@tangle-network/agent-integrations 0.53.49 → 0.53.51

package/dist/specs.d.ts

@@ -1,5 +1,5 @@
-import { f as IntegrationActionRisk, g as IntegrationDataClass, d as IntegrationConnectorCategory, e as IntegrationConnectorAction, G as IntegrationConnectorTrigger, b as IntegrationConnector } from './core-types-D26cY5tD.js';
-import { O as OAuth2TokenClientAuthMethod } from './types-DpKn0frG.js';
+import { f as IntegrationActionRisk, g as IntegrationDataClass, d as IntegrationConnectorCategory, e as IntegrationConnectorAction, G as IntegrationConnectorTrigger, b as IntegrationConnector } from './core-types-BR9Gv6hE.js';
+import { O as OAuth2TokenClientAuthMethod, p as OAuth2UrlTemplateMetadataSpec } from './types-Hy58Fb8T.js';
 
 type IntegrationAuthMode = 'oauth2' | 'api_key' | 'hmac' | 'none' | 'custom';
 type IntegrationSpecStatus = 'catalog' | 'executable' | 'deprecated';
@@ -23,6 +23,8 @@ interface IntegrationSpec {
 type IntegrationAuthSpec = OAuth2AuthSpec | ApiKeyAuthSpec | HmacAuthSpec | NoneAuthSpec | CustomAuthSpec;
 interface OAuth2AuthSpec {
     mode: 'oauth2';
+    /** OAuth grant the connection runtime must drive. */
+    grantType?: 'authorization_code' | 'client_credentials';
     /** Authorization endpoint the connect flow sends the user to.
      *
      *  UNDEFINED when no shipped adapter and no family default supplies one —
@@ -47,6 +49,9 @@ interface OAuth2AuthSpec {
     tokenClientAuthMethod?: OAuth2TokenClientAuthMethod;
     scopes: ScopeDescriptor[];
     extraAuthParams?: Record<string, string>;
+    /** Rules for connection metadata that replaces complete provider roots in
+     *  authorizationUrl or tokenUrl templates. */
+    urlTemplateMetadata?: Readonly<Record<string, OAuth2UrlTemplateMetadataSpec>>;
     redirectUriTemplate: string;
     pkce?: 'required' | 'supported' | 'unsupported';
 }
@@ -195,6 +200,7 @@ declare function getIntegrationSpec(kind: string): IntegrationSpec | undefined;
 interface ConnectorAuthSpec {
     kind: string;
     authKind: 'oauth2' | 'api_key' | 'none' | 'custom';
+    grantType?: 'authorization_code' | 'client_credentials';
     /** Provider scopes to request in the authorization grant. Empty for
      *  api_key / none / custom. */
     requestedScopes: string[];
@@ -212,6 +218,7 @@ interface ConnectorAuthSpec {
     tokenClientSecretParam?: string;
     tokenClientAuthMethod?: OAuth2TokenClientAuthMethod;
     extraAuthParams?: Record<string, string>;
+    urlTemplateMetadata?: Readonly<Record<string, OAuth2UrlTemplateMetadataSpec>>;
 }
 declare function resolveConnectorAuthSpec(kind: string): ConnectorAuthSpec | undefined;
 declare function listExecutableIntegrationSpecs(): IntegrationSpec[];

package/dist/specs.js

@@ -16,12 +16,12 @@ import {
   validateCredentialFormat,
   validateCredentialSet,
   validateIntegrationSpec
-} from "./chunk-ZSXRS7D7.js";
+} from "./chunk-VV73V64K.js";
 import "./chunk-TKEVCGAI.js";
-import "./chunk-5UCHLQ3D.js";
-import "./chunk-H5UCSRF4.js";
+import "./chunk-CJ6SZNMU.js";
+import "./chunk-BYTP5QJQ.js";
 import "./chunk-XC54EOUQ.js";
-import "./chunk-W72KPXXX.js";
+import "./chunk-P4YUWB77.js";
 import "./chunk-PZ5AY32C.js";
 export {
   INTEGRATION_FAMILIES,

package/dist/{tangle-id-BCOVbWrP.d.ts → tangle-id-BRtXszIF.d.ts}

@@ -1,4 +1,4 @@
-import { C as ConnectorAdapter } from './types-DpKn0frG.js';
+import { C as ConnectorAdapter } from './types-Hy58Fb8T.js';
 
