@tangle-network/agent-app 0.49.33 → 0.49.34

package/dist/chunk-MVIIH2EQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/platform/sso.ts","../src/platform/guards.ts"],"sourcesContent":["/**\n * Tangle SSO for agent apps. OIDC callers use the registered runtime client\n * with S256 PKCE. Legacy API-key callers remain explicit during migration.\n * OIDC never falls back to cross-site exchange. Account matching and native\n * session cookie minting remain shared.\n */\n\nimport { clearCookieHeader, readCookieValue, serializeCookie } from '../web/index'\n\nconst DEFAULT_STATE_TTL_SECONDS = 600\nconst DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 7\nconst DEFAULT_REDIRECT_PATH = '/app'\nconst DEFAULT_LOGIN_PATH = '/login'\nconst DEFAULT_SESSION_COOKIE = 'better-auth.session_token'\n\n// ── Signed state ────────────────────────────────────────────────────────────\n\n/** Define configuration options for managing SSO state including secret, lifetime, and clock injection */\nexport interface SsoStateConfig {\n  /** HMAC-SHA256 secret (e.g. the app's auth secret). */\n  secret: string\n  /** State lifetime in ms. Default 600 000. */\n  ttlMs?: number\n  /** Injectable clock (ms since epoch). Default Date.now. */\n  now?: () => number\n}\n\nfunction randomHex(bytes: number): string {\n  const buf = new Uint8Array(bytes)\n  crypto.getRandomValues(buf)\n  return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nasync function hmacBytes(secret: string, value: string): Promise<Uint8Array> {\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  return new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(value)))\n}\n\nasync function hmacHex(secret: string, value: string): Promise<string> {\n  return Array.from(await hmacBytes(secret, value), (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return diff === 0\n}\n\n/** Mint a `<randomHex32>.<timestamp36>.<hmacHex>` state value. The timestamp\n *  is inside the signed payload, so expiry survives cookie-attribute tampering. */\nexport async function createSignedSsoState(config: SsoStateConfig): Promise<string> {\n  if (!config.secret) throw new Error('SsoStateConfig.secret is required')\n  const now = config.now ?? Date.now\n  const payload = `${randomHex(16)}.${now().toString(36)}`\n  return `${payload}.${await hmacHex(config.secret, payload)}`\n}\n\n/** Verify the MAC (constant-time) and the signed TTL. */\nexport async function verifySignedSsoState(state: string, config: SsoStateConfig): Promise<boolean> {\n  if (!config.secret) throw new Error('SsoStateConfig.secret is required')\n  const parts = state.split('.')\n  if (parts.length !== 3) return false\n  const [random, timestamp, mac] = parts\n  if (!random || !timestamp || !mac || !/^[0-9a-z]+$/.test(timestamp)) return false\n  const expected = await hmacHex(config.secret, `${random}.${timestamp}`)\n  if (!constantTimeEqual(mac, expected)) return false\n  const mintedAt = parseInt(timestamp, 36)\n  if (!Number.isFinite(mintedAt)) return false\n  const now = config.now ?? Date.now\n  const ttlMs = config.ttlMs ?? DEFAULT_STATE_TTL_SECONDS * 1000\n  const age = now() - mintedAt\n  return age >= 0 && age <= ttlMs\n}\n\n// ── Seams ───────────────────────────────────────────────────────────────────\n\n/** Describe the result of exchanging SSO credentials including API key, user info, and optional plan details */\nexport interface TangleSsoExchangeResult {\n  apiKey: string\n  /** The platform's canonical verified-email proof. */\n  emailVerified: boolean\n  user: { id: string; email: string; name?: string | null }\n  plan?: { tier: string } | null\n}\n\n/** Structural mirror of the platform auth wire client — any object with these\n *  two methods satisfies it without this module importing the concrete class. */\nexport interface TangleSsoAuthClient {\n  authorizeUrl(options: { state: string; redirectUri?: string }): string\n  exchange(code: string): Promise<TangleSsoExchangeResult>\n}\n\n/** Token fields the callback persists from the runtime's OIDC exchange. */\nexport interface TangleOidcSsoTokens {\n  accessToken: string\n  tokenType: string\n  expiresIn?: number\n  refreshToken?: string\n  idToken?: string\n  scope?: string\n}\n\n/** Verified identity returned by the runtime's OIDC userinfo lookup. */\nexport interface TangleOidcSsoUser {\n  id: string\n  email: string\n  emailVerified: true\n  name?: string\n}\n\n/** The caller needs only the OIDC operations used by this callback. Keeping\n *  this structural prevents legacy consumers from needing the optional\n *  Runtime peer just to load the SSO declarations. */\nexport interface TangleOidcSsoAuthClient {\n  authorizeUrl(options: {\n    state: string\n    codeChallenge: string\n    nonce?: string\n    prompt?: 'login' | 'consent' | 'none'\n    loginHint?: string\n  }): string\n  exchange(code: string, codeVerifier: string): Promise<{\n    tokens: TangleOidcSsoTokens\n    user: TangleOidcSsoUser\n  }>\n  revoke(token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<void>\n}\n\n/** Local account shape required by the verified Tangle SSO account policy.\n * Consumers map their user/link tables into this shape before resolving an\n * exchange. */\nexport interface TangleSsoLocalAccount {\n  userId: string\n  email: string\n  emailVerified: boolean\n  platformUserId: string | null\n}\n\n/** Reasons a local account lookup must stop instead of linking an exchange. */\nexport type TangleSsoAccountConflictReason =\n  | 'ambiguous-platform-id'\n  | 'platform-id-email-conflict'\n  | 'unverified-email'\n  | 'email-platform-id-conflict'\n  | 'ambiguous-email'\n  | 'invalid-platform-id'\n  | 'invalid-email'\n  | 'platform-match-mismatch'\n  | 'email-match-mismatch'\n\n/** Result of applying the verified Tangle SSO account matching policy. */\nexport type TangleSsoAccountResolution =\n  | { kind: 'existing'; userId: string; matchedBy: 'platform-id' | 'verified-email' }\n  | { kind: 'create' }\n  | { kind: 'reject'; reason: TangleSsoAccountConflictReason }\n\n/** Inputs for {@link resolveTangleSsoAccount}. `platformUserId` is the\n * platform's stable identity. */\nexport interface TangleSsoAccountResolutionInput {\n  email: string\n  platformMatches: readonly TangleSsoLocalAccount[]\n  emailMatches: readonly TangleSsoLocalAccount[]\n  platformUserId: string\n}\n\n/** Normalize an email for comparisons and persistence queries. */\nexport function normalizeTangleSsoEmail(email: string): string {\n  return email.trim().toLowerCase()\n}\n\nfunction normalizedPlatformUserId(value: string | null | undefined): string | null {\n  const normalized = value?.trim()\n  return normalized ? normalized : null\n}\n\n/**\n * Resolve a platform exchange against all local rows found by stable platform\n * identity and normalized email.\n *\n * A stable platform id takes precedence over email. Every ambiguous or\n * contradictory result rejects, and email fallback requires a verified local\n * email that is not already bound to another platform id. The resolver is\n * pure so each consumer can query its own schema, including schemas without\n * unique indexes, then rerun it after an insert race.\n */\nexport function resolveTangleSsoAccount(\n  input: TangleSsoAccountResolutionInput,\n): TangleSsoAccountResolution {\n  const email = normalizeTangleSsoEmail(input.email)\n  const platformUserId = normalizedPlatformUserId(input.platformUserId)\n  if (!email) return { kind: 'reject', reason: 'invalid-email' }\n  if (!platformUserId) return { kind: 'reject', reason: 'invalid-platform-id' }\n\n  if (input.platformMatches.length > 1) {\n    return { kind: 'reject', reason: 'ambiguous-platform-id' }\n  }\n  if (input.emailMatches.length > 1) {\n    return { kind: 'reject', reason: 'ambiguous-email' }\n  }\n\n  if (input.platformMatches.some((account) => normalizedPlatformUserId(account.platformUserId) !== platformUserId)) {\n    return { kind: 'reject', reason: 'platform-match-mismatch' }\n  }\n  if (input.emailMatches.some((account) => normalizeTangleSsoEmail(account.email) !== email)) {\n    return { kind: 'reject', reason: 'email-match-mismatch' }\n  }\n\n  const platformMatch = input.platformMatches[0]\n  const emailMatch = input.emailMatches[0]\n\n  if (platformMatch) {\n    if (emailMatch && emailMatch.userId !== platformMatch.userId) {\n      return { kind: 'reject', reason: 'platform-id-email-conflict' }\n    }\n    return { kind: 'existing', userId: platformMatch.userId, matchedBy: 'platform-id' }\n  }\n\n  if (!emailMatch) return { kind: 'create' }\n  const existingPlatformUserId = normalizedPlatformUserId(emailMatch.platformUserId)\n  if (existingPlatformUserId === platformUserId) {\n    return { kind: 'existing', userId: emailMatch.userId, matchedBy: 'platform-id' }\n  }\n  if (emailMatch.emailVerified !== true) {\n    return { kind: 'reject', reason: 'unverified-email' }\n  }\n\n  if (existingPlatformUserId && existingPlatformUserId !== platformUserId) {\n    return { kind: 'reject', reason: 'email-platform-id-conflict' }\n  }\n\n  // The platform proof is already verified. A verified local email row is safe\n  // to link when it is unbound or already carries this same platform id.