@tangle-network/agent-integrations 0.53.53 → 0.53.54

package/dist/chunk-RSJRICPU.js

@@ -0,0 +1,394 @@
+// src/web-crypto.ts
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+async function sha256Base64Url(value) {
+  const crypto = requireWebCrypto();
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return bytesToBase64Url(new Uint8Array(digest));
+}
+function createWebCryptoUuid() {
+  const crypto = requireWebCrypto();
+  if (typeof crypto.randomUUID === "function") return crypto.randomUUID();
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  return [...bytes].map((byte, index) => {
+    const value = byte.toString(16).padStart(2, "0");
+    return [4, 6, 8, 10].includes(index) ? `-${value}` : value;
+  }).join("");
+}
+function requireWebCrypto() {
+  const crypto = globalThis.crypto;
+  if (!crypto || !crypto.subtle || typeof crypto.getRandomValues !== "function") {
+    throw new Error("The Web Crypto API is required for integration security operations.");
+  }
+  return crypto;
+}
+function bytesToBase64Url(bytes) {
+  let encoded = "";
+  for (let index = 0; index < bytes.length; index += 3) {
+    const first = bytes[index];
+    const second = bytes[index + 1];
+    const third = bytes[index + 2];
+    encoded += BASE64_ALPHABET[first >> 2];
+    encoded += BASE64_ALPHABET[(first & 3) << 4 | (second === void 0 ? 0 : second >> 4)];
+    encoded += second === void 0 ? "=" : BASE64_ALPHABET[(second & 15) << 2 | (third === void 0 ? 0 : third >> 6)];
+    encoded += third === void 0 ? "=" : BASE64_ALPHABET[third & 63];
+  }
+  return encoded.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+// src/audit.ts
+var InMemoryIntegrationAuditStore = class {
+  events = [];
+  record(event) {
+    this.events.push(event);
+  }
+  list(filter = {}) {
+    return this.events.filter((event) => matchesFilter(event, filter));
+  }
+};
+function createIntegrationAuditEvent(input) {
+  const occurredAt = input.occurredAt instanceof Date ? input.occurredAt.toISOString() : input.occurredAt ?? (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+  return {
+    ...input,
+    id: input.id ?? `audit_${createWebCryptoUuid()}`,
+    occurredAt,
+    metadata: input.metadata ? redactUnknown(input.metadata) : void 0
+  };
+}
+function createAuditingActionGuard(options) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  return {
+    async invokeAction(ctx, proceed) {
+      const startedAt = now();
+      try {
+        const result = await proceed();
+        await options.sink.record(actionEvent({
+          ctx,
+          request: ctx.request,
+          result,
+          type: result.ok ? "action.invoked" : "action.failed",
+          subject: options.subject,
+          occurredAt: startedAt,
+          includeInputPreview: options.includeInputPreview
+        }));
+        return result;
+      } catch (error) {
+        await options.sink.record(actionEvent({
+          ctx,
+          request: ctx.request,
+          type: "action.failed",
+          subject: options.subject,
+          occurredAt: startedAt,
+          includeInputPreview: options.includeInputPreview,
+          message: error instanceof Error ? error.message : "Integration action failed."
+        }));
+        throw error;
+      }
+    }
+  };
+}
+function sanitizeAuditConnection(connection) {
+  return {
+    id: connection.id,
+    owner: connection.owner,
+    providerId: connection.providerId,
+    connectorId: connection.connectorId,
+    status: connection.status,
+    grantedScopes: connection.grantedScopes,
+    account: connection.account,
+    hasSecretRef: Boolean(connection.secretRef),
+    createdAt: connection.createdAt,
+    updatedAt: connection.updatedAt,
+    expiresAt: connection.expiresAt,
+    lastUsedAt: connection.lastUsedAt
+  };
+}
+function actionEvent(input) {
+  return createIntegrationAuditEvent({
+    type: input.type,
+    occurredAt: input.occurredAt,
+    actor: input.subject ?? input.ctx.connection.owner,
+    connectionId: input.ctx.connection.id,
+    providerId: input.ctx.connection.providerId,
+    connectorId: input.ctx.connection.connectorId,
+    action: input.request.action,
+    risk: input.ctx.action?.risk,
+    dataClass: input.ctx.action?.dataClass,
+    ok: input.result?.ok ?? false,
+    message: input.message,
+    metadata: {
+      idempotencyKey: input.request.idempotencyKey,
+      dryRun: input.request.dryRun,
+      externalId: input.result?.externalId,
+      warnings: input.result?.warnings,
+      inputPreview: input.includeInputPreview ? redactUnknown(input.request.input) : void 0
+    }
+  });
+}
+function matchesFilter(event, filter) {
+  if (filter.type && event.type !== filter.type) return false;
+  if (filter.actor && (!event.actor || event.actor.type !== filter.actor.type || event.actor.id !== filter.actor.id)) return false;
+  if (filter.connectionId && event.connectionId !== filter.connectionId) return false;
+  if (filter.providerId && event.providerId !== filter.providerId) return false;
+  if (filter.connectorId && event.connectorId !== filter.connectorId) return false;
+  if (filter.action && event.action !== filter.action) return false;
+  return true;
+}
+function redactUnknown(value) {
+  if (Array.isArray(value)) return value.map(redactUnknown);
+  if (!value || typeof value !== "object") return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (/token|secret|password|authorization|api[_-]?key|credential|refresh/i.test(key)) {
+      out[key] = "[REDACTED]";
+    } else {
+      out[key] = redactUnknown(child);
+    }
+  }
+  return out;
+}
+
+// src/guard.ts
+var InMemoryIntegrationIdempotencyStore = class {
+  records = /* @__PURE__ */ new Map();
+  get(key) {
+    return this.records.get(key);
+  }
+  put(record) {
+    this.records.set(record.key, record);
+  }
+};
+var DefaultIntegrationActionGuard = class {
+  idempotency;
+  audit;
+  rateLimiter;
+  requireIdempotencyForMutations;
+  now;
+  constructor(options = {}) {
+    this.idempotency = options.idempotency;
+    this.audit = options.audit;
+    this.rateLimiter = options.rateLimiter;
+    this.requireIdempotencyForMutations = options.requireIdempotencyForMutations ?? false;
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  async invokeAction(ctx, proceed) {
+    const idempotencyKey = ctx.request.idempotencyKey;
+    if (this.requireIdempotencyForMutations && ctx.action?.risk !== "read" && !idempotencyKey) {
+      return {
+        ok: false,
+        action: ctx.request.action,
+        output: {
+          idempotencyRequired: true,
+          message: "State-changing integration actions require an idempotency key."
