@opengeni/contracts 4.1.0 → 5.0.0

package/dist/host-mcp-bindings.js

@@ -1,15 +1,15 @@
 import {
-  ConnectionUseAuthoritySnapshot,
-  IssueConnectionUseGrantRequest
-} from "./chunk-J6QIYKO5.js";
+  ConnectionUseAuthoritySnapshot
+} from "./chunk-KUCZDFJ5.js";
 import {
   HostMcpCreateSelections,
+  ManagedUserResourceGrantMode,
   McpServerConnectionRef,
   SessionTenancyVisibility,
   stableJson
-} from "./chunk-HR6NB3CA.js";
+} from "./chunk-CM7E7PFV.js";
 import "./chunk-YBW5JSA3.js";
-import "./chunk-O5LEQHDM.js";
+import "./chunk-ENJTPHKP.js";
 import "./chunk-GRG7PHWQ.js";
 import "./chunk-RKX3NQYS.js";
 import "./chunk-MRWYRAS5.js";
@@ -19,10 +19,10 @@ import "./chunk-YRKRZ6OF.js";
 import "./chunk-JUFK3T4Q.js";
 import "./chunk-M5ZGRVIQ.js";
 import "./chunk-BCS7WHCK.js";
-import "./chunk-5LYFSZ7O.js";
+import "./chunk-YJEOWXOE.js";
 import "./chunk-Y3KNXVTD.js";
-import "./chunk-D2HKF2EF.js";
 import "./chunk-TXTQIYCV.js";
+import "./chunk-D2HKF2EF.js";
 import "./chunk-RIY7GYQS.js";
 import "./chunk-MYBZRDTY.js";
 import "./chunk-PX3VCKAU.js";
@@ -99,7 +99,33 @@ var CreateHostMcpBindingRequest = z.object({
   operationId: z.string().uuid(),
   definition: HostMcpBindingDefinition
 }).strict();
-var HostMcpDelegationGrant = IssueConnectionUseGrantRequest.superRefine((value, context) => {
+var HostMcpGrantRequest = z.object({
+  scope: z.literal("user"),
+  mode: ManagedUserResourceGrantMode,
+  context: SessionTenancyVisibility,
+  sessionId: z.string().uuid().nullable().optional(),
+  expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),
+  workspaceSharedAcknowledged: z.boolean().default(false)
+}).strict().superRefine((value, context) => {
+  if (value.context === "workspace_shared" && !value.workspaceSharedAcknowledged) {
+    context.addIssue({
+      code: "custom",
+      path: ["workspaceSharedAcknowledged"],
+      message: "workspace_shared requires durable shared-output acknowledgement"
+    });
+  }
+  if (value.mode === "always" && (value.sessionId || value.expectedAuthorityEpoch)) {
+    context.addIssue({ code: "custom", path: ["sessionId"], message: "always is unbound" });
+  }
+  if (value.mode === "session" && (!value.sessionId || !value.expectedAuthorityEpoch)) {
+    context.addIssue({
+      code: "custom",
+      path: ["sessionId"],
+      message: "session requires a target session and expectedAuthorityEpoch"
+    });
+  }
+});
+var HostMcpDelegationGrant = HostMcpGrantRequest.superRefine((value, context) => {
   if (Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) || value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch)) {
     context.addIssue({
       code: "custom",

package/dist/host-mcp-bindings.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/host-mcp-bindings.ts"],"sourcesContent":["import { z } from \"zod\";\nexport { HostMcpCreateSelections, type HostMcpCreateSelection } from \"./index\";\nimport { McpServerConnectionRef, SessionTenancyVisibility, stableJson } from \"./index\";\nimport {\n  ConnectionUseAuthoritySnapshot,\n  IssueConnectionUseGrantRequest,\n} from \"./connection-authority\";\nimport { ExternalIdentity } from \"./external-identities\";\nexport const HostMcpOwnerSubject = z.union([\n  ExternalIdentity.shape.subjectId,\n  z\n    .string()\n    .max(4096)\n    .regex(/^user:[^\\r\\n\\u0000]+$/),\n]);\n\n/** Credential-free, immutable destination and host connection selection. */\nexport const HostMcpBindingDefinition = z\n  .object({\n    serverId: z.string().min(1).max(256),\n    destinationUrl: z\n      .string()\n      .url()\n      .max(4096)\n      .refine((value) => {\n        const url = new URL(value);\n        return url.protocol === \"https:\" && !url.username && !url.password && !url.hash;\n      }, \"Host binding requires an HTTPS destination without userinfo or fragment\")\n      .transform((value) => new URL(value).toString()),\n    connectionRef: McpServerConnectionRef,\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.connectionRef.hostBinding)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\", \"hostBinding\"],\n        message: \"A binding definition cannot reference another binding\",\n      });\n    if (value.connectionRef.authoritySource !