@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/chunk-G4RKARXZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secret-generator.ts","../src/vaults.ts"],"sourcesContent":["import * as primitives from \"./primitives\";\nimport { defineSchema } from \"./define-schema\";\n/**\n * The one password generator shared by agents (`secret_save` with\n * `generate`), the ask card's server-side generate, and the web/mobile UI.\n *\n * Isomorphic and dependency-free: randomness comes from\n * `crypto.getRandomValues` unless a test injects `random`. Output is ASCII\n * only, and every character is drawn uniformly from the selected alphabet by\n * rejection sampling, so no modulo bias is introduced. When\n * `requireEachClass` is set, whole candidates lacking an enabled class are\n * rejected and redrawn, which keeps the result uniform over all compliant\n * passwords.\n */\nimport { z } from \"zod\";\n\nexport const SECRET_GENERATOR_DEFAULT_SYMBOLS = \"!#%+-.:=?@_\";\n/** Characters that are easy to confuse when a person reads them. */\nexport const SECRET_GENERATOR_AMBIGUOUS_CHARACTERS = \"0O1lI|\";\n\nconst LOWERCASE = \"abcdefghijklmnopqrstuvwxyz\";\nconst UPPERCASE = \"ABCDEFGHIJKLMNOPQRSTUVWXYZ\";\nconst DIGITS = \"0123456789\";\n\nfunction isPrintableAscii(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code < 0x21 || code > 0x7e) return false;\n  }\n  return true;\n}\n\nexport const GeneratePasswordSpec = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      length: z.number().int().min(8).max(128).default(24),\n      lowercase: primitives.boolean.default(true),\n      uppercase: primitives.boolean.default(true),\n      digits: primitives.boolean.default(true),\n      symbols: primitives.boolean.default(true),\n      // No quotes, $, `, \\, braces, /, &, ; or | by default: generated values\n      // stay safe to paste into shells, URLs and config files.\n      symbolSet: z\n        .string()\n        .min(1)\n        .max(64)\n        .refine(isPrintableAscii, \"symbolSet must be printable ASCII without spaces\")\n        .default(SECRET_GENERATOR_DEFAULT_SYMBOLS),\n      excludeAmbiguous: primitives.boolean.default(true),\n      requireEachClass: primitives.boolean.default(true),\n    })\n    .strict()\n    .refine(\n      (spec) => spec.lowercase || spec.uppercase || spec.digits || spec.symbols,\n      \"at least one character class must be enabled\",\n    ),\n);\nexport type GeneratePasswordSpec = z.infer<typeof GeneratePasswordSpec>;\nexport type GeneratePasswordSpecInput = z.input<typeof GeneratePasswordSpec>;\n\nexport class PasswordGeneratorError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"PasswordGeneratorError\";\n  }\n}\n\nfunction defaultRandom(n: number): Uint8Array {\n  const bytes = new Uint8Array(n);\n  globalThis.crypto.getRandomValues(bytes);\n  return bytes;\n}\n\nfunction uniqueCharacters(value: string): string {\n  return [...new Set(value)].join(\"\");\n}\n\n/** The enabled character classes after exclusions; empty classes are dropped. */\nexport function passwordCharacterClasses(spec: GeneratePasswordSpec): string[] {\n  const ambiguous = spec.excludeAmbiguous ? new Set(SECRET_GENERATOR_AMBIGUOUS_CHARACTERS) : null;\n  const strip = (alphabet: string) =>\n    uniqueCharacters(alphabet)\n      .split(\"\")\n      .filter((character) => !ambiguous?.has(character))\n      .join(\"\");\n  const classes: string[] = [];\n  if (spec.lowercase) classes.push(strip(LOWERCASE));\n  if (spec.uppercase) classes.push(strip(UPPERCASE));\n  if (spec.digits) classes.push(strip(DIGITS));\n  if (spec.symbols) classes.push(strip(spec.symbolSet));\n  return classes.filter((characters) => characters.length > 0);\n}\n\n/** Draws `count` uniform indexes in `[0, size)` by rejection sampling bytes. */\nfunction uniformIndexes(count: number, size: number, random: (n: number) => Uint8Array): number[] {\n  if (size < 1 || size > 256) throw new PasswordGeneratorError(\"alphabet size out of range\");\n  const limit = 256 - (256 % size);\n  const out: number[] = [];\n  let guard = 0;\n  while (out.length < count) {\n    const bytes = random(Math.max(16, (count - out.length) * 2));\n    for (const byte of bytes) {\n      if (byte < limit) out.push(byte % size);\n      if (out.length === count) break;\n    }\n    guard += 1;\n    if (guard > 10_000) throw new PasswordGeneratorError(\"random source is not producing entropy\");\n  }\n  return out;\n}\n\n/** Generate a password. The spec input is parsed (defaults applied) first. */\nexport function generatePassword(\n  spec?: GeneratePasswordSpecInput,\n  random: (n: number) => Uint8Array = defaultRandom,\n): string {\n  const parsed = GeneratePasswordSpec.parse(spec ?? {});\n  const classes = passwordCharacterClasses(parsed);\n  if (classes.length === 0) throw new PasswordGeneratorError(\"no characters available\");\n  const alphabet = uniqueCharacters(classes.join(\"\"));\n  const requireClasses = parsed.requireEachClass ? classes : [];\n  if (requireClasses.length > parsed.length) {\n    throw new PasswordGeneratorError(\"length is shorter than the number of required classes\");\n  }\n  for (let attempt = 0; attempt < 1_000; attempt += 1) {\n    const password = uniformIndexes(parsed.length, alphabet.length, random)\n      .map((index) => alphabet[index]!)\n      .join(\"\");\n    if (requireClasses.every((characters) => [...password].some((c) => characters.includes(c)))) {\n      return password;\n    }\n  }\n  throw new PasswordGeneratorError(\"could not satisfy the character class requirements\");\n}\n\nexport type PasswordStrengthLabel = \"weak\" | \"fair\" | \"strong\" | \"very_strong\";\n\n/**\n * Estimated entropy from length and the character pools the password uses.\n * A display hint for the UI, not a security decision.\n */\nexport function passwordStrength(password: string): {\n  bits: number;\n  label: PasswordStrengthLabel;\n} {\n  let pool = 0;\n  if (/[a-z]/.test(password)) pool += 26;\n  if (/[A-Z]/.test(password)) pool += 26;\n  if (/[0-9]/.test(password)) pool += 10;\n  if (/[^a-zA-Z0-9]/.test(password)) pool += 33;\n  const length = [...password].length;\n  const bits = pool === 0 ? 0 : Math.round(length * Math.log2(pool) * 10) / 10;\n  const label: PasswordStrengthLabel =\n    bits < 40 ? \"weak\" : bits < 60 ? \"fair\" : bits < 100 ? \"strong\" : \"very_strong\";\n  return { bits, label };\n}\n","import * as primitives from \"./primitives\";\nimport { defineSchema } from \"./define-schema\";\n/**\n * Vaults: the Opengeni secrets model (replaces variable sets).\n *\n * A vault holds a flat list of items; an item holds named fields; hosted\n * fields keep encrypted versions. Every type here is `z.infer` of its schema.\n *\n * This module must not import runtime values from `./index` (the index\n * re-exports it); only types cross that edge.\n */\nimport { z } from \"zod\";\nimport { GeneratePasswordSpec } from \"./secret-generator\";\n\nexport const VaultOwnerKind = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"user\", \"workspace\", \"organization\", \"task\"]),\n);\nexport type VaultOwnerKind = z.infer<typeof VaultOwnerKind>;\nexport const VaultSource = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"opengeni\", \"onepassword\", \"host\", \"external\", \"protonpass\", \"keeper\", \"bitwarden\"]),\n);\nexport type VaultSource = z.infer<typeof VaultSource>;\nexport const VaultMode = /* @__PURE__ */ defineSchema(() => z.enum([\"read_write\", \"read_only\"]));\nexport type VaultMode = z.infer<typeof VaultMode>;\nexport const VaultSyncStatus = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"ok\", \"syncing\", \"error\", \"auth_expired\", \"rate_limited\"]),\n);\nexport type VaultSyncStatus = z.infer<typeof VaultSyncStatus>;\n/**\n * The kind of item, which decides its standard fields and its primary field.\n * Each provider item maps to one type; anything more specific (a database\n * login, a bank account, a passport) is its `category` (see\n * `VAULT_ITEM_CATEGORIES`), so an item keeps both when it moves between\n * providers.\n */\nexport const VaultItemType = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"login\", \"api_key\", \"note\", \"file\", \"passkey\", \"card\", \"identity\", \"ssh_key\"]),\n);\nexport type VaultItemType = z.infer<typeof VaultItemType>;\n\n/** The item types that exist; `createItemTypes` lists at most all of them. */\nexport const VAULT_ITEM_TYPE_COUNT = 8;\n\n/**\n * A provider-specific kind of item, as a lower-case snake_case token. Known\n * categories use the names in `VAULT_ITEM_CATEGORIES`; a provider category\n * Opengeni does not know is kept as the snake_case form of its own name.\n */\nexport const VAULT_ITEM_CATEGORY_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;\nexport const VaultItemCategory = /* @__PURE__ */ defineSchema(() =>\n  z.string().regex(VAULT_ITEM_CATEGORY_PATTERN, \"a lower-case snake_case category\"),\n);\nexport type VaultItemCategory = z.infer<typeof VaultItemCategory>;\n\n/**\n * Categories with a shared meaning across providers, and the item type each\n * belongs to. An item with no category is the plain form of its type.\n */\nexport const VAULT_ITEM_CATEGORIES = {\n  password: \"api_key\",\n  database: \"api_key\",\n  server: \"api_key\",\n  wifi: \"api_key\",\n  email_account: \"api_key\",\n  software_license: \"api_key\",\n  crypto_wallet: \"api_key\",\n  bank_account: \"note\",\n  membership: \"note\",\n  passport: \"note\",\n  driver_license: \"note\",\n  outdoor_license: \"note\",\n  reward_program: \"note\",\n  national_id: \"note\",\n  medical_record: \"note\",\n  health_insurance: \"note\",\n  birth_certificate: \"note\",\n  email_alias: \"note\",\n  address: \"identity\",\n  person: \"identity\",\n  photo: \"file\",\n} as const satisfies Record<string, VaultItemType>;\nexport type KnownVaultItemCategory = keyof typeof VAULT_ITEM_CATEGORIES;\n\n/**\n * The category token for a provider's own category or record-type name:\n * \"BankAccount\", \"bank account\" and \"bankAccount\" all become \"bank_account\".\n * Null when nothing usable remains.\n */\nexport function vaultItemCategoryToken(raw: string): string | null {\n  const token = raw\n    .normalize(\"NFKD\")\n    .replace(/[\\u0300-\\u036f]/g, \"\")\n    .replace(/([a-z0-9])([A-Z])/g, \"$1_$2\")\n    .replace(/([A-Z]+)([A-Z][a-z])/g, \"$1_$2\")\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^[^a-z]+/, \"\")\n    .slice(0, 64)\n    .replace(/_+$/, \"\");\n  return VAULT_ITEM_CATEGORY_PATTERN.test(token) ? token : null;\n}\n\n/**\n * The standard fields of each type, in display order, as Opengeni names them\n * in every vault. Providers store them in their own built-in slots; any other\n * field is kept as a custom field under its own name.\n */\nexport const VAULT_ITEM_TYPE_FIELDS: Readonly<\n  Record<VaultItemType, ReadonlyArray<{ name: string; kind: \"text\" | \"concealed\" | \"totp\" }>>\n> = {\n  login: [\n    { name: \"username\", kind: \"text\" },\n    { name: \"password\", kind: \"concealed\" },\n    { name: \"one-time password\", kind: \"totp\" },\n  ],\n  api_key: [{ name: \"value\", kind: \"concealed\" }],\n  note: [{ name: \"note\", kind: \"concealed\" }],\n  file: [],\n  passkey: [],\n  card: [\n    { name: \"cardholder name\", kind: \"text\" },\n    { name: \"brand\", kind: \"text\" },\n    { name: \"number\", kind: \"concealed\" },\n    { name: \"expiry month\", kind: \"text\" },\n    { name: \"expiry year\", kind: \"text\" },\n    { name: \"security code\", kind: \"concealed\" },\n  ],\n  identity: [\n    { name: \"title\", kind: \"text\" },\n    { name: \"first name\", kind: \"text\" },\n    { name: \"middle name\", kind: \"text\" },\n    { name: \"last name\", kind: \"text\" },\n    { name: \"username\", kind: \"text\" },\n    { name: \"company\", kind: \"text\" },\n    { name: \"email\", kind: \"text\" },\n    { name: \"phone\", kind: \"text\" },\n    { name: \"address 1\", kind: \"text\" },\n    { name: \"address 2\", kind: \"text\" },\n    { name: \"address 3\", kind: \"text\" },\n    { name: \"city\", kind: \"text\" },\n    { name: \"state\", kind: \"text\" },\n    { name: \"postal code\", kind: \"text\" },\n    { name: \"country\", kind: \"text\" },\n    { name: \"national ID number\", kind: \"concealed\" },\n    { name: \"passport number\", kind: \"concealed\" },\n    { name: \"license number\", kind: \"concealed\" },\n  ],\n  ssh_key: [\n    { name: \"private key\", kind: \"concealed\" },\n    { name: \"public key\", kind: \"text\" },\n    { name: \"fingerprint\", kind: \"text\" },\n  ],\n};\n\n/**\n * A freshly generated SSH key pair for an `ssh_key` item's \"private key\"\n * field. Opengeni writes the private key in OpenSSH format and fills in the\n * \"public key\" and \"fingerprint\" fields; the private key never leaves the\n * vault.\n */\nexport const GenerateSshKeySpec = /* @__PURE__ */ defineSchema(() =>\n  z.object({ algorithm: z.enum([\"ed25519\", \"rsa4096\"]).default(\"ed25519\") }).strict(),\n);\nexport type GenerateSshKeySpec = z.infer<typeof GenerateSshKeySpec>;\n\n/**\n * Other names password managers give a type's standard fields (1Password's\n * \"verification number\" is Bitwarden's \"security code\"). A write stores a\n * field under any of these names in the provider's own slot, and a reference\n * that names one of them still resolves when the item names it another way.\n */\nexport const VAULT_FIELD_NAME_SYNONYMS: Readonly<\n  Partial<Record<VaultItemType, Readonly<Record<string, readonly string[]>>>>\n> = {\n  card: {\n    \"cardholder name\": [\"cardholder\", \"name on card\"],\n    brand: [\"type\", \"card type\"],\n    number: [\"card number\"],\n    \"security code\": [\"verification number\", \"cvv\", \"cvc\", \"cvv2\", \"csc\"],\n    \"expiry month\": [\"exp month\", \"expiration month\"],\n    \"expiry year\": [\"exp year\", \"expiration year\"],\n  },\n  identity: {\n    \"first name\": [\"firstname\", \"given name\"],\n    \"middle name\": [\"initial\", \"middle initial\"],\n    \"last name\": [\"lastname\", \"surname\", \"family name\"],\n    email: [\"email address\"],\n    phone: [\"phone number\", \"default phone\"],\n    \"address 1\": [\"address\", \"street address\"],\n    \"postal code\": [\"zip\", \"zip code\", \"postcode\"],\n    \"national ID number\": [\"ssn\", \"social security number\"],\n  },\n  ssh_key: {},\n};\n\nfunction fieldNameKey(name: string): string {\n  return name.normalize(\"NFC\").trim().toLowerCase();\n}\n\n/**\n * The standard field a field name stands for in an item of this type, as\n * Opengeni names it (\"cvv\" is a card's \"security code\"), or null for a\n * custom field.\n */\nexport function standardVaultFieldName(type: VaultItemType, name: string): string | null {\n  const key = fieldNameKey(name);\n  const standard = VAULT_ITEM_TYPE_FIELDS[type].find((field) => fieldNameKey(field.name) === key);\n  if (standard) return standard.name;\n  for (const [canonical, synonyms] of Object.entries(VAULT_FIELD_NAME_SYNONYMS[type] ?? {})) {\n    if (synonyms.some((synonym) => fieldNameKey(synonym) === key)) return canonical;\n  }\n  return null;\n}\n\n/**\n * Every other name a reference's field name may have in another password\n * manager, across all types: a group's names when it belongs to one, else\n * nothing. Used only when the exact name finds no field.\n */\nexport function vaultFieldNameAlternatives(name: string): string[] {\n  const key = fieldNameKey(name);\n  const out = new Set<string>();\n  for (const table of Object.values(VAULT_FIELD_NAME_SYNONYMS)) {\n    for (const [canonical, synonyms] of Object.entries(table ?? {})) {\n      const group = [canonical, ...synonyms];\n      if (!group.some((entry) => fieldNameKey(entry) === key)) continue;\n      for (const entry of group) if (fieldNameKey(entry) !== key) out.add(entry);\n    }\n  }\n  return [...out];\n}\nexport const VaultFieldKind = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"text\", \"concealed\", \"totp\", \"file\"]),\n);\nexport type VaultFieldKind = z.infer<typeof VaultFieldKind>;\n\n/** Effective operations, not a promise that upstream permissions cannot change. */\nexport const VaultProviderOperations = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      createItemTypes: z.array(VaultItemType).max(VAULT_ITEM_TYPE_COUNT),\n      updateItem: primitives.boolean,\n      removeField: primitives.boolean,\n      archiveItem: primitives.boolean,\n      archiveKind: z.enum([\"archive\", \"trash\", \"none\"]),\n      /** Permanent provider deletion is deliberately not exposed. */\n      deleteItem: z.literal(false),\n      restoreItem: primitives.boolean,\n      readFiles: primitives.boolean,\n      writeFiles: primitives.boolean,\n      createTotp: primitives.boolean,\n      updateTotp: primitives.boolean,\n      createVault: primitives.boolean,\n      restoreFieldHistory: primitives.boolean,\n    })\n    .strict(),\n);\nexport type VaultProviderOperations = z.infer<typeof VaultProviderOperations>;\n\nconst ARCHIVE_KIND_STRENGTH = { archive: 2, trash: 1, none: 0 } as const;\n\n/**\n * The weaker of two archive kinds: an archive (hidden, restorable as is) is\n * stronger than a trash (restorable until emptied), which is stronger than\n * none. A vault may narrow its adapter's archive to a trash, never widen it.