@osva-ai/contracts 1.0.0

package/dist/secret-resolver.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secret-resolver.js.map

package/dist/secret-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-resolver.js","sourceRoot":"","sources":["../src/secret-resolver.ts"],"names":[],"mappings":""}

package/dist/security.d.ts

@@ -0,0 +1,50 @@
+import type { ApiKeyId, WorkspaceId } from "./ids.js";
+export declare const AUTHENTICATION_METHODS: {
+    readonly API_KEY: "API_KEY";
+};
+export type AuthenticationMethod = (typeof AUTHENTICATION_METHODS)[keyof typeof AUTHENTICATION_METHODS];
+export declare const COMMUNITY_EDITION_ROLES: {
+    readonly VIEWER: "VIEWER";
+    readonly OPERATOR: "OPERATOR";
+    readonly EDITOR: "EDITOR";
+    readonly ADMIN: "ADMIN";
+};
+export type CommunityEditionRole = (typeof COMMUNITY_EDITION_ROLES)[keyof typeof COMMUNITY_EDITION_ROLES];
+export declare const AUTHORIZATION_ACTIONS: {
+    readonly READ: "READ";
+    readonly EXECUTE: "EXECUTE";
+    readonly WRITE: "WRITE";
+    readonly ADMIN: "ADMIN";
+};
+export type AuthorizationAction = (typeof AUTHORIZATION_ACTIONS)[keyof typeof AUTHORIZATION_ACTIONS];
+export declare const PUBLIC_API_ERROR_CODES: {
+    readonly AUTHENTICATION_REQUIRED: "AUTHENTICATION_REQUIRED";
+    readonly PERMISSION_DENIED: "PERMISSION_DENIED";
+    readonly RESOURCE_NOT_FOUND: "RESOURCE_NOT_FOUND";
+    readonly REQUEST_TOO_LARGE: "REQUEST_TOO_LARGE";
+};
+/** Default maximum JSON request body size for ordinary REST handlers (1 MiB). */
+export declare const OSVA_DEFAULT_JSON_BODY_MAX_BYTES = 1048576;
+export type PublicApiErrorCode = (typeof PUBLIC_API_ERROR_CODES)[keyof typeof PUBLIC_API_ERROR_CODES];
+export declare const AUTHENTICATION_FAILURE_REASONS: {
+    readonly MALFORMED_TOKEN: "malformed_token";
+    readonly UNKNOWN_KEY: "unknown_key";
+    readonly REVOKED_KEY: "revoked_key";
+    readonly EXPIRED_KEY: "expired_key";
+    readonly INVALID_SECRET: "invalid_secret";
+};
+export type AuthenticationFailureReason = (typeof AUTHENTICATION_FAILURE_REASONS)[keyof typeof AUTHENTICATION_FAILURE_REASONS];
+export interface RequestPrincipal {
+    readonly subjectId: ApiKeyId;
+    readonly workspaceId: WorkspaceId;
+    readonly role: CommunityEditionRole;
+    readonly authenticationMethod: AuthenticationMethod;
+}
+export interface AuthContextResourceV1 {
+    readonly subjectId: ApiKeyId;
+    readonly workspaceId: WorkspaceId;
+    readonly role: CommunityEditionRole;
+}
+export declare const API_KEY_NAME_MAX_LENGTH = 128;
+export declare const OSVA_REQUEST_ID_HEADER = "x-osva-request-id";
+//# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEtD,eAAO,MAAM,sBAAsB;;CAEzB,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAC9B,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,OAAO,sBAAsB,CAAC,CAAC;AAEvE,eAAO,MAAM,uBAAuB;;;;;CAK1B,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAC9B,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAEzE,eAAO,MAAM,qBAAqB;;;;;CAKxB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAC7B,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAErE,eAAO,MAAM,sBAAsB;;;;;CAKzB,CAAC;AAEX,iFAAiF;AACjF,eAAO,MAAM,gCAAgC,UAAY,CAAC;AAE1D,MAAM,MAAM,kBAAkB,GAC5B,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,OAAO,sBAAsB,CAAC,CAAC;AAEvE,eAAO,MAAM,8BAA8B;;;;;;CAMjC,CAAC;AAEX,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,OAAO,8BAA8B,CAAC,CAAC;AAEvF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;CACrD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;CACrC;AAED,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,eAAO,MAAM,sBAAsB,sBAAsB,CAAC"}