== \"host\" || !value.connectionRef.connectionId)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\"],\n        message: \"Explicit host connection authority is required\",\n      });\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536)\n      context.addIssue({ code: \"custom\", message: \"Host binding definition exceeds 64 KiB\" });\n  });\nexport type HostMcpBindingDefinition = z.infer<typeof HostMcpBindingDefinition>;\n\n/** Configuration ceiling, never execution authority. The complete destination\n * and provider/scope/resource selection stay exact; only the account identifier\n * is chosen by a captured owner grant in explicit accepted-turn mode. */\nexport type HostMcpBindingSelection = {\n  serverId: string;\n  destinationUrl: string;\n  connectionRef: McpServerConnectionRef;\n};\n\nexport function hostMcpBindingMatchesSelection(\n  binding: { id: string; generation: number; definition: HostMcpBindingDefinition },\n  selection: HostMcpBindingSelection,\n): boolean {\n  const parsed = McpServerConnectionRef.safeParse(selection.connectionRef);\n  if (!parsed.success || !parsed.data.hostBinding) return false;\n  const { hostBinding, ...configuredRef } = parsed.data;\n  const definition = HostMcpBindingDefinition.safeParse(binding.definition);\n  if (!definition.success) return false;\n  let destinationUrl: string;\n  try {\n    destinationUrl = new URL(selection.destinationUrl).toString();\n  } catch {\n    return false;\n  }\n  if (\n    selection.serverId !== definition.data.serverId ||\n    destinationUrl !== definition.data.destinationUrl\n  )\n    return false;\n  if (\"selection\" in hostBinding) {\n    const { connectionId: _connectionId, ...selectedRef } = definition.data.connectionRef;\n    return stableJson(configuredRef) === stableJson(selectedRef);\n  }\n  return (\n    binding.id === hostBinding.bindingId &&\n    binding.generation === hostBinding.generation &&\n    stableJson(configuredRef) === stableJson(definition.data.connectionRef)\n  );\n}\n\nexport const HostMcpBinding = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    authorizationRevision: z.number().int().positive().safe(),\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    definition: HostMcpBindingDefinition,\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpBinding = z.infer<typeof HostMcpBinding>;\n\nexport const CreateHostMcpBindingRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    definition: HostMcpBindingDefinition,\n  })\n  .strict();\nexport type CreateHostMcpBindingRequest = z.infer<typeof CreateHostMcpBindingRequest>;\n\n/** Internal owner-authorized issuance; never itself proves caller identity. */\nconst HostMcpDelegationGrant = IssueConnectionUseGrantRequest.superRefine((value, context) => {\n  if (\n    Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) ||\n    (value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch))\n  ) {\n    context.addIssue({\n      code: \"custom\",\n      message: \"Host session grants require a matching safe authority epoch\",\n    });\n  }\n});\nexport const IssueHostMcpDelegationRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    bindingId: z.string().uuid(),\n    expectedBindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n  })\n  .strict();\nexport type IssueHostMcpDelegationRequest = z.infer<typeof IssueHostMcpDelegationRequest>;\n\nexport const HostMcpDelegation = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpDelegation = z.infer<typeof HostMcpDelegation>;\n\n/** Internal admission evidence, not a caller-supplied permission or credential.