f.and([
+                    filter.role === 'responsible'
+                        ? f.string('responsibleUserId').eq(filter.userId)
+                        : filter.role === 'requester'
+                            ? f.string('requestedByUserId').eq(filter.userId)
+                            : f.or([
+                                f.string('responsibleUserId').eq(filter.userId),
+                                f.string('requestedByUserId').eq(filter.userId),
+                            ]),
+                    ...(filter.status ? [f.string('status').eq(filter.status)] : []),
+                    ...(filter.subject
+                        ? [f.string('subjectKind').eq(filter.subject.kind)]
+                        : []),
+                    ...(filter.subject?.id
+                        ? [f.string('subjectId').eq(filter.subject.id)]
+                        : []),
+                    ...(filter.agentId ? [f.string('agentId').eq(filter.agentId)] : []),
+                ]),
+                sort: (sort) => [
+                    sort.field('createdAt').desc(),
+                    sort.field('id').desc(),
+                ],
+                limit: Math.min(Math.max(filter.limit ?? 50, 1), 201),
+                ...(filter.cursor ? { cursor: filter.cursor } : {}),
+            });
+            return itemsOf(records);
+        },
+        async pendingOn(conn, subject, agentId) {
+            const records = await runRequestsRepo(conn).findMany({
+                filter: (f) => f.and([
+                    f.string('subjectKind').eq(subject.kind),
+                    f.string('subjectId').eq(subject.id),
+                    f.string('status').eq('pending'),
+                    ...(agentId ? [f.string('agentId').eq(agentId)] : []),
+                ]),
+                sort: (sort) => [sort.field('createdAt').asc(), sort.field('id').asc()],
+            });
+            return records.map(toRunRequest);
+        },
+        confirm: (requestId, byUserId) => tx.run(async (unit) => {
+            const record = await require(unit.conn, requestId);
+            if (record.responsibleUserId !== byUserId)
+                throw forbidden('Only the person who answers for the subject may confirm this request.');
+            requirePending(record);
+            await requireCurrentResponsible(unit, record, byUserId);
+            // Confirming runs the work as them: they must still be able to wake the agent.
+            const agent = await deps.requireInvocable(unit, record.agentId, byUserId);
+            await settle(unit, record, {
+                status: 'confirmed',
+                settledById: byUserId,
+                settledAt: clock.now().toISOString(),
+            });
+            const run = await deps.direct(unit, {
+                ...workOf(record, agent),
+                actorUserId: record.responsibleUserId,
+                requestedByUserId: record.requestedByUserId,
+                confirmedByUserId: byUserId,
+            });
+            const request = toRunRequest(await setRun(unit, record.id, run.runId));
+            unit.emit({ type: 'runRequest.confirmed', request });
+            return { request, run };
+        }),
+        reject: (requestId, byUserId, note) => tx.run(async (unit) => {
+            const record = await require(unit.conn, requestId);
+            if (record.responsibleUserId !== byUserId)
+                throw forbidden('Only the person who answers for the subject may reject this request.');
+            requirePending(record);
+            await requireCurrentResponsible(unit, record, byUserId);
+            const request = toRunRequest(await settle(unit, record, {
+                status: 'rejected',
+                settledById: byUserId,
+                settledAt: clock.now().toISOString(),
+                note: note ?? null,
+            }));
+            unit.emit({ type: 'runRequest.rejected', request });
+            return request;
+        }),
+        withdraw: (requestId, byUserId) => tx.run(async (unit) => {
+            const record = await require(unit.conn, requestId);
+            if (record.requestedByUserId !== byUserId)
+                throw forbidden('Only the person who asked may withdraw this request.');
+            requirePending(record);
+            const request = toRunRequest(await settle(unit, record, {
+                status: 'withdrawn',
+                settledById: byUserId,
+                settledAt: clock.now().toISOString(),
+            }));
+            unit.emit({ type: 'runRequest.withdrawn', request });
+            return request;
+        }),
+        runAsRequester: (requestId, byUserId) => tx.run(async (unit) => {
+            const record = await require(unit.conn, requestId);
+            if (record.requestedByUserId !== byUserId)
+                throw forbidden('Only the person who asked may run this request as themselves.');
+            // An expired request that went nowhere may still be run this way: that is what its expiry notice offers.