package/dist/security.js

@@ -0,0 +1,33 @@
+export const AUTHENTICATION_METHODS = {
+    API_KEY: "API_KEY",
+};
+export const COMMUNITY_EDITION_ROLES = {
+    VIEWER: "VIEWER",
+    OPERATOR: "OPERATOR",
+    EDITOR: "EDITOR",
+    ADMIN: "ADMIN",
+};
+export const AUTHORIZATION_ACTIONS = {
+    READ: "READ",
+    EXECUTE: "EXECUTE",
+    WRITE: "WRITE",
+    ADMIN: "ADMIN",
+};
+export const PUBLIC_API_ERROR_CODES = {
+    AUTHENTICATION_REQUIRED: "AUTHENTICATION_REQUIRED",
+    PERMISSION_DENIED: "PERMISSION_DENIED",
+    RESOURCE_NOT_FOUND: "RESOURCE_NOT_FOUND",
+    REQUEST_TOO_LARGE: "REQUEST_TOO_LARGE",
+};
+/** Default maximum JSON request body size for ordinary REST handlers (1 MiB). */
+export const OSVA_DEFAULT_JSON_BODY_MAX_BYTES = 1_048_576;
+export const AUTHENTICATION_FAILURE_REASONS = {
+    MALFORMED_TOKEN: "malformed_token",
+    UNKNOWN_KEY: "unknown_key",
+    REVOKED_KEY: "revoked_key",
+    EXPIRED_KEY: "expired_key",
+    INVALID_SECRET: "invalid_secret",
+};
+export const API_KEY_NAME_MAX_LENGTH = 128;
+export const OSVA_REQUEST_ID_HEADER = "x-osva-request-id";
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,OAAO,EAAE,SAAS;CACV,CAAC;AAKX,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;CACN,CAAC;AAKX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;CACN,CAAC;AAKX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,uBAAuB,EAAE,yBAAyB;IAClD,iBAAiB,EAAE,mBAAmB;IACtC,kBAAkB,EAAE,oBAAoB;IACxC,iBAAiB,EAAE,mBAAmB;CAC9B,CAAC;AAEX,iFAAiF;AACjF,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAC;AAK1D,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAkBX,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC"}

package/dist/stdio-transport.d.ts

@@ -0,0 +1,5 @@
+import type { StdioTransportConfig } from "./connector.js";
+export declare function isValidProcessEnvironmentVariableName(name: string): boolean;
+export declare function listStdioEnvironmentConflicts(config: Pick<StdioTransportConfig, "environment" | "secretEnvironment">): readonly string[];
+export declare function validateStdioTransportEnvironment(config: Pick<StdioTransportConfig, "environment" | "secretEnvironment">): void;
+//# sourceMappingURL=stdio-transport.d.ts.map

package/dist/stdio-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-transport.d.ts","sourceRoot":"","sources":["../src/stdio-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAI3D,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,GAAG,mBAAmB,CAAC,GACtE,SAAS,MAAM,EAAE,CAInB;AAED,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,GAAG,mBAAmB,CAAC,GACtE,IAAI,CAmBN"}

package/dist/stdio-transport.js

@@ -0,0 +1,25 @@
+const ENV_VAR_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export function isValidProcessEnvironmentVariableName(name) {
+    return ENV_VAR_NAME_PATTERN.test(name);
+}
+export function listStdioEnvironmentConflicts(config) {
+    const plain = config.environment ?? {};
+    const secret = config.secretEnvironment ?? {};
+    return Object.keys(secret).filter((key) => key in plain);
+}
+export function validateStdioTransportEnvironment(config) {
+    const names = [
+        ...Object.keys(config.environment ?? {}),
+        ...Object.keys(config.secretEnvironment ?? {}),
+    ];
+    for (const name of names) {
+        if (!isValidProcessEnvironmentVariableName(name)) {
+            throw new Error(`Invalid process environment variable name '${name}' in stdio transport configuration.`);
+        }
+    }
+    const conflicts = listStdioEnvironmentConflicts(config);
+    if (conflicts.length > 0) {
+        throw new Error(`Stdio transport environment and secretEnvironment both define: ${conflicts.join(", ")}.`);
+    }
+}
+//# sourceMappingURL=stdio-transport.js.map