\n * Persistence must construct this from live authenticated authority and freeze\n * it with accepted work. Runtime use must independently revalidate that work,\n * membership, binding and delegation. No API key is retained as execution rights.\n */\nexport const HostMcpAcceptedAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive().safe(),\n    acceptedWork: ConnectionUseAuthoritySnapshot.shape.acceptedWork,\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    scheduledOrigin: z\n      .object({\n        taskId: z.string().uuid(),\n        taskAuthorityRevision: z.number().int().positive().safe(),\n        runId: z.string().uuid(),\n      })\n      .strict()\n      .optional(),\n    source: z.discriminatedUnion(\"kind\", [\n      z.object({ kind: z.literal(\"direct\") }).strict(),\n      z.object({ kind: z.literal(\"scheduled_task\") }).strict(),\n      z\n        .object({\n          kind: z.literal(\"child_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n      z\n        .object({\n          kind: z.literal(\"inherited_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n    ]),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      (value.source.kind === \"direct\" && value.scheduledOrigin) ||\n      (value.source.kind === \"scheduled_task\" &&\n        (!value.scheduledOrigin ||\n          value.acceptedWork.kind !== \"scheduled_task\" ||\n          value.scheduledOrigin.taskId !== value.acceptedWork.taskId ||\n          value.scheduledOrigin.runId !== value.acceptedWork.runId ||\n          value.scheduledOrigin.taskAuthorityRevision !== value.acceptedWork.taskAuthorityRevision))\n    )\n      context.addIssue({\n        code: \"custom\",\n        message: \"Scheduled host authority must retain its exact run origin\",\n      });\n    if (\n      value.acceptedWork.kind === \"turn\" &&\n      value.source.kind === \"inherited_turn\" &&\n      value.acceptedWork.turnId === value.source.turnId\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"source\"],\n        message: \"Accepted work cannot inherit from itself\",\n      });\n    }\n    if (\n      value.acceptedWork.kind === \"scheduled_task\" &&\n      !Number.isSafeInteger(value.acceptedWork.taskAuthorityRevision)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"acceptedWork\"],\n        message: \"Task authority revision must be a safe integer\",\n      });\n    }\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536) {\n      context.addIssue({ code: \"custom\", message: \"Host accepted authority exceeds 64 KiB\" });\n    }\n  });\nexport type HostMcpAcceptedAuthority = z.infer<typeof HostMcpAcceptedAuthority>;\n\n/** Credential-free selection frozen on one immutable scheduled-task revision. */\nexport const HostMcpTaskAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    taskId: z.string().uuid(),\n    taskAuthorityRevision: z.number().int().positive().safe(),\n    taskExecutionDigest: z.string().regex(/^[0-9a-f]{64}$/),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    context: SessionTenancyVisibility,\n  })\n  .strict();\nexport type HostMcpTaskAuthority = z.infer<typeof HostMcpTaskAuthority>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAQX,IAAM,sBAAsB,EAAE,MAAM;AAAA,EACzC,iBAAiB,MAAM;AAAA,EACvB,EACG,OAAO,EACP,IAAI,IAAI,EACR,MAAM,uBAAuB;AAClC,CAAC;AAGM,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,gBAAgB,EACb,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,OAAO,CAAC,UAAU;AACjB,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,EAC7E,GAAG,yEAAyE,EAC3E,UAAU,CAAC,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,CAAC;AAAA,EACjD,eAAe;AACjB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,cAAc;AACtB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB,aAAa;AAAA,MACrC,SAAS;AAAA,IACX,CAAC;AACH,MAAI,MAAM,cAAc