@vectorlingo/cli 0.1.0

package/dist/credential-store.js

@@ -0,0 +1,528 @@
+import { constants } from 'node:fs';
+import { chmod, link, lstat, mkdir, open, readFile, rename, rm, } from 'node:fs/promises';
+import { homedir, platform } from 'node:os';
+import { dirname, join } from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+import { AgentError } from './contracts.js';
+export function defaultCredentialPath() {
+    const configRoot = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+    return join(configRoot, 'vectorlingo', 'credentials.json');
+}
+export function createCredentialStore(options = {}) {
+    const mode = options.mode ?? 'auto';
+    const filePath = options.filePath ?? defaultCredentialPath();
+    if (mode === 'file')
+        return new FileCredentialStore(filePath);
+    const backendFor = platformKeychain(options.service ?? 'VectorLingo Agent Access', dirname(filePath));
+    if (backendFor)
+        return new KeychainCredentialStore(backendFor, `${filePath}.lock`);
+    if (mode === 'keychain') {
+        throw new AgentError('keychain_unavailable', 'No supported operating-system keychain is available');
+    }
+    throw new AgentError('keychain_unavailable', 'No supported keychain is available; explicitly choose the private file credential store');
+}
+export class FileCredentialStore {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    async load() {
+        await validatePrivateFile(this.filePath);
+        try {
+            const value = JSON.parse(await readFile(this.filePath, 'utf8'));
+            return parseCredentialProfile(value);
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return undefined;
+            if (error instanceof AgentError)
+                throw error;
+            throw new AgentError('credential_store_corrupt', 'Credential file could not be read', {
+                cause: error,
+            });
+        }
+    }
+    async save(profile) {
+        await atomicPrivateWrite(this.filePath, JSON.stringify(parseCredentialProfile(profile)));
+    }
+    async clear() {
+        await rm(this.filePath, { force: true });
+    }
+    async update(updater) {
+        return withFileLock(`${this.filePath}.lock`, async () => {
+            const next = await updater(await this.load());
+            if (next === undefined)
+                await this.clear();
+            else
+                await this.save(next);
+            return next;
+        });
+    }
+}
+/**
+ * One keychain entry per deployment (issuer + resource), so logging in to a second deployment
+ * never overwrites the first. A separate `active` entry names the deployment that commands
+ * without a deployment of their own (tenant, execute, logout) use: the last one logged in to.
+ */
+export class KeychainCredentialStore {
+    backendFor;
+    lockPath;
+    constructor(backendFor, lockPath) {
+        this.backendFor = backendFor;
+        this.lockPath = lockPath;
+    }
+    get active() {
+        return this.backendFor('active');
+    }
+    async load(deployment) {
+        const account = deployment ? credentialAccountFor(deployment.issuer, deployment.resource) : await this.active.load();
+        if (account === undefined)
+            return undefined;
+        const value = await this.backendFor(account).load();
+        return value === undefined ? undefined : parseCredentialProfile(JSON.parse(value));
+    }
+    /** Locked like `update()`: two concurrent logins would otherwise race the sealing key (GLM W2). */
+    async save(profile) {
+        await withFileLock(this.lockPath, () => this.write(profile));
+    }
+    async write(profile) {
+        const account = credentialAccountFor(profile.issuer, profile.resource);
+        await this.backendFor(account).save(JSON.stringify(parseCredentialProfile(profile)));
+        await this.active.save(account);
+    }
+    async clear() {
+        const account = await this.active.load();
+        if (account !== undefined)
+            await this.backendFor(account).clear();
+        await this.active.clear();
+    }
+    async update(updater) {
+        return withFileLock(this.lockPath, async () => {
+            const next = await updater(await this.load());
+            if (next === undefined)
+                await this.clear();
+            else
+                await this.write(next);
+            return next;
+        });
+    }
+}
+/**
+ * macOS keeps only a random 256-bit key per entry in the keychain; the value itself is sealed with
+ * AES-256-GCM in a 0600 file. `security` takes a secret only in argv, on a tty prompt, or on stdin
+ * in `-i` mode, and `-i` hangs on lines near 4 KB — too short for a token profile, fine for a key.
