@stratusagent/gateway 0.14.8 → 0.14.9

package/dist/credential-requests.js

@@ -0,0 +1,452 @@
+/*
+ * Credential requests: the `credential.request` tool, the requests it opens,
+ * and answering one (storing the value, granting it, auditing the change).
+ * Moved out of `createGateway` in index.ts as is: the statements are
+ * unchanged, inside a factory that takes what they closed over there, and
+ * `createGateway` calls it where they were and destructures what it returns.
+ * formCredentialValue and isFlattenedPem, used only here, moved with them.
+ */
+import { randomUUID } from 'node:crypto';
+import { matchesToolAllowlist, } from '@stratusagent/core';
+import { createCredentialRequestTool, CREDENTIAL_REQUEST_TOOL_NAME, credentialVariableProblem, } from '@stratusagent/agents';
+import { addNamedCredential, appendCredentialAudit, CREDENTIAL_NAME_PATTERN, grantSoulCredential, loadSoulFile, NamedCredentialExistsError, NamedCredentialMissingError, namedCredentialSource, quoteShellArg, replaceNamedCredential, withSoulFileLock, } from '@stratusagent/state';
+/**
+ * A value from a form, without the line breaks around it.
+ *
+ * Forms take multi-line values now, so a one-line key copied with the line
+ * break after it would otherwise be stored with it, and fail later inside
+ * whatever header or command it lands in. Only line breaks: a value's own
+ * spaces are its own, as on the CLI.
+ */
+const formCredentialValue = (value) => value.replace(/^[\r\n]+|[\r\n]+$/g, '');
+/**
+ * A PEM block (a private key, a certificate) with no line breaks left, which
+ * is what a one-line field makes of a pasted key file. PEM readers need the
+ * line after the `-----BEGIN …-----` header, so storing it would only move
+ * the failure to the first call that reads the key. Only a value that *is*
+ * one: a PEM inside JSON (a service account file) escapes its line breaks,
+ * so it has none of its own and is fine as sent.
+ */
+const isFlattenedPem = (value) => /^\s*-----BEGIN [A-Z0-9 ]+-----/.test(value) && !value.includes('\n');
+export const createCredentialRequests = ({ env, warn, bus, startedChannels, channelCarrying, registry, sources, unlistedTools, tools, }) => {
+    /**
+     * Credential requests waiting on a person, by request id.
+     *
+     * In memory on purpose: a request is a question somebody is being asked
+     * now, and a restart that forgot it only means the agent asks again. What
+     * matters is that the entry carries everything the answer needs, so a
+     * channel quoting the id back decides nothing about where the key goes.
+     */
+    const credentialRequests = new Map();
+    tools.register(createCredentialRequestTool(async (request, session) => {
+        const agentId = session.agent.id;
+        const soulPath = sources.get(agentId)?.soulPath;
+        if (soulPath === undefined) {
+            throw new Error(`${session.agent.name} is the built-in agent and has no soul file to grant a credential in. `
+                + `Your operator can store one on the machine with \`stratus credential set ${request.name}\`.`);
+        }
+        if (!CREDENTIAL_NAME_PATTERN.test(request.name)) {
+            throw new Error(`${JSON.stringify(request.name)} is not a credential name. Use letters, digits, dots, dashes, or underscores, `
+                + 'starting with a letter, the way the tool that needs it spells it: search.apiKey, github.token.');
+        }
+        // The stricter rule, for a name the model picked: checked before anyone
+        // is asked, so an approver never sees a form whose binding the store
+        // would refuse, and so a variable that changes what a judged command
+        // does (NODE_OPTIONS) is never offered at all.
+        if (request.env !== undefined) {
+            const problem = credentialVariableProblem(request.env, { requested: true });
+            if (problem !== undefined) {
+                throw new Error(`${problem} Nothing is pending.`);
+            }
+        }
+        // A key already stored is not something to ask a person for again: the
+        // form only adds, so it could only fail. Say what is actually missing.
+        const source = await namedCredentialSource(env, agentId, request.name);
+        const stored = source !== undefined;
+        const granted = session.agent.credentials?.includes(request.name) === true;
+        // Binding a key the agent already holds asks for no value, and every
+        // form today has a value field, so phase 1 leaves it to the machine.
