@nodetool-ai/agents 0.7.0-rc.23 → 0.8.2

package/dist/apify/policy.d.ts

@@ -0,0 +1,136 @@
+/**
+ * What this install will let an actor do — the reason this integration is not
+ * remote code execution by proxy.
+ *
+ * An Apify actor is somebody else's program, run on somebody else's machines,
+ * against a URL a model chose. Three separate things therefore have to be
+ * decided before one runs, and they are decided here rather than at the call
+ * sites so there is one place to read and one place to test:
+ *
+ *   1. **Which actors** — the mode and the allowlist.
+ *   2. **Where they may point** — URL screening of the actor's own input.
+ *   3. **How much they may spend** — the per-session budget.
+ *
+ * None of this replaces NodeTool's permission gate. Every capability in the
+ * module carries a category and goes through `run.invoke` like all the others;
+ * this is the Apify-specific layer *underneath* that gate, answering questions
+ * the generic gate has no way to ask — the gate knows "this call is external",
+ * it does not know that `compass/google-maps-extractor` is not on the list.
+ */
+/**
+ * How much of Apify this install exposes.
+ *
+ * - `disabled` — no Apify call of any kind.
+ * - `allowlist` — the shipped catalog plus whatever the operator added, and
+ *   nothing else. Store search is refused: there is no point letting a model
+ *   discover actors it cannot run. **The default.**
+ * - `discovery` — search and inspect the whole store freely; run an
+ *   allowlisted actor directly, and anything else only after the user approves
+ *   that specific actor through the normal permission prompt.
+ * - `unrestricted` — any actor, for trusted environments.
+ */
+export type ApifyPolicyMode = "disabled" | "allowlist" | "discovery" | "unrestricted";
+/** Ceilings a single session may not exceed, whatever a model asks for. */
+export interface ApifyBudget {
+    /** Actor runs one session may start. */
+    readonly maxRuns: number;
+    /** Dataset items one run may be billed for. */
+    readonly maxItems: number;
+    /** Wall clock one run may take, in seconds. */
+    readonly maxRunSeconds: number;
+    /** Memory one run may be given, in MB. */
+    readonly maxMemoryMb: number;
+    /** Total Apify spend one session may incur, in USD. */
+    readonly maxCostUsd: number;
+}
+export declare const DEFAULT_BUDGET: ApifyBudget;
+export interface ApifyPolicy {
+    readonly mode: ApifyPolicyMode;
+    /** Canonical actor ids runnable without an approval prompt. */
+    readonly allowlist: ReadonlySet<string>;
+    readonly budget: ApifyBudget;
+}
+/**
+ * Read the policy from the environment.
+ *
+ * `NODETOOL_APIFY_MODE` picks the mode and `NODETOOL_APIFY_ALLOWED_ACTORS` is
+ * a comma-separated list *added to* the shipped catalog — added rather than
+ * replacing it, because the common operator intent is "the usual ones plus
+ * mine", and a replacing list silently turns off the wrappers.
+ */
+export declare function apifyPolicyFromEnv(env?: NodeJS.ProcessEnv): ApifyPolicy;
+/** What a policy decided about running one actor. */
+export type ActorVerdict = 
+/** Run it. */
+{
+    readonly decision: "allow";
+}
+/** Run it only if the user approves this actor by name. */
+ | {
+    readonly decision: "ask";
+    readonly reason: string;
+} | {
+    readonly decision: "deny";
+    readonly reason: string;
+};
+/** Whether discovery — store search and inspecting an arbitrary actor — is on. */
+export declare function allowsDiscovery(policy: ApifyPolicy): boolean;
+/** Decide whether `actorId` may run under `policy`. */
+export declare function decideActor(policy: ApifyPolicy, actorId: string): ActorVerdict;
+/**
+ * Whether a URL an actor is being pointed at resolves somewhere public.
+ *
+ * `isSafePublicHttpsUrl` carries NodeTool's IP-range logic — loopback, RFC1918,
+ * link-local, CGNAT, cloud metadata, and the IPv6 forms that smuggle an IPv4
+ * address — and reusing it beats a second copy that drifts. It also insists on
+ * https, which is right for a download and wrong here: actors legitimately
+ * crawl plain-http sites. So the scheme is normalized to https for the *host*
+ * check and the real scheme is checked separately.
