@undefineds.co/xpod 0.3.57 → 0.3.61

package/dist/api/ai-gateway/AiGatewayService.js

@@ -0,0 +1,527 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiGatewayService = void 0;
+const node_crypto_1 = require("node:crypto");
+const errors_1 = require("./errors");
+const AuthContext_1 = require("../auth/AuthContext");
+const protocol_1 = require("./protocol");
+const ProviderRegistry_1 = require("./providers/ProviderRegistry");
+class AiGatewayService {
+    constructor(options) {
+        this.frontends = new Map();
+        this.deployment = options.deployment;
+        this.registry = options.registry;
+        this.router = options.router;
+        this.credentials = options.credentials;
+        this.vault = options.vault;
+        this.runtimes = options.runtimes;
+        this.now = options.now ?? (() => new Date());
+        for (const frontend of options.frontends ?? [
+            new protocol_1.ResponsesFrontend(),
+            new protocol_1.MessagesFrontend(),
+            new protocol_1.ChatCompletionsFrontend(),
+        ]) {
+            this.frontends.set(frontend.protocol, frontend);
+        }
+    }
+    frontend(protocol) {
+        const frontend = this.frontends.get(protocol);
+        if (!frontend) {
+            throw new errors_1.GatewayProtocolError('Unsupported gateway protocol', {
+                code: 'invalid_request',
+                status: 400,
+                details: { protocol },
+            });
+        }
+        return frontend;
+    }
+    async execute(input) {
+        this.requireScope(input.auth, 'inference:write');
+        const principal = this.requirePrincipal(input.auth);
+        const frontend = this.frontend(input.protocol);
+        const request = frontend.parseRequest(input.body);
+        validateGatewayRequest(request, input.protocol);
+        const route = await this.router.route({
+            webId: principal.webId,
+            deployment: this.deployment,
+            auth: input.auth,
+            model: request.model,
+            conversationId: conversationIdFor(request),
+            explicitCredentialId: explicitCredentialIdFor(request),
+        });
+        request.model = route.model;
+        const events = this.executeWithCredentialFailover({
+            principal,
+            request,
+            route,
+            signal: input.signal,
+        });
+        return {
+            protocol: input.protocol,
+            frontend,
+            request,
+            route,
+            events,
+        };
+    }
+    async complete(input) {
+        const execution = await this.execute(input);
+        const events = [];
+        for await (const event of execution.events) {
+            events.push(event);
+        }
+        return aggregateEvents(execution.protocol, execution.request.model, events, this.now());
+    }
+    async listModels(auth) {
+        this.requireScope(auth, 'models:read');
+        const principal = this.requirePrincipal(auth);
+        const credentials = await this.credentials.listCredentials({
+            webId: principal.webId,
+            deployment: this.deployment,
+            auth,
+        });
+        const activeCredentialModels = new Map();
+        for (const credential of credentials) {
+            if (!isCredentialModelVisible(credential, this.now())) {
+                continue;
+            }
+            const providerId = (0, ProviderRegistry_1.normalizeProviderId)(credential.provider);
+            const allowedModels = credential.models ?? [];
+            if (allowedModels.length === 0) {
+                activeCredentialModels.set(providerId, undefined);
+                continue;
+            }
+            const existing = activeCredentialModels.get(providerId);
+            if (existing === undefined && activeCredentialModels.has(providerId)) {
+                continue;
+            }
+            const models = existing ?? new Set();
+            for (const model of allowedModels) {
+                models.add(model);
+            }
+            activeCredentialModels.set(providerId, models);
+        }
+        const seen = new Set();
+        const models = [];
+        for (const provider of this.registry.listProviders()) {
+            const providerId = (0, ProviderRegistry_1.normalizeProviderId)(provider.id);
+            if (!activeCredentialModels.has(providerId)) {
+                continue;
+            }
+            const allowedModels = activeCredentialModels.get(providerId);
+            const providerModelItems = provider.models
+                .filter((model) => allowedModels === undefined || allowedModels.has(model.id))
+                .map((model) => ({
+                id: model.id,
+                object: 'model',
+                owned_by: provider.id,
+                ...(model.contextWindow !== undefined ? { context_window: model.contextWindow } : {}),
+                ...(model.capabilities ? { capabilities: model.capabilities } : {}),
+                ...(model.protocols ? { protocols: model.protocols } : {}),
+            }));
+            const registryModelIds = new Set(provider.models.map((model) => model.id));
+            const credentialOnlyModelItems = allowedModels === undefined
+                ? []
+                : Array.from(allowedModels)
+                    .filter((model) => !registryModelIds.has(model))
+                    .map((model) => ({
+                    id: model,
+                    object: 'model',
+                    owned_by: provider.id,
+                }));
+            for (const model of [...providerModelItems, ...credentialOnlyModelItems]) {
+                if (seen.has(model.id)) {
+                    continue;
+                }
+                seen.add(model.id);
+                models.push(model);
+            }
+        }
+        return models;
+    }
+    async acceptanceProvenance(input) {
+        this.requireScope(input.auth, 'acceptance:read');
+        const principal = this.requirePrincipal(input.auth);
+        if (input.auth.type !== 'solid' || input.auth.viaGatewayApiKey !== true || !input.auth.gatewayKeyFingerprint) {
+            throw new errors_1.GatewayProtocolError('Acceptance provenance requires a Gateway API key principal', {
+                code: 'invalid_request',
+                status: 403,
+            });
+        }
+        let route;
+        try {
+            route = await this.router.route({
+                webId: principal.webId,
+                deployment: this.deployment,
+                auth: input.auth,
+                model: input.model,
+            });
+        }
+        catch (error) {
+            if (error instanceof errors_1.GatewayProtocolError && error.code === 'credential_unavailable') {
+                throw new errors_1.GatewayProtocolError('Acceptance provenance credential route was not resolved', {
+                    code: 'credential_unavailable',
+                    status: 404,
+                    details: error.details,
+                });
+            }
+            throw error;
+        }
+        if (route.model !== requestedRouteModel(input.model)) {
+            throw new errors_1.GatewayProtocolError('Acceptance provenance credential route was not resolved', {
+                code: 'credential_unavailable',
