@opengeni/sdk 3.3.2-canary.1 → 3.4.0

package/dist/chunk-QGEIL4TR.js

@@ -0,0 +1,195 @@
+// src/tool-auth.ts
+var TOOL_TOKEN_ISSUER = "opengeni-session-proxy";
+var TOOL_TOKEN_KEY_LABEL = "opengeni-tool-token:v1";
+var TOOL_TOKEN_DEFAULT_TTL_SECONDS = 24 * 60 * 60;
+var MAX_TTL_SECONDS = 7 * 24 * 60 * 60;
+var MAX_HEADER_VALUE_LENGTH = 4096;
+var TOOL_SERVER_URL_ENV = "OPENGENI_TOOL_SERVER_URL";
+var CLOCK_SKEW_SECONDS = 60;
+var ToolRequestError = class extends Error {
+  constructor(code) {
+    super("Tool request is not authorized.");
+    this.code = code;
+    this.name = "ToolRequestError";
+  }
+  status = 401;
+  /** A ready 401 response with a `WWW-Authenticate: Bearer` challenge. */
+  toResponse() {
+    return new Response(JSON.stringify({ error: { code: this.code, message: this.message } }), {
+      status: 401,
+      headers: {
+        "Content-Type": "application/json; charset=utf-8",
+        "WWW-Authenticate": 'Bearer error="invalid_token"'
+      }
+    });
+  }
+};
+async function verifyToolRequest(request, options = {}) {
+  const key = await signingKey(resolveToolTokenSecret(options.secret));
+  const audience = options.audience ?? environment(TOOL_SERVER_URL_ENV);
+  if (!audience) {
+    throw new TypeError(
+      `verifyToolRequest needs the tool server URL: pass { audience } or set ${TOOL_SERVER_URL_ENV}.`
+    );
+  }
+  const authorization = requestAuthorization(request);
+  const match = /^Bearer[ ]+([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$/i.exec(
+    authorization?.trim() ?? ""
+  );
+  if (!match) throw new ToolRequestError("token_missing");
+  const [header, payload, signature] = match[1].split(".");
+  let protectedHeader;
+  let claims;
+  let signatureBytes;
+  try {
+    signatureBytes = base64UrlDecode(signature);
+    protectedHeader = JSON.parse(utf8(base64UrlDecode(header)));
+    claims = JSON.parse(utf8(base64UrlDecode(payload)));
+  } catch {
+    throw new ToolRequestError("token_malformed");
+  }
+  if (!protectedHeader || typeof protectedHeader !== "object" || protectedHeader.alg !== "HS256" || !claims || typeof claims !== "object" || Array.isArray(claims)) {
+    throw new ToolRequestError("token_malformed");
+  }
+  const valid = await crypto.subtle.verify(
+    "HMAC",
+    key,
+    signatureBytes,
+    new TextEncoder().encode(`${header}.${payload}`)
+  );
+  if (!valid) throw new ToolRequestError("token_invalid");
+  const now = Math.floor(Date.now() / 1e3);
+  const { iss, aud, sub, exp, iat, workspace_id, source, tenant } = claims;
+  if (iss !== TOOL_TOKEN_ISSUER) throw new ToolRequestError("token_invalid");
+  if (typeof exp !== "number" || exp <= now) throw new ToolRequestError("token_expired");
+  if (typeof iat !== "number" || iat > now + CLOCK_SKEW_SECONDS) {
+    throw new ToolRequestError("token_invalid");
+  }
+  if (aud !== audience) {
+    throw new ToolRequestError("token_audience");
+  }
+  if (typeof sub !== "string" || !sub || typeof workspace_id !== "string" || !workspace_id || typeof source !== "string" || tenant !== void 0 && typeof tenant !== "string") {
+    throw new ToolRequestError("token_invalid");
+  }
+  return {
+    user: sub,
+    ...tenant !== void 0 ? { tenant } : {},