\n */\nexport function weakerArchiveKind(\n  left: VaultProviderOperations[\"archiveKind\"],\n  right: VaultProviderOperations[\"archiveKind\"],\n): VaultProviderOperations[\"archiveKind\"] {\n  return ARCHIVE_KIND_STRENGTH[left] <= ARCHIVE_KIND_STRENGTH[right] ? left : right;\n}\n\n/** A successful mirror check does not prove a customer's upstream cache is current. */\nexport const VaultProviderFreshness = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      state: z.enum([\"current\", \"stale\", \"refreshing\", \"unavailable\"]),\n      lastCheckedAt: z.string().datetime().nullable(),\n      sourceSyncedAt: z.string().datetime().nullable(),\n      source: z.enum([\"live\", \"cache\", \"unknown\"]),\n      errorCode: z.string().max(100).nullable(),\n      retryAt: z.string().datetime().nullable(),\n    })\n    .strict(),\n);\nexport type VaultProviderFreshness = z.infer<typeof VaultProviderFreshness>;\n/** Lookup order for references that name no vault; index = tier. */\nexport const VAULT_LOOKUP_TIERS = [\"task\", \"user\", \"workspace\", \"organization\"] as const;\nexport type VaultLookupTier = (typeof VAULT_LOOKUP_TIERS)[number];\n\nexport const VAULT_LIMITS = {\n  vaultsPerOwnerScope: 200,\n  itemsPerVault: 2_000,\n  fieldsPerItem: 50,\n  versionsPerField: 10,\n  nameMaxChars: 120,\n  descriptionMaxChars: 2_000,\n  websitesPerItem: 20,\n  websiteMaxChars: 2_048,\n  usernameMaxChars: 1_024,\n  textValueMaxBytes: 65_536,\n  fileValueMaxBytes: 262_144,\n  referenceMaxChars: 300,\n  execEnvMaxBytes: 262_144,\n  execValueMaxBytes: 102_400,\n  policyVaultIdsMax: 200,\n  searchResultsMax: 50,\n  /** Items one agent search call examines before it returns a cursor. */\n  searchScanMax: 1_000,\n  searchCursorMaxChars: 1_024,\n  providerReadsPerAttempt: 50,\n  providerValueCacheMs: 60_000,\n} as const;\n\n/** Default names of lazily created hosted vaults (Q-06). */\nexport const DEFAULT_VAULT_NAMES = {\n  user: \"Private\",\n  workspace: \"Shared\",\n  task: \"Task\",\n} as const;\n\n/**\n * Default primary field per item type (§10B.2); passkeys have none, and an\n * identity's primary is its first concealed field.\n */\nexport const VAULT_DEFAULT_PRIMARY_FIELD: Readonly<Record<VaultItemType, string | null>> = {\n  login: \"password\",\n  api_key: \"value\",\n  note: \"note\",\n  file: \"file\",\n  passkey: null,\n  card: \"number\",\n  identity: null,\n  ssh_key: \"private key\",\n};\n\n/** Fixed passkey fields (D20). `privateKey` is concealed; the rest are text. */\nexport const PASSKEY_FIELD_NAMES = [\n  \"rpId\",\n  \"credentialId\",\n  \"userHandle\",\n  \"userName\",\n  \"privateKey\",\n] as const;\n\n// Forbidden anywhere in a name: / { } # \\ and C0/C1 control characters.\n// oxlint-disable-next-line no-control-regex\nconst FORBIDDEN_NAME_CHARACTERS = /[/{}#\\\\\\u0000-\\u001f\\u007f-\\u009f]/;\n\n/**\n * Q-10: 1–120 characters, no `/ { } # \\` or control characters, no leading\n * or trailing whitespace, and not starting with `id:` (reserved for the ID\n * reference form). Interior spaces and any other Unicode are allowed.\n */\nexport function isValidSecretName(name: string): boolean {\n  if (typeof name !== \"string\") return false;\n  const length = [...name].length;\n  if (length < 1 || length > VAULT_LIMITS.nameMaxChars) return false;\n  if (FORBIDDEN_NAME_CHARACTERS.test(name)) return false;\n  if (name.trim() !== name) return false;\n  if (name.toLowerCase().startsWith(\"id:\")) return false;\n  return true;\n}\n\n/** True when `name` is reserved as a field name (the `/otp` suffix). */\nexport function isReservedVaultFieldName(name: string): boolean {\n  return name.normalize(\"NFC\").trim().toLowerCase() === \"otp\";\n}\n\nexport const VaultName = /* @__PURE__ */ defineSchema(() =>\n  primitives.nonEmptyString\n    .max(VAULT_LIMITS.nameMaxChars)\n    .refine(isValidSecretName, \"invalid_secret_name\"),\n);\nexport const VaultFieldName = /* @__PURE__ */ defineSchema(() =>\n  VaultName.refine((name) => !isReservedVaultFieldName(name), \"invalid_secret_name\"),\n);\n\nexport const VaultPolicy = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"mode\", [\n    z.object({ mode: z.literal(\"all\") }).strict(),\n    z\n      .object({\n        mode: z.literal(\"selected\"),\n        vaultIds: z.array(primitives.uuid).max(VAULT_LIMITS.policyVaultIdsMax),\n      })\n      .strict(),\n  ]),\n);\nexport type VaultPolicy = z.infer<typeof VaultPolicy>;\nexport const VAULT_POLICY_ALL: VaultPolicy = Object.freeze({ mode: \"all\" }) as VaultPolicy;\n\n/**\n * Intersect two policies. `all` is the identity; two selections keep the IDs\n * present in both (order of `a`).\n */\nexport function intersectVaultPolicies(a: VaultPolicy, b: VaultPolicy): VaultPolicy {\n  if (a.mode === \"all\")\n    return b.mode === \"all\" ? VAULT_POLICY_ALL : { mode: \"selected\", vaultIds: [...b.vaultIds] };\n  if (b.mode === \"all\") return { mode: \"selected\", vaultIds: [...a.vaultIds] };\n  const allowed = new Set(b.vaultIds);\n  return { mode: \"selected\", vaultIds: a.vaultIds.filter((id) => allowed.has(id)) };\n}\n\nexport const VaultAvailability = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      allowedWorkspaceIds: z.array(primitives.uuid).max(500).nullable(), // null = every workspace\n      allowPersonalWorkspaces: primitives.boolean,\n    })\n    .strict(),\n);\nexport type VaultAvailability = z.infer<typeof VaultAvailability>;\n\nexport const VaultSummary = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: primitives.uuid,\n    workspaceId: primitives.uuid,\n    ownerKind: VaultOwnerKind,\n    /** \"Only me\" | workspace name | organization name | \"This task\" */\n    ownerLabel: primitives.string,\n    rootSessionId: primitives.nullableUuid,\n    name: primitives.string,\n    description: primitives.nullableString,\n    source: VaultSource,\n    mode: VaultMode,\n    syncStatus: VaultSyncStatus,\n    syncErrorCode: primitives.nullableString,\n    syncErrorMessage: primitives.nullableString,\n    lastSyncedAt: primitives.nullableString,\n    rateLimitedUntil: primitives.nullableString,\n    providerConnectionId: primitives.nullableUuid,\n    providerOperations: VaultProviderOperations.optional(),\n    freshness: VaultProviderFreshness.optional(),\n    /** Organization and Only-me vaults; null for workspace and task vaults. */\n    availability: VaultAvailability.nullable(),\n    isDefault: primitives.boolean,\n    itemCount: z.number().int(),\n    canWrite: primitives.boolean,\n    canManage: primitives.boolean,\n    generation: z.number().int(),\n    createdAt: primitives.string,\n    updatedAt: primitives.string,\n  }),\n);\nexport type VaultSummary = z.infer<typeof VaultSummary>;\n\nexport const VaultItemReferences = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    primary: primitives.nullableString,\n    otp: primitives.nullableString,\n    byField: z.record(primitives.string, primitives.string),\n  }),\n);\nexport type VaultItemReferences = z.infer<typeof VaultItemReferences>;\n\nexport const VaultItemSummary = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: primitives.uuid,\n    vaultId: primitives.uuid,\n    type: VaultItemType,\n    /** Provider-specific kind of item (`VAULT_ITEM_CATEGORIES`); null for the plain type. */\n    category: primitives.nullableString,\n    name: primitives.string,\n    websites: z.array(primitives.string),\n    /** Native username text field or the connected provider's display hint. */\n    username: primitives.nullableString,\n    hasTotp: primitives.boolean,\n    hasPasskey: primitives.boolean,\n    expiresAt: primitives.nullableString,\n    archivedAt: primitives.nullableString,\n    lastUsedAt: primitives.nullableString,\n    updatedAt: primitives.string,\n    references: VaultItemReferences,\n  }),\n);\nexport type VaultItemSummary = z.infer<typeof VaultItemSummary>;\n\nexport const VaultItemField = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: primitives.uuid,\n    name: primitives.string,\n    kind: VaultFieldKind,\n    position: z.number().int(),\n    /** null for provider fields */\n    currentVersion: z.number().int().nullable(),\n    /** Plaintext ONLY for kind \"text\"; null otherwise. */\n    value: primitives.nullableString,\n    fileName: primitives.nullableString,\n    fileSize: z.number().int().nullable(),\n    reference: primitives.string,\n    updatedAt: primitives.string,\n  }),\n);\nexport type VaultItemField = z.infer<typeof VaultItemField>;\n\nexport const PasskeySummary = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    rpId: primitives.string,\n    userName: primitives.nullableString,\n    /** Last 8 characters of the credential ID. */\n    credentialIdSuffix: primitives.string,\n    signCount: z.number().int(),\n    leasedUntil: primitives.nullableString,\n    lastUsedAt: primitives.nullableString,\n  }),\n);\nexport type PasskeySummary = z.infer<typeof PasskeySummary>;\n\nexport const VaultItem = /* @__PURE__ */ defineSchema(() =>\n  VaultItemSummary.extend({\n    fields: z.array(VaultItemField),\n    passkey: PasskeySummary.nullable(),\n    aliases: z.array(primitives.string),\n    primaryFieldId: primitives.nullableUuid,\n    createdBySubjectId: primitives.nullableString,\n    createdAt: primitives.string,\n    generation: z.number().int(),\n  }),\n);\nexport type VaultItem = z.infer<typeof VaultItem>;\n\nexport const VaultVersionCreatedByKind = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"human\", \"agent\", \"api_key\", \"migration\", \"provider\", \"system\"]),\n);\nexport type VaultVersionCreatedByKind = z.infer<typeof VaultVersionCreatedByKind>;\n\nexport const VaultFieldVersionMeta = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    version: z.number().int(),\n    current: primitives.boolean,\n    createdAt: primitives.string,\n    createdByKind: VaultVersionCreatedByKind,\n    createdBySubjectId: primitives.nullableString,\n  }),\n);\nexport type VaultFieldVersionMeta = z.infer<typeof VaultFieldVersionMeta>;\n\n// ---------------------------------------------------------------------------\n// Requests\n// ---------------------------------------------------------------------------\n\nexport const CreateVaultRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      name: VaultName,\n      description: primitives.string.max(VAULT_LIMITS.descriptionMaxChars).optional(),\n      ownerKind: z.enum([\"user\", \"workspace\", \"organization\"]),\n      availability: VaultAvailability.optional(),\n    })\n    .strict(),\n);\nexport type CreateVaultRequest = z.infer<typeof CreateVaultRequest>;\n\nexport const UpdateVaultRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      expectedGeneration: z.number().int(),\n      name: VaultName.optional(),\n      description: primitives.string.max(VAULT_LIMITS.descriptionMaxChars).nullable().optional(),\n      availability: VaultAvailability.optional(),\n    })\n    .strict(),\n);\nexport type UpdateVaultRequest = z.infer<typeof UpdateVaultRequest>;\n\nexport const DeleteVaultRequest = /* @__PURE__ */ defineSchema(() =>\n  z.object({ confirmName: primitives.nonEmptyString }).strict(),\n);\nexport type DeleteVaultRequest = z.infer<typeof DeleteVaultRequest>;\n\nconst VALUE_SOURCE_KEYS = [\n  \"value\",\n  \"generate\",\n  \"generateKey\",\n  \"fromReference\",\n  \"fileBase64\",\n  \"restoreVersion\",\n  \"remove\",\n] as const;\n\n/** Exactly one value source per field input. */\nexport function exactlyOneValueSource(\n  input: Partial<Record<(typeof VALUE_SOURCE_KEYS)[number], unknown>>,\n): boolean {\n  return VALUE_SOURCE_KEYS.filter((key) => input[key] !== undefined).length === 1;\n}\n\nexport const VaultFieldInput = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      fieldId: primitives.optionalUuid,\n      name: VaultFieldName,\n      /** Default concealed; a field named \"username\" defaults to text. */\n      kind: VaultFieldKind.optional(),\n      value: z.string().optional(),\n      generate: GeneratePasswordSpec.optional(),\n      generateKey: GenerateSshKeySpec.optional(),\n      fromReference: primitives.string.max(VAULT_LIMITS.referenceMaxChars).optional(),\n      fileBase64: z.string().optional(),\n      fileName: z.string().max(255).optional(),\n      restoreVersion: z.number().int().optional(),\n      remove: z.literal(true).optional(),\n    })\n    .strict()\n    .refine(\n      exactlyOneValueSource,\n      \"exactly one of value|generate|generateKey|fromReference|fileBase64|restoreVersion|remove\",\n    ),\n);\nexport type VaultFieldInput = z.infer<typeof VaultFieldInput>;\n\nconst CreateVaultItemShape = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      type: VaultItemType,\n      category: VaultItemCategory.nullable().optional(),\n      name: VaultName,\n      websites: z\n        .array(primitives.string.max(VAULT_LIMITS.websiteMaxChars))\n        .max(VAULT_LIMITS.websitesPerItem)\n        .optional(),\n      expiresAt: primitives.string.datetime({ offset: true }).nullable().optional(),\n      fields: z.array(VaultFieldInput).max(VAULT_LIMITS.fieldsPerItem),\n      primaryFieldName: z.string().optional(),\n    })\n    .strict(),\n);\nexport const CreateVaultItemRequest = CreateVaultItemShape;\nexport type CreateVaultItemRequest = z.infer<typeof CreateVaultItemRequest>;\n\nexport const UpdateVaultItemRequest = /* @__PURE__ */ defineSchema(() =>\n  CreateVaultItemShape.partial().extend({ expectedGeneration: z.number().int() }).strict(),\n);\nexport type UpdateVaultItemRequest = z.infer<typeof UpdateVaultItemRequest>;\n\nexport const MoveVaultItemRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      targetVaultId: primitives.uuid,\n      mode: z.enum([\"move\", \"copy\"]),\n      newName: VaultName.optional(),\n    })\n    .strict(),\n);\nexport type MoveVaultItemRequest = z.infer<typeof MoveVaultItemRequest>;\n\nexport const RevealVaultFieldRequest = /* @__PURE__ */ defineSchema(() =>\n  z.object({ version: z.number().int().optional() }).strict(),\n);\nexport type RevealVaultFieldRequest = z.infer<typeof RevealVaultFieldRequest>;\n\nexport const RevealVaultFieldResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    value: primitives.string,\n    encoding: z.enum([\"utf8\", \"base64\"]),\n    version: z.number().int().nullable(),\n    totp: z\n      .object({\n        code: primitives.string,\n        periodSeconds: z.number().int(),\n        expiresAt: primitives.string,\n      })\n      .nullable(),\n  }),\n);\nexport type RevealVaultFieldResponse = z.infer<typeof RevealVaultFieldResponse>;\n\nexport const RestoreVaultFieldVersionRequest = /* @__PURE__ */ defineSchema(() =>\n  z.object({ version: primitives.positiveInteger }).strict(),\n);\nexport type RestoreVaultFieldVersionRequest = z.infer<typeof RestoreVaultFieldVersionRequest>;\n\nconst QUERY_TRUE = new Set([\"true\", \"1\", \"yes\"]);\nconst QUERY_FALSE = new Set([\"false\", \"0\", \"no\"]);\nconst QueryBoolean = /* @__PURE__ */ defineSchema(() =>\n  z.preprocess((value) => {\n    if (typeof value !== \"string\") return value;\n    const normalized = value.trim().toLowerCase();\n    return QUERY_TRUE.has(normalized) ? true : QUERY_FALSE.has(normalized) ? false : value;\n  }, primitives.boolean),\n);\nconst QueryInt = /* @__PURE__ */ defineSchema(() =>\n  z.preprocess(\n    (value) => (typeof value === \"string\" && /^\\d+$/.test(value) ? Number(value) : value),\n    z.number().int().min(1).max(200),\n  ),\n);\n\n/**\n * Query strings are accepted as strings too (\"true\", \"1\", \"50\"). Archived\n * items are left out unless `includeArchived` is set; a connected vault's\n * archived items are the ones its connected account archived.