@stigmer/runner 0.1.0-dev.20261017020314.g644422724c27

package/dist/agent-proxy/cursor-lane.js

@@ -0,0 +1,507 @@
+/**
+ * The local proxy's Cursor lane: where the agent host's Cursor SDK sends
+ * everything, and the one place the Cursor credentials are used (#2016).
+ *
+ * It is a listener of its own, beside the model lanes' (`server.ts`): TLS on
+ * `127.0.0.1` (written as a number, {@link LOOPBACK_AS_NUMBER} says why)
+ * with a certificate made at each runner start
+ * (`loopback-certificate.ts`), serving HTTP/2 and HTTP/1.1 on one port. The
+ * SDK opens its agent run as an HTTP/2 bidirectional stream only for an
+ * `https:` backend, and that stream is the wire the Stigmer platform's proxy
+ * serves, so the host's SDK is pointed here (`CURSOR_BACKEND_URL`) and
+ * trusts this certificate alone (`agent-host/hosting.ts`).
+ *
+ * The host's Cursor harness runs as a proxy-mode client (its interceptors,
+ * `activities/execute-cursor/`), so the lane receives two shapes:
+ *
+ *  - REST, `/v1/proxy/cursor/<cursor host><path>`, over HTTP/1.1 (the SDK's
+ *    `fetch`): the API-key exchange, the model list, agent CRUD. The host's
+ *    token is in `Authorization` and the call must name a live execution;
+ *    only Cursor's own hosts are reached.
+ *  - Connect, `/agent.v1.*` and `/aiserver.v1.*`, over HTTP/2 or HTTP/1.1:
+ *    the agent run and the SDK's side calls. `Authorization` carries the
+ *    access token the SDK got from the exchange — which, here, is a
+ *    stand-in.
+ *
+ * Custody of the Cursor access token: the exchange is made with the
+ * runner's credential (the operator's `CURSOR_API_KEY`, or through the
+ * platform's proxy, which adds the organization's key), and the access
+ * token that comes
+ * back stays here. The host receives a stand-in, random and worthless
+ * elsewhere, shaped so the SDK reads the real token's expiry from it (it
+ * decodes the second dot-separated part for `exp`, and assumes thirty
+ * minutes when it cannot); every Connect call swaps the stand-in back for
+ * the real token on its way out. A stand-in the lane does not hold — a new
+ * host's, after the old one died — is refused as unauthenticated, and the
+ * SDK answers that by exchanging again, as it does when a real token
+ * expires.
+ *
+ * Two upstream modes, as for the model lanes (`lanes.ts`):
+ *
+ *  - Forward (the runner talks to the Stigmer platform's proxy): REST goes
+ *    to the same path there with the runner's proxy credential; Connect goes
+ *    to the platform's Cursor lane with the real access token in
+ *    `Authorization` and the runner's credential in `x-stigmer-auth`, as the
+ *    runner's own interceptors sent it before the harness moved here.
+ *  - Terminate (the runner calls Cursor itself): REST and Connect go to
+ *    Cursor (`CURSOR_BACKEND_URL` on the runner, else Cursor's own hosts),
+ *    REST with the operator's key, Connect with the real access token.
+ *
+ * Bounds, the same as every lane's: the host's token for REST, a held
+ * stand-in for Connect; a live turn's execution for every call but the
+ * SDK's unscoped side calls (`/aiserver.v1.*`, the platform's lane serves
+ * those unscoped too); the execution id is the one scope header forwarded.
+ * Of Cursor's `aiserver.v1` surface, only the methods the SDK itself calls
+ * are relayed ({@link CURSOR_SIDE_CALLS}): the rest, which carry the real
+ * token just the same, include one that mints an API key from it.
+ */
+import { randomBytes } from "node:crypto";
+import { connect as connectHttp2, constants as http2Constants, createSecureServer, } from "node:http2";
+import { LaneRefusal, laneUrl } from "./lanes.js";
+import { mintLoopbackCertificate } from "./loopback-certificate.js";
+import { RequestTooLargeError, bearerOf, forwardableHeaders, readBody, relay, requestWhole } from "./relay.js";
+/** Cursor's own hosts: the only ones the REST lane reaches. */
+const CURSOR_HOSTS = ["api2.cursor.sh", "api.cursor.com", "api.cursor.sh"];
+const REST_PREFIX = "/v1/proxy/cursor/";
+const EXCHANGE_PATH = "/auth/exchange_user_api_key";
+const AGENT_PREFIX = "/agent.v1.";
+const SIDE_CALL_PREFIX = "/aiserver.v1.";
+/** The one `agent.v1` method `@cursor/sdk` 1.0.31 calls: the agent run. */
+const AGENT_RUN = "/agent.v1.AgentService/Run";
+/**
+ * The `aiserver.v1` methods the Cursor SDK calls through a client, read from
+ * `@cursor/sdk` 1.0.31's bundle (#2083), through a client or by `fetch`: its
+ * server config, telemetry and feature flags (`BootstrapStatsig`), and the
+ * dashboard reads for privacy mode, team settings, plugins and skills.
