@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/cjs/channels/agent-session.js

@@ -0,0 +1,604 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentSession = void 0;
+exports.intersectNegotiatedRoles = intersectNegotiatedRoles;
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const crypto = __importStar(require("crypto"));
+const wake_channel_1 = require("./wake-channel");
+const data_channel_1 = require("./data-channel");
+const envelope_1 = require("../protocol/envelope");
+const validate_1 = require("../protocol/validate");
+const serialize_1 = require("../protocol/serialize");
+const constants_1 = require("../protocol/constants");
+class AgentSession {
+    wakeChannel;
+    dataChannel;
+    state;
+    opts;
+    inFlightRequests = new Map();
+    currentWakeEvent;
+    inboundGuard;
+    activeMessageHandler;
+    activeStateChangeHandler;
+    /** Explicit authoriser for tearing down a healthy session. Absent = deny. */
+    authoriseReplacement;
+    now;
+    sessionPolicy;
+    /**
+     * Timestamps of session-change attempts inside the current window, oldest
+     * first. Bounded: entries are trimmed by age and the array is hard-capped at
+     * `maxPerWindow * 4`, so a churn flood cannot grow it without limit.
+     */
+    sessionChanges = [];
+    constructor(opts) {
+        this.opts = opts;
+        this.activeMessageHandler = opts.onMessage;
+        this.activeStateChangeHandler = opts.onStateChange;
+        this.authoriseReplacement = opts.authoriseSessionReplacement;
+        this.now = opts.now ?? Date.now;
+        this.sessionPolicy = {
+            cooldownMs: opts.sessionChangeBudget?.cooldownMs ?? constants_1.DEFAULTS.SESSION_CHANGE_COOLDOWN_MS,
+            windowMs: opts.sessionChangeBudget?.windowMs ?? constants_1.DEFAULTS.SESSION_CHANGE_WINDOW_MS,
+            maxPerWindow: opts.sessionChangeBudget?.maxPerWindow ?? constants_1.DEFAULTS.SESSION_CHANGE_MAX_PER_WINDOW,
+        };
+        this.state = {
+            wake: 'disconnected',
+            data: 'closed',
+            has_in_flight: false,
+            reconnect_attempts: 0,
+            negotiated_roles: [],
+            envelope_mac_active: false,
+            envelope_authn_failures: 0,
+            session_replacements: 0,
+            session_replacement_rejections: 0,
+        };
+        if (this.opts.abortSignal) {
+            if (this.opts.abortSignal.aborted) {
+                this.stop().catch(() => { });
+            }
+            else {
+                this.opts.abortSignal.addEventListener('abort', () => {
+                    this.stop().catch((err) => {
+                        console.error('Error stopping AgentSession via abortSignal:', err);
+                    });
+                });
+            }
+        }
+    }
+    /** Start the agent. Boots wake channel. Returns when fully started. */
+    async start() {
+        this.updateState({
+            wake: 'connecting',
+        });
+        this.wakeChannel = new wake_channel_1.WakeChannel({
+            cloudUrl: this.opts.machineConfig.cloud_url,
+            token: this.opts.machineConfig.agent_token,
+            agentId: this.opts.machineConfig.agent_id,
+            getDatabases: this.opts.getDatabases,
+            onWake: (event) => this.handleWakeEvent(event),
+            onStateChange: (wakeState, error) => {
+                this.updateState({
+                    wake: wakeState,
+                    last_error: error || this.state.last_error,
+                    reconnect_attempts: this.wakeChannel ? this.wakeChannel.getReconnectAttempts() : 0,
+                    wake_connected_at: wakeState === 'connected' ? Date.now() : this.state.wake_connected_at,
+                });
+            },
+            abortSignal: this.opts.abortSignal,
+            ...this.opts.wakeChannelOverrides,
+        });
+        await this.wakeChannel.start();
+    }
+    /** Graceful shutdown. Closes data channel, then wake channel. */
+    async stop() {
+        if (this.dataChannel) {
+            await this.dataChannel.close('shutdown');
+            this.dataChannel = undefined;
+        }
+        this.clearInboundGuard();
+        if (this.wakeChannel) {
+            await this.wakeChannel.stop();
+            this.wakeChannel = undefined;
+        }
+    }
+    /**
+     * Send a message out via the data channel.
+     * If data channel is closed, opens it first (using current wake event's token).