 /**
  * @stable Tangle Identity — `id.tangle.tools` connector + verifier.

package/dist/{types-DpKn0frG.d.ts → types-Hy58Fb8T.d.ts}

@@ -354,6 +354,17 @@ type TokenMetadataSource = string | {
  * otherwise default to `client_secret_post`, which sends both values in the
  * form body. `client_secret_basic` sends an HTTP Basic header instead. */
 type OAuth2TokenClientAuthMethod = 'none' | 'client_secret_post' | 'client_secret_basic';
+interface OAuth2UrlTemplateMetadataSpec {
+    /** A complete HTTPS provider base URL, substituted for a URL template
+     *  placeholder such as `{accountUrl}`. */
+    kind: 'base-url';
+    /** Exact provider roots accepted for finite regional endpoint sets. */
+    allowedBaseUrls?: readonly string[];
+    /** HTTPS hostname suffixes accepted for tenant-specific provider roots. */
+    allowedBaseUrlSuffixes?: readonly string[];
+    /** Permit a caller-selected public HTTPS root for self-hosted providers. */
+    requirePublicHttps?: boolean;
+}
 type OAuth2AuthSpec = {
     kind: 'oauth2';
     /** OAuth2 grant type. Defaults to `'authorization_code'` (the interactive
@@ -399,6 +410,11 @@ type OAuth2AuthSpec = {
      *  Google's `access_type=offline&prompt=consent` to obtain refresh
      *  tokens). */
     extraAuthParams?: Record<string, string>;
+    /** Rules for metadata placeholders that represent complete provider roots.
+     *  Placeholders without a rule remain single DNS labels. This distinction
+     *  prevents tenant metadata from redirecting client credentials unless the
+     *  connector explicitly declares the allowed provider host policy. */
+    urlTemplateMetadata?: Readonly<Record<string, OAuth2UrlTemplateMetadataSpec>>;
     /** Non-secret headers sent to the token endpoint. Use this for provider
      *  identification headers such as Reddit's required User-Agent. The runtime
      *  always owns Authorization and Content-Type. */
@@ -521,4 +537,4 @@ interface ConnectorManifestValidationResult {
 declare function validateConnectorManifest(manifest: ConnectorManifest): ConnectorManifestValidationResult;
 declare function assertValidConnectorManifest(manifest: ConnectorManifest): void;
 
-export { type AuthSpec as A, type ConnectorAdapter as C, type DataSourceMetadata as D, type EventHandlerResult as E, type InboundEvent as I, type OAuth2TokenClientAuthMethod as O, ProviderConfigError as P, type ResolvedDataSource as R, type TokenMetadataSource as T, type ConnectorCredentials as a, type CASStrategy as b, type Capability as c, type CapabilityClass as d, type CapabilityMutation as e, type CapabilityMutationResult as f, type CapabilityParameterSchema as g, type CapabilityRead as h, type CapabilityReadResult as i, type ConnectorInvocation as j, type ConnectorManifest as k, type ConnectorManifestValidationIssue as l, type ConnectorManifestValidationResult as m, type ConsistencyModel as n, CredentialsExpired as o, type ProviderHttpErrorInit as p, ProviderRateLimited as q, type ProviderRateLimitedInit as r, type RateLimitSpec as s, ResourceContention as t, assertValidConnectorManifest as u, validateConnectorManifest as v };
+export { type AuthSpec as A, type ConnectorAdapter as C, type DataSourceMetadata as D, type EventHandlerResult as E, type InboundEvent as I, type OAuth2TokenClientAuthMethod as O, ProviderConfigError as P, type ResolvedDataSource as R, type TokenMetadataSource as T, type ConnectorCredentials as a, type CASStrategy as b, type Capability as c, type CapabilityClass as d, type CapabilityMutation as e, type CapabilityMutationResult as f, type CapabilityParameterSchema as g, type CapabilityRead as h, type CapabilityReadResult as i, type ConnectorInvocation as j, type ConnectorManifest as k, type ConnectorManifestValidationIssue as l, type ConnectorManifestValidationResult as m, type ConsistencyModel as n, CredentialsExpired as o, type OAuth2UrlTemplateMetadataSpec as p, type ProviderHttpErrorInit as q, ProviderRateLimited as r, type ProviderRateLimitedInit as s, type RateLimitSpec as t, ResourceContention as u, assertValidConnectorManifest as v, validateConnectorManifest as w };