+                status: 404,
+                details: { model: input.model },
+            });
+        }
+        const credential = route.credential;
+        return {
+            webId: principal.webId,
+            gatewayKeyId: input.auth.type === 'solid' ? input.auth.gatewayKeyId ?? 'unknown' : 'unknown',
+            gatewayKeyFingerprint: input.auth.gatewayKeyFingerprint,
+            credentialIriHash: hashProvenanceValue(credential.credentialIri),
+            secretCellRefHash: hashProvenanceValue(credential.encryptedSecret.credentialIri),
+            providerId: route.provider.id,
+            providerRouteSource: 'pod-credential',
+            xpodBaseUrl: input.xpodBaseUrl,
+            generatedAt: this.now().toISOString(),
+        };
+    }
+    async *executeWithCredentialFailover(input) {
+        let route = input.route;
+        let firstClientEventEmitted = false;
+        const attempted = new Set();
+        for (;;) {
+            attempted.add(route.credential.id);
+            const credential = route.credential;
+            try {
+                const apiKey = await this.openApiKey(input.principal, route, credential);
+                const adapter = this.runtimes.get(route.provider.id);
+                const upstream = adapter.execute({
+                    request: input.request,
+                    apiKey,
+                    credential: credential.runtimeCredential ?? runtimeCredentialFromMetadata(credential.metadata),
+                    signal: input.signal,
+                });
+                for await (const event of upstream) {
+                    if (!firstClientEventEmitted) {
+                        firstClientEventEmitted = true;
+                        this.router.markClientEventEmitted(route);
+                    }
+                    yield event;
+                }
+                await this.credentials.recordSuccess?.(healthRecord(input.principal.webId, this.deployment, route));
+                return;
+            }
+            catch (error) {
+                await this.recordRouteFailure(input.principal.webId, route, error);
+                if (!firstClientEventEmitted && this.router.canFailOver(route)) {
+                    const nextRoute = await this.findFailoverRoute(input.principal.webId, input.request, route, attempted);
+                    if (nextRoute) {
+                        route = nextRoute;
+                        continue;
+                    }
+                }
+                throw error;
+            }
+        }
+    }
+    async findFailoverRoute(webId, request, failedRoute, attempted) {
+        try {
+            return await this.router.route({
+                webId,
+                deployment: this.deployment,
+                model: `${failedRoute.provider.id}/${failedRoute.model}`,
+                conversationId: conversationIdFor(request),
+            }, attempted);
+        }
+        catch (error) {
+            if (error instanceof errors_1.GatewayProtocolError && error.code === 'credential_unavailable') {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    async openApiKey(principal, route, credential) {
+        const secret = await this.vault.open(principal, credential.credentialIri, route.provider.id, credential.encryptedSecret);
+        if (this.vault.needsRewrap?.(credential.encryptedSecret) && this.credentials.rewrapCredential) {
+            const rewrapped = await this.vault.rewrap(principal, credential.encryptedSecret);
+            await this.credentials.rewrapCredential({
+                webId: principal.webId,
+                deployment: this.deployment,
+                credentialId: credential.id,
+                expectedVersion: credential.version,
+                encryptedSecret: rewrapped,
+            });
+        }
+        const apiKey = secret.apiKey ?? secret.accessToken ?? secret.token;
+        if (typeof apiKey !== 'string' || !apiKey) {
+            throw new errors_1.GatewayProtocolError('Credential secret does not contain a usable provider token', {
+                code: 'credential_unavailable',
+                status: 403,
+                details: { provider: route.provider.id, credentialId: credential.id },
+            });
+        }
+        return apiKey;
+    }
+    async recordRouteFailure(webId, route, error) {
+        const status = typeof error?.status === 'number'
+            ? error.status
+            : error instanceof errors_1.GatewayProtocolError
+                ? error.status
+                : undefined;
+        if (status === 429) {
+            await this.router.recordCooldown({
+                webId,
+                deployment: this.deployment,
+                credentialId: route.credential.id,
+                until: new Date(this.now().getTime() + 60_000),
+            });
+        }
+        const normalized = (0, errors_1.normalizeGatewayError)(error);
+        await this.credentials.recordFailure?.({
+            ...healthRecord(webId, this.deployment, route),
+            status,
+            errorCode: normalized.error.code,
+        });
+    }
+    requirePrincipal(auth) {
+        const webId = (0, AuthContext_1.getWebId)(auth);
+        if (!webId) {
+            throw new errors_1.GatewayProtocolError('Gateway requests require a Solid WebID principal', {
+                code: 'invalid_request',
+                status: 401,
+            });
+        }
+        return { webId };
+    }
+    requireScope(auth, scope) {
+        if (!(0, AuthContext_1.hasGatewayScope)(auth, scope)) {
+            throw new errors_1.GatewayProtocolError(`Missing required scope: ${scope}`, {
+                code: 'invalid_request',
+                status: 403,
+                details: { scope },
+            });
+        }
+    }
+}
+exports.AiGatewayService = AiGatewayService;
+function hashProvenanceValue(value) {
+    return `sha256:${(0, node_crypto_1.createHash)('sha256').update(value).digest('hex')}`;
+}
+function requestedRouteModel(model) {
+    const slash = model.indexOf('/');
+    return slash > 0 && slash < model.length - 1 ? model.slice(slash + 1) : model;
+}
+function isCredentialModelVisible(credential, now) {
+    return credential.enabled
+        && (!credential.health || credential.health === 'healthy')
+        && credential.quota?.status !== 'exhausted'
+        && (!credential.cooldownUntil || credential.cooldownUntil.getTime() <= now.getTime());
+}
+function validateGatewayRequest(request, protocol) {
+    if (!request.model) {
+        throw new errors_1.GatewayProtocolError('model is required', {
+            code: 'invalid_request',
+            status: 400,
+            details: { protocol, field: 'model' },
+        });
+    }
+    if (request.messages.length === 0) {
+        throw new errors_1.GatewayProtocolError('messages or input are required', {
+            code: 'invalid_request',
+            status: 400,
+            details: { protocol, field: protocol === 'responses' ? 'input' : 'messages' },
+        });
+    }
+}
+function conversationIdFor(request) {
+    const extensions = request.protocolExtensions.responses ?? request.protocolExtensions.chatCompletions ?? request.protocolExtensions.anthropic;
+    return request.previousResponseId