+     * Throws if no wake event has been received yet (i.e., no token to open data channel).
+     */
+    async send(msg) {
+        if (this.state.data !== 'open' || !this.dataChannel) {
+            throw new serialize_1.ProtocolError('channel_closed', 'Data channel not open');
+        }
+        await this.dataChannel.send(msg);
+        // Track requests (not responses/events/chunks/ends/errors)
+        if (msg.type !== 'response' &&
+            msg.type !== 'error' &&
+            msg.type !== 'stream_chunk' &&
+            msg.type !== 'stream_end' &&
+            msg.type !== 'event') {
+            this.trackInFlight(msg.id, msg);
+        }
+    }
+    /** Register a message handler (overrides the one from opts). */
+    setMessageHandler(handler) {
+        this.activeMessageHandler = handler;
+    }
+    /**
+     * Resolve once this session's data channel has caught up: the send buffer is at
+     * or below its high-water mark and nothing earlier is still in flight.
+     *
+     * This is the transport signal a cursor fetch loop waits on (audit H-10), so
+     * the producer stops asking PostgreSQL for rows while the relay is behind.
+     * Hand it to the dispatcher as its `waitForDrain` option.
+     *
+     * Resolves immediately when there is no data channel — before the first wake
+     * event, or after the channel was torn down. A socket that will never drain
+     * again must not strand a producer, and the caller still observes the missing
+     * channel on its next {@link send}.
+     */
+    waitForDrain() {
+        return this.dataChannel ? this.dataChannel.waitForDrain() : Promise.resolve();
+    }
+    /** Register a state change handler (overrides the one from opts). */
+    onStateChange(handler) {
+        this.activeStateChangeHandler = handler;
+    }
+    /** Current state. */
+    getState() {
+        return this.state;
+    }
+    /**
+     * The envelope authenticator for the open data channel, or undefined before
+     * the first wake event. Exposed so diagnostics and tests can inspect the
+     * negotiated role set and replay-cache occupancy.
+     */
+    getInboundGuard() {
+        return this.inboundGuard;
+    }
+    /**
+     * Roles permitted for the current session. Empty until a wake event arrives,
+     * and empty — meaning nothing is permitted — if the relay negotiated none.
+     */
+    getNegotiatedRoles() {
+        return this.state.negotiated_roles;
+    }
+    /**
+     * Build the per-session inbound authenticator: derive the MAC key from the
+     * data-channel token, intersect the roles the relay asked for with the local
+     * ceiling, and start with an empty replay cache.
+     */
+    buildInboundGuard(event) {
+        const security = this.opts.machineConfig.security ?? {};
+        const policy = {
+            requireMac: this.opts.envelopeAuth?.requireMac ?? security.envelope_mac_required,
+            maxNegotiableRole: this.opts.envelopeAuth?.maxNegotiableRole ?? security.max_negotiable_role,
+        };
+        const requireMac = policy.requireMac ?? constants_1.ENVELOPE_MAC_REQUIRED_DEFAULT;
+        const ceiling = policy.maxNegotiableRole ?? envelope_1.ENVELOPE_MAX_NEGOTIABLE_ROLE_DEFAULT;
+        const browserSessionId = event.browser_session_id || 'unknown';
+        const allowedRoles = intersectNegotiatedRoles(event.allowed_roles, ceiling);
+        const macKey = (0, envelope_1.deriveSessionMacKey)({
+            dataChannelToken: event.data_channel_token,
+            agentId: this.opts.machineConfig.agent_id,
+            browserSessionId,
+        });
+        if (allowedRoles.length === 0) {
+            console.error('[authn] Data channel negotiated no usable role; every inbound envelope will be rejected. ' +
+                'The relay must send WakeEvent.allowed_roles for this session.');
+        }
+        if (!requireMac) {
+            console.error('[authn] WARNING: per-session envelope MAC verification is DISABLED by configuration. ' +
+                'Only the negotiated role set, freshness window and replay cache are enforced.');
+        }
+        return {
+            guard: new validate_1.InboundEnvelopeGuard({
+                macKey,
+                allowedRoles,
+                requireMac,
+                // The ceiling is applied twice on purpose. `intersectNegotiatedRoles`
+                // trims the set at session open; the guard re-checks every frame so a
+                // bug in that intersection, a replacement session, or any other
+                // construction path that hands the guard a wider set still cannot
+                // assert a role above the operator's ceiling.