+ *
+ * Apify runs on Apify's machines, so a private address in an actor input
+ * cannot reach NodeTool's own network — unless NodeTool is reachable from the
+ * internet, which is exactly the self-hosted case, and a `.internal` hostname
+ * that only resolves inside a customer VPC is another. The check is cheap and
+ * the failure mode is expensive, so it runs regardless of who is hosting.
+ */
+export declare function isPubliclyRoutableUrl(value: string): boolean;
+/**
+ * Refuse an actor input that points anywhere non-public.
+ *
+ * The walk is over the whole input rather than a known set of URL fields:
+ * every actor names its URL field differently (`startUrls`, `url`,
+ * `directUrls`, `queries` carrying a URL), and a check that only knows
+ * `startUrls` is a check a model routes around by accident.
+ */
+export declare function assertActorInputUrlsArePublic(input: Record<string, unknown>): void;
+/**
+ * A session's running Apify spend.
+ *
+ * Per session rather than per call, because the risk being bounded is an
+ * autonomous agent looping — any single run is affordable, and it is the
+ * eleventh that is the problem. It is a plain mutable counter held by the
+ * capability run, so a workflow, a chat turn, and a Code node each get their
+ * own without any of them being able to reset another's.
+ */
+export declare class ApifyBudgetLedger {
+    #private;
+    readonly budget: ApifyBudget;
+    constructor(budget?: ApifyBudget);
+    get runs(): number;
+    get costUsd(): number;
+    /** Claim one run's slot, or refuse before anything is started or billed. */
+    reserveRun(actorId: string): void;
+    /** Record what a finished run actually cost, as Apify reported it. */
+    recordCost(usd: number | undefined): void;
+    /** Clamp a caller's run options to the budget. */
+    clampRunOptions(options: {
+        timeoutSecs?: number;
+        memoryMbytes?: number;
+        maxItems?: number;
+    }): {
+        timeoutSecs: number;
+        memoryMbytes: number | undefined;
+        maxItems: number;
+    };
+}
+//# sourceMappingURL=policy.d.ts.map

package/dist/apify/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/apify/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GACvB,UAAU,GACV,WAAW,GACX,WAAW,GACX,cAAc,CAAC;AASnB,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,cAAc,EAAE,WAM5B,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AASD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,CAkCb;AAED,qDAAqD;AACrD,MAAM,MAAM,YAAY;AACtB,cAAc;AACZ;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE;AAChC,2DAA2D;GACzD;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAE5D;AAED,uDAAuD;AACvD,wBAAgB,WAAW,CACzB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,GACd,YAAY,CA2Bd;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAW5D;AAmBD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,IAAI,CAWN;AAED;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;;IAG5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAE7B,YAAY,MAAM,GAAE,WAA4B,EAE/C;IAED,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,4EAA4E;IAC5E,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAkBhC;IAED,sEAAsE;IACtE,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAIxC;IAED,kDAAkD;IAClD,eAAe,CAAC,OAAO,EAAE;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG;QACF,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,QAAQ,EAAE,MAAM,CAAC;KAClB,CAeA;CACF"}

package/dist/apify/policy.js

@@ -0,0 +1,223 @@
+/**
+ * What this install will let an actor do — the reason this integration is not
+ * remote code execution by proxy.
+ *
+ * An Apify actor is somebody else's program, run on somebody else's machines,
+ * against a URL a model chose. Three separate things therefore have to be
+ * decided before one runs, and they are decided here rather than at the call
+ * sites so there is one place to read and one place to test:
+ *
+ *   1. **Which actors** — the mode and the allowlist.
+ *   2. **Where they may point** — URL screening of the actor's own input.
+ *   3. **How much they may spend** — the per-session budget.
+ *
+ * None of this replaces NodeTool's permission gate. Every capability in the
+ * module carries a category and goes through `run.invoke` like all the others;
+ * this is the Apify-specific layer *underneath* that gate, answering questions
+ * the generic gate has no way to ask — the gate knows "this call is external",
+ * it does not know that `compass/google-maps-extractor` is not on the list.