+ * Each dashboard read falls back to a default when it fails. Left out on
+ * purpose: `DashboardService/CreateUserApiKey` (the SDK's login flow, which
+ * mints a key from the access token) and `BidiService/BidiAppend` (the
+ * HTTP/1.1 imitation of the agent run, which an HTTP/2 lane never needs).
+ * The real-SDK wire test (`__tests__/cursor-sdk-wire.test.ts`) fails when
+ * the SDK makes a side call this list leaves out.
+ */
+export const CURSOR_SIDE_CALLS = new Set([
+    "/aiserver.v1.ServerConfigService/GetServerConfig",
+    "/aiserver.v1.AnalyticsService/TrackEvents",
+    "/aiserver.v1.AnalyticsService/BootstrapStatsig",
+    "/aiserver.v1.DashboardService/GetUserPrivacyMode",
+    "/aiserver.v1.DashboardService/GetTeamReposOrEmptyIfNotInTeam",
+    "/aiserver.v1.DashboardService/GetTeamAdminSettingsOrEmptyIfNotInTeam",
+    "/aiserver.v1.DashboardService/GetEffectiveUserPlugins",
+    "/aiserver.v1.DashboardService/ResolvePluginsByRef",
+    "/aiserver.v1.DashboardService/GetManagedSkills",
+]);
+const DEFAULT_CONNECT_UPSTREAM = "https://api2.cursor.sh";
+/**
+ * 127.0.0.1 written as one number, which every URL parser reads as
+ * 127.0.0.1 (WHATWG's IPv4 parser; `fetch`, `http2.connect` and the TLS
+ * identity check all see that address). The Cursor SDK sets
+ * `NODE_TLS_REJECT_UNAUTHORIZED=0` for its whole process whenever its
+ * backend URL's text matches `://localhost` or `://127.0.0.1` (`Agent.create`,
+ * SDK 1.0.31): written as a number, the lane's address does not match, so
+ * the host and every process an agent starts keep verifying certificates.
+ */
+const LOOPBACK_AS_NUMBER = "2130706433";
+export class CursorLane {
+    server;
+    endpoint;
+    certPem;
+    config;
+    gate;
+    custody = new TokenCustody();
+    /**
+     * The upstream HTTP/2 sessions, by the host's session they serve and then
+     * by origin. A host that resets its transport (the Cursor harness does at
+     * every turn start and on a transport timeout) gets fresh upstream
+     * connections with its new one, so a recovery never reuses a degraded one.