+    workspaceId: workspace_id,
+    source,
+    expiresAt: new Date(exp * 1e3)
+  };
+}
+async function mintToolToken(input) {
+  const ttl = input.ttlSeconds ?? TOOL_TOKEN_DEFAULT_TTL_SECONDS;
+  if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > MAX_TTL_SECONDS) {
+    throw new TypeError(`ttlSeconds must be an integer from 1 to ${MAX_TTL_SECONDS}.`);
+  }
+  const key = await signingKey(resolveToolTokenSecret(input.secret));
+  const now = Math.floor(Date.now() / 1e3);
+  const header = base64UrlJson({ alg: "HS256", typ: "JWT" });
+  const payload = base64UrlJson({
+    iss: TOOL_TOKEN_ISSUER,
+    aud: input.audience,
+    sub: input.user,
+    workspace_id: input.workspaceId,
+    source: input.source,
+    ...input.tenant !== void 0 ? { tenant: input.tenant } : {},
+    iat: now,
+    exp: now + ttl
+  });
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    new TextEncoder().encode(`${header}.${payload}`)
+  );
+  const token = `${header}.${payload}.${base64UrlEncode(new Uint8Array(signature))}`;
+  if (`Bearer ${token}`.length > MAX_HEADER_VALUE_LENGTH) {
+    throw new TypeError(
+      `Tool token exceeds Opengeni's ${MAX_HEADER_VALUE_LENGTH}-character header limit; shorten the user, tenant, or URL.`
+    );
+  }
+  return token;
+}
+async function deriveToolTokenKey(secret) {
+  return [...await derivedKeyBytes(resolveToolTokenSecret(secret))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function resolveToolTokenSecret(secret) {
+  const resolved = secret ?? environment("OPENGENI_API_KEY");
+  if (!resolved) {
+    throw new TypeError(
+      "Tool tokens need a signing secret: set OPENGENI_API_KEY, or pass the same `secret` to the session proxy's toolServer and verifyToolRequest."
+    );
+  }
+  return resolved;
+}
+function environment(name) {
+  return globalThis.process?.env?.[name] || void 0;
+}
+async function derivedKeyBytes(secret) {
+  const root = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return new Uint8Array(
+    await crypto.subtle.sign("HMAC", root, new TextEncoder().encode(TOOL_TOKEN_KEY_LABEL))
+  );
+}
+var keys = /* @__PURE__ */ new Map();
+function signingKey(secret) {
+  let key = keys.get(secret);
+  if (!key) {
+    key = (async () => await crypto.subtle.importKey(
+      "raw",
+      await derivedKeyBytes(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign", "verify"]
+    ))();
+    key.catch(() => keys.delete(secret));
+    if (keys.size >= 16) keys.delete(keys.keys().next().value);
+    keys.set(secret, key);
+  }
+  return key;
+}
+function requestAuthorization(request) {
+  if (typeof Request !== "undefined" && request instanceof Request) {
+    return request.headers.get("authorization") ?? void 0;
+  }
+  const headers = request.headers;
+  const raw = headers && typeof headers.get === "function" ? headers.get("authorization") ?? void 0 : headers?.authorization;
+  return Array.isArray(raw) ? void 0 : raw;
+}
+function base64UrlJson(value) {
+  return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
+}
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  return bytes;
+}
+function utf8(bytes) {
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+
+export {
+  TOOL_TOKEN_ISSUER,