+        const bindOnMachine = request.env !== undefined
+            ? ` To have your shell read it as ${request.env}, ask your operator to run \`stratus credential env ${request.name} ${request.env} --agent ${quoteShellArg(agentId)}\` on the machine.`
+            : '';
+        if (request.replace === true) {
+            // Checked here, before anyone is asked, so an approver is never shown
+            // a form whose answer could only be refused.
+            if (!stored || !granted) {
+                throw new Error(`You don't hold ${request.name}, so there is nothing to replace. Ask for it without replace.`);
+            }
+            if (source === 'environment') {
+                throw new Error(`${request.name} comes from the daemon's environment, which a form can't change. `
+                    + 'Ask your operator to change it where that environment is set.');
+            }
+            if (source === 'shared' && request.scope !== 'shared') {
+                throw new Error(`${request.name} is a shared credential, so replacing it changes the key for every agent granted it. `
+                    + 'Ask again with scope "shared" if that is what you mean.');
+            }
+            if (source === 'agent' && request.scope === 'shared') {
+                throw new Error(`${request.name} is your own credential, not a shared one. Ask again with scope "agent" to replace it.`);
+            }
+            if (request.via === 'link') {
+                throw new Error('A replacement is asked for in a form an approver answers, never a link. Nothing is pending.');
+            }
+        }
+        else if (stored && granted) {
+            throw new Error(`You already hold ${request.name}; the tools that need it use it for you. To rotate it for a new value, ask again with replace: true.${bindOnMachine}`
+                + (request.env !== undefined ? ' Nothing is pending.' : ''));
+        }
+        else if (stored) {
+            throw new Error(`${request.name} is already ${source === 'environment' ? "supplied by the daemon's environment" : 'stored'} but not granted to you. `
+                + `Ask your operator to add it to the credentials list in your soul; a form would only refuse to store it again.${bindOnMachine}`);
+        }
+        const onMachine = request.env === undefined
+            ? `\`stratus credential set ${request.name}${request.scope === 'agent' ? ` --agent ${quoteShellArg(agentId)}` : ''}\``
+            : request.scope === 'agent'
+                ? `\`stratus credential set ${request.name} --agent ${quoteShellArg(agentId)} --env ${request.env}\``
+                : `\`stratus credential set ${request.name}\`, then \`stratus credential env ${request.name} ${request.env} --agent ${quoteShellArg(agentId)}\``;
+        const record = {
+            agentId,
+            sessionId: session.id,
+            name: request.name,
+            scope: request.scope,
+            soulPath,
+            ...(request.replace === true ? { replace: true } : {}),
+            ...(request.env !== undefined ? { env: request.env } : {}),
+        };
+        const announce = async (requestId, via) => {
+            await bus.emit({
+                type: 'credential.requested',
+                sessionId: session.id,
+                agentId,
+                requestId,
+                name: request.name,
+                scope: request.scope,
+                ...(request.reason !== undefined ? { reason: request.reason } : {}),
+                via,
+                ...(request.replace === true ? { replace: true } : {}),
+                ...(request.env !== undefined ? { env: request.env } : {}),
+                ...(session.metadata ? { metadata: session.metadata } : {}),
+            });
+        };
+        // A link only for an agent whose soul lists the tool. Every agent may
+        // ask through a form, because a form goes to an approver; a link is a
+        // bearer credential the model is handed, and whoever it reaches can
+        // store a key and amend the soul. That is the operator's to allow.
+        const allowlist = session.agent.tools ?? registry.get(agentId)?.tools;
+        // An omitted list grants the safe tools, this one among them, but a
+        // link is the operator's to allow by naming it, so only a list says yes.
+        // On a home an older build set up an omitted list is every tool, and
+        // has always allowed a link there.
+        const linkAllowed = allowlist === undefined
+            ? unlistedTools() === 'every'
+            : matchesToolAllowlist(CREDENTIAL_REQUEST_TOOL_NAME, allowlist);
+        // Why no form went up, said to the agent beside the link that replaces
+        // it, so it can tell the person why they are getting a link instead.