\n  return { kind: 'existing', userId: emailMatch.userId, matchedBy: 'verified-email' }\n}\n\n/** Thrown by an account store when the verified SSO policy rejects a link. */\nexport class TangleSsoAccountConflictError extends Error {\n  readonly reason: TangleSsoAccountConflictReason\n\n  constructor(reason: TangleSsoAccountConflictReason, message = 'Tangle SSO account linking was rejected') {\n    super(message)\n    this.name = 'TangleSsoAccountConflictError'\n    this.reason = reason\n  }\n}\n\n/** Thrown by `upsertUserByEmail` when the app-local user row cannot be\n *  created; the callback handler maps it to `?error=tangle_user_create_failed`.\n *  Any other store error propagates. */\nexport class TangleSsoUserCreateError extends Error {\n  constructor(message = 'Failed to create local user for Tangle SSO') {\n    super(message)\n    this.name = 'TangleSsoUserCreateError'\n  }\n}\n\n/**\n * Account persistence seam. Covers both storage styles in use: link-table\n * apps (a per-user platform-link row) and session-column apps (the key on the\n * session row) — `saveTangleLink` receives both `userId` and `sessionToken`,\n * and each app persists with the key it needs. `createSession` runs first so\n * the token is always available to `saveTangleLink`.\n */\nexport interface TangleSsoAccountStore {\n  /** Resolve the local account before any user, session, or link write.\n   * Implementations must query every candidate by stable platform id and\n   * normalized email, then apply `resolveTangleSsoAccount` (or an equivalent\n   * fail-closed policy). The callback rejects `kind: 'reject'` results before\n   * it calls `upsertUserByEmail`. */\n  resolveAccount(input: { email: string; platformUserId: string }): Promise<TangleSsoAccountResolution>\n  /** Find-or-create the app-local user selected by `resolveAccount`.\n   * `tangleUserId` is the platform's stable user id — match on it first when\n   * the app stores it (emails are mutable on the platform; the id is not),\n   * falling back to email for first-time logins. */\n  upsertUserByEmail(input: {\n    email: string\n    name: string | null\n    tangleUserId: string\n    resolution: Exclude<TangleSsoAccountResolution, { kind: 'reject' }>\n  }): Promise<{ userId: string }>\n  /** Create an app session row; returns the session-cookie token value. */\n  createSession(input: {\n    userId: string\n    expiresAt: Date\n    ipAddress: string | null\n    userAgent: string | null\n  }): Promise<{ token: string }>\n  /** Persist the platform link (API key + platform identity). */\n  saveTangleLink(input: {\n    userId: string\n    sessionToken: string\n    tangleUserId: string\n    email: string\n    name: string | null\n    apiKey: string\n    planTier: string | null\n  }): Promise<void>\n}\n\n/**\n * OIDC tokens are server-side credentials, not API keys. Implementations must\n * encrypt them at rest and bind them to the exact local session. Refresh and\n * disconnect must serialize updates to the same grant.\n */\nexport interface TangleOidcSsoAccountStore extends Omit<TangleSsoAccountStore, 'saveTangleLink'> {\n  /** Atomically bind the grant to this exact session. If persistence partially\n   * fails, `deleteSession` must remove every row and credential for it. */\n  saveTangleLink(input: {\n    userId: string\n    sessionToken: string\n    tangleUserId: string\n    email: string\n    name: string | null\n    tokens: TangleOidcSsoTokens\n    accessTokenExpiresAt: Date\n  }): Promise<void>\n  /** Remove an unpublished local session if callback persistence fails.\n   * This must also remove any grant rows or credentials partially written by\n   * a rejected `saveTangleLink`, keyed by this exact session token. */\n  deleteSession(input: { sessionToken: string }): Promise<void>\n}\n\n// ── Session cookie ──────────────────────────────────────────────────────────\n\n/** Successful-login context handed to the `setSessionCookie` seam. */\nexport interface TangleSsoSessionCookieArgs {\n  /** Session token returned by `store.createSession`. */\n  token: string\n  /** Session expiry (now + `sessionTtlSeconds`). */\n  expiresAt: Date\n  /** Mirrors `sessionTtlSeconds` after defaulting. */\n  ttlSeconds: number\n  /** Mirrors `TangleSsoHandlerOptions.secureCookies`. */\n  secure: boolean\n}\n\n/**\n * Sign a session token to better-call's signed-cookie contract — the value\n * better-auth's `getSignedCookie` verifies: `<token>.<signature>` where the\n * signature is the raw HMAC-SHA256 of the token under `secret`, encoded as\n * STANDARD base64 WITH padding (32 bytes → 44 chars ending `=`; better-call\n * rejects any other length or suffix, so url-safe/unpadded variants read back\n * as a null session). The joined value is percent-encoded once at cookie\n * serialization, matching better-call's `serializeSignedCookie` byte-exactly.\n */\nexport async function signSessionCookieValue(token: string, secret: string): Promise<string> {\n  if (!secret) throw new Error('signSessionCookieValue requires a non-empty secret')\n  const sig = await hmacBytes(secret, token)\n  let bin = ''\n  for (const byte of sig) bin += String.fromCharCode(byte)\n  return `${token}.${btoa(bin)}`\n}\n\n/** Structural slice of a `betterAuth()` instance — only what cookie minting\n *  reads. No better-auth import: the signing contract is implemented by\n *  `signSessionCookieValue`, byte-compatible with better-auth's own\n *  `makeSignature`. */\nexport interface BetterAuthSessionCookieSource {\n  $context: PromiseLike<{\n    secret: string\n    authCookies: {\n      sessionToken: {\n        /** Final cookie name — better-auth decides the `__Secure-` prefix\n         *  (and any `advanced.cookiePrefix`) once at `betterAuth()` init. */\n        name: string\n        attributes: {\n          secure?: boolean\n          sameSite?: string\n          path?: string\n          httpOnly?: boolean\n          domain?: string\n        }\n      }\n    }\n  }>\n}\n\n/** Define options to customize warning behavior for shadowed cookie names in authentication sessions */\nexport interface BetterAuthSessionCookieMinterOptions {\n  /** Receives the shadowed-cookie-name warning (see below). Default\n   *  console.warn. */\n  warn?: (message: string) => void\n}\n\n/**\n * Canonical `setSessionCookie` wiring for better-auth apps: mint the session\n * Set-Cookie exactly as better-auth's own login flows do — name + attributes\n * from `auth.$context.authCookies.sessionToken` (better-auth stays\n * authoritative over prefix/name/attributes) and the value signed to\n * better-call's `getSignedCookie` contract. A raw unprefixed\n * `better-auth.session_token` left by an earlier login is explicitly expired\n * so it cannot shadow the real cookie.\n *\n * Warns when the app's session cookie still has better-auth's DEFAULT name:\n * the Tangle platform (id.tangle.tools) sets a `Domain=.tangle.tools` cookie\n * under that exact name, and equal-path cookies are sent oldest-first — the\n * platform's cookie is always older (the user signs in there before the app's\n * callback runs), so the app reads the platform's token, fails its own\n * signature check, and every fresh login lands logged-out. Per-app\n * `advanced.cookiePrefix` is the fix.\n *\n * Throws on a domain-scoped session cookie for the same reason: a\n * `Domain=`-wide session cookie is exactly the shadowing footgun.\n */\nexport function createBetterAuthSessionCookieMinter(\n  auth: BetterAuthSessionCookieSource,\n  options: BetterAuthSessionCookieMinterOptions = {},\n): (args: TangleSsoSessionCookieArgs) => Promise<string[]> {\n  const warn = options.warn ?? ((message: string) => console.warn(message))\n  return async ({ token, ttlSeconds }) => {\n    const ctx = await auth.$context\n    if (!ctx.secret) {\n      throw new Error('createBetterAuthSessionCookieMinter: auth context has no secret')\n    }\n    const { name, attributes } = ctx.authCookies.sessionToken\n    if (attributes.domain) {\n      throw new Error(\n        `createBetterAuthSessionCookieMinter: refusing a domain-scoped session cookie (Domain=${attributes.domain}) — ` +\n          'a domain-wide session cookie shadows sibling apps that share the parent domain',\n      )\n    }\n    if (name === DEFAULT_SESSION_COOKIE || name === `__Secure-${DEFAULT_SESSION_COOKIE}`) {\n      warn(\n        `[tangle-sso] session cookie is named \"${name}\" — better-auth's default. ` +\n          'The Tangle platform (id.tangle.tools) sets a Domain=.tangle.tools cookie under the same name, ' +\n          \"and the platform's (older) cookie wins the Cookie-header order, so this app's sessions read back null. \" +\n          \"Set a per-app prefix: betterAuth({ advanced: { cookiePrefix: '<app>' } }).\",\n      )\n    }\n    const sameSite = typeof attributes.sameSite === 'string' ? attributes.sameSite : 'lax'\n    const cookieOptions = {\n      name,\n      path: typeof attributes.path === 'string' ? attributes.path : '/',\n      httpOnly: attributes.httpOnly !== false,\n      sameSite: (sameSite.charAt(0).toUpperCase() + sameSite.slice(1)) as 'Lax' | 'Strict' | 'None',\n      secure: Boolean(attributes.secure) || name.startsWith('__Secure-'),\n      maxAgeSeconds: ttlSeconds,\n    }\n    const cookies = [serializeCookie(await signSessionCookieValue(token, ctx.secret), cookieOptions)]\n    if (name !