package/docs/integration-execution-matrix.json

@@ -60203,8 +60203,8 @@
     "catalogAuth": null,
     "setupAuth": {
       "mode": "oauth2",
-      "authorizationUrl": "https://app.marketo.com/identity/oauth/authorize",
-      "tokenUrl": "https://app.marketo.com/identity/oauth/token",
+      "grantType": "client_credentials",
+      "tokenUrl": "{restEndpoint}/identity/oauth/token",
       "clientIdEnv": "MARKETO_OAUTH_CLIENT_ID",
       "clientSecretEnv": "MARKETO_OAUTH_CLIENT_SECRET",
       "scopeSeparator": " ",
@@ -60213,8 +60213,16 @@
       "tokenClientSecretParam": "client_secret",
       "tokenClientAuthMethod": "client_secret_post",
       "scopes": [],
+      "urlTemplateMetadata": {
+        "restEndpoint": {
+          "kind": "base-url",
+          "allowedBaseUrlSuffixes": [
+            ".mktorest.com"
+          ]
+        }
+      },
       "redirectUriTemplate": "https://{host}/api/integrations/oauth/marketo/callback",
-      "pkce": "required"
+      "pkce": "unsupported"
     },
     "runtimePackage": null,
     "actionCount": 11,
@@ -67980,7 +67988,7 @@
       "authorizationClientIdParam": "client_id",
       "tokenClientIdParam": "client_id",
       "tokenClientSecretParam": "client_secret",
-      "tokenClientAuthMethod": "client_secret_post",
+      "tokenClientAuthMethod": "client_secret_basic",
       "scopes": [],
       "extraAuthParams": {
         "owner": "user"
@@ -70532,84 +70540,13 @@
     "category": "workflow",
     "catalogAuth": null,
     "setupAuth": {
-      "mode": "oauth2",
-      "authorizationUrl": "https://app.opsgenie.com/oauth/authorize",
-      "tokenUrl": "https://app.opsgenie.com/oauth/token",
-      "clientIdEnv": "OPSGENIE_OAUTH_CLIENT_ID",
-      "clientSecretEnv": "OPSGENIE_OAUTH_CLIENT_SECRET",
-      "scopeSeparator": " ",
-      "authorizationClientIdParam": "client_id",
-      "tokenClientIdParam": "client_id",
-      "tokenClientSecretParam": "client_secret",
-      "tokenClientAuthMethod": "client_secret_post",
-      "scopes": [
-        {
-          "normalized": "project.read",
-          "providerScope": "alert.read",
-          "title": "Opsgenie read",
-          "reason": "Read Opsgenie data for user-authorized agent workflows.",
-          "risk": "read",
-          "dataClass": "private"
-        },
-        {
-          "normalized": "project.write",
-          "providerScope": "alert.write",
-          "title": "Opsgenie write",
-          "reason": "Create or update Opsgenie resources after policy approval.",
-          "risk": "write",
-          "dataClass": "private"
-        },
-        {
-          "normalized": "project.read",
-          "providerScope": "incident.read",
-          "title": "Opsgenie read",
-          "reason": "Read Opsgenie data for user-authorized agent workflows.",
-          "risk": "read",
-          "dataClass": "private"
-        },
-        {
-          "normalized": "project.write",
-          "providerScope": "incident.write",
-          "title": "Opsgenie write",
-          "reason": "Create or update Opsgenie resources after policy approval.",
-          "risk": "write",
-          "dataClass": "private"
-        },
-        {
-          "normalized": "project.read",
-          "providerScope": "schedule.read",
-          "title": "Opsgenie read",
-          "reason": "Read Opsgenie data for user-authorized agent workflows.",
-          "risk": "read",
-          "dataClass": "private"
-        },
-        {