+ */
+import { isSafePublicHttpsUrl } from "@nodetool-ai/runtime";
+import { ApifyError } from "./errors.js";
+import { CATALOG_ACTOR_IDS } from "./catalog.js";
+import { toCanonicalActorId } from "./client.js";
+import { isRecord, isString } from "../utils/type-guards.js";
+const MODES = new Set([
+    "disabled",
+    "allowlist",
+    "discovery",
+    "unrestricted"
+]);
+export const DEFAULT_BUDGET = {
+    maxRuns: 10,
+    maxItems: 1000,
+    maxRunSeconds: 300,
+    maxMemoryMb: 4096,
+    maxCostUsd: 5
+};
+function positiveNumberEnv(name, fallback) {
+    const raw = process.env[name];
+    if (raw === undefined)
+        return fallback;
+    const value = Number(raw);
+    return Number.isFinite(value) && value > 0 ? value : fallback;
+}
+/**
+ * Read the policy from the environment.
+ *
+ * `NODETOOL_APIFY_MODE` picks the mode and `NODETOOL_APIFY_ALLOWED_ACTORS` is
+ * a comma-separated list *added to* the shipped catalog — added rather than
+ * replacing it, because the common operator intent is "the usual ones plus
+ * mine", and a replacing list silently turns off the wrappers.
+ */
+export function apifyPolicyFromEnv(env = process.env) {
+    const raw = (env.NODETOOL_APIFY_MODE ?? "").trim().toLowerCase();
+    // Discovery is the default: the shipped catalog runs directly, and any
+    // other actor asks the user through the ordinary permission gate before it
+    // spends anything. An operator narrows it with `allowlist` or `disabled`.
+    const mode = (MODES.has(raw) ? raw : "discovery");
+    const extra = (env.NODETOOL_APIFY_ALLOWED_ACTORS ?? "")
+        .split(",")
+        .map((id) => toCanonicalActorId(id).trim())
+        .filter((id) => id.length > 0);
+    return {
+        mode,
+        allowlist: new Set([...CATALOG_ACTOR_IDS, ...extra]),
+        budget: {
+            maxRuns: positiveNumberEnv("NODETOOL_APIFY_MAX_RUNS", DEFAULT_BUDGET.maxRuns),
+            maxItems: positiveNumberEnv("NODETOOL_APIFY_MAX_ITEMS", DEFAULT_BUDGET.maxItems),
+            maxRunSeconds: positiveNumberEnv("NODETOOL_APIFY_MAX_RUN_SECONDS", DEFAULT_BUDGET.maxRunSeconds),
+            maxMemoryMb: positiveNumberEnv("NODETOOL_APIFY_MAX_MEMORY_MB", DEFAULT_BUDGET.maxMemoryMb),
+            maxCostUsd: positiveNumberEnv("NODETOOL_APIFY_MAX_COST_USD", DEFAULT_BUDGET.maxCostUsd)
+        }
+    };
+}
+/** Whether discovery — store search and inspecting an arbitrary actor — is on. */
+export function allowsDiscovery(policy) {
+    return policy.mode === "discovery" || policy.mode === "unrestricted";
+}
+/** Decide whether `actorId` may run under `policy`. */
+export function decideActor(policy, actorId) {
+    const id = toCanonicalActorId(actorId);
+    if (policy.mode === "disabled") {
+        return {
+            decision: "deny",
+            reason: "The Apify integration is disabled on this install " +
+                "(NODETOOL_APIFY_MODE=disabled)."
+        };
+    }
+    if (policy.mode === "unrestricted" || policy.allowlist.has(id)) {
+        return { decision: "allow" };
+    }
+    if (policy.mode === "discovery") {
+        return {
+            decision: "ask",
+            reason: `${id} is not on this install's Apify allowlist and needs approval before it runs.`
+        };
+    }
+    return {
+        decision: "deny",
+        reason: `${id} is not on this install's Apify allowlist. Allowed actors: ` +
+            `${[...policy.allowlist].sort().join(", ")}. An operator can add one ` +
+            "with NODETOOL_APIFY_ALLOWED_ACTORS, or unset NODETOOL_APIFY_MODE " +
+            "(default: discovery) to approve actors per run."
+    };
+}
+/**
+ * Whether a URL an actor is being pointed at resolves somewhere public.
+ *
+ * `isSafePublicHttpsUrl` carries NodeTool's IP-range logic — loopback, RFC1918,
+ * link-local, CGNAT, cloud metadata, and the IPv6 forms that smuggle an IPv4
+ * address — and reusing it beats a second copy that drifts. It also insists on
+ * https, which is right for a download and wrong here: actors legitimately
+ * crawl plain-http sites. So the scheme is normalized to https for the *host*
+ * check and the real scheme is checked separately.