== DEFAULT_SESSION_COOKIE) {\n      cookies.push(clearCookieHeader({ ...cookieOptions, name: DEFAULT_SESSION_COOKIE }))\n    }\n    return cookies\n  }\n}\n\n// ── Handlers ────────────────────────────────────────────────────────────────\n\n/** Define configuration options for handling Tangle SSO authentication and session management */\nexport interface TangleSsoHandlerOptions {\n  protocol?: 'legacy'\n  auth: TangleSsoAuthClient\n  store: TangleSsoAccountStore\n  /** HMAC secret for the state cookie. */\n  stateSecret: string\n  /** Absolute callback URL registered with the platform. */\n  callbackUrl: string\n  stateCookieName: string\n  /** Default 'better-auth.session_token'. Ignored when `setSessionCookie` is\n   *  provided. The default path prepends `__Secure-` iff `secureCookies`. */\n  sessionCookieName?: string\n  /** Mint the host auth framework's own session cookie(s); return complete\n   *  Set-Cookie header values (the handler appends them verbatim and sets no\n   *  session cookie itself). Supply this when the framework should stay\n   *  authoritative over name/prefix/signing/attributes — e.g. better-auth:\n   *  `auth.$context.authCookies.sessionToken` + `makeSignature`. */\n  setSessionCookie?: (\n    args: TangleSsoSessionCookieArgs,\n  ) => readonly string[] | Promise<readonly string[]>\n  /** HMAC-SHA256 secret the host auth framework verifies session cookies with\n   *  (better-auth: its `secret`). Required when `setSessionCookie` is absent —\n   *  the default cookie is minted to better-call's signed contract via\n   *  `signSessionCookieValue`; an unsigned or mis-signed value reads back as a\n   *  null session, so there is deliberately no fallback to `stateSecret`\n   *  (which is not guaranteed to be the auth secret). */\n  sessionCookieSecret?: string\n  /** Adds `Secure` to every cookie this module sets, and (default session\n   *  cookie only) the `__Secure-` name prefix. Must match the auth\n   *  framework's own secure-cookie decision (better-auth: https `baseURL` /\n   *  `advanced.useSecureCookies`), or it will look up a different cookie name\n   *  than the one set here. */\n  secureCookies: boolean\n  /** Default 604 800 (7 days). */\n  sessionTtlSeconds?: number\n  /** Default 600. Applies to both the cookie Max-Age and the signed TTL. */\n  stateTtlSeconds?: number\n  /** Default '/app'. */\n  defaultRedirectPath?: string\n  /** Default '/login'. */\n  loginPath?: string\n  /** Failure log hook (e.g. console.error). Default no-op. */\n  log?: (message: string, error?: unknown) => void\n  now?: () => number\n}\n\n/** Registered OIDC client and token store. The OIDC caller supplies the Runtime PKCE helper. */\nexport interface TangleOidcSsoHandlerOptions extends Omit<TangleSsoHandlerOptions, 'protocol' | 'auth' | 'store'> {\n  protocol: 'oidc'\n  auth: TangleOidcSsoAuthClient\n  store: TangleOidcSsoAccountStore\n  /** Pass the Runtime's `createPkcePair` helper from the OIDC-only caller. */\n  createPkcePair: () => Promise<{ verifier: string; challenge: string }>\n}\n\n/** Define handlers for SSO start and callback routes managing authentication flow and session cookies */\nexport interface TangleSsoHandlers {\n  /** GET start route: mint + sign state, set the state cookie, 302 to the\n   *  platform authorize URL. `?redirect=` carries the post-login path. */\n  start(request: Request): Promise<Response>\n  /** GET callback route: verify state, exchange the code, upsert the user,\n   *  create the session, save the platform link, set the session cookie\n   *  (via the `setSessionCookie` seam, else signed to better-call's contract\n   *  with `sessionCookieSecret`), 302 to the saved redirect. Every failure\n   *  302s to `loginPath?error=…` with the state cookie cleared. */\n  callback(request: Request): Promise<Response>\n}\n\n/** Redirect targets must stay on this app's origin. A prefix check on `/`\n *  and `//` is not enough: in the WHATWG parser a backslash is a path\n *  separator for special schemes, so `/\\host` resolves to `https://host/`,\n *  and tab or newline are stripped before parsing, so `/\\t/host` is `//host`.\n *  Parse the value against a fixed origin and accept it only when that origin\n *  survives; the result is the parser's normalised path, query and fragment.\n *  Backslash and control characters are rejected up front as well, so the\n *  decision does not rest on one parser's handling of them.\n *\n *  The input staying on-origin is not enough either: dot-segment removal\n *  turns `/.//host` or `/a/..//host` into the pathname `//host` with the\n *  origin intact, and a browser resolves that Location off-origin. So the\n *  emitted value must itself resolve on-origin and come back unchanged. */\nconst REDIRECT_REFERENCE_ORIGIN = 'https://redirect-reference.invalid'\n\nfunction sanitizeRedirectPath(value: string | null, fallback: string): string {\n  if (!value || !value.startsWith('/') || /[\\\\\\u0000-\\u001f\\u007f]/.test(value)) return fallback\n  const path = resolveOnReferenceOrigin(value)\n  if (path === null || resolveOnReferenceOrigin(path) !== path) return fallback\n  return path\n}\n\n/** `path + search + hash` of `value` resolved against the reference origin,\n *  or null when the parse fails or lands on another origin. */\nfunction resolveOnReferenceOrigin(value: string): string | null {\n  let url: URL\n  try {\n    url = new URL(value, REDIRECT_REFERENCE_ORIGIN)\n  } catch {\n    return null\n  }\n  if (url.origin !== REDIRECT_REFERENCE_ORIGIN) return null\n  return `${url.pathname}${url.search}${url.hash}`\n}\n\nfunction redirectResponse(location: string, headers = new Headers()): Response {\n  headers.set('Location', location)\n  headers.set('Cache-Control', 'no-store')\n  headers.set('Referrer-Policy', 'no-referrer')\n  return new Response(null, { status: 302, headers })\n}\n\n/** Real client IP: `CF-Connecting-IP` behind Cloudflare, else the first\n *  `x-forwarded-for` hop (the rest of the list is sender-controlled). */\nfunction clientIp(request: Request): string | null {\n  return (\n    request.headers.get('CF-Connecting-IP') ??\n    request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ??\n    null\n  )\n}\n\ninterface StateCookiePayload {\n  s: string\n  r: string\n  v?: string\n  m?: string\n}\n\nfunction parseStateCookiePayload(raw: string | null): StateCookiePayload | null {\n  if (!raw || raw.length > 4096) return null\n  try {\n    const parsed = JSON.parse(raw) as unknown\n    if (parsed === null || typeof parsed !== 'object') return null\n    const { s, r, v, m } = parsed as Record<string, unknown>\n    if (typeof s !== 'string' || typeof r !== 'string') return null\n    return { s, r, ...(typeof v === 'string' ? { v } : {}), ...(typeof m === 'string' ? { m } : {}) }\n  } catch { return null }\n}\n\nfunction stateBinding(payload: StateCookiePayload, callbackUrl: string): string {\n  return JSON.stringify([payload.s, payload.r, payload.v ?? null, callbackUrl])\n}\n\n/** Create Tangle SSO handlers to manage authentication state, callbacks, and session cookies */\nexport function createTangleSsoHandlers(\n  opts: TangleSsoHandlerOptions | TangleOidcSsoHandlerOptions,\n): TangleSsoHandlers {\n  if (!opts.stateSecret) throw new Error('TangleSsoHandlerOptions.stateSecret is required')\n  if (!opts.callbackUrl) throw new Error('TangleSsoHandlerOptions.callbackUrl is required')\n  if (!opts.stateCookieName) throw new Error('TangleSsoHandlerOptions.stateCookieName is required')\n  const callbackUrl = new URL(opts.callbackUrl)\n  if (opts.protocol === 'oidc') {\n    if (opts.stateSecret.length < 32) throw new Error('OIDC stateSecret must contain at least 32 characters')\n    if (callbackUrl.username || callbackUrl.password || callbackUrl.hash || callbackUrl.search) {\n      throw new Error('OIDC callbackUrl must be fixed and have no credentials, query, or fragment')\n    }\n    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(callbackUrl.hostname)\n    if (callbackUrl.protocol !== 'https:' && !(callbackUrl.protocol === 'http:' && loopback)) {\n      throw new Error('OIDC requires HTTPS except on loopback')\n    }\n    if (callbackUrl.protocol === 'https:' && !opts.secureCookies) {\n      throw new Error('OIDC HTTPS callbacks require Secure cookies')\n    }\n  }\n  const sessionCookieName = opts.sessionCookieName ?? DEFAULT_SESSION_COOKIE\n  let mintSessionCookies: (args: TangleSsoSessionCookieArgs) => Promise<readonly string[]>\n  if (opts.setSessionCookie) {\n    const seam = opts.setSessionCookie\n    mintSessionCookies = async (args) => await seam(args)\n  } else if (opts.sessionCookieSecret) {\n    const secret = opts.sessionCookieSecret\n    mintSessionCookies = async ({ token, secure, ttlSeconds }) => [\n      serializeCookie(await signSessionCookieValue(token, secret), {\n        name: secure ? `__Secure-${sessionCookieName}` : sessionCookieName,\n        secure,\n        maxAgeSeconds: ttlSeconds,\n      }),\n    ]\n  } else {\n    throw new Error('TangleSsoHandlerOptions requires setSessionCookie or sessionCookieSecret')\n  }\n  const sessionTtlSeconds = opts.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS\n  const stateTtlSeconds = opts.stateTtlSeconds ?? DEFAULT_STATE_TTL_SECONDS\n  if (!Number.isFinite(stateTtlSeconds) || stateTtlSeconds <= 0\n    || !Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error('SSO lifetimes must be positive and finite')\n  }\n  const defaultRedirectPath = sanitizeRedirectPath(opts.defaultRedirectPath ?? DEFAULT_REDIRECT_PATH, DEFAULT_REDIRECT_PATH)\n  const loginPath = sanitizeRedirectPath(opts.loginPath ?? DEFAULT_LOGIN_PATH, DEFAULT_LOGIN_PATH)\n  const log = opts.log ?? (() => {})\n  const now = opts.now ?? Date.now\n  const stateConfig: SsoStateConfig = { secret: opts.stateSecret, ttlMs: stateTtlSeconds * 1000, now }\n  const stateCookieOpts = { name: opts.stateCookieName, secure: opts.secureCookies }\n  function loginErrorRedirect(code: string): Response {\n    const headers = new Headers()\n    headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n    const target = new URL(loginPath, REDIRECT_REFERENCE_ORIGIN)\n    target.searchParams.set('error', code)\n    return redirectResponse(`${target.pathname}${target.search}${target.hash}`, headers)\n  }\n  return {\n    async start(request) {\n      if (request.method !== 'GET') return new Response(null, { status: 405, headers: { Allow: 'GET' } })\n      const url = new URL(request.url)\n      if (opts.protocol === 'oidc' && url.origin !== callbackUrl.origin) {\n        return loginErrorRedirect('tangle_origin_mismatch')\n      }\n      const redirectPath = sanitizeRedirectPath(url.searchParams.get('redirect'), defaultRedirectPath)\n      const state = await createSignedSsoState(stateConfig)\n      const payload: StateCookiePayload = { s: state, r: redirectPath }\n      let authorizationUrl: string\n      if (opts.protocol === 'oidc') {\n        const pkce = await opts.createPkcePair()\n        payload.v = pkce.verifier\n        payload.m = await hmacHex(opts.stateSecret, stateBinding(payload, opts.callbackUrl))\n        authorizationUrl = opts.auth.authorizeUrl({ state, codeChallenge: pkce.challenge })\n        if (new URL(authorizationUrl).searchParams.get('redirect_uri') !== opts.callbackUrl) {\n          throw new Error('PlatformOidcClient.redirectUri must equal callbackUrl')\n        }\n      } else {\n        authorizationUrl = opts.auth.authorizeUrl({ state, redirectUri: opts.callbackUrl })\n      }\n      const cookie = serializeCookie(JSON.stringify(payload), {\n        ...stateCookieOpts,\n        maxAgeSeconds: stateTtlSeconds,\n      })\n      const headers = new Headers()\n      headers.append('Set-Cookie', cookie)\n      return redirectResponse(authorizationUrl, headers)\n    },\n    async callback(request) {\n      if (request.method !== 'GET') return new Response(null, { status: 405, headers: { Allow: 'GET' } })\n      const url = new URL(request.url)\n      if (opts.protocol === 'oidc'\n        && (url.origin !== callbackUrl.origin || url.pathname !== callbackUrl.pathname)) {\n        return loginErrorRedirect('tangle_origin_mismatch')\n      }\n      const code = url.searchParams.get('code')\n      const stateFromPlatform = url.searchParams.get('state')\n      if (!code || !stateFromPlatform || url.searchParams.has('error')) return loginErrorRedirect('tangle_callback_missing')\n      const payload = parseStateCookiePayload(readCookieValue(request.headers.get('cookie'), opts.stateCookieName))\n      if (!payload || !constantTimeEqual(payload.s, stateFromPlatform)) return loginErrorRedirect('tangle_state_mismatch')\n      if (!(await verifySignedSsoState(payload.s, stateConfig))) return loginErrorRedirect('tangle_state_mismatch')\n      if (opts.protocol === 'oidc' && (!payload.v || !/^[A-Za-z0-9_-]{43,128}$/.test(payload.v)\n        || !payload.m || !constantTimeEqual(payload.m, await hmacHex(opts.stateSecret, stateBinding(payload, opts.callbackUrl))))) {\n        return loginErrorRedirect('tangle_state_mismatch')\n      }\n      const tokenRequestedAt = now()\n      let oidcTokens: TangleOidcSsoTokens | undefined\n      let legacyExchange: TangleSsoExchangeResult | undefined\n      let createdSession: string | undefined\n      let committed = false\n      try {\n        let exchanged: { user: TangleSsoExchangeResult['user']; emailVerified: boolean }\n        try {\n          if (opts.protocol === 'oidc') {\n            const result = await opts.auth.exchange(code, payload.v!)\n            oidcTokens = result.tokens\n            if (!oidcTokens.refreshToken || !Number.isFinite(oidcTokens.expiresIn) || oidcTokens.expiresIn! <= 0) {\n              throw new Error('OIDC requires offline_access and a finite access-token lifetime')\n            }\n            exchanged = { user: result.user, emailVerified: result.user.emailVerified }\n          } else {\n            legacyExchange = await opts.auth.exchange(code)\n            exchanged = legacyExchange\n          }\n        } catch {\n          log('[tangle-sso] exchange failed')\n          return loginErrorRedirect('tangle_exchange_failed')\n        }\n        if (exchanged.emailVerified !== true) {\n          log('[tangle-sso] exchange did not include a verified-email proof')\n          return loginErrorRedirect('tangle_exchange_failed')\n        }\n        let userId: string\n        try {\n          const email = normalizeTangleSsoEmail(exchanged.user.email)\n          const resolution = await opts.store.resolveAccount({ email, platformUserId: exchanged.user.id })\n          if (resolution.kind === 'reject') throw new TangleSsoAccountConflictError(resolution.reason)\n          ;({ userId } = await opts.store.upsertUserByEmail({\n            email,\n            name: exchanged.user.name ?? null,\n            tangleUserId: exchanged.user.id,\n            resolution,\n          }))\n        } catch (err) {\n          if (err instanceof TangleSsoAccountConflictError) {\n            log('[tangle-sso] account linking conflict', err.reason)\n            return loginErrorRedirect('tangle_account_conflict')\n          }\n          if (err instanceof TangleSsoUserCreateError) return loginErrorRedirect('tangle_user_create_failed')\n          throw err\n        }\n        const expiresAt = new Date(now() + sessionTtlSeconds * 1000)\n        const { token } = await opts.store.createSession({\n          userId,\n          expiresAt,\n          ipAddress: clientIp(request),\n          userAgent: request.headers.get('user-agent'),\n        })\n        createdSession = token\n        const link = {\n          userId,\n          sessionToken: token,\n          tangleUserId: exchanged.user.id,\n          email: normalizeTangleSsoEmail(exchanged.user.email),\n          name: exchanged.user.name ?? null,\n        }\n        if (opts.protocol === 'oidc') {\n          const headers = new Headers()\n          headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n          const sessionCookies = await mintSessionCookies({ token, expiresAt, ttlSeconds: sessionTtlSeconds, secure: opts.secureCookies })\n          for (const cookie of sessionCookies) headers.append('Set-Cookie', cookie)\n          const response = redirectResponse(sanitizeRedirectPath(payload.r, defaultRedirectPath), headers)\n          await opts.store.saveTangleLink({\n            ...link,\n            tokens: oidcTokens!,\n            accessTokenExpiresAt: new Date(tokenRequestedAt + oidcTokens!.expiresIn! * 1000),\n          })\n          committed = true\n          return response\n        }\n        await opts.store.saveTangleLink({ ...link, apiKey: legacyExchange!.apiKey, planTier: legacyExchange!.plan?.tier ?? null })\n        const headers = new Headers()\n        headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n        const sessionCookies = await mintSessionCookies({ token, expiresAt, ttlSeconds: sessionTtlSeconds, secure: opts.secureCookies })\n        for (const cookie of sessionCookies) headers.append('Set-Cookie', cookie)\n        return redirectResponse(sanitizeRedirectPath(payload.r, defaultRedirectPath), headers)\n      } catch (error) {\n        if (opts.protocol !== 'oidc') throw error\n        log('[tangle-sso] local session persistence failed')\n        return loginErrorRedirect('tangle_session_failed')\n      } finally {\n        if (opts.protocol === 'oidc' && !committed) {\n          if (createdSession) {\n            try { await opts.store.deleteSession({ sessionToken: createdSession }) }\n            catch { log('[tangle-sso] unpublished session cleanup failed') }\n          }\n          if (oidcTokens) {\n            try { if (oidcTokens.refreshToken) await opts.auth.revoke(oidcTokens.refreshToken, 'refresh_token') }\n            catch { log('[tangle-sso] rejected grant refresh revocation failed') }\n            try { await opts.auth.revoke(oidcTokens.accessToken, 'access_token') }\n            catch { log('[tangle-sso] rejected grant access revocation failed') }\n          }\n        }\n      }\n    },\n  }\n}\n","/**\n * Request guards for agent-app routes: session auth (302 redirect for pages,\n * JSON 401 for APIs), admin allowlisting (404 — the route stays invisible to\n * non-admins), and the billable-balance gate (402 with a stable code).\n * Session resolution is a seam; thrown Responses follow the router convention\n * of surfacing a thrown Response as the route result.