+                maxNegotiableRole: ceiling,
+            }),
+            requireMac,
+        };
+    }
+    /**
+     * Authenticate one inbound envelope, then hand it on. A rejected envelope
+     * never reaches `onMessage` — and therefore never reaches the dispatcher — and
+     * the data channel is torn down rather than left open to a peer that is
+     * forging authorization claims.
+     */
+    handleInboundMessage(msg) {
+        const guard = this.inboundGuard;
+        if (!guard) {
+            const detail = 'No envelope authenticator is active for this data channel';
+            console.error(`[authn] rejected inbound envelope ${msg?.id ?? 'unknown'}: ${detail}`);
+            this.dataChannel?.forceClose('protocol_error', detail);
+            return;
+        }
+        try {
+            guard.verify(msg);
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            console.error(`[authn] rejected inbound envelope ${msg?.id ?? 'unknown'}: ${detail}`);
+            this.updateState({
+                envelope_authn_failures: this.state.envelope_authn_failures + 1,
+                last_envelope_authn_failure_at: Date.now(),
+                last_error: detail,
+            });
+            this.dataChannel?.forceClose('protocol_error', detail);
+            return;
+        }
+        return this.activeMessageHandler(msg);
+    }
+    /** Tear down the current authenticator so no envelope can be admitted. */
+    clearInboundGuard() {
+        if (this.inboundGuard) {
+            this.inboundGuard.reset();
+            this.inboundGuard = undefined;
+        }
+        this.updateState({ negotiated_roles: [], envelope_mac_active: false });
+    }
+    /**
+     * Track an in-flight request (for reconnect/resume).
+     * Called by execution engine before sending a request.
+     * Cleared when response is received.
+     */
+    trackInFlight(requestId, msg) {
+        this.inFlightRequests.set(requestId, msg);
+        this.updateState({ has_in_flight: this.inFlightRequests.size > 0 });
+    }
+    untrackInFlight(requestId) {
+        this.inFlightRequests.delete(requestId);
+        this.updateState({ has_in_flight: this.inFlightRequests.size > 0 });
+    }
+    getInFlight() {
+        return this.inFlightRequests;
+    }
+    handleWakeEvent(event) {
+        this.processWakeEvent(event).catch((err) => {
+            console.error('AgentSession: failed processing wake event:', err);
+        });
+    }
+    /**
+     * Decide what a wake event is allowed to do to the active data channel.
+     *
+     * Audit M-15. The previous implementation closed the live channel and opened a
+     * new one for ANY wake event carrying a different `browser_session_id`, which
+     * made session takeover and forced disconnection a single message, and
+     * orphaned every in-flight query on the old channel. The policy is now:
+     *
+     *   1. Same session while healthy → no-op (a duplicate wake for work already
+     *      being served).
+     *   2. A different `browser_session_id` while the current channel is HEALTHY
+     *      (open or connecting) → REPLACED only when the caller supplied an explicit
+     *      authoriser, otherwise REJECTED. Deny by default.
+     *   3. A different session while the current channel is DEAD (closed or error)
+     *      → replaced, because there is nothing to take over and refusing would
+     *      strand the agent.
+     *   4. No channel at all (first wake) → adopted.
+     *
+     * Session churn is additionally rate limited, so the 3 case cannot be turned
+     * into a cheaper denial of service than tearing the channel down once.
+     */
+    evaluateWakeEvent(event) {
+        const current = this.currentWakeEvent?.browser_session_id;
+        const incoming = event.browser_session_id || 'unknown';
+        const dataState = this.dataChannel ? this.dataChannel.getState() : this.state.data;
+        const healthy = dataState === 'open' || dataState === 'connecting';
+        if (!this.dataChannel) {
+            return { action: 'adopt', reason: 'no active data channel' };
+        }
+        if (current === incoming) {
+            if (healthy) {
+                // Re-delivery for the session already being served and healthy. Nothing to tear down.
+                return { action: 'noop', reason: 'wake event for the active browser session' };
+            }
+            // Same session re-waking after data channel closed or errored: re-establish immediately
+            return {
+                action: 'replace',
+                reason: `re-establishing data channel for session '${incoming}' (data channel ${dataState})`,
+                churn: { allowed: true, reason: 'same_session_recovery', replacements: this.sessionChanges.length },
+            };
+        }
+        // An authoriser only speaks for a healthy channel: replacing a dead one is
+        // recovery, not a security decision, and must not require a policy or be blocked by cooldown.
