@undefineds.co/xpod 0.3.58 → 0.3.61

package/dist/api/handlers/AiGatewayManagementHandler.js

@@ -0,0 +1,503 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAiGatewayManagementRoutes = registerAiGatewayManagementRoutes;
+const readBoundedJsonBody_1 = require("../http/readBoundedJsonBody");
+const GatewayPrincipal_1 = require("../ai-gateway/auth/GatewayPrincipal");
+const GatewayApiKey_1 = require("../ai-gateway/auth/GatewayApiKey");
+const GatewayApiKeyAuthenticator_1 = require("../ai-gateway/auth/GatewayApiKeyAuthenticator");
+const AiConnectionServiceAccess_1 = require("../ai-gateway/service-access/AiConnectionServiceAccess");
+const AiClientConfigurationService_1 = require("../service/AiClientConfigurationService");
+function registerAiGatewayManagementRoutes(server, options) {
+    const now = options.now ?? (() => new Date());
+    const createKeyId = options.keyId ?? ((owner) => (options.repository.createKeyId?.(owner, options.deployment) ?? (0, GatewayApiKey_1.createGatewayKeyId)()));
+    const jsonBodyLimitBytes = options.jsonBodyLimitBytes ?? 64 * 1024;
+    server.get('/api/applets/service-access/ai-connection', async (request, response) => {
+        if (!authorizeProviderConnect(request, response)) {
+            return;
+        }
+        if (!options.servicePrincipal) {
+            sendJson(response, 503, { error: 'AI Connection service identity is unavailable' });
+            return;
+        }
+        const service = await options.servicePrincipal.getServicePrincipal();
+        const descriptor = (0, AiConnectionServiceAccess_1.createAiConnectionServiceAccess)({
+            ownerWebId: request.auth.webId,
+            serviceWebId: service.webId,
+        });
+        const invocation = options.aiConnectionInvocationKeyIssuer
+            ? await options.aiConnectionInvocationKeyIssuer.issue({ auth: request.auth })
+            : undefined;
+        sendJson(response, 200, {
+            ...descriptor,
+            aiClientConfiguration: options.aiClientConfiguration ?? (0, AiClientConfigurationService_1.unavailableAiClientConfigurationCapability)(),
+            ...(invocation ? { invocation } : {}),
+        });
+    });
+    server.post('/api/ai/gateway/keys', async (request, response) => {
+        if (!authorizeGatewayKeyManagement(request, response)) {
+            return;
+        }
+        const bodyResult = await (0, readBoundedJsonBody_1.readBoundedJsonBody)(request, { limitBytes: jsonBodyLimitBytes });
+        if (!bodyResult.ok) {
+            sendJson(response, bodyResult.status, { error: bodyResult.error });
+            return;
+        }
+        const body = bodyResult.value;
+        if (!body || typeof body !== 'object' || Array.isArray(body)) {
+            sendJson(response, 400, { error: 'Request body must be a JSON object' });
+            return;
+        }
+        const payload = body;
+        const owner = (0, GatewayPrincipal_1.ownerWebIdForGatewayKeyManagement)(request.auth, payload.owner);
+        if (!owner) {
+            sendJson(response, 400, { error: 'Gateway key owner WebID is required' });
+            return;
+        }
+        const scopes = normalizeScopes(payload.scopes);
+        if (!scopes) {
+            sendJson(response, 400, { error: 'scopes must be a non-empty string array' });
+            return;
+        }
+        const expiresAt = normalizeOptionalDate(payload.expiresAt);
+        if (payload.expiresAt !== undefined && !expiresAt) {
+            sendJson(response, 400, { error: 'expiresAt must be an ISO date string' });
+            return;
+        }
+        const issued = await (0, GatewayApiKey_1.createGatewayApiKey)({
+            deployment: options.deployment,
+            keyId: createKeyId(owner),
+        });
+        const createdAt = now();
+        const record = await options.repository.create({
+            ...issued.record,
+            owner,
+            scopes,
+            createdAt,
+            expiresAt,
+            name: normalizeOptionalString(payload.name),
+        }, { auth: request.auth });
+        sendJson(response, 201, {
+            key: issued.plaintext,
+            record: publicRecord(record),
+        });
+    });
+    server.get('/api/ai/gateway/keys', async (request, response) => {
+        if (!authorizeGatewayKeyManagement(request, response)) {
+            return;
+        }
+        const owner = ownerForList(request);
+        if (!owner) {
+            sendJson(response, 400, { error: 'Gateway key owner WebID is required' });
+            return;
+        }
+        const records = await options.repository.listByOwner(owner, { auth: request.auth });
+        sendJson(response, 200, {
+            data: records.map(publicRecord),
+        });
+    });
+    server.delete('/api/ai/gateway/keys/:keyId', async (request, response, params) => {
+        if (!authorizeGatewayKeyManagement(request, response)) {
+            return;
+        }
+        const keyId = decodeURIComponent(params.keyId);
+        const existing = await options.repository.findById(keyId);
+        if (!existing) {
+            sendJson(response, 404, { error: 'Gateway key not found' });
+            return;
+        }
+        const owner = ownerForList(request);
+        if (!owner || existing.owner !== owner) {
+            sendJson(response, 403, { error: 'Cannot revoke a gateway key owned by another WebID' });
+            return;
+        }
+        const revoked = await options.repository.revoke(keyId, now(), { auth: request.auth });
+        sendJson(response, 200, {
+            record: revoked ? publicRecord(revoked) : undefined,
+        });
+    });
+    server.get('/api/ai/connections/providers', async (request, response) => {
+        if (!authorizeProviderConnect(request, response)) {
+            return;
+        }
+        const connectService = requireConnectService(options, response);
+        if (!connectService) {
+            return;
+        }
+        const providers = await connectService.listProviders({
+            webId: request.auth.webId,
+            deployment: options.deployment,
+            auth: request.auth,
+        });
+        sendJson(response, 200, {
