@superblocksteam/gateway 2.0.155-next.0

package/dist/server/client.js

@@ -0,0 +1,572 @@
+import { uploadAttachmentToServerApi } from "@superblocksteam/shared";
+import { recordIdentityReadOutcome } from "../telemetry/metrics.js";
+import { withGuardedIdentityReads, } from "./identity-reads.js";
+const MAX_DETAIL_LENGTH = 300;
+/**
+ * Pulls the server's own explanation out of an error body.
+ *
+ * Bounded because the body is attacker-influenced in principle and ends up in
+ * logs and in tool output the caller sees.
+ */
+function detailSuffix(body) {
+    if (!body.trim()) {
+        return "";
+    }
+    let detail = body;
+    try {
+        const parsed = JSON.parse(body);
+        if (parsed && typeof parsed === "object") {
+            const record = parsed;
+            const message = record.responseMeta?.message ?? record.message ?? record.error;
+            if (typeof message === "string" && message.trim()) {
+                detail = message;
+            }
+        }
+    }
+    catch {
+        // Not JSON — fall back to the raw body.
+    }
+    const trimmed = detail.trim().slice(0, MAX_DETAIL_LENGTH);
+    return ` — ${trimmed}`;
+}
+export class ServerHttpError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "ServerHttpError";
+    }
+}
+/**
+ * Generous enough for a sandbox start.
+ *
+ * It is not short enough to keep a tool call from hanging, which is what this
+ * used to claim: a tool call waits on the identity read, and that one is bounded
+ * by {@link DEFAULT_IDENTITY_TIMEOUT_MS} instead.
+ */
+const DEFAULT_TIMEOUT_MS = 120_000;
+/**
+ * The identity read gets its own, much tighter bound.
+ *
+ * {@link DEFAULT_TIMEOUT_MS} is sized for starting a sandbox. Nothing waits on
+ * that; every tool call waits on `/users/me`. Giving the two the same budget is
+ * what let a single wedged route hold each call for two minutes.
+ *
+ * Still well above the ~10s a caller waits (see
+ * {@link withGuardedIdentityReads}) so that an endpoint which answers slowly
+ * rather than never can still finish and fill the cache.
+ */
+const DEFAULT_IDENTITY_TIMEOUT_MS = 30_000;
+/**
+ * Whether a failed identity read means the endpoint is unhealthy rather than
+ * that this one credential is bad.
+ *
+ * A 4xx is a definite answer about a single caller, so it must not trip the
+ * breaker and start failing everyone else fast. A 5xx, a timeout or a
+ * transport error says nothing about the credential and everything about the
+ * route.
+ *
+ * 429 is the exception on the 4xx side: a shared rate limit is a statement
+ * about the route's capacity, not about this credential, and it is exactly the
+ * case where hammering on is worst. Treating it as the caller's fault left it
+ * neither retried (only >= 500 is) nor able to open the breaker, so every call
+ * kept going straight at an endpoint already asking for less load.
+ */
+function identityEndpointUnhealthy(error) {
+    return !(error instanceof ServerHttpError &&
+        error.status < 500 &&
+        error.status !== 429);
+}
+/**
+ * Extra attempts for reads that failed with a server-side error.
+ *
+ * Only GETs are retried: they carry no side effects, so a repeat is free. A
+ * failed POST may well have taken effect, and re-sending one can deploy or
+ * commit twice.
+ */
+const READ_RETRY_ATTEMPTS = 2;
+const READ_RETRY_BASE_DELAY_MS = 100;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+const DEPLOY_STATUSES = [
+    "awaiting_ack",
+    "deployed",
+    "failed",
+    "queued",
+];
+function isDeployStatus(value) {
+    return DEPLOY_STATUSES.includes(value);
+}
+/**
+ * SABS's build status as this client's own vocabulary.
+ *
+ * It answers with `BUILD_STATUS_*` strings through the server, and with the
+ * matching protobuf ordinals when the response is not re-serialized on the way
+ * — the editor's own client normalizes both, and so does this.
