@zhihaohong52/sonata 0.4.0

package/dist/native/router.js

@@ -0,0 +1,469 @@
+import { createServer } from 'node:http';
+import { createUsageCollector, usageFromJsonBody } from './usage.js';
+const HOP_BY_HOP_HEADERS = new Set([
+    'content-encoding',
+    'transfer-encoding',
+    'content-length',
+    'connection',
+]);
+function targetUrl(base, url) {
+    return `${base.replace(/\/$/, '')}/${url.replace(/^\//, '')}`;
+}
+function requestHeaders(headers) {
+    return Object.fromEntries(Object.entries(headers).filter(([name]) => !['host', 'content-length'].includes(name.toLowerCase())));
+}
+function responseHeaders(headers) {
+    return Object.fromEntries([...headers.entries()].filter(([name]) => !HOP_BY_HOP_HEADERS.has(name.toLowerCase())));
+}
+async function* responseBody(body) {
+    const reader = body.getReader();
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                return;
+            yield value;
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+async function drainBody(body) {
+    if (Buffer.isBuffer(body))
+        return;
+    try {
+        for await (const _chunk of body) { /* discard */ }
+    }
+    catch { /* the body failing to drain is not itself an error */ }
+}
+/**
+ * Lets the client advance before inspecting its chunk. This keeps accounting
+ * off the response critical path; `finally` also accounts for disconnects.
+ */
+async function* observe(body, onChunk, onEnd) {
+    let complete = false;
+    try {
+        for await (const chunk of body) {
+            yield chunk;
+            try {
+                onChunk(chunk);
+            }
+            catch { /* A malformed frame must not interrupt the response. */ }
+        }
+        complete = true;
+    }
+    finally {
+        try {
+            onEnd(complete);
+        }
+        catch { /* Ledger failures must not escape a disconnected stream either. */ }
+    }
+}
+function headerNumber(headers, name) {
+    const value = Number(headers[name]);
+    return Number.isFinite(value) ? value : undefined;
+}
+/**
+ * Adds accounting only when requested. The guard intentionally covers parsing,
+ * timestamps, and emission: a ledger defect cannot change router behaviour.
+ */
+function withUsageRecording(response, ctx, deps) {
+    if (deps.recordUsage === undefined)
+        return response;
+    try {
+        const now = deps.now ?? Date.now;
+        const fallbacks = headerNumber(response.headers, 'x-litellm-attempted-fallbacks');
+        const retries = headerNumber(response.headers, 'x-litellm-attempted-retries');
+        const emit = (tokens, complete) => {
+            try {
+                const endedAt = now();
+                deps.recordUsage?.({
+                    // Priced at request start, not completion (spec §3): a stream that
+                    // crosses a price-window boundary must keep the rate it started
+                    // under. `ms` is the genuine duration and stays tied to `endedAt`.
+                    ts: new Date(ctx.startedAt).toISOString(),
+                    ms: endedAt - ctx.startedAt,
+                    session: ctx.session,
+                    alias: ctx.alias,
+                    role: ctx.role,
+                    tier: ctx.tier,
+                    key: ctx.key,
+                    gateway: ctx.gateway,
+                    upstream: ctx.upstream,
+                    litellmModel: response.headers['x-litellm-model-name'],
+                    callId: response.headers['x-litellm-call-id'],
+                    status: response.status,
+                    complete,
+                    tokens,
+                    // The router knows observations, while serve owns pricing config.
+                    price: { source: 'none' },
+                    attempts: ctx.attempts,
+                    litellm: fallbacks === undefined && retries === undefined
+                        ? undefined
+                        : { fallbacks: fallbacks ?? 0, retries: retries ?? 0 },
+                });
+            }
+            catch { /* Accounting is strictly best-effort. */ }
+        };
+        if (Buffer.isBuffer(response.body)) {
+            const { tokens, complete } = usageFromJsonBody(response.body);
+            emit(tokens, complete);
+            return response;
+        }
+        const collector = createUsageCollector();
+        return {
+            ...response,
+            body: observe(response.body, (chunk) => collector.push(chunk), (streamComplete) => {
+                const { tokens, complete } = collector.finish();
+                emit(tokens, streamComplete && complete);
+            }),
+        };
+    }
+    catch {
+        return response;
+    }
+}
+/**
+ * The model a request names, for logging which upstream served it.