+        }
+      };
+    }
+    const requestHash = idempotencyKey && this.idempotency ? await hashRequest(ctx) : void 0;
+    if (idempotencyKey && this.idempotency && requestHash) {
+      const existing = await this.idempotency.get(idempotencyKey);
+      if (existing) {
+        if (existing.requestHash !== requestHash) {
+          return {
+            ok: false,
+            action: ctx.request.action,
+            output: { idempotencyConflict: true, message: "Idempotency key was reused with different integration input." }
+          };
+        }
+        return {
+          ...existing.result,
+          metadata: { ...existing.result.metadata ?? {}, idempotentReplay: true }
+        };
+      }
+    }
+    if (ctx.request.dryRun && ctx.action?.risk !== "read") {
+      const result = {
+        ok: true,
+        action: ctx.request.action,
+        output: { dryRun: true },
+        metadata: { dryRun: true }
+      };
+      await this.writeIdempotency(idempotencyKey, requestHash, result);
+      return result;
+    }
+    const rateLimit = await this.rateLimiter?.check(ctx);
+    if (rateLimit && !rateLimit.allowed) {
+      return {
+        ok: false,
+        action: ctx.request.action,
+        output: { rateLimited: true, retryAfterMs: rateLimit.retryAfterMs, message: rateLimit.reason ?? "Integration rate limit exceeded." }
+      };
+    }
+    try {
+      const result = await proceed();
+      if (result.ok) {
+        await this.writeIdempotency(idempotencyKey, requestHash, result);
+      }
+      await this.audit?.record(createIntegrationAuditEvent({
+        type: result.ok ? "action.invoked" : "action.failed",
+        actor: ctx.connection.owner,
+        connectionId: ctx.connection.id,
+        providerId: ctx.connection.providerId,
+        connectorId: ctx.connection.connectorId,
+        action: ctx.request.action,
+        risk: ctx.action?.risk,
+        dataClass: ctx.action?.dataClass,
+        ok: result.ok,
+        metadata: { idempotencyKey, externalId: result.externalId, warnings: result.warnings },
+        now: this.now
+      }));
+      return result;
+    } catch (error) {
+      await this.audit?.record(createIntegrationAuditEvent({
+        type: "action.failed",
+        actor: ctx.connection.owner,
+        connectionId: ctx.connection.id,
+        providerId: ctx.connection.providerId,
+        connectorId: ctx.connection.connectorId,
+        action: ctx.request.action,
+        risk: ctx.action?.risk,
+        dataClass: ctx.action?.dataClass,
+        ok: false,
+        message: error instanceof Error ? error.message : "Integration action failed.",
+        metadata: { idempotencyKey },
+        now: this.now
+      }));
+      throw error;
+    }
+  }
+  async writeIdempotency(key, requestHash, result) {
+    if (!key || !this.idempotency || !requestHash) return;
+    await this.idempotency.put({
+      key,
+      requestHash,
+      result,
+      createdAt: this.now().toISOString()
+    });
+  }
+};
+function createDefaultIntegrationActionGuard(options = {}) {
+  return new DefaultIntegrationActionGuard(options);
+}
+async function hashRequest(ctx) {
+  return sha256Base64Url(JSON.stringify({
+    connectionId: ctx.connection.id,
+    action: ctx.request.action,
+    input: ctx.request.input ?? null,
+    dryRun: ctx.request.dryRun ?? false
+  }));
+}
+
+// src/policy.ts
+var StaticIntegrationPolicyEngine = class {
+  rules;
+  defaultReadEffect;
+  defaultWriteEffect;
+  defaultDestructiveEffect;
+  now;
+  constructor(options = {}) {
+    this.rules = options.rules ?? [];
+    this.defaultReadEffect = options.defaultReadEffect ?? "allow";
+    this.defaultWriteEffect = options.defaultWriteEffect ?? "require_approval";
+    this.defaultDestructiveEffect = options.defaultDestructiveEffect ?? "deny";
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  decide(ctx) {
+    const action = ctx.action;
+    if (!action) return { decision: "deny", reason: "Integration action is missing from connector catalog." };
+    const matched = this.rules.find((rule) => ruleMatches(rule, ctx));
+    const effect = matched?.effect ?? this.defaultEffect(action.risk);
+    const reason = matched?.reason ?? defaultReason(effect, action.risk);
+    if (effect === "allow") return { decision: "allow", reason, metadata: matched ? { ruleId: matched.id } : void 0 };
+    if (effect === "deny") return { decision: "deny", reason, metadata: matched ? { ruleId: matched.id } : void 0 };
+    return {
+      decision: "require_approval",
+      reason,
+      approval: buildApprovalRequest(ctx, reason, this.now()),
+      metadata: matched ? { ruleId: matched.id } : void 0
+    };
+  }
+  defaultEffect(risk) {
+    if (risk === "read") return this.defaultReadEffect;
+    if (risk === "write") return this.defaultWriteEffect;
+    return this.defaultDestructiveEffect;
+  }
+};
+function createDefaultIntegrationPolicyEngine(options = {}) {
+  return new StaticIntegrationPolicyEngine(options);
+}
+function buildApprovalRequest(ctx, reason, requestedAt) {
+  if (!ctx.action) {
+    throw new Error("Cannot build approval request without an action descriptor.");
+  }
+  return {
+    id: `approval_${createWebCryptoUuid()}`,
+    connectionId: ctx.connection.id,
+    providerId: ctx.connection.providerId,
+    connectorId: ctx.connection.connectorId,
+    action: ctx.request.action,
