@stigmer/runner 0.1.0-dev.20261017020314.g644422724c27

package/dist/client/stigmer-client.js

@@ -0,0 +1,478 @@
+/**
+ * Connect-RPC client for communicating with the Stigmer server.
+ *
+ * Provides typed wrappers around generated service stubs for RPCs the
+ * runner needs: execution queries, status updates, session reads/writes,
+ * and blueprint resolution (agent, skill, MCP server).
+ *
+ * Shared by all activities in the unified runner.
+ */
+import { createClient } from "@connectrpc/connect";
+import { createGrpcTransport } from "@connectrpc/connect-node";
+import { context as otelContext, propagation } from "@opentelemetry/api";
+import { RunCommandController } from "@stigmer/apis/ai/stigmer/agentic/run/v1/command_pb";
+import { RunQueryController } from "@stigmer/apis/ai/stigmer/agentic/run/v1/query_pb";
+import { VaultValueController, FetchExecutionValuesInputSchema } from "@stigmer/apis/ai/stigmer/agentic/vault/v1/values_pb";
+import { SessionCommandController } from "@stigmer/apis/ai/stigmer/agentic/session/v1/command_pb";
+import { SessionQueryController } from "@stigmer/apis/ai/stigmer/agentic/session/v1/query_pb";
+import { AgentQueryController } from "@stigmer/apis/ai/stigmer/agentic/agent/v1/query_pb";
+import { SkillQueryController } from "@stigmer/apis/ai/stigmer/agentic/skill/v1/query_pb";
+import { PluginQueryController } from "@stigmer/apis/ai/stigmer/agentic/plugin/v1/query_pb";
+import { EvalQueryController } from "@stigmer/apis/ai/stigmer/agentic/eval/v1/query_pb";
+import { create } from "@bufbuild/protobuf";
+import { RunUpdateStatusInputSchema } from "@stigmer/apis/ai/stigmer/agentic/run/v1/io_pb";
+import { PlatformQueryController, GetRunnerScopedTokenInputSchema, TokenRenewalSchema } from "@stigmer/apis/ai/stigmer/platform/v1/server_info_pb";
+import { ChannelMessageQueryController } from "@stigmer/apis/ai/stigmer/agentic/channel/v1/message_query_pb";
+import { TOKEN_TYPE_EMBEDDED_RUNNER, tokenTypeOf } from "./token-claims.js";
+import { assertCreateRequirements, assertReferenceRequirements } from "./server-contracts.js";
+import { currentRunCredential } from "../shared/run-credential-store.js";
+/**
+ * Map the scope union onto the proto oneof init shape. The narrowing chain is
+ * exhaustive: adding a variant to {@link RunnerScopedTokenScope} breaks the
+ * final branch's type until it is mapped here.
+ */
+function toRunnerScopedTokenOneof(scope) {
+    if ("agentExecutionId" in scope) {
+        return { case: "runId", value: scope.agentExecutionId };
+    }
+    if ("poolClaimSessionId" in scope) {
+        return { case: "poolClaim", value: { sessionId: scope.poolClaimSessionId } };
+    }
+    return { case: "renewal", value: create(TokenRenewalSchema) };
+}
+export class StigmerClient {
+    transport;
+    fixedToken;
+    executionQuery;
+    executionCommand;
+    vaultValues;
+    sessionQuery;
+    sessionCommand;
+    agentQuery;
+    skillQuery;
+    pluginQuery;
+    evalQuery;
+    platformQuery;
+    channelMessageQuery;
+    tokenRef;
+    runnerTokenRef;
+    constructor(options) {
+        this.fixedToken = options.token ?? null;
+        this.tokenRef = options.tokenRef ?? null;
+        this.runnerTokenRef = options.runnerTokenRef ?? null;
+        this.transport = createGrpcTransport({
+            baseUrl: options.endpoint,
+            interceptors: [
+                // W3C trace-context propagation: stamps `traceparent` (and baggage)
+                // from the active OTel context onto every outgoing RPC, so a runner
+                // span and the server-side request span join into one distributed
+                // trace (the server's GrpcRequestTraceIdInterceptor already parses
+                // traceparent). When OTel is not initialized — the OSS default, no
+                // OTEL_EXPORTER_OTLP_ENDPOINT — the global propagator is a no-op and
+                // this adds nothing to the request.