+ */
+const BUILD_PROGRESS_BY_ORDINAL = {
+    0: "none",
+    1: "running",
+    2: "success",
+    3: "failed",
+    4: "timed_out",
+};
+const BUILD_PROGRESS_BY_NAME = {
+    FAILED: "failed",
+    RUNNING: "running",
+    SUCCESS: "success",
+    TIMED_OUT: "timed_out",
+    UNSPECIFIED: "none",
+};
+function buildProgress(status) {
+    if (typeof status === "number") {
+        return BUILD_PROGRESS_BY_ORDINAL[status] ?? "none";
+    }
+    if (typeof status !== "string") {
+        return "none";
+    }
+    const name = status
+        .trim()
+        .toUpperCase()
+        .replace(/^BUILD_STATUS_/, "");
+    return BUILD_PROGRESS_BY_NAME[name] ?? "none";
+}
+export class HttpSuperblocksServerClient {
+    identityTimeoutMs;
+    readIdentity;
+    serverUrl;
+    timeoutMs;
+    constructor(serverUrl, options = {}) {
+        this.serverUrl = serverUrl;
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.identityTimeoutMs =
+            options.identityTimeoutMs ?? DEFAULT_IDENTITY_TIMEOUT_MS;
+        this.readIdentity = withGuardedIdentityReads((apiKey) => this.readIdentityFromServer(apiKey), {
+            onOutcome: recordIdentityReadOutcome,
+            opensBreaker: identityEndpointUnhealthy,
+            ...options.identityReads,
+        });
+    }
+    baseUrl() {
+        return this.serverUrl.replace(/\/$/, "");
+    }
+    /**
+     * Unwraps the Superblocks `ResponseDto` envelope.
+     *
+     * Every v1/v2/v3 route the gateway calls replies with
+     * `{ responseMeta, data }`. Reading the body directly yields `undefined` for
+     * every field, which is indistinguishable from a legitimately empty response
+     * — so this is deliberately strict rather than falling back to the raw body.
+     */
+    async requestData(path, init) {
+        const body = await this.request(path, init);
+        if (body?.data === undefined) {
+            throw new Error(`Server ${path} returned no data field; expected a { responseMeta, data } envelope`);
+        }
+        return body.data;
+    }
+    /**
+     * Issues the request, retrying a transient status when the verb makes that
+     * safe.
+     *
+     * A transient failure on the identity lookup used to fail the whole tool call
+     * and leave the caller guessing whether their account was broken.
+     *
+     * 429 counts as transient alongside 5xx: it is the route reporting its own
+     * capacity, and backing off is the whole point of it.
+     */
+    async request(path, init) {
+        const retryable = (init.method ?? "GET").toUpperCase() === "GET";
+        let lastError;
+        for (let attempt = 0; attempt <= (retryable ? READ_RETRY_ATTEMPTS : 0);) {
+            try {
+                return await this.send(path, init);
+            }
+            catch (error) {
+                lastError = error;
+                const transient = error instanceof ServerHttpError &&
+                    (error.status >= 500 || error.status === 429);
+                attempt += 1;
+                if (!retryable || !transient || attempt > READ_RETRY_ATTEMPTS) {
+                    throw error;
+                }
+                await delay(READ_RETRY_BASE_DELAY_MS * attempt);
+            }
+        }
+        throw lastError;
+    }
+    async send(path, init) {
+        const { apiKey, headers: callerHeaders, timeoutMs, ...rest } = init;
+        const bound = timeoutMs ?? this.timeoutMs;
+        const mergedHeaders = new Headers(callerHeaders);
+        // Auth and content-type are owned by this client — never override from callers.
+        mergedHeaders.set("Authorization", `Bearer ${apiKey}`);
+        if (!mergedHeaders.has("Content-Type")) {
+            mergedHeaders.set("Content-Type", "application/json");
+        }
+        let response;
+        try {
+            response = await fetch(`${this.baseUrl()}${path}`, {
+                ...rest,
+                headers: mergedHeaders,
+                signal: AbortSignal.timeout(bound),
+            });
+        }
+        catch (error) {
+            if (error instanceof Error && error.name === "TimeoutError") {
+                throw new Error(`Server ${path} timed out after ${bound}ms`);
+            }
+            throw error;
+        }
+        if (!response.ok) {
+            throw new ServerHttpError(`Server ${path} failed: ${response.status}${detailSuffix(await response.text().catch(() => ""))}`, response.status);
+        }
+        return (await response.json());
+    }
+    /**
+     * The Superblocks user behind a downstream credential.