,oBAAoB,UAAU,CAAC,MAAM,cAAc;AACzE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,eAAe;AAAA,MACtB,SAAS;AAAA,IACX,CAAC;AACH,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa;AAC/D,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAC1F,CAAC;AAYI,SAAS,+BACd,SACA,WACS;AACT,QAAM,SAAS,uBAAuB,UAAU,UAAU,aAAa;AACvE,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAK,YAAa,QAAO;AACxD,QAAM,EAAE,aAAa,GAAG,cAAc,IAAI,OAAO;AACjD,QAAM,aAAa,yBAAyB,UAAU,QAAQ,UAAU;AACxE,MAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAI;AACJ,MAAI;AACF,qBAAiB,IAAI,IAAI,UAAU,cAAc,EAAE,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,UAAU,aAAa,WAAW,KAAK,YACvC,mBAAmB,WAAW,KAAK;AAEnC,WAAO;AACT,MAAI,eAAe,aAAa;AAC9B,UAAM,EAAE,cAAc,eAAe,GAAG,YAAY,IAAI,WAAW,KAAK;AACxE,WAAO,WAAW,aAAa,MAAM,WAAW,WAAW;AAAA,EAC7D;AACA,SACE,QAAQ,OAAO,YAAY,aAC3B,QAAQ,eAAe,YAAY,cACnC,WAAW,aAAa,MAAM,WAAW,WAAW,KAAK,aAAa;AAE1E;AAEO,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY;AACd,CAAC,EACA,OAAO;AAIV,IAAM,yBAAyB,+BAA+B,YAAY,CAAC,OAAO,YAAY;AAC5F,MACE,QAAQ,MAAM,SAAS,OAAO,MAAM,0BAA0B,SAC7D,MAAM,0BAA0B,QAAQ,CAAC,OAAO,cAAc,MAAM,sBAAsB,GAC3F;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AACM,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC5D,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7D,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,OAAO;AAAA,EACP,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAQH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC9D,cAAc,+BAA+B,MAAM;AAAA,EACnD,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,iBAAiB,EACd,OAAO;AAAA,IACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,IACxD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,QAAQ,EAAE,mBAAmB,QAAQ;AAAA,IACnC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,IAC/C,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,EAAE,CAAC,EAAE,OAAO;AAAA,IACvD,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,YAAY;AAAA,MAC5B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,MAChC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACG,MAAM,OAAO,SAAS,YAAY,MAAM,mBACxC,MAAM,OAAO,SAAS,qBACpB,CAAC,MAAM,mBACN,MAAM,aAAa,SAAS,oBAC5B,MAAM,gBAAgB,WAAW,MAAM,aAAa,UACpD,MAAM,gBAAgB,UAAU,MAAM,aAAa,SACnD,MAAM,gBAAgB,0BAA0B,MAAM,aAAa;AAEvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACH,MACE,MAAM,aAAa,SAAS,UAC5B,MAAM,OAAO,SAAS,oBACtB,MAAM,aAAa,WAAW,MAAM,OAAO,QAC3C;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,aAAa,SAAS,oBAC5B,CAAC,OAAO,cAAc,MAAM,aAAa,qBAAqB,GAC9D;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,OAAQ;AACvE,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAAA,EACxF;AACF,CAAC;AAII,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACtD,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,YAAY;AAAA,EACZ,SAAS;AACX,CAAC,EACA,OAAO;","names":[]}
+{"version":3,"sources":["../src/host-mcp-bindings.ts"],"sourcesContent":["import { z } from \"zod\";\nexport { HostMcpCreateSelections, type HostMcpCreateSelection } from \"./index\";\nimport {\n  McpServerConnectionRef,\n  SessionTenancyVisibility,\n  ManagedUserResourceGrantMode,\n  stableJson,\n} from \"./index\";\nimport { ConnectionUseAuthoritySnapshot } from \"./connection-authority\";\nimport { ExternalIdentity } from \"./external-identities\";\nexport const HostMcpOwnerSubject = z.union([\n  ExternalIdentity.shape.subjectId,\n  z\n    .string()\n    .max(4096)\n    .regex(/^user:[^\\r\\n\\u0000]+$/),\n]);\n\n/** Credential-free, immutable destination and host connection selection. */\nexport const HostMcpBindingDefinition = z\n  .object({\n    serverId: z.string().min(1).max(256),\n    destinationUrl: z\n      .string()\n      .url()\n      .max(4096)\n      .refine((value) => {\n        const url = new URL(value);\n        return url.protocol === \"https:\" && !url.username && !url.password && !url.hash;\n      }, \"Host binding requires an HTTPS destination without userinfo or fragment\")\n      .transform((value) => new URL(value).toString()),\n    connectionRef: McpServerConnectionRef,\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.connectionRef.hostBinding)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\", \"hostBinding\"],\n        message: \"A binding definition cannot reference another binding\",\n      });\n    if (value.connectionRef.authoritySource !