+                (next) => async (req) => {
+                    propagation.inject(otelContext.active(), req.header, {
+                        set: (carrier, key, value) => carrier.set(key, value),
+                    });
+                    return next(req);
+                },
+                // Credential selection lives here — one tested decision point — rather
+                // than at call sites. Precedence:
+                //
+                // 1. An explicit per-call credential (an authorization header set via
+                //    CallOptions) always wins. The scoped-token flow (issue #156)
+                //    authenticates each value fetch with a token minted for that
+                //    specific execution; the renewal and pool-claim exchanges
+                //    present the token being exchanged; the connect lane hands its
+                //    decrypt-lane token per call.
+                //
+                // 2. The run credential of the activity this request belongs to
+                //    (shared/run-credential-store.ts), on every RPC that is about a
+                //    run — which is every RPC but the process-bound bootstrap read.
+                //    The server minted it for exactly this execution at dispatch and,
+                //    with sign-in on, admits its bearer as the run's own human: the
+                //    status write and the session title are the member's, whoever's API
+                //    key this process holds. It is read from the async context, never
+                //    from a ref: one process serves many runs at once and a shared ref
+                //    would be the wrong run's the moment two overlap — the same reason
+                //    rule 1 exists. Absent outside an activity and when the dispatch
+                //    carried none (an older server; the cloud, whose runner credential
+                //    is provisioned), so the rules below are exactly what they were.
+                //
+                // 3. The runner credential (runnerTokenRef) authenticates the services
+                //    that require a runner-class token_type claim: a value fetch
+                //    answers a run's secrets, and the server releases them only to a
+                //    runner credential bound to that execution; the
+                //    scoped-token exchange itself requires the embedded_runner
+                //    bootstrap credential (a desktop runner's control-plane token is
+                //    the user's own Auth0 token, which the server correctly treats as
+                //    a browsing user).
+                //
+                // 4. Everything else uses the control-plane token: the process
+                //    credential, an operator's API key on a self-host. Falls through
+                //    unchanged when no runner token exists.
+                (next) => async (req) => {
+                    if (req.header.has("authorization")) {
+                        return next(req);
+                    }
+                    const isProcessBound = req.service.typeName === PlatformQueryController.typeName &&
+                        req.method.name === PlatformQueryController.method.getRunnerBootstrapConfig.name;
+                    const usesRunnerCredential = req.service.typeName === VaultValueController.typeName ||
+                        (req.service.typeName === PlatformQueryController.typeName &&
+                            req.method.name === PlatformQueryController.method.getRunnerScopedToken.name);
+                    const token = (isProcessBound ? undefined : currentRunCredential())
+                        ?? (usesRunnerCredential ? this.runnerTokenRef?.current : null)
+                        ?? this.tokenRef?.current
+                        ?? this.fixedToken;
+                    if (token) {
+                        req.header.set("authorization", `Bearer ${token}`);
+                    }
+                    return next(req);
+                },
+            ],
+        });
+        this.executionQuery = createClient(RunQueryController, this.transport);
+        this.executionCommand = createClient(RunCommandController, this.transport);
+        this.vaultValues = createClient(VaultValueController, this.transport);
+        this.sessionQuery = createClient(SessionQueryController, this.transport);
+        this.sessionCommand = createClient(SessionCommandController, this.transport);
+        this.agentQuery = createClient(AgentQueryController, this.transport);
+        this.skillQuery = createClient(SkillQueryController, this.transport);
+        this.pluginQuery = createClient(PluginQueryController, this.transport);
+        this.evalQuery = createClient(EvalQueryController, this.transport);
+        this.platformQuery = createClient(PlatformQueryController, this.transport);
+        this.channelMessageQuery = createClient(ChannelMessageQueryController, this.transport);
+    }
+    /**
+     * Fetch this runner's bootstrap config from the control plane.
+     *
+     * Lets an embedded runner self-bootstrap from a token alone: the control
+     * plane returns the Temporal frontend address and namespace for the
+     * environment the token belongs to (so integrators never hardcode
+     * infrastructure addresses) and, on cloud, a minted iss=stigmer access token
+     * the runner uses for its proxy traffic. The token fields are absent when the
+     * server does not mint one (OSS, or no signing key configured).
+     */
+    async getRunnerBootstrapConfig() {
+        const res = await this.platformQuery.getRunnerBootstrapConfig({});
+        return {
+            temporalAddress: res.temporalAddress,
+            temporalNamespace: res.temporalNamespace,
+            // Empty proto string/0 means "not minted" — normalize to undefined so
+            // callers branch on presence rather than emptiness.
+            runnerAccessToken: res.runnerAccessToken || undefined,
+            runnerAccessTokenExpiresInSeconds: res.runnerAccessTokenExpiresInSeconds || undefined,
+            // Same presence contract, grouped so callers make ONE presence check.
+            // Key without id (or vice versa) is a server contract violation the
+            // encryption config loader rejects — not silently dropped here, so the
+            // breakage is diagnosable at the fail-closed boundary.