package/dist/stdio-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-transport.js","sourceRoot":"","sources":["../src/stdio-transport.ts"],"names":[],"mappings":"AAEA,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAExD,MAAM,UAAU,qCAAqC,CAAC,IAAY;IAChE,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,MAAuE;IAEvE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAuE;IAEvE,MAAM,KAAK,GAAG;QACZ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QACxC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KAC/C,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,qCAAqC,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/telemetry.d.ts

@@ -0,0 +1,24 @@
+import type { AgentId, AgentVersionId, RunAttemptId, RunId, RunStepId, WorkflowRunId, WorkspaceId } from "./ids.js";
+export interface TelemetryCorrelation {
+    readonly workspaceId?: WorkspaceId;
+    readonly agentId?: AgentId;
+    readonly agentVersionId?: AgentVersionId;
+    readonly workflowRunId?: WorkflowRunId;
+    readonly runId?: RunId;
+    readonly runAttemptId?: RunAttemptId;
+    readonly runStepId?: RunStepId;
+}
+/**
+ * Normalized telemetry for external exporters.
+ * Exporters are not canonical storage; dropping them must not destroy Run state.
+ */
+export interface TelemetryEvent {
+    readonly name: string;
+    readonly occurredAt: string;
+    readonly correlation: TelemetryCorrelation;
+    readonly attributes?: Readonly<Record<string, unknown>>;
+}
+export interface TelemetrySink {
+    emit(event: TelemetryEvent): Promise<void>;
+}
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,YAAY,EACZ,KAAK,EACL,SAAS,EACT,aAAa,EACb,WAAW,EACZ,MAAM,UAAU,CAAC;AAElB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C"}

package/dist/telemetry.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=telemetry.js.map