+        ?? stringExtension(extensions, 'conversation')
+        ?? stringExtension(extensions, 'conversation_id')
+        ?? stringExtension(extensions, 'thread_id');
+}
+function explicitCredentialIdFor(request) {
+    const extensions = request.protocolExtensions.responses ?? request.protocolExtensions.chatCompletions ?? request.protocolExtensions.anthropic;
+    return stringExtension(extensions, 'credential')
+        ?? stringExtension(extensions, 'credential_id')
+        ?? stringExtension(extensions, 'xpod_credential_id');
+}
+function stringExtension(extensions, key) {
+    const value = extensions?.[key];
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+function runtimeCredentialFromMetadata(metadata) {
+    const runtime = metadata?.runtimeCredential;
+    return runtime && typeof runtime === 'object' && !Array.isArray(runtime)
+        ? runtime
+        : undefined;
+}
+function healthRecord(webId, deployment, route) {
+    return {
+        webId,
+        deployment,
+        provider: route.provider.id,
+        credentialId: route.credential.id,
+        credentialIri: route.credential.credentialIri,
+    };
+}
+function aggregateEvents(protocol, model, events, now) {
+    const state = collectEventState(events);
+    if (protocol === 'responses') {
+        return {
+            id: state.id ?? `resp_${now.getTime()}`,
+            object: 'response',
+            created_at: Math.floor(now.getTime() / 1000),
+            status: 'completed',
+            model,
+            output: [
+                ...(state.reasoning ? [{
+                        type: 'reasoning',
+                        summary: [{ type: 'summary_text', text: state.reasoning }],
+                        ...(state.reasoningSignatures[0] ? { encrypted_content: state.reasoningSignatures[0].signature } : {}),
+                    }] : []),
+                {
+                    type: 'message',
+                    role: 'assistant',
+                    content: state.text ? [{ type: 'output_text', text: state.text }] : [],
+                },
+                ...state.tools.map((tool) => ({
+                    type: 'function_call',
+                    call_id: tool.id,
+                    name: tool.name,
+                    arguments: tool.arguments,
+                })),
+            ],
+            usage: openAiUsage(state.usage),
+        };
+    }
+    if (protocol === 'anthropic') {
+        return {
+            id: state.id ?? `msg_${now.getTime()}`,
+            type: 'message',
+            role: 'assistant',
+            model,
+            content: [
+                ...(state.reasoning ? [{
+                        type: 'thinking',
+                        thinking: state.reasoning,
+                        ...(state.reasoningSignatures[0] ? { signature: state.reasoningSignatures[0].signature } : {}),
+                    }] : []),
+                ...(state.text ? [{ type: 'text', text: state.text }] : []),
+                ...state.tools.map((tool) => ({
+                    type: 'tool_use',
+                    id: tool.id,
+                    name: tool.name,
+                    input: parseJsonOrString(tool.arguments),
+                })),
+            ],
+            stop_reason: state.finishReason ?? 'end_turn',
+            usage: anthropicUsage(state.usage),
+        };
+    }
+    return {
+        id: state.id ?? `chatcmpl_${now.getTime()}`,
+        object: 'chat.completion',
+        created: Math.floor(now.getTime() / 1000),
+        model,
+        choices: [{
+                index: 0,
+                message: {
+                    role: 'assistant',
+                    content: state.text || null,
+                    ...(state.reasoning ? { reasoning_content: state.reasoning } : {}),
+                    ...(state.reasoningSignatures[0] ? { reasoning_signature: state.reasoningSignatures[0].signature } : {}),
+                    ...(state.tools.length > 0 ? {
+                        tool_calls: state.tools.map((tool) => ({
+                            id: tool.id,
+                            type: 'function',
+                            function: {
+                                name: tool.name,
+                                arguments: tool.arguments,
+                            },
+                        })),
+                    } : {}),
+                },
+                finish_reason: state.finishReason ?? 'stop',
+            }],
+        usage: chatUsage(state.usage),
+    };
+}
+function collectEventState(events) {
+    const tools = new Map();
+    let id;
+    let text = '';
+    let reasoning = '';
+    const reasoningSignatures = [];
+    let usage;
+    let finishReason;
+    for (const event of events) {
+        if (event.type === 'response.started') {
+            id = event.id;
+        }
+        else if (event.type === 'text.delta') {
+            text += event.text;
+        }
+        else if (event.type === 'reasoning.delta') {
+            reasoning += event.text;
+        }
+        else if (event.type === 'reasoning.signature') {
+            reasoningSignatures.push({ provider: event.provider, signature: event.signature });
+        }
+        else if (event.type === 'tool.started') {
+            tools.set(event.callId, { id: event.callId, name: event.name, arguments: '' });
+        }
+        else if (event.type === 'tool.arguments.delta') {
+            const tool = tools.get(event.callId);
+            if (tool) {
+                tool.arguments += event.delta;
+            }
+        }
+        else if (event.type === 'usage') {
+            usage = event.usage;
+        }
+        else if (event.type === 'response.completed') {
+            finishReason = event.finishReason;
+        }
+    }
+    return {
+        id,
+        text,
+        usage,
+        finishReason,
+        tools: Array.from(tools.values()),
+        reasoning,
+        reasoningSignatures,
+    };
+}
+function chatUsage(usage) {
+    return {
+        prompt_tokens: usage?.inputTokens ?? 0,
+        completion_tokens: usage?.outputTokens ?? 0,
+        total_tokens: usage?.totalTokens ?? ((usage?.inputTokens ?? 0) + (usage?.outputTokens ?? 0)),
+    };
+}
+function openAiUsage(usage) {
+    return {
+        input_tokens: usage?.inputTokens ?? 0,
+        output_tokens: usage?.outputTokens ?? 0,
+        total_tokens: usage?.totalTokens ?? ((usage?.inputTokens ?? 0) + (usage?.outputTokens ?? 0)),
+    };
+}
+function anthropicUsage(usage) {
+    return {
+        input_tokens: usage?.inputTokens ?? 0,
+        output_tokens: usage?.outputTokens ?? 0,
+    };
+}
+function parseJsonOrString(value) {
+    try {
+        return JSON.parse(value || '{}');
+    }
+    catch {
+        return value;
+    }
+}
+//# sourceMappingURL=AiGatewayService.js.map