+  TOOL_TOKEN_KEY_LABEL,
+  TOOL_TOKEN_DEFAULT_TTL_SECONDS,
+  TOOL_SERVER_URL_ENV,
+  ToolRequestError,
+  verifyToolRequest,
+  mintToolToken,
+  deriveToolTokenKey,
+  resolveToolTokenSecret
+};
+//# sourceMappingURL=chunk-QGEIL4TR.js.map

package/dist/chunk-QGEIL4TR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tool-auth.ts"],"sourcesContent":["/**\n * Per-user credentials for a product's own MCP tool server.\n *\n * `createSessionProxyHandler({ toolServer })` mints a short-lived token for the\n * user its `resolve` hook authenticated, attaches it to each session it creates,\n * and refreshes it on every message, approval, and answer. The product's MCP\n * endpoint calls {@link verifyToolRequest} on every request and scopes all data\n * access to the returned identity, never to ids the model supplied.\n *\n * Wire format (for non-Node verifiers): an HS256 JWT in `Authorization: Bearer`,\n * signed with the hex key from {@link deriveToolTokenKey} (`HMAC-SHA256(key =\n * secret, message = \"opengeni-tool-token:v1\")`, where `secret` is\n * `OPENGENI_API_KEY` unless configured). Give a non-Node verifier that derived\n * key, never the organization key. Claims: `iss` = `\"opengeni-session-proxy\"`,\n * `aud` = the tool server URL, `sub` = the external user id, `workspace_id`,\n * `source`, optional `tenant`, `iat`, `exp`.\n */\n\n/** `iss` of every tool token. */\nexport const TOOL_TOKEN_ISSUER = \"opengeni-session-proxy\";\n/** HMAC message used to derive the signing key from the secret. */\nexport const TOOL_TOKEN_KEY_LABEL = \"opengeni-tool-token:v1\";\n/** Default token lifetime: 24 hours, refreshed on every message, approval, and answer. */\nexport const TOOL_TOKEN_DEFAULT_TTL_SECONDS = 24 * 60 * 60;\nconst MAX_TTL_SECONDS = 7 * 24 * 60 * 60;\n/** Opengeni's per-value limit for session MCP credential headers. */\nconst MAX_HEADER_VALUE_LENGTH = 4096;\n/** Default `toolServer.url` and `verifyToolRequest` audience. */\nexport const TOOL_SERVER_URL_ENV = \"OPENGENI_TOOL_SERVER_URL\";\nconst CLOCK_SKEW_SECONDS = 60;\n\n/** The user a verified tool request acts for. */\nexport type ToolRequestIdentity = {\n  /** External user id the session proxy's `resolve` hook authenticated. */\n  user: string;\n  /** Tenant from `resolve`, when it returned one. */\n  tenant?: string | undefined;\n  workspaceId: string;\n  /** External identity source (same as the proxy's `asUser` source). */\n  source: string;\n  expiresAt: Date;\n};\n\nexport type VerifyToolRequestOptions = {\n  /** Signing secret. Defaults to `OPENGENI_API_KEY`; must match the proxy's. */\n  secret?: string | undefined;\n  /**\n   * Exact tool server URL the token must be issued for (the proxy's\n   * `toolServer.url`). Defaults to `OPENGENI_TOOL_SERVER_URL`.\n   */\n  audience?: string | undefined;\n};\n\n/** A Web `Request`, or a Node/Express request (`headers` plus `originalUrl`/`url`). */\nexport type ToolRequestLike =\n  | Request\n  | {\n      headers: Record<string, string | string[] | undefined>;\n      originalUrl?: string | undefined;\n      url?: string | undefined;\n    };\n\n/** Missing, expired, forged, or misdirected tool token. Respond with `status` (401). */\nexport class ToolRequestError extends Error {\n  readonly status = 401;\n  constructor(readonly code: string) {\n    super(\"Tool request is not authorized.