+ * No secret is ever in argv, where process telemetry can log it (Codex Gate 3 r2 A H2).
+ */
+export class SealedFileSecret {
+    key;
+    filePath;
+    constructor(key, filePath) {
+        this.key = key;
+        this.filePath = filePath;
+    }
+    async load() {
+        await validatePrivateFile(this.filePath);
+        let sealed;
+        try {
+            sealed = await readFile(this.filePath, 'utf8');
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return undefined;
+            throw error;
+        }
+        const key = await this.key.load();
+        if (key === undefined)
+            throw corruptCredentialStore();
+        const [version, iv, tag, data] = sealed.split('.');
+        if (version !== 'v1' || !iv || !tag || data === undefined)
+            throw corruptCredentialStore();
+        try {
+            const decipher = createDecipheriv('aes-256-gcm', parseKey(key), Buffer.from(iv, 'base64'));
+            decipher.setAuthTag(Buffer.from(tag, 'base64'));
+            return Buffer.concat([decipher.update(Buffer.from(data, 'base64')), decipher.final()]).toString('utf8');
+        }
+        catch (error) {
+            throw new AgentError('credential_store_corrupt', 'Stored credentials are invalid', { cause: error });
+        }
+    }
+    async save(value) {
+        let key = await this.key.load();
+        // A non-key value is an entry from before sealing (the whole profile): replacing it with a key
+        // also scrubs that plaintext copy. The key is stored before the file, so a crash in between
+        // leaves no unreadable file.
+        if (key === undefined || !HEX_KEY.test(key)) {
+            key = randomBytes(32).toString('hex');
+            await this.key.save(key);
+        }
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', parseKey(key), iv);
+        const data = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()]);
+        await atomicPrivateWrite(this.filePath, ['v1', iv, cipher.getAuthTag(), data].map((part) => typeof part === 'string' ? part : part.toString('base64')).join('.'));
+    }
+    async clear() {
+        await rm(this.filePath, { force: true });
+        await this.key.clear();
+    }
+}
+const HEX_KEY = /^[0-9a-f]{64}$/;
+function parseKey(hex) {
+    if (!HEX_KEY.test(hex))
+        throw corruptCredentialStore();
+    return Buffer.from(hex, 'hex');
+}
+/** A short secret (the sealing key) in the user's default macOS keychain, written via `security -i` on stdin. */
+export class MacOsKeychain {
+    service;
+    account;
+    run;
+    constructor(service, account, run = runSecretCommand) {
+        this.service = service;
+        this.account = account;
+        this.run = run;
+        if (!/^[^"\\\s][^"\\\n]*$/.test(service) || !/^[^"\\\s]+$/.test(account)) {
+            throw new AgentError('keychain_error', 'Keychain service or account name is not safe to quote');
+        }
+    }
+    async load() {
+        const result = await this.run('security', ['find-generic-password', '-s', this.service, '-a', this.account, '-w']);
+        if (result.code === 44)
+            return undefined;
+        if (result.code !== 0)
+            throw keychainError('read', result.stderr);
+        return result.stdout.replace(/\r?\n$/, '');
+    }
+    async save(value) {
+        if (!/^[0-9a-f]{1,128}$/.test(value))
+            throw new AgentError('keychain_error', 'Only a short hex key may be written to the keychain');
+        const command = `add-generic-password -U -s "${this.service}" -a "${this.account}" -w ${value}\n`;
+        const result = await this.run('security', ['-i'], command);
+        // `-i` does not reliably report a failed inner command, so read the value back.
