@opengeni/runtime 4.6.0 → 4.7.0-canary.37090756480001

package/dist/{chunk-A22BKN4P.js → chunk-LJNCGUMB.js}

@@ -9,12 +9,12 @@ import {
 import { undiciFetch } from "@opengeni/network";
 var MCP_MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 var MCP_MAX_INBOUND_REQUEST_BYTES = CODEMODE_ARGUMENTS_MAX_BYTES + 64 * 1024;
-var MCP_MAX_TOOL_DEFINITION_BYTES = 128 * 1024;
+var MCP_MAX_TOOL_DEFINITION_BYTES = 512 * 1024;
 var MCP_MAX_TOOL_LIST_BYTES = 4 * 1024 * 1024;
 var MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES = MCP_MAX_CATALOG_TOOL_ENTRIES;
 var MCP_MAX_TOOL_LIST_ENTRIES = MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES;
 var MCP_MAX_TOOL_RESULT_BYTES = 1024 * 1024;
-var MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES = 256 * 1024;
+var MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES = MCP_MAX_TOOL_DEFINITION_BYTES + 16 * 1024;
 var MCP_MAX_SELECTED_SERVERS = 64;
 var MCP_MAX_CONCURRENT_SERVER_OPERATIONS = 8;
 var MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS = 1e4;
@@ -588,4 +588,4 @@ export {
   isNonPublicMcpAddress,
   undiciFetch
 };
-//# sourceMappingURL=chunk-A22BKN4P.js.map
+//# sourceMappingURL=chunk-LJNCGUMB.js.map

package/dist/chunk-LJNCGUMB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mcp-network.ts"],"sourcesContent":["import { beginMcpPhase, traceparent } from \"@opengeni/observability\";\nimport type { Settings } from \"@opengeni/config\";\nimport { CODEMODE_ARGUMENTS_MAX_BYTES, MCP_MAX_CATALOG_TOOL_ENTRIES } from \"@opengeni/contracts\";\nimport {\n  isNonPublicAddress,\n  pinnedFetch,\n  resolvePinnedDestination,\n  type DnsLookup,\n  type FetchLike,\n} from \"@opengeni/network\";\n\nexport { undiciFetch } from \"@opengeni/network\";\n\nexport const MCP_MAX_RESPONSE_BYTES = 8 * 1024 * 1024;\n// Codemode sends its admitted call through the same first-party MCP endpoint.\n// Keep enough JSON-RPC envelope headroom above the exact 4 MiB argument bound;\n// a lower HTTP limit rejects valid calls before the tool can execute and turns\n// a deterministic transport refusal into apparent outcome uncertainty.\nexport const MCP_MAX_INBOUND_REQUEST_BYTES = CODEMODE_ARGUMENTS_MAX_BYTES + 64 * 1024;\n// Rich nested schemas fit within one bounded discovery/disclosure envelope.\n// Whole-server and aggregate limits still bound the complete catalog.\nexport const MCP_MAX_TOOL_DEFINITION_BYTES = 512 * 1024;\nexport const MCP_MAX_TOOL_LIST_BYTES = 4 * 1024 * 1024;\nexport const MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES = MCP_MAX_CATALOG_TOOL_ENTRIES;\n// One provider may use the available catalog allowance. The shared budget\n// still accounts for every provider together; a separate lower count ceiling\n// silently excluded otherwise bounded catalogs from best-effort discovery.\nexport const MCP_MAX_TOOL_LIST_ENTRIES = MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES;\nexport const MCP_MAX_TOOL_RESULT_BYTES = 1024 * 1024;\nexport const MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES = MCP_MAX_TOOL_DEFINITION_BYTES + 16 * 1024;\nexport const MCP_MAX_SELECTED_SERVERS = 64;\nexport const MCP_MAX_CONCURRENT_SERVER_OPERATIONS = 8;\n// @openai/agents has a separate lifecycle fence around MCPServer.connect().\n// It defaults to 10 seconds and can otherwise preempt a larger per-server\n// transport timeout before that server finishes its own handshake.\nexport const MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS = 10_000;\nexport const MCP_MAX_AGGREGATE_TOOL_LIST_BYTES = 16 * 1024 * 1024;\n\nexport const MCP_REPLAY_SAFE_METHODS = [\n  \"initialize\",\n  \"notifications/initialized\",\n  \"tools/list\",\n] as const;\n\nexport type McpJsonRpcId = string | number | null;\n\nexport type McpRequestReplayInfo = {\n  replaySafeAfter401: boolean;\n  batch: boolean;\n  responseIds: readonly McpJsonRpcId[];\n  method?: string;\n  id?: McpJsonRpcId;\n  toolName?: string;\n  operationId?: string;\n};\n\nexport type McpTransportFailureCauseDiagnostic = Readonly<{\n  kind: \"error\" | \"object\" | \"string\" | \"number\" | \"boolean\" | \"null\" | \"other\";\n  name?: string;\n  message?: string;\n  code?: string | number;\n  status?: number;\n  statusCode?: number;\n  value?: string | number | boolean | null;\n}>;\n\nexport type McpTransportRequestFailureDiagnostic = Readonly<{\n  httpMethod: string;\n  rpcMethod?: string;\n  /** The thrown source is first, followed by its successive `cause` values. */\n  causeChain: readonly McpTransportFailureCauseDiagnostic[];\n  causeChainComplete: boolean;\n}>;\n\ntype ClassifiedMcpJsonRpcRequest = {\n  valid: boolean;\n  method?: string;\n  id?: McpJsonRpcId;\n  toolName?: string;\n  operationId?: string;\n};\n\nconst MCP_REPLAY_SAFE_METHOD_SET = new Set<string>(MCP_REPLAY_SAFE_METHODS);\nconst MCP_TRANSPORT_FAILURE_CAUSE_MAX_NODES = 8;\nconst MCP_TRANSPORT_FAILURE_LOOKUP_MAX_NODES = 32;\nconst MCP_TRANSPORT_FAILURE_NESTED_KEYS = [\"cause\", \"error\", \"response\", \"data\"] as const;\nconst mcpTransportRequestFailures = new WeakMap<object, McpTransportRequestFailureDiagnostic>();\n\nfunction isJsonObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction classifyMcpJsonRpcRequest(value: unknown): ClassifiedMcpJsonRpcRequest {\n  if (!isJsonObject(value)) {\n    return { valid: false };\n  }\n  const hasId = Object.prototype.hasOwnProperty.call(value, \"id\");\n  const id =\n    typeof value.id === \"string\" || typeof value.id === \"number\" || value.id === null\n      ? value.id\n      : undefined;\n  const validId = !hasId || id !