package/dist/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":""}

package/dist/tool-gateway.d.ts

@@ -0,0 +1,67 @@
+import type { AgentId, ConnectorVersionId, RunAttemptId, RunId, ToolVersionId, WorkspaceId } from "./ids.js";
+import type { JsonSchemaRecord } from "./json-schema.js";
+import type { JsonValue } from "./json-value.js";
+export declare const TOOL_BINDING_NAME_PATTERN: RegExp;
+export declare const INTERNAL_TOOL_IMPLEMENTATIONS: readonly ["OSVA_ECHO_V1", "OSVA_CLOCK_NOW_V1"];
+export type InternalToolImplementationId = (typeof INTERNAL_TOOL_IMPLEMENTATIONS)[number];
+export declare const TOOL_TYPES: readonly ["INTERNAL", "MCP"];
+export type ToolType = (typeof TOOL_TYPES)[number];
+export declare const MCP_TOOL_IMPLEMENTATION: "MCP_V1";
+export type McpToolImplementationId = typeof MCP_TOOL_IMPLEMENTATION;
+export interface McpToolVersionConfig {
+    readonly connectorVersionId: ConnectorVersionId;
+    readonly remoteToolName: string;
+    readonly description?: string;
+    readonly inputSchema: JsonSchemaRecord;
+}
+export declare const TOOL_EFFECT_CLASSIFICATIONS: readonly ["READ_ONLY"];
+export type ToolEffectClassification = (typeof TOOL_EFFECT_CLASSIFICATIONS)[number];
+export declare const TOOL_ERROR_CODES: {
+    readonly TOOL_BINDING_NOT_FOUND: "TOOL_BINDING_NOT_FOUND";
+    readonly TOOL_VERSION_NOT_FOUND: "TOOL_VERSION_NOT_FOUND";
+    readonly TOOL_NOT_AUTHORIZED: "TOOL_NOT_AUTHORIZED";
+    readonly TOOL_IMPLEMENTATION_NOT_FOUND: "TOOL_IMPLEMENTATION_NOT_FOUND";
+    readonly INVALID_TOOL_INPUT: "INVALID_TOOL_INPUT";
+    readonly TOOL_EXECUTION_ERROR: "TOOL_EXECUTION_ERROR";
+    readonly INVALID_TOOL_OUTPUT: "INVALID_TOOL_OUTPUT";
+    readonly CONNECTOR_UNAVAILABLE: "CONNECTOR_UNAVAILABLE";
+    readonly CONNECTOR_AUTHENTICATION_FAILED: "CONNECTOR_AUTHENTICATION_FAILED";
+    readonly CONNECTOR_TIMEOUT: "CONNECTOR_TIMEOUT";
+    readonly CONNECTOR_CANCELLED: "CONNECTOR_CANCELLED";
+    readonly MCP_PROTOCOL_ERROR: "MCP_PROTOCOL_ERROR";
+    readonly MCP_TOOL_NOT_FOUND: "MCP_TOOL_NOT_FOUND";
+    readonly MCP_INVALID_ARGUMENTS: "MCP_INVALID_ARGUMENTS";
+    readonly MCP_TOOL_ERROR: "MCP_TOOL_ERROR";
+    readonly MCP_INVALID_RESPONSE: "MCP_INVALID_RESPONSE";
+    readonly MCP_UNSUPPORTED_INTERACTION: "MCP_UNSUPPORTED_INTERACTION";
+};
+export type ToolErrorCode = (typeof TOOL_ERROR_CODES)[keyof typeof TOOL_ERROR_CODES];
+export declare function isToolBindingName(value: string): boolean;
+export declare function isToolType(value: string): value is ToolType;
+export declare function isInternalToolImplementationId(value: string): value is InternalToolImplementationId;
+export declare function isToolErrorCode(value: string): value is ToolErrorCode;
+export interface ToolAuthorizationContext {
+    readonly workspaceId: WorkspaceId;
+    readonly agentId: AgentId;
+    readonly runId: RunId;
+    readonly runAttemptId: RunAttemptId;
+    readonly bindingName: string;
+    readonly toolVersionId: ToolVersionId;
+}
+/**
+ * Stage 1 ToolGateway request. Authorization context is required for every
+ * invocation. The gateway does not derive permissions from prompt text.
+ */
+export interface ToolInvokeRequest {
+    readonly toolVersionId: ToolVersionId;
+    readonly input: unknown;
+    readonly idempotencyKey?: string;
+    readonly authorization: ToolAuthorizationContext;
+}
+export interface ToolPolicy {
+    authorizeToolInvocation(context: ToolAuthorizationContext): Promise<void> | void;
+}
+export interface ToolGateway {
+    invoke(request: ToolInvokeRequest): Promise<JsonValue>;
+}
+//# sourceMappingURL=tool-gateway.d.ts.map

package/dist/tool-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-gateway.d.ts","sourceRoot":"","sources":["../src/tool-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,kBAAkB,EAClB,YAAY,EACZ,KAAK,EACL,aAAa,EACb,WAAW,EACZ,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,eAAO,MAAM,yBAAyB,QAAkC,CAAC;AAEzE,eAAO,MAAM,6BAA6B,gDAGhC,CAAC;AAEX,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,eAAO,MAAM,UAAU,8BAA+B,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,eAAO,MAAM,uBAAuB,EAAG,QAAiB,CAAC;AAEzD,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC;AAErE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;CACxC;AAED,eAAO,MAAM,2BAA2B,wBAAyB,CAAC;AAElE,MAAM,MAAM,wBAAwB,GAClC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;CAkBnB,CAAC;AAEX,MAAM,MAAM,aAAa,GACvB,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAE3D;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,4BAA4B,CAEvC;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,aAAa,CAErE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;CAClD;AAED,MAAM,WAAW,UAAU;IACzB,uBAAuB,CACrB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACxD"}