+ *
+ * Apify runs on Apify's machines, so a private address in an actor input
+ * cannot reach NodeTool's own network — unless NodeTool is reachable from the
+ * internet, which is exactly the self-hosted case, and a `.internal` hostname
+ * that only resolves inside a customer VPC is another. The check is cheap and
+ * the failure mode is expensive, so it runs regardless of who is hosting.
+ */
+export function isPubliclyRoutableUrl(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        return false;
+    const asHttps = new URL(parsed.toString());
+    asHttps.protocol = "https:";
+    return isSafePublicHttpsUrl(asHttps.toString());
+}
+/** Every string in `value` that parses as a URL, at any depth. */
+function collectUrls(value, found = []) {
+    if (isString(value)) {
+        if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value.trim()))
+            found.push(value.trim());
+        return found;
+    }
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            collectUrls(entry, found);
+        return found;
+    }
+    if (isRecord(value)) {
+        for (const entry of Object.values(value))
+            collectUrls(entry, found);
+        return found;
+    }
+    return found;
+}
+/**
+ * Refuse an actor input that points anywhere non-public.
+ *
+ * The walk is over the whole input rather than a known set of URL fields:
+ * every actor names its URL field differently (`startUrls`, `url`,
+ * `directUrls`, `queries` carrying a URL), and a check that only knows
+ * `startUrls` is a check a model routes around by accident.
+ */
+export function assertActorInputUrlsArePublic(input) {
+    for (const url of collectUrls(input)) {
+        if (!isPubliclyRoutableUrl(url)) {
+            throw new ApifyError("invalid_input", `Refusing to point an Apify actor at ${url}: actor inputs may only ` +
+                "target public http(s) addresses, not loopback, private-network, " +
+                "or cloud-metadata destinations.");
+        }
+    }
+}
+/**
+ * A session's running Apify spend.
+ *
+ * Per session rather than per call, because the risk being bounded is an
+ * autonomous agent looping — any single run is affordable, and it is the
+ * eleventh that is the problem. It is a plain mutable counter held by the
+ * capability run, so a workflow, a chat turn, and a Code node each get their
+ * own without any of them being able to reset another's.
+ */
+export class ApifyBudgetLedger {
+    #runs = 0;
+    #costUsd = 0;
+    budget;
+    constructor(budget = DEFAULT_BUDGET) {
+        this.budget = budget;
+    }
+    get runs() {
+        return this.#runs;
+    }
+    get costUsd() {
+        return this.#costUsd;
+    }
+    /** Claim one run's slot, or refuse before anything is started or billed. */
+    reserveRun(actorId) {
+        if (this.#runs >= this.budget.maxRuns) {
+            throw new ApifyError("budget_exceeded", `This session has already started ${this.#runs} Apify runs, its limit. ` +
+                `Refusing to start ${actorId}.`, { actorId });
+        }
+        if (this.#costUsd >= this.budget.maxCostUsd) {
+            throw new ApifyError("budget_exceeded", `This session has spent $${this.#costUsd.toFixed(2)} on Apify, its ` +
+                `limit of $${this.budget.maxCostUsd.toFixed(2)}.`, { actorId });
+        }
+        this.#runs += 1;
+    }
+    /** Record what a finished run actually cost, as Apify reported it. */
+    recordCost(usd) {
+        if (typeof usd === "number" && Number.isFinite(usd) && usd > 0) {
+            this.#costUsd += usd;
+        }
+    }
+    /** Clamp a caller's run options to the budget. */
+    clampRunOptions(options) {
+        return {
+            timeoutSecs: Math.min(options.timeoutSecs ?? this.budget.maxRunSeconds, this.budget.maxRunSeconds),
+            memoryMbytes: options.memoryMbytes === undefined
+                ? undefined
+                : Math.min(options.memoryMbytes, this.budget.maxMemoryMb),
+            maxItems: Math.min(options.maxItems ?? this.budget.maxItems, this.budget.maxItems)
+        };