+     *
+     * Cached, collapsed, deadlined and circuit-broken: this is the first thing
+     * every MCP tool call does, so reading it straight through coupled the whole
+     * tool surface to the health of one route.
+     */
+    async validateApiKey(apiKey) {
+        return this.readIdentity(apiKey);
+    }
+    /** The unguarded read behind {@link validateApiKey}. */
+    async readIdentityFromServer(apiKey) {
+        try {
+            const data = await this.requestData("/api/v1/users/me", {
+                apiKey,
+                method: "GET",
+                timeoutMs: this.identityTimeoutMs,
+            });
+            const user = data.user;
+            const organizationId = user?.currentOrganizationId ?? data.organizations?.[0]?.id;
+            if (!user || !organizationId) {
+                return undefined;
+            }
+            return {
+                email: user.email,
+                organizationId,
+                userId: user.id,
+            };
+        }
+        catch (error) {
+            // Auth failures → undefined (caller elicits login). Transport errors rethrow.
+            if (error instanceof ServerHttpError && error.status === 401) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    async getAgentInventory(input) {
+        const data = await this.requestData("/api/v1/users/me", {
+            apiKey: input.apiKey,
+            method: "GET",
+            // Same route, so the same bound. This one runs on the build path rather
+            // than per tool call, and left at the sandbox timeout a wedged
+            // /users/me held a start_app open for two minutes here instead.
+            timeoutMs: this.identityTimeoutMs,
+        });
+        const organization = data.organizations?.find((org) => org.id === input.organizationId) ??
+            data.organizations?.find((org) => org.id === data.user?.currentOrganizationId) ??
+            data.organizations?.[0];
+        if (organization?.agentType === undefined) {
+            throw new Error(`Server /api/v1/users/me returned no agentType for organization ${input.organizationId}`);
+        }
+        const agents = [];
+        for (const raw of data.agents ?? []) {
+            if (typeof raw.url !== "string" ||
+                !raw.url ||
+                typeof raw.type !== "number" ||
+                typeof raw.status !== "string") {
+                continue;
+            }
+            agents.push({
+                status: raw.status,
+                tags: raw.tags ?? {},
+                type: raw.type,
+                url: raw.url,
+            });
+        }
+        return {
+            agentType: organization.agentType,
+            agents,
+        };
+    }
+    async createApplication(input) {
+        return this.requestData("/api/v2/applications/", {
+            apiKey: input.apiKey,
+            // Live edit only attaches to code-mode apps; without this the server
+            // builds a legacy DSL app and `connect` rejects it.
+            body: JSON.stringify({
+                createUsingReact: true,
+                name: input.name,
+                organizationId: input.organizationId,
+                ...(input.templateName ? { templateName: input.templateName } : {}),
+            }),
+            method: "POST",
+        });
+    }
+    async uploadAttachment(input) {
+        const mimeType = input.mimeType ?? "application/zip";
+        // Multipart must not go through {@link send}: that helper forces
+        // application/json and would break the boundary.
+        const response = await uploadAttachmentToServerApi({
+            applicationId: input.applicationId,
+            authorization: `Bearer ${input.apiKey}`,
+            baseUrl: this.baseUrl(),
+            descriptor: {
+                blob: new Blob([Buffer.from(input.bytes)], { type: mimeType }),
+                fileName: input.fileName,
+                mimeType,
+            },
+            prefix: "message-attachment",
+            purpose: "attachment",
+            scopeType: "app",
+        });
+        return {
+            applicationId: response.applicationId,
+            attachmentId: response.attachmentId,
+            contentUrl: response.contentUrl,
+            fileName: response.fileName,
+            mimeType: response.mimeType,
+            signedUrl: response.signedUrl,
+            signedUrlExpiresAt: response.signedUrlExpiresAt,
+            storageKey: response.storageKey,
+        };
+    }
+    async connectLiveEdit(input) {
+        const branchSegment = input.branch
+            ? `/branches/${encodeURIComponent(input.branch)}`
+            : "";
+        const data = await this.requestData(`/api/v3/applications/${input.applicationId}${branchSegment}/connect`, {
+            apiKey: input.apiKey,
+            method: "GET",
+        });
+        if (!data.sandboxStartData) {
+            // Absent for a LOCAL lock — there is no remote sandbox to drive.