package/dist/tool-gateway.js

@@ -0,0 +1,40 @@
+export const TOOL_BINDING_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+export const INTERNAL_TOOL_IMPLEMENTATIONS = [
+    "OSVA_ECHO_V1",
+    "OSVA_CLOCK_NOW_V1",
+];
+export const TOOL_TYPES = ["INTERNAL", "MCP"];
+export const MCP_TOOL_IMPLEMENTATION = "MCP_V1";
+export const TOOL_EFFECT_CLASSIFICATIONS = ["READ_ONLY"];
+export const TOOL_ERROR_CODES = {
+    TOOL_BINDING_NOT_FOUND: "TOOL_BINDING_NOT_FOUND",
+    TOOL_VERSION_NOT_FOUND: "TOOL_VERSION_NOT_FOUND",
+    TOOL_NOT_AUTHORIZED: "TOOL_NOT_AUTHORIZED",
+    TOOL_IMPLEMENTATION_NOT_FOUND: "TOOL_IMPLEMENTATION_NOT_FOUND",
+    INVALID_TOOL_INPUT: "INVALID_TOOL_INPUT",
+    TOOL_EXECUTION_ERROR: "TOOL_EXECUTION_ERROR",
+    INVALID_TOOL_OUTPUT: "INVALID_TOOL_OUTPUT",
+    CONNECTOR_UNAVAILABLE: "CONNECTOR_UNAVAILABLE",
+    CONNECTOR_AUTHENTICATION_FAILED: "CONNECTOR_AUTHENTICATION_FAILED",
+    CONNECTOR_TIMEOUT: "CONNECTOR_TIMEOUT",
+    CONNECTOR_CANCELLED: "CONNECTOR_CANCELLED",
+    MCP_PROTOCOL_ERROR: "MCP_PROTOCOL_ERROR",
+    MCP_TOOL_NOT_FOUND: "MCP_TOOL_NOT_FOUND",
+    MCP_INVALID_ARGUMENTS: "MCP_INVALID_ARGUMENTS",
+    MCP_TOOL_ERROR: "MCP_TOOL_ERROR",
+    MCP_INVALID_RESPONSE: "MCP_INVALID_RESPONSE",
+    MCP_UNSUPPORTED_INTERACTION: "MCP_UNSUPPORTED_INTERACTION",
+};
+export function isToolBindingName(value) {
+    return TOOL_BINDING_NAME_PATTERN.test(value);
+}
+export function isToolType(value) {
+    return TOOL_TYPES.includes(value);
+}
+export function isInternalToolImplementationId(value) {
+    return INTERNAL_TOOL_IMPLEMENTATIONS.includes(value);
+}
+export function isToolErrorCode(value) {
+    return Object.values(TOOL_ERROR_CODES).includes(value);
+}
+//# sourceMappingURL=tool-gateway.js.map

package/dist/tool-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-gateway.js","sourceRoot":"","sources":["../src/tool-gateway.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AAEzE,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,cAAc;IACd,mBAAmB;CACX,CAAC;AAKX,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,KAAK,CAAU,CAAC;AAIvD,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAiB,CAAC;AAWzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,WAAW,CAAU,CAAC;AAKlE,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,sBAAsB,EAAE,wBAAwB;IAChD,sBAAsB,EAAE,wBAAwB;IAChD,mBAAmB,EAAE,qBAAqB;IAC1C,6BAA6B,EAAE,+BAA+B;IAC9D,kBAAkB,EAAE,oBAAoB;IACxC,oBAAoB,EAAE,sBAAsB;IAC5C,mBAAmB,EAAE,qBAAqB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,+BAA+B,EAAE,iCAAiC;IAClE,iBAAiB,EAAE,mBAAmB;IACtC,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,qBAAqB,EAAE,uBAAuB;IAC9C,cAAc,EAAE,gBAAgB;IAChC,oBAAoB,EAAE,sBAAsB;IAC5C,2BAA2B,EAAE,6BAA6B;CAClD,CAAC;AAKX,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAQ,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,KAAa;IAEb,OAAQ,6BAAmD,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAQ,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC"}