+        let formUnavailable;
+        if (request.via !== 'link') {
+            // Only a conversation a channel started has anywhere to show a form,
+            // and only a channel that renders one can show it: a scheduled or
+            // HTTP turn, or a channel with no form, would record a request nobody
+            // sees while the agent tells its user the operator was asked.
+            const kind = session.metadata?.channel;
+            const { adapter } = typeof kind === 'string'
+                ? channelCarrying(kind, agentId, (candidate) => candidate.requestCredential !== undefined
+                    && (request.replace !== true || candidate.credentialReplaceForms === true)
+                    // A form that can't say the key will be shell-readable must not
+                    // be the approval for it: a link says it instead.
+                    && (request.env === undefined || candidate.credentialEnvForms === true))
+                : { adapter: undefined };
+            if (!adapter?.requestCredential || !session.metadata) {
+                formUnavailable = typeof kind === 'string'
+                    ? `This conversation's channel (${kind}) cannot show your operator a ${request.replace === true ? 'replacement' : 'credential'} form here${request.env !== undefined ? ' that says which variable your shell will read it from' : ''}.`
+                    : 'This conversation is not in a channel that can show your operator a form.';
+            }
+            else {
+                const requestId = randomUUID();
+                credentialRequests.set(requestId, { ...record, via: 'form' });
+                // Delivered before it is announced, and dropped if delivery fails: a
+                // request whose post never landed has no button to answer it, so
+                // keeping it would leave it pending for good behind a tool result
+                // saying the operator was asked.
+                try {
+                    await adapter.requestCredential({
+                        sessionId: session.id,
+                        agentId,
+                        requestId,
+                        name: request.name,
+                        scope: request.scope,
+                        ...(request.reason !== undefined ? { reason: request.reason } : {}),
+                        ...(request.replace === true ? { replace: true } : {}),
+                        ...(request.env !== undefined ? { env: request.env } : {}),
+                        metadata: session.metadata,
+                    });
+                    await announce(requestId, 'form');
+                    return { requestId, via: 'form' };
+                }
+                catch (error) {
+                    credentialRequests.delete(requestId);
+                    formUnavailable = `The form could not be shown here: ${error instanceof Error ? error.message : String(error)}`;
+                }
+            }
+            if (request.replace === true) {
+                // Never a link: whoever holds one could change a key in use.
+                throw new Error(`${formUnavailable} Nothing is pending. A replacement needs a conversation that can show an approver a form.`);
+            }
+            if (request.via === 'form') {
+                throw new Error(`${formUnavailable} Nothing is pending. ${linkAllowed ? 'Ask for a link instead (via: "link"), or ask' : 'Ask'} your operator to store ${request.name} on the machine with ${onMachine} and grant it to you.`);
+            }
+        }
+        if (!linkAllowed) {
+            throw new Error(`${formUnavailable !== undefined ? `${formUnavailable} ` : ''}A one-time link needs ${CREDENTIAL_REQUEST_TOOL_NAME} in your soul's tools: list, and it is not there. Nothing is pending. `
+                + `Ask in a conversation that can show your operator a form, or ask your operator to store ${request.name} on the machine with ${onMachine} and grant it to you.`);
+        }
+        // A link where no form can go, from whichever adapter issues them: the
+        // control API, which is not tied to any one agent's transport.