\n */\nexport const ListVaultItemsQuery = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    q: z.string().max(200).optional(),\n    type: VaultItemType.optional(),\n    includeArchived: QueryBoolean.optional(),\n    cursor: z.string().optional(),\n    limit: QueryInt.optional(),\n  }),\n);\nexport type ListVaultItemsQuery = z.infer<typeof ListVaultItemsQuery>;\n\nexport const ListVaultsResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({ vaults: z.array(VaultSummary) }),\n);\nexport type ListVaultsResponse = z.infer<typeof ListVaultsResponse>;\nexport const ListVaultItemsResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    items: z.array(VaultItemSummary),\n    nextCursor: primitives.nullableString,\n  }),\n);\nexport type ListVaultItemsResponse = z.infer<typeof ListVaultItemsResponse>;\nexport const ListVaultFieldVersionsResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    versions: z.array(VaultFieldVersionMeta),\n  }),\n);\nexport type ListVaultFieldVersionsResponse = z.infer<typeof ListVaultFieldVersionsResponse>;\n\nexport const SetSessionVaultPolicyRequest = /* @__PURE__ */ defineSchema(() =>\n  z.object({ policy: VaultPolicy }).strict(),\n);\nexport type SetSessionVaultPolicyRequest = z.infer<typeof SetSessionVaultPolicyRequest>;\n\nexport const SessionSecretsView = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    capabilityEnabled: primitives.boolean,\n    policy: VaultPolicy,\n    effectiveVaultIds: z.array(primitives.uuid),\n    /** Nearest ancestor that narrowed, if any. */\n    narrowedBySessionId: primitives.nullableUuid,\n    taskVault: VaultSummary.nullable(),\n    taskItems: z.array(VaultItemSummary),\n    reachableVaults: z.array(\n      VaultSummary.extend({ selected: primitives.boolean, selectable: primitives.boolean }),\n    ),\n  }),\n);\nexport type SessionSecretsView = z.infer<typeof SessionSecretsView>;\n\nexport const InstallOnePasswordRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      // Real service-account tokens are long; the dev fakes (ops_fake_healthy) are 16 chars.\n      token: primitives.string.trim().min(16).max(4_096),\n      ownership: z.enum([\"user\", \"workspace\", \"organization\"]),\n      planTier: z.enum([\"family\", \"teams\", \"business\"]).default(\"teams\"),\n      label: z.string().max(120).optional(),\n    })\n    .strict(),\n);\nexport type InstallOnePasswordRequest = z.infer<typeof InstallOnePasswordRequest>;\n\nexport const ProviderVaultMeta = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    externalVaultId: primitives.string,\n    name: primitives.string,\n    itemCount: z.number().int().nullable(),\n    linkedVaultId: primitives.nullableUuid,\n    /** Unknown means the provider does not expose the grant; writes still check upstream. */\n    writeAccess: z.enum([\"read_only\", \"read_write\", \"unknown\"]).optional(),\n    operations: VaultProviderOperations.optional(),\n  }),\n);\nexport type ProviderVaultMeta = z.infer<typeof ProviderVaultMeta>;\n\nexport const InstallOnePasswordResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    connectionId: primitives.uuid,\n    accountName: primitives.nullableString,\n    vaults: z.array(ProviderVaultMeta),\n  }),\n);\nexport type InstallOnePasswordResponse = z.infer<typeof InstallOnePasswordResponse>;\n\n/** A 1Password service account connected in a workspace. Never carries the token. */\nexport const OnePasswordConnectionSummary = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: primitives.uuid,\n    /** Who can use the vaults linked through it. */\n    ownership: z.enum([\"user\", \"workspace\", \"organization\"]),\n    /** Sign-in host from the token, for example \"my.1password.com\". */\n    accountName: primitives.nullableString,\n    label: primitives.nullableString,\n    planTier: z.enum([\"family\", \"teams\", \"business\"]),\n    /** When the current token was last checked against 1Password. */\n    verifiedAt: primitives.string,\n    createdAt: primitives.string,\n    createdBySubjectId: primitives.nullableString,\n    /** The caller can link vaults, replace the token and disconnect it. */\n    canManage: primitives.boolean,\n  }),\n);\nexport type OnePasswordConnectionSummary = z.infer<typeof OnePasswordConnectionSummary>;\n\nexport const ListOnePasswordConnectionsResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    connections: z.array(OnePasswordConnectionSummary),\n  }),\n);\nexport type ListOnePasswordConnectionsResponse = z.infer<typeof ListOnePasswordConnectionsResponse>;\n\n/** A new token for an existing connection; its linked vaults keep working. */\nexport const ReplaceOnePasswordTokenRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      token: primitives.string.trim().min(16).max(4_096),\n      planTier: z.enum([\"family\", \"teams\", \"business\"]).optional(),\n    })\n    .strict(),\n);\nexport type ReplaceOnePasswordTokenRequest = z.infer<typeof ReplaceOnePasswordTokenRequest>;\n\nexport const DisconnectOnePasswordResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    /** The Opengeni vaults that were unlinked. Nothing is deleted in 1Password. */\n    unlinkedVaultIds: z.array(primitives.uuid),\n  }),\n);\nexport type DisconnectOnePasswordResponse = z.infer<typeof DisconnectOnePasswordResponse>;\n\n/** Providers installed through the generic connection lifecycle. */\nexport const ExternalVaultProviderKind = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"external\", \"protonpass\", \"keeper\", \"bitwarden\"]),\n);\nexport type ExternalVaultProviderKind = z.infer<typeof ExternalVaultProviderKind>;\n\n/** Write-only setup material. Never included in connection summaries or logs. */\nexport const VaultProviderCredentials = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"provider\", [\n    z\n      .object({\n        provider: z.literal(\"external\"),\n        endpoint: z.string().url().max(2_048),\n        signingSecret: z.string().min(32).max(4_096),\n      })\n      .strict(),\n    /**\n     * Bitwarden or Vaultwarden: the server address, the account's personal\n     * API key (Settings, Security, Keys) and the master password. The master\n     * password opens the account once during setup and is never stored.\n     */\n    z\n      .object({\n        provider: z.literal(\"bitwarden\"),\n        serverUrl: z.string().trim().min(1).max(2_048),\n        clientId: z.string().trim().min(1).max(200),\n        clientSecret: z.string().trim().min(1).max(1_024),\n        masterPassword: z.string().min(1).max(1_024),\n      })\n      .strict(),\n    z\n      .object({\n        provider: z.literal(\"protonpass\"),\n        token: z.string().min(16).max(4_096),\n      })\n      .strict(),\n    z\n      .object({\n        provider: z.literal(\"keeper\"),\n        oneTimeToken: z.string().min(16).max(4_096),\n        /** Optional region host for tokens that do not encode one. */\n        hostname: z.string().max(253).optional(),\n      })\n      .strict(),\n  ]),\n);\nexport type VaultProviderCredentials = z.infer<typeof VaultProviderCredentials>;\n\nexport const InstallVaultProviderRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      credentials: VaultProviderCredentials,\n      ownership: z.enum([\"user\", \"workspace\", \"organization\"]),\n      label: primitives.string.trim().min(1).max(120).optional(),\n    })\n    .strict(),\n);\nexport type InstallVaultProviderRequest = z.infer<typeof InstallVaultProviderRequest>;\n\nexport const ReplaceVaultProviderCredentialsRequest = /* @__PURE__ */ defineSchema(() =>\n  z.object({ credentials: VaultProviderCredentials }).strict(),\n);\nexport type ReplaceVaultProviderCredentialsRequest = z.infer<\n  typeof ReplaceVaultProviderCredentialsRequest\n>;\n\n/** Includes legacy 1Password connections; existing 1Password routes remain supported. */\nexport const VaultProviderConnectionSummary = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: primitives.uuid,\n    provider: z.enum([\"onepassword\", \"external\", \"protonpass\", \"keeper\", \"bitwarden\"]),\n    ownership: z.enum([\"user\", \"workspace\", \"organization\"]),\n    accountName: primitives.nullableString,\n    label: primitives.nullableString,\n    verifiedAt: primitives.string,\n    createdAt: primitives.string,\n    createdBySubjectId: primitives.nullableString,\n    canManage: primitives.boolean,\n    operations: VaultProviderOperations,\n    /** Only 1Password uses a plan tier. */\n    planTier: z.enum([\"family\", \"teams\", \"business\"]).optional(),\n    /** Unavailable means this deployment cannot run the adapter, not bad credentials. */\n    available: primitives.boolean,\n    /** Setup material is saved, but provider verification has not completed. */\n    verificationStatus: z.enum([\"ready\", \"pending\"]).optional(),\n  }),\n);\nexport type VaultProviderConnectionSummary = z.infer<typeof VaultProviderConnectionSummary>;\n\n/** Deployment configuration, independent of whether anyone has connected yet. */\nexport const VaultProviderAvailability = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    provider: VaultProviderConnectionSummary.shape.provider,\n    available: primitives.boolean,\n    reason: z.enum([\"not_enabled\"]).nullable(),\n  }),\n);\nexport type VaultProviderAvailability = z.infer<typeof VaultProviderAvailability>;\n\nexport const ListVaultProviderConnectionsResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    connections: z.array(VaultProviderConnectionSummary),\n    /** Additive: older servers may omit this metadata-only deployment catalog. */\n    providers: z.array(VaultProviderAvailability).optional(),\n  }),\n);\nexport type ListVaultProviderConnectionsResponse = z.infer<\n  typeof ListVaultProviderConnectionsResponse\n>;\n\nexport const InstallVaultProviderResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    connectionId: primitives.uuid,\n    accountName: primitives.nullableString,\n    provider: ExternalVaultProviderKind,\n    operations: VaultProviderOperations,\n    vaults: z.array(ProviderVaultMeta),\n    /** Retry verification on this connection; never replay a consumed bootstrap token. */\n    discoveryPending: primitives.optionalBoolean,\n    errorCode: z.string().max(100).optional(),\n  }),\n);\nexport type InstallVaultProviderResponse = z.infer<typeof InstallVaultProviderResponse>;\n\nexport const DisconnectVaultProviderResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({ unlinkedVaultIds: z.array(primitives.uuid) }),\n);\nexport type DisconnectVaultProviderResponse = z.infer<typeof DisconnectVaultProviderResponse>;\n\nexport const LinkProviderVaultRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      provider: z.enum([\"onepassword\", \"host\", \"external\", \"protonpass\", \"keeper\", \"bitwarden\"]),\n      /** Required except for an in-process host provider. */\n      connectionId: primitives.optionalUuid,\n      externalVaultId: primitives.string,\n      ownerKind: z.enum([\"user\", \"workspace\", \"organization\"]),\n      mode: VaultMode,\n      name: VaultName.optional(),\n      availability: VaultAvailability.optional(),\n    })\n    .strict(),\n);\nexport type LinkProviderVaultRequest = z.infer<typeof LinkProviderVaultRequest>;\n\nexport const CreateManagedProviderVaultRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      name: VaultName,\n      ownerKind: z.enum([\"user\", \"workspace\", \"organization\"]),\n      groupId: z.string().optional(),\n    })\n    .strict(),\n);\nexport type CreateManagedProviderVaultRequest = z.infer<typeof CreateManagedProviderVaultRequest>;\n\n// ---------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------\n\nexport const VaultErrorCode = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\n    \"vault_not_found\",\n    \"vault_item_not_found\",\n    \"vault_field_not_found\",\n    \"vault_name_conflict\",\n    \"vault_item_name_conflict\",\n    \"vault_limit_reached\",\n    \"vault_read_only\",\n    /**\n     * A writable connected vault cannot do this one thing (an item type, a\n     * file, a one-time password or an operation its provider does not\n     * offer). Unlike `vault_read_only`, other writes still work.\n     */\n    \"vault_operation_unsupported\",\n    \"vault_generation_conflict\",\n    \"vault_permission_denied\",\n    /** A session's vault policy reaches outside its parent's effective vaults (AX-2). */\n    \"vault_policy_outside_parent\",\n    \"vault_reveal_requires_human\",\n    \"encryption_key_missing\",\n    \"provider_auth_invalid\",\n    \"provider_auth_expired\",\n    \"provider_rate_limited\",\n    \"provider_unavailable\",\n    \"provider_conflict\",\n    \"provider_locked\",\n    \"provider_inventory_incomplete\",\n    \"provider_outcome_unknown\",\n    \"variable_sets_removed\",\n    \"secret_save_forbidden\",\n    \"invalid_secret_name\",\n    \"secret_value_too_large\",\n    \"human_auth_required\",\n    \"secret_search_cursor_invalid\",\n  ]),\n);\nexport type VaultErrorCode = z.infer<typeof VaultErrorCode>;\n\nexport const VaultApiError = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    error: VaultErrorCode,\n    message: primitives.string,\n    details: z.record(primitives.string, z.unknown()).optional(),\n  }),\n);\nexport type VaultApiError = z.infer<typeof VaultApiError>;\n\n/** HTTP status for every vault error code (§10B.1.1). */\nexport const VAULT_ERROR_HTTP_STATUS: Readonly<Record<VaultErrorCode, number>> = {\n  vault_not_found: 404,\n  vault_item_not_found: 404,\n  vault_field_not_found: 404,\n  vault_name_conflict: 409,\n  vault_item_name_conflict: 409,\n  vault_generation_conflict: 409,\n  provider_conflict: 409,\n  vault_limit_reached: 422,\n  invalid_secret_name: 422,\n  secret_value_too_large: 422,\n  secret_save_forbidden: 422,\n  secret_search_cursor_invalid: 422,\n  vault_policy_outside_parent: 422,\n  vault_read_only: 403,\n  vault_operation_unsupported: 422,\n  vault_permission_denied: 403,\n  vault_reveal_requires_human: 403,\n  human_auth_required: 403,\n  variable_sets_removed: 422,\n  encryption_key_missing: 503,\n  provider_unavailable: 503,\n  provider_rate_limited: 429,\n  provider_auth_invalid: 401,\n  provider_auth_expired: 401,\n  provider_locked: 423,\n  provider_inventory_incomplete: 503,\n  provider_outcome_unknown: 503,\n};\n\n// ---------------------------------------------------------------------------\n// Agent tools (capability `secrets`)\n// ---------------------------------------------------------------------------\n\nexport const SECRET_TOOL_NAMES = [\n  \"secret_search\",\n  \"secret_save\",\n  \"secret_get\",\n  \"secret_move\",\n  \"secret_delete\",\n] as const;\nexport type SecretToolName = (typeof SECRET_TOOL_NAMES)[number];\n\nexport const SECRET_SAVE_TO = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"user\", \"task\", \"workspace\"]),\n);\nexport type SecretSaveTo = z.infer<typeof SECRET_SAVE_TO>;\n\nexport const SecretSearchInput = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      query: z.string().max(200).optional(),\n      website: primitives.string.max(VAULT_LIMITS.websiteMaxChars).optional(),\n      type: VaultItemType.optional(),\n      /** Vault name or ID. */\n      vault: z.string().max(200).optional(),\n      limit: z.number().int().min(1).max(VAULT_LIMITS.searchResultsMax).default(20),\n      /** `nextCursor` from the previous call with the same filters. */\n      cursor: primitives.string.max(VAULT_LIMITS.searchCursorMaxChars).optional(),\n      /** Refresh provider metadata and subsequent value reads; never bypass rate limits. */\n      refresh: primitives.optionalBoolean,\n    })\n    .strict(),\n);\nexport type SecretSearchInput = z.infer<typeof SecretSearchInput>;\n\nexport const SecretSearchResult = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    vault: z.object({\n      id: primitives.uuid,\n      name: primitives.string,\n      ownerKind: VaultOwnerKind,\n      source: VaultSource,\n      mode: VaultMode,\n    }),\n    item: z.object({\n      id: primitives.uuid,\n      name: primitives.string,\n      type: VaultItemType,\n      category: primitives.nullableString,\n      websites: z.array(primitives.string),\n      username: primitives.nullableString,\n      hasTotp: primitives.boolean,\n      hasPasskey: primitives.boolean,\n      expiresAt: primitives.nullableString,\n    }),\n    fields: z.array(z.object({ name: primitives.string, kind: VaultFieldKind })),\n    references: VaultItemReferences,\n  }),\n);\nexport type SecretSearchResult = z.infer<typeof SecretSearchResult>;\nexport const SecretSearchVault = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: primitives.uuid,\n    name: primitives.string,\n    ownerKind: VaultOwnerKind,\n    source: VaultSource,\n    mode: VaultMode,\n    itemCount: primitives.nonnegativeInteger,\n    freshness: VaultProviderFreshness.optional(),\n  }),\n);\nexport type SecretSearchVault = z.infer<typeof SecretSearchVault>;\nexport const SecretSearchOutput = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    items: z.array(SecretSearchResult),\n    /** True when more matches remain; pass `nextCursor` to continue. */\n    truncated: primitives.boolean,\n    nextCursor: primitives.nullableString,\n    /** Every vault the caller can reach, on the first page only. */\n    vaults: z.array(SecretSearchVault).optional(),\n    /** False when a reachable provider could not be checked; empty items are not proof of absence. */\n    complete: primitives.optionalBoolean,\n    /** Included on every page so failures are not lost after page one. */\n    sources: z\n      .array(\n        z.object({\n          vaultId: primitives.uuid,\n          freshness: VaultProviderFreshness,\n        }),\n      )\n      .optional(),\n  }),\n);\nexport type SecretSearchOutput = z.infer<typeof SecretSearchOutput>;\n\nexport const SecretSaveFieldInput = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      name: VaultFieldName,\n      kind: VaultFieldKind.optional(),\n      value: z.string().optional(),\n      generate: GeneratePasswordSpec.optional(),\n      /** An `ssh_key` item's \"private key\" only: a new key pair. */\n      generateKey: GenerateSshKeySpec.optional(),\n      fromReference: primitives.string.max(VAULT_LIMITS.referenceMaxChars).optional(),\n      restoreVersion: z.number().int().optional(),\n    })\n    .strict()\n    .refine(\n      exactlyOneValueSource,\n      \"exactly one of value|generate|generateKey|fromReference|restoreVersion\",\n    ),\n);\nexport type SecretSaveFieldInput = z.infer<typeof SecretSaveFieldInput>;\n\nexport const SecretSaveInput = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      item: VaultName,\n      /** Vault name or ID; defaults to the saveTo scope's default vault. */\n      vault: z.string().max(200).optional(),\n      saveTo: SECRET_SAVE_TO.optional(),\n      type: VaultItemType.default(\"login\"),\n      /** A more specific kind of item, such as \"database\" or \"bank_account\". */\n      category: VaultItemCategory.nullable().optional(),\n      websites: z\n        .array(primitives.string.max(VAULT_LIMITS.websiteMaxChars))\n        .max(VAULT_LIMITS.websitesPerItem)\n        .optional(),\n      username: z.string().max(512).optional(),\n      fields: z.array(SecretSaveFieldInput).max(VAULT_LIMITS.fieldsPerItem).optional(),\n      mode: z.enum([\"create\", \"update\", \"upsert\"]).default(\"upsert\"),\n    })\n    .strict(),\n);\nexport type SecretSaveInput = z.infer<typeof SecretSaveInput>;\nexport const SecretSaveOutput = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    item: VaultItemSummary,\n    references: VaultItemReferences,\n    generatedFields: z.array(primitives.string),\n  }),\n);\nexport type SecretSaveOutput = z.infer<typeof SecretSaveOutput>;\n\nexport const SecretGetInput = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      reference: primitives.nonEmptyString.max(VAULT_LIMITS.referenceMaxChars),\n      version: z.number().int().optional(),\n    })\n    .strict(),\n);\nexport type SecretGetInput = z.infer<typeof SecretGetInput>;\nexport const SecretGetOutput = RevealVaultFieldResponse;\nexport type SecretGetOutput = RevealVaultFieldResponse;\n\nexport const SecretMoveInput = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      reference: primitives.nonEmptyString.max(VAULT_LIMITS.referenceMaxChars),\n      /** Vault name or ID. */\n      toVault: z.string().min(1).max(200),\n      mode: z.enum([\"move\", \"copy\"]).default(\"move\"),\n      newName: VaultName.optional(),\n    })\n    .strict(),\n);\nexport type SecretMoveInput = z.infer<typeof SecretMoveInput>;\nexport const SecretMoveOutput = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    item: VaultItemSummary,\n    references: VaultItemReferences,\n  }),\n);\nexport type SecretMoveOutput = z.infer<typeof SecretMoveOutput>;\n\nexport const SecretDeleteInput = /* @__PURE__ */ defineSchema(() =>\n  z.object({ reference: primitives.nonEmptyString.max(VAULT_LIMITS.referenceMaxChars) }).strict(),\n);\nexport type SecretDeleteInput = z.infer<typeof SecretDeleteInput>;\nexport const SecretDeleteOutput = /* @__PURE__ */ defineSchema(() =>\n  z.object({ archived: z.literal(true), restoreHint: primitives.string }),\n);\nexport type SecretDeleteOutput = z.infer<typeof SecretDeleteOutput>;\n\n// ---------------------------------------------------------------------------\n// Events, audit and metrics (§10B.1.9)\n// ---------------------------------------------------------------------------\n\nexport const VAULT_POLICY_UPDATED_EVENT_TYPE = \"session.vaultPolicy.updated\" as const;\n\nexport const VAULT_AUDIT_ACTIONS = [\n  \"vault.created\",\n  \"vault.updated\",\n  \"vault.deleted\",\n  \"vault.item.created\",\n  \"vault.item.updated\",\n  \"vault.item.archived\",\n  \"vault.item.restored\",\n  \"vault.item.deleted\",\n  \"vault.item.moved\",\n  \"vault.item.copied\",\n  \"vault.field.set\",\n  \"vault.field.revealed\",\n  \"vault.secret.used\",\n  \"vault.secret.read\",\n  \"vault.secret.read.denied\",\n  \"vault.reference.failed\",\n  \"vault.provider.connected\",\n  \"vault.provider.linked\",\n  \"vault.provider.synced\",\n  \"vault.provider.error\",\n  \"vault.passkey.registered\",\n  \"vault.passkey.asserted\",\n  \"vault.policy.updated\",\n  \"vault.migrated\",\n] as const;\nexport const VaultAuditAction = /* @__PURE__ */ defineSchema(() => z.enum(VAULT_AUDIT_ACTIONS));\nexport type VaultAuditAction = z.infer<typeof VaultAuditAction>;\nexport const VAULT_AUDIT_TARGET_TYPES = [\"vault\", \"vault_item\"] as const;\n\nexport const VAULT_METRIC_NAMES = {\n  resolutions: \"opengeni_secret_resolutions_total\",\n  resolutionDuration: \"opengeni_secret_resolution_duration_seconds\",\n  execEnvBytes: \"opengeni_secret_exec_env_bytes\",\n  providerCalls: \"opengeni_vault_provider_calls_total\",\n  providerRateLimited: \"opengeni_vault_provider_rate_limited_total\",\n  passkeyAssertions: \"opengeni_passkey_assertions_total\",\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;AAcA,SAAS,SAAS;AAEX,IAAM,mCAAmC;AAEzC,IAAM,wCAAwC;AAErD,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,SAAS;AAEf,SAAS,iBAAiB,OAAwB;AAChD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,OAAO,MAAQ,OAAO,IAAM,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AAEO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,EACG,OAAO;AAAA,IACN,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,IACnD,WAAsB,QAAQ,QAAQ,IAAI;AAAA,IAC1C,WAAsB,QAAQ,QAAQ,IAAI;AAAA,IAC1C,QAAmB,QAAQ,QAAQ,IAAI;AAAA,IACvC,SAAoB,QAAQ,QAAQ,IAAI;AAAA;AAAA;AAAA,IAGxC,WAAW,EACR,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,OAAO,kBAAkB,kDAAkD,EAC3E,QAAQ,gCAAgC;AAAA,IAC3C,kBAA6B,QAAQ,QAAQ,IAAI;AAAA,IACjD,kBAA6B,QAAQ,QAAQ,IAAI;AAAA,EACnD,CAAC,EACA,OAAO,EACP;AAAA,IACC,CAAC,SAAS,KAAK,aAAa,KAAK,aAAa,KAAK,UAAU,KAAK;AAAA,IAClE;AAAA,EACF;AACJ;AAIO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,cAAc,GAAuB;AAC5C,QAAM,QAAQ,IAAI,WAAW,CAAC;AAC9B,aAAW,OAAO,gBAAgB,KAAK;AACvC,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAuB;AAC/C,SAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;AACpC;AAGO,SAAS,yBAAyB,MAAsC;AAC7E,QAAM,YAAY,KAAK,mBAAmB,IAAI,IAAI,qCAAqC,IAAI;AAC3F,QAAM,QAAQ,CAAC,aACb,iBAAiB,QAAQ,EACtB,MAAM,EAAE,EACR,OAAO,CAAC,cAAc,CAAC,WAAW,IAAI,SAAS,CAAC,EAChD,KAAK,EAAE;AACZ,QAAM,UAAoB,CAAC;AAC3B,MAAI,KAAK,UAAW,SAAQ,KAAK,MAAM,SAAS,CAAC;AACjD,MAAI,KAAK,UAAW,SAAQ,KAAK,MAAM,SAAS,CAAC;AACjD,MAAI,KAAK,OAAQ,SAAQ,KAAK,MAAM,MAAM,CAAC;AAC3C,MAAI,KAAK,QAAS,SAAQ,KAAK,MAAM,KAAK,SAAS,CAAC;AACpD,SAAO,QAAQ,OAAO,CAAC,eAAe,WAAW,SAAS,CAAC;AAC7D;AAGA,SAAS,eAAe,OAAe,MAAc,QAA6C;AAChG,MAAI,OAAO,KAAK,OAAO,IAAK,OAAM,IAAI,uBAAuB,4BAA4B;AACzF,QAAM,QAAQ,MAAO,MAAM;AAC3B,QAAM,MAAgB,CAAC;AACvB,MAAI,QAAQ;AACZ,SAAO,IAAI,SAAS,OAAO;AACzB,UAAM,QAAQ,OAAO,KAAK,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC;AAC3D,eAAW,QAAQ,OAAO;AACxB,UAAI,OAAO,MAAO,KAAI,KAAK,OAAO,IAAI;AACtC,UAAI,IAAI,WAAW,MAAO;AAAA,IAC5B;AACA,aAAS;AACT,QAAI,QAAQ,IAAQ,OAAM,IAAI,uBAAuB,wCAAwC;AAAA,EAC/F;AACA,SAAO;AACT;AAGO,SAAS,iBACd,MACA,SAAoC,eAC5B;AACR,QAAM,SAAS,qBAAqB,MAAM,QAAQ,CAAC,CAAC;AACpD,QAAM,UAAU,yBAAyB,MAAM;AAC/C,MAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,uBAAuB,yBAAyB;AACpF,QAAM,WAAW,iBAAiB,QAAQ,KAAK,EAAE,CAAC;AAClD,QAAM,iBAAiB,OAAO,mBAAmB,UAAU,CAAC;AAC5D,MAAI,eAAe,SAAS,OAAO,QAAQ;AACzC,UAAM,IAAI,uBAAuB,uDAAuD;AAAA,EAC1F;AACA,WAAS,UAAU,GAAG,UAAU,KAAO,WAAW,GAAG;AACnD,UAAM,WAAW,eAAe,OAAO,QAAQ,SAAS,QAAQ,MAAM,EACnE,IAAI,CAAC,UAAU,SAAS,KAAK,CAAE,EAC/B,KAAK,EAAE;AACV,QAAI,eAAe,MAAM,CAAC,eAAe,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,MAAM,WAAW,SAAS,CAAC,CAAC,CAAC,GAAG;AAC3F,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,IAAI,uBAAuB,oDAAoD;AACvF;AAQO,SAAS,iBAAiB,UAG/B;AACA,MAAI,OAAO;AACX,MAAI,QAAQ,KAAK,QAAQ,EAAG,SAAQ;AACpC,MAAI,QAAQ,KAAK,QAAQ,EAAG,SAAQ;AACpC,MAAI,QAAQ,KAAK,QAAQ,EAAG,SAAQ;AACpC,MAAI,eAAe,KAAK,QAAQ,EAAG,SAAQ;AAC3C,QAAM,SAAS,CAAC,GAAG,QAAQ,EAAE;AAC7B,QAAM,OAAO,SAAS,IAAI,IAAI,KAAK,MAAM,SAAS,KAAK,KAAK,IAAI,IAAI,EAAE,IAAI;AAC1E,QAAM,QACJ,OAAO,KAAK,SAAS,OAAO,KAAK,SAAS,OAAO,MAAM,WAAW;AACpE,SAAO,EAAE,MAAM,MAAM;AACvB;;;AChJA,SAAS,KAAAA,UAAS;AAGX,IAAM,iBAAiC;AAAA,EAAa,MACzDC,GAAE,KAAK,CAAC,QAAQ,aAAa,gBAAgB,MAAM,CAAC;AACtD;AAEO,IAAM,cAA8B;AAAA,EAAa,MACtDA,GAAE,KAAK,CAAC,YAAY,eAAe,QAAQ,YAAY,cAAc,UAAU,WAAW,CAAC;AAC7F;AAEO,IAAM,YAA4B,6BAAa,MAAMA,GAAE,KAAK,CAAC,cAAc,WAAW,CAAC,CAAC;AAExF,IAAM,kBAAkC;AAAA,EAAa,MAC1DA,GAAE,KAAK,CAAC,MAAM,WAAW,SAAS,gBAAgB,cAAc,CAAC;AACnE;AASO,IAAM,gBAAgC;AAAA,EAAa,MACxDA,GAAE,KAAK,CAAC,SAAS,WAAW,QAAQ,QAAQ,WAAW,QAAQ,YAAY,SAAS,CAAC;AACvF;AAIO,IAAM,wBAAwB;AAO9B,IAAM,8BAA8B;AACpC,IAAM,oBAAoC;AAAA,EAAa,MAC5DA,GAAE,OAAO,EAAE,MAAM,6BAA6B,kCAAkC;AAClF;AAOO,IAAM,wBAAwB;AAAA,EACnC,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,eAAe;AAAA,EACf,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,aAAa;AAAA,EACb,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,OAAO;AACT;AAQO,SAAS,uBAAuB,KAA4B;AACjE,QAAM,QAAQ,IACX,UAAU,MAAM,EAChB,QAAQ,oBAAoB,EAAE,EAC9B,QAAQ,sBAAsB,OAAO,EACrC,QAAQ,yBAAyB,OAAO,EACxC,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE,EACtB,MAAM,GAAG,EAAE,EACX,QAAQ,OAAO,EAAE;AACpB,SAAO,4BAA4B,KAAK,KAAK,IAAI,QAAQ;AAC3D;AAOO,IAAM,yBAET;AAAA,EACF,OAAO;AAAA,IACL,EAAE,MAAM,YAAY,MAAM,OAAO;AAAA,IACjC,EAAE,MAAM,YAAY,MAAM,YAAY;AAAA,IACtC,EAAE,MAAM,qBAAqB,MAAM,OAAO;AAAA,EAC5C;AAAA,EACA,SAAS,CAAC,EAAE,MAAM,SAAS,MAAM,YAAY,CAAC;AAAA,EAC9C,MAAM,CAAC,EAAE,MAAM,QAAQ,MAAM,YAAY,CAAC;AAAA,EAC1C,MAAM,CAAC;AAAA,EACP,SAAS,CAAC;AAAA,EACV,MAAM;AAAA,IACJ,EAAE,MAAM,mBAAmB,MAAM,OAAO;AAAA,IACxC,EAAE,MAAM,SAAS,MAAM,OAAO;AAAA,IAC9B,EAAE,MAAM,UAAU,MAAM,YAAY;AAAA,IACpC,EAAE,MAAM,gBAAgB,MAAM,OAAO;AAAA,IACrC,EAAE,MAAM,eAAe,MAAM,OAAO;AAAA,IACpC,EAAE,MAAM,iBAAiB,MAAM,YAAY;AAAA,EAC7C;AAAA,EACA,UAAU;AAAA,IACR,EAAE,MAAM,SAAS,MAAM,OAAO;AAAA,IAC9B,EAAE,MAAM,cAAc,MAAM,OAAO;AAAA,IACnC,EAAE,MAAM,eAAe,MAAM,OAAO;AAAA,IACpC,EAAE,MAAM,aAAa,MAAM,OAAO;AAAA,IAClC,EAAE,MAAM,YAAY,MAAM,OAAO;AAAA,IACjC,EAAE,MAAM,WAAW,MAAM,OAAO;AAAA,IAChC,EAAE,MAAM,SAAS,MAAM,OAAO;AAAA,IAC9B,EAAE,MAAM,SAAS,MAAM,OAAO;AAAA,IAC9B,EAAE,MAAM,aAAa,MAAM,OAAO;AAAA,IAClC,EAAE,MAAM,aAAa,MAAM,OAAO;AAAA,IAClC,EAAE,MAAM,aAAa,MAAM,OAAO;AAAA,IAClC,EAAE,MAAM,QAAQ,MAAM,OAAO;AAAA,IAC7B,EAAE,MAAM,SAAS,MAAM,OAAO;AAAA,IAC9B,EAAE,MAAM,eAAe,MAAM,OAAO;AAAA,IACpC,EAAE,MAAM,WAAW,MAAM,OAAO;AAAA,IAChC,EAAE,MAAM,sBAAsB,MAAM,YAAY;AAAA,IAChD,EAAE,MAAM,mBAAmB,MAAM,YAAY;AAAA,IAC7C,EAAE,MAAM,kBAAkB,MAAM,YAAY;AAAA,EAC9C;AAAA,EACA,SAAS;AAAA,IACP,EAAE,MAAM,eAAe,MAAM,YAAY;AAAA,IACzC,EAAE,MAAM,cAAc,MAAM,OAAO;AAAA,IACnC,EAAE,MAAM,eAAe,MAAM,OAAO;AAAA,EACtC;AACF;AAQO,IAAM,qBAAqC;AAAA,EAAa,MAC7DA,GAAE,OAAO,EAAE,WAAWA,GAAE,KAAK,CAAC,WAAW,SAAS,CAAC,EAAE,QAAQ,SAAS,EAAE,CAAC,EAAE,OAAO;AACpF;AASO,IAAM,4BAET;AAAA,EACF,MAAM;AAAA,IACJ,mBAAmB,CAAC,cAAc,cAAc;AAAA,IAChD,OAAO,CAAC,QAAQ,WAAW;AAAA,IAC3B,QAAQ,CAAC,aAAa;AAAA,IACtB,iBAAiB,CAAC,uBAAuB,OAAO,OAAO,QAAQ,KAAK;AAAA,IACpE,gBAAgB,CAAC,aAAa,kBAAkB;AAAA,IAChD,eAAe,CAAC,YAAY,iBAAiB;AAAA,EAC/C;AAAA,EACA,UAAU;AAAA,IACR,cAAc,CAAC,aAAa,YAAY;AAAA,IACxC,eAAe,CAAC,WAAW,gBAAgB;AAAA,IAC3C,aAAa,CAAC,YAAY,WAAW,aAAa;AAAA,IAClD,OAAO,CAAC,eAAe;AAAA,IACvB,OAAO,CAAC,gBAAgB,eAAe;AAAA,IACvC,aAAa,CAAC,WAAW,gBAAgB;AAAA,IACzC,eAAe,CAAC,OAAO,YAAY,UAAU;AAAA,IAC7C,sBAAsB,CAAC,OAAO,wBAAwB;AAAA,EACxD;AAAA,EACA,SAAS,CAAC;AACZ;AAEA,SAAS,aAAa,MAAsB;AAC1C,SAAO,KAAK,UAAU,KAAK,EAAE,KAAK,EAAE,YAAY;AAClD;AAOO,SAAS,uBAAuB,MAAqB,MAA6B;AACvF,QAAM,MAAM,aAAa,IAAI;AAC7B,QAAM,WAAW,uBAAuB,IAAI,EAAE,KAAK,CAAC,UAAU,aAAa,MAAM,IAAI,MAAM,GAAG;AAC9F,MAAI,SAAU,QAAO,SAAS;AAC9B,aAAW,CAAC,WAAW,QAAQ,KAAK,OAAO,QAAQ,0BAA0B,IAAI,KAAK,CAAC,CAAC,GAAG;AACzF,QAAI,SAAS,KAAK,CAAC,YAAY,aAAa,OAAO,MAAM,GAAG,EAAG,QAAO;AAAA,EACxE;AACA,SAAO;AACT;AAOO,SAAS,2BAA2B,MAAwB;AACjE,QAAM,MAAM,aAAa,IAAI;AAC7B,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,SAAS,OAAO,OAAO,yBAAyB,GAAG;AAC5D,eAAW,CAAC,WAAW,QAAQ,KAAK,OAAO,QAAQ,SAAS,CAAC,CAAC,GAAG;AAC/D,YAAM,QAAQ,CAAC,WAAW,GAAG,QAAQ;AACrC,UAAI,CAAC,MAAM,KAAK,CAAC,UAAU,aAAa,KAAK,MAAM,GAAG,EAAG;AACzD,iBAAW,SAAS,MAAO,KAAI,aAAa,KAAK,MAAM,IAAK,KAAI,IAAI,KAAK;AAAA,IAC3E;AAAA,EACF;AACA,SAAO,CAAC,GAAG,GAAG;AAChB;AACO,IAAM,iBAAiC;AAAA,EAAa,MACzDA,GAAE,KAAK,CAAC,QAAQ,aAAa,QAAQ,MAAM,CAAC;AAC9C;AAIO,IAAM,0BAA0C;AAAA,EAAa,MAClEA,GACG,OAAO;AAAA,IACN,iBAAiBA,GAAE,MAAM,aAAa,EAAE,IAAI,qBAAqB;AAAA,IACjE,YAAuB;AAAA,IACvB,aAAwB;AAAA,IACxB,aAAwB;AAAA,IACxB,aAAaA,GAAE,KAAK,CAAC,WAAW,SAAS,MAAM,CAAC;AAAA;AAAA,IAEhD,YAAYA,GAAE,QAAQ,KAAK;AAAA,IAC3B,aAAwB;AAAA,IACxB,WAAsB;AAAA,IACtB,YAAuB;AAAA,IACvB,YAAuB;AAAA,IACvB,YAAuB;AAAA,IACvB,aAAwB;AAAA,IACxB,qBAAgC;AAAA,EAClC,CAAC,EACA,OAAO;AACZ;AAGA,IAAM,wBAAwB,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,EAAE;AAOvD,SAAS,kBACd,MACA,OACwC;AACxC,SAAO,sBAAsB,IAAI,KAAK,sBAAsB,KAAK,IAAI,OAAO;AAC9E;AAGO,IAAM,yBAAyC;AAAA,EAAa,MACjEA,GACG,OAAO;AAAA,IACN,OAAOA,GAAE,KAAK,CAAC,WAAW,SAAS,cAAc,aAAa,CAAC;AAAA,IAC/D,eAAeA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC9C,gBAAgBA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC/C,QAAQA,GAAE,KAAK,CAAC,QAAQ,SAAS,SAAS,CAAC;AAAA,IAC3C,WAAWA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACxC,SAASA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,qBAAqB,CAAC,QAAQ,QAAQ,aAAa,cAAc;AAGvE,IAAM,eAAe;AAAA,EAC1B,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,cAAc;AAAA,EACd,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,kBAAkB;AAAA;AAAA,EAElB,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,yBAAyB;AAAA,EACzB,sBAAsB;AACxB;AAGO,IAAM,sBAAsB;AAAA,EACjC,MAAM;AAAA,EACN,WAAW;AAAA,EACX,MAAM;AACR;AAMO,IAAM,8BAA8E;AAAA,EACzF,OAAO;AAAA,EACP,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,SAAS;AAAA,EACT,MAAM;AAAA,EACN,UAAU;AAAA,EACV,SAAS;AACX;AAGO,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,IAAM,4BAA4B;AAO3B,SAAS,kBAAkB,MAAuB;AACvD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,QAAM,SAAS,CAAC,GAAG,IAAI,EAAE;AACzB,MAAI,SAAS,KAAK,SAAS,aAAa,aAAc,QAAO;AAC7D,MAAI,0BAA0B,KAAK,IAAI,EAAG,QAAO;AACjD,MAAI,KAAK,KAAK,MAAM,KAAM,QAAO;AACjC,MAAI,KAAK,YAAY,EAAE,WAAW,KAAK,EAAG,QAAO;AACjD,SAAO;AACT;AAGO,SAAS,yBAAyB,MAAuB;AAC9D,SAAO,KAAK,UAAU,KAAK,EAAE,KAAK,EAAE,YAAY,MAAM;AACxD;AAEO,IAAM,YAA4B;AAAA,EAAa,MACzC,eACR,IAAI,aAAa,YAAY,EAC7B,OAAO,mBAAmB,qBAAqB;AACpD;AACO,IAAM,iBAAiC;AAAA,EAAa,MACzD,UAAU,OAAO,CAAC,SAAS,CAAC,yBAAyB,IAAI,GAAG,qBAAqB;AACnF;AAEO,IAAM,cAA8B;AAAA,EAAa,MACtDA,GAAE,mBAAmB,QAAQ;AAAA,IAC3BA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,KAAK,EAAE,CAAC,EAAE,OAAO;AAAA,IAC5CA,GACG,OAAO;AAAA,MACN,MAAMA,GAAE,QAAQ,UAAU;AAAA,MAC1B,UAAUA,GAAE,MAAiB,IAAI,EAAE,IAAI,aAAa,iBAAiB;AAAA,IACvE,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH;AAEO,IAAM,mBAAgC,OAAO,OAAO,EAAE,MAAM,MAAM,CAAC;AAMnE,SAAS,uBAAuB,GAAgB,GAA6B;AAClF,MAAI,EAAE,SAAS;AACb,WAAO,EAAE,SAAS,QAAQ,mBAAmB,EAAE,MAAM,YAAY,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE;AAC7F,MAAI,EAAE,SAAS,MAAO,QAAO,EAAE,MAAM,YAAY,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE;AAC3E,QAAM,UAAU,IAAI,IAAI,EAAE,QAAQ;AAClC,SAAO,EAAE,MAAM,YAAY,UAAU,EAAE,SAAS,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC,EAAE;AAClF;AAEO,IAAM,oBAAoC;AAAA,EAAa,MAC5DA,GACG,OAAO;AAAA,IACN,qBAAqBA,GAAE,MAAiB,IAAI,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,IAChE,yBAAoC;AAAA,EACtC,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,eAA+B;AAAA,EAAa,MACvDA,GAAE,OAAO;AAAA,IACP,IAAe;AAAA,IACf,aAAwB;AAAA,IACxB,WAAW;AAAA;AAAA,IAEX,YAAuB;AAAA,IACvB,eAA0B;AAAA,IAC1B,MAAiB;AAAA,IACjB,aAAwB;AAAA,IACxB,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,eAA0B;AAAA,IAC1B,kBAA6B;AAAA,IAC7B,cAAyB;AAAA,IACzB,kBAA6B;AAAA,IAC7B,sBAAiC;AAAA,IACjC,oBAAoB,wBAAwB,SAAS;AAAA,IACrD,WAAW,uBAAuB,SAAS;AAAA;AAAA,IAE3C,cAAc,kBAAkB,SAAS;AAAA,IACzC,WAAsB;AAAA,IACtB,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,IAC1B,UAAqB;AAAA,IACrB,WAAsB;AAAA,IACtB,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,WAAsB;AAAA,IACtB,WAAsB;AAAA,EACxB,CAAC;AACH;AAGO,IAAM,sBAAsC;AAAA,EAAa,MAC9DA,GAAE,OAAO;AAAA,IACP,SAAoB;AAAA,IACpB,KAAgB;AAAA,IAChB,SAASA,GAAE,OAAkB,QAAmB,MAAM;AAAA,EACxD,CAAC;AACH;AAGO,IAAM,mBAAmC;AAAA,EAAa,MAC3DA,GAAE,OAAO;AAAA,IACP,IAAe;AAAA,IACf,SAAoB;AAAA,IACpB,MAAM;AAAA;AAAA,IAEN,UAAqB;AAAA,IACrB,MAAiB;AAAA,IACjB,UAAUA,GAAE,MAAiB,MAAM;AAAA;AAAA,IAEnC,UAAqB;AAAA,IACrB,SAAoB;AAAA,IACpB,YAAuB;AAAA,IACvB,WAAsB;AAAA,IACtB,YAAuB;AAAA,IACvB,YAAuB;AAAA,IACvB,WAAsB;AAAA,IACtB,YAAY;AAAA,EACd,CAAC;AACH;AAGO,IAAM,iBAAiC;AAAA,EAAa,MACzDA,GAAE,OAAO;AAAA,IACP,IAAe;AAAA,IACf,MAAiB;AAAA,IACjB,MAAM;AAAA,IACN,UAAUA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA,IAEzB,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,IAE1C,OAAkB;AAAA,IAClB,UAAqB;AAAA,IACrB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACpC,WAAsB;AAAA,IACtB,WAAsB;AAAA,EACxB,CAAC;AACH;AAGO,IAAM,iBAAiC;AAAA,EAAa,MACzDA,GAAE,OAAO;AAAA,IACP,MAAiB;AAAA,IACjB,UAAqB;AAAA;AAAA,IAErB,oBAA+B;AAAA,IAC/B,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,IAC1B,aAAwB;AAAA,IACxB,YAAuB;AAAA,EACzB,CAAC;AACH;AAGO,IAAM,YAA4B;AAAA,EAAa,MACpD,iBAAiB,OAAO;AAAA,IACtB,QAAQA,GAAE,MAAM,cAAc;AAAA,IAC9B,SAAS,eAAe,SAAS;AAAA,IACjC,SAASA,GAAE,MAAiB,MAAM;AAAA,IAClC,gBAA2B;AAAA,IAC3B,oBAA+B;AAAA,IAC/B,WAAsB;AAAA,IACtB,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,CAAC;AACH;AAGO,IAAM,4BAA4C;AAAA,EAAa,MACpEA,GAAE,KAAK,CAAC,SAAS,SAAS,WAAW,aAAa,YAAY,QAAQ,CAAC;AACzE;AAGO,IAAM,wBAAwC;AAAA,EAAa,MAChEA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,IACxB,SAAoB;AAAA,IACpB,WAAsB;AAAA,IACtB,eAAe;AAAA,IACf,oBAA+B;AAAA,EACjC,CAAC;AACH;AAOO,IAAM,qBAAqC;AAAA,EAAa,MAC7DA,GACG,OAAO;AAAA,IACN,MAAM;AAAA,IACN,aAAwB,OAAO,IAAI,aAAa,mBAAmB,EAAE,SAAS;AAAA,IAC9E,WAAWA,GAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAAA,IACvD,cAAc,kBAAkB,SAAS;AAAA,EAC3C,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,qBAAqC;AAAA,EAAa,MAC7DA,GACG,OAAO;AAAA,IACN,oBAAoBA,GAAE,OAAO,EAAE,IAAI;AAAA,IACnC,MAAM,UAAU,SAAS;AAAA,IACzB,aAAwB,OAAO,IAAI,aAAa,mBAAmB,EAAE,SAAS,EAAE,SAAS;AAAA,IACzF,cAAc,kBAAkB,SAAS;AAAA,EAC3C,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,qBAAqC;AAAA,EAAa,MAC7DA,GAAE,OAAO,EAAE,aAAwB,eAAe,CAAC,EAAE,OAAO;AAC9D;AAGA,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,SAAS,sBACd,OACS;AACT,SAAO,kBAAkB,OAAO,CAAC,QAAQ,MAAM,GAAG,MAAM,MAAS,EAAE,WAAW;AAChF;AAEO,IAAM,kBAAkC;AAAA,EAAa,MAC1DA,GACG,OAAO;AAAA,IACN,SAAoB;AAAA,IACpB,MAAM;AAAA;AAAA,IAEN,MAAM,eAAe,SAAS;AAAA,IAC9B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,UAAU,qBAAqB,SAAS;AAAA,IACxC,aAAa,mBAAmB,SAAS;AAAA,IACzC,eAA0B,OAAO,IAAI,aAAa,iBAAiB,EAAE,SAAS;AAAA,IAC9E,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAUA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACvC,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC1C,QAAQA,GAAE,QAAQ,IAAI,EAAE,SAAS;AAAA,EACnC,CAAC,EACA,OAAO,EACP;AAAA,IACC;AAAA,IACA;AAAA,EACF;AACJ;AAGA,IAAM,uBAAuC;AAAA,EAAa,MACxDA,GACG,OAAO;AAAA,IACN,MAAM;AAAA,IACN,UAAU,kBAAkB,SAAS,EAAE,SAAS;AAAA,IAChD,MAAM;AAAA,IACN,UAAUA,GACP,MAAiB,OAAO,IAAI,aAAa,eAAe,CAAC,EACzD,IAAI,aAAa,eAAe,EAChC,SAAS;AAAA,IACZ,WAAsB,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,IAC5E,QAAQA,GAAE,MAAM,eAAe,EAAE,IAAI,aAAa,aAAa;AAAA,IAC/D,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,OAAO;AACZ;AACO,IAAM,yBAAyB;AAG/B,IAAM,yBAAyC;AAAA,EAAa,MACjE,qBAAqB,QAAQ,EAAE,OAAO,EAAE,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO;AACzF;AAGO,IAAM,uBAAuC;AAAA,EAAa,MAC/DA,GACG,OAAO;AAAA,IACN,eAA0B;AAAA,IAC1B,MAAMA,GAAE,KAAK,CAAC,QAAQ,MAAM,CAAC;AAAA,IAC7B,SAAS,UAAU,SAAS;AAAA,EAC9B,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,0BAA0C;AAAA,EAAa,MAClEA,GAAE,OAAO,EAAE,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO;AAC5D;AAGO,IAAM,2BAA2C;AAAA,EAAa,MACnEA,GAAE,OAAO;AAAA,IACP,OAAkB;AAAA,IAClB,UAAUA,GAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,IACnC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACnC,MAAMA,GACH,OAAO;AAAA,MACN,MAAiB;AAAA,MACjB,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA,MAC9B,WAAsB;AAAA,IACxB,CAAC,EACA,SAAS;AAAA,EACd,CAAC;AACH;AAGO,IAAM,kCAAkD;AAAA,EAAa,MAC1EA,GAAE,OAAO,EAAE,SAAoB,gBAAgB,CAAC,EAAE,OAAO;AAC3D;AAGA,IAAM,aAAa,oBAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC;AAC/C,IAAM,cAAc,oBAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AAChD,IAAM,eAA+B;AAAA,EAAa,MAChDA,GAAE,WAAW,CAAC,UAAU;AACtB,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,WAAO,WAAW,IAAI,UAAU,IAAI,OAAO,YAAY,IAAI,UAAU,IAAI,QAAQ;AAAA,EACnF,GAAc,OAAO;AACvB;AACA,IAAM,WAA2B;AAAA,EAAa,MAC5CA,GAAE;AAAA,IACA,CAAC,UAAW,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AAAA,IAC/EA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC;AACF;AAOO,IAAM,sBAAsC;AAAA,EAAa,MAC9DA,GAAE,OAAO;AAAA,IACP,GAAGA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IAChC,MAAM,cAAc,SAAS;AAAA,IAC7B,iBAAiB,aAAa,SAAS;AAAA,IACvC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,OAAO,SAAS,SAAS;AAAA,EAC3B,CAAC;AACH;AAGO,IAAM,qBAAqC;AAAA,EAAa,MAC7DA,GAAE,OAAO,EAAE,QAAQA,GAAE,MAAM,YAAY,EAAE,CAAC;AAC5C;AAEO,IAAM,yBAAyC;AAAA,EAAa,MACjEA,GAAE,OAAO;AAAA,IACP,OAAOA,GAAE,MAAM,gBAAgB;AAAA,IAC/B,YAAuB;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,iCAAiD;AAAA,EAAa,MACzEA,GAAE,OAAO;AAAA,IACP,UAAUA,GAAE,MAAM,qBAAqB;AAAA,EACzC,CAAC;AACH;AAGO,IAAM,+BAA+C;AAAA,EAAa,MACvEA,GAAE,OAAO,EAAE,QAAQ,YAAY,CAAC,EAAE,OAAO;AAC3C;AAGO,IAAM,qBAAqC;AAAA,EAAa,MAC7DA,GAAE,OAAO;AAAA,IACP,mBAA8B;AAAA,IAC9B,QAAQ;AAAA,IACR,mBAAmBA,GAAE,MAAiB,IAAI;AAAA;AAAA,IAE1C,qBAAgC;AAAA,IAChC,WAAW,aAAa,SAAS;AAAA,IACjC,WAAWA,GAAE,MAAM,gBAAgB;AAAA,IACnC,iBAAiBA,GAAE;AAAA,MACjB,aAAa,OAAO,EAAE,UAAqB,SAAS,YAAuB,QAAQ,CAAC;AAAA,IACtF;AAAA,EACF,CAAC;AACH;AAGO,IAAM,4BAA4C;AAAA,EAAa,MACpEA,GACG,OAAO;AAAA;AAAA,IAEN,OAAkB,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,IAAK;AAAA,IACjD,WAAWA,GAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAAA,IACvD,UAAUA,GAAE,KAAK,CAAC,UAAU,SAAS,UAAU,CAAC,EAAE,QAAQ,OAAO;AAAA,IACjE,OAAOA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,oBAAoC;AAAA,EAAa,MAC5DA,GAAE,OAAO;AAAA,IACP,iBAA4B;AAAA,IAC5B,MAAiB;AAAA,IACjB,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACrC,eAA0B;AAAA;AAAA,IAE1B,aAAaA,GAAE,KAAK,CAAC,aAAa,cAAc,SAAS,CAAC,EAAE,SAAS;AAAA,IACrE,YAAY,wBAAwB,SAAS;AAAA,EAC/C,CAAC;AACH;AAGO,IAAM,6BAA6C;AAAA,EAAa,MACrEA,GAAE,OAAO;AAAA,IACP,cAAyB;AAAA,IACzB,aAAwB;AAAA,IACxB,QAAQA,GAAE,MAAM,iBAAiB;AAAA,EACnC,CAAC;AACH;AAIO,IAAM,+BAA+C;AAAA,EAAa,MACvEA,GAAE,OAAO;AAAA,IACP,IAAe;AAAA;AAAA,IAEf,WAAWA,GAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAAA;AAAA,IAEvD,aAAwB;AAAA,IACxB,OAAkB;AAAA,IAClB,UAAUA,GAAE,KAAK,CAAC,UAAU,SAAS,UAAU,CAAC;AAAA;AAAA,IAEhD,YAAuB;AAAA,IACvB,WAAsB;AAAA,IACtB,oBAA+B;AAAA;AAAA,IAE/B,WAAsB;AAAA,EACxB,CAAC;AACH;AAGO,IAAM,qCAAqD;AAAA,EAAa,MAC7EA,GAAE,OAAO;AAAA,IACP,aAAaA,GAAE,MAAM,4BAA4B;AAAA,EACnD,CAAC;AACH;AAIO,IAAM,iCAAiD;AAAA,EAAa,MACzEA,GACG,OAAO;AAAA,IACN,OAAkB,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,IAAK;AAAA,IACjD,UAAUA,GAAE,KAAK,CAAC,UAAU,SAAS,UAAU,CAAC,EAAE,SAAS;AAAA,EAC7D,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,gCAAgD;AAAA,EAAa,MACxEA,GAAE,OAAO;AAAA;AAAA,IAEP,kBAAkBA,GAAE,MAAiB,IAAI;AAAA,EAC3C,CAAC;AACH;AAIO,IAAM,4BAA4C;AAAA,EAAa,MACpEA,GAAE,KAAK,CAAC,YAAY,cAAc,UAAU,WAAW,CAAC;AAC1D;AAIO,IAAM,2BAA2C;AAAA,EAAa,MACnEA,GAAE,mBAAmB,YAAY;AAAA,IAC/BA,GACG,OAAO;AAAA,MACN,UAAUA,GAAE,QAAQ,UAAU;AAAA,MAC9B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK;AAAA,MACpC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,IAAK;AAAA,IAC7C,CAAC,EACA,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMVA,GACG,OAAO;AAAA,MACN,UAAUA,GAAE,QAAQ,WAAW;AAAA,MAC/B,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AAAA,MAC7C,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,MAC1C,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AAAA,MAChD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AAAA,IAC7C,CAAC,EACA,OAAO;AAAA,IACVA,GACG,OAAO;AAAA,MACN,UAAUA,GAAE,QAAQ,YAAY;AAAA,MAChC,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,IAAK;AAAA,IACrC,CAAC,EACA,OAAO;AAAA,IACVA,GACG,OAAO;AAAA,MACN,UAAUA,GAAE,QAAQ,QAAQ;AAAA,MAC5B,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,IAAK;AAAA;AAAA,MAE1C,UAAUA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACzC,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH;AAGO,IAAM,8BAA8C;AAAA,EAAa,MACtEA,GACG,OAAO;AAAA,IACN,aAAa;AAAA,IACb,WAAWA,GAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAAA,IACvD,OAAkB,OAAO,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3D,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,yCAAyD;AAAA,EAAa,MACjFA,GAAE,OAAO,EAAE,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAC7D;AAMO,IAAM,iCAAiD;AAAA,EAAa,MACzEA,GAAE,OAAO;AAAA,IACP,IAAe;AAAA,IACf,UAAUA,GAAE,KAAK,CAAC,eAAe,YAAY,cAAc,UAAU,WAAW,CAAC;AAAA,IACjF,WAAWA,GAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAAA,IACvD,aAAwB;AAAA,IACxB,OAAkB;AAAA,IAClB,YAAuB;AAAA,IACvB,WAAsB;AAAA,IACtB,oBAA+B;AAAA,IAC/B,WAAsB;AAAA,IACtB,YAAY;AAAA;AAAA,IAEZ,UAAUA,GAAE,KAAK,CAAC,UAAU,SAAS,UAAU,CAAC,EAAE,SAAS;AAAA;AAAA,IAE3D,WAAsB;AAAA;AAAA,IAEtB,oBAAoBA,GAAE,KAAK,CAAC,SAAS,SAAS,CAAC,EAAE,SAAS;AAAA,EAC5D,CAAC;AACH;AAIO,IAAM,4BAA4C;AAAA,EAAa,MACpEA,GAAE,OAAO;AAAA,IACP,UAAU,+BAA+B,MAAM;AAAA,IAC/C,WAAsB;AAAA,IACtB,QAAQA,GAAE,KAAK,CAAC,aAAa,CAAC,EAAE,SAAS;AAAA,EAC3C,CAAC;AACH;AAGO,IAAM,uCAAuD;AAAA,EAAa,MAC/EA,GAAE,OAAO;AAAA,IACP,aAAaA,GAAE,MAAM,8BAA8B;AAAA;AAAA,IAEnD,WAAWA,GAAE,MAAM,yBAAyB,EAAE,SAAS;AAAA,EACzD,CAAC;AACH;AAKO,IAAM,+BAA+C;AAAA,EAAa,MACvEA,GAAE,OAAO;AAAA,IACP,cAAyB;AAAA,IACzB,aAAwB;AAAA,IACxB,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,QAAQA,GAAE,MAAM,iBAAiB;AAAA;AAAA,IAEjC,kBAA6B;AAAA,IAC7B,WAAWA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,CAAC;AACH;AAGO,IAAM,kCAAkD;AAAA,EAAa,MAC1EA,GAAE,OAAO,EAAE,kBAAkBA,GAAE,MAAiB,IAAI,EAAE,CAAC;AACzD;AAGO,IAAM,2BAA2C;AAAA,EAAa,MACnEA,GACG,OAAO;AAAA,IACN,UAAUA,GAAE,KAAK,CAAC,eAAe,QAAQ,YAAY,cAAc,UAAU,WAAW,CAAC;AAAA;AAAA,IAEzF,cAAyB;AAAA,IACzB,iBAA4B;AAAA,IAC5B,WAAWA,GAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAAA,IACvD,MAAM;AAAA,IACN,MAAM,UAAU,SAAS;AAAA,IACzB,cAAc,kBAAkB,SAAS;AAAA,EAC3C,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,oCAAoD;AAAA,EAAa,MAC5EA,GACG,OAAO;AAAA,IACN,MAAM;AAAA,IACN,WAAWA,GAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAAA,IACvD,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,OAAO;AACZ;AAOO,IAAM,iBAAiC;AAAA,EAAa,MACzDA,GAAE,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAGO,IAAM,gBAAgC;AAAA,EAAa,MACxDA,GAAE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,SAAoB;AAAA,IACpB,SAASA,GAAE,OAAkB,QAAQA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC7D,CAAC;AACH;AAIO,IAAM,0BAAoE;AAAA,EAC/E,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,2BAA2B;AAAA,EAC3B,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,wBAAwB;AAAA,EACxB,uBAAuB;AAAA,EACvB,8BAA8B;AAAA,EAC9B,6BAA6B;AAAA,EAC7B,iBAAiB;AAAA,EACjB,6BAA6B;AAAA,EAC7B,yBAAyB;AAAA,EACzB,6BAA6B;AAAA,EAC7B,qBAAqB;AAAA,EACrB,uBAAuB;AAAA,EACvB,wBAAwB;AAAA,EACxB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,iBAAiB;AAAA,EACjB,+BAA+B;AAAA,EAC/B,0BAA0B;AAC5B;AAMO,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,iBAAiC;AAAA,EAAa,MACzDA,GAAE,KAAK,CAAC,QAAQ,QAAQ,WAAW,CAAC;AACtC;AAGO,IAAM,oBAAoC;AAAA,EAAa,MAC5DA,GACG,OAAO;AAAA,IACN,OAAOA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACpC,SAAoB,OAAO,IAAI,aAAa,eAAe,EAAE,SAAS;AAAA,IACtE,MAAM,cAAc,SAAS;AAAA;AAAA,IAE7B,OAAOA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACpC,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,aAAa,gBAAgB,EAAE,QAAQ,EAAE;AAAA;AAAA,IAE5E,QAAmB,OAAO,IAAI,aAAa,oBAAoB,EAAE,SAAS;AAAA;AAAA,IAE1E,SAAoB;AAAA,EACtB,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,qBAAqC;AAAA,EAAa,MAC7DA,GAAE,OAAO;AAAA,IACP,OAAOA,GAAE,OAAO;AAAA,MACd,IAAe;AAAA,MACf,MAAiB;AAAA,MACjB,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,IACD,MAAMA,GAAE,OAAO;AAAA,MACb,IAAe;AAAA,MACf,MAAiB;AAAA,MACjB,MAAM;AAAA,MACN,UAAqB;AAAA,MACrB,UAAUA,GAAE,MAAiB,MAAM;AAAA,MACnC,UAAqB;AAAA,MACrB,SAAoB;AAAA,MACpB,YAAuB;AAAA,MACvB,WAAsB;AAAA,IACxB,CAAC;AAAA,IACD,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,MAAiB,QAAQ,MAAM,eAAe,CAAC,CAAC;AAAA,IAC3E,YAAY;AAAA,EACd,CAAC;AACH;AAEO,IAAM,oBAAoC;AAAA,EAAa,MAC5DA,GAAE,OAAO;AAAA,IACP,IAAe;AAAA,IACf,MAAiB;AAAA,IACjB,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,WAAsB;AAAA,IACtB,WAAW,uBAAuB,SAAS;AAAA,EAC7C,CAAC;AACH;AAEO,IAAM,qBAAqC;AAAA,EAAa,MAC7DA,GAAE,OAAO;AAAA,IACP,OAAOA,GAAE,MAAM,kBAAkB;AAAA;AAAA,IAEjC,WAAsB;AAAA,IACtB,YAAuB;AAAA;AAAA,IAEvB,QAAQA,GAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA;AAAA,IAE5C,UAAqB;AAAA;AAAA,IAErB,SAASA,GACN;AAAA,MACCA,GAAE,OAAO;AAAA,QACP,SAAoB;AAAA,QACpB,WAAW;AAAA,MACb,CAAC;AAAA,IACH,EACC,SAAS;AAAA,EACd,CAAC;AACH;AAGO,IAAM,uBAAuC;AAAA,EAAa,MAC/DA,GACG,OAAO;AAAA,IACN,MAAM;AAAA,IACN,MAAM,eAAe,SAAS;AAAA,IAC9B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,UAAU,qBAAqB,SAAS;AAAA;AAAA,IAExC,aAAa,mBAAmB,SAAS;AAAA,IACzC,eAA0B,OAAO,IAAI,aAAa,iBAAiB,EAAE,SAAS;AAAA,IAC9E,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,CAAC,EACA,OAAO,EACP;AAAA,IACC;AAAA,IACA;AAAA,EACF;AACJ;AAGO,IAAM,kBAAkC;AAAA,EAAa,MAC1DA,GACG,OAAO;AAAA,IACN,MAAM;AAAA;AAAA,IAEN,OAAOA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACpC,QAAQ,eAAe,SAAS;AAAA,IAChC,MAAM,cAAc,QAAQ,OAAO;AAAA;AAAA,IAEnC,UAAU,kBAAkB,SAAS,EAAE,SAAS;AAAA,IAChD,UAAUA,GACP,MAAiB,OAAO,IAAI,aAAa,eAAe,CAAC,EACzD,IAAI,aAAa,eAAe,EAChC,SAAS;AAAA,IACZ,UAAUA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACvC,QAAQA,GAAE,MAAM,oBAAoB,EAAE,IAAI,aAAa,aAAa,EAAE,SAAS;AAAA,IAC/E,MAAMA,GAAE,KAAK,CAAC,UAAU,UAAU,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC/D,CAAC,EACA,OAAO;AACZ;AAEO,IAAM,mBAAmC;AAAA,EAAa,MAC3DA,GAAE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,iBAAiBA,GAAE,MAAiB,MAAM;AAAA,EAC5C,CAAC;AACH;AAGO,IAAM,iBAAiC;AAAA,EAAa,MACzDA,GACG,OAAO;AAAA,IACN,WAAsB,eAAe,IAAI,aAAa,iBAAiB;AAAA,IACvE,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,CAAC,EACA,OAAO;AACZ;AAEO,IAAM,kBAAkB;AAGxB,IAAM,kBAAkC;AAAA,EAAa,MAC1DA,GACG,OAAO;AAAA,IACN,WAAsB,eAAe,IAAI,aAAa,iBAAiB;AAAA;AAAA,IAEvE,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IAClC,MAAMA,GAAE,KAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAQ,MAAM;AAAA,IAC7C,SAAS,UAAU,SAAS;AAAA,EAC9B,CAAC,EACA,OAAO;AACZ;AAEO,IAAM,mBAAmC;AAAA,EAAa,MAC3DA,GAAE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,YAAY;AAAA,EACd,CAAC;AACH;AAGO,IAAM,oBAAoC;AAAA,EAAa,MAC5DA,GAAE,OAAO,EAAE,WAAsB,eAAe,IAAI,aAAa,iBAAiB,EAAE,CAAC,EAAE,OAAO;AAChG;AAEO,IAAM,qBAAqC;AAAA,EAAa,MAC7DA,GAAE,OAAO,EAAE,UAAUA,GAAE,QAAQ,IAAI,GAAG,aAAwB,OAAO,CAAC;AACxE;AAOO,IAAM,kCAAkC;AAExC,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACO,IAAM,mBAAmC,6BAAa,MAAMA,GAAE,KAAK,mBAAmB,CAAC;AAEvF,IAAM,2BAA2B,CAAC,SAAS,YAAY;AAEvD,IAAM,qBAAqB;AAAA,EAChC,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,mBAAmB;AACrB;","names":["z","z"]}

package/dist/chunk-H6UJJIUM.js

@@ -0,0 +1,350 @@
+// src/site-operations.ts
+var ID = "[A-Za-z0-9_-]{1,128}";
+var DATA = "/published-artifacts/current/(?:data|files)(?:/[A-Za-z0-9._~:@!$&'()*+,;=-]+)*";
+var SITE_OPERATIONS = Object.freeze([
+  { id: "config.client", method: "GET", pattern: /^\/v1\/config\/client$/u },
+  { id: "workspace.get", method: "GET", pattern: /^$/u },
+  { id: "site.config", method: "GET", pattern: /^\/site\/config$/u },
+  { id: "models.list", method: "GET", pattern: /^\/model-catalog$/u },
+  { id: "sessions.list", method: "GET", pattern: /^\/sessions$/u },
+  { id: "sessions.create", method: "POST", pattern: /^\/sessions$/u, agent: true },
+  { id: "sessions.get", method: "GET", pattern: new RegExp(`^/sessions/${ID}$`, "u") },
+  { id: "sessions.events", method: "GET", pattern: new RegExp(`^/sessions/${ID}/events$`, "u") },
+  {
+    id: "sessions.stream",
+    method: "GET",
+    pattern: new RegExp(`^/sessions/${ID}/events/stream$`, "u"),
+    stream: true
+  },
+  {
+    id: "sessions.send",
+    method: "POST",
+    pattern: new RegExp(`^/sessions/${ID}/events$`, "u"),
+    agent: true
+  },
+  {
+    id: "sessions.steer",
+    method: "POST",
+    pattern: new RegExp(`^/sessions/${ID}/steer$`, "u"),
+    agent: true
+  },
+  {
+    id: "sessions.control",
+    method: "POST",
+    pattern: new RegExp(`^/sessions/${ID}/control$`, "u"),
+    agent: true
+  },
+  { id: "sessions.queue", method: "GET", pattern: new RegExp(`^/sessions/${ID}/queue$`, "u") },
+  // SessionConversation's documented queue edit/delete/steer/move.