+            data: publicConnectResult(providers),
+        });
+    });
+    server.post('/api/ai/gateway/providers/:provider/connect/begin', async (request, response, params) => {
+        if (!authorizeProviderConnect(request, response)) {
+            return;
+        }
+        const body = await readJsonObject(request, response, jsonBodyLimitBytes);
+        if (!body) {
+            return;
+        }
+        const mode = typeof body.mode === 'string' ? body.mode : undefined;
+        if (mode !== 'browserAssistedApiKey' && mode !== 'deviceCodeOAuth' && mode !== 'connectUnsupported') {
+            sendJson(response, 400, { error: 'mode must be a supported Connect mode' });
+            return;
+        }
+        const connectService = requireConnectService(options, response);
+        if (!connectService) {
+            return;
+        }
+        const result = await connectService.begin({
+            webId: request.auth.webId,
+            deployment: options.deployment,
+            provider: params.provider,
+            requestedMode: mode,
+            expectedCredentialVersion: typeof body.expectedCredentialVersion === 'number'
+                ? body.expectedCredentialVersion
+                : undefined,
+            auth: request.auth,
+        });
+        sendJson(response, 200, publicConnectResult(result));
+    });
+    server.get('/api/ai/gateway/providers/:provider/connect/status/:attemptId', async (request, response, params) => {
+        if (!authorizeProviderConnect(request, response)) {
+            return;
+        }
+        const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
+        const connectService = requireConnectService(options, response);
+        if (!connectService) {
+            return;
+        }
+        const result = await connectService.status({
+            webId: request.auth.webId,
+            deployment: options.deployment,
+            provider: params.provider,
+            attemptId: decodeURIComponent(params.attemptId),
+            state: url.searchParams.get('state') ?? '',
+            signature: url.searchParams.get('signature') ?? '',
+            auth: request.auth,
+        });
+        sendJson(response, 200, publicConnectResult(result));
+    });
+    server.post('/api/ai/gateway/providers/:provider/connect/complete-api-key', async (request, response, params) => {
+        if (!authorizeProviderConnect(request, response)) {
+            return;
+        }
+        const body = await readJsonObject(request, response, jsonBodyLimitBytes);
+        if (!body) {
+            return;
+        }
+        const apiKey = normalizeOptionalString(body.apiKey);
+        if (!apiKey) {
+            sendJson(response, 400, { error: 'apiKey is required' });
+            return;
+        }
+        const connectService = requireConnectService(options, response);
+        if (!connectService) {
+            return;
+        }
+        const result = await connectService.completeApiKey({
+            webId: request.auth.webId,
+            deployment: options.deployment,
+            provider: params.provider,
+            attemptId: stringBody(body.attemptId),
+            state: stringBody(body.state),
+            signature: stringBody(body.signature),
+            apiKey,
+            accountLabel: normalizeOptionalString(body.accountLabel),
+            auth: request.auth,
+        });
+        sendJson(response, 200, publicConnectResult(result));
+    });
+    server.post('/api/ai/gateway/providers/:provider/connect/poll', async (request, response, params) => {
+        if (!authorizeProviderConnect(request, response)) {
+            return;
+        }
+        const body = await readJsonObject(request, response, jsonBodyLimitBytes);
+        if (!body) {
+            return;
+        }
+        const connectService = requireConnectService(options, response);
+        if (!connectService) {
+            return;
+        }
+        const result = await connectService.pollDevice({
+            webId: request.auth.webId,
+            deployment: options.deployment,
+            provider: params.provider,
+            attemptId: stringBody(body.attemptId),
+            state: stringBody(body.state),
+            signature: stringBody(body.signature),
+            auth: request.auth,
+        });
+        sendJson(response, 200, publicConnectResult(result));
+    });
+    server.post('/api/ai/gateway/providers/:provider/connect/refresh', async (request, response, params) => {
+        if (!authorizeProviderConnect(request, response)) {
+            return;
+        }
+        const body = await readJsonObject(request, response, jsonBodyLimitBytes);
+        if (!body) {
+            return;
+        }
+        const connectService = requireConnectService(options, response);
+        if (!connectService) {
+            return;
+        }
+        const record = await connectService.refresh({
+            webId: request.auth.webId,
+            deployment: options.deployment,
+            provider: params.provider,
+            auth: request.auth,
+        });
+        sendJson(response, 200, { record: record ? publicCredentialRecord(record) : undefined });
+    });
+    server.delete('/api/ai/gateway/providers/:provider/connect', async (request, response, params) => {
+        if (!authorizeProviderConnect(request, response)) {
+            return;
+        }
+        const connectService = requireConnectService(options, response);
+        if (!connectService) {
+            return;
+        }
+        const record = await connectService.disconnect({
+            webId: request.auth.webId,
+            deployment: options.deployment,
+            provider: params.provider,
+            auth: request.auth,
+        });
+        sendJson(response, 200, { record: record ? publicCredentialRecord(record) : undefined });
+    });
+    server.get('/api/ai/gateway/providers/:provider/connect/callback', async (_request, response) => {
+        // This endpoint is intentionally public only for signed one-time OAuth callbacks.
+        // Browser-assisted API key completion is never accepted here because API keys
+        // must be submitted through the authenticated management API.
