@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/host-mcp-bindings.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/host-mcp-bindings.ts"],"sourcesContent":["import { z } from \"zod\";\nexport { HostMcpCreateSelections, type HostMcpCreateSelection } from \"./index\";\nimport {\n  McpServerConnectionRef,\n  SessionTenancyVisibility,\n  ManagedUserResourceGrantMode,\n  stableJson,\n} from \"./index\";\nimport { ConnectionUseAuthoritySnapshot } from \"./connection-authority\";\nimport { ExternalIdentity } from \"./external-identities\";\nexport const HostMcpOwnerSubject = z.union([\n  ExternalIdentity.shape.subjectId,\n  z\n    .string()\n    .max(4096)\n    .regex(/^user:[^\\r\\n\\u0000]+$/),\n]);\n\n/** Credential-free, immutable destination and host connection selection. */\nexport const HostMcpBindingDefinition = z\n  .object({\n    serverId: z.string().min(1).max(256),\n    destinationUrl: z\n      .string()\n      .url()\n      .max(4096)\n      .refine((value) => {\n        const url = new URL(value);\n        return url.protocol === \"https:\" && !url.username && !url.password && !url.hash;\n      }, \"Host binding requires an HTTPS destination without userinfo or fragment\")\n      .transform((value) => new URL(value).toString()),\n    connectionRef: McpServerConnectionRef,\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.connectionRef.hostBinding)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\", \"hostBinding\"],\n        message: \"A binding definition cannot reference another binding\",\n      });\n    if (value.connectionRef.authoritySource !== \"host\" || !value.connectionRef.connectionId)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\"],\n        message: \"Explicit host connection authority is required\",\n      });\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536)\n      context.addIssue({ code: \"custom\", message: \"Host binding definition exceeds 64 KiB\" });\n  });\nexport type HostMcpBindingDefinition = z.infer<typeof HostMcpBindingDefinition>;\n\n/** Configuration ceiling, never execution authority. The complete destination\n * and provider/scope/resource selection stay exact; only the account identifier\n * is chosen by a captured owner grant in explicit accepted-turn mode. */\nexport type HostMcpBindingSelection = {\n  serverId: string;\n  destinationUrl: string;\n  connectionRef: McpServerConnectionRef;\n};\n\nexport function hostMcpBindingMatchesSelection(\n  binding: { id: string; generation: number; definition: HostMcpBindingDefinition },\n  selection: HostMcpBindingSelection,\n): boolean {\n  const parsed = McpServerConnectionRef.safeParse(selection.connectionRef);\n  if (!parsed.success || !parsed.data.hostBinding) return false;\n  const { hostBinding, ...configuredRef } = parsed.data;\n  const definition = HostMcpBindingDefinition.safeParse(binding.definition);\n  if (!definition.success) return false;\n  let destinationUrl: string;\n  try {\n    destinationUrl = new URL(selection.destinationUrl).toString();\n  } catch {\n    return false;\n  }\n  if (\n    selection.serverId !== definition.data.serverId ||\n    destinationUrl !== definition.data.destinationUrl\n  )\n    return false;\n  if (\"selection\" in hostBinding) {\n    const { connectionId: _connectionId, ...selectedRef } = definition.data.connectionRef;\n    return stableJson(configuredRef) === stableJson(selectedRef);\n  }\n  return (\n    binding.id === hostBinding.bindingId &&\n    binding.generation === hostBinding.generation &&\n    stableJson(configuredRef) === stableJson(definition.data.connectionRef)\n  );\n}\n\nexport const HostMcpBinding = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    authorizationRevision: z.number().int().positive().safe(),\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    definition: HostMcpBindingDefinition,\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpBinding = z.infer<typeof HostMcpBinding>;\n\nexport const CreateHostMcpBindingRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    definition: HostMcpBindingDefinition,\n  })\n  .strict();\nexport type CreateHostMcpBindingRequest = z.infer<typeof CreateHostMcpBindingRequest>;\n\nconst HostMcpGrantRequest = z\n  .object({\n    scope: z.literal(\"user\"),\n    mode: ManagedUserResourceGrantMode,\n    context: SessionTenancyVisibility,\n    sessionId: z.string().uuid().nullable().optional(),\n    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n    workspaceSharedAcknowledged: z.boolean().default(false),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"workspaceSharedAcknowledged\"],\n        message: \"workspace_shared requires durable shared-output acknowledgement\",\n      });\n    }\n    if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n      context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n    }\n    if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"sessionId\"],\n        message: \"session requires a target session and expectedAuthorityEpoch\",\n      });\n    }\n  });\n\n/** Internal owner-authorized issuance; never itself proves caller identity. */\nconst HostMcpDelegationGrant = HostMcpGrantRequest.superRefine((value, context) => {\n  if (\n    Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) ||\n    (value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch))\n  ) {\n    context.addIssue({\n      code: \"custom\",\n      message: \"Host session grants require a matching safe authority epoch\",\n    });\n  }\n});\nexport const IssueHostMcpDelegationRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    bindingId: z.string().uuid(),\n    expectedBindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n  })\n  .strict();\nexport type IssueHostMcpDelegationRequest = z.infer<typeof IssueHostMcpDelegationRequest>;\n\nexport const HostMcpDelegation = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpDelegation = z.infer<typeof HostMcpDelegation>;\n\n/** Internal admission evidence, not a caller-supplied permission or credential.\n * Persistence must construct this from live authenticated authority and freeze\n * it with accepted work. Runtime use must independently revalidate that work,\n * membership, binding and delegation. No API key is retained as execution rights.\n */\nexport const HostMcpAcceptedAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive().safe(),\n    acceptedWork: ConnectionUseAuthoritySnapshot.shape.acceptedWork,\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    scheduledOrigin: z\n      .object({\n        taskId: z.string().uuid(),\n        taskAuthorityRevision: z.number().int().positive().safe(),\n        runId: z.string().uuid(),\n      })\n      .strict()\n      .optional(),\n    source: z.discriminatedUnion(\"kind\", [\n      z.object({ kind: z.literal(\"direct\") }).strict(),\n      z.object({ kind: z.literal(\"scheduled_task\") }).strict(),\n      z\n        .object({\n          kind: z.literal(\"child_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n      z\n        .object({\n          kind: z.literal(\"inherited_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n    ]),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      (value.source.kind === \"direct\" && value.scheduledOrigin) ||\n      (value.source.kind === \"scheduled_task\" &&\n        (!value.scheduledOrigin ||\n          value.acceptedWork.kind !== \"scheduled_task\" ||\n          value.scheduledOrigin.taskId !== value.acceptedWork.taskId ||\n          value.scheduledOrigin.runId !== value.acceptedWork.runId ||\n          value.scheduledOrigin.taskAuthorityRevision !