+  {
+    id: "sessions.queue.item",
+    method: "POST",
+    pattern: new RegExp(`^/sessions/${ID}/queue/${ID}/(?:move|edit|steer|delete)$`, "u"),
+    agent: true
+  },
+  // SessionConversation's durable composer draft and its Send.
+  {
+    id: "sessions.composerDraft.get",
+    method: "GET",
+    pattern: new RegExp(`^/sessions/${ID}/composer-draft$`, "u")
+  },
+  {
+    id: "sessions.composerDraft.put",
+    method: "PUT",
+    pattern: new RegExp(`^/sessions/${ID}/composer-draft$`, "u")
+  },
+  {
+    id: "sessions.composerDraft.submit",
+    method: "POST",
+    pattern: new RegExp(`^/sessions/${ID}/composer-draft/submit$`, "u"),
+    agent: true
+  },
+  {
+    id: "sessions.humanInput",
+    method: "GET",
+    pattern: new RegExp(`^/sessions/${ID}/human-input-requests$`, "u")
+  },
+  // SessionConversation's human-input form reads the one open request.
+  {
+    id: "sessions.humanInput.get",
+    method: "GET",
+    pattern: new RegExp(`^/sessions/${ID}/human-input-requests/${ID}$`, "u")
+  },
+  { id: "data.read", method: "GET", pattern: new RegExp(`^${DATA}$`, "u") },
+  { id: "data.write", method: "POST", pattern: new RegExp(`^${DATA}$`, "u") },
+  { id: "data.put", method: "PUT", pattern: new RegExp(`^${DATA}$`, "u") },
+  { id: "data.patch", method: "PATCH", pattern: new RegExp(`^${DATA}$`, "u") },
+  { id: "data.delete", method: "DELETE", pattern: new RegExp(`^${DATA}$`, "u") },
+  // Site SQL (PR B): run one named query the owner defined; never raw SQL.
+  {
+    id: "sql.run",
+    method: "POST",
+    pattern: /^\/published-artifacts\/current\/sql\/queries\/[A-Za-z][A-Za-z0-9_-]{0,63}$/u
+  },
+  { id: "site.report", method: "POST", pattern: /^\/site\/reports$/u }
+]);
+var SITE_TOOL_METHODS = Object.freeze([
+  "catalog",
+  "declarations",
+  "call",
+  "resolve",
+  "invoke"
+]);
+var SITE_HOST_PREFIX = "/v1/workspaces/site-host";
+function matchSiteOperation(method, path) {
+  if (/[%\\#\u0000-\u0020\u007f]/u.test(path)) return null;
+  if (path.split("/").some((part) => part === "." || part === "..")) return null;
+  const upper = method.toUpperCase();
+  let suffix;
+  if (path === "/v1/config/client") suffix = path;
+  else if (path === SITE_HOST_PREFIX) suffix = "";
+  else if (path.startsWith(`${SITE_HOST_PREFIX}/`)) suffix = path.slice(SITE_HOST_PREFIX.length);
+  else return null;
+  const operation = SITE_OPERATIONS.find(
+    (candidate) => candidate.method === upper && candidate.pattern.test(suffix)
+  );
+  return operation ? { operation, suffix } : null;
+}
+
+// src/site-session-http.ts
+var SITE_WORKSPACE_PREFIX = "/v1/workspaces/site-host";
+var SITE_DATA_PATH = /^\/v1\/workspaces\/site-host\/published-artifacts\/([^/]+)\/(?:data|files|sql)(?:\/|$)/u;
+var SITE_NO_ORIGIN_ID = "00000000-0000-0000-0000-000000000000";
+var SITE_FRAME_HEADER = "x-opengeni-site-frame";
+var SITE_PREVIEW_FRAME = "preview";
+var SITE_FRAME_ID_HEADER = "x-opengeni-site-frame-id";
+var SITE_ID_HEADER = "x-opengeni-site-id";
+var SITE_VERSION_HEADER = "x-opengeni-site-version";
+function siteConversationContext(site) {
+  const title = site.title.replace(/\s+/gu, " ").trim().slice(0, 200) || "Untitled Site";
+  return [
+    `The person is working on the Opengeni Site \u201C${title}\u201D (Site id ${site.siteId}), shown beside this chat at version ${site.revision} (version id ${site.versionId}).`,
+    "When they ask for a change to \u201Cthe Site\u201D, \u201Cthis page\u201D or a part of it, they mean this Site: read its current source, then publish the change as a new version of this Site.",
+    "A published version goes live immediately and the preview beside this chat reloads; earlier versions can be restored."
+  ].join(" ");
+}
+var SiteSessionPathError = class extends Error {
+  code = "site_session_path_unsupported";
+  constructor() {
+    super("Unsupported Site session API path");
+    this.name = "SiteSessionPathError";
+  }
+};
+var SiteDataUnsupportedError = class extends Error {
+  code = "site_data_unsupported";
+  constructor() {
+    super("This Site host does not provide Site Data");
+    this.name = "SiteDataUnsupportedError";
+  }
+};
+function unsafePathname(pathname) {
+  return /[%\\#\u0000-\u0020\u007f]/u.test(pathname) || pathname.split("/").some((part) => part === "." || part === "..");
+}
+function hostWorkspacePath(path, workspaceId) {
+  const url = new URL(path, "http://site.invalid");
+  if (url.pathname === "/v1/config/client") {
+    const requested = url.searchParams.getAll("workspaceId");
+    if (requested.length > 1 || requested.length === 1 && requested[0] !== "site-host" && requested[0] !== workspaceId)
+      throw new SiteSessionPathError();
+    if (workspaceId !== "site-host") url.searchParams.set("workspaceId", workspaceId);
+    return url.pathname + url.search;
+  }
+  return path.replace("/workspaces/site-host", `/workspaces/${encodeURIComponent(workspaceId)}`);
+}
+function siteDataPath(path, rewritten, workspaceId, siteId) {
+  if (workspaceId === "site-host") return path;
+  if (!siteId) throw new SiteDataUnsupportedError();
+  return rewritten.replace(
+    "/published-artifacts/current/",
+    `/published-artifacts/${encodeURIComponent(siteId)}/`
+  );
+}
+function siteSessionPath(path, workspaceId, method = "GET", siteId) {
+  const pathname = path.split("?")[0];
+  const match = matchSiteOperation(method, pathname);
+  if (!match) throw new SiteSessionPathError();
+  const rewritten = hostWorkspacePath(path, workspaceId);
+  if (SITE_DATA_PATH.test(pathname)) return siteDataPath(path, rewritten, workspaceId, siteId);
+  if (match.operation.id !== "sessions.list") return rewritten;
+  const url = new URL(rewritten, "http://site.invalid");
+  const origins = url.searchParams.getAll("originSiteId");
+  const access = url.searchParams.getAll("siteAccessId");
+  const views = url.searchParams.getAll("view");
+  if (views.length > 1 || views.length === 1 && views[0] !== "page" || origins.length + access.length !== 1 || (origins[0] ?? access[0]) !== "current")
+    throw new SiteSessionPathError();
+  if (workspaceId === "site-host") return path;
+  url.searchParams.set(
+    access.length ? "siteAccessId" : "originSiteId",
+    siteId ?? SITE_NO_ORIGIN_ID
+  );
+  return url.pathname + url.search;
+}
+function siteHostWorkspacePath(path, workspaceId) {
+  const pathname = path.split("?")[0];
+  const workspace = pathname === SITE_WORKSPACE_PREFIX || pathname.startsWith(`${SITE_WORKSPACE_PREFIX}/`);
+  if (!workspace && pathname !== "/v1/config/client" || unsafePathname(pathname))
+    throw new SiteSessionPathError();
+  const rewritten = hostWorkspacePath(path, workspaceId);
+  const data = SITE_DATA_PATH.exec(pathname);
+  if (data) {
+    if (data[1] !== "current") throw new SiteSessionPathError();
+    return siteDataPath(path, rewritten, workspaceId);
+  }
+  const url = new URL(rewritten, "http://site.invalid");
+  if (url.searchParams.get("originSiteId") === "current" && workspaceId !== "site-host") {
+    url.searchParams.set("originSiteId", SITE_NO_ORIGIN_ID);
+    return url.pathname + url.search;
+  }
+  return rewritten;
+}
+function siteFrameFromHeaders(header) {
+  const value = (name) => header(name) ?? null;
+  const marker = value(SITE_FRAME_HEADER);
+  const siteId = value(SITE_ID_HEADER);
+  const versionId = value(SITE_VERSION_HEADER);
+  const frameId = value(SITE_FRAME_ID_HEADER);
+  if (marker === null && siteId === null && versionId === null && frameId === null) return null;
+  return { siteId: siteId || null, versionId: versionId || null, marker, frameId: frameId || null };
+}
+function siteFrameOperation(method, pathname, workspaceId, frameSiteId) {
+  if (unsafePathname(pathname)) return null;
+  let sitePath = pathname;
+  if (pathname !== "/v1/config/client") {
+    const prefix = `/v1/workspaces/${workspaceId}`;
+    if (pathname !== prefix && !pathname.startsWith(`${prefix}/`)) return null;
+    sitePath = `${SITE_WORKSPACE_PREFIX}${pathname.slice(prefix.length)}`;
+    const data = /^\/v1\/workspaces\/site-host\/published-artifacts\/([^/]+)\//u.exec(sitePath);
+    if (data) {
+      if (!frameSiteId || data[1] !== frameSiteId) return null;
+      sitePath = sitePath.replace(
+        `/published-artifacts/${frameSiteId}/`,
+        "/published-artifacts/current/"
+      );
+    }
+  }
+  const match = matchSiteOperation(method, sitePath);
+  if (!match) return null;
+  const session = /^\/sessions\/([^/]+)(?:\/|$)/u.exec(match.suffix);
+  return { ...match, sessionId: session ? session[1] : null };
+}
+function siteRequestHeaders(input) {
+  const headers = new Headers(input);
+  const connectionHeaders = (headers.get("connection") ?? "").split(",").map((value) => value.trim().toLowerCase());
+  for (const name of [...headers.keys()]) {
+    if (connectionHeaders.includes(name) || /^(authorization|proxy-authorization|cookie|cookie2|host|origin|referer|connection|keep-alive|proxy-connection|te|trailer|transfer-encoding|upgrade|content-length|accept-encoding|forwarded|x-api-key)$/i.test(
+      name
+    ) || /^(sec-|x-forwarded-|x-opengeni-(access-key|external-actor|site-|managed-actor))/i.test(name))
+      headers.delete(name);
+  }
+  return headers;
+}
+var SITE_FRAME_MESSAGE_FIELDS = [
+  "text",
+  "annotations",
+  "model",
+  "reasoningEffort",
+  "latencyMode",
+  "controlEtag",
+  "expectedDraftRevision",
+  // The viewer's own IANA time zone, so the agent sees the message's local time.