\");\n    this.name = \"ToolRequestError\";\n  }\n  /** A ready 401 response with a `WWW-Authenticate: Bearer` challenge. */\n  toResponse(): Response {\n    return new Response(JSON.stringify({ error: { code: this.code, message: this.message } }), {\n      status: 401,\n      headers: {\n        \"Content-Type\": \"application/json; charset=utf-8\",\n        \"WWW-Authenticate\": 'Bearer error=\"invalid_token\"',\n      },\n    });\n  }\n}\n\n/**\n * Verify the tool token on one MCP request and return who it acts for.\n * Throws {@link ToolRequestError} (401) for every invalid token. Call it on\n * every request, before any tool runs.\n *\n * ```ts\n * const user = await verifyToolRequest(request); // { user, tenant, workspaceId }\n * ```\n */\nexport async function verifyToolRequest(\n  request: ToolRequestLike,\n  options: VerifyToolRequestOptions = {},\n): Promise<ToolRequestIdentity> {\n  const key = await signingKey(resolveToolTokenSecret(options.secret));\n  const audience = options.audience ?? environment(TOOL_SERVER_URL_ENV);\n  if (!audience) {\n    throw new TypeError(\n      `verifyToolRequest needs the tool server URL: pass { audience } or set ${TOOL_SERVER_URL_ENV}.`,\n    );\n  }\n  const authorization = requestAuthorization(request);\n  const match = /^Bearer[ ]+([A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)$/i.exec(\n    authorization?.trim() ?? \"\",\n  );\n  if (!match) throw new ToolRequestError(\"token_missing\");\n  const [header, payload, signature] = match[1]!.split(\".\") as [string, string, string];\n  let protectedHeader: unknown;\n  let claims: Record<string, unknown>;\n  let signatureBytes: Uint8Array<ArrayBuffer>;\n  try {\n    signatureBytes = base64UrlDecode(signature);\n    protectedHeader = JSON.parse(utf8(base64UrlDecode(header)));\n    claims = JSON.parse(utf8(base64UrlDecode(payload)));\n  } catch {\n    throw new ToolRequestError(\"token_malformed\");\n  }\n  if (\n    !protectedHeader ||\n    typeof protectedHeader !== \"object\" ||\n    (protectedHeader as { alg?: unknown }).alg !== \"HS256\" ||\n    !claims ||\n    typeof claims !== \"object\" ||\n    Array.isArray(claims)\n  ) {\n    throw new ToolRequestError(\"token_malformed\");\n  }\n  const valid = await crypto.subtle.verify(\n    \"HMAC\",\n    key,\n    signatureBytes,\n    new TextEncoder().encode(`${header}.${payload}`),\n  );\n  if (!valid) throw new ToolRequestError(\"token_invalid\");\n  const now = Math.floor(Date.now() / 1000);\n  const { iss, aud, sub, exp, iat, workspace_id, source, tenant } = claims;\n  if (iss !== TOOL_TOKEN_ISSUER) throw new ToolRequestError(\"token_invalid\");\n  if (typeof exp !== \"number\" || exp <= now) throw new ToolRequestError(\"token_expired\");\n  if (typeof iat !== \"number\" || iat > now + CLOCK_SKEW_SECONDS) {\n    throw new ToolRequestError(\"token_invalid\");\n  }\n  if (aud !== audience) {\n    throw new ToolRequestError(\"token_audience\");\n  }\n  if (\n    typeof sub !== \"string\" ||\n    !sub ||\n    typeof workspace_id !== \"string\" ||\n    !workspace_id ||\n    typeof source !== \"string\" ||\n    (tenant !