+        if (result.code !== 0 || (await this.load()) !== value)
+            throw keychainError('write', result.stderr);
+    }
+    async clear() {
+        const result = await this.run('security', ['delete-generic-password', '-s', this.service, '-a', this.account]);
+        if (result.code !== 0 && result.code !== 44)
+            throw keychainError('delete', result.stderr);
+    }
+}
+class LinuxSecretService {
+    service;
+    account;
+    constructor(service, account) {
+        this.service = service;
+        this.account = account;
+    }
+    async load() {
+        const result = await runSecretCommand('secret-tool', [
+            'lookup',
+            'service',
+            this.service,
+            'account',
+            this.account,
+        ]);
+        if (result.code === 1)
+            return undefined;
+        if (result.code !== 0)
+            throw keychainError('read', result.stderr);
+        return result.stdout.replace(/\r?\n$/, '');
+    }
+    async save(value) {
+        const result = await runSecretCommand('secret-tool', [
+            'store',
+            '--label=VectorLingo Agent Access',
+            'service',
+            this.service,
+            'account',
+            this.account,
+        ], value);
+        if (result.code !== 0)
+            throw keychainError('write', result.stderr);
+    }
+    async clear() {
+        const result = await runSecretCommand('secret-tool', [
+            'clear',
+            'service',
+            this.service,
+            'account',
+            this.account,
+        ]);
+        if (result.code !== 0 && result.code !== 1)
+            throw keychainError('delete', result.stderr);
+    }
+}
+function platformKeychain(service, directory) {
+    if (platform() === 'darwin' && commandExists('security')) {
+        return (account) => new SealedFileSecret(new MacOsKeychain(service, account), join(directory, `${account}.sealed`));
+    }
+    if (platform() === 'linux' && commandExists('secret-tool'))
+        return (account) => new LinuxSecretService(service, account);
+    return undefined;
+}
+function commandExists(command) {
+    const result = spawnSync(command, ['--help'], { stdio: 'ignore' });
+    return !result.error;
+}
+async function atomicPrivateWrite(filePath, contents) {
+    const directory = dirname(filePath);
+    await ensurePrivateDirectory(directory);
+    const temporary = `${filePath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
+    const handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+    try {
+        await handle.writeFile(contents, 'utf8');
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await rename(temporary, filePath);
+        await chmod(filePath, 0o600);
+    }
+    catch (error) {
+        await rm(temporary, { force: true });
+        throw error;
+    }
+}
+/**
+ * Create the credential directory 0700 when missing. An existing directory (for example the
+ * parent of a `--credential-file` path) is never re-permissioned; it is refused when other
+ * users could write to it, because they could then replace the credential file.
+ */
+async function ensurePrivateDirectory(directory) {
+    const created = await mkdir(directory, { recursive: true, mode: 0o700 });
+    const info = await lstat(directory);
+    if (!info.isDirectory() || info.isSymbolicLink()) {
+        throw new AgentError('unsafe_credential_path', 'Credential directory must be a real directory');
+    }
+    if (created !== undefined)
+        await chmod(directory, 0o700);
+    else if ((info.mode & 0o022) !== 0) {
+        throw new AgentError('unsafe_credential_permissions', `Credential directory ${directory} must not be group- or world-writable`);
+    }
+}
+async function validatePrivateFile(filePath) {
+    try {
+        const info = await lstat(filePath);
+        if (!info.isFile() || info.isSymbolicLink()) {
+            throw new AgentError('unsafe_credential_path', 'Credential path must be a regular file');
+        }
+        if ((info.mode & 0o077) !== 0) {
+            throw new AgentError('unsafe_credential_permissions', 'Credential file permissions must be 0600');
+        }
+    }
+    catch (error) {
+        if (!isNotFound(error))
+            throw error;
+    }
+}
+async function withFileLock(lockPath, task) {
+    await ensurePrivateDirectory(dirname(lockPath));
+    // Resolved before the lock exists, so a failed `ps` cannot leave an ownerless lock behind.