+            throw new Error("Server returned no live edit session for this application");
+        }
+        return {
+            liveEditId: data.sandboxStartData.sandboxId,
+            liveEditUrl: data.sandboxStartData.pitcherURL,
+            pitcherToken: data.sandboxStartData.pitcherToken,
+            pitcherURL: data.sandboxStartData.pitcherURL,
+        };
+    }
+    /**
+     * Mints the credential the live-edit session accepts. Connect's
+     * `pitcherToken` is a placeholder in the local sandbox path, so the editor
+     * mints this separately and so must anything else driving a session.
+     */
+    async issueScopedToken(input) {
+        // Alone among the routes here, this one answers with a bare OAuth-shaped
+        // body rather than the `{ responseMeta, data }` envelope.
+        const scope = input.scope ?? "apps:update";
+        const body = {
+            applicationId: input.applicationId,
+            scope,
+        };
+        if (scope === "apps:preview") {
+            if (!input.commitId?.trim()) {
+                throw new Error("apps:preview scoped tokens require a commitId so the viewer can load that commit");
+            }
+            body.commitId = input.commitId;
+        }
+        const data = await this.request("/api/v1/token/scoped", {
+            apiKey: input.apiKey,
+            body: JSON.stringify(body),
+            method: "POST",
+        });
+        if (!data?.access_token) {
+            throw new Error("Server /api/v1/token/scoped returned no access_token; the live-edit session has nothing to verify");
+        }
+        return data.access_token;
+    }
+    async getSupersetIntegrations(input) {
+        const params = new URLSearchParams({
+            // The endpoint rejects a request without `kind` (400 "Kind must be
+            // provided."); PLUGIN is what the editor asks for when it builds the
+            // integration list Clark sees.
+            kind: "PLUGIN",
+            organizationId: input.organizationId,
+        });
+        if (input.applicationId) {
+            params.set("applicationId", input.applicationId);
+        }
+        const data = await this.requestData(`/api/v1/integrations/superset?${params.toString()}`, { apiKey: input.apiKey, method: "GET" });
+        return Array.isArray(data) ? data : [];
+    }
+    async getIntegration(input) {
+        try {
+            return await this.requestData(`/api/v1/integrations/${encodeURIComponent(input.integrationId)}`, { apiKey: input.apiKey, method: "GET" });
+        }
+        catch (error) {
+            if (error instanceof ServerHttpError && error.status === 404) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    async getOrganizationProfiles(input) {
+        const data = await this.requestData(`/api/v1/organizations/${encodeURIComponent(input.organizationId)}/profiles`, { apiKey: input.apiKey, method: "GET" });
+        if (!Array.isArray(data)) {
+            return [];
+        }
+        return data
+            .filter((row) => typeof row?.key === "string" && row.key.length > 0)
+            .map((row) => ({
+            ...(row.allowedInEditor !== undefined
+                ? { allowedInEditor: row.allowedInEditor }
+                : {}),
+            ...(row.displayName ? { displayName: row.displayName } : {}),
+            ...(row.id ? { id: row.id } : {}),
+            key: row.key,
+        }));
+    }
+    /**
+     * Snapshots the application's current live-edit state as a commit.
+     *
+     * Deploys address a commit, never a branch head, so anything publishing work
+     * that has not been committed yet has to make one first — the same thing the
+     * editor's publish flow does.
+     */
+    async createCommit(input) {
+        const branchSegment = input.branch
+            ? `/branches/${encodeURIComponent(input.branch)}`
+            : "";
+        const data = await this.requestData(`/api/v2/applications/${input.applicationId}${branchSegment}/commit`, {
+            apiKey: input.apiKey,
+            body: JSON.stringify({
+                commitMessage: input.message,
+                // The server compares this against the last live-edit write to catch
+                // a commit racing an editor that has moved on since.