\n */\n\nimport { isTangleBillingEnforcementDisabled } from '../runtime/model'\n\n/** Define options for configuring authentication guard behavior and session retrieval */\nexport interface AuthGuardOptions<Session> {\n  /** e.g. a better-auth `auth.api.getSession` wrapped by the app. */\n  getSession(request: Request): Promise<Session | null | undefined>\n  /** Default '/login'. */\n  loginPath?: string\n}\n\n/** Resolve user authentication and session requirements for page and API requests */\nexport interface AuthGuard<Session> {\n  /** Page guard — throws a 302 redirect Response to `loginPath`. */\n  requireUser(request: Request): Promise<Session>\n  /** API guard — throws JSON 401 `{ error: 'Unauthorized', code: 'auth.unauthenticated' }`. */\n  requireApiUser(request: Request): Promise<Session>\n  /** `apiResponse` selects the 401 JSON path over the redirect. */\n  requireSession(request: Request, opts?: { apiResponse?: boolean }): Promise<Session>\n  getOptionalSession(request: Request): Promise<Session | null>\n}\n\n/** Create an authentication guard that enforces session presence and handles unauthorized access responses */\nexport function createAuthGuard<Session>(opts: AuthGuardOptions<Session>): AuthGuard<Session> {\n  const loginPath = opts.loginPath ?? '/login'\n\n  async function requireSession(request: Request, o: { apiResponse?: boolean } = {}): Promise<Session> {\n    const session = await opts.getSession(request)\n    if (!session) {\n      if (o.apiResponse) {\n        throw Response.json({ error: 'Unauthorized', code: 'auth.unauthenticated' }, { status: 401 })\n      }\n      throw new Response(null, { status: 302, headers: { Location: loginPath } })\n    }\n    return session\n  }\n\n  return {\n    requireSession,\n    requireUser: (request) => requireSession(request),\n    requireApiUser: (request) => requireSession(request, { apiResponse: true }),\n    getOptionalSession: async (request) => (await opts.getSession(request)) ?? null,\n  }\n}\n\n/** Resolve a value or an HTTP response indicating failure in a guarded operation */\nexport type GuardResolution<T> = { ok: true; value: T } | { ok: false; response: Response }\n\n/**\n * Adapt a guard that THROWS a Response (the quartet above — the router\n * convention) to the `{ok: true, value} | {ok: false, response}` resolution\n * shape the route factories take (`/chat-routes` `authorize`,\n * `/interactions` `resolveConnection`, `/chat-routes` upload `authorize`).\n * Every product wrote this try/catch by hand; it lives here once.\n */\nexport async function guardResolution<T>(run: () => Promise<T>): Promise<GuardResolution<T>> {\n  try {\n    return { ok: true, value: await run() }\n  } catch (err) {\n    if (err instanceof Response) return { ok: false, response: err }\n    throw err\n  }\n}\n\n/** Comma/whitespace separated → trimmed, lowercased, empties dropped. */\nexport function parseAdminEmails(raw: string | null | undefined): string[] {\n  return (raw ?? '')\n    .split(/[,\\s]+/)\n    .map((e) => e.trim().toLowerCase())\n    .filter(Boolean)\n}\n\n/** Define options to resolve user session and control access based on allowed admin emails */\nexport interface AdminGuardOptions<Session> {\n  requireUser(request: Request): Promise<Session>\n  emailOf(session: Session): string | null | undefined\n  /** Resolved per request; an EMPTY allowlist refuses everyone. */\n  allowedEmails(): string[]\n}\n\n/** Non-admins (and empty allowlists) get 404, keeping the route invisible —\n *  better than a \"forbidden\" footprint that advertises its existence. */\nexport function createAdminGuard<Session>(opts: AdminGuardOptions<Session>): (request: Request) => Promise<Session> {\n  return async (request) => {\n    const session = await opts.requireUser(request)\n    const allowed = opts.allowedEmails()\n    if (allowed.length === 0) throw new Response('Not found', { status: 404 })\n    const email = (opts.emailOf(session) ?? '').toLowerCase()\n    if (!allowed.includes(email)) throw new Response('Not found', { status: 404 })\n    return session\n  }\n}\n\n/** Describe the billable balance state including overage permission and remaining USD balance */\nexport interface BillableBalanceState {\n  overageAllowed: boolean\n  remainingBalanceUsd: number\n}\n\n/** Define options to assert and customize billable balance enforcement behavior */\nexport interface AssertBillableBalanceOptions {\n  env?: Record<string, string | undefined>\n  /** App-specific enforcement override flag (e.g. 'GTM_BILLING_ENFORCEMENT'),\n   *  fed to `isTangleBillingEnforcementDisabled`. */\n  enforcementEnvVar?: string\n  /** Default 'Add balance or upgrade your plan to invoke this agent.'. */\n  errorMessage?: string\n  /** Merged into the 402 JSON body (e.g. `{ organizationId }`). */\n  errorBody?: Record<string, unknown>\n}\n\n/**\n * Gate a billable turn: passes when enforcement is disabled (dev default),\n * the tier allows overage, or remaining balance is positive. Otherwise throws\n * a 402 Response with the stable `billing.balance_required` code so clients\n * can route to the billing screen.\n */\nexport function assertBillableBalance(state: BillableBalanceState, opts: AssertBillableBalanceOptions = {}): void {\n  if (isTangleBillingEnforcementDisabled({ env: opts.env, enforcementEnvVar: opts.enforcementEnvVar })) return\n  if (state.overageAllowed || state.remainingBalanceUsd > 0) return\n  // errorBody first: the stable error/code contract always wins over caller extras.\n  throw Response.json(\n    {\n      ...opts.errorBody,\n      error: opts.errorMessage ?? 'Add balance or upgrade your plan to invoke this agent.',\n      code: 'billing.balance_required',\n    },\n    { status: 402 },\n  )\n}\n"],"mappings":";;;;;;;;;;AASA,IAAM,4BAA4B;AAClC,IAAM,8BAA8B,KAAK,KAAK,KAAK;AACnD,IAAM,wBAAwB;AAC9B,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAc/B,SAAS,UAAU,OAAuB;AACxC,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACxE;AAEA,eAAe,UAAU,QAAgB,OAAoC;AAC3E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;AAC9F;AAEA,eAAe,QAAQ,QAAgB,OAAgC;AACrE,SAAO,MAAM,KAAK,MAAM,UAAU,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACnG;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;AAIA,eAAsB,qBAAqB,QAAyC;AAClF,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACvE,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,UAAU,GAAG,UAAU,EAAE,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;AACtD,SAAO,GAAG,OAAO,IAAI,MAAM,QAAQ,OAAO,QAAQ,OAAO,CAAC;AAC5D;AAGA,eAAsB,qBAAqB,OAAe,QAA0C;AAClG,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACvE,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,CAAC,QAAQ,WAAW,GAAG,IAAI;AACjC,MAAI,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,EAAG,QAAO;AAC5E,QAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,GAAG,MAAM,IAAI,SAAS,EAAE;AACtE,MAAI,CAAC,kBAAkB,KAAK,QAAQ,EAAG,QAAO;AAC9C,QAAM,WAAW,SAAS,WAAW,EAAE;AACvC,MAAI,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO;AACvC,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,QAAQ,OAAO,SAAS,4BAA4B;AAC1D,QAAM,MAAM,IAAI,IAAI;AACpB,SAAO,OAAO,KAAK,OAAO;AAC5B;AA8FO,SAAS,wBAAwB,OAAuB;AAC7D,SAAO,MAAM,KAAK,EAAE,YAAY;AAClC;AAEA,SAAS,yBAAyB,OAAiD;AACjF,QAAM,aAAa,OAAO,KAAK;AAC/B,SAAO,aAAa,aAAa;AACnC;AAYO,SAAS,wBACd,OAC4B;AAC5B,QAAM,QAAQ,wBAAwB,MAAM,KAAK;AACjD,QAAM,iBAAiB,yBAAyB,MAAM,cAAc;AACpE,MAAI,CAAC,MAAO,QAAO,EAAE,MAAM,UAAU,QAAQ,gBAAgB;AAC7D,MAAI,CAAC,eAAgB,QAAO,EAAE,MAAM,UAAU,QAAQ,sBAAsB;AAE5E,MAAI,MAAM,gBAAgB,SAAS,GAAG;AACpC,WAAO,EAAE,MAAM,UAAU,QAAQ,wBAAwB;AAAA,EAC3D;AACA,MAAI,MAAM,aAAa,SAAS,GAAG;AACjC,WAAO,EAAE,MAAM,UAAU,QAAQ,kBAAkB;AAAA,EACrD;AAEA,MAAI,MAAM,gBAAgB,KAAK,CAAC,YAAY,yBAAyB,QAAQ,cAAc,MAAM,cAAc,GAAG;AAChH,WAAO,EAAE,MAAM,UAAU,QAAQ,0BAA0B;AAAA,EAC7D;AACA,MAAI,MAAM,aAAa,KAAK,CAAC,YAAY,wBAAwB,QAAQ,KAAK,MAAM,KAAK,GAAG;AAC1F,WAAO,EAAE,MAAM,UAAU,QAAQ,uBAAuB;AAAA,EAC1D;AAEA,QAAM,gBAAgB,MAAM,gBAAgB,CAAC;AAC7C,QAAM,aAAa,MAAM,aAAa,CAAC;AAEvC,MAAI,eAAe;AACjB,QAAI,cAAc,WAAW,WAAW,cAAc,QAAQ;AAC5D,aAAO,EAAE,MAAM,UAAU,QAAQ,6BAA6B;AAAA,IAChE;AACA,WAAO,EAAE,MAAM,YAAY,QAAQ,cAAc,QAAQ,WAAW,cAAc;AAAA,EACpF;AAEA,MAAI,CAAC,WAAY,QAAO,EAAE,MAAM,SAAS;AACzC,QAAM,yBAAyB,yBAAyB,WAAW,cAAc;AACjF,MAAI,2BAA2B,gBAAgB;AAC7C,WAAO,EAAE,MAAM,YAAY,QAAQ,WAAW,QAAQ,WAAW,cAAc;AAAA,EACjF;AACA,MAAI,WAAW,kBAAkB,MAAM;AACrC,WAAO,EAAE,MAAM,UAAU,QAAQ,mBAAmB;AAAA,EACtD;AAEA,MAAI,0BAA0B,2BAA2B,gBAAgB;AACvE,WAAO,EAAE,MAAM,UAAU,QAAQ,6BAA6B;AAAA,EAChE;AAIA,SAAO,EAAE,MAAM,YAAY,QAAQ,WAAW,QAAQ,WAAW,iBAAiB;AACpF;AAGO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAC9C;AAAA,EAET,YAAY,QAAwC,UAAU,2CAA2C;AACvG,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAKO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,UAAU,8CAA8C;AAClE,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AA2FA,eAAsB,uBAAuB,OAAe,QAAiC;AAC3F,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,oDAAoD;AACjF,QAAM,MAAM,MAAM,UAAU,QAAQ,KAAK;AACzC,MAAI,MAAM;AACV,aAAW,QAAQ,IAAK,QAAO,OAAO,aAAa,IAAI;AACvD,SAAO,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC;AAC9B;AAqDO,SAAS,oCACd,MACA,UAAgD,CAAC,GACQ;AACzD,QAAM,OAAO,QAAQ,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACvE,SAAO,OAAO,EAAE,OAAO,WAAW,MAAM;AACtC,UAAM,MAAM,MAAM,KAAK;AACvB,QAAI,CAAC,IAAI,QAAQ;AACf,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,UAAM,EAAE,MAAM,WAAW,IAAI,IAAI,YAAY;AAC7C,QAAI,WAAW,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wFAAwF,WAAW,MAAM;AAAA,MAE3G;AAAA,IACF;AACA,QAAI,SAAS,0BAA0B,SAAS,YAAY,sBAAsB,IAAI;AACpF;AAAA,QACE,yCAAyC,IAAI;AAAA,MAI/C;AAAA,IACF;AACA,UAAM,WAAW,OAAO,WAAW,aAAa,WAAW,WAAW,WAAW;AACjF,UAAM,gBAAgB;AAAA,MACpB;AAAA,MACA,MAAM,OAAO,WAAW,SAAS,WAAW,WAAW,OAAO;AAAA,MAC9D,UAAU,WAAW,aAAa;AAAA,MAClC,UAAW,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,SAAS,MAAM,CAAC;AAAA,MAC9D,QAAQ,QAAQ,WAAW,MAAM,KAAK,KAAK,WAAW,WAAW;AAAA,MACjE,eAAe;AAAA,IACjB;AACA,UAAM,UAAU,CAAC,gBAAgB,MAAM,uBAAuB,OAAO,IAAI,MAAM,GAAG,aAAa,CAAC;AAChG,QAAI,SAAS,wBAAwB;AACnC,cAAQ,KAAK,kBAAkB,EAAE,GAAG,eAAe,MAAM,uBAAuB,CAAC,CAAC;AAAA,IACpF;AACA,WAAO;AAAA,EACT;AACF;AAsFA,IAAM,4BAA4B;AAElC,SAAS,qBAAqB,OAAsB,UAA0B;AAC5E,MAAI,CAAC,SAAS,CAAC,MAAM,WAAW,GAAG,KAAK,0BAA0B,KAAK,KAAK,EAAG,QAAO;AACtF,QAAM,OAAO,yBAAyB,KAAK;AAC3C,MAAI,SAAS,QAAQ,yBAAyB,IAAI,MAAM,KAAM,QAAO;AACrE,SAAO;AACT;AAIA,SAAS,yBAAyB,OAA8B;AAC9D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,OAAO,yBAAyB;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,WAAW,0BAA2B,QAAO;AACrD,SAAO,GAAG,IAAI,QAAQ,GAAG,IAAI,MAAM,GAAG,IAAI,IAAI;AAChD;AAEA,SAAS,iBAAiB,UAAkB,UAAU,IAAI,QAAQ,GAAa;AAC7E,UAAQ,IAAI,YAAY,QAAQ;AAChC,UAAQ,IAAI,iBAAiB,UAAU;AACvC,UAAQ,IAAI,mBAAmB,aAAa;AAC5C,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACpD;AAIA,SAAS,SAAS,SAAiC;AACjD,SACE,QAAQ,QAAQ,IAAI,kBAAkB,KACtC,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC5D;AAEJ;AASA,SAAS,wBAAwB,KAA+C;AAC9E,MAAI,CAAC,OAAO,IAAI,SAAS,KAAM,QAAO;AACtC,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO;AAC1D,UAAM,EAAE,GAAG,GAAG,GAAG,EAAE,IAAI;AACvB,QAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,WAAO,EAAE,GAAG,GAAG,GAAI,OAAO,MAAM,WAAW,EAAE,EAAE,IAAI,CAAC,GAAI,GAAI,OAAO,MAAM,WAAW,EAAE,EAAE,IAAI,CAAC,EAAG;AAAA,EAClG,QAAQ;AAAE,WAAO;AAAA,EAAK;AACxB;AAEA,SAAS,aAAa,SAA6B,aAA6B;AAC9E,SAAO,KAAK,UAAU,CAAC,QAAQ,GAAG,QAAQ,GAAG,QAAQ,KAAK,MAAM,WAAW,CAAC;AAC9E;AAGO,SAAS,wBACd,MACmB;AACnB,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,iDAAiD;AACxF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,iDAAiD;AACxF,MAAI,CAAC,KAAK,gBAAiB,OAAM,IAAI,MAAM,qDAAqD;AAChG,QAAM,cAAc,IAAI,IAAI,KAAK,WAAW;AAC5C,MAAI,KAAK,aAAa,QAAQ;AAC5B,QAAI,KAAK,YAAY,SAAS,GAAI,OAAM,IAAI,MAAM,sDAAsD;AACxG,QAAI,YAAY,YAAY,YAAY,YAAY,YAAY,QAAQ,YAAY,QAAQ;AAC1F,YAAM,IAAI,MAAM,4EAA4E;AAAA,IAC9F;AACA,UAAM,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,YAAY,QAAQ;AAClF,QAAI,YAAY,aAAa,YAAY,EAAE,YAAY,aAAa,WAAW,WAAW;AACxF,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AACA,QAAI,YAAY,aAAa,YAAY,CAAC,KAAK,eAAe;AAC5D,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAAA,EACF;AACA,QAAM,oBAAoB,KAAK,qBAAqB;AACpD,MAAI;AACJ,MAAI,KAAK,kBAAkB;AACzB,UAAM,OAAO,KAAK;AAClB,yBAAqB,OAAO,SAAS,MAAM,KAAK,IAAI;AAAA,EACtD,WAAW,KAAK,qBAAqB;AACnC,UAAM,SAAS,KAAK;AACpB,yBAAqB,OAAO,EAAE,OAAO,QAAQ,WAAW,MAAM;AAAA,MAC5D,gBAAgB,MAAM,uBAAuB,OAAO,MAAM,GAAG;AAAA,QAC3D,MAAM,SAAS,YAAY,iBAAiB,KAAK;AAAA,QACjD;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AACL,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AACA,QAAM,oBAAoB,KAAK,qBAAqB;AACpD,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,MAAI,CAAC,OAAO,SAAS,eAAe,KAAK,mBAAmB,KACvD,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AAClE,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,QAAM,sBAAsB,qBAAqB,KAAK,uBAAuB,uBAAuB,qBAAqB;AACzH,QAAM,YAAY,qBAAqB,KAAK,aAAa,oBAAoB,kBAAkB;AAC/F,QAAM,MAAM,KAAK,QAAQ,MAAM;AAAA,EAAC;AAChC,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cAA8B,EAAE,QAAQ,KAAK,aAAa,OAAO,kBAAkB,KAAM,IAAI;AACnG,QAAM,kBAAkB,EAAE,MAAM,KAAK,iBAAiB,QAAQ,KAAK,cAAc;AACjF,WAAS,mBAAmB,MAAwB;AAClD,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,UAAM,SAAS,IAAI,IAAI,WAAW,yBAAyB;AAC3D,WAAO,aAAa,IAAI,SAAS,IAAI;AACrC,WAAO,iBAAiB,GAAG,OAAO,QAAQ,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI,IAAI,OAAO;AAAA,EACrF;AACA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,UAAI,QAAQ,WAAW,MAAO,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,MAAM,EAAE,CAAC;AAClG,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAI,KAAK,aAAa,UAAU,IAAI,WAAW,YAAY,QAAQ;AACjE,eAAO,mBAAmB,wBAAwB;AAAA,MACpD;AACA,YAAM,eAAe,qBAAqB,IAAI,aAAa,IAAI,UAAU,GAAG,mBAAmB;AAC/F,YAAM,QAAQ,MAAM,qBAAqB,WAAW;AACpD,YAAM,UAA8B,EAAE,GAAG,OAAO,GAAG,aAAa;AAChE,UAAI;AACJ,UAAI,KAAK,aAAa,QAAQ;AAC5B,cAAM,OAAO,MAAM,KAAK,eAAe;AACvC,gBAAQ,IAAI,KAAK;AACjB,gBAAQ,IAAI,MAAM,QAAQ,KAAK,aAAa,aAAa,SAAS,KAAK,WAAW,CAAC;AACnF,2BAAmB,KAAK,KAAK,aAAa,EAAE,OAAO,eAAe,KAAK,UAAU,CAAC;AAClF,YAAI,IAAI,IAAI,gBAAgB,EAAE,aAAa,IAAI,cAAc,MAAM,KAAK,aAAa;AACnF,gBAAM,IAAI,MAAM,uDAAuD;AAAA,QACzE;AAAA,MACF,OAAO;AACL,2BAAmB,KAAK,KAAK,aAAa,EAAE,OAAO,aAAa,KAAK,YAAY,CAAC;AAAA,MACpF;AACA,YAAM,SAAS,gBAAgB,KAAK,UAAU,OAAO,GAAG;AAAA,QACtD,GAAG;AAAA,QACH,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,OAAO,cAAc,MAAM;AACnC,aAAO,iBAAiB,kBAAkB,OAAO;AAAA,IACnD;AAAA,IACA,MAAM,SAAS,SAAS;AACtB,UAAI,QAAQ,WAAW,MAAO,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,MAAM,EAAE,CAAC;AAClG,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAI,KAAK,aAAa,WAChB,IAAI,WAAW,YAAY,UAAU,IAAI,aAAa,YAAY,WAAW;AACjF,eAAO,mBAAmB,wBAAwB;AAAA,MACpD;AACA,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,oBAAoB,IAAI,aAAa,IAAI,OAAO;AACtD,UAAI,CAAC,QAAQ,CAAC,qBAAqB,IAAI,aAAa,IAAI,OAAO,EAAG,QAAO,mBAAmB,yBAAyB;AACrH,YAAM,UAAU,wBAAwB,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK,eAAe,CAAC;AAC5G,UAAI,CAAC,WAAW,CAAC,kBAAkB,QAAQ,GAAG,iBAAiB,EAAG,QAAO,mBAAmB,uBAAuB;AACnH,UAAI,CAAE,MAAM,qBAAqB,QAAQ,GAAG,WAAW,EAAI,QAAO,mBAAmB,uBAAuB;AAC5G,UAAI,KAAK,aAAa,WAAW,CAAC,QAAQ,KAAK,CAAC,0BAA0B,KAAK,QAAQ,CAAC,KACnF,CAAC,QAAQ,KAAK,CAAC,kBAAkB,QAAQ,GAAG,MAAM,QAAQ,KAAK,aAAa,aAAa,SAAS,KAAK,WAAW,CAAC,CAAC,IAAI;AAC3H,eAAO,mBAAmB,uBAAuB;AAAA,MACnD;AACA,YAAM,mBAAmB,IAAI;AAC7B,UAAI;AACJ,UAAI;AACJ,UAAI;AACJ,UAAI,YAAY;AAChB,UAAI;AACF,YAAI;AACJ,YAAI;AACF,cAAI,KAAK,aAAa,QAAQ;AAC5B,kBAAM,SAAS,MAAM,KAAK,KAAK,SAAS,MAAM,QAAQ,CAAE;AACxD,yBAAa,OAAO;AACpB,gBAAI,CAAC,WAAW,gBAAgB,CAAC,OAAO,SAAS,WAAW,SAAS,KAAK,WAAW,aAAc,GAAG;AACpG,oBAAM,IAAI,MAAM,iEAAiE;AAAA,YACnF;AACA,wBAAY,EAAE,MAAM,OAAO,MAAM,eAAe,OAAO,KAAK,cAAc;AAAA,UAC5E,OAAO;AACL,6BAAiB,MAAM,KAAK,KAAK,SAAS,IAAI;AAC9C,wBAAY;AAAA,UACd;AAAA,QACF,QAAQ;AACN,cAAI,8BAA8B;AAClC,iBAAO,mBAAmB,wBAAwB;AAAA,QACpD;AACA,YAAI,UAAU,kBAAkB,MAAM;AACpC,cAAI,8DAA8D;AAClE,iBAAO,mBAAmB,wBAAwB;AAAA,QACpD;AACA,YAAI;AACJ,YAAI;AACF,gBAAM,QAAQ,wBAAwB,UAAU,KAAK,KAAK;AAC1D,gBAAM,aAAa,MAAM,KAAK,MAAM,eAAe,EAAE,OAAO,gBAAgB,UAAU,KAAK,GAAG,CAAC;AAC/F,cAAI,WAAW,SAAS,SAAU,OAAM,IAAI,8BAA8B,WAAW,MAAM;AAC1F,WAAC,EAAE,OAAO,IAAI,MAAM,KAAK,MAAM,kBAAkB;AAAA,YAChD;AAAA,YACA,MAAM,UAAU,KAAK,QAAQ;AAAA,YAC7B,cAAc,UAAU,KAAK;AAAA,YAC7B;AAAA,UACF,CAAC;AAAA,QACH,SAAS,KAAK;AACZ,cAAI,eAAe,+BAA+B;AAChD,gBAAI,yCAAyC,IAAI,MAAM;AACvD,mBAAO,mBAAmB,yBAAyB;AAAA,UACrD;AACA,cAAI,eAAe,yBAA0B,QAAO,mBAAmB,2BAA2B;AAClG,gBAAM;AAAA,QACR;AACA,cAAM,YAAY,IAAI,KAAK,IAAI,IAAI,oBAAoB,GAAI;AAC3D,cAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,cAAc;AAAA,UAC/C;AAAA,UACA;AAAA,UACA,WAAW,SAAS,OAAO;AAAA,UAC3B,WAAW,QAAQ,QAAQ,IAAI,YAAY;AAAA,QAC7C,CAAC;AACD,yBAAiB;AACjB,cAAM,OAAO;AAAA,UACX;AAAA,UACA,cAAc;AAAA,UACd,cAAc,UAAU,KAAK;AAAA,UAC7B,OAAO,wBAAwB,UAAU,KAAK,KAAK;AAAA,UACnD,MAAM,UAAU,KAAK,QAAQ;AAAA,QAC/B;AACA,YAAI,KAAK,aAAa,QAAQ;AAC5B,gBAAMA,WAAU,IAAI,QAAQ;AAC5B,UAAAA,SAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,gBAAMC,kBAAiB,MAAM,mBAAmB,EAAE,OAAO,WAAW,YAAY,mBAAmB,QAAQ,KAAK,cAAc,CAAC;AAC/H,qBAAW,UAAUA,gBAAgB,CAAAD,SAAQ,OAAO,cAAc,MAAM;AACxE,gBAAM,WAAW,iBAAiB,qBAAqB,QAAQ,GAAG,mBAAmB,GAAGA,QAAO;AAC/F,gBAAM,KAAK,MAAM,eAAe;AAAA,YAC9B,GAAG;AAAA,YACH,QAAQ;AAAA,YACR,sBAAsB,IAAI,KAAK,mBAAmB,WAAY,YAAa,GAAI;AAAA,UACjF,CAAC;AACD,sBAAY;AACZ,iBAAO;AAAA,QACT;AACA,cAAM,KAAK,MAAM,eAAe,EAAE,GAAG,MAAM,QAAQ,eAAgB,QAAQ,UAAU,eAAgB,MAAM,QAAQ,KAAK,CAAC;AACzH,cAAM,UAAU,IAAI,QAAQ;AAC5B,gBAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,cAAM,iBAAiB,MAAM,mBAAmB,EAAE,OAAO,WAAW,YAAY,mBAAmB,QAAQ,KAAK,cAAc,CAAC;AAC/H,mBAAW,UAAU,eAAgB,SAAQ,OAAO,cAAc,MAAM;AACxE,eAAO,iBAAiB,qBAAqB,QAAQ,GAAG,mBAAmB,GAAG,OAAO;AAAA,MACvF,SAAS,OAAO;AACd,YAAI,KAAK,aAAa,OAAQ,OAAM;AACpC,YAAI,+CAA+C;AACnD,eAAO,mBAAmB,uBAAuB;AAAA,MACnD,UAAE;AACA,YAAI,KAAK,aAAa,UAAU,CAAC,WAAW;AAC1C,cAAI,gBAAgB;AAClB,gBAAI;AAAE,oBAAM,KAAK,MAAM,cAAc,EAAE,cAAc,eAAe,CAAC;AAAA,YAAE,QACjE;AAAE,kBAAI,iDAAiD;AAAA,YAAE;AAAA,UACjE;AACA,cAAI,YAAY;AACd,gBAAI;AAAE,kBAAI,WAAW,aAAc,OAAM,KAAK,KAAK,OAAO,WAAW,cAAc,eAAe;AAAA,YAAE,QAC9F;AAAE,kBAAI,uDAAuD;AAAA,YAAE;AACrE,gBAAI;AAAE,oBAAM,KAAK,KAAK,OAAO,WAAW,aAAa,cAAc;AAAA,YAAE,QAC/D;AAAE,kBAAI,sDAAsD;AAAA,YAAE;AAAA,UACtE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACrwBO,SAAS,gBAAyB,MAAqD;AAC5F,QAAM,YAAY,KAAK,aAAa;AAEpC,iBAAe,eAAe,SAAkB,IAA+B,CAAC,GAAqB;AACnG,UAAM,UAAU,MAAM,KAAK,WAAW,OAAO;AAC7C,QAAI,CAAC,SAAS;AACZ,UAAI,EAAE,aAAa;AACjB,cAAM,SAAS,KAAK,EAAE,OAAO,gBAAgB,MAAM,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC9F;AACA,YAAM,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,UAAU,EAAE,CAAC;AAAA,IAC5E;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,CAAC,YAAY,eAAe,OAAO;AAAA,IAChD,gBAAgB,CAAC,YAAY,eAAe,SAAS,EAAE,aAAa,KAAK,CAAC;AAAA,IAC1E,oBAAoB,OAAO,YAAa,MAAM,KAAK,WAAW,OAAO,KAAM;AAAA,EAC7E;AACF;AAYA,eAAsB,gBAAmB,KAAoD;AAC3F,MAAI;AACF,WAAO,EAAE,IAAI,MAAM,OAAO,MAAM,IAAI,EAAE;AAAA,EACxC,SAAS,KAAK;AACZ,QAAI,eAAe,SAAU,QAAO,EAAE,IAAI,OAAO,UAAU,IAAI;AAC/D,UAAM;AAAA,EACR;AACF;AAGO,SAAS,iBAAiB,KAA0C;AACzE,UAAQ,OAAO,IACZ,MAAM,QAAQ,EACd,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EACjC,OAAO,OAAO;AACnB;AAYO,SAAS,iBAA0B,MAA0E;AAClH,SAAO,OAAO,YAAY;AACxB,UAAM,UAAU,MAAM,KAAK,YAAY,OAAO;AAC9C,UAAM,UAAU,KAAK,cAAc;AACnC,QAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACzE,UAAM,SAAS,KAAK,QAAQ,OAAO,KAAK,IAAI,YAAY;AACxD,QAAI,CAAC,QAAQ,SAAS,KAAK,EAAG,OAAM,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC7E,WAAO;AAAA,EACT;AACF;AA0BO,SAAS,sBAAsB,OAA6B,OAAqC,CAAC,GAAS;AAChH,MAAI,mCAAmC,EAAE,KAAK,KAAK,KAAK,mBAAmB,KAAK,kBAAkB,CAAC,EAAG;AACtG,MAAI,MAAM,kBAAkB,MAAM,sBAAsB,EAAG;AAE3D,QAAM,SAAS;AAAA,IACb;AAAA,MACE,GAAG,KAAK;AAAA,MACR,OAAO,KAAK,gBAAgB;AAAA,MAC5B,MAAM;AAAA,IACR;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;","names":["headers","sessionCookies"]}