+ *
+ * Without this the routing decision is invisible: LiteLLM's access log records
+ * the path and status but not the model, so "did this agent really run on the
+ * foreign model?" could only be answered by inference.
+ */
+export function requestedModel(body) {
+    try {
+        const model = JSON.parse(body.toString()).model;
+        return typeof model === 'string' ? model : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Rewrites only the `model` field of a JSON body; returns it unchanged if it does not parse. */
+export function withModel(body, model) {
+    let payload;
+    try {
+        payload = JSON.parse(body.toString());
+    }
+    catch {
+        return body;
+    }
+    return Buffer.from(JSON.stringify({ ...payload, model }));
+}
+export const TIER_COOLDOWN_MS = 60_000;
+/** Module-level so a cooling-down key stays cool across requests. Test seam: `clearCooldowns()`. */
+const cooldowns = new Map();
+export function clearCooldowns() {
+    cooldowns.clear();
+}
+/**
+ * An Anthropic-shaped error body: `{"type":"error","error":{"type":...,
+ * "message":...}}`. An Anthropic-compatible client (Claude Code included)
+ * expects this exact envelope on every path — a flat `{type, message}` or a
+ * bare `{error: {...}}` with no top-level `type: "error"` is silently
+ * discarded, surfacing a generic error instead of the actual message (in
+ * particular, the fallback command a tier's 529 names to activate harness
+ * dispatch).
+ */
+function anthropicErrorBody(type, message) {
+    return Buffer.from(JSON.stringify({ type: 'error', error: { type, message } }));
+}
+function isClaudeRequest(body) {
+    try {
+        return JSON.parse(body.toString()).model?.startsWith('claude-') === true;
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Flattens an Anthropic `system` block array into a single string.
+ *
+ * Claude Code always sends `system` as an array of text blocks. LiteLLM turns a
+ * *string* system prompt into a `developer` message, which the Codex backend
+ * accepts, but leaves block arrays as role `system` — and that backend answers
+ * `{"detail":"System messages are not allowed"}`, a 400 naming neither the
+ * field nor the shape. Probed directly: a string system prompt succeeds, the
+ * identical text as a one-element array fails.
+ *
+ * So the array is joined here, before LiteLLM sees it. The text is unchanged
+ * and its order preserved; only the shape differs, and the string form is the
+ * one both sides agree on. `cache_control` is dropped with the blocks, which
+ * costs prompt caching on this path — the alternative is a request that cannot
+ * be sent at all.
+ *
+ * Returns the body untouched unless it is JSON with a non-empty `system` array:
+ * an empty array is already accepted, and a non-JSON body is not ours to parse.
+ */
+export function flattenSystemBlocks(body) {
+    let payload;
+    try {
+        payload = JSON.parse(body.toString());
+    }
+    catch {
+        return body;
+    }
+    const system = payload.system;
+    if (!Array.isArray(system) || system.length === 0)
+        return body;
+    const text = system
+        .map((block) => {
+        if (typeof block === 'string')
+            return block;
+        const { type, text: blockText } = (block ?? {});
+        // Only text blocks carry a prompt. Anything else (an image, a shape added
+        // later) has no string form, so leaving the body alone is safer than
+        // silently dropping content.
+        return type === 'text' && typeof blockText === 'string' ? blockText : null;
+    })
+        .filter((part) => part !== null);
+    if (text.length !== system.length)
+        return body;
+    return Buffer.from(JSON.stringify({ ...payload, system: text.join('\n\n') }));
+}
+/**
+ * Forwards an already-litellm-shaped request (auth swapped, system flattened,
+ * model rewritten if this is a tier candidate) and applies the 500->529
+ * empty-completion rewrite. Shared by the plain litellm path and the tier
+ * fallback loop so the two forwarding paths cannot drift apart.