+     */
+    upstreams = new Map();
+    /** Every connection a host has open to the lane, so a close does not wait on them. */
+    inbound = new Set();
+    constructor(server, 
+    /** `https://2130706433:<port>`, 127.0.0.1 written as one number so the Cursor SDK keeps certificate checks on (`agent-proxy/cursor-lane.ts`). */
+    endpoint, 
+    /** The certificate the host trusts, PEM. */
+    certPem, config, gate) {
+        this.server = server;
+        this.endpoint = endpoint;
+        this.certPem = certPem;
+        this.config = config;
+        this.gate = gate;
+    }
+    static async start(config, gate) {
+        const { certPem, keyPem } = mintLoopbackCertificate();
+        let lane;
+        const server = createSecureServer({ cert: certPem, key: keyPem, allowHTTP1: true }, (req, res) => {
+            void lane.handle(req, res);
+        });
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", () => resolve());
+        });
+        server.unref();
+        const { port } = server.address();
+        lane = new CursorLane(server, `https://${LOOPBACK_AS_NUMBER}:${port}`, certPem, config, gate);
+        const inbound = lane.inbound;
+        server.on("connection", (socket) => {
+            inbound.add(socket);
+            socket.once("close", () => inbound.delete(socket));
+        });
+        return lane;
+    }
+    /** Forget every stand-in: a new host holds none of the old one's. */
+    resetCustody() {
+        this.custody.clear();
+    }
+    /** Close the listener, ending every connection a host still holds, as the model lanes' listener does. */
+    close() {
+        for (const sessions of this.upstreams.values())
+            for (const session of sessions.values())
+                session.destroy();
+        this.upstreams.clear();
+        const closed = new Promise((resolve) => this.server.close(() => resolve()));
+        for (const socket of this.inbound)
+            socket.destroy();
+        return closed;
+    }
+    async handle(req, res) {
+        const url = new URL(req.url ?? "/", "https://cursor-lane");
+        const path = url.pathname;
+        try {
+            if (path.startsWith(REST_PREFIX)) {
+                await this.rest(req, res, path.slice(REST_PREFIX.length), url.search);
+                return;
+            }
+            if (path.startsWith(SIDE_CALL_PREFIX) && !CURSOR_SIDE_CALLS.has(path)) {
+                throw new LaneRefusal(403, `the Cursor lane relays only the Cursor SDK's own side calls, not ${path}`);
+            }
+            if (path.startsWith(AGENT_PREFIX) && path !== AGENT_RUN) {
+                throw new LaneRefusal(403, `the Cursor lane relays only the Cursor SDK's agent run, not ${path}`);
+            }
+            if (path.startsWith(AGENT_PREFIX) || path.startsWith(SIDE_CALL_PREFIX)) {
+                await this.connect(req, res, `${path}${url.search}`, path.startsWith(AGENT_PREFIX));
+                return;
+            }
+            throw new LaneRefusal(404, `the Cursor lane serves no path ${path}`);
+        }
+        catch (err) {
+            const refusal = err instanceof LaneRefusal ? err
+                : err instanceof RequestTooLargeError ? new LaneRefusal(413, err.message)
+                    : new LaneRefusal(502, err instanceof Error ? err.message : String(err));
+            console.warn(`[agent-proxy] refused ${req.method ?? "?"} ${path}: ${refusal.status} ${refusal.message}`);
+            replyConnectError(res, refusal.status, refusal.message);
+        }
+    }
+    /** `/v1/proxy/cursor/<host><path>`: the host's token, a live execution, a Cursor host. */
+    async rest(req, res, hostAndPath, search) {
+        if (!this.gate.isHostToken(bearerOf(req.headers.authorization))) {
+            throw new LaneRefusal(401, "the agent proxy accepts the current agent host's token only");
+        }
+        this.gate.requireLiveExecution(req);
+        const slash = hostAndPath.indexOf("/");
+        const host = slash === -1 ? hostAndPath : hostAndPath.slice(0, slash);
+        const path = slash === -1 ? "" : hostAndPath.slice(slash);
+        // Cursor's Connect services are the Connect paths' alone, which hold
+        // them to the SDK's own calls; REST never reaches them, by any spelling
+        // a server could read as one (an escape, a doubled slash, another case).
+        const canonical = canonicalPath(path);
+        if (canonical === undefined || canonical.includes(SIDE_CALL_PREFIX) || canonical.includes(AGENT_PREFIX)) {
+            throw new LaneRefusal(403, `the Cursor lane's REST path reaches no Connect service, not ${path}`);
+        }
+        const rest = `${path}${search}`;
+        const known = cursorHostNamed(host);
+        if (known === undefined)
+            throw new LaneRefusal(403, `the Cursor lane reaches Cursor's own hosts only, not ${host}`);
+        const exchange = path === EXCHANGE_PATH;
+        // Custody turns on this one path. Any other spelling that a server could
+        // read as the auth API (a trailing or doubled slash, an escape, another
+        // case) is refused, so no answer carrying a token is relayed unchanged.
+        if (!exchange && readsAsAuthPath(path))
+            throw new LaneRefusal(403, "the Cursor lane serves the auth API at its key exchange's own path only");
+        const body = await readBody(req);
+        const forward = this.config.proxyEndpoint !== null;
+        const upstream = forward ?
+            {
+                url: laneUrl(this.config.proxyEndpoint, `/v1/proxy/cursor/${known}${rest}`),
+                method: req.method ?? "GET",
+                headers: { ...forwardableHeaders(req.headers, true), authorization: `Bearer ${this.runnerCredential()}` },
+                body,
+            }
+            : {
+                url: laneUrl(process.env.CURSOR_BACKEND_URL?.trim() || `https://${known}`, rest),
+                method: req.method ?? "GET",
+                headers: { ...forwardableHeaders(req.headers, false), authorization: `Bearer ${this.operatorKey()}` },
+                body,
+            };
+        if (!exchange) {
+            await relay(res, upstream);
+            return;
+        }
+        // The exchange: the access token stays here; the host gets a stand-in.