+        sendJson(response, 405, {
+            error: 'Public Connect callback is unsupported for current provider Connect modes',
+        });
+    }, { public: true });
+    server.get('/api/ai/gateway/providers/:provider/quota/status', async (request, response, params) => {
+        if (!authorizeProviderQuota(request, response)) {
+            return;
+        }
+        const quotaService = requireQuotaService(options, response);
+        if (!quotaService) {
+            return;
+        }
+        const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
+        try {
+            const result = await quotaService.status({
+                webId: request.auth.webId,
+                deployment: options.deployment,
+                provider: params.provider,
+                credentialIri: normalizeOptionalString(url.searchParams.get('credentialIri')),
+                refresh: false,
+            });
+            sendJson(response, 200, result);
+        }
+        catch (error) {
+            sendQuotaError(response, error);
+        }
+    });
+    server.post('/api/ai/gateway/providers/:provider/quota/refresh', async (request, response, params) => {
+        if (!authorizeProviderQuota(request, response)) {
+            return;
+        }
+        const body = await readJsonObject(request, response, jsonBodyLimitBytes);
+        if (!body) {
+            return;
+        }
+        const quotaService = requireQuotaService(options, response);
+        if (!quotaService) {
+            return;
+        }
+        try {
+            const result = await quotaService.status({
+                webId: request.auth.webId,
+                deployment: options.deployment,
+                provider: params.provider,
+                credentialIri: normalizeOptionalString(body.credentialIri),
+                refresh: true,
+            });
+            sendJson(response, 200, result);
+        }
+        catch (error) {
+            sendQuotaError(response, error);
+        }
+    });
+}
+function authorizeGatewayKeyManagement(request, response) {
+    return authorizeManagementCaller(request, response, {
+        gatewayKeyPrincipalError: 'Gateway API keys cannot manage gateway keys',
+        nonSolidPrincipalError: 'Insufficient permissions',
+        allowServiceGatewayKeyManagement: true,
+    });
+}
+function authorizeManagementCaller(request, response, options) {
+    const auth = request.auth;
+    if (!auth) {
+        sendJson(response, 401, { error: 'Authentication required' });
+        return false;
+    }
+    if (auth.type === 'solid' && auth.webId) {
+        if ((0, GatewayPrincipal_1.isGatewayApiKeyPrincipal)(auth) && !(0, GatewayPrincipal_1.isInternalGatewayInvocationPrincipal)(auth)) {
+            sendJson(response, 403, { error: options.gatewayKeyPrincipalError });
+            return false;
+        }
+        return true;
+    }
+    if (options.allowServiceGatewayKeyManagement && (0, GatewayPrincipal_1.canManageGatewayKeys)(auth)) {
+        return true;
+    }
+    sendJson(response, 403, { error: options.nonSolidPrincipalError });
+    return false;
+}
+function authorizeCurrentSolidManagement(request, response, options) {
+    if (!authorizeManagementCaller(request, response, options)) {
+        return false;
+    }
+    const auth = request.auth;
+    if (!auth || auth.type !== 'solid' || !auth.webId) {
+        sendJson(response, 403, { error: 'Insufficient permissions' });
+        return false;
+    }
+    return true;
+}
+function authorizeProviderConnect(request, response) {
+    return authorizeCurrentSolidManagement(request, response, {
+        gatewayKeyPrincipalError: 'Gateway API keys cannot manage provider Connect state',
+        nonSolidPrincipalError: 'Provider Connect requires the current Solid identity',
+    });
+}
+function authorizeProviderQuota(request, response) {
+    return authorizeCurrentSolidManagement(request, response, {
+        gatewayKeyPrincipalError: 'Gateway API keys cannot manage provider quota state',
+        nonSolidPrincipalError: 'Provider quota requires the current Solid identity',
+    });
+}
+function requireConnectService(options, response) {
+    if (!options.connectService) {
+        sendJson(response, 503, { error: 'AI provider Connect service is not configured' });
+        return undefined;
+    }
+    return options.connectService;
+}
+function requireQuotaService(options, response) {
+    if (!options.quotaService) {
+        sendJson(response, 503, { error: 'AI provider quota service is not configured' });
+        return undefined;
+    }
+    return options.quotaService;
+}
+function sendQuotaError(response, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message === 'quota_credential_not_found') {
+        sendJson(response, 404, { error: 'Provider credential not found for current identity' });
+        return;
+    }
+    if (message.startsWith('quota_adapter_not_found:')) {
+        sendJson(response, 404, { error: 'Provider quota adapter not found' });
+        return;
+    }
+    sendJson(response, 500, { error: 'Provider quota lookup failed' });
+}
+async function readJsonObject(request, response, limitBytes) {
+    const bodyResult = await (0, readBoundedJsonBody_1.readBoundedJsonBody)(request, { limitBytes });
+    if (!bodyResult.ok) {
+        sendJson(response, bodyResult.status, { error: bodyResult.error });
+        return undefined;
+    }
+    const body = bodyResult.value;
+    if (!body || typeof body !== 'object' || Array.isArray(body)) {
+        sendJson(response, 400, { error: 'Request body must be a JSON object' });
+        return undefined;
+    }
+    return body;
+}
+function ownerForList(request) {
+    if (request.auth?.type === 'solid') {
+        return request.auth.webId;
+    }
+    const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
+    return url.searchParams.get('owner') ?? undefined;
+}
+function normalizeScopes(value) {
+    if (value === undefined) {
+        return [...GatewayApiKeyAuthenticator_1.DEFAULT_GATEWAY_API_KEY_SCOPES];
+    }
+    if (!Array.isArray(value) || value.length === 0) {
+        return undefined;
+    }
+    const scopes = value
+        .map((item) => typeof item === 'string' ? item.trim() : '')
+        .filter(Boolean);
+    if (scopes.length !== value.length) {
+        return undefined;
+    }
+    return [...new Set(scopes)];
+}
+function normalizeOptionalDate(value) {
+    if (value === undefined || value === null || value === '') {