== \"host\" || !value.connectionRef.connectionId)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\"],\n        message: \"Explicit host connection authority is required\",\n      });\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536)\n      context.addIssue({ code: \"custom\", message: \"Host binding definition exceeds 64 KiB\" });\n  });\nexport type HostMcpBindingDefinition = z.infer<typeof HostMcpBindingDefinition>;\n\n/** Configuration ceiling, never execution authority. The complete destination\n * and provider/scope/resource selection stay exact; only the account identifier\n * is chosen by a captured owner grant in explicit accepted-turn mode. */\nexport type HostMcpBindingSelection = {\n  serverId: string;\n  destinationUrl: string;\n  connectionRef: McpServerConnectionRef;\n};\n\nexport function hostMcpBindingMatchesSelection(\n  binding: { id: string; generation: number; definition: HostMcpBindingDefinition },\n  selection: HostMcpBindingSelection,\n): boolean {\n  const parsed = McpServerConnectionRef.safeParse(selection.connectionRef);\n  if (!parsed.success || !parsed.data.hostBinding) return false;\n  const { hostBinding, ...configuredRef } = parsed.data;\n  const definition = HostMcpBindingDefinition.safeParse(binding.definition);\n  if (!definition.success) return false;\n  let destinationUrl: string;\n  try {\n    destinationUrl = new URL(selection.destinationUrl).toString();\n  } catch {\n    return false;\n  }\n  if (\n    selection.serverId !== definition.data.serverId ||\n    destinationUrl !== definition.data.destinationUrl\n  )\n    return false;\n  if (\"selection\" in hostBinding) {\n    const { connectionId: _connectionId, ...selectedRef } = definition.data.connectionRef;\n    return stableJson(configuredRef) === stableJson(selectedRef);\n  }\n  return (\n    binding.id === hostBinding.bindingId &&\n    binding.generation === hostBinding.generation &&\n    stableJson(configuredRef) === stableJson(definition.data.connectionRef)\n  );\n}\n\nexport const HostMcpBinding = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    authorizationRevision: z.number().int().positive().safe(),\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    definition: HostMcpBindingDefinition,\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpBinding = z.infer<typeof HostMcpBinding>;\n\nexport const CreateHostMcpBindingRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    definition: HostMcpBindingDefinition,\n  })\n  .strict();\nexport type CreateHostMcpBindingRequest = z.infer<typeof CreateHostMcpBindingRequest>;\n\nconst HostMcpGrantRequest = z\n  .object({\n    scope: z.literal(\"user\"),\n    mode: ManagedUserResourceGrantMode,\n    context: SessionTenancyVisibility,\n    sessionId: z.string().uuid().nullable().optional(),\n    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n    workspaceSharedAcknowledged: z.boolean().default(false),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"workspaceSharedAcknowledged\"],\n        message: \"workspace_shared requires durable shared-output acknowledgement\",\n      });\n    }\n    if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n      context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n    }\n    if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"sessionId\"],\n        message: \"session requires a target session and expectedAuthorityEpoch\",\n      });\n    }\n  });\n\n/** Internal