== value.acceptedWork.taskAuthorityRevision))\n    )\n      context.addIssue({\n        code: \"custom\",\n        message: \"Scheduled host authority must retain its exact run origin\",\n      });\n    if (\n      value.acceptedWork.kind === \"turn\" &&\n      value.source.kind === \"inherited_turn\" &&\n      value.acceptedWork.turnId === value.source.turnId\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"source\"],\n        message: \"Accepted work cannot inherit from itself\",\n      });\n    }\n    if (\n      value.acceptedWork.kind === \"scheduled_task\" &&\n      !Number.isSafeInteger(value.acceptedWork.taskAuthorityRevision)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"acceptedWork\"],\n        message: \"Task authority revision must be a safe integer\",\n      });\n    }\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536) {\n      context.addIssue({ code: \"custom\", message: \"Host accepted authority exceeds 64 KiB\" });\n    }\n  });\nexport type HostMcpAcceptedAuthority = z.infer<typeof HostMcpAcceptedAuthority>;\n\n/** Credential-free selection frozen on one immutable scheduled-task revision. */\nexport const HostMcpTaskAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    taskId: z.string().uuid(),\n    taskAuthorityRevision: z.number().int().positive().safe(),\n    taskExecutionDigest: z.string().regex(/^[0-9a-f]{64}$/),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    context: SessionTenancyVisibility,\n  })\n  .strict();\nexport type HostMcpTaskAuthority = z.infer<typeof HostMcpTaskAuthority>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,MAAM;AAAA,EACzC,iBAAiB,MAAM;AAAA,EACvB,EACG,OAAO,EACP,IAAI,IAAI,EACR,MAAM,uBAAuB;AAClC,CAAC;AAGM,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,gBAAgB,EACb,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,OAAO,CAAC,UAAU;AACjB,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,EAC7E,GAAG,yEAAyE,EAC3E,UAAU,CAAC,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,CAAC;AAAA,EACjD,eAAe;AACjB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,cAAc;AACtB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB,aAAa;AAAA,MACrC,SAAS;AAAA,IACX,CAAC;AACH,MAAI,MAAM,cAAc,oBAAoB,UAAU,CAAC,MAAM,cAAc;AACzE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,eAAe;AAAA,MACtB,SAAS;AAAA,IACX,CAAC;AACH,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa;AAC/D,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAC1F,CAAC;AAYI,SAAS,+BACd,SACA,WACS;AACT,QAAM,SAAS,uBAAuB,UAAU,UAAU,aAAa;AACvE,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAK,YAAa,QAAO;AACxD,QAAM,EAAE,aAAa,GAAG,cAAc,IAAI,OAAO;AACjD,QAAM,aAAa,yBAAyB,UAAU,QAAQ,UAAU;AACxE,MAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAI;AACJ,MAAI;AACF,qBAAiB,IAAI,IAAI,UAAU,cAAc,EAAE,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,UAAU,aAAa,WAAW,KAAK,YACvC,mBAAmB,WAAW,KAAK;AAEnC,WAAO;AACT,MAAI,eAAe,aAAa;AAC9B,UAAM,EAAE,cAAc,eAAe,GAAG,YAAY,IAAI,WAAW,KAAK;AACxE,WAAO,WAAW,aAAa,MAAM,WAAW,WAAW;AAAA,EAC7D;AACA,SACE,QAAQ,OAAO,YAAY,aAC3B,QAAQ,eAAe,YAAY,cACnC,WAAW,aAAa,MAAM,WAAW,WAAW,KAAK,aAAa;AAE1E;AAEO,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY;AACd,CAAC,EACA,OAAO;AAGV,IAAM,sBAAsB,EACzB,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACxD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,6BAA6B;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,yBAAyB,oBAAoB,YAAY,CAAC,OAAO,YAAY;AACjF,MACE,QAAQ,MAAM,SAAS,OAAO,MAAM,0BAA0B,SAC7D,MAAM,0BAA0B,QAAQ,CAAC,OAAO,cAAc,MAAM,sBAAsB,GAC3F;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AACM,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC5D,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7D,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,OAAO;AAAA,EACP,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAQH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC9D,cAAc,+BAA+B,MAAM;AAAA,EACnD,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,iBAAiB,EACd,OAAO;AAAA,IACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,IACxD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,QAAQ,EAAE,mBAAmB,QAAQ;AAAA,IACnC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,IAC/C,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,EAAE,CAAC,EAAE,OAAO;AAAA,IACvD,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,YAAY;AAAA,MAC5B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,MAChC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACG,MAAM,OAAO,SAAS,YAAY,MAAM,mBACxC,MAAM,OAAO,SAAS,qBACpB,CAAC,MAAM,mBACN,MAAM,aAAa,SAAS,oBAC5B,MAAM,gBAAgB,WAAW,MAAM,aAAa,UACpD,MAAM,gBAAgB,UAAU,MAAM,aAAa,SACnD,MAAM,gBAAgB,0BAA0B,MAAM,aAAa;AAEvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACH,MACE,MAAM,aAAa,SAAS,UAC5B,MAAM,OAAO,SAAS,oBACtB,MAAM,aAAa,WAAW,MAAM,OAAO,QAC3C;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,aAAa,SAAS,oBAC5B,CAAC,OAAO,cAAc,MAAM,aAAa,qBAAqB,GAC9D;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,OAAQ;AACvE,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAAA,EACxF;AACF,CAAC;AAII,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACtD,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,YAAY;AAAA,EACZ,SAAS;AACX,CAAC,EACA,OAAO;","names":[]}
+{"version":3,"sources":["../src/host-mcp-bindings.ts"],"sourcesContent":["import * as primitives from \"./primitives\";\nimport { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\nexport { HostMcpCreateSelections, type HostMcpCreateSelection } from \"./index\";\nimport {\n  McpServerConnectionRef,\n  SessionTenancyVisibility,\n  ManagedUserResourceGrantMode,\n  stableJson,\n} from \"./index\";\nimport { ConnectionUseAuthoritySnapshot } from \"./connection-authority\";\nimport { ExternalIdentity } from \"./external-identities\";\nexport const HostMcpOwnerSubject = /* @__PURE__ */ defineSchema(() =>\n  z.union([\n    ExternalIdentity.shape.subjectId,\n    z\n      .string()\n      .max(4096)\n      .regex(/^user:[^\\r\\n\\u0000]+$/),\n  ]),\n);\n\n/** Credential-free, immutable destination and host connection selection. */\nexport const HostMcpBindingDefinition = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      serverId: z.string().min(1).max(256),\n      destinationUrl: z\n        .string()\n        .url()\n        .max(4096)\n        .refine((value) => {\n          const url = new URL(value);\n          return url.protocol === \"https:\" && !url.username && !url.password && !url.hash;\n        }, \"Host binding requires an HTTPS destination without userinfo or fragment\")\n        .transform((value) => new URL(value).toString()),\n      connectionRef: McpServerConnectionRef,\n    })\n    .strict()\n    .superRefine((value, context) => {\n      if (value.connectionRef.hostBinding)\n        context.addIssue({\n          code: \"custom\",\n          path: [\"connectionRef\", \"hostBinding\"],\n          message: \"A binding definition cannot reference another binding\",\n        });\n      if (value.connectionRef.authoritySource !== \"host\" || !value.connectionRef.connectionId)\n        context.addIssue({\n          code: \"custom\",\n          path: [\"connectionRef\"],\n          message: \"Explicit host connection authority is required\",\n        });\n      if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536)\n        context.addIssue({ code: \"custom\", message: \"Host binding definition exceeds 64 KiB\" });\n    }),\n);\nexport type HostMcpBindingDefinition = z.infer<typeof HostMcpBindingDefinition>;\n\n/** Configuration ceiling, never execution authority. The complete destination\n * and provider/scope/resource selection stay exact; only the account identifier\n * is chosen by a captured owner grant in explicit accepted-turn