+    actor: { type: ctx.subject.type, id: ctx.subject.id },
+    risk: ctx.action.risk,
+    dataClass: ctx.action.dataClass,
+    reason,
+    requestedAt: requestedAt.toISOString(),
+    inputPreview: previewInput(ctx.request.input)
+  };
+}
+function redactApprovalRequest(request) {
+  return {
+    ...request,
+    inputPreview: redactUnknown2(request.inputPreview)
+  };
+}
+function ruleMatches(rule, ctx) {
+  if (!ctx.action) return false;
+  if (rule.providerId && rule.providerId !== ctx.connection.providerId) return false;
+  if (rule.connectorId && rule.connectorId !== ctx.connection.connectorId) return false;
+  if (rule.action && rule.action !== ctx.request.action) return false;
+  if (rule.risk && rule.risk !== ctx.action.risk) return false;
+  if (rule.maxRisk && riskRank(ctx.action.risk) > riskRank(rule.maxRisk)) return false;
+  if (rule.dataClass && rule.dataClass !== ctx.action.dataClass) return false;
+  return true;
+}
+function riskRank(risk) {
+  if (risk === "read") return 0;
+  if (risk === "write") return 1;
+  return 2;
+}
+function defaultReason(effect, risk) {
+  if (effect === "allow") return `${risk} integration action allowed by default policy.`;
+  if (effect === "deny") return `${risk} integration action denied by default policy.`;
+  return `${risk} integration action requires approval by default policy.`;
+}
+function previewInput(input) {
+  return redactUnknown2(input);
+}
+function redactUnknown2(value) {
+  if (Array.isArray(value)) return value.map(redactUnknown2);
+  if (!value || typeof value !== "object") return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (/token|secret|password|authorization|api[_-]?key|credential/i.test(key)) {
+      out[key] = "[REDACTED]";
+    } else {
+      out[key] = redactUnknown2(child);
+    }
+  }
+  return out;
+}
+
+export {
+  InMemoryIntegrationAuditStore,
+  createIntegrationAuditEvent,
+  createAuditingActionGuard,
+  sanitizeAuditConnection,
+  InMemoryIntegrationIdempotencyStore,
+  DefaultIntegrationActionGuard,
+  createDefaultIntegrationActionGuard,
+  StaticIntegrationPolicyEngine,
+  createDefaultIntegrationPolicyEngine,
+  buildApprovalRequest,
+  redactApprovalRequest
+};
+//# sourceMappingURL=chunk-RSJRICPU.js.map

package/dist/chunk-RSJRICPU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/web-crypto.ts","../src/audit.ts","../src/guard.ts","../src/policy.ts"],"sourcesContent":["const BASE64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'\n\nexport async function sha256Base64Url(value: string): Promise<string> {\n  const crypto = requireWebCrypto()\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value))\n  return bytesToBase64Url(new Uint8Array(digest))\n}\n\nexport function createWebCryptoUuid(): string {\n  const crypto = requireWebCrypto()\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID()\n\n  const bytes = new Uint8Array(16)\n  crypto.getRandomValues(bytes)\n  bytes[6] = (bytes[6]! & 0x0f) | 0x40\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80\n  return [...bytes]\n    .map((byte, index) => {\n      const value = byte.toString(16).padStart(2, '0')\n      return [4, 6, 8, 10].includes(index) ? `-${value}` : value\n    })\n    .join('')\n}\n\nfunction requireWebCrypto(): Crypto {\n  const crypto = globalThis.crypto\n  if (!crypto || !crypto.subtle || typeof crypto.getRandomValues !== 'function') {\n    throw new Error('The Web Crypto API is required for integration security operations.')\n  }\n  return crypto\n}\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n  let encoded = ''\n  for (let index = 0; index < bytes.length; index += 3) {\n    const first = bytes[index]!\n    const second = bytes[index + 1]\n    const third = bytes[index + 2]\n    encoded += BASE64_ALPHABET[first >> 2]\n    encoded += BASE64_ALPHABET[((first & 0x03) << 4) | (second === undefined ? 0 : second >> 4)]\n    encoded += second === undefined\n      ? '='\n      : BASE64_ALPHABET[((second & 0x0f) << 2) | (third === undefined ? 0 : third >> 6)]\n    encoded += third === undefined ? '=' : BASE64_ALPHABET[third & 0x3f]\n  }\n  return encoded.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/g, '')\n}\n","import type {\n  IntegrationActionGuard,\n  IntegrationActionRequest,\n  IntegrationActionResult,\n  IntegrationActor,\n  IntegrationConnection,\n  IntegrationConnectorAction,\n  IntegrationDataClass,\n  IntegrationGuardContext,\n} from './core-types.js'\nimport { createWebCryptoUuid } from './web-crypto.js'\n\nexport type IntegrationAuditEventType =\n  | 'connection.created'\n  | 'connection.updated'\n  | 'connection.revoked'\n  | 'grant.created'\n  | 'grant.revoked'\n  | 'capability.issued'\n  | 'action.invoked'\n  | 'action.failed'\n  | 'trigger.subscribed'\n  | 'trigger.received'\n  | 'workflow.installed'\n  | 'approval.requested'\n  | 'approval.resolved'\n  | 'healthcheck.completed'\n\nexport interface IntegrationAuditEvent {\n  id: string\n  type: IntegrationAuditEventType\n  occurredAt: string\n  actor?: IntegrationActor\n  connectionId?: string\n  providerId?: string\n  connectorId?: string\n  action?: string\n  risk?: IntegrationConnectorAction['risk']\n  dataClass?: IntegrationDataClass\n  ok?: boolean\n  message?: string\n  metadata?: Record<string, unknown>\n}\n\nexport interface IntegrationAuditSink {\n  record(event: IntegrationAuditEvent): Promise<void> | void\n}\n\nexport interface