+        if (healthy) {
+            let authorised = false;
+            let authoriserConfigured = false;
+            if (this.authoriseReplacement) {
+                authoriserConfigured = true;
+                try {
+                    authorised = this.authoriseReplacement(event, this.currentWakeEvent) === true;
+                }
+                catch (err) {
+                    authorised = false;
+                    console.error('AgentSession: session replacement authoriser threw; denying:', err);
+                }
+            }
+            if (!authorised) {
+                return {
+                    action: 'reject',
+                    reason: `refused session replacement while browser session '${current ?? 'unknown'}' is still ` +
+                        `healthy (data channel ${dataState}): ` +
+                        (authoriserConfigured
+                            ? 'the configured authoriser declined'
+                            : 'no session replacement authoriser is configured (deny by default)'),
+                    churn: {
+                        allowed: false,
+                        reason: authoriserConfigured ? 'not authorised' : 'no authoriser configured',
+                        replacements: this.sessionChanges.length,
+                    },
+                };
+            }
+            const churn = this.checkChurnBudget();
+            if (!churn.allowed) {
+                return { action: 'reject', reason: churn.reason, churn };
+            }
+            return {
+                action: 'replace',
+                reason: `replacing browser session '${current ?? 'unknown'}' under explicit authorisation`,
+                churn,
+            };
+        }
+        return {
+            action: 'replace',
+            reason: `replacing dead browser session '${current ?? 'unknown'}' (data channel ${dataState})`,
+            churn: { allowed: true, reason: 'dead_channel_recovery', replacements: this.sessionChanges.length },
+        };
+    }
+    /**
+     * Bounded session-churn budget (audit M-15): at most
+     * DEFAULTS.SESSION_CHANGE_MAX_PER_WINDOW session changes inside any
+     * DEFAULTS.SESSION_CHANGE_WINDOW_MS window, and never two closer together than
+     * DEFAULTS.SESSION_CHANGE_COOLDOWN_MS. Deny by default when the budget is out.
+     */
+    checkChurnBudget() {
+        const now = this.now();
+        const window = this.sessionPolicy.windowMs;
+        const thisChange = {
+            at: now,
+            admitted: false,
+        };
+        while (this.sessionChanges.length > 0 && now - this.sessionChanges[0].at > window) {
+            this.sessionChanges.shift();
+        }
+        if (this.sessionChanges.length >= this.sessionPolicy.maxPerWindow) {
+            thisChange.admitted = false;
+            this.sessionChanges.push(thisChange);
+            if (this.sessionChanges.length > this.sessionPolicy.maxPerWindow * 4) {
+                this.sessionChanges.splice(0, this.sessionChanges.length - this.sessionPolicy.maxPerWindow);
+            }
+            return {
+                allowed: false,
+                reason: `session churn limit reached: ${this.sessionChanges.length} replacements within ${window}ms ` +
+                    `(max ${this.sessionPolicy.maxPerWindow})`,
+                replacements: this.sessionChanges.length,
+            };
+        }
+        const lastAdmitted = [...this.sessionChanges].reverse().find((entry) => entry.admitted);
+        if (lastAdmitted && now - lastAdmitted.at < this.sessionPolicy.cooldownMs) {
+            thisChange.admitted = false;
+            this.sessionChanges.push(thisChange);
+            return {
+                allowed: false,
+                reason: `session churn cooldown: the previous replacement was ${now - lastAdmitted.at}ms ago, ` +
+                    `minimum is ${this.sessionPolicy.cooldownMs}ms`,
+                replacements: this.sessionChanges.length,
+            };
+        }
+        thisChange.admitted = true;
+        this.sessionChanges.push(thisChange);
+        if (this.sessionChanges.length > this.sessionPolicy.maxPerWindow * 4) {
+            this.sessionChanges.splice(0, this.sessionChanges.length - this.sessionPolicy.maxPerWindow);
+        }
+        return {
+            allowed: true,
+            reason: 'within churn budget',
+            replacements: this.sessionChanges.length,
+        };
+    }
+    /**
+     * Every session replacement is a security event: the active channel is being
+     * torn down by a party that merely asserted a different session id. Recorded
+     * as a `system` actor (no principal is authenticated for this) through the
+     * same sink the dispatcher uses.