+        const answer = await requestWhole(upstream);
+        let out = answer.body;
+        if (answer.status >= 200 && answer.status < 300) {
+            // Custody fails closed: an answer this lane cannot take the token out
+            // of never reaches the host, and no refresh token ever does.
+            const parsed = parseJsonObject(answer.body);
+            if (parsed === undefined || typeof parsed.accessToken !== "string" || parsed.accessToken.length === 0) {
+                throw new LaneRefusal(502, "Cursor's key exchange answered without an access token");
+            }
+            const { refreshToken: _dropped, ...kept } = parsed;
+            out = Buffer.from(JSON.stringify({ ...kept, accessToken: this.custody.hold(parsed.accessToken) }));
+        }
+        const headers = { ...answer.headers, "content-length": String(out.length) };
+        res.writeHead(answer.status, headers);
+        res.end(out);
+    }
+    /** A Connect call: a held stand-in, a live execution for the agent run, the real token on the way out. */
+    async connect(req, res, pathAndQuery, scoped) {
+        const real = this.custody.real(bearerOf(req.headers.authorization));
+        if (real === undefined)
+            throw new LaneRefusal(401, "the Cursor lane holds no such access token; exchange the API key again");
+        if (scoped)
+            this.gate.requireLiveExecution(req);
+        const forward = this.config.proxyEndpoint !== null;
+        const base = forward ? this.config.proxyEndpoint : process.env.CURSOR_BACKEND_URL?.trim() || DEFAULT_CONNECT_UPSTREAM;
+        const headers = {
+            // The execution id goes on only once this lane has checked it names a
+            // live turn: the agent run's. A side call's claim is dropped.
+            ...forwardableHeaders(req.headers, forward && scoped),
+            authorization: `Bearer ${real}`,
+            ...(forward ? { "x-stigmer-auth": `Bearer ${this.runnerCredential()}` } : {}),
+        };
+        const url = laneUrl(base, pathAndQuery);
+        if (req.httpVersionMajor === 2) {
+            await this.relayStream(req, res, url, headers);
+            return;
+        }
+        await relay(res, { url, method: req.method ?? "POST", headers, body: await readBody(req) });
+    }
+    /**
+     * One HTTP/2 stream, relayed both ways as it flows: the agent run is a
+     * bidirectional stream, so neither side is buffered. The upstream's
+     * headers, data and trailers come back as they were; either side's reset
+     * resets the other, with its own code, so a cut-off answer never reads as
+     * a complete one. The relay is done when the upstream stream closes,
+     * however it closes.
+     */
+    relayStream(req, res, url, headers) {
+        return new Promise((resolve) => {
+            // The host's session is live while its request is handled: the relay
+            // starts in the same tick the lane checked the stand-in.
+            const session = this.session(req.stream.session, url.origin);
+            const outgoing = {
+                ...headers,
+                [http2Constants.HTTP2_HEADER_METHOD]: req.method,
+                [http2Constants.HTTP2_HEADER_PATH]: `${url.pathname}${url.search}`,
+            };
+            const upstream = session.request(outgoing);
+            // A host that drops its stream abandons the run: cancel it at Cursor
+            // rather than let the request's end read as "nothing more to send".
+            // (`res.writableFinished` reads true once the host's stream is gone,
+            // so the upstream's own state decides.)
+            const abandon = () => {
+                if (!upstream.closed)
+                    upstream.close(http2Constants.NGHTTP2_CANCEL);
+            };
+            res.on("close", abandon);
+            req.pipe(upstream);
+            upstream.on("response", (answer) => {
+                const relayed = {};
+                for (const [name, value] of Object.entries(answer)) {
+                    if (!name.startsWith(":") && value !== undefined)
+                        relayed[name] = value;
+                }
+                res.writeHead(Number(answer[http2Constants.HTTP2_HEADER_STATUS] ?? 502), relayed);
+                upstream.pipe(res, { end: false });
+            });
+            upstream.on("trailers", (trailers) => {
+                const relayed = {};
+                for (const [name, value] of Object.entries(trailers)) {
+                    if (!name.startsWith(":") && value !== undefined)
+                        relayed[name] = value;
+                }
+                res.addTrailers(relayed);
+            });
+            let failed = false;
+            // How the host's stream ends follows how Cursor's ended. Node emits
+            // `end` both for a clean END_STREAM and for a reset that cut the
+            // answer off, but marks the reset (its code, and `aborted` while this
+            // side is still sending) before that `end`: so a clean end ends the host's stream with its trailers, and
+            // a reset resets it with Cursor's code. A stream that closes without
+            // either (its session gone) is reset too: a cut-off answer never reads
+            // as a complete one.