IntegrationAuditStore extends IntegrationAuditSink {\n  list(filter?: IntegrationAuditFilter): Promise<IntegrationAuditEvent[]> | IntegrationAuditEvent[]\n}\n\nexport interface IntegrationAuditFilter {\n  type?: IntegrationAuditEventType\n  actor?: IntegrationActor\n  connectionId?: string\n  providerId?: string\n  connectorId?: string\n  action?: string\n}\n\nexport class InMemoryIntegrationAuditStore implements IntegrationAuditStore {\n  private readonly events: IntegrationAuditEvent[] = []\n\n  record(event: IntegrationAuditEvent): void {\n    this.events.push(event)\n  }\n\n  list(filter: IntegrationAuditFilter = {}): IntegrationAuditEvent[] {\n    return this.events.filter((event) => matchesFilter(event, filter))\n  }\n}\n\nexport function createIntegrationAuditEvent(input: Omit<IntegrationAuditEvent, 'id' | 'occurredAt'> & {\n  id?: string\n  occurredAt?: string | Date\n  now?: () => Date\n}): IntegrationAuditEvent {\n  const occurredAt = input.occurredAt instanceof Date\n    ? input.occurredAt.toISOString()\n    : input.occurredAt ?? (input.now?.() ?? new Date()).toISOString()\n  return {\n    ...input,\n    id: input.id ?? `audit_${createWebCryptoUuid()}`,\n    occurredAt,\n    metadata: input.metadata ? redactUnknown(input.metadata) as Record<string, unknown> : undefined,\n  }\n}\n\nexport function createAuditingActionGuard(options: {\n  sink: IntegrationAuditSink\n  subject?: IntegrationActor\n  now?: () => Date\n  includeInputPreview?: boolean\n}): IntegrationActionGuard {\n  const now = options.now ?? (() => new Date())\n  return {\n    async invokeAction(ctx: IntegrationGuardContext, proceed: () => Promise<IntegrationActionResult>): Promise<IntegrationActionResult> {\n      const startedAt = now()\n      try {\n        const result = await proceed()\n        await options.sink.record(actionEvent({\n          ctx,\n          request: ctx.request,\n          result,\n          type: result.ok ? 'action.invoked' : 'action.failed',\n          subject: options.subject,\n          occurredAt: startedAt,\n          includeInputPreview: options.includeInputPreview,\n        }))\n        return result\n      } catch (error) {\n        await options.sink.record(actionEvent({\n          ctx,\n          request: ctx.request,\n          type: 'action.failed',\n          subject: options.subject,\n          occurredAt: startedAt,\n          includeInputPreview: options.includeInputPreview,\n          message: error instanceof Error ? error.message : 'Integration action failed.',\n        }))\n        throw error\n      }\n    },\n  }\n}\n\nexport function sanitizeAuditConnection(connection: IntegrationConnection): Record<string, unknown> {\n  return {\n    id: connection.id,\n    owner: connection.owner,\n    providerId: connection.providerId,\n    connectorId: connection.connectorId,\n    status: connection.status,\n    grantedScopes: connection.grantedScopes,\n    account: connection.account,\n    hasSecretRef: Boolean(connection.secretRef),\n    createdAt: connection.createdAt,\n    updatedAt: connection.updatedAt,\n    expiresAt: connection.expiresAt,\n    lastUsedAt: connection.lastUsedAt,\n  }\n}\n\nfunction actionEvent(input: {\n  ctx: IntegrationGuardContext\n  request: IntegrationActionRequest\n  result?: IntegrationActionResult\n  type: 'action.invoked' | 'action.failed'\n  subject?: IntegrationActor\n  occurredAt: Date\n  includeInputPreview?: boolean\n  message?: string\n}): IntegrationAuditEvent {\n  return createIntegrationAuditEvent({\n    type: input.type,\n    occurredAt: input.occurredAt,\n    actor: input.subject ?? input.ctx.connection.owner,\n    connectionId: input.ctx.connection.id,\n    providerId: input.ctx.connection.providerId,\n    connectorId: input.ctx.connection.connectorId,\n    action: input.request.action,\n    risk: input.ctx.action?.risk,\n    dataClass: input.ctx.action?.dataClass,\n    ok: input.result?.ok ?? false,\n    message: input.message,\n    metadata: {\n      idempotencyKey: input.request.idempotencyKey,\n      dryRun: input.request.dryRun,\n      externalId: input.result?.externalId,\n      warnings: input.result?.warnings,\n      inputPreview: input.includeInputPreview ? redactUnknown(input.request.input) : undefined,\n    },\n  })\n}\n\nfunction matchesFilter(event: IntegrationAuditEvent, filter: IntegrationAuditFilter): boolean {\n  if (filter.type && event.type !== filter.type) return false\n  if (filter.actor && (!event.actor || event.actor.type !== filter.actor.type || event.actor.id !== filter.actor.id)) return false\n  if (filter.connectionId && event.connectionId !== filter.connectionId) return false\n  if (filter.providerId && event.providerId !== filter.providerId) return false\n  if (filter.connectorId && event.connectorId !== filter.connectorId) return false\n  if (filter.action && event.action !== filter.action) return false\n  return true\n}\n\nfunction redactUnknown(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(redactUnknown)\n  if (!value || typeof value !