+     */
+    auditSessionAdmission(event, admission) {
+        if (admission.action === 'adopt' || admission.action === 'noop') {
+            return;
+        }
+        const replacing = this.currentWakeEvent?.browser_session_id ?? null;
+        const denied = admission.action === 'reject';
+        // Recorded as `cancel`/`cancelled` because `AuditAction` has no dedicated
+        // member for a session takeover (audit/types.ts is owned elsewhere); the
+        // reason strings below always name it as `session_replace` so the record is
+        // never ambiguous once that member exists.
+        this.opts.auditSink?.log({
+            project: '',
+            user_id: 'system',
+            actor: 'system',
+            role: 'system',
+            action: 'cancel',
+            decision: denied ? 'deny' : 'allow',
+            outcome: denied ? 'n/a' : 'cancelled',
+            permission_level: 'unknown',
+            denial_reason: denied ? `session_replace: ${admission.reason}` : undefined,
+            statement_preview: `session_replace: browser_session_id ${replacing ?? 'none'} -> ` +
+                `${event.browser_session_id || 'unknown'}; wake_id ${event.wake_id}; ` +
+                `reason ${admission.reason}`,
+        });
+        this.updateState(denied
+            ? {
+                session_replacement_rejections: this.state.session_replacement_rejections + 1,
+                last_error: admission.reason,
+            }
+            : { session_replacements: this.state.session_replacements + 1 });
+    }
+    /**
+     * Fail in-flight work explicitly when the channel is being torn down.
+     *
+     * The old behaviour silently dropped the tracking map, so those queries ran to
+     * completion against a channel that could no longer carry their responses. They
+     * are now cancelled at the backend (best effort) and removed from tracking, and
+     * `onInFlightDrained` lets the caller observe exactly what was lost.
+     */
+    async drainInFlight(reason) {
+        const ids = [...this.inFlightRequests.keys()];
+        for (const id of ids) {
+            this.inFlightRequests.delete(id);
+        }
+        this.updateState({ has_in_flight: this.inFlightRequests.size > 0 });
+        if (ids.length > 0) {
+            try {
+                await this.opts.onInFlightDrained?.(ids, reason);
+            }
+            catch (err) {
+                console.error('AgentSession: in-flight drain handler failed:', err);
+            }
+        }
+        return ids;
+    }
+    async processWakeEvent(event) {
+        const admission = this.evaluateWakeEvent(event);
+        if (admission.action === 'noop') {
+            return;
+        }
+        if (admission.action === 'reject') {
+            this.auditSessionAdmission(event, admission);
+            console.warn(`AgentSession: ${admission.reason}`);
+            return;
+        }
+        this.auditSessionAdmission(event, admission);
+        if (this.dataChannel) {
+            const drained = await this.drainInFlight('explicit_close');
+            if (drained.length > 0) {
+                console.warn(`AgentSession: ${admission.reason}; ${drained.length} in-flight request(s) were ` +
+                    `explicitly failed rather than orphaned: ${drained.join(', ')}`);
+            }
+            await this.dataChannel.close('explicit_close').catch(() => { });
+            this.dataChannel = undefined;
+        }
+        this.clearInboundGuard();
+        this.currentWakeEvent = event;
+        const { guard, requireMac } = this.buildInboundGuard(event);
+        this.inboundGuard = guard;
+        this.updateState({
+            negotiated_roles: guard.getAllowedRoles(),
+            envelope_mac_active: requireMac,
+        });
+        this.dataChannel = new data_channel_1.DataChannel({
+            cloudUrl: this.opts.machineConfig.cloud_url,
+            dataChannelToken: event.data_channel_token,
+            dataChannelTokenExpiresAt: event.data_channel_token_expires_at,
+            agentId: this.opts.machineConfig.agent_id,
+            browserSessionId: event.browser_session_id || 'unknown',
+            onMessage: (msg) => this.handleInboundMessage(msg),
+            onStateChange: (dataState, _reason, error) => {
+                this.updateState({
+                    data: dataState,
+                    last_error: error || this.state.last_error,
+                    data_opened_at: dataState === 'open' ? Date.now() : this.state.data_opened_at,
+                });
+            },
+            abortSignal: this.opts.abortSignal,
+        });
+        try {
+            await this.dataChannel.connect();
+        }
+        catch (err) {
+            console.error('AgentSession: failed to connect data channel:', err);
+            return;
+        }
+        // Fast-track request if needed
+        if (event.request_id) {
+            const inFlightMsg = this.inFlightRequests.get(event.request_id);
+            if (inFlightMsg) {
+                const resumeEvent = {
+                    v: 1,
+                    id: crypto.randomUUID(),
+                    type: 'event',
+                    project: inFlightMsg.project,
+                    user: inFlightMsg.user,
+                    db_alias: inFlightMsg.db_alias,
+                    ts: Date.now(),
+                    payload: {
+                        kind: 'resume_request',
+                        data: {
+                            request_id: event.request_id,
+                        },
+                    },
+                };
+                this.send(resumeEvent).catch((sendErr) => {
+                    console.error('Failed to send resume_request event:', sendErr);
+                });
+            }
+        }
+    }
+    updateState(diff) {
+        this.state = { ...this.state, ...diff };
+        if (this.activeStateChangeHandler) {
+            this.activeStateChangeHandler(this.state);
+        }
+    }
+}
+exports.AgentSession = AgentSession;
+/**
+ * Roles the connector will accept for this session: the roles the relay
+ * negotiated, minus anything above the local ceiling, minus anything that is not
+ * a legal role. Returned in the canonical `ROLES` order.