+            const reset = () => {
+                if (failed || res.writableEnded || res.stream.closed)
+                    return;
+                const code = upstream.rstCode;
+                res.stream.close(code !== undefined && code !== http2Constants.NGHTTP2_NO_ERROR ? code : http2Constants.NGHTTP2_CANCEL);
+            };
+            upstream.on("end", () => {
+                const code = upstream.rstCode;
+                if (upstream.aborted || (code !== undefined && code !== http2Constants.NGHTTP2_NO_ERROR))
+                    reset();
+                else if (!res.writableEnded)
+                    res.end();
+            });
+            res.once("close", () => resolve());
+            upstream.on("close", () => {
+                res.off("close", abandon);
+                reset();
+                resolve();
+            });
+            upstream.on("error", (err) => {
+                failed = true;
+                res.off("close", abandon);
+                console.warn(`[agent-proxy] the Cursor stream ${url.pathname} failed upstream: ${err.message}`);
+                if (res.headersSent)
+                    res.stream.close(http2Constants.NGHTTP2_INTERNAL_ERROR);
+                else
+                    replyConnectError(res, 502, `the upstream could not be reached: ${err.message}`);
+                resolve();
+            });
+        });
+    }
+    /** The upstream session to `origin` for the host's session `inbound`, opened on first use and ended with it. */
+    session(inbound, origin) {
+        let byOrigin = this.upstreams.get(inbound);
+        if (byOrigin === undefined) {
+            const sessions = new Map();
+            byOrigin = sessions;
+            this.upstreams.set(inbound, sessions);
+            // Closed, not destroyed: each stream still open is cancelled at Cursor
+            // by its own relay as the host's side of it closes.
+            inbound.once("close", () => {
+                this.upstreams.delete(inbound);
+                for (const session of sessions.values())
+                    session.close();
+            });
+        }
+        const open = byOrigin.get(origin);
+        if (open && !open.closed && !open.destroyed)
+            return open;
+        const session = connectHttp2(origin);
+        session.unref();
+        const sessions = byOrigin;
+        const forget = () => {
+            if (sessions.get(origin) === session)
+                sessions.delete(origin);
+        };
+        session.on("close", forget);
+        session.on("goaway", forget);
+        session.on("error", forget);
+        sessions.set(origin, session);
+        return session;
+    }
+    runnerCredential() {
+        // The proxy credential the runner's interceptors sent, which the root binds (`config.ts`).
+        const token = (this.config.proxyTokenRef ?? this.config.stigmerTokenRef).current;
+        if (!token)
+            throw new LaneRefusal(503, "the runner holds no Stigmer credential to forward this call with");
+        return token;
+    }
+    operatorKey() {
+        if (!this.config.cursorApiKey)
+            throw new LaneRefusal(500, "the Cursor lane needs CURSOR_API_KEY on the runner");
+        return this.config.cursorApiKey;
+    }
+}
+/**
+ * The Cursor host a REST call names, as the lane's own constant, or
+ * `undefined` for anything else. Only the exact host names count: the host's
+ * interceptors name `api2.cursor.sh` or `api.cursor.com` (or the host of a
+ * Cursor URL the SDK fetched), and the upstream URL is built from the
+ * constant, never from the request's text.
+ */
+function cursorHostNamed(host) {
+    return CURSOR_HOSTS.find((known) => known === host);
+}
+/** Does `path` read as the auth API once decoded, lower-cased and stripped of repeated or trailing slashes? */
+function readsAsAuthPath(path) {
+    const canonical = canonicalPath(path);
+    return canonical === undefined || canonical === "/auth" || canonical.startsWith("/auth/");
+}
+/** `path` decoded, lower-cased and stripped of repeated or trailing slashes; `undefined` when it cannot be decoded. */
+function canonicalPath(path) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(path);
+    }
+    catch {
+        return undefined;
+    }
+    let canonical = decoded.toLowerCase().replace(/\/{2,}/g, "/");
+    while (canonical.endsWith("/"))
+        canonical = canonical.slice(0, -1);
+    return canonical;
+}
+/**
+ * The access tokens the lane holds, by the stand-in the host was given for
+ * each. A token is held until its own expiry (a day when it names none),
+ * and at most {@link MAX_HELD} at once, the oldest let go first.