+                lastSuccessfulWrite: Date.now(),
+            }),
+            method: "POST",
+        });
+        return {
+            commitId: data.commitId,
+            ...(data.directoryContentsHash
+                ? { directoryHash: data.directoryContentsHash }
+                : {}),
+        };
+    }
+    /**
+     * Starts a SABS build of a commit's content, the same call the editor makes
+     * behind Preview and behind a publish.
+     *
+     * The response carries a build id this caller has no use for: progress is
+     * observed by content hash, which is also how a preview and a publish of the
+     * same content end up watching one build instead of racing two.
+     */
+    async createBuild(input) {
+        await this.request(`/api/v3/applications/${input.applicationId}/${encodeURIComponent(input.directoryHash)}/builds`, {
+            apiKey: input.apiKey,
+            body: JSON.stringify({ commitId: input.commitId }),
+            method: "POST",
+        });
+    }
+    async getBuildProgress(input) {
+        const path = `/api/v3/applications/${input.applicationId}/build-bulk-status`;
+        // POST because the hashes go in the body, but it is a read: the server
+        // asks SABS for status and changes nothing.
+        const data = await this.requestData(path, {
+            apiKey: input.apiKey,
+            body: JSON.stringify({ directoryHashes: [input.directoryHash] }),
+            method: "POST",
+        });
+        // Absent for content SABS has never built. Same meaning as UNSPECIFIED:
+        // there is no build to wait for.
+        return buildProgress(data.directoryHashToStatus?.[input.directoryHash]?.status);
+    }
+    async deployApplication(input) {
+        const path = `/api/v2/applications/${input.applicationId}/deployments`;
+        const body = await this.request(path, {
+            apiKey: input.apiKey,
+            // PostApplicationDeployRequestBody rejects unknown properties, so this
+            // body carries the commit and nothing else — the branch is already
+            // fixed by the commit being deployed.
+            body: JSON.stringify({ commitId: input.commitId }),
+            method: "POST",
+        });
+        if (body?.data?.deploymentId) {
+            return { deploymentId: body.data.deploymentId, status: "deployed" };
+        }
+        if (isDeployStatus(body?.status)) {
+            return { message: body?.message, status: body.status };
+        }
+        // Neither shape. Guessing "it worked" here would report a publish that
+        // never happened as a success.
+        throw new Error(`Server ${path} returned neither a deployment nor a deploy status`);
+    }
+    /**
+     * Polls the deploy queue for a commit the UI watches after a queued publish.
+     */
+    async getDeployStatus(input) {
+        const path = `/api/v2/applications/${input.applicationId}/deploy-status/${encodeURIComponent(input.commitId)}`;
+        const body = await this.request(path, {
+            apiKey: input.apiKey,
+            method: "GET",
+        });
+        const status = body?.status;
+        if (status === "none" ||
+            status === "QUEUED" ||
+            status === "DEPLOYING" ||
+            status === "DEPLOYED" ||
+            status === "FAILED" ||
+            status === "AWAITING_ACK") {
+            return {
+                error: typeof body?.error === "string" ? body.error : undefined,
+                isLive: typeof body?.isLive === "boolean" ? body.isLive : undefined,
+                status,
+            };
+        }
+        throw new Error(`Server ${path} returned an unknown deploy status`);
+    }
+    /**
+     * Asks Clark for an app name, the same way the editor header does after a
+     * prompt-created app loads.
+     */
+    async generateAppName(input) {
+        // Another bare body rather than the `{ responseMeta, data }` envelope.
+        const data = await this.request("/api/v1/ai/generate-app-name", {
+            apiKey: input.apiKey,
+            body: JSON.stringify({
+                applicationId: input.applicationId,
+                prompt: input.prompt,
+            }),
+            method: "POST",
+        });
+        if (!data?.name?.trim()) {
+            throw new Error("Server /api/v1/ai/generate-app-name returned no name");
+        }
+        return data.name.trim();
+    }
+    /**
+     * Looks a name up in the org-wide application listing.
+     *
+     * The API exposes no single-application GET that carries a name — only this
+     * listing and the metadata PUT — so one label costs a list read. That is
+     * affordable where it is used (alongside a build and a screenshot) and is
+     * why nothing on a hot path should call it.