+ */
+async function forwardToLitellm(body, headers, req, deps) {
+    try {
+        await deps.litellmReady?.();
+        const response = await deps.fetch(targetUrl(deps.litellmBase, req.url), { method: req.method, headers, body: body.length > 0 ? body : undefined });
+        // LiteLLM returns 500 when ChatGPT's Codex endpoint yields output:[]. That
+        // usually means the upstream was overloaded and returned an empty completion
+        // rather than a real error. Re-emitting it as 529 (overloaded) lets Claude
+        // Code treat it as a retriable backpressure signal rather than a hard fault.
+        if (response.status === 500) {
+            const responseBodyBuf = response.body === null
+                ? Buffer.alloc(0)
+                : Buffer.concat(await async function () { const chunks = []; for await (const c of responseBody(response.body))
+                    chunks.push(Buffer.from(c)); return chunks; }());
+            const text = responseBodyBuf.toString();
+            if (text.includes('Unknown items in responses API response')) {
+                const msg = 'upstream returned empty completion (overloaded) — retry';
+                deps.log?.(`router: 500 from litellm rewritten to 529 (${requestedModel(body) ?? '?'}): empty output`);
+                return {
+                    status: 529,
+                    headers: { 'content-type': 'application/json' },
+                    body: anthropicErrorBody('overloaded_error', msg),
+                };
+            }
+            return {
+                status: response.status,
+                headers: responseHeaders(response.headers),
+                body: responseBodyBuf,
+            };
+        }
+        return {
+            status: response.status,
+            headers: responseHeaders(response.headers),
+            body: response.body === null ? Buffer.alloc(0) : responseBody(response.body),
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            status: 502,
+            headers: { 'content-type': 'application/json' },
+            body: anthropicErrorBody('router_error', message),
+        };
+    }
+}
+function litellmHeaders(headers, litellmKey) {
+    const out = { ...headers };
+    for (const name of Object.keys(out)) {
+        if (name.toLowerCase() === 'authorization' || name.toLowerCase() === 'x-api-key')
+            delete out[name];
+    }
+    out.authorization = `Bearer ${litellmKey}`;
+    return out;
+}
+/**
+ * Tries each native-routed candidate for a `sonata-<role>-<tier>` alias in
+ * rank order, skipping any inside its post-failure cooldown window. The first
+ * response that is neither ≥500, 429, nor a candidate-specific auth failure
+ * (401/403) goes to the client — retry is inherently pre-first-byte, so this
+ * never interferes with an in-progress stream.
+ */
+async function routeTierRequest(req, deps, alias, startedAt, session) {
+    // Once per request, not once per candidate: a candidate skipped for being
+    // in its post-failure cooldown window would otherwise mean this never
+    // fires at all, silently masking a real config change behind an unrelated
+    // stale cooldown until it expires on its own.
+    deps.checkModelChange?.();
+    const resolved = deps.resolveTier?.(alias);
+    if (resolved === undefined) {
+        return {
+            status: 400,
+            headers: { 'content-type': 'application/json' },
+            body: anthropicErrorBody('invalid_request_error', `unknown sonata tier alias "${alias}" — run \`sonata sync\` and check [tiers] in sonata.toml`),
+        };
+    }
+    const now = deps.now ?? Date.now;
+    const headers = litellmHeaders(requestHeaders(req.headers), deps.litellmKey);
+    const flattened = flattenSystemBlocks(req.body);
+    const candidates = resolved.routes.filter((route) => route.native !== undefined);
+    const attempts = [];
+    for (const route of candidates) {
+        const until = cooldowns.get(route.key);
+        if (until !== undefined && until > now())
+            continue;
+        const body = withModel(flattened, route.key);
+        const response = await forwardToLitellm(body, headers, { ...req, body }, deps);
+        // 429 is treated as a failure alongside 5xx (not as one of "our" 4xx
+        // mistakes to return as-is): it's the upstream saying it's overloaded,
+        // exactly the transient case ranked fallback exists for. 401/403 are also
+        // retried — they are credential failures specific to THIS candidate's
+        // gateway (an expired or rejected key), so a later candidate on a
+        // different gateway with a working credential is worth trying, and they
+        // must not take down every tier that ranks the affected gateway first.