+            const expired = record.status === 'expired' ||
+                (record.status === 'pending' && isDue(record));
+            if (!(record.status === 'pending' || record.status === 'expired') ||
+                record.runId)
+                throw settled(record);
+            const agent = await deps.requireInvocable(unit, record.agentId, byUserId);
+            const work = workOf(record, agent);
+            await deps.requireRunnerFor(unit, agent, byUserId, work.requires);
+            if (record.status === 'pending')
+                await settle(unit, record, {
+                    status: expired ? 'expired' : 'withdrawn',
+                    settledById: expired ? null : byUserId,
+                    settledAt: expired ? null : clock.now().toISOString(),
+                });
+            else {
+                // Only once: a second attempt finds the run set.
+                const result = await runRequestsRepo(unit.conn).updateMany({
+                    filter: (f) => f.and([f.string('id').eq(record.id), f.string('runId').eq(null)]),
+                    values: { updatedAt: clock.now().toISOString() },
+                });
+                if (result.updatedCount !== 1)
+                    throw conflict('The request changed; read it again.');
+            }
+            const run = await deps.direct(unit, {
+                ...work,
+                actorUserId: byUserId,
+                requestedByUserId: byUserId,
+                confirmedByUserId: null,
+            });
+            const request = toRunRequest(await setRun(unit, record.id, run.runId));
+            if (record.status === 'pending')
+                unit.emit({
+                    type: expired ? 'runRequest.expired' : 'runRequest.withdrawn',
+                    request,
+                });
+            return { request, run };
+        }),
+        reassign: (request, outer) => tx.run(async (unit) => {
+            const pending = await runRequestsRepo(unit.conn).findMany({
+                filter: (f) => f.and([
+                    f.string('subjectKind').eq(request.subject.kind),
+                    f.string('subjectId').eq(request.subject.id),
+                    f.string('status').eq('pending'),
+                    ...(request.agentId
+                        ? [f.string('agentId').eq(request.agentId)]
+                        : []),
+                ]),
+                sort: (sort) => [
+                    sort.field('createdAt').asc(),
+                    sort.field('id').asc(),
+                ],
+            });
+            const superseded = [];
+            const created = [];
+            const queued = [];
+            const expired = [];
+            for (const record of pending) {
+                // Its time ran out before the sweeper noticed: it expires now, as confirming would find, rather than being
+                // handed on with a fresh expiry or queued.
+                if (isDue(record)) {
+                    if (await expire(unit, record))
+                        expired.push(toRunRequest(await require(unit.conn, record.id)));
+                    continue;
+                }
+                if (record.responsibleUserId === request.toUserId)
+                    continue;
+                const agent = request.toUserId
+                    ? await findAgent(unit.conn, record.agentId)
+                    : undefined;
+                const usable = request.toUserId &&
+                    agent &&
+                    deps.mayInvoke(agent, request.toUserId);
+                if (!usable) {
+                    if (await expire(unit, record, 'reassignment'))
+                        expired.push(toRunRequest(await require(unit.conn, record.id)));
+                    continue;
+                }
+                await settle(unit, record, {
+                    status: 'superseded',
+                    settledById: request.byUserId,
+                    settledAt: clock.now().toISOString(),
+                    note: request.note ?? null,
+                });
+                if (usable && record.requestedByUserId === request.toUserId) {
+                    // The new responsible asked for it: their own work needs nobody's confirmation.