+            payloadEncryption: res.payloadEncryptionKey
+                ? {
+                    key: res.payloadEncryptionKey,
+                    keyId: res.payloadEncryptionKeyId,
+                    secondaryKey: res.payloadEncryptionSecondaryKey || undefined,
+                    secondaryKeyId: res.payloadEncryptionSecondaryKeyId || undefined,
+                }
+                : undefined,
+        };
+    }
+    async getExecution(executionId) {
+        return this.executionQuery.get({ value: executionId });
+    }
+    async updateStatus(executionId, status) {
+        const input = create(RunUpdateStatusInputSchema, {
+            runId: executionId,
+            status,
+        });
+        return this.executionCommand.updateStatus(input);
+    }
+    /**
+     * Fetch the values of a run or a tool connect from their vaults, grouped
+     * by who declared them.
+     *
+     * When a scoped runner token is supplied (issue #156), the fetch
+     * authenticates with it per-call instead of the process-wide credential:
+     * the server answers only a runner credential bound to this very
+     * execution and refuses every other caller, and one desktop runner
+     * process serves many sessions concurrently, so the credential cannot
+     * live in a shared ref.
+     */
+    async fetchExecutionValues(executionId, scopedToken) {
+        return this.vaultValues.fetchValues(create(FetchExecutionValuesInputSchema, { executionId }), scopedToken
+            ? { headers: { authorization: `Bearer ${scopedToken}` } }
+            : undefined);
+    }
+    /**
+     * Exchange this runner's credential for a token scoped to one unit of
+     * dispatched work (issue #156).
+     *
+     * The call authenticates with the runner credential (see the interceptor).
+     * Cloud verifies it is an embedded_runner token and that its identity can
+     * view the named execution, then mints the same session/execution-scoped
+     * sandbox token a cloud sandbox runner receives at provisioning. An
+     * open-source server with sign-in off mints an execution-scoped token for
+     * any caller (oss#535 — there it only unlocks the value fetch); with
+     * sign-in on the same token admits its bearer as the run's
+     * human, so the exchange mints only for the run's own person (a missing
+     * run NOT_FOUND, anyone else PERMISSION_DENIED). Runs normally receive
+     * their credential from the dispatch itself (shared/run-credential.ts);
+     * this exchange is the fallback. Returns undefined when the server does
+     * not mint (pre-oss#535 OSS, or an unserved scope arm) — presence-based,
+     * like the bootstrap token fields.
+     *
+     * `callerToken` authenticates the exchange per-call instead of the
+     * process-wide runner credential. The warm-pool attach uses it: a pool
+     * member exchanges with its pool_sandbox token, which is not the runner
+     * credential the interceptor would pick for this method.
+     */
+    async getRunnerScopedToken(scope, callerToken) {
+        const input = create(GetRunnerScopedTokenInputSchema, {
+            scope: toRunnerScopedTokenOneof(scope),
+        });
+        const res = await this.platformQuery.getRunnerScopedToken(input, callerToken
+            ? { headers: { authorization: `Bearer ${callerToken}` } }
+            : undefined);
+        if (!res.runnerScopedToken) {
+            return undefined;
+        }
+        return {
+            token: res.runnerScopedToken,
+            expiresInSeconds: res.expiresInSeconds || undefined,
+        };
+    }
+    /**
+     * Acquire a scoped runner token to fetch an execution's values, if this
+     * runner's credential situation calls for one.
+     *
+     * When the activity this call belongs to carries a run credential (the
+     * server minted it for this very execution at dispatch —
+     * shared/run-credential.ts), that IS the scoped token: it is answered
+     * without an RPC, and the exchange below serves only a dispatch that
+     * carried none — an older server, or the cloud's provisioned runner.
+     *
+     * Otherwise the gate is the credential itself:
+     *
+     * 1. An already-scoped runner-class credential (a cloud sandbox, pool or
+     *    connect token) — skip; the exchange would rightly refuse it and the
+     *    ambient credential is bound to its work on its own.
+     *
+     * 2. An unscoped embedded_runner bootstrap token, or no runner-class
+     *    credential at all (OSS/local) — exchange it. A failed exchange, or a
+     *    server that mints nothing, is a hard error naming the cause: the
+     *    value fetch answers only a credential bound to the execution and
+     *    refuses every other, so there is nothing to fall back to. The
+     *    value-delivery call sites let this error end the turn; opportunistic
+     *    consumers that can genuinely proceed without a scoped token
+     *    (attachment credential, channel discovery) catch it at the call
+     *    site, where their degrade-to-empty contract lives.