+    const owner = `${lockOwner(process.pid)}\n`;
+    const deadline = Date.now() + 10_000;
+    let lock;
+    while (!lock) {
+        try {
+            lock = await open(lockPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+        }
+        catch (error) {
+            if (!isExists(error))
+                throw error;
+            if (await reclaimStaleLock(lockPath))
+                continue;
+            if (Date.now() >= deadline) {
+                throw new AgentError('credential_store_busy', `Timed out waiting for the credential store lock ${lockPath}`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 25 + Math.floor(Math.random() * 25)));
+        }
+    }
+    try {
+        await lock.writeFile(owner, 'utf8');
+        return await task();
+    }
+    finally {
+        await lock.close();
+        await rm(lockPath, { force: true });
+    }
+}
+const STALE_LOCK_MS = 60_000;
+/**
+ * A lock records `<pid> <process start time>`. It is stale when its owner has exited (Ctrl-C
+ * skips `finally`), when its PID now belongs to a different process (PID reuse after a crash:
+ * the start time differs), or when it is ownerless and older than a minute (its writer died
+ * before writing). A live owner is never reclaimed: a slow refresh must not be joined, and a
+ * hung keychain command is bounded by `runSecretCommand`'s timeout instead. A stale lock is
+ * renamed away before removal, so of two processes reclaiming the same stale lock only one
+ * rename succeeds and the loser retries. A loser that judged the old lock
+ * stale but renames after the winner re-locked has moved the winner's fresh lock: the identity
+ * check (inode, mtime and content — Linux reuses a freed inode at once) sees that and links it
+ * back (the sealed save writes a random key, so two holders would leave the profile unreadable).
+ * ponytail: a third process that locks inside that rename/link gap still overlaps the winner.
+ */
+async function reclaimStaleLock(lockPath) {
+    let identity;
+    try {
+        identity = await readLockIdentity(lockPath);
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return true;
+        throw error;
+    }
+    const [pidText, ...startParts] = identity.content.trim().split(' ');
+    const owner = Number.parseInt(pidText ?? '', 10);
+    const recordedStart = startParts.join(' ');
+    const ageMs = Date.now() - identity.mtimeMs;
+    // An empty PID is a lock still being written; only its age can make it stale. A lock without
+    // a start time (older CLI, or Windows) falls back to PID liveness alone.
+    if (Number.isInteger(owner) && owner > 0) {
+        if (processIsAlive(owner) && (!recordedStart || processStartTime(owner) === recordedStart))
+            return false;
+    }
+    else if (ageMs < STALE_LOCK_MS) {
+        return false;
+    }
+    await claimStaleLock(lockPath, identity);
+    return true;
+}
+/** Inode, mtime and content read through one handle, so they describe the same file. */
+export async function readLockIdentity(lockPath) {
+    const handle = await open(lockPath, 'r');
+    try {
+        const stat = await handle.stat();
+        return { ino: stat.ino, mtimeMs: stat.mtimeMs, content: await handle.readFile('utf8') };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Remove the lock at `lockPath` only if it is still the file judged stale. Exported for tests. */
+export async function claimStaleLock(lockPath, stale) {
+    const claimed = `${lockPath}.${process.pid}.${randomBytes(8).toString('hex')}.stale`;
+    try {
+        await rename(lockPath, claimed);
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return;
+        throw error;
+    }
+    try {
+        const moved = await readLockIdentity(claimed);
+        if (moved.ino !== stale.ino || moved.mtimeMs !== stale.mtimeMs || moved.content !== stale.content) {
+            try {
+                await link(claimed, lockPath);
+            }
+            catch (error) {
+                if (!isExists(error))
+                    throw error;
+            }
+        }
+    }
+    finally {
+        await rm(claimed, { force: true });
+    }
+}
+function lockOwner(pid) {
+    const start = processStartTime(pid);
+    return start ? `${pid} ${start}` : String(pid);
+}
+/**
+ * The process's start time from `ps` (same `lstart` format on macOS and Linux under `LC_ALL=C`),
+ * or `undefined` when no such process exists. `lstart` is wall-clock time, so `TZ=UTC` keeps
+ * two CLIs with different time zones from reading one live owner as a reused PID.