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/apify/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/apify/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAoB7D,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAgBH,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,GAAG;IAClB,WAAW,EAAE,IAAI;IACjB,UAAU,EAAE,CAAC;CACd,CAAC;AASF,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAoB,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,6BAA6B,IAAI,EAAE,CAAC;SACpD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC1C,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEjC,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,iBAAiB,EAAE,GAAG,KAAK,CAAC,CAAC;QACpD,MAAM,EAAE;YACN,OAAO,EAAE,iBAAiB,CAAC,yBAAyB,EAAE,cAAc,CAAC,OAAO,CAAC;YAC7E,QAAQ,EAAE,iBAAiB,CACzB,0BAA0B,EAC1B,cAAc,CAAC,QAAQ,CACxB;YACD,aAAa,EAAE,iBAAiB,CAC9B,gCAAgC,EAChC,cAAc,CAAC,aAAa,CAC7B;YACD,WAAW,EAAE,iBAAiB,CAC5B,8BAA8B,EAC9B,cAAc,CAAC,WAAW,CAC3B;YACD,UAAU,EAAE,iBAAiB,CAC3B,6BAA6B,EAC7B,cAAc,CAAC,UAAU,CAC1B;SACF;KACF,CAAC;AACJ,CAAC;AAUD,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,MAAmB;IACjD,OAAO,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC;AACvE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,WAAW,CACzB,MAAmB,EACnB,OAAe;IAEf,MAAM,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EACJ,oDAAoD;gBACpD,iCAAiC;SACpC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,GAAG,EAAE,8EAA8E;SAC5F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM;QAChB,MAAM,EACJ,GAAG,EAAE,6DAA6D;YAClE,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B;YACtE,mEAAmE;YACnE,iDAAiD;KACpD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC5B,OAAO,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,KAAc,EAAE,KAAK,GAAa,EAAE;IACvD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAA8B;IAE9B,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,uCAAuC,GAAG,0BAA0B;gBAClE,kEAAkE;gBAClE,iCAAiC,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IAC5B,KAAK,GAAG,CAAC,CAAC;IACV,QAAQ,GAAG,CAAC,CAAC;IACJ,MAAM,CAAc;IAE7B,YAAY,MAAM,GAAgB,cAAc;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,4EAA4E;IAC5E,UAAU,CAAC,OAAe;QACxB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,oCAAoC,IAAI,CAAC,KAAK,0BAA0B;gBACtE,qBAAqB,OAAO,GAAG,EACjC,EAAE,OAAO,EAAE,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,2BAA2B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB;gBAClE,aAAa,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EACnD,EAAE,OAAO,EAAE,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,UAAU,CAAC,GAAuB;QAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;QACvB,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,eAAe,CAAC,OAIf;QAKC,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,GAAG,CACnB,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAC1B;YACD,YAAY,EACV,OAAO,CAAC,YAAY,KAAK,SAAS;gBAChC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7D,QAAQ,EAAE,IAAI,CAAC,GAAG,CAChB,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CACrB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/apify/run.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Starting an actor, waiting for it, and cancelling it — the part with the
+ * money and the clock in it.
+ *
+ * The lifecycle is start → poll → collect, and each step exists to answer a
+ * failure the others cannot. Polling rather than a synchronous run is what
+ * makes the run *abortable*: the run id exists from the first response, so a
+ * NodeTool cancellation has something concrete to abort on Apify's side rather
+ * than merely abandoning an HTTP request while the actor keeps billing.
+ *
+ * Cancellation is the reason this file is not three inline calls in the
+ * capability. When the run signal fires mid-poll, the wait unwinds — but the
+ * *actor* is still running on Apify's machines, and something has to send the
+ * abort. That cleanup deliberately runs on a fresh, un-aborted path, because
+ * the obvious implementation (pass the caller's signal to the abort request)
+ * cancels the cleanup with the thing it is cleaning up.
+ */
+import type { ProcessingContext } from "@nodetool-ai/runtime";
+import { ApifyClient, type ApifyRun } from "./client.js";
+import { ApifyError } from "./errors.js";
+import { type ApifyBudgetLedger, type ApifyPolicy } from "./policy.js";
+import type { ApifyProvenance } from "./normalize.js";
+export interface RunActorOptions {
+    readonly actorId: string;
+    readonly input: Record<string, unknown>;
+    /** Wait for the run to settle. False returns as soon as it is accepted. */
+    readonly waitForFinish?: boolean;
+    /** Wall-clock ceiling for the wait, in seconds. Clamped to the budget. */
+    readonly timeoutSecs?: number;
+    readonly memoryMbytes?: number;
+    readonly maxItems?: number;
+    readonly build?: string;
+}
+export interface RunActorResult {
+    readonly run: ApifyRun;
+    readonly provenance: ApifyProvenance;
+}
+/** Ask the user about one actor the allowlist does not cover. */
+export type ApproveActor = (actorId: string, reason: string) => Promise<boolean>;
+/**
+ * Decide, start, and (optionally) wait.