== undefined && typeof tenant !== \"string\")\n  ) {\n    throw new ToolRequestError(\"token_invalid\");\n  }\n  return {\n    user: sub,\n    ...(tenant !== undefined ? { tenant } : {}),\n    workspaceId: workspace_id,\n    source,\n    expiresAt: new Date(exp * 1000),\n  };\n}\n\n/** Mint one tool token. The session proxy calls this; products rarely need to. */\nexport async function mintToolToken(input: {\n  /** Tool server URL; becomes `aud`. */\n  audience: string;\n  user: string;\n  tenant?: string | undefined;\n  workspaceId: string;\n  source: string;\n  secret?: string | undefined;\n  ttlSeconds?: number | undefined;\n}): Promise<string> {\n  const ttl = input.ttlSeconds ?? TOOL_TOKEN_DEFAULT_TTL_SECONDS;\n  if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > MAX_TTL_SECONDS) {\n    throw new TypeError(`ttlSeconds must be an integer from 1 to ${MAX_TTL_SECONDS}.`);\n  }\n  const key = await signingKey(resolveToolTokenSecret(input.secret));\n  const now = Math.floor(Date.now() / 1000);\n  const header = base64UrlJson({ alg: \"HS256\", typ: \"JWT\" });\n  const payload = base64UrlJson({\n    iss: TOOL_TOKEN_ISSUER,\n    aud: input.audience,\n    sub: input.user,\n    workspace_id: input.workspaceId,\n    source: input.source,\n    ...(input.tenant !== undefined ? { tenant: input.tenant } : {}),\n    iat: now,\n    exp: now + ttl,\n  });\n  const signature = await crypto.subtle.sign(\n    \"HMAC\",\n    key,\n    new TextEncoder().encode(`${header}.${payload}`),\n  );\n  const token = `${header}.${payload}.${base64UrlEncode(new Uint8Array(signature))}`;\n  if (`Bearer ${token}`.length > MAX_HEADER_VALUE_LENGTH) {\n    throw new TypeError(\n      `Tool token exceeds Opengeni's ${MAX_HEADER_VALUE_LENGTH}-character header limit; shorten the user, tenant, or URL.`,\n    );\n  }\n  return token;\n}\n\n/**\n * The hex HS256 key tool tokens are signed with. Give this (not the\n * organization key) to a tool server written in Python, Ruby, Go, and so on.\n */\nexport async function deriveToolTokenKey(secret?: string): Promise<string> {\n  return [...(await derivedKeyBytes(resolveToolTokenSecret(secret)))]\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n\n/** The configured secret, else `OPENGENI_API_KEY`. Throws when neither is set. */\nexport function resolveToolTokenSecret(secret: string | undefined): string {\n  const resolved = secret ?? environment(\"OPENGENI_API_KEY\");\n  if (!resolved) {\n    throw new TypeError(\n      \"Tool tokens need a signing secret: set OPENGENI_API_KEY, or pass the same `secret` to the session proxy's toolServer and verifyToolRequest.\",\n    );\n  }\n  return resolved;\n}\n\nfunction environment(name: string): string | undefined {\n  return (\n    (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env?.