+     */
+    async acquireScopedRunnerToken(scope) {
+        const runCredential = currentRunCredential();
+        if (runCredential !== undefined) {
+            return runCredential;
+        }
+        // Inspect the same credential chain the fetch's interceptor would use.
+        const ambientTokenType = tokenTypeOf(this.runnerTokenRef?.current ?? this.tokenRef?.current ?? this.fixedToken);
+        if (ambientTokenType !== undefined && ambientTokenType !== TOKEN_TYPE_EMBEDDED_RUNNER) {
+            return undefined;
+        }
+        const scopeDescription = "agentExecutionId" in scope
+            ? `agent execution ${scope.agentExecutionId}`
+            : JSON.stringify(scope);
+        let scoped;
+        try {
+            scoped = await this.getRunnerScopedToken(scope);
+        }
+        catch (err) {
+            throw new Error(`Scoped runner token exchange failed for ${scopeDescription}: ` +
+                `${err instanceof Error ? err.message : String(err)}. ` +
+                "This runner holds no credential bound to the execution, so it cannot " +
+                "fetch the execution's values until the exchange succeeds.");
+        }
+        if (!scoped) {
+            throw new Error(`Server minted no scoped runner token for ${scopeDescription}. ` +
+                "This runner holds no credential bound to the execution, so it cannot " +
+                "fetch the execution's values until the control plane mints scoped tokens.");
+        }
+        return scoped.token;
+    }
+    /**
+     * The agent's serving proactive-messaging channels, as data — the
+     * runner's tool-attachment
+     * decision. An empty list is the everyday answer (most agents have no
+     * proactive channel).
+     *
+     * When a scoped runner token is supplied, the read authenticates with
+     * it per-call (the {@link fetchExecutionValues} precedent):
+     * the messaging reach refuses the desktop runner's ambient
+     * embedded_runner credential outright, and one desktop runner process
+     * serves many sessions concurrently, so the credential cannot live in
+     * a shared ref. A cloud sandbox runner's ambient credential is already
+     * the session-scoped token; OSS sends nothing and answers empty.
+     */
+    async listMessagingChannels(scopedToken) {
+        const res = await this.channelMessageQuery.listMessagingChannels({}, scopedToken
+            ? { headers: { authorization: `Bearer ${scopedToken}` } }
+            : undefined);
+        return res.entries;
+    }
+    /**
+     * The channel's provider template registry, approved entries only —
+     * the `<available_channel_templates>` prompt section's source.
+     * Entries carry the sendability verdict (`unsupportedReason`, empty
+     * means sendable);
+     * the section formatter filters on it. Credential rules as
+     * {@link listMessagingChannels}.
+     */
+    async listChannelTemplates(channel, scopedToken) {
+        const res = await this.channelMessageQuery.listTemplates({ channel, approvedOnly: true }, scopedToken
+            ? { headers: { authorization: `Bearer ${scopedToken}` } }
+            : undefined);
+        return res.entries;
+    }
+    async getSession(sessionId) {
+        return this.sessionQuery.get({ value: sessionId });
+    }
+    /**
+     * Record the harness's conversation id on the run's session. The server
+     * admits only the runner acting for that run, as it admits an append, so
+     * the caller passes the same scoped token
+     * ({@link acquireScopedRunnerToken}).
+     */
+    async bindHarnessState(runId, harnessStateId, scopedToken) {
+        return this.sessionCommand.bindHarnessState({ runId, harnessStateId }, scopedToken ? { headers: { authorization: `Bearer ${scopedToken}` } } : undefined);
+    }
+    /**
+     * Append a run's events, and the live previews of what it is still
+     * producing, to its session's log. The server admits only the runner
+     * acting for that run: it decides the credential as a values fetch does,
+     * so the caller passes the same scoped token
+     * ({@link acquireScopedRunnerToken}); without one the request carries the
+     * credential the interceptor chooses.
+     */
+    async appendSessionEvents(runId, events, previews, scopedToken) {
+        return this.sessionCommand.appendEvents({ runId, events: [...events], previews: [...previews] }, scopedToken ? { headers: { authorization: `Bearer ${scopedToken}` } } : undefined);
+    }
+    /**
+     * Every event of one run in its session's log, oldest first, of `types`
+     * when given (every type otherwise): what a resumed turn already sent, or
+     * the answers the server recorded on its asks (`harness/approval-answers.ts`).
+     * Pages to the end, at most 1000 a page.