+  "timeZone"
+];
+var SITE_FRAME_BODY_FIELDS = Object.freeze({
+  "sessions.send": ["type", "payload", "clientEventId"],
+  "sessions.steer": [...SITE_FRAME_MESSAGE_FIELDS, "clientEventId"],
+  "sessions.control": ["action", "reason", "clientEventId", "expectedControlEtag"],
+  "sessions.composerDraft.put": [
+    "text",
+    "annotations",
+    "resources",
+    "model",
+    "reasoningEffort",
+    "latencyMode",
+    "expectedRevision"
+  ],
+  "sessions.composerDraft.submit": [
+    ...SITE_FRAME_MESSAGE_FIELDS,
+    "resources",
+    "connectionAccounts",
+    "clientEventId",
+    "delivery"
+  ],
+  "sessions.queue.move": ["clientEventId", "expectedQueueVersion", "beforeTurnId"],
+  "sessions.queue.edit": [
+    "clientEventId",
+    "expectedTurnVersion",
+    "expectedDraftRevision",
+    "replaceDraft"
+  ],
+  "sessions.queue.steer": ["clientEventId", "expectedTurnVersion", "controlEtag"],
+  "sessions.queue.delete": ["clientEventId", "expectedTurnVersion", "reason"]
+});
+var SITE_FRAME_EMPTY_ONLY_FIELDS = /* @__PURE__ */ new Set(["resources", "connectionAccounts"]);
+var SITE_FRAME_SESSION_CREATE_FIELDS = Object.freeze([
+  "initialMessage",
+  "requestedSessionId",
+  "idempotencyKey",
+  "clientEventId",
+  "model",
+  "reasoningEffort",
+  "latencyMode",
+  "startMode",
+  "metadata",
+  "timeZone"
+]);
+function bodyRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function emptyBodyValue(value) {
+  if (value === void 0 || value === null) return true;
+  if (Array.isArray(value)) return value.length === 0;
+  if (typeof value === "object") return Object.keys(value).length === 0;
+  return false;
+}
+function refusedField(body, allowed, prefix = "") {
+  for (const [name, value] of Object.entries(body)) {
+    if (emptyBodyValue(value)) continue;
+    if (!allowed.includes(name) || SITE_FRAME_EMPTY_ONLY_FIELDS.has(name))
+      return `${prefix}${name}`;
+  }
+  return null;
+}
+function siteFrameBodyRefusal(operationId, suffix, body) {
+  const record = bodyRecord(body);
+  if (!record) return null;
+  if (operationId === "sessions.create")
+    return refusedField(record, SITE_FRAME_SESSION_CREATE_FIELDS);
+  const action = operationId === "sessions.queue.item" ? /\/queue\/[^/]+\/(move|edit|steer|delete)$/u.exec(suffix)?.[1] : void 0;
+  const key = action ? `sessions.queue.${action}` : operationId;
+  const allowed = SITE_FRAME_BODY_FIELDS[key];
+  if (!allowed) return null;
+  const refused = refusedField(record, allowed);
+  if (refused) return refused;
+  if (operationId !== "sessions.send") return null;
+  if (record.type !== "user.message") return "type";
+  const payload = bodyRecord(record.payload);
+  return payload ? refusedField(payload, SITE_FRAME_MESSAGE_FIELDS, "payload.") : null;
+}
+
+export {
+  SITE_OPERATIONS,
+  SITE_TOOL_METHODS,
+  matchSiteOperation,
+  SITE_NO_ORIGIN_ID,
+  SITE_FRAME_HEADER,
+  SITE_PREVIEW_FRAME,
+  SITE_FRAME_ID_HEADER,
+  SITE_ID_HEADER,
+  SITE_VERSION_HEADER,
+  siteConversationContext,
+  SiteSessionPathError,
+  SiteDataUnsupportedError,
+  siteSessionPath,
+  siteHostWorkspacePath,
+  siteFrameFromHeaders,
+  siteFrameOperation,
+  siteRequestHeaders,
+  SITE_FRAME_SESSION_CREATE_FIELDS,
+  siteFrameBodyRefusal
+};
+//# sourceMappingURL=chunk-H6UJJIUM.js.map

package/dist/chunk-H6UJJIUM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/site-operations.ts","../src/site-session-http.ts"],"sourcesContent":["// Zod-free on purpose: browser bundles (the Site runtime, the console Site\n// bridge and the gateway shell) import this module, and must not pull in zod.\n\n// ---------------------------------------------------------------------------\n// Site operation allowlist\n// ---------------------------------------------------------------------------\n\n/**\n * Every HTTP operation Site code may perform through a host, as an explicit\n * allowlist (method + exact path shape) rather than a URL prefix. Paths are\n * the suffix after `/v1/workspaces/site-host` that the in-Site SDK client\n * uses; `/v1/config/client` is the one path outside that prefix.\n *\n * The console host forwards an allowed operation to the ordinary workspace\n * route with Site provenance. The gateway forwards it to `/_og/api<suffix>`\n * and the API serves it at `/v1/site-runtime<suffix>`. `agent: true` marks\n * operations that start or message an agent; every such route records which\n * Site (and version) originated it.\n */\nexport type SiteOperationMethod = \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\nexport type SiteOperation = {\n  id: string;\n  method: SiteOperationMethod;\n  /** Anchored pattern on the site-host suffix (`\"\"` is the workspace itself). */\n  pattern: RegExp;\n  agent?: true;\n  stream?: true;\n};\n\nconst ID = \"[A-Za-z0-9_-]{1,128}\";\nconst DATA = \"/published-artifacts/current/(?:data|files)(?:/[A-Za-z0-9._~:@!$&'()*+,;=-]+)*\";\n\nexport const SITE_OPERATIONS: readonly SiteOperation[] = Object.freeze([\n  { id: \"config.client\", method: \"GET\", pattern: /^\\/v1\\/config\\/client$/u },\n  { id: \"workspace.get\", method: \"GET\", pattern: /^$/u },\n  { id: \"site.config\", method: \"GET\", pattern: /^\\/site\\/config$/u },\n  { id: \"models.list\", method: \"GET\", pattern: /^\\/model-catalog$/u },\n  { id: \"sessions.list\", method: \"GET\", pattern: /^\\/sessions$/u },\n  { id: \"sessions.create\", method: \"POST\", pattern: /^\\/sessions$/u, agent: true },\n  { id: \"sessions.get\", method: \"GET\", pattern: new RegExp(`^/sessions/${ID}$`, \"u\") },\n  { id: \"sessions.events\", method: \"GET\", pattern: new RegExp(`^/sessions/${ID}/events$`, \"u\") },\n  {\n    id: \"sessions.stream\",\n    method: \"GET\",\n    pattern: new RegExp(`^/sessions/${ID}/events/stream$`, \"u\"),\n    stream: true,\n  },\n  {\n    id: \"sessions.send\",\n    method: \"POST\",\n    pattern: new RegExp(`^/sessions/${ID}/events$`, \"u\"),\n    agent: true,\n  },\n  {\n    id: \"sessions.steer\",\n    method: \"POST\",\n    pattern: new RegExp(`^/sessions/${ID}/steer$`, \"u\"),\n    agent: true,\n  },\n  {\n    id: \"sessions.control\",\n    method: \"POST\",\n    pattern: new RegExp(`^/sessions/${ID}/control$`, \"u\"),\n    agent: true,\n  },\n  { id: \"sessions.queue\", method: \"GET\", pattern: new RegExp(`^/sessions/${ID}/queue$`, \"u\") },\n  // SessionConversation's documented queue edit/delete/steer/move.\n  {\n    id: \"sessions.queue.item\",\n    method: \"POST\",\n    pattern: new RegExp(`^/sessions/${ID}/queue/${ID}/(?:move|edit|steer|delete)$`, \"u\"),\n    agent: true,\n  },\n  // SessionConversation's durable composer draft and its Send.\n  {\n    id: \"sessions.composerDraft.get\",\n    method: \"GET\",\n    pattern: new RegExp(`^/sessions/${ID}/composer-draft$`, \"u\"),\n  },\n  {\n    id: \"sessions.composerDraft.put\",\n    method: \"PUT\",\n    pattern: new RegExp(`^/sessions/${ID}/composer-draft$`, \"u\"),\n  },\n  {\n    id: \"sessions.composerDraft.submit\",\n    method: \"POST\",\n    pattern: new RegExp(`^/sessions/${ID}/composer-draft/submit$`, \"u\"),\n    agent: true,\n  },\n  {\n    id: \"sessions.humanInput\",\n    method: \"GET\",\n    pattern: new RegExp(`^/sessions/${ID}/human-input-requests$`, \"u\"),\n  },\n  // SessionConversation's human-input form reads the one open request.\n  {\n    id: \"sessions.humanInput.get\",\n    method: \"GET\",\n    pattern: new RegExp(`^/sessions/${ID}/human-input-requests/${ID}$`, \"u\"),\n  },\n  { id: \"data.read\", method: \"GET\", pattern: new RegExp(`^${DATA}$`, \"u\") },\n  { id: \"data.write\", method: \"POST\", pattern: new RegExp(`^${DATA}$`, \"u\") },\n  { id: \"data.put\", method: \"PUT\", pattern: new RegExp(`^${DATA}$`, \"u\") },\n  { id: \"data.patch\", method: \"PATCH\", pattern: new RegExp(`^${DATA}$`, \"u\") },\n  { id: \"data.delete\", method: \"DELETE\", pattern: new RegExp(`^${DATA}$`, \"u\") },\n  // Site SQL (PR B): run one named query the owner defined; never raw SQL.\n  {\n    id: \"sql.run\",\n    method: \"POST\",\n    pattern: /^\\/published-artifacts\\/current\\/sql\\/queries\\/[A-Za-z][A-Za-z0-9_-]{0,63}$/u,\n  },\n  { id: \"site.report\", method: \"POST\", pattern: /^\\/site\\/reports$/u },\n] satisfies SiteOperation[]);\n\n/**\n * Tool bridge methods (MessagePort, not HTTP). The gateway serves them at\n * POST /_og/api/tools/<method>; the console uses its tool gateway client.\n */\nexport const SITE_TOOL_METHODS = Object.freeze([\n  \"catalog\",\n  \"declarations\",\n  \"call\",\n  \"resolve\",\n  \"invoke\",\n] as const);\nexport type SiteToolMethod = (typeof SITE_TOOL_METHODS)[number];\n\nconst SITE_HOST_PREFIX = \"/v1/workspaces/site-host\";\n\n/**\n * Match a Site-originated request against the allowlist. `path` is the\n * pathname the in-Site SDK used (`/v1/workspaces/site-host/...` or\n * `/v1/config/client`), without query. Returns the operation and the\n * site-host suffix, or null when the operation is not allowed. Refuses\n * encoded separators, dot segments and control characters.\n */\nexport function matchSiteOperation(\n  method: string,\n  path: string,\n): { operation: SiteOperation; suffix: string } | null {\n  if (/[%\\\\#\\u0000-\\u0020\\u007f]/u.test(path)) return null;\n  if (path.split(\"/\").some((part) => part === \".\" || part === \"..\")) return null;\n  const upper = method.toUpperCase();\n  let suffix: string;\n  if (path === \"/v1/config/client\") suffix = path;\n  else if (path === SITE_HOST_PREFIX) suffix = \"\";\n  else if (path.startsWith(`${SITE_HOST_PREFIX}/`)) suffix = path.slice(SITE_HOST_PREFIX.length);\n  else return null;\n  const operation = SITE_OPERATIONS.find(\n    (candidate) => candidate.method === upper && candidate.pattern.test(suffix),\n  );\n  return operation ? { operation, suffix } : null;\n}\n","import { matchSiteOperation, type SiteOperation } from \"./site-operations\";\n\nconst SITE_WORKSPACE_PREFIX = \"/v1/workspaces/site-host\";\n/** Site Data and Site SQL routes under any published Site: `<prefix>/published-artifacts/<id>/data|files|sql`. */\nconst SITE_DATA_PATH =\n  /^\\/v1\\/workspaces\\/site-host\\/published-artifacts\\/([^/]+)\\/(?:data|files|sql)(?:\\/|$)/u;\n/** The list filter a frame without a published Site gets: it names no Site, so lists nothing. */\nexport const SITE_NO_ORIGIN_ID = \"00000000-0000-0000-0000-000000000000\";\n\n/**\n * The header a host sets on every request it forwards from a Site frame. The\n * value names the host: `1` for the console bridge, `preview` for a Codemode\n * local preview. The API treats a request carrying it (or the pinned Site id)\n * as Site code: only `SITE_OPERATIONS`, only the frame's own sessions.\n */\nexport const SITE_FRAME_HEADER = \"x-opengeni-site-frame\";\n/** SITE_FRAME_HEADER value a Codemode local preview sets. */\nexport const SITE_PREVIEW_FRAME = \"preview\";\n/**\n * A random id the host mints per mounted frame. A frame without a published\n * Site (inline HTML, previews) records it on the sessions it starts and may\n * reach only those sessions afterwards.\n */\nexport const SITE_FRAME_ID_HEADER = \"x-opengeni-site-frame-id\";\n/** The published Site (artifact id) a host pinned the frame to. */\nexport const SITE_ID_HEADER = \"x-opengeni-site-id\";\n/** The exact Site version the pinned frame runs. */\nexport const SITE_VERSION_HEADER = \"x-opengeni-site-version\";\n\n/** The Site a console Site view conversation is about, as its messages name it. */\nexport type SiteConversationSite = {\n  siteId: string;\n  title: string;\n  versionId: string;\n  revision: number;\n};\n\n/**\n * Message context for a conversation in the console's Site view, where the\n * person edits the Site beside it: which Site and version \"the Site\" means,\n * and that a change is published straight away. The API attaches it to the\n * first message of a conversation started there; the console attaches it to\n * each later message, with the version then current. It is ordinary,\n * model-visible context (`modelContext`), never authority.\n */\nexport function siteConversationContext(site: SiteConversationSite): string {\n  const title = site.title.replace(/\\s+/gu, \" \").trim().slice(0, 200) || \"Untitled Site\";\n  return [\n    `The person is working on the Opengeni Site “${title}” (Site id ${site.siteId}), shown beside this chat at version ${site.revision} (version id ${site.versionId}).`,\n    \"When they ask for a change to “the Site”, “this page” or a part of it, they mean this Site: read its current source, then publish the change as a new version of this Site.\",\n    \"A published version goes live immediately and the preview beside this chat reloads; earlier versions can be restored.\",\n  ].join(\" \");\n}\n\n/** A Site/Codemode SDK request named a route outside the proxied surface. */\nexport class SiteSessionPathError extends Error {\n  readonly code = \"site_session_path_unsupported\";\n\n  constructor() {\n    super(\"Unsupported Site session API path\");\n    this.name = \"SiteSessionPathError\";\n  }\n}\n\n/** The host serves no Site Data: it is not bound to a published Site (inline HTML, previews). */\nexport class SiteDataUnsupportedError extends Error {\n  readonly code = \"site_data_unsupported\";\n\n  constructor() {\n    super(\"This Site host does not provide Site Data\");\n    this.name = \"SiteDataUnsupportedError\";\n  }\n}\n\nfunction unsafePathname(pathname: string): boolean {\n  return (\n    /[%\\\\#\\u0000-\\u0020\\u007f]/u.test(pathname) ||\n    pathname.split(\"/\").some((part) => part === \".\" || part === \"..\")\n  );\n}\n\nfunction hostWorkspacePath(path: string, workspaceId: string): string {\n  const url = new URL(path, \"http://site.invalid\");\n  if (url.pathname === \"/v1/config/client\") {\n    const requested = url.searchParams.getAll(\"workspaceId\");\n    if (\n      requested.length > 1 ||\n      (requested.length === 1 && requested[0] !== \"site-host\" && requested[0] !== workspaceId)\n    )\n      throw new SiteSessionPathError();\n    // The SDK's scoped config read uses a query, not a workspace path segment.\n    // Both the console bridge and Codemode proxy bind it to their own workspace.\n    if (workspaceId !== \"site-host\") url.searchParams.set(\"workspaceId\", workspaceId);\n    return url.pathname + url.search;\n  }\n  return path.replace(\"/workspaces/site-host\", `/workspaces/${encodeURIComponent(workspaceId)}`);\n}\n\n/** Site Data: a Site reaches only its own data, as `current`, through a host bound to a published Site. */\nfunction siteDataPath(path: string, rewritten: string, workspaceId: string, siteId?: string) {\n  // Inside the Site the alias stays unresolved; the host resolves it.\n  if (workspaceId === \"site-host\") return path;\n  // Only a host bound to a published Site serves its data.\n  if (!siteId) throw new SiteDataUnsupportedError();\n  return rewritten.replace(\n    \"/published-artifacts/current/\",\n    `/published-artifacts/${encodeURIComponent(siteId)}/`,\n  );\n}\n\n/**\n * Route a request from Site code (the in-Site SDK, the console bridge, a\n * Codemode preview) to the host workspace. This is the `SITE_OPERATIONS`\n * allowlist: anything else is refused with SiteSessionPathError before any\n * request is made. Ordinary API handlers still authorize every allowed\n * operation with the viewer's own authority, and the API independently\n * refuses frame requests outside the allowlist or to another Site's sessions.\n *\n * `workspaceId` `site-host` checks a path inside the Site without rewriting\n * it. A session list must name `originSiteId=current` or `siteAccessId=current`; the host binds it to\n * its pinned Site, or to no Site at all when the frame has none.\n */\nexport function siteSessionPath(\n  path: string,\n  workspaceId: string,\n  method = \"GET\",\n  siteId?: string,\n): string {\n  const pathname = path.split(\"?\")[0]!;\n  const match = matchSiteOperation(method, pathname);\n  if (!match) throw new SiteSessionPathError();\n  const rewritten = hostWorkspacePath(path, workspaceId);\n  if (SITE_DATA_PATH.test(pathname)) return siteDataPath(path, rewritten, workspaceId, siteId);\n  if (match.operation.id !== \"sessions.list\") return rewritten;\n  // A Site lists only conversations available to it. Never widen to the workspace.\n  const url = new URL(rewritten, \"http://site.invalid\");\n  const origins = url.searchParams.getAll(\"originSiteId\");\n  const access = url.searchParams.getAll(\"siteAccessId\");\n  const views = url.searchParams.getAll(\"view\");\n  if (\n    views.length > 1 ||\n    (views.length === 1 && views[0] !== \"page\") ||\n    origins.length + access.length !== 1 ||\n    (origins[0] ?? access[0]) !== \"current\"\n  )\n    throw new SiteSessionPathError();\n  if (workspaceId === \"site-host\") return path;\n  url.searchParams.set(\n    access.length ? \"siteAccessId\" : \"originSiteId\",\n    siteId ?? SITE_NO_ORIGIN_ID,\n  );\n  return url.pathname + url.search;\n}\n\n/**\n * Route an agent's own SDK request through the Codemode SDK proxy to its\n * workspace. Unlike `siteSessionPath` this is a URL prefix boundary, not an\n * operation allowlist: the proxy signs a short-lived credential bounded by\n * the agent's own permission ceiling and ordinary handlers authorize every\n * operation. Site Data is not served here (an agent uses its tools).\n * Requests a Codemode preview forwards from Site code carry the frame marker\n * and use `siteSessionPath` instead.