+        return undefined;
+    }
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const parsed = new Date(value);
+    return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+}
+function normalizeOptionalString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+function stringBody(value) {
+    return typeof value === 'string' ? value : '';
+}
+function publicRecord(record) {
+    return {
+        id: record.id,
+        owner: record.owner,
+        scopes: record.scopes,
+        createdAt: record.createdAt.toISOString(),
+        expiresAt: record.expiresAt?.toISOString(),
+        lastUsedAt: record.lastUsedAt?.toISOString(),
+        revokedAt: record.revokedAt?.toISOString(),
+        name: record.name,
+    };
+}
+function publicCredentialRecord(record) {
+    return {
+        id: record.id,
+        credentialIri: record.credentialIri,
+        provider: record.provider,
+        authMode: record.authMode,
+        status: record.status,
+        accountLabel: record.accountLabel,
+        expiresAt: record.expiresAt?.toISOString(),
+        version: record.version,
+        reauthRequired: record.reauthRequired,
+    };
+}
+function publicConnectResult(value) {
+    if (Array.isArray(value)) {
+        return value.map(publicConnectResult);
+    }
+    if (!value || typeof value !== 'object' || value instanceof Date) {
+        return value;
+    }
+    return Object.fromEntries(Object.entries(value)
+        .filter(([key]) => ![
+        'deployment',
+        'webId',
+        'encryptedSecret',
+        'metadata',
+    ].includes(key))
+        .map(([key, item]) => [key, publicConnectResult(item)]));
+}
+function sendJson(response, status, data) {
+    response.statusCode = status;
+    response.setHeader('Content-Type', 'application/json');
+    response.end(JSON.stringify(data));
+}
+//# sourceMappingURL=AiGatewayManagementHandler.js.map

package/dist/api/handlers/AiGatewayManagementHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AiGatewayManagementHandler.js","sourceRoot":"","sources":["../../../src/api/handlers/AiGatewayManagementHandler.ts"],"names":[],"mappings":";;AAiDA,8EAsVC;AApYD,qEAAkE;AAClE,0EAK6C;AAE7C,oEAI0C;AAK1C,8FAA+F;AAO/F,sGAAyG;AAEzG,0FAGiD;AAiBjD,SAAgB,iCAAiC,CAC/C,MAAiB,EACjB,OAA0C;IAE1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,CACvD,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,IAAA,kCAAkB,GAAE,CACpF,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,GAAG,IAAI,CAAC;IAEnE,MAAM,CAAC,GAAG,CAAC,2CAA2C,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAClF,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,CAAC;QACrE,MAAM,UAAU,GAAG,IAAA,2DAA+B,EAAC;YACjD,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YAC9B,YAAY,EAAE,OAAO,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,OAAO,CAAC,+BAA+B;YACxD,CAAC,CAAC,MAAM,OAAO,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7E,CAAC,CAAC,SAAS,CAAC;QACd,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,GAAG,UAAU;YACb,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,IAAA,yEAA0C,GAAE;YACpG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC9D,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAmB,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,KAAK,GAAG,IAAA,oDAAiC,EAAC,OAAO,CAAC,IAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAmB,EAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;SAC1B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAC7C,GAAG,MAAM,CAAC,MAAM;YAChB,KAAK;YACL,MAAM;YACN,SAAS;YACT,SAAS;YACT,IAAI,EAAE,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC;SAC5C,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAE3B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC7D,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC/E,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACvC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SACpD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACtE,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC;YACnD,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACnG,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACpG,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC;YACxC,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,IAAI;YACnB,yBAAyB,EAAE,OAAO,IAAI,CAAC,yBAAyB,KAAK,QAAQ;gBAC3E,CAAC,CAAC,IAAI,CAAC,yBAAyB;gBAChC,CAAC,CAAC,SAAS;YACb,IAAI,EAAE,OAAO,CAAC,IAAI;SACS,CAAC,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,+DAA+D,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC9G,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACzF,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC;YACzC,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YAClD,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC9G,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC;YACjD,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,MAAM;YACN,YAAY,EAAE,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxD,IAAI,EAAE,OAAO,CAAC,IAAI;SACW,CAAC,CAAC;QACjC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAClG,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC;YAC7C,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACrG,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,6CAA6C,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC/F,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC;YAC7C,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,sDAAsD,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC9F,kFAAkF;QAClF,8EAA8E;QAC9E,8DAA8D;QAC9D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,KAAK,EAAE,2EAA2E;SACnF,CAAC,CAAC;IACL,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAErB,MAAM,CAAC,GAAG,CAAC,kDAAkD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACjG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;gBACvC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;gBACzB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7E,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACnG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;gBACvC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;gBACzB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,uBAAuB,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC1D,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CACpC,OAA6B,EAC7B,QAAwB;IAExB,OAAO,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE;QAClD,wBAAwB,EAAE,6CAA6C;QACvE,sBAAsB,EAAE,0BAA0B;QAClD,gCAAgC,EAAE,IAAI;KACvC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA6B,EAC7B,QAAwB,EACxB,