package/dist/api/ai-gateway/AiGatewayService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AiGatewayService.js","sourceRoot":"","sources":["../../../src/api/ai-gateway/AiGatewayService.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,qCAAuE;AAEvE,qDAAgE;AAGhE,yCAA0F;AAG1F,mEAAmE;AA2FnE,MAAa,gBAAgB;IAU3B,YAAmB,OAAgC;QAHlC,cAAS,GAAG,IAAI,GAAG,EAA4C,CAAC;QAI/E,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAI;YAC1C,IAAI,4BAAiB,EAAE;YACvB,IAAI,2BAAgB,EAAE;YACtB,IAAI,kCAAuB,EAAE;SAC9B,EAAE,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEM,QAAQ,CAAC,QAAyB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,6BAAoB,CAAC,8BAA8B,EAAE;gBAC7D,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,KAA4B;QAC/C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACpC,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc,EAAE,iBAAiB,CAAC,OAAO,CAAC;YAC1C,oBAAoB,EAAE,uBAAuB,CAAC,OAAO,CAAC;SACvD,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,6BAA6B,CAAC;YAChD,SAAS;YACT,OAAO;YACP,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;YACR,OAAO;YACP,KAAK;YACL,MAAM;SACP,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAA4B;QAChD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,IAAiB;QACvC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC;YACzD,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI;SACL,CAAC,CAAC;QACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAmC,CAAC;QAC1E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBACtD,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,IAAA,sCAAmB,EAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;YAC9C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;gBAClD,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxD,IAAI,QAAQ,KAAK,SAAS,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;YACrD,MAAM,UAAU,GAAG,IAAA,sCAAmB,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,MAAM,aAAa,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM;iBACvC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;iBAC7E,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACf,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,MAAM,EAAE,OAAgB;gBACxB,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACrB,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAC,CAAC;YACN,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3E,MAAM,wBAAwB,GAAG,aAAa,KAAK,SAAS;gBAC1D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;qBACxB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;qBAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACf,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,OAAgB;oBACxB,QAAQ,EAAE,QAAQ,CAAC,EAAE;iBACtB,CAAC,CAAC,CAAC;YACR,KAAK,MAAM,KAAK,IAAI,CAAE,GAAG,kBAAkB,EAAE,GAAG,wBAAwB,CAAE,EAAE,CAAC;gBAC3E,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBACvB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,KAIjC;QACC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7G,MAAM,IAAI,6BAAoB,CAAC,4DAA4D,EAAE;gBAC3F,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC9B,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBACrF,MAAM,IAAI,6BAAoB,CAAC,yDAAyD,EAAE;oBACxF,IAAI,EAAE,wBAAwB;oBAC9B,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,6BAAoB,CAAC,yDAAyD,EAAE;gBACxF,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAqC,CAAC;QAC/D,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS;YAC5F,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;YACvD,iBAAiB,EAAE,mBAAmB,CAAC,UAAU,CAAC,aAAa,CAAC;YAChE,iBAAiB,EAAE,mBAAmB,CAAC,UAAU,CAAC,eAAe,CAAC,aAAa,CAAC;YAChF,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;YAC7B,mBAAmB,EAAE,gBAAgB;YACrC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,CAAC,6BAA6B,CAAC,KAK5C;QACC,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QAEpC,SAAS,CAAC;YACR,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAqC,CAAC;YAC/D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;oBAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM;oBACN,UAAU,EAAE,UAAU,CAAC,iBAAiB,IAAI,6BAA6B,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAC9F,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;oBACnC,IAAI,CAAC,uBAAuB,EAAE,CAAC;wBAC7B,uBAAuB,GAAG,IAAI,CAAC;wBAC/B,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;oBAC5C,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;gBACpG,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;gBACnE,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;oBACvG,IAAI,SAAS,EAAE,CAAC;wBACd,KAAK,GAAG,SAAS,CAAC;wBAClB,SAAS;oBACX,CAAC;gBACH,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,KAAa,EACb,OAAuB,EACvB,WAA6B,EAC7B,SAAsB;QAEtB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7B,KAAK;gBACL,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,KAAK,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,IAAI,WAAW,CAAC,KAAK,EAAE;gBACxD,cAAc,EAAE,iBAAiB,CAAC,OAAO,CAAC;aAC3C,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBACrF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,SAA4B,EAC5B,KAAuB,EACvB,UAAmC;QAEnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC,SAAS,EACT,UAAU,CAAC,aAAa,EACxB,KAAK,CAAC,QAAQ,CAAC,EAAE,EACjB,UAAU,CAAC,eAAe,CAC3B,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;YAC9F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;YACjF,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBACtC,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,eAAe,EAAE,UAAU,CAAC,OAAO;gBACnC,eAAe,EAAE,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC;QACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,6BAAoB,CAAC,4DAA4D,EAAE;gBAC3F,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,KAAuB,EAAE,KAAc;QACrF,MAAM,MAAM,GAAG,OAAQ,KAA8B,EAAE,MAAM,KAAK,QAAQ;YACxE,CAAC,CAAE,KAA4B,CAAC,MAAM;YACtC,CAAC,CAAC,KAAK,YAAY,6BAAoB;gBACrC,CAAC,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC/B,KAAK;gBACL,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;gBACjC,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,IAAA,8BAAqB,EAAC,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;YACrC,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC;YAC9C,MAAM;YACN,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,IAAiB;QACxC,MAAM,KAAK,GAAG,IAAA,sBAAQ,EAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,6BAAoB,CAAC,kDAAkD,EAAE;gBACjF,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAEO,YAAY,CAAC,IAAiB,EAAE,KAAa;QACnD,IAAI,CAAC,IAAA,6BAAe,EAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,6BAAoB,CAAC,2BAA2B,KAAK,EAAE,EAAE;gBACjE,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,KAAK,EAAE;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAnVD,4CAmVC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,UAAU,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAChF,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAmC,EAAE,GAAS;IAC9E,OAAO,UAAU,CAAC,OAAO;WACpB,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC;WACvD,UAAU,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW;WACxC,CAAC,CAAC,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAuB,EAAE,QAAyB;IAChF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,6BAAoB,CAAC,mBAAmB,EAAE;YAClD,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,6BAAoB,CAAC,gCAAgC,EAAE;YAC/D,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE;SAC9E,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,SAAS,IAAI,OAAO,CAAC,kBAAkB,CAAC,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC;IAC9I,OAAO,OAAO,CAAC,kBAAkB;WAC5B,eAAe,CAAC,UAAU,EAAE,cAAc,CAAC;WAC3C,eAAe,CAAC,UAAU,EAAE,iBAAiB,CAAC;WAC9C,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAuB;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,SAAS,IAAI,OAAO,CAAC,kBAAkB,CAAC,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC;IAC9I,OAAO,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC;WAC3C,eAAe,CAAC,UAAU,EAAE,eAAe,CAAC;WAC5C,eAAe,