+ *
+ * An absent, empty, or wholly invalid `allowed_roles` yields an empty set, which
+ * the guard treats as "no role is permitted" — there is no fallback to "all
+ * roles", because that fallback is the C-04 vulnerability.
+ */
+function intersectNegotiatedRoles(negotiated, ceiling = envelope_1.ENVELOPE_MAX_NEGOTIABLE_ROLE_DEFAULT) {
+    if (!Array.isArray(negotiated)) {
+        return [];
+    }
+    const permitted = new Set(negotiated.filter(envelope_1.isRole));
+    const ceilingRole = (0, envelope_1.isRole)(ceiling) ? ceiling : envelope_1.ENVELOPE_MAX_NEGOTIABLE_ROLE_DEFAULT;
+    // ROLES is ordered most- to least-privileged, so a role is within the ceiling
+    // when it sits at or below the ceiling's rank.
+    const ceilingRank = envelope_1.ROLES.indexOf(ceilingRole);
+    return envelope_1.ROLES.filter((role) => permitted.has(role) && envelope_1.ROLES.indexOf(role) >= ceilingRank);
+}
+//# sourceMappingURL=agent-session.js.map

package/dist/cjs/channels/agent-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-session.js","sourceRoot":"","sources":["../../../src/channels/agent-session.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAktBA,4DAaC;AA/tBD,uDAAuD;AACvD,+CAAiC;AACjC,iDAAiE;AACjE,iDAA6C;AAC7C,mDAO8B;AAC9B,mDAA4D;AAC5D,qDAAsD;AACtD,qDAAgF;AA2FhF,MAAa,YAAY;IACf,WAAW,CAAe;IAC1B,WAAW,CAAe;IAC1B,KAAK,CAAoB;IAChB,IAAI,CAAsB;IACnC,gBAAgB,GAA8B,IAAI,GAAG,EAAE,CAAC;IACxD,gBAAgB,CAAa;IAC7B,YAAY,CAAwB;IAEpC,oBAAoB,CAAiB;IACrC,wBAAwB,CAAsB;IAEtD,6EAA6E;IAC5D,oBAAoB,CAAsD;IAC1E,GAAG,CAAe;IAClB,aAAa,CAI5B;IACF;;;;OAIG;IACc,cAAc,GAA6C,EAAE,CAAC;IAE/E,YAAY,IAAyB;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3C,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,aAAa,CAAC;QACnD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,2BAA2B,CAAC;QAC7D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG;YACnB,UAAU,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,IAAI,oBAAQ,CAAC,0BAA0B;YACvF,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,IAAI,oBAAQ,CAAC,wBAAwB;YACjF,YAAY,EACV,IAAI,CAAC,mBAAmB,EAAE,YAAY,IAAI,oBAAQ,CAAC,6BAA6B;SACnF,CAAC;QAEF,IAAI,CAAC,KAAK,GAAG;YACX,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,QAAQ;YACd,aAAa,EAAE,KAAK;YACpB,kBAAkB,EAAE,CAAC;YACrB,gBAAgB,EAAE,EAAE;YACpB,mBAAmB,EAAE,KAAK;YAC1B,uBAAuB,EAAE,CAAC;YAC1B,oBAAoB,EAAE,CAAC;YACvB,8BAA8B,EAAE,CAAC;SAClC,CAAC;QAEF,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;oBACnD,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;wBACxB,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;oBACrE,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,WAAW,CAAC;YACf,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,0BAAW,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW;YAC1C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ;YACzC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;YAC9C,aAAa,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;gBAClC,IAAI,CAAC,WAAW,CAAC;oBACf,IAAI,EAAE,SAAS;oBACf,UAAU,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU;oBAC1C,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,CAAC;oBAClF,iBAAiB,EAAE,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB;iBACzF,CAAC,CAAC;YACL,CAAC;YACD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB;SAClC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACzC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,GAAiB;QAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,IAAI,yBAAa,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjC,2DAA2D;QAC3D,IACE,GAAG,CAAC,IAAI,KAAK,UAAU;YACvB,GAAG,CAAC,IAAI,KAAK,OAAO;YACpB,GAAG,CAAC,IAAI,KAAK,cAAc;YAC3B,GAAG,CAAC,IAAI,KAAK,YAAY;YACzB,GAAG,CAAC,IAAI,KAAK,OAAO,EACpB,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,iBAAiB,CAAC,OAAuB;QACvC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC;IAED,qEAAqE;IACrE,aAAa,CAAC,OAA2B;QACvC,IAAI,CAAC,wBAAwB,GAAG,OAAO,CAAC;IAC1C,CAAC;IAED,qBAAqB;IACrB,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACK,iBAAiB,CAAC,KAAgB;QAIxC,MAAM,QAAQ,GACX,IAAI,CAAC,IAAI,CAAC,aAAiE,