+ * ponytail: Windows has no `ps`, so its locks record the PID alone and PID reuse there still
+ * needs the lock file removed by hand; add a Windows process-identity lookup if it ships there.
+ */
+function processStartTime(pid) {
+    if (platform() === 'win32')
+        return undefined;
+    const result = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+        encoding: 'utf8',
+        env: { ...process.env, LC_ALL: 'C', TZ: 'UTC' },
+    });
+    if (result.error)
+        throw result.error;
+    const start = result.stdout.trim();
+    if (result.status === 0 && start)
+        return start;
+    if (result.status === 1 && !start)
+        return undefined;
+    throw new Error(`ps could not read process ${pid} (exit ${result.status}): ${result.stderr.slice(0, 200)}`);
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM: the process exists but belongs to another user.
+        return error.code !== 'ESRCH';
+    }
+}
+function parseCredentialProfile(value) {
+    if (typeof value !== 'object' || value === null)
+        throw corruptCredentialStore();
+    const profile = value;
+    const tokens = profile.tokens;
+    if (typeof profile.baseUrl !== 'string' ||
+        typeof profile.issuer !== 'string' ||
+        typeof profile.resource !== 'string' ||
+        typeof profile.clientId !== 'string' ||
+        typeof tokens?.accessToken !== 'string' ||
+        tokens.tokenType !== 'Bearer' ||
+        typeof tokens.expiresAt !== 'number' ||
+        (tokens.refreshToken !== undefined && typeof tokens.refreshToken !== 'string') ||
+        (profile.selectedTenantId !== undefined && typeof profile.selectedTenantId !== 'string')) {
+        throw corruptCredentialStore();
+    }
+    return profile;
+}
+function corruptCredentialStore() {
+    return new AgentError('credential_store_corrupt', 'Stored credentials are invalid');
+}
+function keychainError(action, stderr) {
+    return new AgentError('keychain_error', `Operating-system keychain ${action} failed`, {
+        details: stderr ? { diagnostic: stderr.slice(0, 200) } : undefined,
+    });
+}
+/**
+ * Run a keychain helper. The timeout bounds a hung helper, so the caller fails and releases the
+ * credential lock instead of holding it forever; 60 s leaves room for a macOS Keychain prompt.
+ * Exported for tests.
+ */
+export function runSecretCommand(command, args, stdin, timeoutMs = 60_000) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'pipe'], timeout: timeoutMs, killSignal: 'SIGKILL' });
+        const stdout = [];
+        const stderr = [];
+        child.stdout.on('data', (chunk) => stdout.push(chunk));
+        child.stderr.on('data', (chunk) => stderr.push(chunk));
+        child.on('error', reject);
+        child.on('close', (code, signal) => {
+            if (signal) {
+                reject(new AgentError('keychain_error', 'Operating-system keychain command timed out'));
+                return;
+            }
+            resolve({
+                code: code ?? 1,
+                stdout: Buffer.concat(stdout).toString('utf8'),
+                stderr: Buffer.concat(stderr).toString('utf8'),
+            });
+        });
+        child.stdin.end(stdin);
+    });
+}
+function isNotFound(error) {
+    return error?.code === 'ENOENT';
+}
+function isExists(error) {
+    return error?.code === 'EEXIST';
+}
+export function credentialAccountFor(issuer, resource) {
+    return createHash('sha256').update(`${issuer}\n${resource}`).digest('hex').slice(0, 32);
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EACL,KAAK,EACL,IAAI,EACJ,KAAK,EACL,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,EAAE,GACH,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AA2C3C,MAAM,UAAU,qBAAqB;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IAC5E,OAAO,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAwC,EAAE;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAA;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,qBAAqB,EAAE,CAAA;IAC5D,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAE7D,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,IAAI,0BAA0B,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACrG,IAAI,UAAU;QAAE,OAAO,IAAI,uBAAuB,CAAC,UAAU,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAA;IAClF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,qDAAqD,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,IAAI,UAAU,CAClB,sBAAsB,EACtB,yFAAyF,CAC1F,CAAA;AACH,CAAC;AAED,MAAM,OAAO,mBAAmB;IACT;IAArB,YAAqB,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEzC,KAAK,CAAC,IAAI;QACR,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAY,CAAA;YAC1E,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YACvC,IAAI,KAAK,YAAY,UAAU;gBAAE,MAAM,KAAK,CAAA;YAC5C,MAAM,IAAI,UAAU,CAAC,0BAA0B,EAAE,mCAAmC,EAAE;gBACpF,KAAK,EAAE,KAAK;aACb,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAA0B;QACnC,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAA2F;QAE3F,OAAO,YAAY,CAAC,GAAG,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7C,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;;gBACrC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC1B,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAQD;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IAEf;IACA;IAFnB,YACmB,UAA8C,EAC9C,QAAgB;QADhB,eAAU,GAAV,UAAU,CAAoC;QAC9C,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAiC;QAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QACpH,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QACnD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC,CAAA;IAC/F,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,IAAI,CAAC,OAA0B;QACnC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAA0B;QAC5C,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QACtE,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACpF,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAA;QACjE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAA2F;QAE3F,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7C,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;;gBACrC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAID;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IAER;IACA;IAFnB,YACmB,GAAkB,EAClB,QAAgB;QADhB,QAAG,GAAH,GAAG,CAAe;QAClB,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YACvC,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,sBAAsB,EAAE,CAAA;QACrD,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,sBAAsB,EAAE,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC1F,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACzG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,0BAA0B,EAAE,gCAAgC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACtG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC/B,+FAA+F;QAC/F,4FAA4F;QAC5F,6BAA6B;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YACrC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QACD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QAC1E,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACzF,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzE,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACxC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;IACxB,CAAC;CACF;AAED,MAAM,OAAO,GAAG,gBAAgB,CAAA;AAEhC,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,sBAAsB,EAAE,CAAA;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAChC,CAAC;AAED,iHAAiH;AACjH,MAAM,OAAO,aAAa;IAEL;IACA;IACA;IAHnB,YACmB,OAAe,EACf,OAAe,EACf,MAA2B,gBAAgB;QAF3C,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAQ;QACf,QAAG,GAAH,GAAG,CAAwC;QAE5D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAA;QACjG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;QAClH,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;YAAE,OAAO,SAAS,CAAA;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACjE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,qDAAqD,CAAC,CAAA;QACnI,MAAM,OAAO,GAAG,+BAA+B,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,IAAI,CAAA;QACjG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;QAC1D,gFAAgF;QAChF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK;YAAE,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACrG,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9G,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;YAAE,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3F,CAAC;CACF;AAED,MAAM,kBAAkB;IAEH;IACA;IAFnB,YACmB,OAAe,EACf,OAAe;QADf,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAQ;IAC/B,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE;YACnD,QAAQ;YACR,SAAS;YACT,IAAI,CAAC,OAAO;YACZ,SAAS;YACT,IAAI,CAAC,OAAO;SACb,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QACvC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACjE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,aAAa,EACb;YACE,OAAO;YACP,kCAAkC;YAClC,SAAS;YACT,IAAI,CAAC,OAAO;YACZ,SAAS;YACT,IAAI,CAAC,OAAO;SACb,EACD,KAAK,CACN,CAAA;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE;YACnD,OAAO;YACP,SAAS;YACT,IAAI,CAAC,OAAO;YACZ,SAAS;YACT,IAAI,CAAC,OAAO;SACb,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC1F,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,SAAiB;IAC1D,IAAI,QAAQ,EAAE,KAAK,QAAQ,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,SAAS,CAAC,CAAC,CAAA;IACrH,CAAC;IACD,IAAI,QAAQ,EAAE,KAAK,OAAO,IAAI,aAAa,CAAC,aAAa,CAAC;QAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACxH,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;AACtB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAA;IACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACtG,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACxC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACjC,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACpC,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACrD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAA;IACnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,+CAA+C,CAAC,CAAA;IACjG,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;SACnD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,+BAA+B,EAAE,wBAAwB,SAAS,uCAAuC,CAAC,CAAA;IACjI,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,wCAAwC,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,UAAU,CAAC,+BAA+B,EAAE,0CAA0C,CAAC,CAAA;QACnG,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAA;IACrC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAI,QAAgB,EAAE,IAAsB;IACrE,MAAM,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC/C,2FAA2F;IAC3F,MAAM,KAAK,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAA;IACpC,IAAI,IAAkD,CAAA;IACtD,OAAO,CAAC,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAA;YACjC,IAAI,MAAM,gBAAgB,CAAC,QAAQ,CAAC;gBAAE,SAAQ;YAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAE,mDAAmD,QAAQ,EAAE,CAAC,CAAA;YAC9G,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACnC,OAAO,MAAM,IAAI,EAAE,CAAA;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAClB,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrC,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,MAAM,CAAA;AAE5B;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,QAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,KAAK,CAAA;IACb,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAA;IAC3C,6FAA6F;IAC7F,yEAAyE;IACzE,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC;YAAE,OAAO,KAAK,CAAA;IAC1G,CAAC;SAAM,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;QACjC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACxC,OAAO,IAAI,CAAA;AACb,CAAC;AAQD,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAChC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAA;IACzF,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAmB;IACxE,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAA;IACpF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAM;QAC7B,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YAClG,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;QACnE,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE;KAChD,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,KAAK,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IACnD,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,UAAU,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;AAC7G,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yDAAyD;QACzD,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAA;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,sBAAsB,EAAE,CAAA;IAC/E,MAAM,OAAO,GAAG,KAAmC,CAAA;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAA0C,CAAA;IACjE,IACE,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACnC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACpC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACpC,OAAO,MAAM,EAAE,WAAW,KAAK,QAAQ;QACvC,MAAM,CAAC,SAAS,KAAK,QAAQ;QAC7B,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC;QAC9E,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC,EACxF,CAAC;QACD,MAAM,sBAAsB,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,OAA4B,CAAA;AACrC,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,IAAI,UAAU,CAAC,0BAA0B,EAAE,gCAAgC,CAAC,CAAA;AACrF,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,MAAc;IACnD,OAAO,IAAI,UAAU,CAAC,gBAAgB,EAAE,6BAA6B,MAAM,SAAS,EAAE;QACpF,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,IAAc,EACd,KAAc,EACd,SAAS,GAAG,MAAM;IAElB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QAClH,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,UAAU,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,CAAC,CAAA;gBACvF,OAAM;YACR,CAAC;YACD,OAAO,CAAC;gBACN,IAAI,EAAE,IAAI,IAAI,CAAC;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC/C,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAQ,KAA2C,EAAE,IAAI,KAAK,QAAQ,CAAA;AACxE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAQ,KAA2C,EAAE,IAAI,KAAK,QAAQ,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAAgB;IACnE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACzF,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,7 @@