package/dist/{chunk-4PZE7XAM.js → chunk-S3344RBY.js}

@@ -1,9 +1,9 @@
-import {
-  persistedPartToWorkProduct
-} from "./chunk-ZVEEWGDK.js";
 import {
   mentionKindForPath
 } from "./chunk-X47R2IVO.js";
+import {
+  persistedPartToWorkProduct
+} from "./chunk-ZVEEWGDK.js";
 import {
   persistedPartToInteraction
 } from "./chunk-M3K2HVQD.js";
@@ -155,4 +155,4 @@ export {
   buildAttachmentPromptBlock,
   historyContentWithAttachments
 };
-//# sourceMappingURL=chunk-4PZE7XAM.js.map
+//# sourceMappingURL=chunk-S3344RBY.js.map

package/dist/{chunk-4S36HWE4.js → chunk-WAMJSZYB.js}

@@ -11,4 +11,4 @@ export {
   DesignCanvasLazy,
   DesignCanvasChromeLazy
 };
-//# sourceMappingURL=chunk-4S36HWE4.js.map
+//# sourceMappingURL=chunk-WAMJSZYB.js.map

package/dist/{chunk-VIL6MHHQ.js → chunk-XTLYE2VO.js}

@@ -7,10 +7,6 @@ import {
 import {
   stepActivityFlowTrace
 } from "./chunk-FBVLEGEG.js";
-import {
-  WorkProductCard,
-  workProductPartsFromMessageParts
-} from "./chunk-ENLRJYVW.js";
 import {
   joinClasses
 } from "./chunk-L7MB2LLM.js";
@@ -28,12 +24,16 @@ import {
   filterCommandPaletteItems,
   groupCommandPaletteItems
 } from "./chunk-SJWIZT7B.js";
+import {
+  WorkProductCard,
+  workProductPartsFromMessageParts
+} from "./chunk-ENLRJYVW.js";
 import {
   AsyncView
 } from "./chunk-3UBAO3N5.js";
 import {
   attachmentPartsFromMessageParts
-} from "./chunk-4PZE7XAM.js";
+} from "./chunk-S3344RBY.js";
 import {
   cancelStatusFor,
   fieldAcceptsFreeText,
@@ -6167,4 +6167,4 @@ export {
   useThinkingSeconds,
   ChatMessages
 };
-//# sourceMappingURL=chunk-VIL6MHHQ.js.map
+//# sourceMappingURL=chunk-XTLYE2VO.js.map