-          "normalized": "project.read",
-          "providerScope": "oncall.read",
-          "title": "Opsgenie read",
-          "reason": "Read Opsgenie data for user-authorized agent workflows.",
-          "risk": "read",
-          "dataClass": "private"
-        },
-        {
-          "normalized": "project.read",
-          "providerScope": "team.read",
-          "title": "Opsgenie read",
-          "reason": "Read Opsgenie data for user-authorized agent workflows.",
-          "risk": "read",
-          "dataClass": "private"
-        },
-        {
-          "normalized": "project.read",
-          "providerScope": "user.read",
-          "title": "Opsgenie read",
-          "reason": "Read Opsgenie data for user-authorized agent workflows.",
-          "risk": "read",
-          "dataClass": "private"
-        }
-      ],
-      "redirectUriTemplate": "https://{host}/api/integrations/oauth/opsgenie/callback",
-      "pkce": "required"
+      "mode": "api_key",
+      "credential": {
+        "label": "opsgenie API key",
+        "description": "Opsgenie API key with access to the selected alert, incident, schedule, team, and user operations.",
+        "secret": true
+      },
+      "placement": "bearer"
     },
     "runtimePackage": null,
     "actionCount": 21,
@@ -89483,8 +89420,8 @@
     "catalogAuth": "oauth2",
     "setupAuth": {
       "mode": "oauth2",
-      "authorizationUrl": "https://app.snowflake.com/oauth/authorize",
-      "tokenUrl": "https://app.snowflake.com/oauth/token",
+      "authorizationUrl": "{accountUrl}/oauth/authorize",
+      "tokenUrl": "{accountUrl}/oauth/token-request",
       "clientIdEnv": "SNOWFLAKE_OAUTH_CLIENT_ID",
       "clientSecretEnv": "SNOWFLAKE_OAUTH_CLIENT_SECRET",
       "scopeSeparator": " ",
@@ -89494,16 +89431,24 @@
       "tokenClientAuthMethod": "client_secret_post",
       "scopes": [
         {
-          "normalized": "database.write",
-          "providerScope": "session:role:manage",
-          "title": "Snowflake write",
-          "reason": "Create or update Snowflake resources after policy approval.",
-          "risk": "write",
+          "normalized": "database.read",
+          "providerScope": "refresh_token",
+          "title": "Snowflake read",
+          "reason": "Read Snowflake data for user-authorized agent workflows.",
+          "risk": "read",
           "dataClass": "private"
         }
       ],
+      "urlTemplateMetadata": {
+        "accountUrl": {
+          "kind": "base-url",
+          "allowedBaseUrlSuffixes": [
+            ".snowflakecomputing.com"
+          ]
+        }
+      },
       "redirectUriTemplate": "https://{host}/api/integrations/oauth/snowflake/callback",
-      "pkce": "required"
+      "pkce": "supported"
     },
     "authFields": [
       {
@@ -98648,7 +98593,7 @@
       "authorizationClientIdParam": "client_id",
       "tokenClientIdParam": "client_id",
       "tokenClientSecretParam": "client_secret",
-      "tokenClientAuthMethod": "client_secret_post",
+      "tokenClientAuthMethod": "client_secret_basic",
       "scopes": [
         {
           "normalized": "marketing.read",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-integrations",
-  "version": "0.53.49",
+  "version": "0.53.51",
   "description": "Vendor-neutral integration contracts and runtime helpers for sandbox and agent apps.",
   "homepage": "https://github.com/tangle-network/agent-integrations#readme",
   "repository": {