+        // Every other 4xx (e.g. 400) means the request itself was wrong, which
+        // retrying can't fix.
+        if (response.status >= 500 || response.status === 429 || response.status === 401 || response.status === 403) {
+            await drainBody(response.body);
+            attempts.push({ key: route.key, status: response.status });
+            cooldowns.set(route.key, now() + TIER_COOLDOWN_MS);
+            deps.log?.(`router: ${route.key} failed (${response.status}), trying next`);
+            continue;
+        }
+        deps.log?.(`${req.method} ${req.url} model=${alias} -> ${route.key} -> litellm`);
+        return withUsageRecording(response, {
+            startedAt,
+            session,
+            alias,
+            role: resolved.role,
+            tier: resolved.tier,
+            key: route.key,
+            gateway: route.native.gateway,
+            upstream: 'litellm',
+            attempts,
+        }, deps);
+    }
+    const label = `${resolved.role}-${resolved.tier}`;
+    deps.log?.(`router: all native routes for ${label} failed`);
+    return withUsageRecording({
+        status: 529,
+        headers: { 'content-type': 'application/json' },
+        body: anthropicErrorBody('overloaded_error', `all native routes for ${label} failed; fall back with: ` +
+            `sonata dispatch --tier ${label} --task-file <path> (or trailing task text) — ` +
+            'dispatch requires one of those; the router has no task text of its own to supply'),
+    }, {
+        startedAt,
+        session,
+        alias,
+        role: resolved.role,
+        tier: resolved.tier,
+        upstream: 'litellm',
+        attempts,
+    }, deps);
+}
+export async function routeRequest(req, deps) {
+    const alias = requestedModel(req.body);
+    const session = req.headers['x-claude-code-session-id'];
+    let startedAt = 0;
+    if (deps.recordUsage !== undefined) {
+        try {
+            startedAt = (deps.now ?? Date.now)();
+        }
+        catch { /* A broken accounting clock must not stop routing. */ }
+    }
+    if (alias !== undefined && alias.startsWith('sonata-') && deps.resolveTier?.(alias) !== undefined) {
+        return routeTierRequest(req, deps, alias, startedAt, session);
+    }
+    const anthropic = isClaudeRequest(req.body);
+    const headers = requestHeaders(req.headers);
+    const upstream = anthropic ? 'anthropic' : 'litellm';
+    // Anthropic understands its own block arrays; only the foreign path needs the
+    // string form, so the request Anthropic receives stays byte-identical.
+    const body = anthropic ? req.body : flattenSystemBlocks(req.body);
+    deps.log?.(`${req.method} ${req.url} model=${requestedModel(req.body) ?? '?'} -> ${upstream}`);
+    if (!anthropic) {
+        // A direct `--model <key>` request never goes through `resolveTier` (the
+        // key isn't a `sonata-*` alias), so this is the only place such a
+        // request's config-change check can fire.
+        deps.checkModelChange?.();
+        return withUsageRecording(await forwardToLitellm(body, litellmHeaders(headers, deps.litellmKey), req, deps), {
+            startedAt,
+            session,
+            alias: alias ?? '',
+            // For a direct `--model <key>` request, `alias` IS the config key.
+            // Recording it (and its gateway) is what lets `resolvePrice` price this
+            // request class at all; without it a direct-model row is `source:
+            // 'none'` even when full price config exists for that exact model.
+            // `key` is only set when `alias` is defined, matching how optional
+            // `RecordContext` fields are handled elsewhere — never an own property
+            // with value `undefined`.