== undefined;\n  const method =\n    typeof value.method === \"string\" && value.method.length > 0 ? value.method : undefined;\n  const valid = value.jsonrpc === \"2.0\" && method !== undefined && validId;\n  const params = isJsonObject(value.params) ? value.params : undefined;\n  const toolName =\n    valid && method === \"tools/call\" && typeof params?.name === \"string\" ? params.name : undefined;\n  const meta =\n    valid && method === \"tools/call\" && isJsonObject(params?._meta) ? params._meta : null;\n  const operationId =\n    meta && typeof meta.opengeniOperationId === \"string\" && meta.opengeniOperationId.length > 0\n      ? meta.opengeniOperationId\n      : undefined;\n  return {\n    valid,\n    ...(valid && method ? { method } : {}),\n    ...(hasId && id !== undefined ? { id } : {}),\n    ...(toolName ? { toolName } : {}),\n    ...(operationId ? { operationId } : {}),\n  };\n}\n\nfunction invalidMcpRequestReplayInfo(batch = false): McpRequestReplayInfo {\n  return {\n    replaySafeAfter401: false,\n    batch,\n    responseIds: [],\n  };\n}\n\n/**\n * Classify one outbound MCP JSON-RPC body for post-401 replay. The policy is\n * deliberately fail-closed: only the exact reviewed handshake/list allowlist\n * may be resent. Unknown extensions, malformed requests, non-list methods, and\n * batches containing any unsafe or invalid entry are outcome-uncertain.\n */\nexport async function mcpRequestReplayInfo(\n  input: string | URL | Request,\n  init?: RequestInit,\n): Promise<McpRequestReplayInfo> {\n  let body: string | null = null;\n  if (typeof init?.body === \"string\") {\n    body = init.body;\n  } else if (init?.body !== undefined && init.body !== null) {\n    return invalidMcpRequestReplayInfo();\n  } else if (input instanceof Request && (init?.method ?? input.method).toUpperCase() === \"POST\") {\n    body = await input\n      .clone()\n      .text()\n      .catch(() => null);\n  }\n  if (!body) {\n    return invalidMcpRequestReplayInfo();\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(body);\n  } catch {\n    return invalidMcpRequestReplayInfo();\n  }\n\n  if (Array.isArray(parsed)) {\n    if (parsed.length === 0) {\n      return invalidMcpRequestReplayInfo(true);\n    }\n    const requests = parsed.map(classifyMcpJsonRpcRequest);\n    const valid = requests.every((request) => request.valid);\n    const responseIds = requests.flatMap((request) =>\n      request.id !== undefined ? [request.id] : [],\n    );\n    const toolName = requests.find((request) => request.toolName)?.toolName;\n    return {\n      replaySafeAfter401:\n        valid &&\n        requests.every(\n          (request) =>\n            request.method !== undefined && MCP_REPLAY_SAFE_METHOD_SET.has(request.method),\n        ),\n      batch: true,\n      responseIds,\n      ...(toolName ? { toolName } : {}),\n    };\n  }\n\n  const request = classifyMcpJsonRpcRequest(parsed);\n  if (!request.valid || request.method === undefined) {\n    return {\n      ...invalidMcpRequestReplayInfo(),\n      ...(request.id !== undefined ? { responseIds: [request.id] } : {}),\n    };\n  }\n  return {\n    replaySafeAfter401: MCP_REPLAY_SAFE_METHOD_SET.has(request.method),\n    batch: false,\n    responseIds: request.id !== undefined ? [request.id] : [],\n    method: request.method,\n    ...(request.id !== undefined ? { id: request.id } : {}),\n    ...(request.toolName ? { toolName: request.toolName } : {}),\n    ...(request.operationId ? { operationId: request.operationId } : {}),\n  };\n}\n\nfunction mcpTransportHttpMethod(input: string | URL | Request, init?: RequestInit): string {\n  try {\n    const method = init?.method ?? (input instanceof Request ? input.method : \"GET\");\n    return method.length > 0 ? method.toUpperCase() : \"GET\";\n  } catch {\n    return \"GET\";\n  }\n}\n\nasync function mcpTransportRpcMethod(\n  input: string | URL | Request,\n  init: RequestInit | undefined,\n  httpMethod: string,\n): Promise<string | undefined> {\n  if (httpMethod !== \"POST\") return undefined;\n  try {\n    return (await mcpRequestReplayInfo(input, init)).method;\n  } catch {\n    // Request diagnostics must never preempt or replace the transport call.\n    return undefined;\n  }\n}\n\nfunction finiteNumber(value: unknown): number | undefined {\n  return typeof value === \"number\" && Number.isFinite(value) ? value : undefined;\n}\n\nfunction mcpTransportFailureCauseDiagnostic(value: unknown): {\n  diagnostic: McpTransportFailureCauseDiagnostic;\n  complete: boolean;\n} {\n  if (value === null) {\n    return { diagnostic: Object.freeze({ kind: \"null\", value: null }), complete: true };\n  }\n  if (typeof value === \"string\") {\n    return { diagnostic: Object.freeze({ kind: \"string\", value }), complete: true };\n  }\n  if (typeof value === \"number\" && Number.isFinite(value)) {\n    return { diagnostic: Object.freeze({ kind: \"number\", value }), complete: true };\n  }\n  if (typeof value === \"boolean\") {\n    return { diagnostic: Object.freeze({ kind: \"boolean\", value }), complete: true };\n  }\n  if (!value || typeof value !