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,UAA+C,EAAE,GAAW;IACnF,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA6C;IAClF,MAAM,OAAO,GAAG,QAAQ,EAAE,iBAAiB,CAAC;IAC5C,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACtE,CAAC,CAAC,OAAoC;QACtC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,UAAkB,EAAE,KAAuB;IAC9E,OAAO;QACL,KAAK;QACL,UAAU;QACV,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC3B,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;QACjC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,QAAyB,EACzB,KAAa,EACb,MAAsB,EACtB,GAAS;IAET,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,QAAQ,GAAG,CAAC,OAAO,EAAE,EAAE;YACvC,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAC5C,MAAM,EAAE,WAAW;YACnB,KAAK;YACL,MAAM,EAAE;gBACN,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;wBACrB,IAAI,EAAE,WAAW;wBACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;wBAC1D,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACvG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACR;oBACE,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;iBACvE;gBACD,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC5B,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC,CAAC;aACJ;YACD,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,OAAO,GAAG,CAAC,OAAO,EAAE,EAAE;YACtC,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,WAAW;YACjB,KAAK;YACL,OAAO,EAAE;gBACP,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;wBACrB,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,KAAK,CAAC,SAAS;wBACzB,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC/F,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACR,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC5B,IAAI,EAAE,UAAU;oBAChB,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;iBACzC,CAAC,CAAC;aACJ;YACD,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,UAAU;YAC7C,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;SACnC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,YAAY,GAAG,CAAC,OAAO,EAAE,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QACzC,KAAK;QACL,OAAO,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;oBAC3B,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;wBAC3B,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;4BACrC,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,IAAI,EAAE,UAAU;4BAChB,QAAQ,EAAE;gCACR,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,SAAS,EAAE,IAAI,CAAC,SAAS;6BAC1B;yBACF,CAAC,CAAC;qBACJ,CAAC,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,aAAa,EAAE,KAAK,CAAC,YAAY,IAAI,MAAM;aAC5C,CAAC;QACF,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAsB;IAS/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2D,CAAC;IACjF,IAAI,EAAsB,CAAC;IAC3B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,MAAM,mBAAmB,GAAmD,EAAE,CAAC;IAC/E,IAAI,KAA+B,CAAC;IACpC,IAAI,YAAgC,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACtC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACvC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAChD,mBAAmB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC;YAChC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC/C,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,IAAI;QACJ,KAAK;QACL,YAAY;QACZ,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,SAAS;QACT,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAA+B;IAChD,OAAO;QACL,aAAa,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;QACtC,iBAAiB,EAAE,KAAK,EAAE,YAAY,IAAI,CAAC;QAC3C,YAAY,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC;KAC7F,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAA+B;IAClD,OAAO;QACL,YAAY,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;QACrC,aAAa,EAAE,KAAK,EAAE,YAAY,IAAI,CAAC;QACvC,YAAY,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC;KAC7F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAA+B;IACrD,OAAO;QACL,YAAY,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;QACrC,aAAa,EAAE,KAAK,EAAE,YAAY,IAAI,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { createHash } from 'node:crypto';\nimport { GatewayProtocolError, normalizeGatewayError } from './errors';\nimport type { AuthContext } from '../auth/AuthContext';\nimport { getWebId, hasGatewayScope } from '../auth/AuthContext';\nimport type { CredentialVault } from './credentials/CredentialVault';\nimport type { EncryptedCredentialSecret } from './credentials/KeyWrapper';\nimport { ChatCompletionsFrontend, MessagesFrontend, ResponsesFrontend } from './protocol';\nimport type { ProviderRuntimeCredential } from './providers/ProviderRuntimeAdapter';\nimport type { ProviderCapabilities, ProviderRegistry } from './providers/ProviderRegistry';\nimport { normalizeProviderId } from './providers/ProviderRegistry';\nimport type { ProviderRuntimeRegistry } from './providers/ProviderRuntimeRegistry';\nimport type { GatewayCredentialCandidate, ModelRouter, ModelRouteResult } from './routing/ModelRouter';\nimport type {\n  GatewayEvent,\n  GatewayProtocol,\n  GatewayProtocolFrontend,\n  GatewayRequest,\n  GatewayUsage,\n} from './types';\n\nexport interface StoredGatewayCredential extends GatewayCredentialCandidate {\n  encryptedSecret: EncryptedCredentialSecret;\n  version?: number;\n  runtimeCredential?: ProviderRuntimeCredential;\n}\n\nexport interface GatewayCredentialStore {\n  listCredentials(input: {\n    webId: string;\n    deployment: string;\n    auth?: AuthContext;\n  }): Promise<StoredGatewayCredential[]>;\n  recordSuccess?(input: GatewayCredentialHealthRecord): Promise<void>;\n  recordFailure?(input: GatewayCredentialHealthRecord): Promise<void>;\n  rewrapCredential?(input: {\n    webId: string;\n    deployment: string;\n    credentialId: string;\n    expectedVersion?: number;\n    encryptedSecret: EncryptedCredentialSecret;\n  }): Promise<boolean>;\n}\n\nexport interface GatewayCredentialHealthRecord {\n  webId: string;\n  deployment: string;\n  provider: string;\n  credentialId: string;\n  credentialIri: string;\n  status?: number;\n  errorCode?: string;\n}\n\nexport interface AiGatewayServiceOptions {\n  deployment: string;\n  registry: ProviderRegistry;\n  router: ModelRouter;\n  credentials: GatewayCredentialStore;\n  vault: CredentialVault;\n  runtimes: ProviderRuntimeRegistry;\n  frontends?: GatewayProtocolFrontend[];\n  now?: () => Date;\n}\n\nexport interface GatewayExecutionInput {\n  auth: AuthContext;\n  protocol: GatewayProtocol;\n  body: unknown;\n  signal?: AbortSignal;\n}\n\nexport interface GatewayExecution {\n  protocol: GatewayProtocol;\n  frontend: GatewayProtocolFrontend;\n  request: GatewayRequest;\n  route: ModelRouteResult;\n  events: AsyncIterable<GatewayEvent>;\n}\n\nexport interface GatewayModelListItem {\n  id: string;\n  object: 'model';\n  owned_by: string;\n  context_window?: number;\n  capabilities?: ProviderCapabilities;\n  protocols?: GatewayProtocol[];\n}\n\nexport interface GatewayAcceptanceProvenance {\n  webId: string;\n  gatewayKeyId: string;\n  gatewayKeyFingerprint: string;\n  credentialIriHash: string;\n  secretCellRefHash: string;\n  providerId: string;\n  providerRouteSource: 'pod-credential';\n  xpodBaseUrl: string;\n  generatedAt: string;\n}\n\nexport class AiGatewayService {\n  private readonly deployment: string;\n  private readonly registry: ProviderRegistry;\n  private readonly router: ModelRouter;\n  private