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC9F,MAAM,MAAM,GAAuB;YACjC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,QAAQ,CAAC,qBAAqB;YAChF,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,IAAI,QAAQ,CAAC,mBAAmB;SAC7F,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,yCAA6B,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,IAAI,+CAAoC,CAAC;QACjF,MAAM,gBAAgB,GAAG,KAAK,CAAC,kBAAkB,IAAI,SAAS,CAAC;QAC/D,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAA,8BAAmB,EAAC;YACjC,gBAAgB,EAAE,KAAK,CAAC,kBAAkB;YAC1C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ;YACzC,gBAAgB;SACjB,CAAC,CAAC;QAEH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CACX,2FAA2F;gBACzF,+DAA+D,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CACX,uFAAuF;gBACrF,+EAA+E,CAClF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI,+BAAoB,CAAC;gBAC9B,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,sEAAsE;gBACtE,sEAAsE;gBACtE,gEAAgE;gBAChE,kEAAkE;gBAClE,8CAA8C;gBAC9C,iBAAiB,EAAE,OAAO;aAC3B,CAAC;YACF,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,GAAiB;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,2DAA2D,CAAC;YAC3E,OAAO,CAAC,KAAK,CAAC,qCAAqC,GAAG,EAAE,EAAE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,OAAO,CAAC,KAAK,CAAC,qCAAqC,GAAG,EAAE,EAAE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,CAAC;gBACf,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC;gBAC/D,8BAA8B,EAAE,IAAI,CAAC,GAAG,EAAE;gBAC1C,UAAU,EAAE,MAAM;aACnB,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,0EAA0E;IAClE,iBAAiB;QACvB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,SAAiB,EAAE,GAAiB;QAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAEO,eAAe,CAAC,KAAgB;QACtC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACzC,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,iBAAiB,CAAC,KAAgB;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,kBAAkB,IAAI,SAAS,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACnF,MAAM,OAAO,GAAG,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,YAAY,CAAC;QAEnE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC/D,CAAC;QAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,IAAI,OAAO,EAAE,CAAC;gBACZ,sFAAsF;gBACtF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;YACjF,CAAC;YACD,wFAAwF;YACxF,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,6CAA6C,QAAQ,mBAAmB,SAAS,GAAG;gBAC5F,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE;aACpG,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,8FAA8F;QAC9F,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,oBAAoB,GAAG,KAAK,CAAC;YACjC,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC9B,oBAAoB,GAAG,IAAI,CAAC;gBAC5B,IAAI,CAAC;oBACH,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC;gBAChF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,UAAU,GAAG,KAAK,CAAC;oBACnB,OAAO,CAAC,KAAK,CAAC,8DAA8D,EAAE,GAAG,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,MAAM,EACJ,sDAAsD,OAAO,IAAI,SAAS,aAAa;wBACvF,yBAAyB,SAAS,KAAK;wBACvC,CAAC,oBAAoB;4BACnB,CAAC,CAAC,oCAAoC;4BACtC,CAAC,CAAC,mEAAmE,CAAC;oBAC1E,KAAK,EAAE;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,0BAA0B;wBAC5E,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;qBACzC;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3D,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,8BAA8B,OAAO,IAAI,SAAS,gCAAgC;gBAC1F,KAAK;aACN,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,mCAAmC,OAAO,IAAI,SAAS,mBAAmB,SAAS,GAAG;YAC9F,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE;SACpG,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,gBAAgB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC3C,MAAM,UAAU,GAAG;YACjB,EAAE,EAAE,GAAG;YACP,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;YAClF,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC9B,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;YAClE,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,gCAAgC,IAAI,CAAC,cAAc,CAAC,MAAM,wBAAwB,MAAM,KAAK;oBAC7F,QAAQ,IAAI,CAAC,aAAa,CAAC,YAAY,GAAG;gBAC5C,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