== 'object') return value\n  const out: Record<string, unknown> = {}\n  for (const [key, child] of Object.entries(value)) {\n    if (/token|secret|password|authorization|api[_-]?key|credential|refresh/i.test(key)) {\n      out[key] = '[REDACTED]'\n    } else {\n      out[key] = redactUnknown(child)\n    }\n  }\n  return out\n}\n","import type {\n  IntegrationActionGuard,\n  IntegrationActionResult,\n  IntegrationGuardContext,\n} from './core-types.js'\nimport type { IntegrationAuditSink } from './audit.js'\nimport { createIntegrationAuditEvent } from './audit.js'\nimport { sha256Base64Url } from './web-crypto.js'\n\nexport interface IntegrationIdempotencyRecord {\n  key: string\n  requestHash: string\n  result: IntegrationActionResult\n  createdAt: string\n}\n\nexport interface IntegrationIdempotencyStore {\n  get(key: string): Promise<IntegrationIdempotencyRecord | undefined> | IntegrationIdempotencyRecord | undefined\n  put(record: IntegrationIdempotencyRecord): Promise<void> | void\n}\n\nexport interface IntegrationRateLimitDecision {\n  allowed: boolean\n  retryAfterMs?: number\n  reason?: string\n}\n\nexport interface IntegrationRateLimiter {\n  check(ctx: IntegrationGuardContext): Promise<IntegrationRateLimitDecision> | IntegrationRateLimitDecision\n}\n\nexport class InMemoryIntegrationIdempotencyStore implements IntegrationIdempotencyStore {\n  private readonly records = new Map<string, IntegrationIdempotencyRecord>()\n\n  get(key: string): IntegrationIdempotencyRecord | undefined {\n    return this.records.get(key)\n  }\n\n  put(record: IntegrationIdempotencyRecord): void {\n    this.records.set(record.key, record)\n  }\n}\n\nexport class DefaultIntegrationActionGuard implements IntegrationActionGuard {\n  private readonly idempotency: IntegrationIdempotencyStore | undefined\n  private readonly audit: IntegrationAuditSink | undefined\n  private readonly rateLimiter: IntegrationRateLimiter | undefined\n  private readonly requireIdempotencyForMutations: boolean\n  private readonly now: () => Date\n\n  constructor(options: {\n    idempotency?: IntegrationIdempotencyStore\n    audit?: IntegrationAuditSink\n    rateLimiter?: IntegrationRateLimiter\n    requireIdempotencyForMutations?: boolean\n    now?: () => Date\n  } = {}) {\n    this.idempotency = options.idempotency\n    this.audit = options.audit\n    this.rateLimiter = options.rateLimiter\n    this.requireIdempotencyForMutations = options.requireIdempotencyForMutations ?? false\n    this.now = options.now ?? (() => new Date())\n  }\n\n  async invokeAction(ctx: IntegrationGuardContext, proceed: () => Promise<IntegrationActionResult>): Promise<IntegrationActionResult> {\n    const idempotencyKey = ctx.request.idempotencyKey\n    if (this.requireIdempotencyForMutations && ctx.action?.risk !== 'read' && !idempotencyKey) {\n      return {\n        ok: false,\n        action: ctx.request.action,\n        output: {\n          idempotencyRequired: true,\n          message: 'State-changing integration actions require an idempotency key.',\n        },\n      }\n    }\n    const requestHash = idempotencyKey && this.idempotency ? await hashRequest(ctx) : undefined\n    if (idempotencyKey && this.idempotency && requestHash) {\n      const existing = await this.idempotency.get(idempotencyKey)\n      if (existing) {\n        if (existing.requestHash !== requestHash) {\n          return {\n            ok: false,\n            action: ctx.request.action,\n            output: { idempotencyConflict: true, message: 'Idempotency key was reused with different integration input.' },\n          }\n        }\n        return {\n          ...existing.result,\n          metadata: { ...(existing.result.metadata ?? {}), idempotentReplay: true },\n        }\n      }\n    }\n\n    if (ctx.request.dryRun && ctx.action?.risk !== 'read') {\n      const result: IntegrationActionResult = {\n        ok: true,\n        action: ctx.request.action,\n        output: { dryRun: true },\n        metadata: { dryRun: true },\n      }\n      await this.writeIdempotency(idempotencyKey, requestHash, result)\n      return result\n    }\n\n    const rateLimit = await this.rateLimiter?.check(ctx)\n    if (rateLimit && !rateLimit.allowed) {\n      return {\n        ok: false,\n        action: ctx.request.action,\n        output: { rateLimited: true, retryAfterMs: rateLimit.retryAfterMs, message: rateLimit.reason ?? 'Integration rate limit exceeded.' },\n      }\n    }\n\n    try {\n      const result = await proceed()\n      if (result.ok) {\n        await this.writeIdempotency(idempotencyKey, requestHash, result)\n      }\n      await this.audit?.record(createIntegrationAuditEvent({\n        type: result.ok ? 'action.invoked' : 'action.failed',\n        actor: ctx.connection.owner,\n        connectionId: ctx.connection.id,\n        providerId: ctx.connection.providerId,\n        connectorId: ctx.connection.connectorId,\n        action: ctx.request.action,\n        risk: ctx.action?.risk,\n        dataClass: ctx.action?.dataClass,\n        ok: result.ok,\n        metadata: { idempotencyKey, externalId: result.externalId, warnings: result.warnings },\n        now: this.now,\n      }))\n      return result\n    } catch (error) {\n      await this.audit?.record(createIntegrationAuditEvent({\n        type: 'action.failed',\n        actor: ctx.connection.owner,\n        connectionId: ctx.connection.id,\n        providerId: ctx.connection.providerId,\n        connectorId: ctx.connection.connectorId,\n        action: ctx.request.action,\n        risk: ctx.action?.risk,\n        dataClass: ctx.action?.dataClass,\n        ok: false,\n        message: error instanceof Error ? error.message : 'Integration action failed.',\n        metadata: { idempotencyKey },\n        now: this.now,\n      }))\n      throw error\n    }\n  }\n\n  private async writeIdempotency(key: string | undefined, requestHash: string | undefined, result: IntegrationActionResult): Promise<void> {\n    if (!key || !this.idempotency || !requestHash) return\n    await this.idempotency.put({\n      key,\n      requestHash,\n      result,\n      createdAt: this.now().toISOString(),\n    })\n  }\n}\n\nexport function createDefaultIntegrationActionGuard(options: ConstructorParameters<typeof DefaultIntegrationActionGuard>[0] = {}): DefaultIntegrationActionGuard {\n  return new DefaultIntegrationActionGuard(options)\n}\n\nasync function hashRequest(ctx: IntegrationGuardContext): Promise<string> {\n  return sha256Base64Url(JSON.stringify({\n    connectionId: ctx.connection.id,\n    action: ctx.request.action,\n    input: ctx.request.input ?? null,\n    dryRun: ctx.request.dryRun ?? false,\n  }))\n}\n","import type {\n  IntegrationActionRisk,\n  IntegrationApprovalRequest,\n  IntegrationDataClass,\n  IntegrationGuardContext,\n  IntegrationPolicyDecision,\n  IntegrationPolicyEngine,\n} from './core-types.js'\nimport { createWebCryptoUuid } from './web-crypto.js'\n\nexport type IntegrationPolicyEffect = 'allow' | 'require_approval' | 'deny'\n\nexport interface IntegrationPolicyRule {\n  id: string\n  effect: IntegrationPolicyEffect\n  reason: string\n  providerId?: string\n  connectorId?: string\n  action?: string\n  maxRisk?: IntegrationActionRisk\n  risk?: IntegrationActionRisk\n  dataClass?: IntegrationDataClass\n}\n\nexport interface StaticIntegrationPolicyOptions {\n  rules?: IntegrationPolicyRule[]\n  defaultReadEffect?: IntegrationPolicyEffect\n  defaultWriteEffect?: IntegrationPolicyEffect\n  defaultDestructiveEffect?: IntegrationPolicyEffect\n  now?: () => Date\n}\n\nexport interface IntegrationApprovalResolution {\n  approvalId: string\n  approved: boolean\n  resolvedBy: string\n  resolvedAt: string\n  reason?: string\n  metadata?: Record<string, unknown>\n}\n\nexport class StaticIntegrationPolicyEngine implements IntegrationPolicyEngine {\n  private readonly rules: IntegrationPolicyRule[]\n  private readonly defaultReadEffect: IntegrationPolicyEffect\n  private readonly defaultWriteEffect: IntegrationPolicyEffect\n  private readonly defaultDestructiveEffect: IntegrationPolicyEffect\n  private readonly now: () => Date\n\n  constructor(options: StaticIntegrationPolicyOptions = {}) {\n    this.rules = options.rules ?? []\n    this.defaultReadEffect = options.defaultReadEffect ?? 'allow'\n    this.defaultWriteEffect = options.defaultWriteEffect ?? 'require_approval'\n    this.defaultDestructiveEffect = options.defaultDestructiveEffect ?? 'deny'\n    this.now = options.now ?? (() => new Date())\n  }\n\n  decide(ctx: IntegrationGuardContext & { subject: { type: string; id: string } }): IntegrationPolicyDecision {\n    const action = ctx.action\n    if (!action) return { decision: 'deny', reason: 'Integration action is missing from connector catalog.' }\n    const matched = this.rules.find((rule) => ruleMatches(rule, ctx))\n    const effect = matched?.effect ?? this.defaultEffect(action.risk)\n    const reason = matched?.reason ?? defaultReason(effect, action.risk)\n    if (effect === 'allow') return { decision: 'allow', reason, metadata: matched ? { ruleId: matched.id } : undefined }\n    if (effect === 'deny') return { decision: 'deny', reason, metadata: matched ? { ruleId: matched.id } : undefined }\n    return {\n      decision: 'require_approval',\n      reason,\n      approval: buildApprovalRequest(ctx, reason, this.now()),\n      metadata: matched ? { ruleId: matched.id } : undefined,\n    }\n  }\n\n  private defaultEffect(risk: IntegrationActionRisk): IntegrationPolicyEffect {\n    if (risk === 'read') return this.defaultReadEffect\n    if (risk === 'write') return this.defaultWriteEffect\n    return this.defaultDestructiveEffect\n  }\n}\n\nexport function createDefaultIntegrationPolicyEngine(options: Omit<StaticIntegrationPolicyOptions, 'rules'> = {}): StaticIntegrationPolicyEngine {\n  return new StaticIntegrationPolicyEngine(options)\n}\n\nexport function buildApprovalRequest(\n  ctx: IntegrationGuardContext & { subject: { type: string; id: string } },\n  reason: string,\n  requestedAt: Date,\n): IntegrationApprovalRequest {\n  if (!ctx.action) {\n    throw new Error('Cannot build approval request without an action descriptor.')\n  }\n  return {\n    id: `approval_${createWebCryptoUuid()}`,\n    connectionId: ctx.connection.id,\n    providerId: ctx.connection.providerId,\n    connectorId: ctx.connection.connectorId,\n    action: ctx.request.action,\n    actor: { type: ctx.subject.type as never, id: ctx.subject.id },\n    risk: ctx.action.risk,\n    dataClass: ctx.action.dataClass,\n    reason,\n    requestedAt: requestedAt.toISOString(),\n    inputPreview: previewInput(ctx.request.input),\n  }\n}\n\nexport function redactApprovalRequest(request: IntegrationApprovalRequest): IntegrationApprovalRequest {\n  return {\n    ...request,\n    inputPreview: redactUnknown(request.inputPreview),\n  }\n}\n\nfunction ruleMatches(rule: IntegrationPolicyRule, ctx: IntegrationGuardContext): boolean {\n  if (!ctx.action) return false\n  if (rule.providerId && rule.providerId !== ctx.connection.providerId) return false\n  if (rule.connectorId && rule.connectorId !== ctx.connection.connectorId) return false\n  if (rule.action && rule.action !