+            ...(alias !== undefined ? { key: alias, gateway: deps.resolveGateway?.(alias) } : {}),
+            upstream: 'litellm',
+            attempts: [],
+        }, deps);
+    }
+    try {
+        const response = await deps.fetch(targetUrl(deps.anthropicBase ?? 'https://api.anthropic.com', req.url), { method: req.method, headers, body: body.length > 0 ? body : undefined });
+        return withUsageRecording({
+            status: response.status,
+            headers: responseHeaders(response.headers),
+            body: response.body === null ? Buffer.alloc(0) : responseBody(response.body),
+        }, { startedAt, session, alias: alias ?? '', upstream: 'anthropic', attempts: [] }, deps);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return withUsageRecording({
+            status: 502,
+            headers: { 'content-type': 'application/json' },
+            body: anthropicErrorBody('router_error', message),
+        }, { startedAt, session, alias: alias ?? '', upstream: 'anthropic', attempts: [] }, deps);
+    }
+}
+function incomingHeaders(req) {
+    const headers = {};
+    for (const [name, value] of Object.entries(req.headers)) {
+        if (value !== undefined)
+            headers[name] = Array.isArray(value) ? value.join(', ') : value;
+    }
+    return headers;
+}
+async function readBody(req) {
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    return Buffer.concat(chunks);
+}
+async function respond(res, routed) {
+    res.writeHead(routed.status, routed.headers);
+    if (Buffer.isBuffer(routed.body)) {
+        res.end(routed.body);
+        return;
+    }
+    for await (const chunk of routed.body)
+        res.write(chunk);
+    res.end();
+}
+export function createRouterServer(deps) {
+    return createServer(async (req, res) => {
+        try {
+            if (deps.health && new URL(req.url ?? '/', 'http://localhost').pathname === '/__sonata_health') {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({
+                    status: 'ok', sonata: true, configPath: deps.configPath ?? null, instanceId: deps.instanceId ?? null,
+                }));
+                return;
+            }
+            await respond(res, await routeRequest({
+                method: req.method ?? 'GET',
+                url: req.url ?? '/',
+                headers: incomingHeaders(req),
+                body: await readBody(req),
+            }, deps));
+        }
+        catch {
+            if (!res.headersSent)
+                res.writeHead(500, { 'content-type': 'application/json' });
+            res.end(anthropicErrorBody('router_error', 'failed to route request'));
+        }
+    });
+}
+//# sourceMappingURL=router.js.map

package/dist/native/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/native/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAGjG,OAAO,EAAE,oBAAoB,EAAoB,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA8EvF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,IAAY,EAAE,GAAW;IAC1C,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,OAA+B;IACrD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,OAAO,MAAM,CAAC,WAAW,CACvB,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CACvF,CAAC;AACJ,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,YAAY,CAAC,IAAgC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,OAAO;YACjB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAwC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAClC,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,KAAK,SAAS,CAAC,CAAC,OAAO,CACrB,IAA+B,EAC/B,OAAoC,EACpC,KAAkC;IAElC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;QACtE,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC,CAAC,mEAAmE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAcD,SAAS,YAAY,CAAC,OAA+B,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,QAAwB,EAAE,GAAkB,EAAE,IAAgB;IACxF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACjC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,CAAC,MAAmB,EAAE,QAAiB,EAAQ,EAAE;YAC5D,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;gBACtB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,mEAAmE;oBACnE,gEAAgE;oBAChE,mEAAmE;oBACnE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;oBACzC,EAAE,EAAE,OAAO,GAAG,GAAG,CAAC,SAAS;oBAC3B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC;oBACtD,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC;oBAC7C,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,QAAQ;oBACR,MAAM;oBACN,kEAAkE;oBAClE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;oBACzB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,OAAO,EAAE,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;wBACvD,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;QACvD,CAAC,CAAC;QAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;QACzC,OAAO;YACL,GAAG,QAAQ;YACX,IAAI,EAAE,OAAO,CACX,QAAQ,CAAC,IAAI,EACb,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAChC,CAAC,cAAc,EAAE,EAAE;gBACjB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;gBAChD,IAAI,CAAC,MAAM,EAAE,cAAc,IAAI,QAAQ,CAAC,CAAC;YAC3C,CAAC,CACF;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAyB,CAAC,KAAK,CAAC;QACzE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAA4B,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,oGAAoG;AACpG,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE5C,MAAM,UAAU,cAAc;IAC5B,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,IAAY,EAAE,OAAe;IACvD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAA4B,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,IAAI,GAAG,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAuC,CAAC;QACtF