+        const linker = startedChannels.find((candidate) => candidate.requestCredentialLink !== undefined);
+        if (!linker?.requestCredentialLink) {
+            throw new Error(`${formUnavailable !== undefined ? `${formUnavailable} ` : ''}No control API is running to issue a link either. `
+                + `Ask your operator to store ${request.name} on the machine with ${onMachine} and grant it to you.`);
+        }
+        const requestId = randomUUID();
+        credentialRequests.set(requestId, { ...record, via: 'link' });
+        let link;
+        try {
+            link = await linker.requestCredentialLink({
+                sessionId: session.id,
+                agentId,
+                agentName: session.agent.name,
+                requestId,
+                name: request.name,
+                scope: request.scope,
+                ...(request.reason !== undefined ? { reason: request.reason } : {}),
+                ...(request.env !== undefined ? { env: request.env } : {}),
+            });
+        }
+        catch (error) {
+            credentialRequests.delete(requestId);
+            throw new Error(`A link for ${request.name} could not be issued: ${error instanceof Error ? error.message : String(error)} `
+                + `Nothing is pending. Ask your operator to store it on the machine with ${onMachine}.`);
+        }
+        await announce(requestId, 'link');
+        return {
+            requestId,
+            via: 'link',
+            url: link.url,
+            expiresAt: link.expiresAt,
+            ...(link.localOnly === true ? { localOnly: true } : {}),
+            ...(formUnavailable !== undefined ? { formUnavailable } : {}),
+        };
+    }));
+    /**
+     * Requests an answer is being stored for now. Claimed before the first
+     * await: two approvers submitting one form at once would otherwise both
+     * start storing, and the second's add-only conflict would retire a
+     * request the first was about to settle as added.
+     */
+    const answering = new Set();
+    const provideCredential = async (input) => {
+        const request = credentialRequests.get(input.requestId);
+        if (!request) {
+            return { ok: false, retired: true, message: 'That credential request is no longer pending. Ask the agent to request it again.' };
+        }
+        if (answering.has(input.requestId)) {
+            return { ok: false, message: 'Someone else\'s answer to this request is being stored right now. Wait a moment before trying again.' };
+        }
+        answering.add(input.requestId);
+        try {
+            return await answerCredentialRequest(input, request);
+        }
+        finally {
+            answering.delete(input.requestId);
+        }
+    };
+    /**
+     * The audit line for a key changed from a chat or a link. After the
+     * store, since it records what happened; a line that can't be written is
+     * warned about rather than undoing a change that already landed.
+     */
+    const auditCredentialChange = async (action, request, actor) => {
+        try {
+            await appendCredentialAudit(env, {
+                action,
+                name: request.name,
+                ...(request.scope === 'agent' ? { agentId: request.agentId } : {}),
+                ...(actor !== undefined ? { actor } : {}),
+                via: request.via ?? 'form',
+                requestedBy: request.agentId,
+                ...(request.env !== undefined ? { env: request.env, bindingFor: request.agentId } : {}),
+            });
+        }
+        catch (error) {
+            warn(`credentials: ${request.name} was ${action === 'add' ? 'added' : 'replaced'}, but the audit line could not be written (${error instanceof Error ? error.message : String(error)}).`);
+        }
+    };
+    const answerCredentialRequest = async (input, request) => {
+        // The agent must still be served from the file the request captured: a
+        // repointed default soul (same id, another file) replaces the source,
+        // and a grant landing in the old file would report a key the agent now
+        // running cannot use.
+        const served = sources.get(request.agentId)?.soulPath;
+        if (served !== request.soulPath) {
+            credentialRequests.delete(input.requestId);
+            return {
+                ok: false,
+                retired: true,
+                message: `${request.agentId} is no longer served from ${request.soulPath}, so nothing was stored. Ask ${request.agentId} to request it again.`,
+            };
+        }
+        // The soul the grant will land in must still be the requester's, and is
+        // checked before anything is stored: a file reassigned to another agent
+        // while the request waited would otherwise receive a key nobody meant
+        // to give it. `grantSoulCredential` checks again as it writes.
+        let owner;
+        try {
+            owner = (await loadSoulFile(request.soulPath)).agent.id;
+        }
+        catch (error) {
+            return {
+                ok: false,
+                message: `${request.agentId}'s soul could not be read (${error instanceof Error ? error.message : String(error)}), so nothing was stored.`,
+            };
+        }
+        if (owner !== request.agentId) {
+            credentialRequests.delete(input.requestId);
+            return {
+                ok: false,
+                retired: true,
+                message: `${request.soulPath} now belongs to ${owner}, not ${request.agentId}, so nothing was stored. Ask ${request.agentId} to request it again.`,
+            };
+        }
+        const value = formCredentialValue(input.value);
+        if (isFlattenedPem(value)) {
+            // Refused, not retired: the same form can still take the key whole.