package/dist/tool-registry.d.ts

@@ -0,0 +1,46 @@
+import type { ToolId, ToolVersionId, WorkspaceId } from "./ids.js";
+import type { InternalToolImplementationId, McpToolVersionConfig, ToolType } from "./tool-gateway.js";
+export interface CreateToolRequestV1 {
+    readonly workspaceId: WorkspaceId;
+    readonly key: string;
+    readonly name: string;
+}
+export interface UpdateToolRequestV1 {
+    readonly name: string;
+}
+export interface CreateToolVersionRequestV1 {
+    readonly type: ToolType;
+    readonly implementation: InternalToolImplementationId;
+}
+export interface ToolResourceV1 {
+    readonly id: ToolId;
+    readonly workspaceId: WorkspaceId;
+    readonly key: string;
+    readonly name: string;
+    readonly createdAt: string;
+}
+export interface ToolListResourceV1 {
+    readonly tools: readonly ToolResourceV1[];
+}
+export interface InternalToolVersionResourceV1 {
+    readonly id: ToolVersionId;
+    readonly toolId: ToolId;
+    readonly version: number;
+    readonly type: "INTERNAL";
+    readonly implementation: InternalToolImplementationId;
+    readonly createdAt: string;
+}
+export interface McpToolVersionResourceV1 {
+    readonly id: ToolVersionId;
+    readonly toolId: ToolId;
+    readonly version: number;
+    readonly type: "MCP";
+    readonly implementation: "MCP_V1";
+    readonly mcp: McpToolVersionConfig;
+    readonly createdAt: string;
+}
+export type ToolVersionResourceV1 = InternalToolVersionResourceV1 | McpToolVersionResourceV1;
+export interface ToolVersionListResourceV1 {
+    readonly versions: readonly ToolVersionResourceV1[];
+}
+//# sourceMappingURL=tool-registry.d.ts.map

package/dist/tool-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registry.d.ts","sourceRoot":"","sources":["../src/tool-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACnE,OAAO,KAAK,EACV,4BAA4B,EAC5B,oBAAoB,EACpB,QAAQ,EACT,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAC;CACvD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,qBAAqB,GAC/B,6BAA6B,GAAG,wBAAwB,CAAC;AAE3D,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACrD"}

package/dist/tool-registry.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tool-registry.js.map

package/dist/tool-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registry.js","sourceRoot":"","sources":["../src/tool-registry.ts"],"names":[],"mappings":""}

package/dist/tool.d.ts

@@ -0,0 +1,60 @@
+import type { RunId, RunStepId, ToolId, ToolVersionId, WorkflowNodeRunId, WorkflowRunId } from "./ids.js";
+import type { JsonSchemaRecord } from "./json-schema.js";
+import type { SecretReference } from "./secret-reference.js";
+export interface ToolDefinition {
+    readonly toolId: ToolId;
+}
+export interface ToolImplementationRef {
+    readonly type: string;
+    readonly key: string;
+}
+export interface ToolVersionDefinition {
+    readonly toolId: ToolId;
+    readonly toolVersionId: ToolVersionId;
+    readonly inputSchema: JsonSchemaRecord;
+    readonly outputSchema: JsonSchemaRecord;
+    readonly riskClassification: string;
+    readonly timeoutMs: number;
+    readonly idempotencyBehavior: string;
+    readonly implementationRef: ToolImplementationRef;
+    readonly credentialRequirements: readonly SecretReference[];
+}
+/**
+ * Authorization to use a logical Tool.
+ * Version pinning is not part of the Stage 0 grant.
+ */
+export interface ToolGrant {
+    readonly toolId: ToolId;
+}
+/**
+ * One Tool operation bound to an immutable ToolVersion.
+ * `operationId` identifies the logical operation. `runAttemptId` is not part of
+ * this contract and must not be used as operation or idempotency identity.
+ */
+export interface ToolInvocation {
+    readonly toolVersionId: ToolVersionId;
+    readonly input: unknown;
+    readonly operationId: string;
+    readonly idempotencyKey?: string;
+    readonly runId?: RunId;
+    readonly runStepId?: RunStepId;
+    readonly workflowRunId?: WorkflowRunId;
+    readonly workflowNodeRunId?: WorkflowNodeRunId;
+}
+export interface ToolError {
+    readonly code: string;
+    readonly message: string;
+}
+export interface ToolSuccess {
+    readonly status: "succeeded";
+    readonly output: unknown;
+}
+export interface ToolFailure {
+    readonly status: "failed";
+    readonly error: ToolError;
+}
+export type ToolResult = ToolSuccess | ToolFailure;
+export interface ToolExecutor {
+    execute(invocation: ToolInvocation): Promise<ToolResult>;
+}
+//# sourceMappingURL=tool.d.ts.map