,0EAA0E;QAC1E,qEAAqE;QACrE,6BAA6B;QAC7B,OAAO,IAAI,KAAK,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAEnD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EACZ,OAA+B,EAC/B,GAAkB,EAClB,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,EACpC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAA2B,CAAC,CAAC,CAAC,SAAS,EAAE,CACjG,CAAC;QACF,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI;gBAC5C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACjB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,eAAc,MAAM,MAAM,GAAa,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAK,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7K,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;gBAC7D,MAAM,GAAG,GAAG,yDAAyD,CAAC;gBACtE,IAAI,CAAC,GAAG,EAAE,CAAC,8CAA8C,cAAc,CAAC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC,CAAC;gBACvG,OAAO;oBACL,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,kBAAkB,CAAC,kBAAkB,EAAE,GAAG,CAAC;iBAClD,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC1C,IAAI,EAAE,eAAe;aACtB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1C,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC7E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC;SAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAA+B,EAAE,UAAkB;IACzE,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACrG,CAAC;IACD,GAAG,CAAC,aAAa,GAAG,UAAU,UAAU,EAAE,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAkB,EAClB,IAAgB,EAChB,KAAa,EACb,SAAiB,EACjB,OAA2B;IAE3B,0EAA0E;IAC1E,sEAAsE;IACtE,0EAA0E;IAC1E,8CAA8C;IAC9C,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,kBAAkB,CACtB,uBAAuB,EACvB,8BAA8B,KAAK,0DAA0D,CAC9F;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,GAAG,EAAE;YAAE,SAAS;QAEnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/E,qEAAqE;QACrE,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,kEAAkE;QAClE,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,sBAAsB;QACtB,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5G,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3D,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,KAAK,CAAC,GAAG,YAAY,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,KAAK,OAAO,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC;QACjF,OAAO,kBAAkB,CAAC,QAAQ,EAAE;YAClC,SAAS;YACT,OAAO;YACP,KAAK;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,KAAK,CAAC,MAAO,CAAC,OAAO;YAC9B,QAAQ,EAAE,SAAS;YACnB,QAAQ;SACT,EAAE,IAAI,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC,iCAAiC,KAAK,SAAS,CAAC,CAAC;IAC5D,OAAO,kBAAkB,CAAC;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,kBAAkB,CACtB,kBAAkB,EAClB,yBAAyB,KAAK,2BAA2B;YACzD,0BAA0B,KAAK,gDAAgD;YAC/E,kFAAkF,CACnF;KACF,EAAE;QACD,SAAS;QACT,OAAO;QACP,KAAK;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,SAAS;QACnB,QAAQ;KACT,EAAE,IAAI,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB,EAAE,IAAgB;IACrE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;QAClG,OAAO,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,8EAA8E;IAC9E,uEAAuE;IACvE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElE,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,OAAO,QAAQ,EAAE,CAAC,CAAC;IAE/F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,yEAAyE;QACzE,kEAAkE;QAClE,0CAA0C;QAC1C,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC1B,OAAO,kBAAkB,CACvB,MAAM,gBAAgB,CAAC,IAAI,EAAE,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EACjF;YACE,SAAS;YACT,OAAO;YACP,KAAK,EAAE,KAAK,IAAI,EAAE;YAClB,mEAAmE;YACnE,wEAAwE;YACxE,kEAAkE;YAClE,mEAAmE;YACnE,mEAAmE;YACnE,uEAAuE;YACvE,0BAA0B;YAC1B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,EAAE;SACb,EACD,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,SAAS,CAAC,IAAI,CAAC,aAAa,IAAI,2BAA2B,EAAE,GAAG,CAAC,GAAG,CAAC,EACrE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAA2B,CAAC,CAAC,CAAC,SAAS,EAAE,CACjG,CAAC;QACF,OAAO,kBAAkB,CAAC;YACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1C,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC7E,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,kBAAkB,CAAC;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC;SAClD,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAmB,EAAE,MAAsB;IAChE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI;QAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBAC/F,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;iBACrG,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YACD,MAAM,OAAO,CAAC,GAAG,EAAE,MAAM,YAAY,CAAC;gBACpC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;gBAC3B,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG;gBACnB,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC;gBAC7B,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC;aAC1B,EAAE,IAAI,CAAC,CAAC,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACjF,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/native/tls.js

@@ -0,0 +1,73 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+export function tlsDir(home) {
+    return join(home, '.config', 'sonata', 'tls');
+}
+export function caKeyPath(home) {
+    return join(tlsDir(home), 'ca.key');
+}
+export function caCertPath(home) {
+    return join(tlsDir(home), 'ca.pem');
+}
+export function serverKeyPath(home) {
+    return join(tlsDir(home), 'server.key');
+}
+export function serverCertPath(home) {
+    return join(tlsDir(home), 'server.pem');
+}
+export function hasCerts(home) {
+    return (existsSync(caKeyPath(home)) &&
+        existsSync(caCertPath(home)) &&
+        existsSync(serverKeyPath(home)) &&
+        existsSync(serverCertPath(home)));
+}
+/**
+ * Generates a local CA and a server cert for api.anthropic.com.