owner-authorized issuance; never itself proves caller identity. */\nconst HostMcpDelegationGrant = HostMcpGrantRequest.superRefine((value, context) => {\n  if (\n    Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) ||\n    (value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch))\n  ) {\n    context.addIssue({\n      code: \"custom\",\n      message: \"Host session grants require a matching safe authority epoch\",\n    });\n  }\n});\nexport const IssueHostMcpDelegationRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    bindingId: z.string().uuid(),\n    expectedBindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n  })\n  .strict();\nexport type IssueHostMcpDelegationRequest = z.infer<typeof IssueHostMcpDelegationRequest>;\n\nexport const HostMcpDelegation = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpDelegation = z.infer<typeof HostMcpDelegation>;\n\n/** Internal admission evidence, not a caller-supplied permission or credential.\n * Persistence must construct this from live authenticated authority and freeze\n * it with accepted work. Runtime use must independently revalidate that work,\n * membership, binding and delegation. No API key is retained as execution rights.\n */\nexport const HostMcpAcceptedAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive().safe(),\n    acceptedWork: ConnectionUseAuthoritySnapshot.shape.acceptedWork,\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    scheduledOrigin: z\n      .object({\n        taskId: z.string().uuid(),\n        taskAuthorityRevision: z.number().int().positive().safe(),\n        runId: z.string().uuid(),\n      })\n      .strict()\n      .optional(),\n    source: z.discriminatedUnion(\"kind\", [\n      z.object({ kind: z.literal(\"direct\") }).strict(),\n      z.object({ kind: z.literal(\"scheduled_task\") }).strict(),\n      z\n        .object({\n          kind: z.literal(\"child_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n      z\n        .object({\n          kind: z.literal(\"inherited_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n    ]),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      (value.source.kind === \"direct\" && value.scheduledOrigin) ||\n      (value.source.kind === \"scheduled_task\" &&\n        (!value.scheduledOrigin ||\n          value.acceptedWork.kind !== \"scheduled_task\" ||\n          value.scheduledOrigin.taskId !== value.acceptedWork.taskId ||\n          value.scheduledOrigin.runId !== value.acceptedWork.runId ||\n          value.scheduledOrigin.taskAuthorityRevision !== value.acceptedWork.taskAuthorityRevision))\n    )\n      context.addIssue({\n        code: \"custom\",\n        message: \"Scheduled host authority must retain its exact run origin\",\n      });\n    if (\n      value.acceptedWork.kind === \"turn\" &&\n      value.source.kind === \"inherited_turn\" &&\n      value.acceptedWork.turnId === value.source.turnId\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"source\"],\n        message: \"Accepted work cannot inherit from itself\",\n      });\n    }\n    if (\n      value.acceptedWork.kind === \"scheduled_task\" &&\n      !Number.isSafeInteger(value.acceptedWork.taskAuthorityRevision)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"acceptedWork\"],\n        message: \"Task authority revision must be a safe integer\",\n      });\n    }\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536) {\n      context.addIssue({ code: \"custom\", message: \"Host accepted authority exceeds 64 KiB\" });\n    }\n  });\nexport type HostMcpAcceptedAuthority = z.infer<typeof HostMcpAcceptedAuthority>;\n\n/** Credential-free selection frozen on one immutable scheduled-task revision. */\nexport const HostMcpTaskAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    taskId: z.string().uuid(),\n    taskAuthorityRevision: z.number().int().positive().safe(),\n    