+     */
+    async listRunSessionEvents(sessionId, runId, types = []) {
+        const events = [];
+        let pageToken = "";
+        do {
+            const page = await this.sessionQuery.listEvents({ sessionId, runId, types: [...types], pageSize: 1000, pageToken });
+            events.push(...page.events);
+            pageToken = page.nextPageToken;
+        } while (pageToken !== "");
+        return events;
+    }
+    /**
+     * Whether the log holds any event of one run of `types`: one page of at
+     * most one event, so the answer costs the same however long the run is.
+     * What a turn's start asks to learn whether an earlier invocation of the
+     * run already wrote what its engine did (`harness/turn-context.ts`
+     * `isReinvocation`).
+     */
+    async hasRunSessionEvent(sessionId, runId, types) {
+        const page = await this.sessionQuery.listEvents({ sessionId, runId, types: [...types], pageSize: 1, pageToken: "" });
+        return page.events.length > 0;
+    }
+    /**
+     * One page of a session's log, filtered by event type, in the order asked
+     * for: the read a turn's start pages back through, newest first, to find
+     * the undos still owed (`harness/owed-undos.ts`). The caller pages and
+     * decides where to stop; the credential is the interceptor's, as for
+     * {@link listRunSessionEvents}.
+     */
+    async listSessionEvents(sessionId, query) {
+        const page = await this.sessionQuery.listEvents({
+            sessionId,
+            types: [...query.types],
+            order: query.order,
+            pageSize: query.pageSize,
+            pageToken: query.pageToken,
+        });
+        return { events: page.events, nextPageToken: page.nextPageToken };
+    }
+    /**
+     * Race-safe, field-level subject write. The dedicated updateSubject RPC
+     * exists precisely so concurrent writers (title generation vs a user
+     * rename) never lose each other's updates — always prefer it for subject
+     * changes.
+     */
+    async updateSessionSubject(sessionId, subject) {
+        return this.sessionCommand.updateSubject({ id: sessionId, subject });
+    }
+    async getAgent(agentId) {
+        return this.agentQuery.get({ value: agentId });
+    }
+    /** One version of an agent, with its full spec: what a turn recorded on it runs. */
+    async getAgentVersion(agentId, versionHash) {
+        return this.agentQuery.getVersion({ agentId, versionHash });
+    }
+    async getSkill(skillId) {
+        return this.skillQuery.get({ value: skillId });
+    }
+    async getSkillByReference(ref) {
+        return this.skillQuery.getByReference(ref);
+    }
+    async getSkillArtifact(artifactStorageKey) {
+        return this.skillQuery.getArtifact({ artifactStorageKey });
+    }
+    /**
+     * Mint an HTTP download URL for a skill artifact (#675). Preferred over
+     * getSkillArtifact for the actual bytes: the unary response is capped by
+     * the server's 10MB gRPC message limit, while skills may be 100MB.
+     * Throws ConnectError with Code.Unimplemented against servers that
+     * predate the transfer lane — callers fall back to getSkillArtifact.
+     */
+    async getSkillArtifactDownloadUrl(artifactStorageKey) {
+        return this.skillQuery.getArtifactDownloadUrl({ artifactStorageKey });
+    }
+    async getPlugin(pluginId) {
+        return this.pluginQuery.get({ value: pluginId });
+    }
+    async getPluginByReference(ref) {
+        return this.pluginQuery.getByReference(ref);
+    }
+    async getPluginArtifact(artifactStorageKey) {
+        return this.pluginQuery.getArtifact({ artifactStorageKey });
+    }
+    /**
+     * Mint an HTTP download URL for a plugin archive, the skill lane's twin:
+     * preferred over getPluginArtifact for the bytes, and answered
+     * UNIMPLEMENTED by a server that predates it.
+     */
+    async getPluginArtifactDownloadUrl(artifactStorageKey) {
+        return this.pluginQuery.getArtifactDownloadUrl({ artifactStorageKey });
+    }
+    /**
+     * Mint an HTTP download URL for one version of an Eval, named by its
+     * reference (its id and the digest as the version). The server asks
+     * can_view on the Eval first, of the run's caller; a server with no
+     * transfer lane answers FAILED_PRECONDITION.