+export type FetchLike = typeof globalThis.fetch;
+export declare function validateServiceUrl(rawUrl: string, label?: string): URL;
+export declare function validateLoopbackRedirect(rawUrl: string): URL;
+export declare function isLoopbackHostname(hostname: string): boolean;
+export declare function parseAgentResponse<T>(response: Response): Promise<T>;
+export declare function joinUrl(baseUrl: URL, path: string): URL;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,OAAO,UAAU,CAAC,KAAK,CAAA;AAE/C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAgB,GAAG,GAAG,CAmB7E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAS5D;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG5D;AAED,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAsB1E;AAqCD,wBAAgB,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,GAAG,CAGvD"}

package/dist/http.js

@@ -0,0 +1,92 @@
+import { AgentError } from './contracts.js';
+export function validateServiceUrl(rawUrl, label = 'Service URL') {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch (cause) {
+        throw new AgentError('invalid_configuration', `${label} is not a valid URL`, { cause });
+    }
+    if (url.username || url.password || url.hash) {
+        throw new AgentError('invalid_configuration', `${label} must not contain credentials or a fragment`);
+    }
+    if (url.protocol === 'https:')
+        return url;
+    if (url.protocol === 'http:' && isLoopbackHostname(url.hostname))
+        return url;
+    throw new AgentError('insecure_url', `${label} must use HTTPS (HTTP is allowed only for a loopback address)`);
+}
+export function validateLoopbackRedirect(rawUrl) {
+    const url = validateServiceUrl(rawUrl, 'OAuth redirect URL');
+    if (url.protocol !== 'http:' || !isLoopbackHostname(url.hostname)) {
+        throw new AgentError('insecure_redirect', 'OAuth redirect URL must use HTTP on a loopback address');
+    }
+    return url;
+}
+export function isLoopbackHostname(hostname) {
+    const value = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    return value === 'localhost' || value === '127.0.0.1' || value === '::1';
+}
+export async function parseAgentResponse(response) {
+    const contentType = response.headers.get('content-type') ?? '';
+    const body = contentType.includes('application/json')
+        ? await response.json().catch(() => undefined)
+        : undefined;
+    if (response.ok)
+        return body;
+    const remote = isAgentErrorResponse(body) ? body.error : undefined;
+    const retryAfter = parseRetryAfter(response.headers.get('retry-after'));
+    const operationId = remote?.operation_id;
+    const retryAfterSeconds = remote?.retry_after_seconds ?? retryAfter;
+    throw new AgentError(remote?.code ?? httpErrorCode(response.status), remote?.message ?? safeStatus(response), {
+        ...(remote?.details === undefined ? {} : { details: remote.details }),
+        httpStatus: response.status,
+        ...(operationId === undefined ? {} : { operationId }),
+        ...(retryAfterSeconds === undefined ? {} : { retryAfterSeconds }),
+    });
+}
+function isAgentErrorResponse(value) {
+    if (typeof value !== 'object' || value === null || !('error' in value))
+        return false;
+    const error = value.error;
+    return (typeof error === 'object' &&
+        error !== null &&
+        typeof error.code === 'string' &&
+        typeof error.message === 'string');
+}
+function safeStatus(response) {
+    return `VectorLingo request failed with HTTP ${response.status}`;
+}
+function httpErrorCode(status) {
+    if (status === 400)
+        return 'invalid_request';
+    if (status === 401)
+        return 'authentication_required';
+    if (status === 403)
+        return 'forbidden';
+    if (status === 404)
+        return 'not_found';
+    if (status === 409)
+        return 'conflict';
+    if (status === 413)
+        return 'payload_too_large';
+    if (status === 429)
+        return 'rate_limited';
+    return status >= 500 ? 'service_error' : 'request_failed';
+}
+function parseRetryAfter(value) {
+    if (value === null)
+        return undefined;
+    const seconds = Number(value);
+    if (Number.isInteger(seconds) && seconds >= 0)
+        return seconds;
+    const date = Date.parse(value);
+    if (Number.isNaN(date))
+        return undefined;
+    return Math.max(0, Math.ceil((date - Date.now()) / 1000));
+}
+export function joinUrl(baseUrl, path) {
+    const root = baseUrl.href.endsWith('/') ? baseUrl : new URL(`${baseUrl.href}/`);
+    return new URL(path.replace(/^\//, ''), root);
+}
+//# sourceMappingURL=http.js.map