[\n      name\n    ] || undefined\n  );\n}\n\nasync function derivedKeyBytes(secret: string): Promise<Uint8Array<ArrayBuffer>> {\n  const root = await crypto.subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return new Uint8Array(\n    await crypto.subtle.sign(\"HMAC\", root, new TextEncoder().encode(TOOL_TOKEN_KEY_LABEL)),\n  );\n}\n\nconst keys = new Map<string, Promise<CryptoKey>>();\n\n/** HS256 key derived from the secret, so the raw secret never signs tokens itself. */\nfunction signingKey(secret: string): Promise<CryptoKey> {\n  let key = keys.get(secret);\n  if (!key) {\n    key = (async () =>\n      await crypto.subtle.importKey(\n        \"raw\",\n        await derivedKeyBytes(secret),\n        { name: \"HMAC\", hash: \"SHA-256\" },\n        false,\n        [\"sign\", \"verify\"],\n      ))();\n    key.catch(() => keys.delete(secret));\n    if (keys.size >= 16) keys.delete(keys.keys().next().value!);\n    keys.set(secret, key);\n  }\n  return key;\n}\n\nfunction requestAuthorization(request: ToolRequestLike): string | undefined {\n  if (typeof Request !== \"undefined\" && request instanceof Request) {\n    return request.headers.get(\"authorization\") ?? undefined;\n  }\n  const headers = (request as Exclude<ToolRequestLike, Request>).headers as unknown;\n  const raw =\n    headers && typeof (headers as Headers).get === \"function\"\n      ? ((headers as Headers).get(\"authorization\") ?? undefined)\n      : (headers as Record<string, string | string[] | undefined>)?.authorization;\n  return Array.isArray(raw) ? undefined : raw;\n}\n\nfunction base64UrlJson(value: unknown): string {\n  return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction base64UrlDecode(value: string): Uint8Array<ArrayBuffer> {\n  const base64 = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const binary = atob(base64 + \"=\".repeat((4 - (base64.length % 4)) % 4));\n  const bytes = new Uint8Array(binary.length);\n  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);\n  return bytes;\n}\n\nfunction utf8(bytes: Uint8Array): string {\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n}\n"],"mappings":";AAmBO,IAAM,oBAAoB;AAE1B,IAAM,uBAAuB;AAE7B,IAAM,iCAAiC,KAAK,KAAK;AACxD,IAAM,kBAAkB,IAAI,KAAK,KAAK;AAEtC,IAAM,0BAA0B;AAEzB,IAAM,sBAAsB;AACnC,IAAM,qBAAqB;AAkCpB,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAE1C,YAAqB,MAAc;AACjC,UAAM,iCAAiC;AADpB;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAJS,SAAS;AAAA;AAAA,EAMlB,aAAuB;AACrB,WAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAQ,EAAE,CAAC,GAAG;AAAA,MACzF,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,oBAAoB;AAAA,MACtB;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAWA,eAAsB,kBACpB,SACA,UAAoC,CAAC,GACP;AAC9B,QAAM,MAAM,MAAM,WAAW,uBAAuB,QAAQ,MAAM,CAAC;AACnE,QAAM,WAAW,QAAQ,YAAY,YAAY,mBAAmB;AACpE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR,yEAAyE,mBAAmB;AAAA,IAC9F;AAAA,EACF;AACA,QAAM,gBAAgB,qBAAqB,OAAO;AAClD,QAAM,QAAQ,gEAAgE;AAAA,IAC5E,eAAe,KAAK,KAAK;AAAA,EAC3B;AACA,MAAI,CAAC,MAAO,OAAM,IAAI,iBAAiB,eAAe;AACtD,QAAM,CAAC,QAAQ,SAAS,SAAS,IAAI,MAAM,CAAC,EAAG,MAAM,GAAG;AACxD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,qBAAiB,gBAAgB,SAAS;AAC1C,sBAAkB,KAAK,MAAM,KAAK,gBAAgB,MAAM,CAAC,CAAC;AAC1D,aAAS,KAAK,MAAM,KAAK,gBAAgB,OAAO,CAAC,CAAC;AAAA,EACpD,QAAQ;AACN,UAAM,IAAI,iBAAiB,iBAAiB;AAAA,EAC9C;AACA,MACE,CAAC,mBACD,OAAO,oBAAoB,YAC1B,gBAAsC,QAAQ,WAC/C,CAAC,UACD,OAAO,WAAW,YAClB,MAAM,QAAQ,MAAM,GACpB;AACA,UAAM,IAAI,iBAAiB,iBAAiB;AAAA,EAC9C;AACA,QAAM,QAAQ,MAAM,OAAO,OAAO;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,EACjD;AACA,MAAI,CAAC,MAAO,OAAM,IAAI,iBAAiB,eAAe;AACtD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