\n */\nexport function siteHostWorkspacePath(path: string, workspaceId: string): string {\n  const pathname = path.split(\"?\")[0]!;\n  const workspace =\n    pathname === SITE_WORKSPACE_PREFIX || pathname.startsWith(`${SITE_WORKSPACE_PREFIX}/`);\n  if ((!workspace && pathname !== \"/v1/config/client\") || unsafePathname(pathname))\n    throw new SiteSessionPathError();\n  const rewritten = hostWorkspacePath(path, workspaceId);\n  const data = SITE_DATA_PATH.exec(pathname);\n  if (data) {\n    if (data[1] !== \"current\") throw new SiteSessionPathError();\n    return siteDataPath(path, rewritten, workspaceId);\n  }\n  const url = new URL(rewritten, \"http://site.invalid\");\n  if (url.searchParams.get(\"originSiteId\") === \"current\" && workspaceId !== \"site-host\") {\n    url.searchParams.set(\"originSiteId\", SITE_NO_ORIGIN_ID);\n    return url.pathname + url.search;\n  }\n  return rewritten;\n}\n\n/** The Site identity a host attached to a request, from its host-set headers. */\nexport type SiteFrameHeaders = {\n  /** The pinned published Site id, or null for a frame without one. */\n  siteId: string | null;\n  versionId: string | null;\n  /** The host's frame marker value (`1`, `preview`), or null when only the Site id was set. */\n  marker: string | null;\n  frameId: string | null;\n};\n\n/** Read the host-set frame headers. Null when the request did not come from a Site frame. */\nexport function siteFrameFromHeaders(\n  header: (name: string) => string | null | undefined,\n): SiteFrameHeaders | null {\n  const value = (name: string) => header(name) ?? null;\n  const marker = value(SITE_FRAME_HEADER);\n  const siteId = value(SITE_ID_HEADER);\n  const versionId = value(SITE_VERSION_HEADER);\n  const frameId = value(SITE_FRAME_ID_HEADER);\n  if (marker === null && siteId === null && versionId === null && frameId === null) return null;\n  return { siteId: siteId || null, versionId: versionId || null, marker, frameId: frameId || null };\n}\n\n/**\n * Match a request that reached a workspace route from a Site frame against\n * `SITE_OPERATIONS`. `pathname` is the raw request path\n * (`/v1/workspaces/<id>/...` or `/v1/config/client`). The frame's own pinned\n * Site id maps back to `current`; any other Site id does not match.\n */\nexport function siteFrameOperation(\n  method: string,\n  pathname: string,\n  workspaceId: string,\n  frameSiteId: string | null,\n): { operation: SiteOperation; suffix: string; sessionId: string | null } | null {\n  if (unsafePathname(pathname)) return null;\n  let sitePath = pathname;\n  if (pathname !== \"/v1/config/client\") {\n    const prefix = `/v1/workspaces/${workspaceId}`;\n    if (pathname !== prefix && !pathname.startsWith(`${prefix}/`)) return null;\n    sitePath = `${SITE_WORKSPACE_PREFIX}${pathname.slice(prefix.length)}`;\n    const data = /^\\/v1\\/workspaces\\/site-host\\/published-artifacts\\/([^/]+)\\//u.exec(sitePath);\n    if (data) {\n      if (!frameSiteId || data[1] !== frameSiteId) return null;\n      sitePath = sitePath.replace(\n        `/published-artifacts/${frameSiteId}/`,\n        \"/published-artifacts/current/\",\n      );\n    }\n  }\n  const match = matchSiteOperation(method, sitePath);\n  if (!match) return null;\n  const session = /^\\/sessions\\/([^/]+)(?:\\/|$)/u.exec(match.suffix);\n  return { ...match, sessionId: session ? session[1]! : null };\n}\n\n/** Preserve SDK request semantics while the host supplies identity and transport headers. */\nexport function siteRequestHeaders(input: HeadersInit): Headers {\n  const headers = new Headers(input);\n  const connectionHeaders = (headers.get(\"connection\") ?? \"\")\n    .split(\",\")\n    .map((value) => value.trim().toLowerCase());\n  for (const name of [...headers.keys()]) {\n    if (\n      connectionHeaders.includes(name) ||\n      /^(authorization|proxy-authorization|cookie|cookie2|host|origin|referer|connection|keep-alive|proxy-connection|te|trailer|transfer-encoding|upgrade|content-length|accept-encoding|forwarded|x-api-key)$/i.test(\n        name,\n      ) ||\n      /^(sec-|x-forwarded-|x-opengeni-(access-key|external-actor|site-|managed-actor))/i.test(name)\n    )\n      headers.delete(name);\n  }\n  return headers;\n}\n\n// ---------------------------------------------------------------------------\n// What a Site frame may put in a request body\n// ---------------------------------------------------------------------------\n\n/** Message fields a Site page may set: the text and how the model answers it. */\nconst SITE_FRAME_MESSAGE_FIELDS = [\n  \"text\",\n  \"annotations\",\n  \"model\",\n  \"reasoningEffort\",\n  \"latencyMode\",\n  \"controlEtag\",\n  \"expectedDraftRevision\",\n  // The viewer's own IANA time zone, so the agent sees the message's local time.\n  \"timeZone\",\n] as const;\n\n/**\n * Body fields a Site frame may send per operation. Anything else with a\n * value (resources, personal resource attachments, MCP credential updates,\n * connection accounts, model context, approval decisions, human-input\n * answers) is the person's to give in the console, never a Site page's.\n */\nconst SITE_FRAME_BODY_FIELDS: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  \"sessions.send\": [\"type\", \"payload\", \"clientEventId\"],\n  \"sessions.steer\": [...SITE_FRAME_MESSAGE_FIELDS, \"clientEventId\"],\n  \"sessions.control\": [\"action\", \"reason\", \"clientEventId\", \"expectedControlEtag\"],\n  \"sessions.composerDraft.put\": [\n    \"text\",\n    \"annotations\",\n    \"resources\",\n    \"model\",\n    \"reasoningEffort\",\n    \"latencyMode\",\n    \"expectedRevision\",\n  ],\n  \"sessions.composerDraft.submit\": [\n    ...SITE_FRAME_MESSAGE_FIELDS,\n    \"resources\",\n    \"connectionAccounts\",\n    \"clientEventId\",\n    \"delivery\",\n  ],\n  \"sessions.queue.move\": [\"clientEventId\", \"expectedQueueVersion\", \"beforeTurnId\"],\n  \"sessions.queue.edit\": [\n    \"clientEventId\",\n    \"expectedTurnVersion\",\n    \"expectedDraftRevision\",\n    \"replaceDraft\",\n  ],\n  \"sessions.queue.steer\": [\"clientEventId\", \"expectedTurnVersion\", \"controlEtag\"],\n  \"sessions.queue.delete\": [\"clientEventId\", \"expectedTurnVersion\", \"reason\"],\n});\n\n/** Fields allowed above only while empty: a draft carries no resources or accounts. */\nconst SITE_FRAME_EMPTY_ONLY_FIELDS = new Set([\"resources\", \"connectionAccounts\"]);\n\n/**\n * Session create fields a Site frame may send. Agent/tool choices use the\n * ordinary viewer's defaults, never a platform-imposed Site profile.\n * Ownership, settings, approvals and credentials remain host-owned.\n */\nexport const SITE_FRAME_SESSION_CREATE_FIELDS: readonly string[] = Object.freeze([\n  \"initialMessage\",\n  \"requestedSessionId\",\n  \"idempotencyKey\",\n  \"clientEventId\",\n  \"model\",\n  \"reasoningEffort\",\n  \"latencyMode\",\n  \"startMode\",\n  \"metadata\",\n  \"timeZone\",\n]);\n\nfunction bodyRecord(value: unknown): Record<string, unknown> | null {\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\n/** Absent, null, an empty list or an empty object asks for nothing. */\nfunction emptyBodyValue(value: unknown): boolean {\n  if (value === undefined || value === null) return true;\n  if (Array.isArray(value)) return value.length === 0;\n  if (typeof value === \"object\") return Object.keys(value).length === 0;\n  return false;\n}\n\nfunction refusedField(\n  body: Record<string, unknown>,\n  allowed: readonly string[],\n  prefix = \"\",\n): string | null {\n  for (const [name, value] of Object.entries(body)) {\n    if (emptyBodyValue(value)) continue;\n    if (!allowed.includes(name) || SITE_FRAME_EMPTY_ONLY_FIELDS.has(name))\n      return `${prefix}${name}`;\n  }\n  return null;\n}\n\n/**\n * The first body field a Site frame may not send for this operation (for\n * example `payload.resources` or `type`), or null when the body is allowed.\n * `suffix` is the operation's site-host suffix (from `siteFrameOperation` or\n * `matchSiteOperation`). A body that is not a JSON object is left to the\n * route, which refuses it. Only `user.message` events are allowed:\n * approvals and answers to questions happen in the console.\n */\nexport function siteFrameBodyRefusal(\n  operationId: string,\n  suffix: string,\n  body: unknown,\n): string | null {\n  const record = bodyRecord(body);\n  if (!record) return null;\n  if (operationId === \"sessions.create\")\n    return refusedField(record, SITE_FRAME_SESSION_CREATE_FIELDS);\n  const action =\n    operationId === \"sessions.queue.item\"\n      ? /\\/queue\\/[^/]+\\/(move|edit|steer|delete)$/u.exec(suffix)?.[1]\n      : undefined;\n  const key = action ? `sessions.queue.${action}` : operationId;\n  const allowed = SITE_FRAME_BODY_FIELDS[key];\n  if (!allowed) return null;\n  const refused = refusedField(record, allowed);\n  if (refused) return refused;\n  if (operationId !== \"sessions.send\") return null;\n  if (record.type !== \"user.message\") return \"type\";\n  const payload = bodyRecord(record.payload);\n  return payload ? refusedField(payload, SITE_FRAME_MESSAGE_FIELDS, \"payload.\") : null;\n}\n"],"mappings":";AA6BA,IAAM,KAAK;AACX,IAAM,OAAO;AAEN,IAAM,kBAA4C,OAAO,OAAO;AAAA,EACrE,EAAE,IAAI,iBAAiB,QAAQ,OAAO,SAAS,0BAA0B;AAAA,EACzE,EAAE,IAAI,iBAAiB,QAAQ,OAAO,SAAS,MAAM;AAAA,EACrD,EAAE,IAAI,eAAe,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EACjE,EAAE,IAAI,eAAe,QAAQ,OAAO,SAAS,qBAAqB;AAAA,EAClE,EAAE,IAAI,iBAAiB,QAAQ,OAAO,SAAS,gBAAgB;AAAA,EAC/D,EAAE,IAAI,mBAAmB,QAAQ,QAAQ,SAAS,iBAAiB,OAAO,KAAK;AAAA,EAC/E,EAAE,IAAI,gBAAgB,QAAQ,OAAO,SAAS,IAAI,OAAO,cAAc,EAAE,KAAK,GAAG,EAAE;AAAA,EACnF,EAAE,IAAI,mBAAmB,QAAQ,OAAO,SAAS,IAAI,OAAO,cAAc,EAAE,YAAY,GAAG,EAAE;AAAA,EAC7F;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,mBAAmB,GAAG;AAAA,IAC1D,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,YAAY,GAAG;AAAA,IACnD,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,WAAW,GAAG;AAAA,IAClD,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,aAAa,GAAG;AAAA,IACpD,OAAO;AAAA,EACT;AAAA,EACA,EAAE,IAAI,kBAAkB,QAAQ,OAAO,SAAS,IAAI,OAAO,cAAc,EAAE,WAAW,GAAG,EAAE;AAAA;AAAA,EAE3F;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,UAAU,EAAE,gCAAgC,GAAG;AAAA,IACnF,OAAO;AAAA,EACT;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,oBAAoB,GAAG;AAAA,EAC7D;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,oBAAoB,GAAG;AAAA,EAC7D;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,2BAA2B,GAAG;AAAA,IAClE,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,0BAA0B,GAAG;AAAA,EACnE;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,yBAAyB,EAAE,KAAK,GAAG;AAAA,EACzE;AAAA,EACA,EAAE,IAAI,aAAa,QAAQ,OAAO,SAAS,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE;AAAA,EACxE,EAAE,IAAI,cAAc,QAAQ,QAAQ,SAAS,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE;AAAA,EAC1E,EAAE,IAAI,YAAY,QAAQ,OAAO,SAAS,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE;AAAA,EACvE,EAAE,IAAI,cAAc,QAAQ,SAAS,SAAS,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE;AAAA,EAC3E,EAAE,IAAI,eAAe,QAAQ,UAAU,SAAS,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE;AAAA;AAAA,EAE7E;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AAAA,EACA,EAAE,IAAI,eAAe,QAAQ,QAAQ,SAAS,qBAAqB;AACrE,CAA2B;AAMpB,IAAM,oBAAoB,OAAO,OAAO;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAU;AAGV,IAAM,mBAAmB;AASlB,SAAS,mBACd,QACA,MACqD;AACrD,MAAI,6BAA6B,KAAK,IAAI,EAAG,QAAO;AACpD,MAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,OAAO,SAAS,IAAI,EAAG,QAAO;AAC1E,QAAM,QAAQ,OAAO,YAAY;AACjC,MAAI;AACJ,MAAI,SAAS,oBAAqB,UAAS;AAAA,WAClC,SAAS,iBAAkB,UAAS;AAAA,WACpC,KAAK,WAAW,GAAG,gBAAgB,GAAG,EAAG,UAAS,KAAK,MAAM,iBAAiB,MAAM;AAAA,MACxF,QAAO;AACZ,QAAM,YAAY,gBAAgB;AAAA,IAChC,CAAC,cAAc,UAAU,WAAW,SAAS,UAAU,QAAQ,KAAK,MAAM;AAAA,EAC5E;AACA,SAAO,YAAY,EAAE,WAAW,OAAO,IAAI;AAC7C;;;ACvJA,IAAM,wBAAwB;AAE9B,IAAM,iBACJ;AAEK,IAAM,oBAAoB;AAQ1B,IAAM,oBAAoB;AAE1B,IAAM,qBAAqB;AAM3B,IAAM,uBAAuB;AAE7B,IAAM,iBAAiB;AAEvB,IAAM,sBAAsB;AAkB5B,SAAS,wBAAwB,MAAoC;AAC1E,QAAM,QAAQ,KAAK,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,KAAK;AACvE,SAAO;AAAA,IACL,oDAA+C,KAAK,mBAAc,KAAK,MAAM,wCAAwC,KAAK,QAAQ,gBAAgB,KAAK,SAAS;AAAA,IAChK;AAAA,IACA;AAAA,EACF,EAAE,KAAK,GAAG;AACZ;AAGO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,mCAAmC;AACzC,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EACzC,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,2CAA2C;AACjD,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,eAAe,UAA2B;AACjD,SACE,6BAA6B,KAAK,QAAQ,KAC1C,SAAS,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,OAAO,SAAS,IAAI;AAEpE;AAEA,SAAS,kBAAkB,MAAc,aAA6B;AACpE,QAAM,MAAM,IAAI,IAAI,MAAM,qBAAqB;AAC/C,MAAI,IAAI,aAAa,qBAAqB;AACxC,UAAM,YAAY,IAAI,aAAa,OAAO,aAAa;AACvD,QACE,UAAU,SAAS,KAClB,UAAU,WAAW,KAAK,UAAU,CAAC,MAAM,eAAe,UAAU,CAAC,MAAM;AAE5E,YAAM,IAAI,qBAAqB;AAGjC,QAAI,gBAAgB,YAAa,KAAI,aAAa,IAAI,eAAe,WAAW;AAChF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC5B;AACA,SAAO,KAAK,QAAQ,yBAAyB,eAAe,mBAAmB,WAAW,CAAC,EAAE;AAC/F;AAGA,SAAS,aAAa,MAAc,WAAmB,aAAqB,QAAiB;AAE3F,MAAI,gBAAgB,YAAa,QAAO;AAExC,MAAI,CAAC,OAAQ,OAAM,IAAI,yBAAyB;AAChD,SAAO,UAAU;AAAA,IACf;AAAA,IACA,wBAAwB,mBAAmB,MAAM,CAAC;AAAA,EACpD;AACF;AAcO,SAAS,gBACd,MACA,aACA,SAAS,OACT,QACQ;AACR,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC;AAClC,QAAM,QAAQ,mBAAmB,QAAQ,QAAQ;AACjD,MAAI,CAAC,MAAO,OAAM,IAAI,qBAAqB;AAC3C,QAAM,YAAY,kBAAkB,MAAM,WAAW;AACrD,MAAI,eAAe,KAAK,QAAQ,EAAG,QAAO,aAAa,MAAM,WAAW,aAAa,MAAM;AAC3F,MAAI,MAAM,UAAU,OAAO,gBAAiB,QAAO;AAEnD,QAAM,MAAM,IAAI,IAAI,WAAW,qBAAqB;AACpD,QAAM,UAAU,IAAI,aAAa,OAAO,cAAc;AACtD,QAAM,SAAS,IAAI,aAAa,OAAO,cAAc;AACrD,QAAM,QAAQ,IAAI,aAAa,OAAO,MAAM;AAC5C,MACE,MAAM,SAAS,KACd,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,UACpC,QAAQ,SAAS,OAAO,WAAW,MAClC,QAAQ,CAAC,KAAK,OAAO,CAAC,OAAO;AAE9B,UAAM,IAAI,qBAAqB;AACjC,MAAI,gBAAgB,YAAa,QAAO;AACxC,MAAI,aAAa;AAAA,IACf,OAAO,SAAS,iBAAiB;AAAA,IACjC,UAAU;AAAA,EACZ;AACA,SAAO,IAAI,WAAW,IAAI;AAC5B;AAWO,SAAS,sBAAsB,MAAc,aAA6B;AAC/E,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC;AAClC,QAAM,YACJ,aAAa,yBAAyB,SAAS,WAAW,GAAG,qBAAqB,GAAG;AACvF,MAAK,CAAC,aAAa,aAAa,uBAAwB,eAAe,QAAQ;AAC7E,UAAM,IAAI,qBAAqB;AACjC,QAAM,YAAY,kBAAkB,MAAM,WAAW;AACrD,QAAM,OAAO,eAAe,KAAK,QAAQ;AACzC,MAAI,MAAM;AACR,QAAI,KAAK,CAAC,MAAM,UAAW,OAAM,IAAI,qBAAqB;AAC1D,WAAO,aAAa,MAAM,WAAW,WAAW;AAAA,EAClD;AACA,QAAM,MAAM,IAAI,IAAI,WAAW,qBAAqB;AACpD,MAAI,IAAI,aAAa,IAAI,cAAc,MAAM,aAAa,gBAAgB,aAAa;AACrF,QAAI,aAAa,IAAI,gBAAgB,iBAAiB;AACtD,WAAO,IAAI,WAAW,IAAI;AAAA,EAC5B;AACA,SAAO;AACT;AAaO,SAAS,qBACd,QACyB;AACzB,QAAM,QAAQ,CAAC,SAAiB,OAAO,IAAI,KAAK;AAChD,QAAM,SAAS,MAAM,iBAAiB;AACtC,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,YAAY,MAAM,mBAAmB;AAC3C,QAAM,UAAU,MAAM,oBAAoB;AAC1C,MAAI,WAAW,QAAQ,WAAW,QAAQ,cAAc,QAAQ,YAAY,KAAM,QAAO;AACzF,SAAO,EAAE,QAAQ,UAAU,MAAM,WAAW,aAAa,MAAM,QAAQ,SAAS,WAAW,KAAK;AAClG;AAQO,SAAS,mBACd,QACA,UACA,aACA,aAC+E;AAC/E,MAAI,eAAe,QAAQ,EAAG,QAAO;AACrC,MAAI,WAAW;AACf,MAAI,aAAa,qBAAqB;AACpC,UAAM,SAAS,kBAAkB,WAAW;AAC5C,QAAI,aAAa,UAAU,CAAC,SAAS,WAAW,GAAG,MAAM,GAAG,EAAG,QAAO;AACtE,eAAW,GAAG,qBAAqB,GAAG,SAAS,MAAM,OAAO,MAAM,CAAC;AACnE,UAAM,OAAO,gEAAgE,KAAK,QAAQ;AAC1F,QAAI,MAAM;AACR,UAAI,CAAC,eAAe,KAAK,CAAC,MAAM,YAAa,QAAO;AACpD,iBAAW,SAAS;AAAA,QAClB,wBAAwB,WAAW;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,mBAAmB,QAAQ,QAAQ;AACjD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,gCAAgC,KAAK,MAAM,MAAM;AACjE,SAAO,EAAE,GAAG,OAAO,WAAW,UAAU,QAAQ,CAAC,IAAK,KAAK;AAC7D;AAGO,SAAS,mBAAmB,OAA6B;AAC9D,QAAM,UAAU,IAAI,QAAQ,KAAK;AACjC,QAAM,qBAAqB,QAAQ,IAAI,YAAY,KAAK,IACrD,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,EAAE,YAAY,CAAC;AAC5C,aAAW,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GAAG;AACtC,QACE,kBAAkB,SAAS,IAAI,KAC/B,2MAA2M;AAAA,MACzM;AAAA,IACF,KACA,mFAAmF,KAAK,IAAI;AAE5F,cAAQ,OAAO,IAAI;AAAA,EACvB;AACA,SAAO;AACT;AAOA,IAAM,4BAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AACF;AAQA,IAAM,yBAAsE,OAAO,OAAO;AAAA,EACxF,iBAAiB,CAAC,QAAQ,WAAW,eAAe;AAAA,EACpD,kBAAkB,CAAC,GAAG,2BAA2B,eAAe;AAAA,EAChE,oBAAoB,CAAC,UAAU,UAAU,iBAAiB,qBAAqB;AAAA,EAC/E,8BAA8B;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,iCAAiC;AAAA,IAC/B,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,uBAAuB,CAAC,iBAAiB,wBAAwB,cAAc;AAAA,EAC/E,uBAAuB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,wBAAwB,CAAC,iBAAiB,uBAAuB,aAAa;AAAA,EAC9E,yBAAyB,CAAC,iBAAiB,uBAAuB,QAAQ;AAC5E,CAAC;AAGD,IAAM,+BAA+B,oBAAI,IAAI,CAAC,aAAa,oBAAoB,CAAC;AAOzE,IAAM,mCAAsD,OAAO,OAAO;AAAA,EAC/E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,WAAW,OAAgD;AAClE,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC5D,QACD;AACN;AAGA,SAAS,eAAe,OAAyB;AAC/C,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,WAAW;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK,KAAK,EAAE,WAAW;AACpE,SAAO;AACT;AAEA,SAAS,aACP,MACA,SACA,SAAS,IACM;AACf,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAChD,QAAI,eAAe,KAAK,EAAG;AAC3B,QAAI,CAAC,QAAQ,SAAS,IAAI,KAAK,6BAA6B,IAAI,IAAI;AAClE,aAAO,GAAG,MAAM,GAAG,IAAI;AAAA,EAC3B;AACA,SAAO;AACT;AAUO,SAAS,qBACd,aACA,QACA,MACe;AACf,QAAM,SAAS,WAAW,IAAI;AAC9B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,gBAAgB;AAClB,WAAO,aAAa,QAAQ,gCAAgC;AAC9D,QAAM,SACJ,gBAAgB,wBACZ,6CAA6C,KAAK,MAAM,IAAI,CAAC,IAC7D;AACN,QAAM,MAAM,SAAS,kBAAkB,MAAM,KAAK;AAClD,QAAM,UAAU,uBAAuB,GAAG;AAC1C,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,UAAU,aAAa,QAAQ,OAAO;AAC5C,MAAI,QAAS,QAAO;AACpB,MAAI,gBAAgB,gBAAiB,QAAO;AAC5C,MAAI,OAAO,SAAS,eAAgB,QAAO;AAC3C,QAAM,UAAU,WAAW,OAAO,OAAO;AACzC,SAAO,UAAU,aAAa,SAAS,2BAA2B,UAAU,IAAI;AAClF;","names":[]}