OAIC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,IAAI,IAAA,2CAAwB,EAAC,IAAI,CAAC,IAAI,CAAC,IAAA,uDAAoC,EAAC,IAAI,CAAC,EAAE,CAAC;YAClF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,gCAAgC,IAAI,IAAA,uCAAoB,EAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,+BAA+B,CACtC,OAA6B,EAC7B,QAAwB,EACxB,OAGC;IAED,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA6B,EAC7B,QAAwB;IAExB,OAAO,+BAA+B,CAAC,OAAO,EAAE,QAAQ,EAAE;QACxD,wBAAwB,EAAE,uDAAuD;QACjF,sBAAsB,EAAE,sDAAsD;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA6B,EAC7B,QAAwB;IAExB,OAAO,+BAA+B,CAAC,OAAO,EAAE,QAAQ,EAAE;QACxD,wBAAwB,EAAE,qDAAqD;QAC/E,sBAAsB,EAAE,oDAAoD;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA0C,EAC1C,QAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA0C,EAC1C,QAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,QAAwB,EAAE,KAAc;IAC9D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,4BAA4B,EAAE,CAAC;QAC7C,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAA6B,EAC7B,QAAwB,EACxB,UAAkB;IAElB,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAmB,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;IAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,OAA6B;IACjD,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IACzF,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,2DAA8B,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK;SACjB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,MAA8B;IAClD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;QAC1C,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE;QAC5C,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;QAC1C,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAa/B;IACC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,YAAY;QACZ,OAAO;QACP,iBAAiB;QACjB,UAAU;KACX,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IACvE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http';\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthenticatedRequest } from '../middleware/AuthMiddleware';\nimport { readBoundedJsonBody } from '../http/readBoundedJsonBody';\nimport {\n  canManageGatewayKeys,\n  isInternalGatewayInvocationPrincipal,\n  isGatewayApiKeyPrincipal,\n  ownerWebIdForGatewayKeyManagement,\n} from '../ai-gateway/auth/GatewayPrincipal';\nimport type { SolidAuthContext } from '../auth/AuthContext';\nimport {\n  createGatewayApiKey,\n  createGatewayKeyId,\n  type GatewayDeployment,\n} from '../ai-gateway/auth/GatewayApiKey';\nimport type {\n  GatewayAccessKeyRecord,\n  GatewayAccessKeyRepository,\n} from '../ai-gateway/auth/GatewayApiKeyAuthenticator';\nimport { DEFAULT_GATEWAY_API_KEY_SCOPES } from '../ai-gateway/auth/GatewayApiKeyAuthenticator';\nimport type {\n  CompleteApiKeyInput,\n  ConnectBeginInput,\n  ProviderConnectService,\n} from '../ai-gateway/connect';\nimport type { ProviderQuotaService } from '../ai-gateway/quota';\nimport { createAiConnectionServiceAccess } from '../ai-gateway/service-access/AiConnectionServiceAccess';\nimport type { AiConnectionInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionInvocationKeyIssuer';\nimport {\n  type AiClientConfigurationCapabilityDescriptor,\n  unavailableAiClientConfigurationCapability,\n} from '../service/AiClientConfigurationService';\n\nexport interface AiGatewayManagementHandlerOptions {\n  repository: GatewayAccessKeyRepository;\n  deployment: GatewayDeployment;\n  connectService?: ProviderConnectService;\n  quotaService?: ProviderQuotaService;\n  servicePrincipal?: {\n    getServicePrincipal(): Promise<{ webId: string }>;\n  };\n  aiClientConfiguration?: AiClientConfigurationCapabilityDescriptor;\n  aiConnectionInvocationKeyIssuer?: Pick<AiConnectionInvocationKeyIssuer, 'issue'>;\n  now?: () => Date;\n  keyId?: (owner: string) => string;\n  jsonBodyLimitBytes?: number;\n}\n\nexport function registerAiGatewayManagementRoutes(\n  server: ApiServer,\n  options: AiGatewayManagementHandlerOptions,\n): void {\n  const now = options.now ?? (() => new Date());\n  const createKeyId = options.keyId ?? ((owner: string) => (\n    options.repository.createKeyId?.(owner, options.deployment) ?? createGatewayKeyId()\n  ));\n  const jsonBodyLimitBytes = options.jsonBodyLimitBytes ?? 64 * 1024;\n\n  server.get('/api/applets/service-access/ai-connection', async (request, response) => {\n    if (!authorizeProviderConnect(request, response)) {\n      return;\n    }\n    if (!options.servicePrincipal) {\n      sendJson(response, 503, { error: 'AI Connection service identity is unavailable' });\n      return;\n    }\n    const service = await options.servicePrincipal.getServicePrincipal();\n    const descriptor = createAiConnectionServiceAccess({\n      ownerWebId: request.auth.webId,\n      serviceWebId: service.webId,\n    });\n    const invocation = options.aiConnectionInvocationKeyIssuer\n      ? await options.aiConnectionInvocationKeyIssuer.issue({ auth: request.auth })\n      : undefined;\n    sendJson(response, 200, {\n      ...descriptor,\n      aiClientConfiguration: options.aiClientConfiguration ?? unavailableAiClientConfigurationCapability(),\n      ...(invocation ? { invocation } : {}),\n    });\n  });\n\n  server.post('/api/ai/gateway/keys', async (request, response) => {\n    if (!authorizeGatewayKeyManagement(request, response)) {\n      return;\n    }\n\n    const bodyResult = await readBoundedJsonBody(request, { limitBytes: jsonBodyLimitBytes });\n    if (!bodyResult.ok) {\n      sendJson(response, bodyResult.status, { error: bodyResult.error });\n      return;\n    }\n    const body = bodyResult.value;\n    if (!body || typeof body !== 'object' || Array.isArray(body)) {\n      sendJson(response, 400, { error: 'Request body must be a JSON object' });\n      return;\n    }\n    const payload = body as Record<string, unknown>;\n    const owner = ownerWebIdForGatewayKeyManagement(request.auth!, payload.owner);\n    if (!owner) {\n      sendJson(response, 400, { error: 'Gateway key owner WebID is required' });\n      return;\n    }\n    const scopes = normalizeScopes(payload.scopes);\n    if (!scopes) {\n      sendJson(response, 400, { error: 'scopes must be a non-empty string array' });\n      return;\n    }\n    const expiresAt = normalizeOptionalDate(payload.expiresAt);\n    if (payload.expiresAt !