readonly credentials: GatewayCredentialStore;\n  private readonly vault: CredentialVault;\n  private readonly runtimes: ProviderRuntimeRegistry;\n  private readonly frontends = new Map<GatewayProtocol, GatewayProtocolFrontend>();\n  private readonly now: () => Date;\n\n  public constructor(options: AiGatewayServiceOptions) {\n    this.deployment = options.deployment;\n    this.registry = options.registry;\n    this.router = options.router;\n    this.credentials = options.credentials;\n    this.vault = options.vault;\n    this.runtimes = options.runtimes;\n    this.now = options.now ?? (() => new Date());\n    for (const frontend of options.frontends ?? [\n      new ResponsesFrontend(),\n      new MessagesFrontend(),\n      new ChatCompletionsFrontend(),\n    ]) {\n      this.frontends.set(frontend.protocol, frontend);\n    }\n  }\n\n  public frontend(protocol: GatewayProtocol): GatewayProtocolFrontend {\n    const frontend = this.frontends.get(protocol);\n    if (!frontend) {\n      throw new GatewayProtocolError('Unsupported gateway protocol', {\n        code: 'invalid_request',\n        status: 400,\n        details: { protocol },\n      });\n    }\n    return frontend;\n  }\n\n  public async execute(input: GatewayExecutionInput): Promise<GatewayExecution> {\n    this.requireScope(input.auth, 'inference:write');\n    const principal = this.requirePrincipal(input.auth);\n    const frontend = this.frontend(input.protocol);\n    const request = frontend.parseRequest(input.body);\n    validateGatewayRequest(request, input.protocol);\n    const route = await this.router.route({\n      webId: principal.webId,\n      deployment: this.deployment,\n      auth: input.auth,\n      model: request.model,\n      conversationId: conversationIdFor(request),\n      explicitCredentialId: explicitCredentialIdFor(request),\n    });\n    request.model = route.model;\n    const events = this.executeWithCredentialFailover({\n      principal,\n      request,\n      route,\n      signal: input.signal,\n    });\n\n    return {\n      protocol: input.protocol,\n      frontend,\n      request,\n      route,\n      events,\n    };\n  }\n\n  public async complete(input: GatewayExecutionInput): Promise<Record<string, unknown>> {\n    const execution = await this.execute(input);\n    const events: GatewayEvent[] = [];\n    for await (const event of execution.events) {\n      events.push(event);\n    }\n    return aggregateEvents(execution.protocol, execution.request.model, events, this.now());\n  }\n\n  public async listModels(auth: AuthContext): Promise<GatewayModelListItem[]> {\n    this.requireScope(auth, 'models:read');\n    const principal = this.requirePrincipal(auth);\n    const credentials = await this.credentials.listCredentials({\n      webId: principal.webId,\n      deployment: this.deployment,\n      auth,\n    });\n    const activeCredentialModels = new Map<string, Set<string> | undefined>();\n    for (const credential of credentials) {\n      if (!isCredentialModelVisible(credential, this.now())) {\n        continue;\n      }\n      const providerId = normalizeProviderId(credential.provider);\n      const allowedModels = credential.models ?? [];\n      if (allowedModels.length === 0) {\n        activeCredentialModels.set(providerId, undefined);\n        continue;\n      }\n      const existing = activeCredentialModels.get(providerId);\n      if (existing === undefined && activeCredentialModels.has(providerId)) {\n        continue;\n      }\n      const models = existing ?? new Set<string>();\n      for (const model of allowedModels) {\n        models.add(model);\n      }\n      activeCredentialModels.set(providerId, models);\n    }\n    const seen = new Set<string>();\n    const models: GatewayModelListItem[] = [];\n    for (const provider of this.registry.listProviders()) {\n      const providerId = normalizeProviderId(provider.id);\n      if (!activeCredentialModels.has(providerId)) {\n        continue;\n      }\n      const allowedModels = activeCredentialModels.get(providerId);\n      const providerModelItems = provider.models\n        .filter((model) => allowedModels === undefined || allowedModels.has(model.id))\n        .map((model) => ({\n          id: model.id,\n          object: 'model' as const,\n          owned_by: provider.id,\n          ...(model.contextWindow !== undefined ? { context_window: model.contextWindow } : {}),\n          ...(model.capabilities ? { capabilities: model.capabilities } : {}),\n          ...(model.protocols ? { protocols: model.protocols } : {}),\n        }));\n      const registryModelIds = new Set(provider.models.map((model) => model.id));\n      const credentialOnlyModelItems = allowedModels === undefined\n        ? []\n        : Array.from(allowedModels)\n          .filter((model) => !registryModelIds.has(model))\n          .map((model) => ({\n            id: model,\n            object: 'model' as const,\n            owned_by: provider.id,\n          }));\n      for (const model of [ ...providerModelItems, ...credentialOnlyModelItems ]) {\n        if (seen.has(model.id)) {\n          continue;\n        }\n        seen.add(model.id);\n        models.push(model);\n      }\n    }\n    return models;\n  }\n\n  public async acceptanceProvenance(input: {\n    auth: AuthContext;\n    model: string;\n    xpodBaseUrl: string;\n  }): Promise<GatewayAcceptanceProvenance> {\n    this.requireScope(input.auth, 'acceptance:read');\n    const principal = this.requirePrincipal(input.auth);\n    if (input.auth.type !== 'solid' || input.auth.viaGatewayApiKey !== true || !input.auth.gatewayKeyFingerprint) {\n      throw new GatewayProtocolError('Acceptance provenance requires a Gateway API key principal', {\n        code: 'invalid_request',\n        status: 403,\n      });\n    }\n    let route: ModelRouteResult;\n    try {\n      route = await this.router.route({\n        webId: principal.webId,\n        deployment: this.deployment,\n        auth: input.auth,\n        model: input.model,\n      });\n    } catch (error) {\n      if (error instanceof GatewayProtocolError && error.code === 'credential_unavailable') {\n        throw new GatewayProtocolError('Acceptance provenance credential route was not resolved', {\n          code: 'credential_unavailable',\n          status: 404,\n          details: error.details,\n        });\n      }\n      throw error;\n    }\n    if (route.model !== requestedRouteModel(input.model)) {\n      throw new GatewayProtocolError('Acceptance provenance credential route was not resolved', {\n        code: 'credential_unavailable',\n        status: 404,\n        details: { model: input.model },\n      });\n    }\n    const credential = route.credential as StoredGatewayCredential;\n    return {\n      webId: principal.webId,\n      gatewayKeyId: input.auth.type === 'solid' ? input.auth.gatewayKeyId ?? 