,EAAE,KAAK,KAAK,KAAK,KAAK,KAAK,cAAc,QAAQ,OAAO,IAAI;AAClE,MAAI,QAAQ,kBAAmB,OAAM,IAAI,iBAAiB,eAAe;AACzE,MAAI,OAAO,QAAQ,YAAY,OAAO,IAAK,OAAM,IAAI,iBAAiB,eAAe;AACrF,MAAI,OAAO,QAAQ,YAAY,MAAM,MAAM,oBAAoB;AAC7D,UAAM,IAAI,iBAAiB,eAAe;AAAA,EAC5C;AACA,MAAI,QAAQ,UAAU;AACpB,UAAM,IAAI,iBAAiB,gBAAgB;AAAA,EAC7C;AACA,MACE,OAAO,QAAQ,YACf,CAAC,OACD,OAAO,iBAAiB,YACxB,CAAC,gBACD,OAAO,WAAW,YACjB,WAAW,UAAa,OAAO,WAAW,UAC3C;AACA,UAAM,IAAI,iBAAiB,eAAe;AAAA,EAC5C;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,IACzC,aAAa;AAAA,IACb;AAAA,IACA,WAAW,IAAI,KAAK,MAAM,GAAI;AAAA,EAChC;AACF;AAGA,eAAsB,cAAc,OAShB;AAClB,QAAM,MAAM,MAAM,cAAc;AAChC,MAAI,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,KAAK,MAAM,iBAAiB;AAClE,UAAM,IAAI,UAAU,2CAA2C,eAAe,GAAG;AAAA,EACnF;AACA,QAAM,MAAM,MAAM,WAAW,uBAAuB,MAAM,MAAM,CAAC;AACjE,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,SAAS,cAAc,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC;AACzD,QAAM,UAAU,cAAc;AAAA,IAC5B,KAAK;AAAA,IACL,KAAK,MAAM;AAAA,IACX,KAAK,MAAM;AAAA,IACX,cAAc,MAAM;AAAA,IACpB,QAAQ,MAAM;AAAA,IACd,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC7D,KAAK;AAAA,IACL,KAAK,MAAM;AAAA,EACb,CAAC;AACD,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,EACjD;AACA,QAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,IAAI,gBAAgB,IAAI,WAAW,SAAS,CAAC,CAAC;AAChF,MAAI,UAAU,KAAK,GAAG,SAAS,yBAAyB;AACtD,UAAM,IAAI;AAAA,MACR,iCAAiC,uBAAuB;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAsB,mBAAmB,QAAkC;AACzE,SAAO,CAAC,GAAI,MAAM,gBAAgB,uBAAuB,MAAM,CAAC,CAAE,EAC/D,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE;AACZ;AAGO,SAAS,uBAAuB,QAAoC;AACzE,QAAM,WAAW,UAAU,YAAY,kBAAkB;AACzD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAAkC;AACrD,SACG,WAA0E,SAAS,MAClF,IACF,KAAK;AAET;AAEA,eAAe,gBAAgB,QAAkD;AAC/E,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO,KAAK,QAAQ,MAAM,IAAI,YAAY,EAAE,OAAO,oBAAoB,CAAC;AAAA,EACvF;AACF;AAEA,IAAM,OAAO,oBAAI,IAAgC;AAGjD,SAAS,WAAW,QAAoC;AACtD,MAAI,MAAM,KAAK,IAAI,MAAM;AACzB,MAAI,CAAC,KAAK;AACR,WAAO,YACL,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,MACA,MAAM,gBAAgB,MAAM;AAAA,MAC5B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAChC;AAAA,MACA,CAAC,QAAQ,QAAQ;AAAA,IACnB,GAAG;AACL,QAAI,MAAM,MAAM,KAAK,OAAO,MAAM,CAAC;AACnC,QAAI,KAAK,QAAQ,GAAI,MAAK,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,KAAM;AAC1D,SAAK,IAAI,QAAQ,GAAG;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAA8C;AAC1E,MAAI,OAAO,YAAY,eAAe,mBAAmB,SAAS;AAChE,WAAO,QAAQ,QAAQ,IAAI,eAAe,KAAK;AAAA,EACjD;AACA,QAAM,UAAW,QAA8C;AAC/D,QAAM,MACJ,WAAW,OAAQ,QAAoB,QAAQ,aACzC,QAAoB,IAAI,eAAe,KAAK,SAC7C,SAA2D;AAClE,SAAO,MAAM,QAAQ,GAAG,IAAI,SAAY;AAC1C;AAEA,SAAS,cAAc,OAAwB;AAC7C,SAAO,gBAAgB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC;AACxE;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,SAAS;AACb,aAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEA,SAAS,gBAAgB,OAAwC;AAC/D,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACzD,QAAM,SAAS,KAAK,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC,CAAC;AACtE,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,EAAG,OAAM,KAAK,IAAI,OAAO,WAAW,KAAK;AAC7F,SAAO;AACT;AAEA,SAAS,KAAK,OAA2B;AACvC,SAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAC/D;","names":[]}