== undefined && !expiresAt) {\n      sendJson(response, 400, { error: 'expiresAt must be an ISO date string' });\n      return;\n    }\n\n    const issued = await createGatewayApiKey({\n      deployment: options.deployment,\n      keyId: createKeyId(owner),\n    });\n    const createdAt = now();\n    const record = await options.repository.create({\n      ...issued.record,\n      owner,\n      scopes,\n      createdAt,\n      expiresAt,\n      name: normalizeOptionalString(payload.name),\n    }, { auth: request.auth });\n\n    sendJson(response, 201, {\n      key: issued.plaintext,\n      record: publicRecord(record),\n    });\n  });\n\n  server.get('/api/ai/gateway/keys', async (request, response) => {\n    if (!authorizeGatewayKeyManagement(request, response)) {\n      return;\n    }\n\n    const owner = ownerForList(request);\n    if (!owner) {\n      sendJson(response, 400, { error: 'Gateway key owner WebID is required' });\n      return;\n    }\n    const records = await options.repository.listByOwner(owner, { auth: request.auth });\n    sendJson(response, 200, {\n      data: records.map(publicRecord),\n    });\n  });\n\n  server.delete('/api/ai/gateway/keys/:keyId', async (request, response, params) => {\n    if (!authorizeGatewayKeyManagement(request, response)) {\n      return;\n    }\n\n    const keyId = decodeURIComponent(params.keyId);\n    const existing = await options.repository.findById(keyId);\n    if (!existing) {\n      sendJson(response, 404, { error: 'Gateway key not found' });\n      return;\n    }\n    const owner = ownerForList(request);\n    if (!owner || existing.owner !== owner) {\n      sendJson(response, 403, { error: 'Cannot revoke a gateway key owned by another WebID' });\n      return;\n    }\n    const revoked = await options.repository.revoke(keyId, now(), { auth: request.auth });\n    sendJson(response, 200, {\n      record: revoked ? publicRecord(revoked) : undefined,\n    });\n  });\n\n  server.get('/api/ai/connections/providers', async (request, response) => {\n    if (!authorizeProviderConnect(request, response)) {\n      return;\n    }\n    const connectService = requireConnectService(options, response);\n    if (!connectService) {\n      return;\n    }\n    const providers = await connectService.listProviders({\n      webId: request.auth!.webId,\n      deployment: options.deployment,\n      auth: request.auth,\n    });\n    sendJson(response, 200, {\n      data: publicConnectResult(providers),\n    });\n  });\n\n  server.post('/api/ai/gateway/providers/:provider/connect/begin', async (request, response, params) => {\n    if (!authorizeProviderConnect(request, response)) {\n      return;\n    }\n    const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n    if (!body) {\n      return;\n    }\n    const mode = typeof body.mode === 'string' ? body.mode : undefined;\n    if (mode !== 'browserAssistedApiKey' && mode !== 'deviceCodeOAuth' && mode !== 'connectUnsupported') {\n      sendJson(response, 400, { error: 'mode must be a supported Connect mode' });\n      return;\n    }\n    const connectService = requireConnectService(options, response);\n    if (!connectService) {\n      return;\n    }\n    const result = await connectService.begin({\n      webId: request.auth!.webId,\n      deployment: options.deployment,\n      provider: params.provider,\n      requestedMode: mode,\n      expectedCredentialVersion: typeof body.expectedCredentialVersion === 'number'\n        ? body.expectedCredentialVersion\n        : undefined,\n      auth: request.auth,\n    } satisfies ConnectBeginInput);\n    sendJson(response, 200, publicConnectResult(result));\n  });\n\n  server.get('/api/ai/gateway/providers/:provider/connect/status/:attemptId', async (request, response, params) => {\n    if (!authorizeProviderConnect(request, response)) {\n      return;\n    }\n    const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n    const connectService = requireConnectService(options, response);\n    if (!connectService) {\n      return;\n    }\n    const result = await connectService.status({\n      webId: request.auth!.webId,\n      deployment: options.deployment,\n      provider: params.provider,\n      attemptId: decodeURIComponent(params.attemptId),\n      state: url.searchParams.get('state') ?? '',\n      signature: url.searchParams.get('signature') ?? '',\n      auth: request.auth,\n    });\n    sendJson(response, 200, publicConnectResult(result));\n  });\n\n  server.post('/api/ai/gateway/providers/:provider/connect/complete-api-key', async (request, response, params) => {\n    if (!authorizeProviderConnect(request, response)) {\n      return;\n    }\n    const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n    if (!body) {\n      return;\n    }\n    const apiKey = normalizeOptionalString(body.apiKey);\n    if (!apiKey) {\n      sendJson(response, 400, { error: 'apiKey is required' });\n      return;\n    }\n    const connectService = requireConnectService(options, response);\n    if (!connectService) {\n      return;\n    }\n    const result = await connectService.completeApiKey({\n      webId: request.auth!.webId,\n      deployment: options.deployment,\n      provider: params.provider,\n      attemptId: stringBody(body.attemptId),\n      state: stringBody(body.state),\n      signature: stringBody(body.signature),\n      apiKey,\n      accountLabel: normalizeOptionalString(body.accountLabel),\n      auth: request.auth,\n    } satisfies CompleteApiKeyInput);\n    sendJson(response, 200, publicConnectResult(result));\n  });\n\n  server.post('/api/ai/gateway/providers/:provider/connect/poll', async (request, response, params) => {\n    if (!authorizeProviderConnect(request, response)) {\n      return;\n    }\n    const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n    if (!body) {\n      return;\n    }\n    const connectService = requireConnectService(options, response);\n    if (!connectService) {\n      return;\n    }\n    const result = await connectService.pollDevice({\n      webId: request.auth!.webId,\n      deployment: options.deployment,\n      provider: params.provider,\n      attemptId: stringBody(body.attemptId),\n      state: stringBody(body.state),\n      signature: stringBody(body.signature),\n      auth: request.auth,\n    });\n    sendJson(response, 200, publicConnectResult(result));\n  });\n\n  server.post('/api/ai/gateway/providers/:provider/connect/refresh', async (request, response, params) => {\n    if (!authorizeProviderConnect(request, response)) {\n      return;\n    }\n    const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n    if (!body) {\n      return;\n    }\n    const connectService = requireConnectService(options, response);\n    if (!connectService) {\n      return;\n    }\n    const record = await connectService.refresh({\n      webId: request.auth!.webId,\n      deployment: options.deployment,\n      provider: params.provider,\n      auth: request.auth,\n    });\n    sendJson(response, 200, { record: record ? publicCredentialRecord(record) : undefined });\n  });\n\n  server.delete('/api/ai/gateway/providers/:provider/connect', async (request, response, params) => {\n    if (!authorizeProviderConnect(request, response)) {\n      return;\n    }\n    const connectService = requireConnectService(options, response);\n    if (!connectService) {\n      return;\n    }\n    const record = await connectService.disconnect({\n      webId: request.auth!.webId,\n      deployment: options.deployment,\n      provider: params.provider,\n      auth: request.auth,\n    });\n    sendJson(response, 200, { record: record ? publicCredentialRecord(record) : undefined });\n  });\n\n  server.get('/api/ai/gateway/providers/:provider/connect/callback', async (_request, response) => {\n    // This endpoint is intentionally public only for signed one-time OAuth callbacks.\n    // Browser-assisted API key completion is never accepted here because API keys\n    // must be submitted through the authenticated management API.\n    sendJson(response, 405, {\n      error: 'Public Connect callback is unsupported for current provider Connect modes',\n    });\n  }, { public: true });\n\n  server.get('/api/ai/gateway/providers/:provider/quota/status', async (request, response, params) => {\n    if (!authorizeProviderQuota(request, response)) {\n      return;\n    }\n    const quotaService = requireQuotaService(options, response);\n    if (!quotaService) {\n      return;\n    }\n    const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n    try {\n      const result = await quotaService.status({\n        webId: request.auth.webId,\n        deployment: options.deployment,\n        provider: params.provider,\n        credentialIri: normalizeOptionalString(url.searchParams.get('credentialIri')),\n        refresh: false,\n      });\n      sendJson(response, 200, result);\n    } catch (error) {\n      sendQuotaError(response, error);\n    }\n  });\n\n  server.post('/api/ai/gateway/providers/:provider/quota/refresh', async (request, response, params) => {\n    if (!authorizeProviderQuota(request, response)) {\n      return;\n    }\n    const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n    if (!body) {\n      return;\n    }\n    const quotaService = requireQuotaService(options, response);\n    if (!quotaService) {\n      return;\n    }\n    try {\n      const result = await quotaService.status({\n        webId: request.auth.webId,\n        deployment: options.deployment,\n        provider: params.provider,\n        credentialIri: normalizeOptionalString(body.credentialIri),\n        refresh: true,\n      });\n      sendJson(response, 200, result);\n    } catch (error) {\n      sendQuotaError(response, error);\n    }\n  });\n}\n\nfunction authorizeGatewayKeyManagement(\n  request: AuthenticatedRequest,\n  response: ServerResponse,\n): boolean {\n  return authorizeManagementCaller(request, response, {\n    gatewayKeyPrincipalError: 'Gateway API keys cannot manage gateway keys',\n    nonSolidPrincipalError: 'Insufficient permissions',\n    allowServiceGatewayKeyManagement: true,\n  });\n}\n\nfunction authorizeManagementCaller(\n  request: AuthenticatedRequest,\n  response: ServerResponse,\n  options: {\n    gatewayKeyPrincipalError: string;\n    nonSolidPrincipalError: string;\n    allowServiceGatewayKeyManagement?: boolean;\n  },\n): boolean {\n  const auth = request.auth;\n  if (!auth) {\n    sendJson(response, 401, { error: 'Authentication required' });\n    return false;\n  }\n  if (auth.type === 'solid' && auth.webId) {\n    if (isGatewayApiKeyPrincipal(auth) && !isInternalGatewayInvocationPrincipal(auth)) {\n      sendJson(response, 403, { error: options.gatewayKeyPrincipalError });\n      return false;\n    }\n    return true;\n  }\n  if (options.allowServiceGatewayKeyManagement && canManageGatewayKeys(auth)) {\n    return true;\n  }\n  sendJson(response, 403, { error: options.nonSolidPrincipalError });\n  return false;\n}\n\nfunction authorizeCurrentSolidManagement(\n  request: AuthenticatedRequest,\n  response: ServerResponse,\n  options: {\n    gatewayKeyPrincipalError: string;\n    nonSolidPrincipalError: string;\n  },\n): request is AuthenticatedRequest & { auth: SolidAuthContext } {\n  if (!authorizeManagementCaller(request, response, options)) {\n    return false;\n  }\n  const auth = request.auth;\n  if (!auth || auth.type !== 'solid' || !auth.webId) {\n    sendJson(response, 403, { error: 'Insufficient permissions' });\n    return false;\n  }\n  return true;\n}\n\nfunction authorizeProviderConnect(\n  request: AuthenticatedRequest,\n  response: ServerResponse,\n): request is AuthenticatedRequest & { auth: Extract<NonNullable<AuthenticatedRequest['auth']>, { type: 'solid' }> } {\n  return authorizeCurrentSolidManagement(request, response, {\n    gatewayKeyPrincipalError: 'Gateway API keys cannot manage provider Connect state',\n    nonSolidPrincipalError: 'Provider Connect requires the current Solid identity',\n  });\n}\n\nfunction authorizeProviderQuota(\n  request: AuthenticatedRequest,\n  response: ServerResponse,\n): request is AuthenticatedRequest & { auth: Extract<NonNullable<AuthenticatedRequest['auth']>, { type: 'solid' }> } {\n  return authorizeCurrentSolidManagement(request, response, {\n    gatewayKeyPrincipalError: 'Gateway API keys cannot manage provider quota state',\n    nonSolidPrincipalError: 'Provider quota requires the current Solid identity',\n  });\n}\n\nfunction requireConnectService(\n  options: AiGatewayManagementHandlerOptions,\n  response: ServerResponse,\n): ProviderConnectService | undefined {\n  if (!options.connectService) {\n    sendJson(response, 503, { error: 'AI provider Connect service is not configured' });\n    return undefined;\n  }\n  return options.connectService;\n}\n\nfunction requireQuotaService(\n  options: AiGatewayManagementHandlerOptions,\n  response: ServerResponse,\n): ProviderQuotaService | undefined {\n  if (!options.quotaService) {\n    sendJson(response, 503, { error: 'AI provider quota service is not configured' });\n    return undefined;\n  }\n  return options.quotaService;\n}\n\nfunction sendQuotaError(response: ServerResponse, error: unknown): void {\n  const message = error instanceof Error ? error.message : String(error);\n  if (message === 'quota_credential_not_found') {\n    sendJson(response, 404, { error: 'Provider credential not found for current identity' });\n    return;\n  }\n  if (message.startsWith('quota_adapter_not_found:')) {\n    sendJson(response, 404, { error: 'Provider quota adapter not found' });\n    return;\n  }\n  sendJson(response, 500, { error: 'Provider quota lookup failed' });\n}\n\nasync function readJsonObject(\n  request: AuthenticatedRequest,\n  response: ServerResponse,\n  limitBytes: number,\n): Promise<Record<string, unknown> | undefined> {\n  const bodyResult = await readBoundedJsonBody(request, { limitBytes });\n  if (!bodyResult.ok) {\n    sendJson(response, bodyResult.status, { error: bodyResult.error });\n    return undefined;\n  }\n  const body = bodyResult.value;\n  if (!body || typeof body !