+            const command = request.scope === 'agent'
+                ? `stratus credential set ${request.name} --agent ${quoteShellArg(request.agentId)} < key.pem`
+                : `stratus credential set ${request.name} < key.pem`;
+            return {
+                ok: false,
+                message: 'That looks like a PEM key whose line breaks were lost, so nothing was stored: whatever reads it would fail. '
+                    + `Paste it again from the original file with its line breaks, or store it on the machine: ${command}.`,
+            };
+        }
+        const store = {
+            ...(request.scope === 'agent' ? { agentId: request.agentId } : {}),
+            // The binding the form promised, written with the value, always for
+            // the agent that asked: consent is per agent even for a shared key.
+            ...(request.env !== undefined ? { bind: { agentId: request.agentId, variable: request.env } } : {}),
+        };
+        if (request.replace === true) {
+            // Re-read under the soul lock, so a grant removed while the form
+            // waited (a shared key most of all) is never rotated on its behalf.
+            let stillGranted;
+            try {
+                stillGranted = await withSoulFileLock(async () => {
+                    const soul = await loadSoulFile(request.soulPath);
+                    if (soul.agent.id !== request.agentId || soul.agent.credentials?.includes(request.name) !== true) {
+                        return false;
+                    }
+                    await replaceNamedCredential(env, { name: request.name, value, ...store });
+                    return true;
+                });
+            }
+            catch (error) {
+                // Removed since the request was made: no value can land now.
+                if (error instanceof NamedCredentialMissingError) {
+                    credentialRequests.delete(input.requestId);
+                    return { ok: false, retired: true, message: error.message };
+                }
+                return { ok: false, message: error instanceof Error ? error.message : String(error) };
+            }
+            if (!stillGranted) {
+                credentialRequests.delete(input.requestId);
+                return {
+                    ok: false,
+                    retired: true,
+                    message: `${request.agentId} is no longer granted ${request.name} in ${request.soulPath}, so the stored key was kept. Ask ${request.agentId} to request it again if it still needs it.`,
+                };
+            }
+            credentialRequests.delete(input.requestId);
+            await auditCredentialChange('replace', request, input.actor);
+            await bus.emit({
+                type: 'credential.provided',
+                sessionId: request.sessionId,
+                agentId: request.agentId,
+                requestId: input.requestId,
+                name: request.name,
+                scope: request.scope,
+                replace: true,
+                ...(request.env !== undefined ? { env: request.env } : {}),
+                ...(input.actor !== undefined ? { actor: input.actor } : {}),
+            });
+            // The soul already lists it: a replace is only asked for a key held.
+            return { ok: true, name: request.name, scope: request.scope, agentId: request.agentId, granted: false };
+        }
+        try {
+            await addNamedCredential(env, {
+                name: request.name,
+                value,
+                ...store,
+            });
+        }
+        catch (error) {
+            // A name stored since the request was made (another form for the
+            // same shared key, or the machine) is final under add-only: no value
+            // typed into this form can ever land, so the request is retired
+            // rather than left answering every submission with the same refusal.
+            if (error instanceof NamedCredentialExistsError) {
+                credentialRequests.delete(input.requestId);
+                return { ok: false, retired: true, message: error.message };
+            }
+            // Otherwise refused, not failed: the request stays pending, so a
+            // person who typed an empty value can try again from the same form.
+            return { ok: false, message: error instanceof Error ? error.message : String(error) };
+        }
+        credentialRequests.delete(input.requestId);
+        await auditCredentialChange('add', request, input.actor);
+        // Stored first, granted second: a key nobody may use is recoverable by
+        // editing the soul, while a soul naming a key that was never stored
+        // fails every call that reaches for it. Announced either way, because
+        // the store already changed and a shared key is already usable.
+        //
+        // The served path is checked again under the soul lock, which roster
+        // reloads take too: a default repointed while the key was being
+        // written, or while the grant queued behind another soul edit, would
+        // otherwise be granted in a file the running agent no longer reads.