+     */
+    async getApplicationName(input) {
+        const body = await this.request("/api/v2/applications", { apiKey: input.apiKey, method: "GET" });
+        const found = body?.data?.applications?.find((application) => application?.id === input.applicationId);
+        return found?.name?.trim() || undefined;
+    }
+    async renameApplication(input) {
+        await this.request(`/api/v2/applications/${input.applicationId}/metadata`, {
+            apiKey: input.apiKey,
+            // PutApplicationMetadataUpdateRequestBody accepts exactly one of name,
+            // folderId, or isPublic — sending more than one fails validation.
+            body: JSON.stringify({ name: input.name }),
+            method: "PUT",
+        });
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/server/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/server/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAItE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAGL,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAwF7B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAId,CAAC;YACF,MAAM,OAAO,GACX,MAAM,CAAC,YAAY,EAAE,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;YACjE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClD,MAAM,GAAG,OAAO,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC1D,OAAO,MAAM,OAAO,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAG7B;IAFX,YACE,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAwID;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAkB3C;;;;;;;;;;;;;;GAcG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,CAAC,CACN,KAAK,YAAY,eAAe;QAChC,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,KAAK,CAAC,MAAM,KAAK,GAAG,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,cAAc;IACd,UAAU;IACV,QAAQ;IACR,QAAQ;CACA,CAAC;AAEX,SAAS,cAAc,CACrB,KAAc;IAEd,OAAO,eAAe,CAAC,QAAQ,CAAC,KAA4C,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAkC;IAC/D,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,WAAW;CACf,CAAC;AAEF,MAAM,sBAAsB,GAAkC;IAC5D,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,MAAM;CACpB,CAAC;AAEF,SAAS,aAAa,CAAC,MAAmC;IACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,yBAAyB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM;SAChB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,sBAAsB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;AAChD,CAAC;AAED,MAAM,OAAO,2BAA2B;IACrB,iBAAiB,CAAS;IAC1B,YAAY,CAAuC;IACnD,SAAS,CAAS;IAClB,SAAS,CAAS;IAEnC,YAAY,SAAiB,EAAE,UAA0C,EAAE;QACzE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,iBAAiB;YACpB,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,wBAAwB,CAC1C,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAC/C;YACE,SAAS,EAAE,yBAAyB;YACpC,YAAY,EAAE,yBAAyB;YACvC,GAAG,OAAO,CAAC,aAAa;SACzB,CACF,CAAC;IACJ,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CACvB,IAAY,EACZ,IAAuB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAe,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,qEAAqE,CACpF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,IAAuB;QAC5D,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;QACjE,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAI,CAAC;YACzE,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,SAAS,GACb,KAAK,YAAY,eAAe;oBAChC,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;oBAC9D,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,CAAC,wBAAwB,GAAG,OAAO,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAuB;QACzD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QACpE,MAAM,KAAK,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAC1C,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;QACjD,gFAAgF;QAChF,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;gBACjD,GAAG,IAAI;gBACP,OAAO,EAAE,aAAa;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,oBAAoB,KAAK,IAAI,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CACvB,UAAU,IAAI,YAAY,QAAQ,CAAC,MAAM,GAAG,YAAY,CACtD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CACtC,EAAE,EACH,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc;QAEd,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,sBAAsB,CAClC,MAAc;QAEd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAOhC,kBAAkB,EAAE;gBACrB,MAAM;gBACN,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,CAAC,iBAAiB;aAClC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,cAAc,GAClB,IAAI,EAAE,qBAAqB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7D,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC7B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,cAAc;gBACd,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8EAA8E;YAC9E,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAGvB;QACC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAShC,kBAAkB,EAAE;YACrB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK;YACb,wEAAwE;YACxE,+DAA+D;YAC/D,gEAAgE;YAChE,SAAS,EAAE,IAAI,CAAC,iBAAiB;SAClC,CAAC,CAAC;QAEH,MAAM,YAAY,GAChB,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,cAAc,CAAC;YAClE,IAAI,CAAC,aAAa,EAAE,IAAI,CACtB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,qBAAqB,CACrD;YACD,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,YAAY,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,kEAAkE,KAAK,CAAC,cAAc,EAAE,CACzF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAiC,EAAE,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACpC,IACE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;gBAC3B,CAAC,GAAG,CAAC,GAAG;gBACR,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAC5B,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAC9B,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,MAAM;SACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAKvB;QACC,OAAO,IAAI,CAAC,WAAW,CACrB,uBAAuB,EACvB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,qEAAqE;YACrE,oDAAoD;YACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,gBAAgB,EAAE,IAAI;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC;YACF,MAAM,EAAE,MAAM;SACf,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAMtB;QACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACrD,iEAAiE;QACjE,iDAAiD;QACjD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;YACjD,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;YACvC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,UAAU,EAAE;gBACV,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ;aACT;YACD,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAIrB;QACC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM;YAChC,CAAC,CAAC,aAAa,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAMhC,wBAAwB,KAAK,CAAC,aAAa,GAAG,aAAa,UAAU,EAAE;YACxE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,iEAAiE;YACjE,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS;YAC3C,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU;YAC7C,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,YAAY;YAChD,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU;SAC7C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAOtB;QACC,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,aAAa,CAAC;QAC3C,MAAM,IAAI,GAA2B;YACnC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,KAAK;SACN,CAAC;QACF,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,sBAAsB,EACtB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,MAAM;SACf,CACF,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAI7B;QACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,mEAAmE;YACnE,qEAAqE;YACrE,+BAA+B;YAC/B,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CACjC,iCAAiC,MAAM,CAAC,QAAQ,EAAE,EAAE,EACpD,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CACxC,CAAC;QACF,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAGpB;QACC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,CAC3B,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EACjE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CACxC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAG7B;QACC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CACjC,yBAAyB,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,EAC5E,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CACxC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,IAAI;aACR,MAAM,CACL,CAAC,GAAG,EAAyD,EAAE,CAC7D,OAAO,GAAG,EAAE,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CACrD;aACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,KAKlB;QACC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM;YAChC,CAAC,CAAC,aAAa,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAGhC,wBAAwB,KAAK,CAAC,aAAa,GAAG,aAAa,SAAS,EAAE;YACvE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,aAAa,EAAE,KAAK,CAAC,OAAO;gBAC5B,qEAAqE;gBACrE,qDAAqD;gBACrD,mBAAmB,EAAE,IAAI,CAAC,GAAG,EAAE;aAChC,CAAC;YACF,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,qBAAqB;gBAC5B,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,qBAAqB,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAAC,KAKjB;QACC,MAAM,IAAI,CAAC,OAAO,CAChB,wBAAwB,KAAK,CAAC,aAAa,IAAI,kBAAkB,CAC/D,KAAK,CAAC,aAAa,CACpB,SAAS,EACV;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,EAAE,MAAM;SACf,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAItB;QACC,MAAM,IAAI,GAAG,wBAAwB,KAAK,CAAC,aAAa,oBAAoB,CAAC;QAC7E,uEAAuE;QACvE,4CAA4C;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAEhC,IAAI,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAChE,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,wEAAwE;QACxE,iCAAiC;QACjC,OAAO,aAAa,CAClB,IAAI,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,CAC1D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAIvB;QACC,MAAM,IAAI,GAAG,wBAAwB,KAAK,CAAC,aAAa,cAAc,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAI5B,IAAI,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,uEAAuE;YACvE,mEAAmE;YACnE,sCAAsC;YACtC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YAC7B,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACzD,CAAC;QACD,uEAAuE;QACvE,+BAA+B;QAC/B,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,oDAAoD,CACnE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,KAIrB;QACC,MAAM,IAAI,GAAG,wBAAwB,KAAK,CAAC,aAAa,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAI5B,IAAI,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAC5B,IACE,MAAM,KAAK,MAAM;YACjB,MAAM,KAAK,QAAQ;YACnB,MAAM,KAAK,WAAW;YACtB,MAAM,KAAK,UAAU;YACrB,MAAM,KAAK,QAAQ;YACnB,MAAM,KAAK,cAAc,EACzB,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC/D,MAAM,EAAE,OAAO,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBACnE,MAAM;aACP,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,oCAAoC,CAAC,CAAC;IACtE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,KAIrB;QACC,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,8BAA8B,EAC9B;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,MAAM,EAAE,MAAM;SACf,CACF,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAGxB;QACC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAE5B,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAC1C,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,KAAK,CAAC,aAAa,CACzD,CAAC;QACF,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAIvB;QACC,MAAM,IAAI,CAAC,OAAO,CAChB,wBAAwB,KAAK,CAAC,aAAa,WAAW,EACtD;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,uEAAuE;YACvE,kEAAkE;YAClE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,EAAE,KAAK;SACd,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/server/identity-reads.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Why an identity lookup produced no answer.