+     */
+    async getEvalDownloadUrl(ref) {
+        return this.evalQuery.getDownloadUrl(ref);
+    }
+    /** One version of an Eval's archive inline, after the same can_view; capped by the gRPC message limit. */
+    async downloadEval(ref) {
+        return this.evalQuery.download(ref);
+    }
+    async getAgentByReference(ref) {
+        assertReferenceRequirements(ref, "Agent", "getAgentByReference");
+        return this.agentQuery.getByReference(ref);
+    }
+    async createSession(session) {
+        assertCreateRequirements(session, "Session", "createSession");
+        return this.sessionCommand.create(session);
+    }
+    async applySession(session) {
+        assertCreateRequirements(session, "Session", "applySession");
+        return this.sessionCommand.apply(session);
+    }
+}
+//# sourceMappingURL=stigmer-client.js.map

package/dist/client/stigmer-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stigmer-client.js","sourceRoot":"","sources":["../../src/client/stigmer-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAA+B,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,+BAA+B,EAAE,MAAM,qDAAqD,CAAC;AAE5H,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAiBxF,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAE3F,OAAO,EAAE,uBAAuB,EAAE,+BAA+B,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAC;AACnJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,8DAA8D,CAAC;AAE7G,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAE9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AA6EzE;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,KAA6B;IAC7D,IAAI,kBAAkB,IAAI,KAAK,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,gBAAgB,EAAW,CAAC;IACnE,CAAC;IACD,IAAI,oBAAoB,IAAI,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,kBAAkB,EAAE,EAAW,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC,EAAW,CAAC;AACzE,CAAC;AAwBD,MAAM,OAAO,aAAa;IACf,SAAS,CAAY;IACb,UAAU,CAAgB;IAC1B,cAAc,CAAoC;IAClD,gBAAgB,CAAsC;IACtD,WAAW,CAAsC;IACjD,YAAY,CAAwC;IACpD,cAAc,CAA0C;IACxD,UAAU,CAAsC;IAChD,UAAU,CAAsC;IAChD,WAAW,CAAuC;IAClD,SAAS,CAAqC;IAC9C,aAAa,CAAyC;IACtD,mBAAmB,CAA+C;IAElE,QAAQ,CAA4B;IACpC,cAAc,CAA4B;IAE3D,YAAY,OAA6B;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,mBAAmB,CAAC;YACnC,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,YAAY,EAAE;gBACZ,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,mEAAmE;gBACnE,mEAAmE;gBACnE,qEAAqE;gBACrE,oCAAoC;gBACpC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACtB,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE;wBACnD,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;qBACtD,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;gBACD,uEAAuE;gBACvE,kCAAkC;gBAClC,EAAE;gBACF,sEAAsE;gBACtE,kEAAkE;gBAClE,iEAAiE;gBACjE,8DAA8D;gBAC9D,mEAAmE;gBACnE,kCAAkC;gBAClC,EAAE;gBACF,gEAAgE;gBAChE,oEAAoE;gBACpE,oEAAoE;gBACpE,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,uEAAuE;gBACvE,qEAAqE;gBACrE,EAAE;gBACF,uEAAuE;gBACvE,iEAAiE;gBACjE,qEAAqE;gBACrE,oDAAoD;gBACpD,+DAA+D;gBAC/D,qEAAqE;gBACrE,sEAAsE;gBACtE,uBAAuB;gBACvB,EAAE;gBACF,+DAA+D;gBAC/D,qEAAqE;gBACrE,4CAA4C;gBAC5C,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACtB,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;wBACpC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnB,CAAC;oBACD,MAAM,cAAc,GAClB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,uBAAuB,CAAC,QAAQ;wBACzD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAuB,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC;oBACnF,MAAM,oBAAoB,GACxB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,oBAAoB,CAAC,QAAQ;wBACtD,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,uBAAuB,CAAC,QAAQ;4BACxD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAuB,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;oBAClF,MAAM,KAAK,GACT,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;2BAClD,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;2BAC5D,IAAI,CAAC,QAAQ,EAAE,OAAO;2BACtB,IAAI,CAAC,UAAU,CAAC;oBACrB,IAAI,KAAK,EAAE,CAAC;wBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;oBACrD,CAAC;oBACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,gBAAgB,GAAG,YAAY,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,wBAAwB;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO;YACL,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,sEAAsE;YACtE,oDAAoD;YACpD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,SAAS;YACrD,iCAAiC,EAC/B,GAAG,CAAC,iCAAiC,IAAI,SAAS;YACpD,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,uDAAuD;YACvD,iBAAiB,EAAE,GAAG,CAAC,oBAAoB;gBACzC,CAAC,CAAC;oBACE,GAAG,EAAE,GAAG,CAAC,oBAAoB;oBAC7B,KAAK,EAAE,GAAG,CAAC,sBAAsB;oBACjC,YAAY,EAAE,GAAG,CAAC,6BAA6B,IAAI,SAAS;oBAC5D,cAAc,EAAE,GAAG,CAAC,+BAA+B,IAAI,SAAS;iBACjE;gBACH,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,MAAiB;QAEjB,MAAM,KAAK,GAAG,MAAM,CAAC,0BAA0B,EAAE;YAC/C,KAAK,EAAE,WAAW;YAClB,MAAM;SACP,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,oBAAoB,CACxB,WAAmB,EACnB,WAAoB;QAEpB,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CACjC,MAAM,CAAC,+BAA+B,EAAE,EAAE,WAAW,EAAE,CAAC,EACxD,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