+        let granted = false;
+        let grantError;
+        try {
+            granted = await grantSoulCredential(request.soulPath, request.name, request.agentId, {
+                check: () => {
+                    const servedNow = sources.get(request.agentId)?.soulPath;
+                    if (servedNow !== request.soulPath) {
+                        throw new Error(`${request.agentId} is now served from ${servedNow ?? 'no soul file'}, not ${request.soulPath}`);
+                    }
+                },
+            });
+        }
+        catch (error) {
+            grantError = error instanceof Error ? error.message : String(error);
+        }
+        await bus.emit({
+            type: 'credential.provided',
+            sessionId: request.sessionId,
+            agentId: request.agentId,
+            requestId: input.requestId,
+            name: request.name,
+            scope: request.scope,
+            ...(request.env !== undefined ? { env: request.env } : {}),
+            ...(input.actor !== undefined ? { actor: input.actor } : {}),
+            ...(grantError !== undefined ? { grantError } : {}),
+        });
+        if (grantError !== undefined) {
+            return {
+                ok: false,
+                retired: true,
+                message: `${request.name} was stored, but could not be added to ${request.soulPath} `
+                    + `(${grantError}). Add it to the soul's credentials list by hand.`,
+            };
+        }
+        return { ok: true, name: request.name, scope: request.scope, agentId: request.agentId, granted };
+    };
+    return { provideCredential };
+};
+//# sourceMappingURL=credential-requests.js.map

package/dist/credential-requests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-requests.js","sourceRoot":"","sources":["../src/credential-requests.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAKL,oBAAoB,GAGrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EACrB,aAAa,EACb,sBAAsB,EAEtB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAE/F;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE,CAChD,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAmBxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,EACvC,GAAG,EACH,IAAI,EACJ,GAAG,EACH,eAAe,EACf,eAAe,EACf,QAAQ,EACR,OAAO,EACP,aAAa,EACb,KAAK,GACkB,EAAE,EAAE;IAC3B;;;;;;;OAOG;IACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAY9B,CAAC;IAEL,KAAK,CAAC,QAAQ,CAAC,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QACpE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;QAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,wEAAwE;kBAC3F,4EAA4E,OAAO,CAAC,IAAI,KAAK,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,gFAAgF;kBAC7G,gGAAgG,CACnG,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,+CAA+C;QAC/C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,sBAAsB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;QAC3E,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS;YAC7C,CAAC,CAAC,kCAAkC,OAAO,CAAC,GAAG,uDAAuD,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,YAAY,aAAa,CAAC,OAAO,CAAC,oBAAoB;YACvL,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,sEAAsE;YACtE,6CAA6C;YAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,CAAC,IAAI,+DAA+D,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,IAAI,mEAAmE;sBAChF,+DAA+D,CAClE,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,IAAI,uFAAuF;sBACpG,yDAAyD,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,wFAAwF,CAAC,CAAC;YAC3H,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,CAAC,IAAI,uGAAuG,aAAa,EAAE;kBACpJ,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,IAAI,eAAe,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,QAAQ,2BAA2B;kBACnI,gHAAgH,aAAa,EAAE,CAClI,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS;YACzC,CAAC,CAAC,4BAA4B,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI;YACtH,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO;gBACzB,CAAC,CAAC,4BAA4B,OAAO,CAAC,IAAI,YAAY,aAAa,CAAC,OAAO,CAAC,UAAU,OAAO,CAAC,GAAG,IAAI;gBACrG,CAAC,CAAC,4BAA4B,OAAO,CAAC,IAAI,qCAAqC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,YAAY,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;QACrJ,MAAM,MAAM,GAAG;YACb,OAAO;YACP,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ;YACR,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,EAAE,SAAiB,EAAE,GAAuB,EAAiB,EAAE;YACnF,MAAM,GAAG,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,sBAAsB;gBAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,OAAO;gBACP,SAAS;gBACT,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG;gBACH,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC,CAAC;QACF,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;QACtE,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,mCAAmC;QACnC,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS;YACzC,CAAC,CAAC,aAAa,EAAE,KAAK,OAAO;YAC7B,CAAC,CAAC,oBAAoB,CAAC,4BAA4B,EAAE,SAAS,CAAC,CAAC;QAClE,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,eAAmC,CAAC;QACxC,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YAC3B,qEAAqE;YACrE,kEAAkE;YAClE,sEAAsE;YACtE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,IAAI,KAAK,QAAQ;gBAC1C,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,KAAK,SAAS;uBACpF,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBAC1E,gEAAgE;oBAChE,kDAAkD;uBAC/C,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC;gBAC1E,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,EAAE,iBAAiB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrD,eAAe,GAAG,OAAO,IAAI,KAAK,QAAQ;oBACxC,CAAC,CAAC,gCAAgC,IAAI,iCAAiC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,aAAa,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,EAAE,GAAG;oBACvO,CAAC,CAAC,2EAA2E,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;gBAC/B,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC9D,qEAAqE;gBACrE,iEAAiE;gBACjE,kEAAkE;gBAClE,iCAAiC;gBACjC,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,iBAAiB,CAAC;wBAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;wBACrB,OAAO;wBACP,SAAS;wBACT,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1D,QAAQ,EAAE,OAAO,CAAC,QAAQ;qBAC3B,CAAC,CAAC;oBACH,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;oBAClC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;gBACpC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBACrC,eAAe,GAAG,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClH,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC7B,6DAA6D;gBAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,eAAe,2FAA2F,CAAC,CAAC;YACjI,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,eAAe,wBAAwB,WAAW,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,KAAK,2BAA2B,OAAO,CAAC,IAAI,wBAAwB,SAAS,uBAAuB,CAAC,CAAC;YACjO,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,CAAC,CAAC,CAAC,EAAE,yBAAyB,4BAA4B,wEAAwE;kBACxL,2FAA2F,OAAO,CAAC,IAAI,wBAAwB,SAAS,uBAAuB,CAClK,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC;QAClG,IAAI,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,CAAC,CAAC,CAAC,EAAE,oDAAoD;kBAC/G,8BAA8B,OAAO,CAAC,IAAI,wBAAwB,SAAS,uBAAuB,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9D,IAAI,IAA6D,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC;gBACxC,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,OAAO;gBACP,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;gBAC7B,SAAS;gBACT,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,IAAI,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG;kBAC1G,yEAAyE,SAAS,GAAG,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO;YACL,SAAS;YACT,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC;IAEJ;;;;;OAKG;IACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,MAAM,iBAAiB,GAAG,KAAK,EAAE,KAA6B,EAAoC,EAAE;QAClG,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kFAAkF,EAAE,CAAC;QACnI,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sGAAsG,EAAE,CAAC;QACxI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;IAEF;;;;OAIG;IACH,MAAM,qBAAqB,GAAG,KAAK,EACjC,MAAyB,EACzB,OAA+D,EAC/D,KAAyB,EACV,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,GAAG,EAAE;gBAC/B,MAAM;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM;gBAC1B,WAAW,EAAE,OAAO,CAAC,OAAO;gBAC5B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,OAAO,CAAC,IAAI,QAAQ,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,8CAA8C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5L,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,uBAAuB,GAAG,KAAK,EACnC,KAA6B,EAC7B,OAA+D,EAC7B,EAAE;QACpC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,sBAAsB;QACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;QACtD,IAAI,MAAM,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YAChC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,6BAA6B,OAAO,CAAC,QAAQ,gCAAgC,OAAO,CAAC,OAAO,uBAAuB;aAC/I,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,+DAA+D;QAC/D,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B;aAC3I,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9B,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,mBAAmB,KAAK,SAAS,OAAO,CAAC,OAAO,gCAAgC,OAAO,CAAC,OAAO,uBAAuB;aACnJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,oEAAoE;YACpE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,KAAK,OAAO;gBACvC,CAAC,CAAC,0BAA0B,OAAO,CAAC,IAAI,YAAY,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY;gBAC9F,CAAC,CAAC,0BAA0B,OAAO,CAAC,IAAI,YAAY,CAAC;YACvD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,8GAA8G;sBACnH,2FAA2F,OAAO,GAAG;aAC1G,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpG,CAAC;QACF,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,iEAAiE;YACjE,oEAAoE;YACpE,IAAI,YAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE;oBAC/C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAClD,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;wBACjG,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,MAAM,sBAAsB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;oBAC3E,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,6DAA6D;gBAC7D,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;oBACjD,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC9D,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC3C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,yBAAyB,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,QAAQ,qCAAqC,OAAO,CAAC,OAAO,4CAA4C;iBACxL,CAAC;YACJ,CAAC;YACD,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,GAAG,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,qBAAqB;gBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC,CAAC;YACH,qEAAqE;YACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC1G,CAAC;QACD,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,GAAG,EAAE;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK;gBACL,GAAG,KAAK;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iEAAiE;YACjE,qEAAqE;YACrE,gEAAgE;YAChE,qEAAqE;YACrE,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9D,CAAC;YACD,iEAAiE;YACjE,oEAAoE;YACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,EAAE;QACF,qEAAqE;QACrE,gEAAgE;QAChE,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;gBACnF,KAAK,EAAE,GAAG,EAAE;oBACV,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;oBACzD,IAAI,SAAS,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;wBACnC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,uBAAuB,SAAS,IAAI,cAAc,SAAS,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACnH,CAAC;gBACH,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,qBAAqB;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,0CAA0C,OAAO,CAAC,QAAQ,GAAG;sBACjF,IAAI,UAAU,mDAAmD;aACtE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;IACnG,CAAC,CAAC;IAEF,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC/B,CAAC,CAAC"}

package/dist/dispatch.d.ts

@@ -0,0 +1,34 @@
+import { type Session } from '@stratusagent/core';
+import { type MergeBatch } from './merge-batch.ts';
+import type { ShardedSessionStore } from './sessions.ts';
+import { type IntakeState } from './lifecycle.ts';
+import type { DispatchInput } from './types.ts';
+import type { TurnDispatch } from './turn-dispatch.ts';
+import type { Recovery } from './recovery.ts';
+import type { Steering } from './steering.ts';
+/** What `dispatch` closes over in `createGateway`. */
+export interface DispatchDeps extends Pick<TurnDispatch, 'dispatchInternal'>, Pick<Recovery, 'settleRepeat'>, Pick<Steering, 'takeSteered'> {
+    store: ShardedSessionStore;
+    sessionChains: Map<string, Promise<unknown>>;
+    queuedWork: Map<string, number>;
+    waitingDispatches: Map<string, number>;
+    isStopping: () => boolean;
+    getIntakeState: () => IntakeState;
+    isHeld: () => boolean;
+    refusal: () => Error;
+    activeTurns: Map<string, string>;
+    liveWorkItems: Map<string, Map<string, {
+        turn: Promise<Session>;
+        agentId: string | undefined;
+        confirmed: boolean;
+        addressed: boolean;
+    }>>;
+    openBatches: Map<string, MergeBatch>;
+    settleOrphanedItem: (sessionId: string) => Promise<void>;
+    onSessionChain: <T>(sessionId: string, work: () => Promise<T>, released?: () => boolean) => Promise<T>;
+}
+export declare const createDispatch: ({ store, sessionChains, queuedWork, waitingDispatches, isStopping, getIntakeState, isHeld, refusal, activeTurns, liveWorkItems, openBatches, settleOrphanedItem, onSessionChain, dispatchInternal, settleRepeat, takeSteered, }: DispatchDeps) => {
+    dispatch: (input: DispatchInput) => Promise<Session>;
+};
+export type Dispatch = ReturnType<typeof createDispatch>;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAWA,OAAO,EAML,KAAK,OAAO,EAGb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,UAAU,EAIhB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAA2D,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAOhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,sDAAsD;AACtD,MAAM,WAAW,YAAa,SAAQ,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC;IACzI,KAAK,EAAE,mBAAmB,CAAC;IAC3B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,cAAc,EAAE,MAAM,WAAW,CAAC;IAClC,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,KAAK,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,aAAa,EAAE,GAAG,CAChB,MAAM,EACN,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAC7G,CAAC;IACF,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,cAAc,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACxG;AAED,eAAO,MAAM,cAAc,GAAI,iOAiB5B,YAAY;sBACkB,aAAa,KAAG,OAAO,CAAC,OAAO,CAAC;CAqchE,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}