package/dist/design-canvas-react/index.js

@@ -88,7 +88,7 @@ import {
 import {
   DesignCanvasChromeLazy,
   DesignCanvasLazy
-} from "../chunk-4S36HWE4.js";
+} from "../chunk-WAMJSZYB.js";
 import {
   assertSceneMediaSrc,
   bleedAwareExportBounds,

package/dist/design-canvas-react/lazy.js

@@ -1,7 +1,7 @@
 import {
   DesignCanvasChromeLazy,
   DesignCanvasLazy
-} from "../chunk-4S36HWE4.js";
+} from "../chunk-WAMJSZYB.js";
 export {
   DesignCanvasChromeLazy,
   DesignCanvasLazy

package/dist/hosted-agent/general-skill.d.ts

@@ -0,0 +1,2 @@
+/** Shipped as a typed skill resource, not concatenated into the system prompt. */
+export declare const GENERAL_AGENT_SKILL = "---\nname: general-agent\ndescription: Use the persistent Tangle computer for code, Router research and media, browser and desktop work, and authorized Hub email, calendar and voice actions.\n---\n\n# Your computer\n\nYou are a general agent, not a hospitality-only bot. The sandbox is your persistent computer. Inspect the current working directory, installed commands and files before claiming a capability is absent. Keep programs and work products in the workspace. Do not write secrets into the memory home or commit credentials, browser state, native harness state or provider transcripts.\n\nThe runtime enforces the enrolled role and owner approval. You cannot grant yourself another role. Do not work around a denied tool through a shell, browser, different connection or another member's session. A business skill grants no extra authority.\n\n## Shell and code\n\nUse the native shell, read, write and edit tools. Write the program, run it and inspect stdout, stderr and exit status. Keep its source. For machine capacity, collect CPU identity and logical CPUs, cgroup CPU quota, cgroup memory limit and current usage, and filesystem capacity. Distinguish host totals from sandbox quotas. Useful sources are /proc/cpuinfo, /proc/meminfo, /sys/fs/cgroup/cpu.max, /sys/fs/cgroup/memory.max and df. Never estimate these numbers.\n\n## Web research and reading\n\nUse the tangle_web_search MCP tools supplied by the published Sandbox Router profile builder. Discover the actual tool schemas. Search, read primary sources, and cite the returned URLs. Preserve the result and source receipts with the answer. A search snippet is not proof that you read the page. Do not substitute the harness's native web provider or raw curl on a denied destination.\n\n## Browser\n\nUse the installed bad CLI from @tangle-network/browser-agent-driver. Begin with bad --help and inspect the help for the selected command. Use its documented browser task, screenshot and trace outputs. Do not install an unpinned replacement, implement another browser controller, or disable the network policy. The browser is governed by the sandbox's explicit egress allowlist. When a site is blocked, report the exact hostname needed for owner/operator approval. Reuse only your own authorized browser session.\n\n## Virtual desktop\n\nUse the computer_use MCP surface provided by the sandbox capability. Read its actual tools before interacting. Take a screenshot to establish the visible state, perform the requested operation, and take a second screenshot to verify it. Browser or desktop presence does not grant permission to spend, delete data or message a new party. Never claim success from a click alone.\n\n## Images, audio and video\n\nThe image includes the published @tangle-network/tcloud CLI and SDK, reached through the Tangle Router. Run tcloud --help and the selected media command's --help rather than guessing flags. Select a supported model from the Router catalog. The same package's TCloud client exposes imageGenerate, imagesEdit, videoGenerate and speech; use its installed declarations for exact options. No handwritten provider HTTP client is needed.\n\nAn accepted asynchronous video job is not a finished video. Record the job id, inspect its terminal status through the published client, and retain the returned artifact or URL. For an image, retain the actual output bytes or Router/provider URL, the selected model and the generation receipt. Do not fetch an arbitrary returned URL outside the allowlist. Never say an artifact was delivered to iMessage until the Hub transport confirms delivery. A generated URL can be sent as text when the channel has no media attachment operation.\n\n## Hub connections and voice\n\nEmail, calendar and ph0ny appear only through explicitly authorized Hub connections. Discover those tools and their schemas. A connection name alone is not a capability. Use the existing approval flow for every protected action. For outbound voice, resolve the exact intended recipient, obtain owner approval for the call, then use the connected ph0ny operation. Retain the provider call id and terminal call state. Inbound voice, iMessage and WhatsApp share the enrolled member's instance identity; do not create a new memory identity from a display name.\n\nFor reminders, use a connected scheduling tool or the published tangle workflows CLI when the current credential is allowed to create workflows. A future promise requires a stored workflow id, schedule, timezone and target receipt. If the scheduler refuses, say that no reminder exists. Never impersonate the owner or obtain a broader key.\n\n## Home and first run\n\nRead AGENTS.md and SOUL.md. Answer the current request before any optional onboarding interview. Fill IDENTITY.md from the configured identity, not an invented history. Add dated preferences to USER.md and durable facts to MEMORY.md. Keep daily source notes in memory/YYYY-MM-DD.md. Follow BOOTSTRAP.md while it exists and remove it when bootstrap is complete. Tell the owner when you change SOUL.md.\n\nUse the home maintenance command supplied with this profile for bounded reads, writes and git commits. An over-budget file is an error to fix, not permission to silently discard the user's memory. Do not use git add . in a sandbox containing credentials or browser/harness state. Only the home allowlist belongs in the home history.\n\n## Scheduled work\n\nAn hourly heartbeat is a scheduler job, not a file. It is private to its enrolled owner. Check only actionable items the owner authorized, within the configured local hours. Return exactly NO_REPLY when nothing needs attention. Do not send a generic check-in. A consolidation run updates the bounded home and commits it; it must not send a chat message simply to announce maintenance.\n\n## Proof\n\nA claim of execution needs a tool receipt. Retain commands, exit statuses, source URLs, generated artifact paths, workflow ids, call ids and product action ids. The operator joins them to the Hub inbound message and sandbox session. A queued workflow or a sent request is not completed work.\n";

package/dist/hosted-agent/general.d.ts

@@ -0,0 +1,53 @@
+import { type AgentProfile } from '@tangle-network/agent-interface';
+import { type BackendConfig, type LineVoiceOptions } from '@tangle-network/sandbox';
+import { type Line } from '@tangle-network/sandbox/core';
+export declare const GENERAL_AGENT_MODEL = "openai/gpt-5.6-luna";
+export declare const GENERAL_AGENT_SYSTEM_PROMPT: string;
+export interface GeneralAgentProfileOptions {
+    /** Business data, skills and already-authorized Hub connections. Not a replacement system prompt. */
+    preset?: AgentProfile;
+    /** Registered Router model id. Router supplies the transport and search configuration. */
+    model?: string;
+}
+/** Uses the published Sandbox Router builder. No provider client or search protocol is reimplemented. */
+export declare function buildGeneralAgentProfile(options?: GeneralAgentProfileOptions): Promise<AgentProfile>;
+export type GeneralAgentMember = {
+    address: string;
+    label?: string;
+} & ({
+    role: 'owner' | 'manager';
+    backend?: BackendConfig;
+    productServers?: never;
+} | {
+    role: 'staff' | 'vendor';
+    backend: BackendConfig;
+    productServers: string[];
+});
+export interface TangleAgentOptions {
+    apiKey: string;
+    /** Stable logical identity. Use the SAME key and enrollment on every channel. */
+    instanceKey: string;
+    profile: AgentProfile;
+    members: GeneralAgentMember[];
+    /** Additional approved hosts. This is not a URL list and never implies open egress. */
+    allowDomains?: string[];
+    turnsPerMemberPerDay?: number;
+    environment?: string;
+    sandboxUrl?: string;
+}
+/**
+ * General agents use the SDK's line attachment route. The additive rolePolicy
+ * is enforced by Platform, not by this composer. Older servers reject it.
+ * This deliberately does not change the legacy public conversation-kit API.
+ */
+export declare function createTangleAgent(options: TangleAgentOptions): {
+    /** Exact integration point for the Mac-lane line id. Never silently detach an existing attachment. */
+    attachExistingLine: (lineId: string, voice?: LineVoiceOptions) => Promise<Line>;
+    attachLine(connectionId: string, channel: {
+        transport: 'imessage';
+        voice?: LineVoiceOptions;
+    } | {
+        transport: 'whatsapp';
+        phoneNumberId: string;
+    }): Promise<Line>;
+};

package/dist/hosted-agent/index.d.ts

@@ -12,6 +12,9 @@ export interface HostedAgentLineOptions {
     voice?: LineVoiceOptions;
 }
 /**
+ * The public conversation kit. Each person has an isolated sandbox.
+ * This compatibility API is separate from the role-governed general-agent
+ * provisioning path (`createTangleAgent` and `tangle-agent`).
  * Hub owns delivery, member threads, consent and execution. A host keeps its
  * product catalog and billing policy, then passes that policy to this kit.
  */
@@ -43,6 +46,7 @@ export interface BoxPolicy {
     idleTimeoutSeconds: number;
     maxLifetimeSeconds: number;
     deleteAfterStoppedSeconds: number;
+    /** App domains. The runtime also admits the exact Platform preview-control host. */
     allowDomains: string[];
 }
 export declare const DEFAULT_BOX_POLICY: BoxPolicy;
@@ -70,4 +74,8 @@ export declare function createHostedAgent(config: HostedAgentConfig): {
     attachExistingLine(lineId: string, options?: HostedAgentLineOptions): Promise<Line>;
 };
 export type HostedAgent = ReturnType<typeof createHostedAgent>;
-export {};
+export { buildGeneralAgentProfile, createTangleAgent, GENERAL_AGENT_MODEL, GENERAL_AGENT_SYSTEM_PROMPT } from './general';
+export type { GeneralAgentProfileOptions, GeneralAgentMember, TangleAgentOptions } from './general';
+export { agentHomeWorkflows } from './workflows';
+export type { AgentHomeWorkflowOptions, AgentHomeWorkflow } from './workflows';
+export { defaultHomeFiles, DEFAULT_HOME_LIMITS, DEFAULT_AGENT_HOME, withDefaultAgentHome } from '../profile/home';