;aACzC,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxF,IAAI,YAAY,IAAI,GAAG,GAAG,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YAC1E,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,wDAAwD,GAAG,GAAG,YAAY,CAAC,EAAE,UAAU;oBACvF,cAAc,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI;gBACjD,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;aACzC,CAAC;QACJ,CAAC;QAED,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,qBAAqB;YAC7B,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;SACzC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,KAAgB,EAAE,SAA2B;QACzE,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChE,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,IAAI,IAAI,CAAC;QACpE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC;QAE7C,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,2CAA2C;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;YACvB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACnC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW;YACrC,gBAAgB,EAAE,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1E,iBAAiB,EACf,uCAAuC,SAAS,IAAI,MAAM,MAAM;gBAChE,GAAG,KAAK,CAAC,kBAAkB,IAAI,SAAS,aAAa,KAAK,CAAC,OAAO,IAAI;gBACtE,UAAU,SAAS,CAAC,MAAM,EAAE;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CACd,MAAM;YACJ,CAAC,CAAC;gBACE,8BAA8B,EAAE,IAAI,CAAC,KAAK,CAAC,8BAA8B,GAAG,CAAC;gBAC7E,UAAU,EAAE,SAAS,CAAC,MAAM;aAC7B;YACH,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CAAC,MAA8B;QACxD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,KAAgB;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAEhD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAE7C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;YAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CACV,iBAAiB,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,6BAA6B;oBAC/E,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClE,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAC9B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC;YACf,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE;YACzC,mBAAmB,EAAE,UAAU;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,0BAAW,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,gBAAgB,EAAE,KAAK,CAAC,kBAAkB;YAC1C,yBAAyB,EAAE,KAAK,CAAC,6BAA6B;YAC9D,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ;YACzC,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,IAAI,SAAS;YACvD,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC;YAClD,aAAa,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;gBAC3C,IAAI,CAAC,WAAW,CAAC;oBACf,IAAI,EAAE,SAAS;oBACf,UAAU,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU;oBAC1C,cAAc,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc;iBAC9E,CAAC,CAAC;YACL,CAAC;YACD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG;oBAClB,CAAC,EAAE,CAAC;oBACJ,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;oBACvB,IAAI,EAAE,OAAgB;oBACtB,OAAO,EAAE,WAAW,CAAC,OAAO;oBAC5B,IAAI,EAAE,WAAW,CAAC,IAAI;oBACtB,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;oBACd,OAAO,EAAE;wBACP,IAAI,EAAE,gBAAyB;wBAC/B,IAAI,EAAE;4BACJ,UAAU,EAAE,KAAK,CAAC,UAAU;yBAC7B;qBACF;iBACF,CAAC;gBACF,IAAI,CAAC,IAAI,CAAC,WAA2B,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;oBACvD,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,OAAO,CAAC,CAAC;gBACjE,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,IAAgC;QAClD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAClC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;CACF;AA9lBD,oCA8lBC;AAED;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,UAA0C,EAC1C,UAAgB,+CAAoC;IAEpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,iBAAM,CAAC,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,IAAA,iBAAM,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,+CAAoC,CAAC;IACrF,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAM,WAAW,GAAG,gBAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,gBAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,gBAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC;AAC3F,CAAC"}