+ *
+ * `caller_timeout` and `read_failed` need telling apart: the first means the
+ * endpoint is slow and the cache is about to fill, the second means it is down.
+ */
+export type IdentityUnavailableReason = "breaker_open" | "caller_timeout" | "read_failed";
+/**
+ * The identity lookup did not produce an answer this caller can act on.
+ *
+ * Distinct from "the credential was refused": nothing is known about the
+ * caller's account, so the right response is to try again rather than to
+ * re-link. Capabilities map this to `downstream_unavailable`.
+ */
+export declare class IdentityUnavailableError extends Error {
+    readonly reason: IdentityUnavailableReason;
+    constructor(message: string, options?: {
+        cause?: unknown;
+        reason?: IdentityUnavailableReason;
+    });
+}
+/**
+ * What one guarded call cost. A closed set because it becomes a metric label.
+ */
+export type IdentityReadOutcome = "breaker_open" | "cached" | "caller_timeout"
+/**
+ * The read failed in a way that says something about this one credential
+ * rather than about the endpoint — the errors `opensBreaker` rejects.
+ * Separate from `outage` so a client looping on a revoked key cannot make a
+ * healthy endpoint look like it is failing.
+ */
+ | "credential_error" | "outage" | "refused" | "resolved";
+/** Resolves the identity behind a downstream credential, or refuses it. */
+export type IdentityRead<T> = (apiKey: string) => Promise<T | undefined>;
+export type GuardedIdentityReadOptions = {
+    /** How long a resolved identity is trusted before the API is asked again. */
+    cacheTtlMs?: number;
+    /** How long one caller waits for a read before it gives up on this call. */
+    callerWaitMs?: number;
+    /** How long reads fail fast after the API failed to answer one. */
+    cooldownMs?: number;
+    now?: () => number;
+    /** Reports what one call cost. Wired to a counter in the HTTP client. */
+    onOutcome?: (outcome: IdentityReadOutcome) => void;
+    /**
+     * Whether a failed read means the endpoint is unhealthy, rather than that
+     * this one credential was refused. Only the former opens the breaker: a
+     * single bad credential must not fail every other caller fast.
+     */
+    opensBreaker?: (error: unknown) => boolean;
+};
+/**
+ * Makes the identity lookup that every tool call gates on cheap and bounded.
+ *
+ * `GET /api/v1/users/me` is the first thing every capability does and the
+ * slowest endpoint the Superblocks API exposes. Read straight through, one
+ * wedged upstream took down the whole tool surface: each call waited out the
+ * full client timeout, a burst of callers multiplied the load on the endpoint
+ * that was already stuck, and nothing remembered that the last twenty calls
+ * had just failed the same way.
+ *
+ * Four things fix that, and they have to work together:
+ *
+ * - **Cache.** Identity does not change between polls, so a poll loop spends
+ *   one read per TTL instead of one per call.
+ * - **Collapse.** Concurrent callers on a cold cache join one read rather than
+ *   each starting their own.
+ * - **Caller deadline.** A tool call stops waiting at the window its own
+ *   contract advertises. The read keeps running, so an endpoint that answers
+ *   slowly still fills the cache and the next call is served from it — the
+ *   reason this is a deadline on the wait and not a shorter timeout on the
+ *   read.
+ * - **Breaker.** Once a read fails, later calls fail fast for a cooldown
+ *   instead of each discovering the same outage the slow way.
+ */
+export declare function withGuardedIdentityReads<T>(read: IdentityRead<T>, options?: GuardedIdentityReadOptions): IdentityRead<T>;