,oBAAoB,CACxB,KAA6B,EAC7B,WAAoB;QAEpB,MAAM,KAAK,GAAG,MAAM,CAAC,+BAA+B,EAAE;YACpD,KAAK,EAAE,wBAAwB,CAAC,KAAK,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CACvD,KAAK,EACL,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,iBAAiB;YAC5B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,SAAS;SACpD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,wBAAwB,CAC5B,KAA6B;QAE7B,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;QAC7C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,uEAAuE;QACvE,MAAM,gBAAgB,GAAG,WAAW,CAClC,IAAI,CAAC,cAAc,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,CAC1E,CAAC;QACF,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,0BAA0B,EAAE,CAAC;YACtF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,gBAAgB,GACpB,kBAAkB,IAAI,KAAK;YACzB,CAAC,CAAC,mBAAmB,KAAK,CAAC,gBAAgB,EAAE;YAC7C,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,MAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,2CAA2C,gBAAgB,IAAI;gBAC/D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;gBACvD,uEAAuE;gBACvE,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,4CAA4C,gBAAgB,IAAI;gBAChE,uEAAuE;gBACvE,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAoB;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,CAC9D,EAAE,EACF,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,WAAoB;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CACtD,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,EAC/B,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAAa,EACb,cAAsB,EACtB,WAAoB;QAEpB,OAAO,IAAI,CAAC,cAAc,CAAC,gBAAgB,CACzC,EAAE,KAAK,EAAE,cAAc,EAAE,EACzB,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAClF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CACvB,KAAa,EACb,MAA+B,EAC/B,QAAwC,EACxC,WAAoB;QAEpB,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CACrC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,EACvD,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAClF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,KAAa,EAAE,QAA2B,EAAE;QACxF,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACpH,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5B,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC;QACjC,CAAC,QAAQ,SAAS,KAAK,EAAE,EAAE;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,KAAa,EAAE,KAAwB;QACjF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CACrB,SAAiB,EACjB,KAKC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;YAC9C,SAAS;YACT,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YACvB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,OAAe;QAC3D,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,WAAmB;QACxD,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAyB;QACjD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,kBAA0B;QAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,2BAA2B,CAAC,kBAA0B;QAC1D,OAAO,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,GAAyB;QAClD,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,kBAA0B;QAChD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,4BAA4B,CAAC,kBAA0B;QAC3D,OAAO,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,GAAyB;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,YAAY,CAAC,GAAyB;QAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAyB;QACjD,2BAA2B,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/client/token-claims.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Read-only claim inspection for the runner's own credentials.
+ *
+ * The runner never verifies signatures — the server does that. It only needs
+ * to look at its own token's `token_type` claim to decide which credential
+ * flow applies (e.g. "do I hold an unscoped bootstrap credential that must be
+ * exchanged for a scoped one before a value fetch?"), and the
+ * attach waiter checks a pushed token's shape and expiry before it starts a
+ * runner with it (`src/attach/push.ts`). Claim names
+ * and values mirror the server's single source of truth,
+ * `StigmerTokenType` (stigmer-cloud, api-authentication).
+ */
+/** The `token_type` claim value of a bootstrap-minted embedded runner token. */
+export declare const TOKEN_TYPE_EMBEDDED_RUNNER = "embedded_runner";
+/** The `token_type` claim value of a session sandbox token. */
+export declare const TOKEN_TYPE_SANDBOX = "sandbox";
+/** The `token_type` claim value of a warm-pool member's pre-claim credential. */
+export declare const TOKEN_TYPE_POOL_SANDBOX = "pool_sandbox";
+/** Whether the token has a JWT's shape: three parts and a JSON object payload. */
+export declare function isJwtShaped(token: string | null | undefined): boolean;
+/** The `exp` claim in seconds since the epoch, when the token carries a numeric one. */
+export declare function expiryClaimOf(token: string | null | undefined): number | undefined;
+/** Extract the `token_type` claim (e.g. a user's Auth0 token has none). */
+export declare function tokenTypeOf(token: string | null | undefined): string | undefined;
+/**
+ * Extract the `session_id` claim of a session-scoped token. A claimed pool
+ * member reads its post-claim identity from this on restart.