package/dist/tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.d.ts","sourceRoot":"","sources":["../src/tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,SAAS,EACT,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,aAAa,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAClD,QAAQ,CAAC,sBAAsB,EAAE,SAAS,eAAe,EAAE,CAAC;CAC7D;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAChD;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC;AAEnD,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC1D"}

package/dist/tool.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tool.js.map

package/dist/tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.js","sourceRoot":"","sources":["../src/tool.ts"],"names":[],"mappings":""}

package/dist/trusted-runtime.d.ts

@@ -0,0 +1,10 @@
+export declare const SHA256_INTEGRITY_PREFIX: "sha256:";
+/**
+ * Relative POSIX path to a trusted TypeScript entrypoint beneath the operator
+ * runtime root. Absolute paths, Windows prefixes, NUL bytes, backslashes, empty
+ * segments, and `..` traversal are rejected at the contract boundary.
+ */
+export declare function isRelativeTrustedEntrypoint(entrypoint: string): boolean;
+export declare function isSha256IntegrityDigest(value: string): boolean;
+export declare function sha256IntegrityHex(value: string): string | undefined;
+//# sourceMappingURL=trusted-runtime.d.ts.map

package/dist/trusted-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-runtime.d.ts","sourceRoot":"","sources":["../src/trusted-runtime.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,EAAG,SAAkB,CAAC;AAK1D;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAgCvE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM9D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMpE"}

package/dist/trusted-runtime.js

@@ -0,0 +1,47 @@
+export const SHA256_INTEGRITY_PREFIX = "sha256:";
+const SHA256_HEX_PATTERN = /^[0-9a-fA-F]{64}$/;
+const WINDOWS_DRIVE_PATTERN = /^[A-Za-z]:/;
+/**
+ * Relative POSIX path to a trusted TypeScript entrypoint beneath the operator
+ * runtime root. Absolute paths, Windows prefixes, NUL bytes, backslashes, empty
+ * segments, and `..` traversal are rejected at the contract boundary.
+ */
+export function isRelativeTrustedEntrypoint(entrypoint) {
+    if (typeof entrypoint !== "string" || entrypoint.length === 0) {
+        return false;
+    }
+    if (entrypoint.includes("\0") ||
+        entrypoint.includes("\\") ||
+        entrypoint.startsWith("/") ||
+        entrypoint.startsWith("//") ||
+        WINDOWS_DRIVE_PATTERN.test(entrypoint)) {
+        return false;
+    }
+    const segments = entrypoint.split("/");
+    if (segments.length === 0) {
+        return false;
+    }
+    let hasFileSegment = false;
+    for (const segment of segments) {
+        if (segment.length === 0 || segment === "..") {
+            return false;
+        }
+        if (segment !== ".") {
+            hasFileSegment = true;
+        }
+    }
+    return hasFileSegment;
+}
+export function isSha256IntegrityDigest(value) {
+    if (typeof value !== "string" || !value.startsWith(SHA256_INTEGRITY_PREFIX)) {
+        return false;
+    }
+    return SHA256_HEX_PATTERN.test(value.slice(SHA256_INTEGRITY_PREFIX.length));
+}
+export function sha256IntegrityHex(value) {
+    if (!isSha256IntegrityDigest(value)) {
+        return undefined;
+    }
+    return value.slice(SHA256_INTEGRITY_PREFIX.length).toLowerCase();
+}
+//# sourceMappingURL=trusted-runtime.js.map

package/dist/trusted-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-runtime.js","sourceRoot":"","sources":["../src/trusted-runtime.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAkB,CAAC;AAE1D,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAC/C,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC3B,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;AACnE,CAAC"}