+ *
+ * The order of the three checks is the point: the policy decides *before* the
+ * budget is charged, and the budget is claimed *before* the run is started, so
+ * a refused actor costs nothing and a refused budget starts nothing. Reversing
+ * either would mean discovering the answer after the money was spent.
+ */
+export declare function runActor(client: ApifyClient, policy: ApifyPolicy, ledger: ApifyBudgetLedger, options: RunActorOptions, hooks?: {
+    signal?: AbortSignal;
+    approve?: ApproveActor;
+    onStatus?: (run: ApifyRun) => void;
+}): Promise<RunActorResult>;
+/**
+ * Poll until the run settles, the deadline passes, or the caller cancels.
+ *
+ * The interval backs off from 2s to 10s. A poll is an HTTP request against a
+ * rate-limited API, and an actor that takes ten minutes does not need three
+ * hundred of them to be noticed finishing.
+ */
+export declare function waitForRun(client: ApifyClient, started: ApifyRun, timeoutSecs: number, hooks?: {
+    signal?: AbortSignal;
+    onStatus?: (run: ApifyRun) => void;
+}): Promise<ApifyRun>;
+/**
+ * Abort without letting the abort's own failure replace the real error.
+ *
+ * Every caller here is already on a failure path — cancelled, or timed out —
+ * and that is the error worth reporting. A network blip while sending the
+ * abort must not mask it.
+ */
+export declare function abortQuietly(client: ApifyClient, runId: string): Promise<void>;
+/** Build the provenance record carried alongside an actor's output. */
+export declare function provenanceOf(actorId: string, run: ApifyRun): ApifyProvenance;
+/**
+ * Resolve the Apify token for a run.
+ *
+ * `APIFY_API_TOKEN` is Apify's own name for it and the one the docs and the
+ * settings page use; `APIFY_API_KEY` is what this install shipped first and is
+ * still read so an upgrade does not silently switch Apify off. The value is
+ * returned to exactly one caller — the client constructor — and never stored
+ * anywhere a result, a log, or the guest can reach.
+ */
+export declare function resolveApifyToken(context: Pick<ProcessingContext, "getSecret">): Promise<string>;
+/** Wrap an unknown failure so callers always see a classified Apify error. */
+export declare function toApifyFailure(value: unknown): ApifyError;
+//# sourceMappingURL=run.d.ts.map

package/dist/apify/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/apify/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EACL,WAAW,EAGX,KAAK,QAAQ,EACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQtD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;CACtC;AAED,iEAAiE;AACjE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjF;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,eAAe,EACxB,KAAK,GAAE;IACL,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAC;CAC/B,GACL,OAAO,CAAC,cAAc,CAAC,CAoDzB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,QAAQ,EACjB,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE;IACL,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAC;CAC/B,GACL,OAAO,CAAC,QAAQ,CAAC,CA6CnB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,QAAQ,GACZ,eAAe,CAUjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAC5C,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAEzD"}

package/dist/apify/run.js

@@ -0,0 +1,158 @@
+/**
+ * Starting an actor, waiting for it, and cancelling it — the part with the
+ * money and the clock in it.
+ *
+ * The lifecycle is start → poll → collect, and each step exists to answer a
+ * failure the others cannot. Polling rather than a synchronous run is what
+ * makes the run *abortable*: the run id exists from the first response, so a
+ * NodeTool cancellation has something concrete to abort on Apify's side rather
+ * than merely abandoning an HTTP request while the actor keeps billing.
+ *
+ * Cancellation is the reason this file is not three inline calls in the
+ * capability. When the run signal fires mid-poll, the wait unwinds — but the
+ * *actor* is still running on Apify's machines, and something has to send the
+ * abort. That cleanup deliberately runs on a fresh, un-aborted path, because
+ * the obvious implementation (pass the caller's signal to the abort request)
+ * cancels the cleanup with the thing it is cleaning up.