+                    queued.push(await deps.direct(unit, {
+                        ...workOf(record, agent),
+                        actorUserId: request.toUserId,
+                        requestedByUserId: request.toUserId,
+                        confirmedByUserId: null,
+                    }));
+                }
+                else if (usable) {
+                    const next = await insertRunRequest(unit, deps, {
+                        agentId: record.agentId,
+                        subject: { kind: record.subjectKind, id: record.subjectId },
+                        threadScope: record.threadScope,
+                        freshSession: Boolean(record.freshSession),
+                        responsibleUserId: request.toUserId,
+                        requestedByUserId: record.requestedByUserId,
+                        ownerUserId: record.ownerUserId,
+                        priority: Number(record.priority),
+                        requires: stringArray(record.requires),
+                        fireAt: record.fireAt,
+                        maxAttempts: record.maxAttempts === null ? null : Number(record.maxAttempts),
+                        input: inputOf(record),
+                    });
+                    created.push(next);
+                    await runRequestsRepo(unit.conn).updateMany({
+                        filter: { id: record.id },
+                        values: { supersededById: next.id },
+                    });
+                }
+                const done = toRunRequest(await require(unit.conn, record.id));
+                superseded.push(done);
+                unit.emit({ type: 'runRequest.superseded', request: done });
+            }
+            return { superseded, created, queued, expired };
+        }, outer),
+        async expireDue() {
+            const due = await runRequestsRepo(tx.read()).findMany({
+                filter: (f) => f.and([
+                    f.string('status').eq('pending'),
+                    f.date('expiresAt').notAfter(clock.now()),
+                ]),
+                sort: (sort) => [sort.field('expiresAt').asc(), sort.field('id').asc()],
+                limit: EXPIRE_BATCH,
+            });
+            let expired = 0;
+            for (const record of due)
+                if (await tx.run((unit) => expire(unit, record)))
+                    expired += 1;
+            return expired;
+        },
+    };
+}
+//# sourceMappingURL=run-requests.js.map

package/dist/server/core/runs/run-requests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-requests.js","sourceRoot":"","sources":["../../../../server/core/runs/run-requests.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAS9C,OAAO,EACL,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,GACb,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAElE,gEAAgE;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElE,kFAAkF;AAClF,MAAM,YAAY,GAAG,GAAG,CAAC;AAiCzB,MAAM,UAAU,eAAe,CAC7B,IAAwB;IAExB,OAAO,IAAI,CAAC,UAAU,CAAmB,eAAe,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAwB;IACnD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE;QAC3D,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;QAC1C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EACT,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACjE,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,CAAC,SAAyB;YACtC,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM,CAAC,cAA2B;gBACxC,EAAE,EAAE,MAAM,CAAC,YAAY;gBACvB,IAAI,EAAE,MAAM,CAAC,cAAc;aAC5B;YACD,IAAI,EAAE,MAAM,CAAC,SAAS;YACtB,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;SACrC;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AA6BD,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAQ,EACR,IAAuD,EACvD,OAAsB;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACtE,6GAA6G;IAC7G,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,MAAM,EAAE;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YACjC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,MAAM,EAAE,SAAS;SAClB;KACF,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAC5B,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE;QAC5C,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;QAC1C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ;QAC5C,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;QAChE,iBAAiB,CACf,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC5B,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CACjC;QACD,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YACjE,MAAM;QACR,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/D,OAAO,CAAC,WAAW;QACrB,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI;QACvC,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;QAClD,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QAC9C,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;QAClD,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI;QACvC,iBAAiB,CACf,MAAM,CAAC,YAAY,IAAI,IAAI,EAC3B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAC9B,CACJ,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;QACzC,MAAM,EAAE;YACN,EAAE;YACF,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YACjC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;YAC3C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC7B,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;YACxC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACpC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;YACxC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC7B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3C,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE;YACrE,KAAK,EAAE,IAAI;YACX,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;SAC7B;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,YAAY,CAC1B,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAE,CAChE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC;AACjB,CAAC;AA2ID,SAAS,OAAO,CAAC,MAAwB,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM;IAC/D,OAAO,YAAY,CACjB,qBAAqB,EACrB,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,kBAAkB,MAAM,WAAW,EACvC,EAAE,MAAM,EAAE,CACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAoB;IAEpB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAE3B,MAAM,OAAO,GAAG,KAAK,EACnB,IAAwB,EACxB,EAAU,EACiB,EAAE;QAC7B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,4FAA4F;IAC5F,MAAM,KAAK,GAAG,CAAC,MAAwB,EAAW,EAAE,CAClD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAExD;;;OAGG;IACH,KAAK,UAAU,MAAM,CACnB,IAAQ,EACR,MAAwB,EACxB,SAAqC,SAAS;QAE9C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;YACzD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACzE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE;SACpE,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,GACb,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE;gBACN,GAAG,EAAE,uBAAuB,MAAM,CAAC,EAAE,EAAE;gBACvC,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACnC,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;gBAChE,KAAK,EAAE,GAAG,SAAS,2BAA2B;gBAC9C,IAAI,EAAE,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,6CAA6C,wBAAwB,SAAS,OAAO,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,kFAAkF;gBACvR,MAAM,EAAE;oBACN,SAAS;oBACT,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,SAAS,EAAE,MAAM,CAAC,EAAE;oBACpB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;oBAC3C,MAAM;iBACP;aACF;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,MAAwB,EAAQ,EAAE;QACxD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC,CAAC;IAEF,KAAK,UAAU,yBAAyB,CACtC,IAAQ,EACR,MAAwB,EACxB,QAAgB;QAEhB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE;YACpD,IAAI,EAAE,MAAM,CAAC,WAAW;YACxB,EAAE,EAAE,MAAM,CAAC,SAAS;SACrB,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ;YAC/C,MAAM,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IAED,sFAAsF;IACtF,KAAK,UAAU,MAAM,CACnB,IAAQ,EACR,MAAwB,EACxB,MAAiC;QAEjC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;YACzD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACzE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE;SAC5D,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;YAC3B,MAAM,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,UAAU,MAAM,CACnB,IAAQ,EACR,EAAU,EACV,KAAa;QAEb,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;YAC1C,MAAM,EAAE,EAAE,EAAE,EAAE;YACd,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE;SACxD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAwB,EAA0B,EAAE;QACnE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CACb,MAAwB,EACxB,KAAY,EAIZ,EAAE,CAAC,CAAC;QACJ,KAAK;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE;QAC3D,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;QAC1C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;QACtC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EACT,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACjE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;KACvB,CAAC,CAAC;IAEH,KAAK,UAAU,OAAO,CACpB,OAAoC;QAEpC,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YAC1C,GAAG,IAAI,GAAG,CACR,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,CAAC,iBAAiB;gBACxB,MAAM,CAAC,iBAAiB;aACzB,CAAC,CACH;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;QAChD,KAAK,MAAM,MAAM,IAAI,OAAO;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC7B,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,OAAO,EACd,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CACtD,CAAC;QACN,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9B,GAAG,YAAY,CAAC,MAAM,CAAC;YACvB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI;YAC7C,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI;YAC5D,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI;SAC7D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,SAAS;YACjB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;gBACxD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,GAAG,CAAC;oBACJ,MAAM,CAAC,IAAI,KAAK,aAAa;wBAC3B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;wBACjD,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW;4BAC3B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;4BACjD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACH,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;gCAC/C,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;6BAChD,CAAC;oBACR,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,GAAG,CAAC,MAAM,CAAC,OAAO;wBAChB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBACnD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE;wBACpB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBAC/C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC;gBACJ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;oBACd,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE;oBAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;iBACxB;gBACD,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;gBACrD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO;YACpC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;gBACnD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,GAAG,CAAC;oBACJ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;oBACxC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC;oBAChC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD,CAAC;gBACJ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;aACxE,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CAC/B,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,iBAAiB,KAAK,QAAQ;gBACvC,MAAM,SAAS,CACb,uEAAuE,CACxE,CAAC;YACJ,cAAc,CAAC,MAAM,CAAC,CAAC;YACvB,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACxD,+EAA+E;YAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACvC,IAAI,EACJ,MAAM,CAAC,OAAO,EACd,QAAQ,CACT,CAAC;YACF,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;gBACzB,MAAM,EAAE,WAAW;gBACnB,WAAW,EAAE,QAAQ;gBACrB,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;gBAClC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;gBACxB,WAAW,EAAE,MAAM,CAAC,iBAAiB;gBACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,iBAAiB,EAAE,QAAQ;aAC5B,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC,CAAC;QAEJ,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CACpC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,iBAAiB,KAAK,QAAQ;gBACvC,MAAM,SAAS,CACb,sEAAsE,CACvE,CAAC;YACJ,cAAc,CAAC,MAAM,CAAC,CAAC;YACvB,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;gBACzB,MAAM,EAAE,UAAU;gBAClB,WAAW,EAAE,QAAQ;gBACrB,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;gBACpC,IAAI,EAAE,IAAI,IAAI,IAAI;aACnB,CAAC,CACH,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEJ,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CAChC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,iBAAiB,KAAK,QAAQ;gBACvC,MAAM,SAAS,CACb,sDAAsD,CACvD,CAAC;YACJ,cAAc,CAAC,MAAM,CAAC,CAAC;YACvB,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;gBACzB,MAAM,EAAE,WAAW;gBACnB,WAAW,EAAE,QAAQ;gBACrB,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC,CACH,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEJ,cAAc,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CACtC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,iBAAiB,KAAK,QAAQ;gBACvC,MAAM,SAAS,CACb,+DAA+D,CAChE,CAAC;YACJ,yGAAyG;YACzG,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,SAAS;gBAC3B,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,IACE,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;gBAC7D,MAAM,CAAC,KAAK;gBAEZ,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACvC,IAAI,EACJ,MAAM,CAAC,OAAO,EACd,QAAQ,CACT,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACnC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAC7B,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;oBACzB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;oBACzC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;oBACtC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;iBACtD,CAAC,CAAC;iBACA,CAAC;gBACJ,iDAAiD;gBACjD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;oBACzD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;oBACnE,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE;iBACjD,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;oBAC3B,MAAM,QAAQ,CAAC,qCAAqC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;gBAClC,GAAG,IAAI;gBACP,WAAW,EAAE,QAAQ;gBACrB,iBAAiB,EAAE,QAAQ;gBAC3B,iBAAiB,EAAE,IAAI;aACxB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACvE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAC7B,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB;oBAC7D,OAAO;iBACR,CAAC,CAAC;YACL,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC,CAAC;QAEJ,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAC3B,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACpB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;gBACxD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,GAAG,CAAC;oBACJ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;oBAChD,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC;oBAChC,GAAG,CAAC,OAAO,CAAC,OAAO;wBACjB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBAC3C,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;gBACJ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;oBACd,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE;oBAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE;iBACvB;aACF,CAAC,CAAC;YACH,MAAM,UAAU,GAAiB,EAAE,CAAC;YACpC,MAAM,OAAO,GAAiB,EAAE,CAAC;YACjC,MAAM,MAAM,GAAmB,EAAE,CAAC;YAClC,MAAM,OAAO,GAAiB,EAAE,CAAC;YACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,2GAA2G;gBAC3G,2CAA2C;gBAC3C,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClB,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;wBAC5B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAClE,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,QAAQ;oBAAE,SAAS;gBAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ;oBAC5B,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC;oBAC5C,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,MAAM,GACV,OAAO,CAAC,QAAQ;oBAChB,KAAK;oBACL,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC;wBAC5C,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAClE,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;oBACzB,MAAM,EAAE,YAAY;oBACpB,WAAW,EAAE,OAAO,CAAC,QAAQ;oBAC7B,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;oBACpC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;iBAC3B,CAAC,CAAC;gBACH,IAAI,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;oBAC5D,gFAAgF;oBAChF,MAAM,CAAC,IAAI,CACT,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;wBACtB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;wBACxB,WAAW,EAAE,OAAO,CAAC,QAAQ;wBAC7B,iBAAiB,EAAE,OAAO,CAAC,QAAQ;wBACnC,iBAAiB,EAAE,IAAI;qBACxB,CAAC,CACH,CAAC;gBACJ,CAAC;qBAAM,IAAI,MAAM,EAAE,CAAC;oBAClB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE;wBAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE;wBAC3D,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;wBAC1C,iBAAiB,EAAE,OAAO,CAAC,QAAQ;wBACnC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;wBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;wBACjC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;wBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,WAAW,EACT,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;wBACjE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;qBACvB,CAAC,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACnB,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;wBAC1C,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;wBACzB,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC/D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAClD,CAAC,EAAE,KAAK,CAAC;QAEX,KAAK,CAAC,SAAS;YACb,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;gBACpD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,GAAG,CAAC;oBACJ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC;oBAChC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;iBAC1C,CAAC;gBACJ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;gBACvE,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;YACH,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,MAAM,IAAI,GAAG;gBACtB,IAAI,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/core/runs/run-tokens.d.ts

@@ -0,0 +1,21 @@
+import type { DatabaseConnection } from '@nocobase/db';
+import { type Clock } from '../../kernel/clock.js';
+import type { IdSource } from '../../kernel/ids.js';
+import { type RunRecord, type TokenRecord } from './run.store.js';
+export interface MintedToken {
+    readonly value: string;
+    readonly expiresAt: string;
+}
+export declare function mintRunToken(conn: DatabaseConnection, deps: {
+    readonly ids: IdSource;
+    readonly clock: Clock;
+}, run: RunRecord, runnerId: string): Promise<MintedToken>;
+export interface RunTokenIdentity {
+    readonly token: TokenRecord;
+    readonly run: RunRecord;
+}
+/** The run a token belongs to, while it is valid; `RUN_TOKEN_INVALID` otherwise. */
+export declare function authenticateRunToken(conn: DatabaseConnection, clock: Clock, value: string): Promise<RunTokenIdentity>;
+/** Whether `runnerId` was ever given a token for the run, that is, ever held it. */
+export declare function everHeld(conn: DatabaseConnection, runId: string, runnerId: string): Promise<boolean>;
+//# sourceMappingURL=run-tokens.d.ts.map

package/dist/server/core/runs/run-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-tokens.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/run-tokens.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAS,KAAK,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,EACvD,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,CAAC,CAkBtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CACzB;AAED,oFAAoF;AACpF,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAmB3B;AAED,oFAAoF;AACpF,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAElB"}

package/dist/server/core/runs/run-tokens.js

@@ -0,0 +1,51 @@
+/**
+ * Run tokens: the credential an agent's CLI calls the server with during its run. A token is minted when a runner
+ * claims the run, works only while that runner holds the run, and is revoked when the run leaves it (ends, or goes
+ * back to the queue).