== \"object\") {\n    return { diagnostic: Object.freeze({ kind: \"other\" }), complete: false };\n  }\n\n  const diagnostic: {\n    kind: \"error\" | \"object\";\n    name?: string;\n    message?: string;\n    code?: string | number;\n    status?: number;\n    statusCode?: number;\n  } = { kind: \"object\" };\n  try {\n    const record = value as Record<string, unknown>;\n    diagnostic.kind = value instanceof Error ? \"error\" : \"object\";\n    const name = record.name;\n    const message = record.message;\n    const code = record.code;\n    const rawStatus = record.status;\n    const rawStatusCode = record.statusCode;\n    if (typeof name === \"string\") diagnostic.name = name;\n    if (typeof message === \"string\") diagnostic.message = message;\n    if (typeof code === \"string\" || finiteNumber(code) !== undefined) {\n      diagnostic.code = code as string | number;\n    }\n    const status = finiteNumber(rawStatus);\n    const statusCode = finiteNumber(rawStatusCode);\n    if (status !== undefined) diagnostic.status = status;\n    if (statusCode !== undefined) diagnostic.statusCode = statusCode;\n    return { diagnostic: Object.freeze(diagnostic), complete: true };\n  } catch {\n    // The source error remains authoritative even when a hostile getter keeps\n    // one optional diagnostic field from being inspected.\n    return { diagnostic: Object.freeze(diagnostic), complete: false };\n  }\n}\n\nfunction snapshotMcpTransportFailureCauseChain(error: unknown): {\n  causeChain: readonly McpTransportFailureCauseDiagnostic[];\n  causeChainComplete: boolean;\n} {\n  const causeChain: McpTransportFailureCauseDiagnostic[] = [];\n  const seen = new WeakSet<object>();\n  let current: unknown = error;\n  let causeChainComplete = true;\n\n  for (let index = 0; index < MCP_TRANSPORT_FAILURE_CAUSE_MAX_NODES; index += 1) {\n    if (current && typeof current === \"object\" && seen.has(current)) {\n      causeChainComplete = false;\n      break;\n    }\n    const snapshot = mcpTransportFailureCauseDiagnostic(current);\n    causeChain.push(snapshot.diagnostic);\n    if (!snapshot.complete) causeChainComplete = false;\n    if (!current || typeof current !== \"object\") break;\n    seen.add(current);\n    try {\n      if (!(\"cause\" in current)) break;\n      const cause = (current as Record<string, unknown>).cause;\n      if (cause === undefined) break;\n      current = cause;\n    } catch {\n      causeChainComplete = false;\n      break;\n    }\n    if (index === MCP_TRANSPORT_FAILURE_CAUSE_MAX_NODES - 1) {\n      causeChainComplete = false;\n    }\n  }\n\n  return {\n    causeChain: Object.freeze(causeChain),\n    causeChainComplete,\n  };\n}\n\nfunction recordMcpTransportRequestFailure(\n  error: unknown,\n  request: { httpMethod: string; rpcMethod?: string },\n): void {\n  if (!error || typeof error !== \"object\") return;\n  try {\n    mcpTransportRequestFailures.set(\n      error,\n      Object.freeze({\n        httpMethod: request.httpMethod,\n        ...(request.rpcMethod ? { rpcMethod: request.rpcMethod } : {}),\n        ...snapshotMcpTransportFailureCauseChain(error),\n      }),\n    );\n  } catch {\n    // Diagnostics are out-of-band and must never replace the exact failure.\n  }\n}\n\n/**\n * Recover the request identity captured at the MCP transport boundary. SDK\n * layers may retain the source under a structural wrapper, so lookup follows a\n * bounded error graph without mutating or reclassifying any Error object.\n */\nexport function mcpTransportRequestFailureDiagnostic(\n  error: unknown,\n): McpTransportRequestFailureDiagnostic | null {\n  const pending: unknown[] = [error];\n  const seen = new WeakSet<object>();\n  let inspected = 0;\n\n  while (pending.length > 0 && inspected < MCP_TRANSPORT_FAILURE_LOOKUP_MAX_NODES) {\n    const current = pending.shift();\n    if (!current || typeof current !== \"object\" || seen.has(current)) continue;\n    seen.add(current);\n    inspected += 1;\n    const diagnostic = mcpTransportRequestFailures.get(current);\n    if (diagnostic) return diagnostic;\n    try {\n      const record = current as Record<string, unknown>;\n      for (const key of MCP_TRANSPORT_FAILURE_NESTED_KEYS) {\n        const nested = record[key];\n        if (nested && typeof nested === \"object\") pending.push(nested);\n      }\n      if (Array.isArray(record.errors)) pending.push(...record.errors.slice(0, 8));\n    } catch {\n      // A hostile wrapper cannot erase diagnostics attached to another node.\n    }\n  }\n  return null;\n}\n\nexport function mcpJsonRpcErrorPayloadForRequest(\n  request: McpRequestReplayInfo,\n  error: { code: number; message: string; data?: unknown },\n):\n  | {\n      jsonrpc: \"2.0\";\n      id: McpJsonRpcId;\n      error: { code: number; message: string; data?: unknown };\n    }\n  | Array<{\n      jsonrpc: \"2.0\";\n      id: McpJsonRpcId;\n      error: { code: number; message: string; data?: unknown };\n    }> {\n  const payload = (id: McpJsonRpcId) => ({ jsonrpc: \"2.0\" as const, id, error });\n  if (request.batch) {\n    const ids = request.responseIds.length > 0 ? request.responseIds : [null];\n    return ids.map(payload);\n  }\n  return payload(request.id ?? null);\n}\n\nexport class McpPayloadTooLargeError extends Error {\n  constructor(\n    readonly label: string,\n    readonly actualBytes: number,\n    readonly maxBytes: number,\n    readonly