'unknown' : 'unknown',\n      gatewayKeyFingerprint: input.auth.gatewayKeyFingerprint,\n      credentialIriHash: hashProvenanceValue(credential.credentialIri),\n      secretCellRefHash: hashProvenanceValue(credential.encryptedSecret.credentialIri),\n      providerId: route.provider.id,\n      providerRouteSource: 'pod-credential',\n      xpodBaseUrl: input.xpodBaseUrl,\n      generatedAt: this.now().toISOString(),\n    };\n  }\n\n  private async *executeWithCredentialFailover(input: {\n    principal: { webId: string };\n    request: GatewayRequest;\n    route: ModelRouteResult;\n    signal?: AbortSignal;\n  }): AsyncIterable<GatewayEvent> {\n    let route = input.route;\n    let firstClientEventEmitted = false;\n    const attempted = new Set<string>();\n\n    for (;;) {\n      attempted.add(route.credential.id);\n      const credential = route.credential as StoredGatewayCredential;\n      try {\n        const apiKey = await this.openApiKey(input.principal, route, credential);\n        const adapter = this.runtimes.get(route.provider.id);\n        const upstream = adapter.execute({\n          request: input.request,\n          apiKey,\n          credential: credential.runtimeCredential ?? runtimeCredentialFromMetadata(credential.metadata),\n          signal: input.signal,\n        });\n        for await (const event of upstream) {\n          if (!firstClientEventEmitted) {\n            firstClientEventEmitted = true;\n            this.router.markClientEventEmitted(route);\n          }\n          yield event;\n        }\n        await this.credentials.recordSuccess?.(healthRecord(input.principal.webId, this.deployment, route));\n        return;\n      } catch (error) {\n        await this.recordRouteFailure(input.principal.webId, route, error);\n        if (!firstClientEventEmitted && this.router.canFailOver(route)) {\n          const nextRoute = await this.findFailoverRoute(input.principal.webId, input.request, route, attempted);\n          if (nextRoute) {\n            route = nextRoute;\n            continue;\n          }\n        }\n        throw error;\n      }\n    }\n  }\n\n  private async findFailoverRoute(\n    webId: string,\n    request: GatewayRequest,\n    failedRoute: ModelRouteResult,\n    attempted: Set<string>,\n  ): Promise<ModelRouteResult | undefined> {\n    try {\n      return await this.router.route({\n        webId,\n        deployment: this.deployment,\n        model: `${failedRoute.provider.id}/${failedRoute.model}`,\n        conversationId: conversationIdFor(request),\n      }, attempted);\n    } catch (error) {\n      if (error instanceof GatewayProtocolError && error.code === 'credential_unavailable') {\n        return undefined;\n      }\n      throw error;\n    }\n  }\n\n  private async openApiKey(\n    principal: { webId: string },\n    route: ModelRouteResult,\n    credential: StoredGatewayCredential,\n  ): Promise<string> {\n    const secret = await this.vault.open(\n      principal,\n      credential.credentialIri,\n      route.provider.id,\n      credential.encryptedSecret,\n    );\n    if (this.vault.needsRewrap?.(credential.encryptedSecret) && this.credentials.rewrapCredential) {\n      const rewrapped = await this.vault.rewrap(principal, credential.encryptedSecret);\n      await this.credentials.rewrapCredential({\n        webId: principal.webId,\n        deployment: this.deployment,\n        credentialId: credential.id,\n        expectedVersion: credential.version,\n        encryptedSecret: rewrapped,\n      });\n    }\n    const apiKey = secret.apiKey ?? secret.accessToken ?? secret.token;\n    if (typeof apiKey !== 'string' || !apiKey) {\n      throw new GatewayProtocolError('Credential secret does not contain a usable provider token', {\n        code: 'credential_unavailable',\n        status: 403,\n        details: { provider: route.provider.id, credentialId: credential.id },\n      });\n    }\n    return apiKey;\n  }\n\n  private async recordRouteFailure(webId: string, route: ModelRouteResult, error: unknown): Promise<void> {\n    const status = typeof (error as { status?: unknown })?.status === 'number'\n      ? (error as { status: number }).status\n      : error instanceof GatewayProtocolError\n        ? error.status\n        : undefined;\n    if (status === 429) {\n      await this.router.recordCooldown({\n        webId,\n        deployment: this.deployment,\n        credentialId: route.credential.id,\n        until: new Date(this.now().getTime() + 60_000),\n      });\n    }\n    const normalized = normalizeGatewayError(error);\n    await this.credentials.recordFailure?.({\n      ...healthRecord(webId, this.deployment, route),\n      status,\n      errorCode: normalized.error.code,\n    });\n  }\n\n  private requirePrincipal(auth: AuthContext): { webId: string } {\n    const webId = getWebId(auth);\n    if (!webId) {\n      throw new GatewayProtocolError('Gateway requests require a Solid WebID principal', {\n        code: 'invalid_request',\n        status: 401,\n      });\n    }\n    return { webId };\n  }\n\n  private requireScope(auth: AuthContext, scope: string): void {\n    if (!hasGatewayScope(auth, scope)) {\n      throw new GatewayProtocolError(`Missing required scope: ${scope}`, {\n        code: 'invalid_request',\n        status: 403,\n        details: { scope },\n      });\n    }\n  }\n}\n\nfunction hashProvenanceValue(value: string): string {\n  return `sha256:${createHash('sha256').update(value).digest('hex')}`;\n}\n\nfunction requestedRouteModel(model: string): string {\n  const slash = model.indexOf('/');\n  return slash > 0 && slash < model.length - 1 ? model.slice(slash + 1) : model;\n}\n\nfunction isCredentialModelVisible(credential: StoredGatewayCredential, now: Date): boolean {\n  return credential.enabled\n    && (!credential.health || credential.health === 'healthy')\n    && credential.quota?.status !== 'exhausted'\n    && (!credential.cooldownUntil || credential.cooldownUntil.getTime() <= now.getTime());\n}\n\nfunction validateGatewayRequest(request: GatewayRequest, protocol: GatewayProtocol): void {\n  if (!request.model) {\n    throw new GatewayProtocolError('model is required', {\n      code: 'invalid_request',\n      status: 400,\n      details: { protocol, field: 'model' },\n    });\n  }\n  if (request.messages.length === 0) {\n    throw new GatewayProtocolError('messages or input are required', {\n      code: 'invalid_request',\n      status: 400,\n      details: { protocol, field: protocol === 'responses' ? 'input' : 'messages' },\n    });\n  }\n}\n\nfunction conversationIdFor(request: GatewayRequest): string | undefined {\n  const extensions = request.protocolExtensions.responses ?? request.protocolExtensions.chatCompletions ?? request.protocolExtensions.anthropic;\n  return request.previousResponseId\n    ?? stringExtension(extensions, 'conversation')\n    ?? stringExtension(extensions, 'conversation_id')\n    ?? stringExtension(extensions, 'thread_id');\n}\n\nfunction explicitCredentialIdFor(request: GatewayRequest): string | undefined {\n  const extensions = request.protocolExtensions.responses ?? request.protocolExtensions.chatCompletions ?? request.protocolExtensions.anthropic;\n  return stringExtension(extensions, 'credential')\n    ?? stringExtension(extensions, 'credential_id')\n    ?? stringExtension(extensions, 'xpod_credential_id');\n}\n\nfunction stringExtension(extensions: Record<string, unknown> | undefined, key: string): string | undefined {\n  const value = extensions?.