+ *
+ * The CA is what NODE_EXTRA_CA_CERTS points at so spawned `claude -p`
+ * processes trust the local server. The server cert has a SAN for the
+ * hostname so TLS handshakes succeed.
+ *
+ * Uses openssl — the only non-Node dependency, universally available on
+ * macOS and Linux. The certs are long-lived (10 years) since they never
+ * leave the machine.
+ */
+export function generateCerts(home) {
+    const dir = tlsDir(home);
+    mkdirSync(dir, { recursive: true });
+    const caKey = caKeyPath(home);
+    const caCert = caCertPath(home);
+    const srvKey = serverKeyPath(home);
+    const srvCert = serverCertPath(home);
+    // CA key + self-signed CA cert
+    execFileSync('openssl', [
+        'req', '-x509', '-newkey', 'ec', '-pkeyopt', 'ec_paramgen_curve:prime256v1',
+        '-keyout', caKey, '-out', caCert,
+        '-days', '3650', '-nodes',
+        '-subj', '/CN=Sonata Local CA',
+    ], { stdio: 'pipe' });
+    // Server key + CSR + sign with CA
+    const csrPath = join(dir, 'server.csr');
+    execFileSync('openssl', [
+        'req', '-newkey', 'ec', '-pkeyopt', 'ec_paramgen_curve:prime256v1',
+        '-keyout', srvKey, '-out', csrPath, '-nodes',
+        '-subj', '/CN=api.anthropic.com',
+    ], { stdio: 'pipe' });
+    const extPath = join(dir, 'server.ext');
+    execFileSync('bash', ['-c', `cat > '${extPath}' << 'EOF'
+subjectAltName=DNS:api.anthropic.com
+EOF`], { stdio: 'pipe' });
+    execFileSync('openssl', [
+        'x509', '-req', '-in', csrPath, '-CA', caCert, '-CAkey', caKey,
+        '-CAcreateserial', '-out', srvCert,
+        '-days', '3650', '-extfile', extPath,
+    ], { stdio: 'pipe' });
+}
+export function readServerTls(home) {
+    return {
+        key: readFileSync(serverKeyPath(home), 'utf8'),
+        cert: readFileSync(serverCertPath(home), 'utf8'),
+    };
+}
+//# sourceMappingURL=tls.js.map

package/dist/native/tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../src/native/tls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,CACL,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5B,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC/B,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAErC,+BAA+B;IAC/B,YAAY,CAAC,SAAS,EAAE;QACtB,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,8BAA8B;QAC3E,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;QAChC,OAAO,EAAE,MAAM,EAAE,QAAQ;QACzB,OAAO,EAAE,qBAAqB;KAC/B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtB,kCAAkC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,YAAY,CAAC,SAAS,EAAE;QACtB,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,8BAA8B;QAClE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;QAC5C,OAAO,EAAE,uBAAuB;KACjC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,OAAO;;IAE3C,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAExB,YAAY,CAAC,SAAS,EAAE;QACtB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK;QAC9D,iBAAiB,EAAE,MAAM,EAAE,OAAO;QAClC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO;KACrC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO;QACL,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAC9C,IAAI,EAAE,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACjD,CAAC;AACJ,CAAC"}