+ */
+class TokenCustody {
+    held = new Map();
+    hold(real) {
+        const exp = expiryOf(real);
+        const random = randomBytes(32).toString("base64url");
+        const claims = Buffer.from(JSON.stringify(exp === undefined ? {} : { exp })).toString("base64url");
+        const standIn = `stigmer.${claims}.${random}`;
+        this.held.set(standIn, { real, until: exp === undefined ? Date.now() + DEFAULT_HOLD_MS : exp * 1000 });
+        for (const oldest of this.held.keys()) {
+            if (this.held.size <= MAX_HELD)
+                break;
+            this.held.delete(oldest);
+        }
+        return standIn;
+    }
+    real(standIn) {
+        if (standIn === undefined)
+            return undefined;
+        const entry = this.held.get(standIn);
+        if (entry === undefined)
+            return undefined;
+        if (entry.until <= Date.now()) {
+            this.held.delete(standIn);
+            return undefined;
+        }
+        return entry.real;
+    }
+    clear() {
+        this.held.clear();
+    }
+}
+const MAX_HELD = 1024;
+const DEFAULT_HOLD_MS = 24 * 60 * 60 * 1000;
+/** The `exp` a JWT-shaped token names, read as the SDK reads it; `undefined` when it names none. */
+function expiryOf(token) {
+    const claims = parseJsonObject(Buffer.from(token.split(".")[1] ?? "", "base64url"));
+    const exp = claims?.exp;
+    return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp : undefined;
+}
+function parseJsonObject(bytes) {
+    try {
+        const parsed = JSON.parse(bytes.toString("utf8"));
+        return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * A refusal in the shape a Connect client reads (`{"code","message"}` with
+ * the matching HTTP status), which the SDK turns into its own errors: an
+ * `unauthenticated` one is what makes it exchange its key again.
+ */
+function replyConnectError(res, status, message) {
+    const code = status === 401 ? "unauthenticated"
+        : status === 403 ? "permission_denied"
+            : status === 404 ? "unimplemented"
+                : status === 413 ? "resource_exhausted"
+                    : status === 503 ? "unavailable"
+                        : "internal";
+    const body = JSON.stringify({ code, message });
+    res.writeHead(status, { "content-type": "application/json", "content-length": String(Buffer.byteLength(body)) });
+    res.end(body);
+}
+//# sourceMappingURL=cursor-lane.js.map

package/dist/agent-proxy/cursor-lane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-lane.js","sourceRoot":"","sources":["../../src/agent-proxy/cursor-lane.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,OAAO,IAAI,YAAY,EACvB,SAAS,IAAI,cAAc,EAC3B,kBAAkB,GAOnB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAqC,MAAM,YAAY,CAAC;AAElJ,+DAA+D;AAC/D,MAAM,YAAY,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;AAC3E,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,aAAa,GAAG,6BAA6B,CAAC;AACpD,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,2EAA2E;AAC3E,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,kDAAkD;IAClD,2CAA2C;IAC3C,gDAAgD;IAChD,kDAAkD;IAClD,8DAA8D;IAC9D,sEAAsE;IACtE,uDAAuD;IACvD,mDAAmD;IACnD,gDAAgD;CACjD,CAAC,CAAC;AACH,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAaxC,MAAM,OAAO,UAAU;IAaF;IAER;IAEA;IACQ;IACA;IAlBF,OAAO,GAAG,IAAI,YAAY,EAAE,CAAC;IAC9C;;;;;OAKG;IACc,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;IACtF,sFAAsF;IACrE,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAE7C,YACmB,MAAyB;IAC1C,iJAAiJ;IACxI,QAAgB;IACzB,4CAA4C;IACnC,OAAe,EACP,MAAc,EACd,IAAoB;QANpB,WAAM,GAAN,MAAM,CAAmB;QAEjC,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,YAAO,GAAP,OAAO,CAAQ;QACP,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAgB;IACpC,CAAC;IAEJ,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,IAAoB;QACrD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,uBAAuB,EAAE,CAAC;QACtD,IAAI,IAA4B,CAAC;QACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/F,KAAK,IAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QACjD,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,WAAW,kBAAkB,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAc,EAAE,EAAE;YACzC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IACrE,YAAY;QACV,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,yGAAyG;IACzG,KAAK;QACH,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;YAAE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3G,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,GAAiB;QACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,oEAAoE,IAAI,EAAE,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxD,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,+DAA+D,IAAI,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,kCAAkC,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG;gBAChC,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;oBACzE,CAAC,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACzG,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,IAAI,CAAC,GAAgB,EAAE,GAAiB,EAAE,WAAmB,EAAE,MAAc;QACzF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,6DAA6D,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,+DAA+D,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,wDAAwD,IAAI,EAAE,CAAC,CAAC;QACpH,MAAM,QAAQ,GAAG,IAAI,KAAK,aAAa,CAAC;QACxC,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,yEAAyE,CAAC,CAAC;QAC9I,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC;QACnD,MAAM,QAAQ,GACZ,OAAO,CAAC,CAAC;YACP;gBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,EAAE,oBAAoB,KAAK,GAAG,IAAI,EAAE,CAAC;gBAC5E,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;gBAC3B,OAAO,EAAE,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,gBAAgB,EAAE,EAAE,EAAE;gBACzG,IAAI;aACL;YACH,CAAC,CAAC;gBACE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,WAAW,KAAK,EAAE,EAAE,IAAI,CAAC;gBAChF,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;gBAC3B,OAAO,EAAE,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE;gBACrG,IAAI;aACL,CAAC;QACN,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAChD,sEAAsE;YACtE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtG,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YACnD,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,OAAO,GAAsC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/G,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,0GAA0G;IAClG,KAAK,CAAC,OAAO,CAAC,GAAgB,EAAE,GAAiB,EAAE,YAAoB,EAAE,MAAe;QAC9F,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,wEAAwE,CAAC,CAAC;QAC7H,IAAI,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC;QACnD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,wBAAwB,CAAC;QACvH,MAAM,OAAO,GAAsC;YACjD,sEAAsE;YACtE,8DAA8D;YAC9D,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,MAAM,CAAC;YACrD,aAAa,EAAE,UAAU,IAAI,EAAE;YAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,IAAI,CAAC,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,gBAAgB,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,WAAW,CAAC,GAAyB,EAAE,GAA0B,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,GAAuB,EAAE,GAAwB,EAAE,GAAQ,EAAE,OAA0C;QACzH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,qEAAqE;YACrE,yDAAyD;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAwB;gBACpC,GAAG,OAAO;gBACV,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM;gBAChD,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;aACnE,CAAC;YACF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3C,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,wCAAwC;YACxC,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,IAAI,CAAC,QAAQ,CAAC,MAAM;oBAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACtE,CAAC,CAAC;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnB,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAwB,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBAC1E,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;gBAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAwB,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACrD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBAC1E,CAAC;gBACD,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,oEAAoE;YACpE,iEAAiE;YACjE,sEAAsE;YACtE,yGAAyG;YACzG,qEAAqE;YACrE,uEAAuE;YACvE,qBAAqB;YACrB,MAAM,KAAK,GAAG,GAAS,EAAE;gBACvB,IAAI,MAAM,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM;oBAAE,OAAO;gBAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YAC1H,CAAC,CAAC;YACF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC;gBAC9B,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,CAAC,gBAAgB,CAAC;oBAAE,KAAK,EAAE,CAAC;qBAC7F,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACnC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1B,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC3B,MAAM,GAAG,IAAI,CAAC;gBACd,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,mCAAmC,GAAG,CAAC,QAAQ,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChG,IAAI,GAAG,CAAC,WAAW;oBAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;;oBACxE,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,sCAAsC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtF,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gHAAgH;IACxG,OAAO,CAAC,OAAqB,EAAE,MAAc;QACnD,IAAI,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;YACvD,QAAQ,GAAG,QAAQ,CAAC;YACpB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACtC,uEAAuE;YACvE,oDAAoD;YACpD,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;oBAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,QAAQ,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,OAAO;gBAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,gBAAgB;QACtB,2FAA2F;QAC3F,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC;QACjF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,kEAAkE,CAAC,CAAC;QAC3G,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;IAClC,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,+GAA+G;AAC/G,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC5F,CAAC;AAED,uHAAuH;AACvH,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,YAAY;IACC,IAAI,GAAG,IAAI,GAAG,EAA6D,CAAC;IAE7F,IAAI,CAAC,IAAY;QACf,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnG,MAAM,OAAO,GAAG,WAAW,MAAM,IAAI,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;QACvG,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ;gBAAE,MAAM;YACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,OAA2B;QAC9B,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,oGAAoG;AACpG,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC;IACxB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAiB,EAAE,MAAc,EAAE,OAAe;IAC3E,MAAM,IAAI,GACR,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB;QAClC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB;YACtC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe;gBAClC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,oBAAoB;oBACvC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa;wBAChC,CAAC,CAAC,UAAU,CAAC;IACf,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IACjH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/agent-proxy/lanes.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The local proxy's lanes: for each path the agent host may call, where the
+ * call goes and with which of the runner's credentials. One rule for every
+ * lane — swap the credential, forward the bytes (`relay.ts`) — in two modes
+ * decided by the runner's own configuration:
+ *
+ *  - Forward, when the runner talks to the Stigmer platform's proxy
+ *    (`config.proxyEndpoint` set): the call goes to the same path there,
+ *    with the host's token replaced by the runner's control-plane token,
+ *    read per request so rotation stays the runner's. The execution id the
+ *    host's clients stamp (`X-Stigmer-Execution-Id`) passes through, because
+ *    the platform's proxy authorizes and meters by it and `server.ts` has
+ *    checked it names a live turn; no other scope header does.
+ *  - Terminate, when the runner calls its providers itself: the call goes
+ *    to the provider with the operator's key, or signed with the runner's
+ *    ambient cloud identity — exactly the credential the runner's own model
+ *    clients use (`shared/model-client.ts`), from the same settings. The
+ *    host's clients are direct-mode clients bound to these lanes
+ *    (`shared/model-lanes.ts`), so the wire each lane receives is already
+ *    the provider's.
+ *
+ * Lanes, and the mode each serves in:
+ *
+ * | Lane                         | Forward | Terminate |
+ * | ---------------------------- | ------- | --------- |
+ * | `llm/anthropic`, `llm/openai`| yes     | yes       |
+ * | `llm/bedrock`, `llm/vertex`, `llm/foundry` | no | yes |
+ * | `model-registry`             | yes     | yes (to the runner's own control plane) |
+ * | `checkpoints`                | yes     | no: a runner without the platform proxy checkpoints locally |
+ * | `otlp`                       | to the operator's collector, in both (`otlp-forward.ts`) | |
+ *
+ * What each lane may be asked, and by whom, is `server.ts`'s; this module
+ * only answers where and how.
+ */
+import type { IncomingMessage } from "node:http";
+import type { Config } from "../config.js";
+import { type Upstream } from "./relay.js";
+/** A lane that cannot serve the call: the status and the message the host's SDK reads. */
+export declare class LaneRefusal extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/** The providers a model lane names, after `/v1/proxy/llm/`. */
+export type ModelProviderLane = "anthropic" | "openai" | "bedrock" | "vertex" | "foundry";
+export declare function isModelProviderLane(name: string): name is ModelProviderLane;
+/**
+ * Where one model call goes. `rest` is the path after the lane's prefix,
+ * with its query (`/v1/messages`, `/model/<id>/invoke-with-response-stream`).
+ */
+export declare function modelUpstream(config: Config, lane: ModelProviderLane, rest: string, req: IncomingMessage, body: Buffer): Promise<Upstream>;
+/** The model registry: the runner's own read of it, with the runner's credential. */
+export declare function registryUpstream(req: IncomingMessage): Upstream;
+/** A checkpoint call, forwarded to the platform's checkpoint lane. `rest` keeps its query. */
+export declare function checkpointUpstream(config: Config, rest: string, req: IncomingMessage, body: Buffer): Upstream;
+/** The Vertex API root for a region, as the Vertex SDK builds it, or `ANTHROPIC_VERTEX_BASE_URL`. */
+export declare function vertexBase(region: string): string;
+/**
+ * `base` with the host's `path` (which starts with `/`) appended, on
+ * `base`'s own origin and under its own path. The path is the agent host's
+ * to choose; the origin never is, so a path that would resolve elsewhere (a
+ * scheme, `//`, `..`) is refused before any credential is attached.
+ */
+export declare function laneUrl(base: string, path: string): URL;