[key];\n  return typeof value === 'string' && value.trim() ? value.trim() : undefined;\n}\n\nfunction runtimeCredentialFromMetadata(metadata: Record<string, unknown> | undefined): ProviderRuntimeCredential | undefined {\n  const runtime = metadata?.runtimeCredential;\n  return runtime && typeof runtime === 'object' && !Array.isArray(runtime)\n    ? runtime as ProviderRuntimeCredential\n    : undefined;\n}\n\nfunction healthRecord(webId: string, deployment: string, route: ModelRouteResult): GatewayCredentialHealthRecord {\n  return {\n    webId,\n    deployment,\n    provider: route.provider.id,\n    credentialId: route.credential.id,\n    credentialIri: route.credential.credentialIri,\n  };\n}\n\nfunction aggregateEvents(\n  protocol: GatewayProtocol,\n  model: string,\n  events: GatewayEvent[],\n  now: Date,\n): Record<string, unknown> {\n  const state = collectEventState(events);\n  if (protocol === 'responses') {\n    return {\n      id: state.id ?? `resp_${now.getTime()}`,\n      object: 'response',\n      created_at: Math.floor(now.getTime() / 1000),\n      status: 'completed',\n      model,\n      output: [\n        ...(state.reasoning ? [{\n          type: 'reasoning',\n          summary: [{ type: 'summary_text', text: state.reasoning }],\n          ...(state.reasoningSignatures[0] ? { encrypted_content: state.reasoningSignatures[0].signature } : {}),\n        }] : []),\n        {\n          type: 'message',\n          role: 'assistant',\n          content: state.text ? [{ type: 'output_text', text: state.text }] : [],\n        },\n        ...state.tools.map((tool) => ({\n          type: 'function_call',\n          call_id: tool.id,\n          name: tool.name,\n          arguments: tool.arguments,\n        })),\n      ],\n      usage: openAiUsage(state.usage),\n    };\n  }\n  if (protocol === 'anthropic') {\n    return {\n      id: state.id ?? `msg_${now.getTime()}`,\n      type: 'message',\n      role: 'assistant',\n      model,\n      content: [\n        ...(state.reasoning ? [{\n          type: 'thinking',\n          thinking: state.reasoning,\n          ...(state.reasoningSignatures[0] ? { signature: state.reasoningSignatures[0].signature } : {}),\n        }] : []),\n        ...(state.text ? [{ type: 'text', text: state.text }] : []),\n        ...state.tools.map((tool) => ({\n          type: 'tool_use',\n          id: tool.id,\n          name: tool.name,\n          input: parseJsonOrString(tool.arguments),\n        })),\n      ],\n      stop_reason: state.finishReason ?? 'end_turn',\n      usage: anthropicUsage(state.usage),\n    };\n  }\n  return {\n    id: state.id ?? `chatcmpl_${now.getTime()}`,\n    object: 'chat.completion',\n    created: Math.floor(now.getTime() / 1000),\n    model,\n    choices: [{\n      index: 0,\n      message: {\n        role: 'assistant',\n        content: state.text || null,\n        ...(state.reasoning ? { reasoning_content: state.reasoning } : {}),\n        ...(state.reasoningSignatures[0] ? { reasoning_signature: state.reasoningSignatures[0].signature } : {}),\n        ...(state.tools.length > 0 ? {\n          tool_calls: state.tools.map((tool) => ({\n            id: tool.id,\n            type: 'function',\n            function: {\n              name: tool.name,\n              arguments: tool.arguments,\n            },\n          })),\n        } : {}),\n      },\n      finish_reason: state.finishReason ?? 'stop',\n    }],\n    usage: chatUsage(state.usage),\n  };\n}\n\nfunction collectEventState(events: GatewayEvent[]): {\n  id?: string;\n  text: string;\n  usage?: GatewayUsage;\n  finishReason?: string;\n  tools: Array<{ id: string; name: string; arguments: string }>;\n  reasoning: string;\n  reasoningSignatures: Array<{ provider: string; signature: string }>;\n} {\n  const tools = new Map<string, { id: string; name: string; arguments: string }>();\n  let id: string | undefined;\n  let text = '';\n  let reasoning = '';\n  const reasoningSignatures: Array<{ provider: string; signature: string }> = [];\n  let usage: GatewayUsage | undefined;\n  let finishReason: string | undefined;\n  for (const event of events) {\n    if (event.type === 'response.started') {\n      id = event.id;\n    } else if (event.type === 'text.delta') {\n      text += event.text;\n    } else if (event.type === 'reasoning.delta') {\n      reasoning += event.text;\n    } else if (event.type === 'reasoning.signature') {\n      reasoningSignatures.push({ provider: event.provider, signature: event.signature });\n    } else if (event.type === 'tool.started') {\n      tools.set(event.callId, { id: event.callId, name: event.name, arguments: '' });\n    } else if (event.type === 'tool.arguments.delta') {\n      const tool = tools.get(event.callId);\n      if (tool) {\n        tool.arguments += event.delta;\n      }\n    } else if (event.type === 'usage') {\n      usage = event.usage;\n    } else if (event.type === 'response.completed') {\n      finishReason = event.finishReason;\n    }\n  }\n  return {\n    id,\n    text,\n    usage,\n    finishReason,\n    tools: Array.from(tools.values()),\n    reasoning,\n    reasoningSignatures,\n  };\n}\n\nfunction chatUsage(usage: GatewayUsage | undefined): Record<string, number> {\n  return {\n    prompt_tokens: usage?.inputTokens ?? 0,\n    completion_tokens: usage?.outputTokens ?? 0,\n    total_tokens: usage?.totalTokens ?? ((usage?.inputTokens ?? 0) + (usage?.outputTokens ?? 0)),\n  };\n}\n\nfunction openAiUsage(usage: GatewayUsage | undefined): Record<string, number> {\n  return {\n    input_tokens: usage?.inputTokens ?? 0,\n    output_tokens: usage?.outputTokens ?? 0,\n    total_tokens: usage?.totalTokens ?? ((usage?.inputTokens ?? 0) + (usage?.outputTokens ?? 0)),\n  };\n}\n\nfunction anthropicUsage(usage: GatewayUsage | undefined): Record<string, number> {\n  return {\n    input_tokens: usage?.inputTokens ?? 0,\n    output_tokens: usage?.outputTokens ?? 0,\n  };\n}\n\nfunction parseJsonOrString(value: string): unknown {\n  try {\n    return JSON.parse(value || '{}');\n  } catch {\n    return value;\n  }\n}\n"]}

package/dist/api/ai-gateway/auth/AiConnectionInvocationKeyIssuer.d.ts

@@ -0,0 +1,38 @@
+import type { StoreContext } from '../../chatkit/store';
+import type { AIConnectionInvocationConfig } from '../../../agents/types';
+import type { GatewayDeployment } from './GatewayApiKey';
+import { type InvocationTokenCodec } from './InvocationTokenCodec';
+export interface AiConnectionInvocationKeyIssuerOptions {
+    codec: InvocationTokenCodec;
+    deployment: GatewayDeployment;
+    baseUrl: string;
+    audience?: string;
+    issuer?: string;
+    ttlMs?: number;
+    reuseSafetyMarginMs?: number;
+    maxCacheEntries?: number;
+    now?: () => Date;
+}
+/**
+ * Produces a short-lived stateless Gateway token at the trusted execution
+ * boundary. Nothing is persisted; plaintext exists solely in process memory
+ * and the returned invocation context.
+ */
+export declare class AiConnectionInvocationKeyIssuer {
+    private readonly codec;
+    private readonly deployment;
+    private readonly baseUrl;
+    private readonly audience;
+    private readonly issuer;
+    private readonly ttlMs;
+    private readonly reuseSafetyMarginMs;
+    private readonly maxCacheEntries;
+    private readonly now;
+    private readonly cache;
+    private readonly pending;
+    constructor(options: AiConnectionInvocationKeyIssuerOptions);
+    issue(context: StoreContext): Promise<AIConnectionInvocationConfig>;
+    private createInvocation;
+    private toInvocationConfig;
+    private pruneCache;
+}