unit: \"byte\" | \"entry\" = \"byte\",\n  ) {\n    super(`${label} exceeds the ${maxBytes}-${unit} safety limit`);\n    this.name = \"McpPayloadTooLargeError\";\n  }\n}\n\nexport function mcpSerializedSizeBytes(value: unknown): number {\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(value) ?? \"null\";\n  } catch {\n    throw new Error(\"MCP payload is not JSON serializable\");\n  }\n  return Buffer.byteLength(serialized);\n}\n\nexport function assertMcpPayloadWithinBytes(value: unknown, maxBytes: number, label: string): void {\n  const actualBytes = mcpSerializedSizeBytes(value);\n  if (actualBytes > maxBytes) {\n    throw new McpPayloadTooLargeError(label, actualBytes, maxBytes);\n  }\n}\n\nexport function assertMcpToolListWithinBounds<T>(tools: readonly T[]): readonly T[] {\n  if (tools.length > MCP_MAX_TOOL_LIST_ENTRIES) {\n    throw new McpPayloadTooLargeError(\n      \"MCP tool list\",\n      tools.length,\n      MCP_MAX_TOOL_LIST_ENTRIES,\n      \"entry\",\n    );\n  }\n  for (const tool of tools) {\n    const toolBytes = mcpSerializedSizeBytes(tool);\n    if (toolBytes > MCP_MAX_TOOL_DEFINITION_BYTES) {\n      throw new McpPayloadTooLargeError(\n        \"MCP tool definition\",\n        toolBytes,\n        MCP_MAX_TOOL_DEFINITION_BYTES,\n      );\n    }\n  }\n  // Measure the complete JSON array, including brackets and separators. Summing\n  // definitions alone under-counts by one byte per separator plus the array\n  // delimiters and makes the advertised serialized-byte ceiling porous.\n  const totalBytes = mcpSerializedSizeBytes(tools);\n  if (totalBytes > MCP_MAX_TOOL_LIST_BYTES) {\n    throw new McpPayloadTooLargeError(\"MCP tool list\", totalBytes, MCP_MAX_TOOL_LIST_BYTES);\n  }\n  return tools;\n}\n\nexport function assertMcpServerSelectionWithinBounds<T>(servers: readonly T[]): readonly T[] {\n  if (servers.length > MCP_MAX_SELECTED_SERVERS) {\n    throw new McpPayloadTooLargeError(\n      \"selected MCP server count\",\n      servers.length,\n      MCP_MAX_SELECTED_SERVERS,\n      \"entry\",\n    );\n  }\n  return servers;\n}\n\nexport function mcpOuterConnectTimeoutMs(\n  configuredTimeouts: readonly (number | undefined)[],\n): number {\n  return Math.max(\n    MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS,\n    ...configuredTimeouts.flatMap((timeoutMs) => (timeoutMs === undefined ? [] : [timeoutMs])),\n  );\n}\n\ntype McpToolListContribution = {\n  entries: number;\n  bytes: number;\n};\n\n/**\n * Atomic aggregate accounting shared by every exposed tools/list in one run.\n * A repeated list for the same source REPLACES its prior contribution, so\n * cache invalidation/relisting cannot ratchet the budget upward. Failed\n * replacements leave the previous accounting intact.\n */\nexport class McpAggregateToolListBudget {\n  private readonly contributions = new Map<string, McpToolListContribution>();\n  private totalEntries = 0;\n  private totalBytes = 0;\n\n  constructor(\n    private readonly label = \"aggregate MCP tool list\",\n    private readonly maxEntries = MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES,\n    private readonly maxBytes = MCP_MAX_AGGREGATE_TOOL_LIST_BYTES,\n  ) {}\n\n  replace<T>(sourceId: string, tools: readonly T[]): readonly T[] {\n    assertMcpToolListWithinBounds(tools);\n    const contribution = {\n      entries: tools.length,\n      // Conservatively account each server as its complete serialized array.\n      // Summing these arrays slightly over-counts the brackets relative to one\n      // flattened array, which is intentional for a fail-closed hard ceiling.\n      bytes: mcpSerializedSizeBytes(tools),\n    };\n    const previous = this.contributions.get(sourceId) ?? { entries: 0, bytes: 0 };\n    const nextEntries = this.totalEntries - previous.entries + contribution.entries;\n    if (nextEntries > this.maxEntries) {\n      throw new McpPayloadTooLargeError(this.label, nextEntries, this.maxEntries, \"entry\");\n    }\n    const nextBytes = this.totalBytes - previous.bytes + contribution.bytes;\n    if (nextBytes > this.maxBytes) {\n      throw new McpPayloadTooLargeError(this.label, nextBytes, this.maxBytes);\n    }\n    this.contributions.set(sourceId, contribution);\n    this.totalEntries = nextEntries;\n    this.totalBytes = nextBytes;\n    return tools;\n  }\n\n  remove(sourceId: string): void {\n    const previous = this.contributions.get(sourceId);\n    if (!previous) return;\n    this.contributions.delete(sourceId);\n    this.totalEntries -= previous.entries;\n    this.totalBytes -= previous.bytes;\n  }\n\n  snapshot(): Readonly<McpToolListContribution> {\n    return { entries: this.totalEntries, bytes: this.totalBytes };\n  }\n}\n\n/** Stable-order parallel map with a hard in-flight ceiling and fail-stop drain. */\nexport async function boundedParallelMap<T, R>(\n  values: readonly T[],\n  concurrency: number,\n  mapper: (value: T, index: number) => Promise<R>,\n): Promise<R[]> {\n  if (!Number.isInteger(concurrency) || concurrency < 1) {\n    throw new Error(\"bounded parallel map concurrency must be a positive integer\");\n  }\n  if (values.length === 0) return [];\n\n  const results = new Array<R>(values.length);\n  const errors: Array<{ index: number; error: unknown }> = [];\n  let nextIndex = 0;\n  let stopped = false;\n  const worker = async () => {\n    while (!stopped) {\n      const index = nextIndex;\n      if (index >= values.length) return;\n      nextIndex += 1;\n      try {\n        results[index] = await mapper(values[index]!, index);\n      } catch (error) {\n        errors.push({ index, error });\n        stopped = true;\n      }\n    }\n  };\n  await Promise.all(Array.from({ length: Math.min(concurrency, values.length) }, () => worker()));\n  if (errors.length > 0) {\n    errors.sort((left, right) => left.index - right.index);\n    throw errors[0]!.error;\n  }\n  return results;\n}\n\n/**\n * Guard normal MCP traffic with the same deployment policy as OAuth traffic.