== ctx.request.action) return false\n  if (rule.risk && rule.risk !== ctx.action.risk) return false\n  if (rule.maxRisk && riskRank(ctx.action.risk) > riskRank(rule.maxRisk)) return false\n  if (rule.dataClass && rule.dataClass !== ctx.action.dataClass) return false\n  return true\n}\n\nfunction riskRank(risk: IntegrationActionRisk): number {\n  if (risk === 'read') return 0\n  if (risk === 'write') return 1\n  return 2\n}\n\nfunction defaultReason(effect: IntegrationPolicyEffect, risk: IntegrationActionRisk): string {\n  if (effect === 'allow') return `${risk} integration action allowed by default policy.`\n  if (effect === 'deny') return `${risk} integration action denied by default policy.`\n  return `${risk} integration action requires approval by default policy.`\n}\n\nfunction previewInput(input: unknown): unknown {\n  return redactUnknown(input)\n}\n\nfunction redactUnknown(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(redactUnknown)\n  if (!value || typeof value !== 'object') return value\n  const out: Record<string, unknown> = {}\n  for (const [key, child] of Object.entries(value)) {\n    if (/token|secret|password|authorization|api[_-]?key|credential/i.test(key)) {\n      out[key] = '[REDACTED]'\n    } else {\n      out[key] = redactUnknown(child)\n    }\n  }\n  return out\n}\n"],"mappings":";AAAA,IAAM,kBAAkB;AAExB,eAAsB,gBAAgB,OAAgC;AACpE,QAAM,SAAS,iBAAiB;AAChC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACpF,SAAO,iBAAiB,IAAI,WAAW,MAAM,CAAC;AAChD;AAEO,SAAS,sBAA8B;AAC5C,QAAM,SAAS,iBAAiB;AAChC,MAAI,OAAO,OAAO,eAAe,WAAY,QAAO,OAAO,WAAW;AAEtE,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,SAAO,CAAC,GAAG,KAAK,EACb,IAAI,CAAC,MAAM,UAAU;AACpB,UAAM,QAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC/C,WAAO,CAAC,GAAG,GAAG,GAAG,EAAE,EAAE,SAAS,KAAK,IAAI,IAAI,KAAK,KAAK;AAAA,EACvD,CAAC,EACA,KAAK,EAAE;AACZ;AAEA,SAAS,mBAA2B;AAClC,QAAM,SAAS,WAAW;AAC1B,MAAI,CAAC,UAAU,CAAC,OAAO,UAAU,OAAO,OAAO,oBAAoB,YAAY;AAC7E,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,OAA2B;AACnD,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,SAAS,MAAM,QAAQ,CAAC;AAC9B,UAAM,QAAQ,MAAM,QAAQ,CAAC;AAC7B,eAAW,gBAAgB,SAAS,CAAC;AACrC,eAAW,iBAAkB,QAAQ,MAAS,KAAM,WAAW,SAAY,IAAI,UAAU,EAAE;AAC3F,eAAW,WAAW,SAClB,MACA,iBAAkB,SAAS,OAAS,KAAM,UAAU,SAAY,IAAI,SAAS,EAAE;AACnF,eAAW,UAAU,SAAY,MAAM,gBAAgB,QAAQ,EAAI;AAAA,EACrE;AACA,SAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAC3E;;;ACeO,IAAM,gCAAN,MAAqE;AAAA,EACzD,SAAkC,CAAC;AAAA,EAEpD,OAAO,OAAoC;AACzC,SAAK,OAAO,KAAK,KAAK;AAAA,EACxB;AAAA,EAEA,KAAK,SAAiC,CAAC,GAA4B;AACjE,WAAO,KAAK,OAAO,OAAO,CAAC,UAAU,cAAc,OAAO,MAAM,CAAC;AAAA,EACnE;AACF;AAEO,SAAS,4BAA4B,OAIlB;AACxB,QAAM,aAAa,MAAM,sBAAsB,OAC3C,MAAM,WAAW,YAAY,IAC7B,MAAM,eAAe,MAAM,MAAM,KAAK,oBAAI,KAAK,GAAG,YAAY;AAClE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,IAAI,MAAM,MAAM,SAAS,oBAAoB,CAAC;AAAA,IAC9C;AAAA,IACA,UAAU,MAAM,WAAW,cAAc,MAAM,QAAQ,IAA+B;AAAA,EACxF;AACF;AAEO,SAAS,0BAA0B,SAKf;AACzB,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACL,MAAM,aAAa,KAA8B,SAAmF;AAClI,YAAM,YAAY,IAAI;AACtB,UAAI;AACF,cAAM,SAAS,MAAM,QAAQ;AAC7B,cAAM,QAAQ,KAAK,OAAO,YAAY;AAAA,UACpC;AAAA,UACA,SAAS,IAAI;AAAA,UACb;AAAA,UACA,MAAM,OAAO,KAAK,mBAAmB;AAAA,UACrC,SAAS,QAAQ;AAAA,UACjB,YAAY;AAAA,UACZ,qBAAqB,QAAQ;AAAA,QAC/B,CAAC,CAAC;AACF,eAAO;AAAA,MACT,SAAS,OAAO;AACd,cAAM,QAAQ,KAAK,OAAO,YAAY;AAAA,UACpC;AAAA,UACA,SAAS,IAAI;AAAA,UACb,MAAM;AAAA,UACN,SAAS,QAAQ;AAAA,UACjB,YAAY;AAAA,UACZ,qBAAqB,QAAQ;AAAA,UAC7B,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QACpD,CAAC,CAAC;AACF,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wBAAwB,YAA4D;AAClG,SAAO;AAAA,IACL,IAAI,WAAW;AAAA,IACf,OAAO,WAAW;AAAA,IAClB,YAAY,WAAW;AAAA,IACvB,aAAa,WAAW;AAAA,IACxB,QAAQ,WAAW;AAAA,IACnB,eAAe,WAAW;AAAA,IAC1B,SAAS,WAAW;AAAA,IACpB,cAAc,QAAQ,WAAW,SAAS;AAAA,IAC1C,WAAW,WAAW;AAAA,IACtB,WAAW,WAAW;AAAA,IACtB,WAAW,WAAW;AAAA,IACtB,YAAY,WAAW;AAAA,EACzB;AACF;AAEA,SAAS,YAAY,OASK;AACxB,SAAO,4BAA4B;AAAA,IACjC,MAAM,MAAM;AAAA,IACZ,YAAY,MAAM;AAAA,IAClB,OAAO,MAAM,WAAW,MAAM,IAAI,WAAW;AAAA,IAC7C,cAAc,MAAM,IAAI,WAAW;AAAA,IACnC,YAAY,MAAM,IAAI,WAAW;AAAA,IACjC,aAAa,MAAM,IAAI,WAAW;AAAA,IAClC,QAAQ,MAAM,QAAQ;AAAA,IACtB,MAAM,MAAM,IAAI,QAAQ;AAAA,IACxB,WAAW,MAAM,IAAI,QAAQ;AAAA,IAC7B,IAAI,MAAM,QAAQ,MAAM;AAAA,IACxB,SAAS,MAAM;AAAA,IACf,UAAU;AAAA,MACR,gBAAgB,MAAM,QAAQ;AAAA,MAC9B,QAAQ,MAAM,QAAQ;AAAA,MACtB,YAAY,MAAM,QAAQ;AAAA,MAC1B,UAAU,MAAM,QAAQ;AAAA,MACxB,cAAc,MAAM,sBAAsB,cAAc,MAAM,QAAQ,KAAK,IAAI;AAAA,IACjF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,cAAc,OAA8B,QAAyC;AAC5F,MAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,KAAM,QAAO;AACtD,MAAI,OAAO,UAAU,CAAC,MAAM,SAAS,MAAM,MAAM,SAAS,OAAO,MAAM,QAAQ,MAAM,MAAM,OAAO,OAAO,MAAM,IAAK,QAAO;AAC3H,MAAI,OAAO,gBAAgB,MAAM,iBAAiB,OAAO,aAAc,QAAO;AAC9E,MAAI,OAAO,cAAc,MAAM,eAAe,OAAO,WAAY,QAAO;AACxE,MAAI,OAAO,eAAe,MAAM,gBAAgB,OAAO,YAAa,QAAO;AAC3E,MAAI,OAAO,UAAU,MAAM,WAAW,OAAO,OAAQ,QAAO;AAC5D,SAAO;AACT;AAEA,SAAS,cAAc,OAAyB;AAC9C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,aAAa;AACxD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,sEAAsE,KAAK,GAAG,GAAG;AACnF,UAAI,GAAG,IAAI;AAAA,IACb,OAAO;AACL,UAAI,GAAG,IAAI,cAAc,KAAK;AAAA,IAChC;AAAA,EACF;AACA,SAAO;AACT;;;ACvKO,IAAM,sCAAN,MAAiF;AAAA,EACrE,UAAU,oBAAI,IAA0C;AAAA,EAEzE,IAAI,KAAuD;AACzD,WAAO,KAAK,QAAQ,IAAI,GAAG;AAAA,EAC7B;AAAA,EAEA,IAAI,QAA4C;AAC9C,SAAK,QAAQ,IAAI,OAAO,KAAK,MAAM;AAAA,EACrC;AACF;AAEO,IAAM,gCAAN,MAAsE;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,UAMR,CAAC,GAAG;AACN,SAAK,cAAc,QAAQ;AAC3B,SAAK,QAAQ,QAAQ;AACrB,SAAK,cAAc,QAAQ;AAC3B,SAAK,iCAAiC,QAAQ,kCAAkC;AAChF,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,KAA8B,SAAmF;AAClI,UAAM,iBAAiB,IAAI,QAAQ;AACnC,QAAI,KAAK,kCAAkC,IAAI,QAAQ,SAAS,UAAU,CAAC,gBAAgB;AACzF,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,IAAI,QAAQ;AAAA,QACpB,QAAQ;AAAA,UACN,qBAAqB;AAAA,UACrB,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AACA,UAAM,cAAc,kBAAkB,KAAK,cAAc,MAAM,YAAY,GAAG,IAAI;AAClF,QAAI,kBAAkB,KAAK,eAAe,aAAa;AACrD,YAAM,WAAW,MAAM,KAAK,YAAY,IAAI,cAAc;AAC1D,UAAI,UAAU;AACZ,YAAI,SAAS,gBAAgB,aAAa;AACxC,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,QAAQ,IAAI,QAAQ;AAAA,YACpB,QAAQ,EAAE,qBAAqB,MAAM,SAAS,+DAA+D;AAAA,UAC/G;AAAA,QACF;AACA,eAAO;AAAA,UACL,GAAG,SAAS;AAAA,UACZ,UAAU,EAAE,GAAI,SAAS,OAAO,YAAY,CAAC,GAAI,kBAAkB,KAAK;AAAA,QAC1E;AAAA,MACF;AAAA,IACF;AAEA,QAAI,IAAI,QAAQ,UAAU,IAAI,QAAQ,SAAS,QAAQ;AACrD,YAAM,SAAkC;AAAA,QACtC,IAAI;AAAA,QACJ,QAAQ,IAAI,QAAQ;AAAA,QACpB,QAAQ,EAAE,QAAQ,KAAK;AAAA,QACvB,UAAU,EAAE,QAAQ,KAAK;AAAA,MAC3B;AACA,YAAM,KAAK,iBAAiB,gBAAgB,aAAa,MAAM;AAC/D,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,MAAM,KAAK,aAAa,MAAM,GAAG;AACnD,QAAI,aAAa,CAAC,UAAU,SAAS;AACnC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,IAAI,QAAQ;AAAA,QACpB,QAAQ,EAAE,aAAa,MAAM,cAAc,UAAU,cAAc,SAAS,UAAU,UAAU,mCAAmC;AAAA,MACrI;AAAA,IACF;AAEA,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ;AAC7B,UAAI,OAAO,IAAI;AACb,cAAM,KAAK,iBAAiB,gBAAgB,aAAa,MAAM;AAAA,MACjE;AACA,YAAM,KAAK,OAAO,OAAO,4BAA4B;AAAA,QACnD,MAAM,OAAO,KAAK,mBAAmB;AAAA,QACrC,OAAO,IAAI,WAAW;AAAA,QACtB,cAAc,IAAI,WAAW;AAAA,QAC7B,YAAY,IAAI,WAAW;AAAA,QAC3B,aAAa,IAAI,WAAW;AAAA,QAC5B,QAAQ,IAAI,QAAQ;AAAA,QACpB,MAAM,IAAI,QAAQ;AAAA,QAClB,WAAW,IAAI,QAAQ;AAAA,QACvB,IAAI,OAAO;AAAA,QACX,UAAU,EAAE,gBAAgB,YAAY,OAAO,YAAY,UAAU,OAAO,SAAS;AAAA,QACrF,KAAK,KAAK;AAAA,MACZ,CAAC,CAAC;AACF,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,KAAK,OAAO,OAAO,4BAA4B;AAAA,QACnD,MAAM;AAAA,QACN,OAAO,IAAI,WAAW;AAAA,QACtB,cAAc,IAAI,WAAW;AAAA,QAC7B,YAAY,IAAI,WAAW;AAAA,QAC3B,aAAa,IAAI,WAAW;AAAA,QAC5B,QAAQ,IAAI,QAAQ;AAAA,QACpB,MAAM,IAAI,QAAQ;AAAA,QAClB,WAAW,IAAI,QAAQ;AAAA,QACvB,IAAI;AAAA,QACJ,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QAClD,UAAU,EAAE,eAAe;AAAA,QAC3B,KAAK,KAAK;AAAA,MACZ,CAAC,CAAC;AACF,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,iBAAiB,KAAyB,aAAiC,QAAgD;AACvI,QAAI,CAAC,OAAO,CAAC,KAAK,eAAe,CAAC,YAAa;AAC/C,UAAM,KAAK,YAAY,IAAI;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI,EAAE,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AACF;AAEO,SAAS,oCAAoC,UAA0E,CAAC,GAAkC;AAC/J,SAAO,IAAI,8BAA8B,OAAO;AAClD;AAEA,eAAe,YAAY,KAA+C;AACxE,SAAO,gBAAgB,KAAK,UAAU;AAAA,IACpC,cAAc,IAAI,WAAW;AAAA,IAC7B,QAAQ,IAAI,QAAQ;AAAA,IACpB,OAAO,IAAI,QAAQ,SAAS;AAAA,IAC5B,QAAQ,IAAI,QAAQ,UAAU;AAAA,EAChC,CAAC,CAAC;AACJ;;;ACrIO,IAAM,gCAAN,MAAuE;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,UAA0C,CAAC,GAAG;AACxD,SAAK,QAAQ,QAAQ,SAAS,CAAC;AAC/B,SAAK,oBAAoB,QAAQ,qBAAqB;AACtD,SAAK,qBAAqB,QAAQ,sBAAsB;AACxD,SAAK,2BAA2B,QAAQ,4BAA4B;AACpE,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAAA,EAC5C;AAAA,EAEA,OAAO,KAAqG;AAC1G,UAAM,SAAS,IAAI;AACnB,QAAI,CAAC,OAAQ,QAAO,EAAE,UAAU,QAAQ,QAAQ,wDAAwD;AACxG,UAAM,UAAU,KAAK,MAAM,KAAK,CAAC,SAAS,YAAY,MAAM,GAAG,CAAC;AAChE,UAAM,SAAS,SAAS,UAAU,KAAK,cAAc,OAAO,IAAI;AAChE,UAAM,SAAS,SAAS,UAAU,cAAc,QAAQ,OAAO,IAAI;AACnE,QAAI,WAAW,QAAS,QAAO,EAAE,UAAU,SAAS,QAAQ,UAAU,UAAU,EAAE,QAAQ,QAAQ,GAAG,IAAI,OAAU;AACnH,QAAI,WAAW,OAAQ,QAAO,EAAE,UAAU,QAAQ,QAAQ,UAAU,UAAU,EAAE,QAAQ,QAAQ,GAAG,IAAI,OAAU;AACjH,WAAO;AAAA,MACL,UAAU;AAAA,MACV;AAAA,MACA,UAAU,qBAAqB,KAAK,QAAQ,KAAK,IAAI,CAAC;AAAA,MACtD,UAAU,UAAU,EAAE,QAAQ,QAAQ,GAAG,IAAI;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,cAAc,MAAsD;AAC1E,QAAI,SAAS,OAAQ,QAAO,KAAK;AACjC,QAAI,SAAS,QAAS,QAAO,KAAK;AAClC,WAAO,KAAK;AAAA,EACd;AACF;AAEO,SAAS,qCAAqC,UAAyD,CAAC,GAAkC;AAC/I,SAAO,IAAI,8BAA8B,OAAO;AAClD;AAEO,SAAS,qBACd,KACA,QACA,aAC4B;AAC5B,MAAI,CAAC,IAAI,QAAQ;AACf,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,SAAO;AAAA,IACL,IAAI,YAAY,oBAAoB,CAAC;AAAA,IACrC,cAAc,IAAI,WAAW;AAAA,IAC7B,YAAY,IAAI,WAAW;AAAA,IAC3B,aAAa,IAAI,WAAW;AAAA,IAC5B,QAAQ,IAAI,QAAQ;AAAA,IACpB,OAAO,EAAE,MAAM,IAAI,QAAQ,MAAe,IAAI,IAAI,QAAQ,GAAG;AAAA,IAC7D,MAAM,IAAI,OAAO;AAAA,IACjB,WAAW,IAAI,OAAO;AAAA,IACtB;AAAA,IACA,aAAa,YAAY,YAAY;AAAA,IACrC,cAAc,aAAa,IAAI,QAAQ,KAAK;AAAA,EAC9C;AACF;AAEO,SAAS,sBAAsB,SAAiE;AACrG,SAAO;AAAA,IACL,GAAG;AAAA,IACH,cAAcA,eAAc,QAAQ,YAAY;AAAA,EAClD;AACF;AAEA,SAAS,YAAY,MAA6B,KAAuC;AACvF,MAAI,CAAC,IAAI,OAAQ,QAAO;AACxB,MAAI,KAAK,cAAc,KAAK,eAAe,IAAI,WAAW,WAAY,QAAO;AAC7E,MAAI,KAAK,eAAe,KAAK,gBAAgB,IAAI,WAAW,YAAa,QAAO;AAChF,MAAI,KAAK,UAAU,KAAK,WAAW,IAAI,QAAQ,OAAQ,QAAO;AAC9D,MAAI,KAAK,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAM,QAAO;AACvD,MAAI,KAAK,WAAW,SAAS,IAAI,OAAO,IAAI,IAAI,SAAS,KAAK,OAAO,EAAG,QAAO;AAC/E,MAAI,KAAK,aAAa,KAAK,cAAc,IAAI,OAAO,UAAW,QAAO;AACtE,SAAO;AACT;AAEA,SAAS,SAAS,MAAqC;AACrD,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,QAAS,QAAO;AAC7B,SAAO;AACT;AAEA,SAAS,cAAc,QAAiC,MAAqC;AAC3F,MAAI,WAAW,QAAS,QAAO,GAAG,IAAI;AACtC,MAAI,WAAW,OAAQ,QAAO,GAAG,IAAI;AACrC,SAAO,GAAG,IAAI;AAChB;AAEA,SAAS,aAAa,OAAyB;AAC7C,SAAOA,eAAc,KAAK;AAC5B;AAEA,SAASA,eAAc,OAAyB;AAC9C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAIA,cAAa;AACxD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,8DAA8D,KAAK,GAAG,GAAG;AAC3E,UAAI,GAAG,IAAI;AAAA,IACb,OAAO;AACL,UAAI,GAAG,IAAIA,eAAc,KAAK;AAAA,IAChC;AAAA,EACF;AACA,SAAO;AACT;","names":["redactUnknown"]}