package/dist/chunk-5UCHLQ3D.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/connectors/bundled-manifests.ts"],"sourcesContent":["import {\n  CONNECTOR_ADAPTER_FACTORIES,\n  type ConnectorAdapterFactoryDefinition,\n} from './adapters/factories.js'\nimport * as bundledAdapters from './adapters/index.js'\nimport type { ConnectorAdapter, ConnectorManifest } from './types.js'\n\n/**\n * The bundled adapter registry — the single source of truth for \"which\n * connectors does this package actually implement, and how do they really\n * authenticate\".\n *\n * This exists because the answer was previously maintained by hand in two\n * places that drifted apart: `specs/registry.ts` carried an 18-name\n * `EXECUTABLE_KINDS` set while the package shipped 530 adapters, and the\n * platform kept its own private `collectBundledAdapters()` copy. A catalog\n * that describes connectors must derive from the connectors, never restate\n * them — restating is what let QuickBooks and Xero advertise a\n * `https://example.invalid/...` authorization URL behind a live Connect\n * button.\n *\n * Manifests are static data. Factory-style adapters need client credentials\n * to *execute*, but their manifest (auth endpoints, scopes, capability list)\n * is fixed at definition time, so we instantiate them with clearly-marked\n * placeholder options purely to read that static shape. The placeholders are\n * never used to make a request — {@link listBundledAdapterManifests} returns\n * manifests, not adapters.\n */\n\n/** Placeholder marker for factory options resolved only to read a manifest. */\nconst MANIFEST_PROBE_PREFIX = 'tangle-adapter-metadata-'\n\nfunction isConnectorAdapter(value: unknown): value is ConnectorAdapter {\n  if (!value || typeof value !== 'object') return false\n  const manifest = (value as { manifest?: unknown }).manifest\n  if (!manifest || typeof manifest !== 'object') return false\n  return typeof (manifest as { kind?: unknown }).kind === 'string'\n}\n\nfunction manifestFromFactory(\n  definition: ConnectorAdapterFactoryDefinition,\n): ConnectorManifest | undefined {\n  const probeOptions = Object.fromEntries(\n    Object.keys(definition.envMap).map((name) => [name, `${MANIFEST_PROBE_PREFIX}${name}`]),\n  )\n  try {\n    return definition.factory(probeOptions).manifest\n  } catch {\n    // A factory that cannot be constructed from placeholder options cannot\n    // contribute a manifest. Skipping is correct: it means the adapter is not\n    // describable without real credentials, so the catalog must not claim it.\n    return undefined\n  }\n}\n\nlet cachedManifests: ConnectorManifest[] | undefined\nlet cachedByKind: Map<string, ConnectorManifest> | undefined\n\n/**\n * Direct adapter instances that public catalog and action hosts may register.\n *\n * Factory adapters are intentionally absent: their construction requires\n * product-owned OAuth configuration. Inbound-only adapters remain available\n * as named exports for webhook hosts, but never compete with action adapters\n * for a public connector kind.\n */\nexport function listBundledConnectorAdapters(): ConnectorAdapter[] {\n  const byKind = new Map<string, ConnectorAdapter>()\n  const exportByKind = new Map<string, string>()\n  for (const [exportName, value] of Object.entries(bundledAdapters)) {\n    if (!isConnectorAdapter(value) || value.inboundOnly) continue\n    const kind = value.manifest.kind\n    const existingExport = exportByKind.get(kind)\n    if (existingExport) {\n      throw new Error(\n        `Duplicate public connector adapter kind \"${kind}\" exported by \"${existingExport}\" and \"${exportName}\".