\n * The pinned transport resolves and policy-checks the destination after the\n * caller has composed any credential headers, then performs the final network\n * call through the vetted Agent. It forces manual redirects, so an\n * Authorization-bearing request never follows a provider-controlled Location\n * to an unvalidated host.\n *\n * This module is deliberately agent-loop-free. API code imports the explicit\n * `@opengeni/runtime/mcp-network` leaf rather than the runtime root barrel.\n */\nexport function guardedMcpFetch<TInput extends string | URL | Request>(\n  settings: Pick<Settings, \"environment\" | \"integrationsAllowPrivateNetworkTargets\">,\n  fetchImpl: (input: TInput, init?: RequestInit) => Promise<Response>,\n  options: {\n    maxResponseBytes?: number;\n    dnsLookup?: DnsLookup;\n    pinResolvedDestination?: boolean;\n    requireHttpsOutsideLocalTest?: boolean;\n    usePinnedRequestTransport?: boolean;\n  } = {},\n): (input: TInput, init?: RequestInit) => Promise<Response> {\n  return async (input: TInput, init?: RequestInit) => {\n    const httpMethod = mcpTransportHttpMethod(input, init);\n    const rpcMethod = await mcpTransportRpcMethod(input, init, httpMethod);\n    const destinationOptions = {\n      ...(options.dnsLookup ? { dnsLookup: options.dnsLookup } : {}),\n      label: \"MCP endpoint\",\n      requireHttpsOutsideLocalTest: options.requireHttpsOutsideLocalTest ?? true,\n    };\n    let response: Response;\n    const observation = beginMcpPhase(\"network_headers\");\n    // RequestInit headers replace Request headers in Fetch; do not accidentally\n    // restore a credential the caller deliberately omitted from an override.\n    const headers = new Headers(\n      init?.headers ?? (input instanceof Request ? input.headers : undefined),\n    );\n    headers.delete(\"traceparent\");\n    headers.delete(\"tracestate\");\n    headers.delete(\"baggage\");\n    const parent = observation.traceContext && traceparent(observation.traceContext);\n    if (parent) headers.set(\"traceparent\", parent);\n    const tracedInit = { ...init, headers };\n    try {\n      if (options.pinResolvedDestination === false) {\n        await resolvePinnedDestination(input instanceof Request ? input.url : input, settings, {\n          ...destinationOptions,\n        });\n        response = await observation.run(() =>\n          fetchImpl(input, { ...tracedInit, redirect: \"manual\" }),\n        );\n      } else {\n        response = await observation.run(() =>\n          pinnedFetch(input, tracedInit, settings, {\n            ...(options.usePinnedRequestTransport ? {} : { fetchImpl: fetchImpl as FetchLike }),\n            ...destinationOptions,\n          }),\n        );\n      }\n      observation.end(response.ok ? \"completed\" : \"rejected\");\n    } catch (error) {\n      observation.end(\"failed\");\n      recordMcpTransportRequestFailure(error, {\n        httpMethod,\n        ...(rpcMethod ? { rpcMethod } : {}),\n      });\n      throw error;\n    }\n    return observation.run(() =>\n      boundMcpResponseBody(response, options.maxResponseBytes ?? MCP_MAX_RESPONSE_BYTES),\n    );\n  };\n}\n\nexport function boundMcpResponseBody(response: Response, maxBytes: number): Response {\n  const observation = beginMcpPhase(\"network_body\");\n  const declaredLength = Number(response.headers.get(\"content-length\"));\n  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {\n    observation.end(\"rejected\");\n    void response.body?.cancel().catch(() => undefined);\n    throw new McpPayloadTooLargeError(\"MCP response\", declaredLength, maxBytes);\n  }\n  if (!response.body) {\n    observation.end();\n    return response;\n  }\n\n  let reader: ReadableStreamDefaultReader<Uint8Array>;\n  try {\n    reader = response.body.getReader();\n  } catch (error) {\n    observation.end(\"failed\");\n    throw error;\n  }\n  let receivedBytes = 0;\n  const body = new ReadableStream<Uint8Array>({\n    async pull(controller) {\n      try {\n        const chunk = await reader.read();\n        if (chunk.done) {\n          observation.end();\n          controller.close();\n          return;\n        }\n        receivedBytes += chunk.value.byteLength;\n        if (receivedBytes > maxBytes) {\n          observation.end(\"rejected\");\n          await reader.cancel().catch(() => undefined);\n          controller.error(new McpPayloadTooLargeError(\"MCP response\", receivedBytes, maxBytes));\n          return;\n        }\n        controller.enqueue(chunk.value);\n      } catch (error) {\n        observation.end(\"failed\");\n        controller.error(error);\n      }\n    },\n    async cancel(reason) {\n      observation.end(\"cancelled\");\n      await reader.cancel(reason).catch(() => undefined);\n    },\n  });\n  const bounded = new Response(body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers: response.headers,\n  });\n  Object.defineProperties(bounded, {\n    redirected: { value: response.redirected },\n    type: { value: response.type },\n    url: { value: response.url },\n  });\n  return bounded;\n}\n\nexport async function cancelMcpResponseBody(response: Response): Promise<void> {\n  await response.body?.cancel().catch(() => undefined);\n}\n\n/** Read and rebuild an inbound MCP request before the SDK parses it. */\nexport async function boundedMcpRequest(\n  request: Request,\n  maxBytes = MCP_MAX_INBOUND_REQUEST_BYTES,\n): Promise<Request> {\n  const declared = request.headers.get(\"content-length\");\n  if (declared !