== 'object' || Array.isArray(body)) {\n    sendJson(response, 400, { error: 'Request body must be a JSON object' });\n    return undefined;\n  }\n  return body as Record<string, unknown>;\n}\n\nfunction ownerForList(request: AuthenticatedRequest): string | undefined {\n  if (request.auth?.type === 'solid') {\n    return request.auth.webId;\n  }\n  const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n  return url.searchParams.get('owner') ?? undefined;\n}\n\nfunction normalizeScopes(value: unknown): string[] | undefined {\n  if (value === undefined) {\n    return [...DEFAULT_GATEWAY_API_KEY_SCOPES];\n  }\n  if (!Array.isArray(value) || value.length === 0) {\n    return undefined;\n  }\n  const scopes = value\n    .map((item) => typeof item === 'string' ? item.trim() : '')\n    .filter(Boolean);\n  if (scopes.length !== value.length) {\n    return undefined;\n  }\n  return [...new Set(scopes)];\n}\n\nfunction normalizeOptionalDate(value: unknown): Date | undefined {\n  if (value === undefined || value === null || value === '') {\n    return undefined;\n  }\n  if (typeof value !== 'string') {\n    return undefined;\n  }\n  const parsed = new Date(value);\n  return Number.isNaN(parsed.getTime()) ? undefined : parsed;\n}\n\nfunction normalizeOptionalString(value: unknown): string | undefined {\n  return typeof value === 'string' && value.trim() ? value.trim() : undefined;\n}\n\nfunction stringBody(value: unknown): string {\n  return typeof value === 'string' ? value : '';\n}\n\nfunction publicRecord(record: GatewayAccessKeyRecord): Record<string, unknown> {\n  return {\n    id: record.id,\n    owner: record.owner,\n    scopes: record.scopes,\n    createdAt: record.createdAt.toISOString(),\n    expiresAt: record.expiresAt?.toISOString(),\n    lastUsedAt: record.lastUsedAt?.toISOString(),\n    revokedAt: record.revokedAt?.toISOString(),\n    name: record.name,\n  };\n}\n\nfunction publicCredentialRecord(record: {\n  id: string;\n  credentialIri: string;\n  webId: string;\n  provider: string;\n  deployment: string;\n  authMode: string;\n  status: string;\n  accountLabel?: string;\n  expiresAt?: Date;\n  version?: number;\n  reauthRequired?: boolean;\n  metadata?: Record<string, unknown>;\n}): Record<string, unknown> {\n  return {\n    id: record.id,\n    credentialIri: record.credentialIri,\n    provider: record.provider,\n    authMode: record.authMode,\n    status: record.status,\n    accountLabel: record.accountLabel,\n    expiresAt: record.expiresAt?.toISOString(),\n    version: record.version,\n    reauthRequired: record.reauthRequired,\n  };\n}\n\nfunction publicConnectResult(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(publicConnectResult);\n  }\n  if (!value || typeof value !== 'object' || value instanceof Date) {\n    return value;\n  }\n  return Object.fromEntries(\n    Object.entries(value as Record<string, unknown>)\n      .filter(([key]) => ![\n        'deployment',\n        'webId',\n        'encryptedSecret',\n        'metadata',\n      ].includes(key))\n      .map(([key, item]) => [key, publicConnectResult(item)]),\n  );\n}\n\nfunction sendJson(response: ServerResponse, status: number, data: unknown): void {\n  response.statusCode = status;\n  response.setHeader('Content-Type', 'application/json');\n  response.end(JSON.stringify(data));\n}\n"]}

package/dist/api/handlers/ChatHandler.d.ts

@@ -1,5 +1,6 @@
 import type { ApiServer } from '../ApiServer';
 import type { AuthContext } from '../auth/AuthContext';
+import type { AiGatewayService } from '../ai-gateway/AiGatewayService';
 /**
  * Chat completion request (OpenAI-compatible)
  */
@@ -31,7 +32,7 @@ export interface ChatCompletionResponse {
             content: string | null;
             tool_calls?: unknown[];
         };
-        finish_reason: 'stop' | 'length' | 'content_filter' | 'tool_calls' | null;
+        finish_reason: 'stop' | 'length' | 'content_filter' | 'tool_calls' | string | null;
     }>;
     usage: {
         prompt_tokens: number;
@@ -40,8 +41,12 @@ export interface ChatCompletionResponse {
     };
 }
 export interface ChatHandlerOptions {
+    aiGatewayService?: AiGatewayService;
+    aiGatewayJsonBodyLimitBytes?: number;
+    acceptanceEndpointsEnabled?: boolean;
     /**
-     * Backend chat service to delegate to (e.g., OpenAI, local model)
+     * Legacy service type retained only so Task11 can migrate existing internal
+     * callers without forcing unrelated imports to change in this task.
      */
     chatService?: {
         complete(request: ChatCompletionRequest, auth: AuthContext): Promise<ChatCompletionResponse>;
@@ -50,19 +55,13 @@ export interface ChatHandlerOptions {
         messages?(body: any, auth: AuthContext): Promise<any>;
         listModels(auth?: AuthContext): Promise<any[]>;
     };
-    /**
-     * Pod base URL for storage
-     */
     podBaseUrl?: string;
 }
 /**
- * Handler for chat completions API (OpenAI-compatible)
- *
- * POST /v1/chat/completions - Create a chat completion
- * POST /v1/responses - Create a response (OpenAI Responses API)
- * POST /v1/messages - Create a message (Anthropic/OpenAI Threads compatible)
- * GET  /v1/models - List available models
+ * Register public AI-compatible routes.
  *
- * Supports both Solid Token (frontend) and CSS client credentials (third-party)
+ * The four `/v1/*` client-facing routes are owned by AiGatewayHandler. Legacy
+ * provider branching remains in VercelChatService until Task11, but it is no
+ * longer installed as a public route implementation here.
  */
 export declare function registerChatRoutes(server: ApiServer, options: ChatHandlerOptions): void;