taskExecutionDigest: z.string().regex(/^[0-9a-f]{64}$/),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    context: SessionTenancyVisibility,\n  })\n  .strict();\nexport type HostMcpTaskAuthority = z.infer<typeof HostMcpTaskAuthority>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,MAAM;AAAA,EACzC,iBAAiB,MAAM;AAAA,EACvB,EACG,OAAO,EACP,IAAI,IAAI,EACR,MAAM,uBAAuB;AAClC,CAAC;AAGM,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,gBAAgB,EACb,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,OAAO,CAAC,UAAU;AACjB,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,EAC7E,GAAG,yEAAyE,EAC3E,UAAU,CAAC,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,CAAC;AAAA,EACjD,eAAe;AACjB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,cAAc;AACtB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB,aAAa;AAAA,MACrC,SAAS;AAAA,IACX,CAAC;AACH,MAAI,MAAM,cAAc,oBAAoB,UAAU,CAAC,MAAM,cAAc;AACzE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,eAAe;AAAA,MACtB,SAAS;AAAA,IACX,CAAC;AACH,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa;AAC/D,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAC1F,CAAC;AAYI,SAAS,+BACd,SACA,WACS;AACT,QAAM,SAAS,uBAAuB,UAAU,UAAU,aAAa;AACvE,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAK,YAAa,QAAO;AACxD,QAAM,EAAE,aAAa,GAAG,cAAc,IAAI,OAAO;AACjD,QAAM,aAAa,yBAAyB,UAAU,QAAQ,UAAU;AACxE,MAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAI;AACJ,MAAI;AACF,qBAAiB,IAAI,IAAI,UAAU,cAAc,EAAE,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,UAAU,aAAa,WAAW,KAAK,YACvC,mBAAmB,WAAW,KAAK;AAEnC,WAAO;AACT,MAAI,eAAe,aAAa;AAC9B,UAAM,EAAE,cAAc,eAAe,GAAG,YAAY,IAAI,WAAW,KAAK;AACxE,WAAO,WAAW,aAAa,MAAM,WAAW,WAAW;AAAA,EAC7D;AACA,SACE,QAAQ,OAAO,YAAY,aAC3B,QAAQ,eAAe,YAAY,cACnC,WAAW,aAAa,MAAM,WAAW,WAAW,KAAK,aAAa;AAE1E;AAEO,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY;AACd,CAAC,EACA,OAAO;AAGV,IAAM,sBAAsB,EACzB,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACxD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,6BAA6B;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,yBAAyB,oBAAoB,YAAY,CAAC,OAAO,YAAY;AACjF,MACE,QAAQ,MAAM,SAAS,OAAO,MAAM,0BAA0B,SAC7D,MAAM,0BAA0B,QAAQ,CAAC,OAAO,cAAc,MAAM,sBAAsB,GAC3F;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AACM,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC5D,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7D,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,OAAO;AAAA,EACP,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAQH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC9D,cAAc,+BAA+B,MAAM;AAAA,EACnD,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,iBAAiB,EACd,OAAO;AAAA,IACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,IACxD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,QAAQ,EAAE,mBAAmB,QAAQ;AAAA,IACnC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,IAC/C,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,EAAE,CAAC,EAAE,OAAO;AAAA,IACvD,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,YAAY;AAAA,MAC5B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,MAChC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACG,MAAM,OAAO,SAAS,YAAY,MAAM,mBACxC,MAAM,OAAO,SAAS,qBACpB,CAAC,MAAM,mBACN,MAAM,aAAa,SAAS,oBAC5B,MAAM,gBAAgB,WAAW,MAAM,aAAa,UACpD,MAAM,gBAAgB,UAAU,MAAM,aAAa,SACnD,MAAM,gBAAgB,0BAA0B,MAAM,aAAa;AAEvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACH,MACE,MAAM,aAAa,SAAS,UAC5B,MAAM,OAAO,SAAS,oBACtB,MAAM,aAAa,WAAW,MAAM,OAAO,QAC3C;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,aAAa,SAAS,oBAC5B,CAAC,OAAO,cAAc,MAAM,aAAa,qBAAqB,GAC9D;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,OAAQ;AACvE,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAAA,EACxF;AACF,CAAC;AAII,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACtD,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,YAAY;AAAA,EACZ,SAAS;AACX,CAAC,EACA,OAAO;","names":[]}