mode. */\nexport type HostMcpBindingSelection = {\n  serverId: string;\n  destinationUrl: string;\n  connectionRef: McpServerConnectionRef;\n};\n\nexport function hostMcpBindingMatchesSelection(\n  binding: { id: string; generation: number; definition: HostMcpBindingDefinition },\n  selection: HostMcpBindingSelection,\n): boolean {\n  const parsed = McpServerConnectionRef.safeParse(selection.connectionRef);\n  if (!parsed.success || !parsed.data.hostBinding) return false;\n  const { hostBinding, ...configuredRef } = parsed.data;\n  const definition = HostMcpBindingDefinition.safeParse(binding.definition);\n  if (!definition.success) return false;\n  let destinationUrl: string;\n  try {\n    destinationUrl = new URL(selection.destinationUrl).toString();\n  } catch {\n    return false;\n  }\n  if (\n    selection.serverId !== definition.data.serverId ||\n    destinationUrl !== definition.data.destinationUrl\n  )\n    return false;\n  if (\"selection\" in hostBinding) {\n    const { connectionId: _connectionId, ...selectedRef } = definition.data.connectionRef;\n    return stableJson(configuredRef) === stableJson(selectedRef);\n  }\n  return (\n    binding.id === hostBinding.bindingId &&\n    binding.generation === hostBinding.generation &&\n    stableJson(configuredRef) === stableJson(definition.data.connectionRef)\n  );\n}\n\nexport const HostMcpBinding = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      id: primitives.uuid,\n      accountId: primitives.uuid,\n      workspaceId: primitives.uuid,\n      ownerSubjectId: HostMcpOwnerSubject,\n      authorizationRevision: primitives.positiveInteger.safe(),\n      generation: primitives.positiveInteger.safe(),\n      status: z.enum([\"active\", \"revoked\"]),\n      definition: HostMcpBindingDefinition,\n      createdAt: primitives.string.datetime({ offset: true }),\n      revokedAt: primitives.string.datetime({ offset: true }).nullable(),\n    })\n    .strict(),\n);\nexport type HostMcpBinding = z.infer<typeof HostMcpBinding>;\n\nexport const CreateHostMcpBindingRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      operationId: primitives.uuid,\n      definition: HostMcpBindingDefinition,\n    })\n    .strict(),\n);\nexport type CreateHostMcpBindingRequest = z.infer<typeof CreateHostMcpBindingRequest>;\n\nconst HostMcpGrantRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      scope: z.literal(\"user\"),\n      mode: ManagedUserResourceGrantMode,\n      context: SessionTenancyVisibility,\n      sessionId: z.string().uuid().nullable().optional(),\n      expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n      workspaceSharedAcknowledged: primitives.boolean.default(false),\n    })\n    .strict()\n    .superRefine((value, context) => {\n      if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"workspaceSharedAcknowledged\"],\n          message: \"workspace_shared requires durable shared-output acknowledgement\",\n        });\n      }\n      if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n        context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n      }\n      if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"sessionId\"],\n          message: \"session requires a target session and expectedAuthorityEpoch\",\n        });\n      }\n    }),\n);\n\n/** Internal owner-authorized issuance; never itself proves caller identity. */\nconst HostMcpDelegationGrant = /* @__PURE__ */ defineSchema(() =>\n  HostMcpGrantRequest.superRefine((value, context) => {\n    if (\n      Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) ||\n      (value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch))\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Host session grants require a matching safe authority epoch\",\n      });\n    }\n  }),\n);\nexport const IssueHostMcpDelegationRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      operationId: primitives.uuid,\n      bindingId: primitives.uuid,\n      expectedBindingGeneration: primitives.positiveInteger.safe(),\n      grant: HostMcpDelegationGrant,\n    })\n    .strict(),\n);\nexport type IssueHostMcpDelegationRequest = z.infer<typeof IssueHostMcpDelegationRequest>;\n\nexport const HostMcpDelegation = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      id: primitives.uuid,\n      accountId: primitives.uuid,\n      workspaceId: primitives.uuid,\n      ownerSubjectId: HostMcpOwnerSubject,\n      ownerAuthorizationRevision: primitives.positiveInteger.safe(),\n      bindingId: primitives.uuid,\n      bindingGeneration: primitives.positiveInteger.safe(),\n      grant: HostMcpDelegationGrant,\n      generation: primitives.positiveInteger.safe(),\n      status: z.enum([\"active\", \"revoked\"]),\n      createdAt: primitives.string.datetime({ offset: true }),\n      revokedAt: primitives.string.datetime({ offset: true }).nullable(),\n    })\n    .strict(),\n);\nexport type HostMcpDelegation = z.infer<typeof HostMcpDelegation>;\n\n/** Internal admission evidence, not a caller-supplied permission or credential.\n * Persistence must construct this from live authenticated authority and freeze\n * it with accepted work. Runtime use must independently revalidate that work,\n * membership, binding and delegation. No API key is retained as execution rights.\n */\nexport const HostMcpAcceptedAuthority = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      version: z.literal(1),\n      accountId: primitives.uuid,\n      workspaceId: primitives.uuid,\n      targetSessionId: primitives.uuid,\n      targetSessionVisibility: SessionTenancyVisibility,\n      targetSessionAuthorityEpoch: primitives.positiveInteger.safe(),\n      acceptedWork: ConnectionUseAuthoritySnapshot.shape.acceptedWork,\n      bindingId: primitives.uuid,\n      bindingGeneration: primitives.positiveInteger.safe(),\n      definition: HostMcpBindingDefinition,\n      ownerSubjectId: HostMcpOwnerSubject,\n      ownerOrganizationMembershipId: primitives.uuid,\n      ownerMembershipAuthorizationRevision: primitives.positiveInteger.safe(),\n      delegationId: primitives.uuid,\n      delegationGeneration: primitives.positiveInteger.safe(),\n      scheduledOrigin: z\n        .object({\n          taskId: primitives.uuid,\n          taskAuthorityRevision: primitives.positiveInteger.safe(),\n          runId: primitives.uuid,\n        })\n        .strict()\n        .optional(),\n      source: z.discriminatedUnion(\"kind\", [\n        z.object({ kind: z.literal(\"direct\") }).strict(),\n        z.object({ kind: z.literal(\"scheduled_task\") }).strict(),\n        z\n          .object({\n            kind: z.literal(\"child_turn\"),\n            sessionId: primitives.uuid,\n            turnId: primitives.uuid,\n          })\n          .strict(),\n        z\n          .object({\n            kind: z.literal(\"inherited_turn\"),\n            sessionId: primitives.uuid,\n            turnId: primitives.uuid,\n          })\n          .strict(),\n      ]),\n    })\n    .strict()\n    .superRefine((value, context) => {\n      if (\n        (value.source.kind === \"direct\" && value.scheduledOrigin) ||\n        (value.source.kind === \"scheduled_task\" &&\n          (!value.scheduledOrigin ||\n            value.acceptedWork.kind !== \"scheduled_task\" ||\n            value.scheduledOrigin.taskId !== value.acceptedWork.taskId ||\n            value.scheduledOrigin.runId !== value.acceptedWork.runId ||\n            value.scheduledOrigin.taskAuthorityRevision !