`,\n      )\n    }\n    exportByKind.set(kind, exportName)\n    byKind.set(kind, value)\n  }\n  return [...byKind.values()]\n}\n\nfunction buildRegistry(): Map<string, ConnectorManifest> {\n  const byKind = new Map<string, ConnectorManifest>()\n  for (const adapter of listBundledConnectorAdapters()) {\n    byKind.set(adapter.manifest.kind, adapter.manifest)\n  }\n  for (const definition of CONNECTOR_ADAPTER_FACTORIES) {\n    if (byKind.has(definition.kind)) continue\n    const manifest = manifestFromFactory(definition)\n    if (manifest) byKind.set(manifest.kind, manifest)\n  }\n  return byKind\n}\n\nfunction registry(): Map<string, ConnectorManifest> {\n  if (!cachedByKind) cachedByKind = buildRegistry()\n  return cachedByKind\n}\n\n/** Every connector manifest this package bundles, sorted by kind. */\nexport function listBundledAdapterManifests(): ConnectorManifest[] {\n  if (!cachedManifests) {\n    cachedManifests = [...registry().values()].sort((a, b) => a.kind.localeCompare(b.kind))\n  }\n  return cachedManifests\n}\n\n/** The bundled manifest for `kind`, or undefined when nothing implements it. */\nexport function getBundledAdapterManifest(kind: string): ConnectorManifest | undefined {\n  return registry().get(kind)\n}\n\n/** Whether this package ships a real, executable adapter for `kind`. */\nexport function hasBundledAdapter(kind: string): boolean {\n  return registry().has(kind)\n}\n\n/** Kinds this package implements. */\nexport function listBundledAdapterKinds(): string[] {\n  return listBundledAdapterManifests().map((manifest) => manifest.kind)\n}\n\n/**\n * How a bundled connector really authenticates.\n *\n * `oauth2_client_credentials` is called out separately because it IS a\n * connectable mode but has no user-facing authorize step — a caller that\n * treats \"oauth2 without an authorizationUrl\" as broken would wrongly condemn\n * these machine-to-machine providers.\n */\nexport type BundledAuthMode =\n  | 'oauth2'\n  | 'oauth2_client_credentials'\n  | 'api_key'\n  | 'hmac'\n  | 'none'\n\n/** The auth mode a connect flow would actually drive for this manifest,\n *  resolving `one_of` through its declared `preferred` mode. */\nexport function bundledAuthMode(manifest: ConnectorManifest): BundledAuthMode | undefined {\n  const auth = manifest.auth\n  const effective =\n    auth.kind === 'one_of'\n      ? (auth.options.find((option) => option.kind === auth.preferred) ?? auth.options[0])\n      : auth\n  switch (effective.kind) {\n    case 'oauth2':\n      return effective.grantType === 'client_credentials' ? 'oauth2_client_credentials' : 'oauth2'\n    case 'api-key':\n      return 'api_key'\n    case 'hmac':\n      return 'hmac'\n    case 'none':\n      return 'none'\n    default:\n      return undefined\n  }\n}\n\n/** The setup hint an api-key connector shows when collecting its credential. */\nexport function bundledApiKeyHint(manifest: ConnectorManifest): string | undefined {\n  const auth = manifest.auth\n  const candidates = auth.kind === 'one_of' ? auth.options : [auth]\n  for (const candidate of candidates) {\n    if (candidate.kind === 'api-key') return candidate.hint\n  }\n  return undefined\n}\n\n/** The authorization-code OAuth2 branch of a manifest's auth spec, if it has\n *  one. `one_of` manifests are resolved through their `preferred` mode, which\n *  is the mode a connect flow would actually drive. Returns undefined for\n *  api-key/hmac/none connectors and for `client_credentials` OAuth (which has\n *  no user-facing authorize step). */\nexport function bundledOAuth2Auth(manifest: ConnectorManifest):\n  | {\n      authorizationUrl: string\n      tokenUrl: string\n      scopes: string[]\n      clientIdEnv: string\n      clientSecretEnv?: string\n      scopeSeparator: ' ' | ','\n      pkce?: 'required' | 'supported' | 'unsupported'\n      authorizationClientIdParam: string\n      tokenClientIdParam: string\n      tokenClientSecretParam: string\n      tokenClientAuthMethod: 'none' | 'client_secret_post' | 'client_secret_basic'\n      extraAuthParams?: Record<string, string>\n      tokenRequestHeaders?: Record<string, string>\n    }\n  | undefined {\n  const auth = manifest.auth\n  const candidates =\n    auth.kind === 'one_of'\n      ? auth.options.filter((option) => option.kind === auth.preferred)\n      : [auth]\n  for (const candidate of candidates) {\n    if (candidate.kind !