+ */
+export declare function sessionIdClaimOf(token: string | null | undefined): string | undefined;
+/** Whether the token is a bootstrap-minted `embedded_runner` credential. */
+export declare function isEmbeddedRunnerToken(token: string | null | undefined): boolean;
+/**
+ * `token` when it is a runner-class credential already scoped below the
+ * runner (a cloud sandbox's session token, a connect token): one the
+ * scoped-token exchange leaves in use rather than exchanging
+ * (`stigmer-client.ts` `acquireScopedRunnerToken`). `undefined` for an
+ * unscoped key (an operator's API key, an embedded runner's bootstrap
+ * token) and for none.
+ */
+export declare function scopedRunnerCredential(token: string | null | undefined): string | undefined;

package/dist/client/token-claims.js

@@ -0,0 +1,88 @@
+/**
+ * Read-only claim inspection for the runner's own credentials.
+ *
+ * The runner never verifies signatures — the server does that. It only needs
+ * to look at its own token's `token_type` claim to decide which credential
+ * flow applies (e.g. "do I hold an unscoped bootstrap credential that must be
+ * exchanged for a scoped one before a value fetch?"), and the
+ * attach waiter checks a pushed token's shape and expiry before it starts a
+ * runner with it (`src/attach/push.ts`). Claim names
+ * and values mirror the server's single source of truth,
+ * `StigmerTokenType` (stigmer-cloud, api-authentication).
+ */
+/** The `token_type` claim value of a bootstrap-minted embedded runner token. */
+export const TOKEN_TYPE_EMBEDDED_RUNNER = "embedded_runner";
+/** The `token_type` claim value of a session sandbox token. */
+export const TOKEN_TYPE_SANDBOX = "sandbox";
+/** The `token_type` claim value of a warm-pool member's pre-claim credential. */
+export const TOKEN_TYPE_POOL_SANDBOX = "pool_sandbox";
+const CLAIM_TOKEN_TYPE = "token_type";
+const CLAIM_SESSION_ID = "session_id";
+/**
+ * Decode a JWT's payload without verifying it, or undefined when the token is
+ * absent or not three dot-separated parts with a JSON object payload.
+ */
+function payloadOf(token) {
+    if (!token)
+        return undefined;
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        return typeof payload === "object" && payload !== null && !Array.isArray(payload)
+            ? payload
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Extract one string claim from a JWT without verifying it.
+ *
+ * Returns undefined for null/malformed tokens and for tokens without the
+ * claim — callers branch on the specific value, so "unknown" and "absent"
+ * collapse to the same answer.
+ */
+function claimOf(token, claim) {
+    const value = payloadOf(token)?.[claim];
+    return typeof value === "string" ? value : undefined;
+}
+/** Whether the token has a JWT's shape: three parts and a JSON object payload. */
+export function isJwtShaped(token) {
+    return payloadOf(token) !== undefined;
+}
+/** The `exp` claim in seconds since the epoch, when the token carries a numeric one. */
+export function expiryClaimOf(token) {
+    const value = payloadOf(token)?.exp;
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+/** Extract the `token_type` claim (e.g. a user's Auth0 token has none). */
+export function tokenTypeOf(token) {
+    return claimOf(token, CLAIM_TOKEN_TYPE);
+}
+/**
+ * Extract the `session_id` claim of a session-scoped token. A claimed pool
+ * member reads its post-claim identity from this on restart.
+ */
+export function sessionIdClaimOf(token) {
+    return claimOf(token, CLAIM_SESSION_ID);
+}
+/** Whether the token is a bootstrap-minted `embedded_runner` credential. */
+export function isEmbeddedRunnerToken(token) {
+    return tokenTypeOf(token) === TOKEN_TYPE_EMBEDDED_RUNNER;
+}
+/**
+ * `token` when it is a runner-class credential already scoped below the
+ * runner (a cloud sandbox's session token, a connect token): one the
+ * scoped-token exchange leaves in use rather than exchanging
+ * (`stigmer-client.ts` `acquireScopedRunnerToken`). `undefined` for an
+ * unscoped key (an operator's API key, an embedded runner's bootstrap
+ * token) and for none.
+ */
+export function scopedRunnerCredential(token) {
+    const type = tokenTypeOf(token);
+    return token && type !== undefined && type !== TOKEN_TYPE_EMBEDDED_RUNNER ? token : undefined;
+}
+//# sourceMappingURL=token-claims.js.map

package/dist/client/token-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-claims.js","sourceRoot":"","sources":["../../src/client/token-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;AAE5D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAEtD,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC;;;GAGG;AACH,SAAS,SAAS,CAChB,KAAgC;IAEhC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrD,CAAC;QACF,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/E,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CACd,KAAgC,EAChC,KAAa;IAEb,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;AACxC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,OAAO,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgC;IAC/D,OAAO,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,KAAgC;IACpE,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,0BAA0B,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAgC;IACrE,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC"}