+ */
+import { setTimeout as delay } from "node:timers/promises";
+import { isTerminalRunStatus, toCanonicalActorId } from "./client.js";
+import { ApifyError, asApifyError } from "./errors.js";
+import { assertActorInputUrlsArePublic, decideActor } from "./policy.js";
+/** How often a running actor is polled. */
+const POLL_INTERVAL_MS = 2_000;
+/** How long the interval grows to for a long run, so a slow actor is cheap. */
+const MAX_POLL_INTERVAL_MS = 10_000;
+/**
+ * Decide, start, and (optionally) wait.
+ *
+ * The order of the three checks is the point: the policy decides *before* the
+ * budget is charged, and the budget is claimed *before* the run is started, so
+ * a refused actor costs nothing and a refused budget starts nothing. Reversing
+ * either would mean discovering the answer after the money was spent.
+ */
+export async function runActor(client, policy, ledger, options, hooks = {}) {
+    const actorId = toCanonicalActorId(options.actorId);
+    const verdict = decideActor(policy, actorId);
+    if (verdict.decision === "deny") {
+        throw new ApifyError("actor_not_allowed", verdict.reason, { actorId });
+    }
+    if (verdict.decision === "ask") {
+        const approved = hooks.approve === undefined
+            ? false
+            : await hooks.approve(actorId, verdict.reason);
+        if (!approved) {
+            throw new ApifyError("actor_not_allowed", hooks.approve === undefined
+                ? `${verdict.reason} This surface cannot ask for approval, so the run was refused.`
+                : `Running ${actorId} was not approved.`, { actorId });
+        }
+    }
+    assertActorInputUrlsArePublic(options.input);
+    const clamped = ledger.clampRunOptions({
+        timeoutSecs: options.timeoutSecs,
+        memoryMbytes: options.memoryMbytes,
+        maxItems: options.maxItems
+    });
+    ledger.reserveRun(actorId);
+    let run = await client.startRun({
+        actorId,
+        input: options.input,
+        timeoutSecs: clamped.timeoutSecs,
+        maxItems: clamped.maxItems,
+        memoryMbytes: clamped.memoryMbytes,
+        build: options.build
+    }, hooks.signal);
+    hooks.onStatus?.(run);
+    if (options.waitForFinish !== false) {
+        run = await waitForRun(client, run, clamped.timeoutSecs, hooks);
+    }
+    ledger.recordCost(run.usageTotalUsd);
+    return { run, provenance: provenanceOf(actorId, run) };
+}
+/**
+ * Poll until the run settles, the deadline passes, or the caller cancels.
+ *
+ * The interval backs off from 2s to 10s. A poll is an HTTP request against a
+ * rate-limited API, and an actor that takes ten minutes does not need three
+ * hundred of them to be noticed finishing.
+ */
+export async function waitForRun(client, started, timeoutSecs, hooks = {}) {
+    const deadline = Date.now() + timeoutSecs * 1000;
+    let run = started;
+    let interval = POLL_INTERVAL_MS;
+    while (!isTerminalRunStatus(run.status)) {
+        if (hooks.signal?.aborted === true) {
+            // The wait is over, but the actor is not. Abort it on a path that does
+            // not carry the signal that just fired, or the cleanup cancels itself.
+            await abortQuietly(client, run.id);
+            throw new ApifyError("cancelled", `The run was cancelled; Apify run ${run.id} was aborted.`, { runId: run.id, actorId: run.actId });
+        }
+        if (Date.now() > deadline) {
+            await abortQuietly(client, run.id);
+            throw new ApifyError("run_timed_out", `Apify run ${run.id} did not finish within ${timeoutSecs}s and was aborted.`, { runId: run.id, actorId: run.actId });
+        }
+        // Never rejects: an abort here is handled by the check at the top of the
+        // loop, which also aborts the actor.
+        await delay(interval, undefined, { signal: hooks.signal }).catch(() => undefined);
+        interval = Math.min(interval * 1.5, MAX_POLL_INTERVAL_MS);
+        run = await client.getRun(run.id, hooks.signal);
+        hooks.onStatus?.(run);
+    }
+    if (run.status !== "SUCCEEDED") {
+        throw new ApifyError(run.status === "ABORTED" ? "run_aborted" : "run_failed", `Apify run ${run.id} ended as ${run.status}` +
+            (run.statusMessage === undefined ? "." : `: ${run.statusMessage}`), { runId: run.id, actorId: run.actId });
+    }
+    return run;
+}
+/**
+ * Abort without letting the abort's own failure replace the real error.
+ *
+ * Every caller here is already on a failure path — cancelled, or timed out —
+ * and that is the error worth reporting. A network blip while sending the
+ * abort must not mask it.
+ */
+export async function abortQuietly(client, runId) {
+    try {
+        await client.abortRun(runId);
+    }
+    catch {
+        // Best-effort: the run may already have finished, or the network may be
+        // gone. Either way the caller's original failure is the one to surface.
+    }
+}
+/** Build the provenance record carried alongside an actor's output. */
+export function provenanceOf(actorId, run) {
+    return {
+        actor_id: toCanonicalActorId(actorId),
+        run_id: run.id,
+        retrieved_at: new Date().toISOString(),
+        dataset_id: run.defaultDatasetId,
+        key_value_store_id: run.defaultKeyValueStoreId,
+        status: run.status,
+        cost_usd: run.usageTotalUsd
+    };
+}
+/**
+ * Resolve the Apify token for a run.
+ *
+ * `APIFY_API_TOKEN` is Apify's own name for it and the one the docs and the
+ * settings page use; `APIFY_API_KEY` is what this install shipped first and is
+ * still read so an upgrade does not silently switch Apify off. The value is
+ * returned to exactly one caller — the client constructor — and never stored
+ * anywhere a result, a log, or the guest can reach.
+ */
+export async function resolveApifyToken(context) {
+    for (const name of ["APIFY_API_TOKEN", "APIFY_API_KEY"]) {
+        const fromContext = await context.getSecret(name).catch(() => null);
+        const value = fromContext ?? process.env[name];
+        if (typeof value === "string" && value.trim().length > 0)
+            return value;
+    }
+    throw new ApifyError("auth", "No Apify API token is configured. Add APIFY_API_TOKEN in Settings → " +
+        "Secrets (get one at https://console.apify.com/account/integrations).");
+}
+/** Wrap an unknown failure so callers always see a classified Apify error. */
+export function toApifyFailure(value) {
+    return asApifyError(value);
+}
+//# sourceMappingURL=run.js.map

package/dist/apify/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/apify/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAI3D,OAAO,EAEL,mBAAmB,EACnB,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACL,6BAA6B,EAC7B,WAAW,EAGZ,MAAM,aAAa,CAAC;AAGrB,2CAA2C;AAC3C,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAsBpC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAmB,EACnB,MAAmB,EACnB,MAAyB,EACzB,OAAwB,EACxB,KAAK,GAID,EAAE;IAEN,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,KAAK,SAAS;YACzB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,UAAU,CAClB,mBAAmB,EACnB,KAAK,CAAC,OAAO,KAAK,SAAS;gBACzB,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,gEAAgE;gBACnF,CAAC,CAAC,WAAW,OAAO,oBAAoB,EAC1C,EAAE,OAAO,EAAE,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6BAA6B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC;QACrC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE3B,IAAI,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAC7B;QACE,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,EACD,KAAK,CAAC,MAAM,CACb,CAAC;IACF,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAEtB,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAmB,EACnB,OAAiB,EACjB,WAAmB,EACnB,KAAK,GAGD,EAAE;IAEN,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC;IACjD,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,IAAI,QAAQ,GAAG,gBAAgB,CAAC;IAEhC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YACnC,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,IAAI,UAAU,CAClB,WAAW,EACX,oCAAoC,GAAG,CAAC,EAAE,eAAe,EACzD,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,aAAa,GAAG,CAAC,EAAE,0BAA0B,WAAW,oBAAoB,EAC5E,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CACtC,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,qCAAqC;QACrC,MAAM,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAC9D,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAE1D,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAClB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,EACvD,aAAa,GAAG,CAAC,EAAE,aAAa,GAAG,CAAC,MAAM,EAAE;YAC1C,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC,EACpE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAmB,EACnB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,wEAAwE;IAC1E,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,GAAa;IAEb,OAAO;QACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC;QACrC,MAAM,EAAE,GAAG,CAAC,EAAE;QACd,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,UAAU,EAAE,GAAG,CAAC,gBAAgB;QAChC,kBAAkB,EAAE,GAAG,CAAC,sBAAsB;QAC9C,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,aAAa;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA6C;IAE7C,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,UAAU,CAClB,MAAM,EACN,sEAAsE;QACpE,sEAAsE,CACzE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}