== null) {\n    const normalized = declared.trim();\n    if (!/^\\d+$/.test(normalized)) {\n      await request.body?.cancel().catch(() => undefined);\n      throw new McpPayloadTooLargeError(\"MCP request\", 0, maxBytes);\n    }\n    const declaredBytes = Number(normalized);\n    if (!Number.isSafeInteger(declaredBytes) || declaredBytes > maxBytes) {\n      await request.body?.cancel().catch(() => undefined);\n      throw new McpPayloadTooLargeError(\"MCP request\", declaredBytes, maxBytes);\n    }\n  }\n  if (!request.body) {\n    return request;\n  }\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let receivedBytes = 0;\n  try {\n    for (;;) {\n      const result = await reader.read();\n      if (result.done) break;\n      receivedBytes += result.value.byteLength;\n      if (receivedBytes > maxBytes) {\n        await reader.cancel().catch(() => undefined);\n        throw new McpPayloadTooLargeError(\"MCP request\", receivedBytes, maxBytes);\n      }\n      chunks.push(result.value);\n    }\n  } catch (error) {\n    await reader.cancel().catch(() => undefined);\n    throw error;\n  } finally {\n    reader.releaseLock();\n  }\n  const body = new Uint8Array(receivedBytes);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return new Request(request, { body, headers: request.headers });\n}\n\nexport async function assertMcpDestinationAllowed(\n  rawUrl: string,\n  settings: Pick<Settings, \"environment\" | \"integrationsAllowPrivateNetworkTargets\">,\n  options: { dnsLookup?: DnsLookup } = {},\n): Promise<void> {\n  await resolvePinnedDestination(rawUrl, settings, {\n    ...(options.dnsLookup ? { dnsLookup: options.dnsLookup } : {}),\n    label: \"MCP endpoint\",\n    requireHttpsOutsideLocalTest: true,\n  });\n}\n\nexport const isNonPublicMcpAddress = isNonPublicAddress;\n"],"mappings":";AAAA,SAAS,eAAe,mBAAmB;AAE3C,SAAS,8BAA8B,oCAAoC;AAC3E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAEP,SAAS,mBAAmB;AAErB,IAAM,yBAAyB,IAAI,OAAO;AAK1C,IAAM,gCAAgC,+BAA+B,KAAK;AAG1E,IAAM,gCAAgC,MAAM;AAC5C,IAAM,0BAA0B,IAAI,OAAO;AAC3C,IAAM,sCAAsC;AAI5C,IAAM,4BAA4B;AAClC,IAAM,4BAA4B,OAAO;AACzC,IAAM,uCAAuC,gCAAgC,KAAK;AAClF,IAAM,2BAA2B;AACjC,IAAM,uCAAuC;AAI7C,IAAM,uCAAuC;AAC7C,IAAM,oCAAoC,KAAK,OAAO;AAEtD,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AACF;AAwCA,IAAM,6BAA6B,IAAI,IAAY,uBAAuB;AAC1E,IAAM,wCAAwC;AAC9C,IAAM,yCAAyC;AAC/C,IAAM,oCAAoC,CAAC,SAAS,SAAS,YAAY,MAAM;AAC/E,IAAM,8BAA8B,oBAAI,QAAsD;AAE9F,SAAS,aAAa,OAAkD;AACtE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,0BAA0B,OAA6C;AAC9E,MAAI,CAAC,aAAa,KAAK,GAAG;AACxB,WAAO,EAAE,OAAO,MAAM;AAAA,EACxB;AACA,QAAM,QAAQ,OAAO,UAAU,eAAe,KAAK,OAAO,IAAI;AAC9D,QAAM,KACJ,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,OAAO,YAAY,MAAM,OAAO,OACzE,MAAM,KACN;AACN,QAAM,UAAU,CAAC,SAAS,OAAO;AACjC,QAAM,SACJ,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,SAAS,IAAI,MAAM,SAAS;AAC/E,QAAM,QAAQ,MAAM,YAAY,SAAS,WAAW,UAAa;AACjE,QAAM,SAAS,aAAa,MAAM,MAAM,IAAI,MAAM,SAAS;AAC3D,QAAM,WACJ,SAAS,WAAW,gBAAgB,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO;AACvF,QAAM,OACJ,SAAS,WAAW,gBAAgB,aAAa,QAAQ,KAAK,IAAI,OAAO,QAAQ;AACnF,QAAM,cACJ,QAAQ,OAAO,KAAK,wBAAwB,YAAY,KAAK,oBAAoB,SAAS,IACtF,KAAK,sBACL;AACN,SAAO;AAAA,IACL;AAAA,IACA,GAAI,SAAS,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IACpC,GAAI,SAAS,OAAO,SAAY,EAAE,GAAG,IAAI,CAAC;AAAA,IAC1C,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/B,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,EACvC;AACF;AAEA,SAAS,4BAA4B,QAAQ,OAA6B;AACxE,SAAO;AAAA,IACL,oBAAoB;AAAA,IACpB;AAAA,IACA,aAAa,CAAC;AAAA,EAChB;AACF;AAQA,eAAsB,qBACpB,OACA,MAC+B;AAC/B,MAAI,OAAsB;AAC1B,MAAI,OAAO,MAAM,SAAS,UAAU;AAClC,WAAO,KAAK;AAAA,EACd,WAAW,MAAM,SAAS,UAAa,KAAK,SAAS,MAAM;AACzD,WAAO,4BAA4B;AAAA,EACrC,WAAW,iBAAiB,YAAY,MAAM,UAAU,MAAM,QAAQ,YAAY,MAAM,QAAQ;AAC9F,WAAO,MAAM,MACV,MAAM,EACN,KAAK,EACL,MAAM,MAAM,IAAI;AAAA,EACrB;AACA,MAAI,CAAC,MAAM;AACT,WAAO,4BAA4B;AAAA,EACrC;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,WAAO,4BAA4B;AAAA,EACrC;AAEA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,QAAI,OAAO,WAAW,GAAG;AACvB,aAAO,4BAA4B,IAAI;AAAA,IACzC;AACA,UAAM,WAAW,OAAO,IAAI,yBAAyB;AACrD,UAAM,QAAQ,SAAS,MAAM,CAACA,aAAYA,SAAQ,KAAK;AACvD,UAAM,cAAc,SAAS;AAAA,MAAQ,CAACA,aACpCA,SAAQ,OAAO,SAAY,CAACA,SAAQ,EAAE,IAAI,CAAC;AAAA,IAC7C;AACA,UAAM,WAAW,SAAS,KAAK,CAACA,aAAYA,SAAQ,QAAQ,GAAG;AAC/D,WAAO;AAAA,MACL,oBACE,SACA,SAAS;AAAA,QACP,CAACA,aACCA,SAAQ,WAAW,UAAa,2BAA2B,IAAIA,SAAQ,MAAM;AAAA,MACjF;AAAA,MACF,OAAO;AAAA,MACP;AAAA,MACA,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,IACjC;AAAA,EACF;AAEA,QAAM,UAAU,0BAA0B,MAAM;AAChD,MAAI,CAAC,QAAQ,SAAS,QAAQ,WAAW,QAAW;AAClD,WAAO;AAAA,MACL,GAAG,4BAA4B;AAAA,MAC/B,GAAI,QAAQ,OAAO,SAAY,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AAAA,IACL,oBAAoB,2BAA2B,IAAI,QAAQ,MAAM;AAAA,IACjE,OAAO;AAAA,IACP,aAAa,QAAQ,OAAO,SAAY,CAAC,QAAQ,EAAE,IAAI,CAAC;AAAA,IACxD,QAAQ,QAAQ;AAAA,IAChB,GAAI,QAAQ,OAAO,SAAY,EAAE,IAAI,QAAQ,GAAG,IAAI,CAAC;AAAA,IACrD,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EACpE;AACF;AAEA,SAAS,uBAAuB,OAA+B,MAA4B;AACzF,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,iBAAiB,UAAU,MAAM,SAAS;AAC1E,WAAO,OAAO,SAAS,IAAI,OAAO,YAAY,IAAI;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,sBACb,OACA,MACA,YAC6B;AAC7B,MAAI,eAAe,OAAQ,QAAO;AAClC,MAAI;AACF,YAAQ,MAAM,qBAAqB,OAAO,IAAI,GAAG;AAAA,EACnD,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,OAAoC;AACxD,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE;AAEA,SAAS,mCAAmC,OAG1C;AACA,MAAI,UAAU,MAAM;AAClB,WAAO,EAAE,YAAY,OAAO,OAAO,EAAE,MAAM,QAAQ,OAAO,KAAK,CAAC,GAAG,UAAU,KAAK;AAAA,EACpF;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,YAAY,OAAO,OAAO,EAAE,MAAM,UAAU,MAAM,CAAC,GAAG,UAAU,KAAK;AAAA,EAChF;AACA,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AACvD,WAAO,EAAE,YAAY,OAAO,OAAO,EAAE,MAAM,UAAU,MAAM,CAAC,GAAG,UAAU,KAAK;AAAA,EAChF;AACA,MAAI,OAAO,UAAU,WAAW;AAC9B,WAAO,EAAE,YAAY,OAAO,OAAO,EAAE,MAAM,WAAW,MAAM,CAAC,GAAG,UAAU,KAAK;AAAA,EACjF;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO,EAAE,YAAY,OAAO,OAAO,EAAE,MAAM,QAAQ,CAAC,GAAG,UAAU,MAAM;AAAA,EACzE;AAEA,QAAM,aAOF,EAAE,MAAM,SAAS;AACrB,MAAI;AACF,UAAM,SAAS;AACf,eAAW,OAAO,iBAAiB,QAAQ,UAAU;AACrD,UAAM,OAAO,OAAO;AACpB,UAAM,UAAU,OAAO;AACvB,UAAM,OAAO,OAAO;AACpB,UAAM,YAAY,OAAO;AACzB,UAAM,gBAAgB,OAAO;AAC7B,QAAI,OAAO,SAAS,SAAU,YAAW,OAAO;AAChD,QAAI,OAAO,YAAY,SAAU,YAAW,UAAU;AACtD,QAAI,OAAO,SAAS,YAAY,aAAa,IAAI,MAAM,QAAW;AAChE,iBAAW,OAAO;AAAA,IACpB;AACA,UAAM,SAAS,aAAa,SAAS;AACrC,UAAM,aAAa,aAAa,aAAa;AAC7C,QAAI,WAAW,OAAW,YAAW,SAAS;AAC9C,QAAI,eAAe,OAAW,YAAW,aAAa;AACtD,WAAO,EAAE,YAAY,OAAO,OAAO,UAAU,GAAG,UAAU,KAAK;AAAA,EACjE,QAAQ;AAGN,WAAO,EAAE,YAAY,OAAO,OAAO,UAAU,GAAG,UAAU,MAAM;AAAA,EAClE;AACF;AAEA,SAAS,sCAAsC,OAG7C;AACA,QAAM,aAAmD,CAAC;AAC1D,QAAM,OAAO,oBAAI,QAAgB;AACjC,MAAI,UAAmB;AACvB,MAAI,qBAAqB;AAEzB,WAAS,QAAQ,GAAG,QAAQ,uCAAuC,SAAS,GAAG;AAC7E,QAAI,WAAW,OAAO,YAAY,YAAY,KAAK,IAAI,OAAO,GAAG;AAC/D,2BAAqB;AACrB;AAAA,IACF;AACA,UAAM,WAAW,mCAAmC,OAAO;AAC3D,eAAW,KAAK,SAAS,UAAU;AACnC,QAAI,CAAC,SAAS,SAAU,sBAAqB;AAC7C,QAAI,CAAC,WAAW,OAAO,YAAY,SAAU;AAC7C,SAAK,IAAI,OAAO;AAChB,QAAI;AACF,UAAI,EAAE,WAAW,SAAU;AAC3B,YAAM,QAAS,QAAoC;AACnD,UAAI,UAAU,OAAW;AACzB,gBAAU;AAAA,IACZ,QAAQ;AACN,2BAAqB;AACrB;AAAA,IACF;AACA,QAAI,UAAU,wCAAwC,GAAG;AACvD,2BAAqB;AAAA,IACvB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,YAAY,OAAO,OAAO,UAAU;AAAA,IACpC;AAAA,EACF;AACF;AAEA,SAAS,iCACP,OACA,SACM;AACN,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,MAAI;AACF,gCAA4B;AAAA,MAC1B;AAAA,MACA,OAAO,OAAO;AAAA,QACZ,YAAY,QAAQ;AAAA,QACpB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,QAC5D,GAAG,sCAAsC,KAAK;AAAA,MAChD,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAOO,SAAS,qCACd,OAC6C;AAC7C,QAAM,UAAqB,CAAC,KAAK;AACjC,QAAM,OAAO,oBAAI,QAAgB;AACjC,MAAI,YAAY;AAEhB,SAAO,QAAQ,SAAS,KAAK,YAAY,wCAAwC;AAC/E,UAAM,UAAU,QAAQ,MAAM;AAC9B,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,KAAK,IAAI,OAAO,EAAG;AAClE,SAAK,IAAI,OAAO;AAChB,iBAAa;AACb,UAAM,aAAa,4BAA4B,IAAI,OAAO;AAC1D,QAAI,WAAY,QAAO;AACvB,QAAI;AACF,YAAM,SAAS;AACf,iBAAW,OAAO,mCAAmC;AACnD,cAAM,SAAS,OAAO,GAAG;AACzB,YAAI,UAAU,OAAO,WAAW,SAAU,SAAQ,KAAK,MAAM;AAAA,MAC/D;AACA,UAAI,MAAM,QAAQ,OAAO,MAAM,EAAG,SAAQ,KAAK,GAAG,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC;AAAA,IAC7E,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,iCACd,SACA,OAWK;AACL,QAAM,UAAU,CAAC,QAAsB,EAAE,SAAS,OAAgB,IAAI,MAAM;AAC5E,MAAI,QAAQ,OAAO;AACjB,UAAM,MAAM,QAAQ,YAAY,SAAS,IAAI,QAAQ,cAAc,CAAC,IAAI;AACxE,WAAO,IAAI,IAAI,OAAO;AAAA,EACxB;AACA,SAAO,QAAQ,QAAQ,MAAM,IAAI;AACnC;AAEO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YACW,OACA,aACA,UACA,OAAyB,QAClC;AACA,UAAM,GAAG,KAAK,gBAAgB,QAAQ,IAAI,IAAI,eAAe;AALpD;AACA;AACA;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,uBAAuB,OAAwB;AAC7D,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,UAAU,KAAK,KAAK;AAAA,EACxC,QAAQ;AACN,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,SAAO,OAAO,WAAW,UAAU;AACrC;AAEO,SAAS,4BAA4B,OAAgB,UAAkB,OAAqB;AACjG,QAAM,cAAc,uBAAuB,KAAK;AAChD,MAAI,cAAc,UAAU;AAC1B,UAAM,IAAI,wBAAwB,OAAO,aAAa,QAAQ;AAAA,EAChE;AACF;AAEO,SAAS,8BAAiC,OAAmC;AAClF,MAAI,MAAM,SAAS,2BAA2B;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,aAAW,QAAQ,OAAO;AACxB,UAAM,YAAY,uBAAuB,IAAI;AAC7C,QAAI,YAAY,+BAA+B;AAC7C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAIA,QAAM,aAAa,uBAAuB,KAAK;AAC/C,MAAI,aAAa,yBAAyB;AACxC,UAAM,IAAI,wBAAwB,iBAAiB,YAAY,uBAAuB;AAAA,EACxF;AACA,SAAO;AACT;AAEO,SAAS,qCAAwC,SAAqC;AAC3F,MAAI,QAAQ,SAAS,0BAA0B;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,yBACd,oBACQ;AACR,SAAO,KAAK;AAAA,IACV;AAAA,IACA,GAAG,mBAAmB,QAAQ,CAAC,cAAe,cAAc,SAAY,CAAC,IAAI,CAAC,SAAS,CAAE;AAAA,EAC3F;AACF;AAaO,IAAM,6BAAN,MAAiC;AAAA,EAKtC,YACmB,QAAQ,2BACR,aAAa,qCACb,WAAW,mCAC5B;AAHiB;AACA;AACA;AAAA,EAChB;AAAA,EARc,gBAAgB,oBAAI,IAAqC;AAAA,EAClE,eAAe;AAAA,EACf,aAAa;AAAA,EAQrB,QAAW,UAAkB,OAAmC;AAC9D,kCAA8B,KAAK;AACnC,UAAM,eAAe;AAAA,MACnB,SAAS,MAAM;AAAA;AAAA;AAAA;AAAA,MAIf,OAAO,uBAAuB,KAAK;AAAA,IACrC;AACA,UAAM,WAAW,KAAK,cAAc,IAAI,QAAQ,KAAK,EAAE,SAAS,GAAG,OAAO,EAAE;AAC5E,UAAM,cAAc,KAAK,eAAe,SAAS,UAAU,aAAa;AACxE,QAAI,cAAc,KAAK,YAAY;AACjC,YAAM,IAAI,wBAAwB,KAAK,OAAO,aAAa,KAAK,YAAY,OAAO;AAAA,IACrF;AACA,UAAM,YAAY,KAAK,aAAa,SAAS,QAAQ,aAAa;AAClE,QAAI,YAAY,KAAK,UAAU;AAC7B,YAAM,IAAI,wBAAwB,KAAK,OAAO,WAAW,KAAK,QAAQ;AAAA,IACxE;AACA,SAAK,cAAc,IAAI,UAAU,YAAY;AAC7C,SAAK,eAAe;AACpB,SAAK,aAAa;AAClB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,UAAwB;AAC7B,UAAM,WAAW,KAAK,cAAc,IAAI,QAAQ;AAChD,QAAI,CAAC,SAAU;AACf,SAAK,cAAc,OAAO,QAAQ;AAClC,SAAK,gBAAgB,SAAS;AAC9B,SAAK,cAAc,SAAS;AAAA,EAC9B;AAAA,EAEA,WAA8C;AAC5C,WAAO,EAAE,SAAS,KAAK,cAAc,OAAO,KAAK,WAAW;AAAA,EAC9D;AACF;AAGA,eAAsB,mBACpB,QACA,aACA,QACc;AACd,MAAI,CAAC,OAAO,UAAU,WAAW,KAAK,cAAc,GAAG;AACrD,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AAEjC,QAAM,UAAU,IAAI,MAAS,OAAO,MAAM;AAC1C,QAAM,SAAmD,CAAC;AAC1D,MAAI,YAAY;AAChB,MAAI,UAAU;AACd,QAAM,SAAS,YAAY;AACzB,WAAO,CAAC,SAAS;AACf,YAAM,QAAQ;AACd,UAAI,SAAS,OAAO,OAAQ;AAC5B,mBAAa;AACb,UAAI;AACF,gBAAQ,KAAK,IAAI,MAAM,OAAO,OAAO,KAAK,GAAI,KAAK;AAAA,MACrD,SAAS,OAAO;AACd,eAAO,KAAK,EAAE,OAAO,MAAM,CAAC;AAC5B,kBAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,aAAa,OAAO,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;AAC9F,MAAI,OAAO,SAAS,GAAG;AACrB,WAAO,KAAK,CAAC,MAAM,UAAU,KAAK,QAAQ,MAAM,KAAK;AACrD,UAAM,OAAO,CAAC,EAAG;AAAA,EACnB;AACA,SAAO;AACT;AAaO,SAAS,gBACd,UACA,WACA,UAMI,CAAC,GACqD;AAC1D,SAAO,OAAO,OAAe,SAAuB;AAClD,UAAM,aAAa,uBAAuB,OAAO,IAAI;AACrD,UAAM,YAAY,MAAM,sBAAsB,OAAO,MAAM,UAAU;AACrE,UAAM,qBAAqB;AAAA,MACzB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5D,OAAO;AAAA,MACP,8BAA8B,QAAQ,gCAAgC;AAAA,IACxE;AACA,QAAI;AACJ,UAAM,cAAc,cAAc,iBAAiB;AAGnD,UAAM,UAAU,IAAI;AAAA,MAClB,MAAM,YAAY,iBAAiB,UAAU,MAAM,UAAU;AAAA,IAC/D;AACA,YAAQ,OAAO,aAAa;AAC5B,YAAQ,OAAO,YAAY;AAC3B,YAAQ,OAAO,SAAS;AACxB,UAAM,SAAS,YAAY,gBAAgB,YAAY,YAAY,YAAY;AAC/E,QAAI,OAAQ,SAAQ,IAAI,eAAe,MAAM;AAC7C,UAAM,aAAa,EAAE,GAAG,MAAM,QAAQ;AACtC,QAAI;AACF,UAAI,QAAQ,2BAA2B,OAAO;AAC5C,cAAM,yBAAyB,iBAAiB,UAAU,MAAM,MAAM,OAAO,UAAU;AAAA,UACrF,GAAG;AAAA,QACL,CAAC;AACD,mBAAW,MAAM,YAAY;AAAA,UAAI,MAC/B,UAAU,OAAO,EAAE,GAAG,YAAY,UAAU,SAAS,CAAC;AAAA,QACxD;AAAA,MACF,OAAO;AACL,mBAAW,MAAM,YAAY;AAAA,UAAI,MAC/B,YAAY,OAAO,YAAY,UAAU;AAAA,YACvC,GAAI,QAAQ,4BAA4B,CAAC,IAAI,EAAE,UAAkC;AAAA,YACjF,GAAG;AAAA,UACL,CAAC;AAAA,QACH;AAAA,MACF;AACA,kBAAY,IAAI,SAAS,KAAK,cAAc,UAAU;AAAA,IACxD,SAAS,OAAO;AACd,kBAAY,IAAI,QAAQ;AACxB,uCAAiC,OAAO;AAAA,QACtC;AAAA,QACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACnC,CAAC;AACD,YAAM;AAAA,IACR;AACA,WAAO,YAAY;AAAA,MAAI,MACrB,qBAAqB,UAAU,QAAQ,oBAAoB,sBAAsB;AAAA,IACnF;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,UAAoB,UAA4B;AACnF,QAAM,cAAc,cAAc,cAAc;AAChD,QAAM,iBAAiB,OAAO,SAAS,QAAQ,IAAI,gBAAgB,CAAC;AACpE,MAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,UAAU;AAChE,gBAAY,IAAI,UAAU;AAC1B,SAAK,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAClD,UAAM,IAAI,wBAAwB,gBAAgB,gBAAgB,QAAQ;AAAA,EAC5E;AACA,MAAI,CAAC,SAAS,MAAM;AAClB,gBAAY,IAAI;AAChB,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,SAAS,KAAK,UAAU;AAAA,EACnC,SAAS,OAAO;AACd,gBAAY,IAAI,QAAQ;AACxB,UAAM;AAAA,EACR;AACA,MAAI,gBAAgB;AACpB,QAAM,OAAO,IAAI,eAA2B;AAAA,IAC1C,MAAM,KAAK,YAAY;AACrB,UAAI;AACF,cAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,YAAI,MAAM,MAAM;AACd,sBAAY,IAAI;AAChB,qBAAW,MAAM;AACjB;AAAA,QACF;AACA,yBAAiB,MAAM,MAAM;AAC7B,YAAI,gBAAgB,UAAU;AAC5B,sBAAY,IAAI,UAAU;AAC1B,gBAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,qBAAW,MAAM,IAAI,wBAAwB,gBAAgB,eAAe,QAAQ,CAAC;AACrF;AAAA,QACF;AACA,mBAAW,QAAQ,MAAM,KAAK;AAAA,MAChC,SAAS,OAAO;AACd,oBAAY,IAAI,QAAQ;AACxB,mBAAW,MAAM,KAAK;AAAA,MACxB;AAAA,IACF;AAAA,IACA,MAAM,OAAO,QAAQ;AACnB,kBAAY,IAAI,WAAW;AAC3B,YAAM,OAAO,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,IACnD;AAAA,EACF,CAAC;AACD,QAAM,UAAU,IAAI,SAAS,MAAM;AAAA,IACjC,QAAQ,SAAS;AAAA,IACjB,YAAY,SAAS;AAAA,IACrB,SAAS,SAAS;AAAA,EACpB,CAAC;AACD,SAAO,iBAAiB,SAAS;AAAA,IAC/B,YAAY,EAAE,OAAO,SAAS,WAAW;AAAA,IACzC,MAAM,EAAE,OAAO,SAAS,KAAK;AAAA,IAC7B,KAAK,EAAE,OAAO,SAAS,IAAI;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AACrD;AAGA,eAAsB,kBACpB,SACA,WAAW,+BACO;AAClB,QAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB;AACrD,MAAI,aAAa,MAAM;AACrB,UAAM,aAAa,SAAS,KAAK;AACjC,QAAI,CAAC,QAAQ,KAAK,UAAU,GAAG;AAC7B,YAAM,QAAQ,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAClD,YAAM,IAAI,wBAAwB,eAAe,GAAG,QAAQ;AAAA,IAC9D;AACA,UAAM,gBAAgB,OAAO,UAAU;AACvC,QAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,UAAU;AACpE,YAAM,QAAQ,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAClD,YAAM,IAAI,wBAAwB,eAAe,eAAe,QAAQ;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,MAAM;AACjB,WAAO;AAAA,EACT;AACA,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,QAAM,SAAuB,CAAC;AAC9B,MAAI,gBAAgB;AACpB,MAAI;AACF,eAAS;AACP,YAAM,SAAS,MAAM,OAAO,KAAK;AACjC,UAAI,OAAO,KAAM;AACjB,uBAAiB,OAAO,MAAM;AAC9B,UAAI,gBAAgB,UAAU;AAC5B,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,cAAM,IAAI,wBAAwB,eAAe,eAAe,QAAQ;AAAA,MAC1E;AACA,aAAO,KAAK,OAAO,KAAK;AAAA,IAC1B;AAAA,EACF,SAAS,OAAO;AACd,UAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,UAAM;AAAA,EACR,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,WAAW,aAAa;AACzC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO,IAAI,QAAQ,SAAS,EAAE,MAAM,SAAS,QAAQ,QAAQ,CAAC;AAChE;AAEA,eAAsB,4BACpB,QACA,UACA,UAAqC,CAAC,GACvB;AACf,QAAM,yBAAyB,QAAQ,UAAU;AAAA,IAC/C,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,IAC5D,OAAO;AAAA,IACP,8BAA8B;AAAA,EAChC,CAAC;AACH;AAEO,IAAM,wBAAwB;","names":["request"]}