== 'oauth2') continue\n    if (candidate.grantType === 'client_credentials') continue\n    if (!candidate.authorizationUrl) continue\n    return {\n      authorizationUrl: candidate.authorizationUrl,\n      tokenUrl: candidate.tokenUrl,\n      scopes: candidate.scopes,\n      clientIdEnv: candidate.clientIdEnv,\n      clientSecretEnv: candidate.clientSecretEnv,\n      scopeSeparator: candidate.scopeSeparator ?? ' ',\n      pkce: candidate.pkce,\n      authorizationClientIdParam: candidate.authorizationClientIdParam ?? 'client_id',\n      tokenClientIdParam: candidate.tokenClientIdParam ?? 'client_id',\n      tokenClientSecretParam: candidate.tokenClientSecretParam ?? 'client_secret',\n      tokenClientAuthMethod: candidate.tokenClientAuthMethod ?? 'client_secret_post',\n      extraAuthParams: candidate.extraAuthParams,\n      tokenRequestHeaders: candidate.tokenRequestHeaders,\n    }\n  }\n  return undefined\n}\n"],"mappings":";;;;;;AA8BA,IAAM,wBAAwB;AAE9B,SAAS,mBAAmB,OAA2C;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO;AACtD,SAAO,OAAQ,SAAgC,SAAS;AAC1D;AAEA,SAAS,oBACP,YAC+B;AAC/B,QAAM,eAAe,OAAO;AAAA,IAC1B,OAAO,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,qBAAqB,GAAG,IAAI,EAAE,CAAC;AAAA,EACxF;AACA,MAAI;AACF,WAAO,WAAW,QAAQ,YAAY,EAAE;AAAA,EAC1C,QAAQ;AAIN,WAAO;AAAA,EACT;AACF;AAEA,IAAI;AACJ,IAAI;AAUG,SAAS,+BAAmD;AACjE,QAAM,SAAS,oBAAI,IAA8B;AACjD,QAAM,eAAe,oBAAI,IAAoB;AAC7C,aAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,gBAAe,GAAG;AACjE,QAAI,CAAC,mBAAmB,KAAK,KAAK,MAAM,YAAa;AACrD,UAAM,OAAO,MAAM,SAAS;AAC5B,UAAM,iBAAiB,aAAa,IAAI,IAAI;AAC5C,QAAI,gBAAgB;AAClB,YAAM,IAAI;AAAA,QACR,4CAA4C,IAAI,kBAAkB,cAAc,UAAU,UAAU;AAAA,MACtG;AAAA,IACF;AACA,iBAAa,IAAI,MAAM,UAAU;AACjC,WAAO,IAAI,MAAM,KAAK;AAAA,EACxB;AACA,SAAO,CAAC,GAAG,OAAO,OAAO,CAAC;AAC5B;AAEA,SAAS,gBAAgD;AACvD,QAAM,SAAS,oBAAI,IAA+B;AAClD,aAAW,WAAW,6BAA6B,GAAG;AACpD,WAAO,IAAI,QAAQ,SAAS,MAAM,QAAQ,QAAQ;AAAA,EACpD;AACA,aAAW,cAAc,6BAA6B;AACpD,QAAI,OAAO,IAAI,WAAW,IAAI,EAAG;AACjC,UAAM,WAAW,oBAAoB,UAAU;AAC/C,QAAI,SAAU,QAAO,IAAI,SAAS,MAAM,QAAQ;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,WAA2C;AAClD,MAAI,CAAC,aAAc,gBAAe,cAAc;AAChD,SAAO;AACT;AAGO,SAAS,8BAAmD;AACjE,MAAI,CAAC,iBAAiB;AACpB,sBAAkB,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA,EACxF;AACA,SAAO;AACT;AAGO,SAAS,0BAA0B,MAA6C;AACrF,SAAO,SAAS,EAAE,IAAI,IAAI;AAC5B;AAGO,SAAS,kBAAkB,MAAuB;AACvD,SAAO,SAAS,EAAE,IAAI,IAAI;AAC5B;AAGO,SAAS,0BAAoC;AAClD,SAAO,4BAA4B,EAAE,IAAI,CAAC,aAAa,SAAS,IAAI;AACtE;AAmBO,SAAS,gBAAgB,UAA0D;AACxF,QAAM,OAAO,SAAS;AACtB,QAAM,YACJ,KAAK,SAAS,WACT,KAAK,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,KAAK,SAAS,KAAK,KAAK,QAAQ,CAAC,IAChF;AACN,UAAQ,UAAU,MAAM;AAAA,IACtB,KAAK;AACH,aAAO,UAAU,cAAc,uBAAuB,8BAA8B;AAAA,IACtF,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGO,SAAS,kBAAkB,UAAiD;AACjF,QAAM,OAAO,SAAS;AACtB,QAAM,aAAa,KAAK,SAAS,WAAW,KAAK,UAAU,CAAC,IAAI;AAChE,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,SAAS,UAAW,QAAO,UAAU;AAAA,EACrD;AACA,SAAO;AACT;AAOO,SAAS,kBAAkB,UAgBpB;AACZ,QAAM,OAAO,SAAS;AACtB,QAAM,aACJ,KAAK,SAAS,WACV,KAAK,QAAQ,OAAO,CAAC,WAAW,OAAO,SAAS,KAAK,SAAS,IAC9D,CAAC,IAAI;AACX,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,SAAS,SAAU;AACjC,QAAI,UAAU,cAAc,qBAAsB;AAClD,QAAI,CAAC,UAAU,iBAAkB;AACjC,WAAO;AAAA,MACL,kBAAkB,UAAU;AAAA,MAC5B,UAAU,UAAU;AAAA,MACpB,QAAQ,UAAU;AAAA,MAClB,aAAa,UAAU;AAAA,MACvB,iBAAiB,UAAU;AAAA,MAC3B,gBAAgB,UAAU,kBAAkB;AAAA,MAC5C,MAAM,UAAU;AAAA,MAChB,4BAA4B,UAAU,8BAA8B;AAAA,MACpE,oBAAoB,UAAU,sBAAsB;AAAA,MACpD,wBAAwB,UAAU,0BAA0B;AAAA,MAC5D,uBAAuB,UAAU,yBAAyB;AAAA,MAC1D,iBAAiB,UAAU;AAAA,MAC3B,qBAAqB,UAAU;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;","names":[]}