==\n              value.acceptedWork.taskAuthorityRevision))\n      )\n        context.addIssue({\n          code: \"custom\",\n          message: \"Scheduled host authority must retain its exact run origin\",\n        });\n      if (\n        value.acceptedWork.kind === \"turn\" &&\n        value.source.kind === \"inherited_turn\" &&\n        value.acceptedWork.turnId === value.source.turnId\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"source\"],\n          message: \"Accepted work cannot inherit from itself\",\n        });\n      }\n      if (\n        value.acceptedWork.kind === \"scheduled_task\" &&\n        !Number.isSafeInteger(value.acceptedWork.taskAuthorityRevision)\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"acceptedWork\"],\n          message: \"Task authority revision must be a safe integer\",\n        });\n      }\n      if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536) {\n        context.addIssue({ code: \"custom\", message: \"Host accepted authority exceeds 64 KiB\" });\n      }\n    }),\n);\nexport type HostMcpAcceptedAuthority = z.infer<typeof HostMcpAcceptedAuthority>;\n\n/** Credential-free selection frozen on one immutable scheduled-task revision. */\nexport const HostMcpTaskAuthority = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      version: z.literal(1),\n      accountId: primitives.uuid,\n      workspaceId: primitives.uuid,\n      taskId: primitives.uuid,\n      taskAuthorityRevision: primitives.positiveInteger.safe(),\n      taskExecutionDigest: primitives.string.regex(/^[0-9a-f]{64}$/),\n      ownerSubjectId: HostMcpOwnerSubject,\n      ownerOrganizationMembershipId: primitives.uuid,\n      ownerMembershipAuthorizationRevision: primitives.positiveInteger.safe(),\n      bindingId: primitives.uuid,\n      bindingGeneration: primitives.positiveInteger.safe(),\n      delegationId: primitives.uuid,\n      delegationGeneration: primitives.positiveInteger.safe(),\n      definition: HostMcpBindingDefinition,\n      context: SessionTenancyVisibility,\n    })\n    .strict(),\n);\nexport type HostMcpTaskAuthority = z.infer<typeof HostMcpTaskAuthority>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,SAAS,SAAS;AAUX,IAAM,sBAAsC;AAAA,EAAa,MAC9D,EAAE,MAAM;AAAA,IACN,iBAAiB,MAAM;AAAA,IACvB,EACG,OAAO,EACP,IAAI,IAAI,EACR,MAAM,uBAAuB;AAAA,EAClC,CAAC;AACH;AAGO,IAAM,2BAA2C;AAAA,EAAa,MACnE,EACG,OAAO;AAAA,IACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACnC,gBAAgB,EACb,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,OAAO,CAAC,UAAU;AACjB,YAAM,MAAM,IAAI,IAAI,KAAK;AACzB,aAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,IAC7E,GAAG,yEAAyE,EAC3E,UAAU,CAAC,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,CAAC;AAAA,IACjD,eAAe;AAAA,EACjB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAI,MAAM,cAAc;AACtB,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,iBAAiB,aAAa;AAAA,QACrC,SAAS;AAAA,MACX,CAAC;AACH,QAAI,MAAM,cAAc,oBAAoB,UAAU,CAAC,MAAM,cAAc;AACzE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,eAAe;AAAA,QACtB,SAAS;AAAA,MACX,CAAC;AACH,QAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa;AAC/D,cAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAAA,EAC1F,CAAC;AACL;AAYO,SAAS,+BACd,SACA,WACS;AACT,QAAM,SAAS,uBAAuB,UAAU,UAAU,aAAa;AACvE,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAK,YAAa,QAAO;AACxD,QAAM,EAAE,aAAa,GAAG,cAAc,IAAI,OAAO;AACjD,QAAM,aAAa,yBAAyB,UAAU,QAAQ,UAAU;AACxE,MAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAI;AACJ,MAAI;AACF,qBAAiB,IAAI,IAAI,UAAU,cAAc,EAAE,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,UAAU,aAAa,WAAW,KAAK,YACvC,mBAAmB,WAAW,KAAK;AAEnC,WAAO;AACT,MAAI,eAAe,aAAa;AAC9B,UAAM,EAAE,cAAc,eAAe,GAAG,YAAY,IAAI,WAAW,KAAK;AACxE,WAAO,WAAW,aAAa,MAAM,WAAW,WAAW;AAAA,EAC7D;AACA,SACE,QAAQ,OAAO,YAAY,aAC3B,QAAQ,eAAe,YAAY,cACnC,WAAW,aAAa,MAAM,WAAW,WAAW,KAAK,aAAa;AAE1E;AAEO,IAAM,iBAAiC;AAAA,EAAa,MACzD,EACG,OAAO;AAAA,IACN,IAAe;AAAA,IACf,WAAsB;AAAA,IACtB,aAAwB;AAAA,IACxB,gBAAgB;AAAA,IAChB,uBAAkC,gBAAgB,KAAK;AAAA,IACvD,YAAuB,gBAAgB,KAAK;AAAA,IAC5C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,IACpC,YAAY;AAAA,IACZ,WAAsB,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,IACtD,WAAsB,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EACnE,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,8BAA8C;AAAA,EAAa,MACtE,EACG,OAAO;AAAA,IACN,aAAwB;AAAA,IACxB,YAAY;AAAA,EACd,CAAC,EACA,OAAO;AACZ;AAGA,IAAM,sBAAsC;AAAA,EAAa,MACvD,EACG,OAAO;AAAA,IACN,OAAO,EAAE,QAAQ,MAAM;AAAA,IACvB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,IACxE,6BAAwC,QAAQ,QAAQ,KAAK;AAAA,EAC/D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,6BAA6B;AAAA,QACpC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,cAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,IACxF;AACA,QAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,WAAW;AAAA,QAClB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAGA,IAAM,yBAAyC;AAAA,EAAa,MAC1D,oBAAoB,YAAY,CAAC,OAAO,YAAY;AAClD,QACE,QAAQ,MAAM,SAAS,OAAO,MAAM,0BAA0B,SAC7D,MAAM,0BAA0B,QAAQ,CAAC,OAAO,cAAc,MAAM,sBAAsB,GAC3F;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AACO,IAAM,gCAAgD;AAAA,EAAa,MACxE,EACG,OAAO;AAAA,IACN,aAAwB;AAAA,IACxB,WAAsB;AAAA,IACtB,2BAAsC,gBAAgB,KAAK;AAAA,IAC3D,OAAO;AAAA,EACT,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,oBAAoC;AAAA,EAAa,MAC5D,EACG,OAAO;AAAA,IACN,IAAe;AAAA,IACf,WAAsB;AAAA,IACtB,aAAwB;AAAA,IACxB,gBAAgB;AAAA,IAChB,4BAAuC,gBAAgB,KAAK;AAAA,IAC5D,WAAsB;AAAA,IACtB,mBAA8B,gBAAgB,KAAK;AAAA,IACnD,OAAO;AAAA,IACP,YAAuB,gBAAgB,KAAK;AAAA,IAC5C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,IACpC,WAAsB,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,IACtD,WAAsB,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EACnE,CAAC,EACA,OAAO;AACZ;AAQO,IAAM,2BAA2C;AAAA,EAAa,MACnE,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,WAAsB;AAAA,IACtB,aAAwB;AAAA,IACxB,iBAA4B;AAAA,IAC5B,yBAAyB;AAAA,IACzB,6BAAwC,gBAAgB,KAAK;AAAA,IAC7D,cAAc,+BAA+B,MAAM;AAAA,IACnD,WAAsB;AAAA,IACtB,mBAA8B,gBAAgB,KAAK;AAAA,IACnD,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,+BAA0C;AAAA,IAC1C,sCAAiD,gBAAgB,KAAK;AAAA,IACtE,cAAyB;AAAA,IACzB,sBAAiC,gBAAgB,KAAK;AAAA,IACtD,iBAAiB,EACd,OAAO;AAAA,MACN,QAAmB;AAAA,MACnB,uBAAkC,gBAAgB,KAAK;AAAA,MACvD,OAAkB;AAAA,IACpB,CAAC,EACA,OAAO,EACP,SAAS;AAAA,IACZ,QAAQ,EAAE,mBAAmB,QAAQ;AAAA,MACnC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,MAC/C,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,EAAE,CAAC,EAAE,OAAO;AAAA,MACvD,EACG,OAAO;AAAA,QACN,MAAM,EAAE,QAAQ,YAAY;AAAA,QAC5B,WAAsB;AAAA,QACtB,QAAmB;AAAA,MACrB,CAAC,EACA,OAAO;AAAA,MACV,EACG,OAAO;AAAA,QACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,QAChC,WAAsB;AAAA,QACtB,QAAmB;AAAA,MACrB,CAAC,EACA,OAAO;AAAA,IACZ,CAAC;AAAA,EACH,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QACG,MAAM,OAAO,SAAS,YAAY,MAAM,mBACxC,MAAM,OAAO,SAAS,qBACpB,CAAC,MAAM,mBACN,MAAM,aAAa,SAAS,oBAC5B,MAAM,gBAAgB,WAAW,MAAM,aAAa,UACpD,MAAM,gBAAgB,UAAU,MAAM,aAAa,SACnD,MAAM,gBAAgB,0BACpB,MAAM,aAAa;AAEzB,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AACH,QACE,MAAM,aAAa,SAAS,UAC5B,MAAM,OAAO,SAAS,oBACtB,MAAM,aAAa,WAAW,MAAM,OAAO,QAC3C;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,QAAQ;AAAA,QACf,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QACE,MAAM,aAAa,SAAS,oBAC5B,CAAC,OAAO,cAAc,MAAM,aAAa,qBAAqB,GAC9D;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,OAAQ;AACvE,cAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAAA,IACxF;AAAA,EACF,CAAC;AACL;AAIO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,WAAsB;AAAA,IACtB,aAAwB;AAAA,IACxB,QAAmB;AAAA,IACnB,uBAAkC,gBAAgB,KAAK;AAAA,IACvD,qBAAgC,OAAO,MAAM,gBAAgB;AAAA,IAC7D,gBAAgB;AAAA,IAChB,+BAA0C;AAAA,IAC1C,sCAAiD,gBAAgB,KAAK;AAAA,IACtE,WAAsB;AAAA,IACtB,mBAA8B,gBAAgB,KAAK;AAAA,IACnD,cAAyB;AAAA,IACzB,sBAAiC,gBAAgB,KAAK;AAAA,IACtD,YAAY;AAAA,IACZ,SAAS;AAAA,EACX,CAAC,EACA,OAAO;AACZ;","names":[]}