+ */
+import { ProtocolError } from '@nocobase/agent-protocol';
+import { later } from '../../kernel/clock.js';
+import { CREDENTIAL_PREFIX, createCredential, hashCredential, } from '../../kernel/crypto.js';
+import { RUN_TOKEN_TTL_MS } from './policy.js';
+import { findRunRecord, isActive, tokensRepo, } from './run.store.js';
+export async function mintRunToken(conn, deps, run, runnerId) {
+    const now = deps.clock.now();
+    const value = createCredential(CREDENTIAL_PREFIX.runToken);
+    const expiresAt = later(now, RUN_TOKEN_TTL_MS);
+    await tokensRepo(conn).createOne({
+        values: {
+            id: deps.ids.next(),
+            tokenHash: hashCredential(value),
+            runId: run.id,
+            runnerId,
+            agentId: run.agentId,
+            actorUserId: run.actorUserId,
+            expiresAt,
+            revokedAt: null,
+            createdAt: now.toISOString(),
+        },
+    });
+    return { value, expiresAt };
+}
+/** The run a token belongs to, while it is valid; `RUN_TOKEN_INVALID` otherwise. */
+export async function authenticateRunToken(conn, clock, value) {
+    const invalid = new ProtocolError('RUN_TOKEN_INVALID', 'The run token is not valid: the run ended or moved to another runner.');
+    if (!value)
+        throw invalid;
+    const token = await tokensRepo(conn).findOne({
+        filter: { tokenHash: hashCredential(value) },
+    });
+    if (!token ||
+        token.revokedAt ||
+        Date.parse(token.expiresAt) <= clock.now().getTime())
+        throw invalid;
+    const run = await findRunRecord(conn, token.runId);
+    if (!run || !isActive(run.status) || run.runnerId !== token.runnerId)
+        throw invalid;
+    return { token, run };
+}
+/** Whether `runnerId` was ever given a token for the run, that is, ever held it. */
+export async function everHeld(conn, runId, runnerId) {
+    return tokensRepo(conn).exists({ filter: { runId, runnerId } });
+}
+//# sourceMappingURL=run-tokens.js.map

package/dist/server/core/runs/run-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-tokens.js","sourceRoot":"","sources":["../../../../server/core/runs/run-tokens.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGzD,OAAO,EAAE,KAAK,EAAc,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,QAAQ,EACR,UAAU,GAGX,MAAM,gBAAgB,CAAC;AAOxB,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAwB,EACxB,IAAuD,EACvD,GAAc,EACd,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC/C,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE;YACN,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC;YAChC,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,QAAQ;YACR,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,SAAS;YACT,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;SAC7B;KACF,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAOD,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAwB,EACxB,KAAY,EACZ,KAAa;IAEb,MAAM,OAAO,GAAG,IAAI,aAAa,CAC/B,mBAAmB,EACnB,uEAAuE,CACxE,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,MAAM,OAAO,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;QAC3C,MAAM,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE;KAC7C,CAAC,CAAC;IACH,IACE,CAAC,KAAK;QACN,KAAK,CAAC,SAAS;QACf,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;QAEpD,MAAM,OAAO,CAAC;IAChB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAClE,MAAM,OAAO,CAAC;IAChB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAwB,EACxB,KAAa,EACb,QAAgB;IAEhB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC"}