agentfootprint 10.3.1 → 10.5.0

package/dist/esm/hosting/streamHandler.js

@@ -0,0 +1,517 @@
+/**
+ * streamHandler — one run per request, streamed in a wire protocol, as a
+ * framework-agnostic Fetch-API handler: `(request: Request) => Promise<Response>`.
+ *
+ * Pattern: Template method over a {@link ProtocolAdapter} (the protocol is a
+ *          strategy; AG-UI is one). Everything HTTP happens here once — the
+ *          door guard, the body ceiling, the JSON parse, binding the
+ *          conversation to its caller, keeping it between requests, the client
+ *          hanging up, a failure that is never the process's — so an adapter
+ *          only reads its request, plans the turn and translates.
+ * Role:    the host for a protocol whose response is a STREAM OF EVENTS rather
+ *          than text pieces (`httpHost`'s port). It mounts in anything that
+ *          speaks `Request`/`Response` — a framework's route handler, an edge
+ *          or serverless runtime, or Node through any fetch adapter.
+ *          Deliberately names no vendor, like every file in this folder.
+ *
+ * THE REQUEST IS UNTRUSTED. A body is what anybody could send. It decides
+ * nothing the server owns:
+ *   - WHO is calling and WHICH conversation is theirs come from the app's
+ *     {@link ThreadBinder} (`threads`), from the request's headers — the id a
+ *     request names is format-checked caller data and never a key;
+ *   - WHAT WAS SAID BEFORE comes from the server: the session store
+ *     (`sessions`), or the agent's own memory keyed by the bound session;
+ *   - WHAT A PAUSED RUN WAITS ON is the stored run's own record — an answer is
+ *     matched to it by the adapter, never taken on the request's word;
+ *   - identity and redaction settings never come from a request. A credential
+ *     the request CARRIES (a gateway's per-request token) reaches its own run
+ *     only through the app's `sealRequest`, sealed: never a frame, a stored
+ *     session or a checkpoint.
+ *
+ * NOTHING IS SHARED BETWEEN REQUESTS. Every request builds a FRESH runner
+ * (`agent`, a factory): footprintjs runs one executor per run and a runner
+ * holds one run's context, so a request can neither see another's events nor
+ * leave anything behind for one — no shared listener, recorder, buffer, tool
+ * session or frame count (each stream numbers its own frames, and hands the
+ * number to the framing: `SseFramePosition`). A factory that hands back a
+ * runner it handed back before is refused; so is a `sealRequest` that hands
+ * back a sealed request twice. The handler's own state is KEYS, never content:
+ * the bound conversations with a turn in flight and who holds each (a second
+ * turn on one conversation is refused rather than racing the first for the
+ * stored state), and the runners and sealed requests already used (by
+ * identity, held weakly).
+ *
+ * ONE TURN PER THREAD IS A PER-PROCESS GUARD. Two instances of the handler
+ * (several serverless instances, several workers) do not see each other's
+ * turns: route a thread to one instance (sticky sessions), or a double-sent
+ * answer can resume one paused run twice and a later persist can overwrite an
+ * earlier one. The session store port has no compare-and-set yet.
+ *
+ * The laws it keeps from `httpHost`:
+ *   - The door guard runs first, on the headers alone (`doorGuard.ts`): a Host
+ *     not configured (421), a browser origin not allowed (403), a POST that
+ *     does not say it is JSON (415). A refused body is never read.
+ *   - A body over `maxBodyBytes` is refused at the byte that crosses it (413).
+ *   - A refusal answers with its own status and code (`refusalStatus.ts`);
+ *     anything else is a 500 that names nothing the caller sent and no thrown
+ *     message.
+ *   - Nothing in a request's lifecycle is the process's failure: every step is
+ *     caught, and a stream always ends.
+ */
+import { CONSUMER_SCOPE_RUN_ID, eventBelongsToRun } from '../bridge/eventMeta.js';
+import { isPaused } from '../core/pause.js';
+import { toWireJson } from '../lib/wireJson.js';
+import { checkSessionId, doorGuard } from './doorGuard.js';
+import { envelopeOwner, readEnvelope, readPausedRun, toEnvelope, toPausedEnvelope, } from './envelope.js';
+import { RequestTooLargeError, WireRequestRefusal } from './errors.js';
+import { describePause } from './pendingAsk.js';
+import { REFUSAL_STATUS } from './refusalStatus.js';
+import { requestSealing } from './requestSealing.js';
+/** The default body ceiling — 1 MiB, the same as `nodeHost`. */
+export const DEFAULT_STREAM_MAX_BODY_BYTES = 1_048_576;
+/** The default keep-alive interval: an SSE comment every 15 s of silence. */
+export const DEFAULT_STREAM_HEARTBEAT_MS = 15_000;
+/**
+ * Serve runs in `adapter`'s protocol: POST a protocol request, read a stream
+ * of the protocol's events.
+ *
+ * @throws TypeError at construction for options that cannot be served, and
+ *   when the adapter's framing cannot be built (an optional peer missing) —
+ *   refused at boot, never mid-request.
+ *
+ * @example A route handler that speaks `Request`/`Response`
+ * ```ts
+ * import { memorySessions, streamHandler } from 'agentfootprint/hosting';
+ * import { agUi } from 'agentfootprint/ag-ui';
+ *
+ * export const POST = streamHandler({
+ *   agent: ({ tools }) => buildAgent(tools), // a fresh agent per request
+ *   adapter: agUi(),
+ *   threads: { bind: ({ conversation, headers }) => bindToUser(conversation, headers) },
+ *   sessions: memorySessions(),
+ * });
+ * ```
+ */
+export function streamHandler(options) {
+    const { adapter, threads, sessions } = options;
+    const name = options.name ?? `${adapter.name} stream`;
+    if (typeof options.agent !== 'function') {
+        throw new TypeError(`[hosting] '${name}': agent must be a function that builds a FRESH runner for every ` +
+            `request — a runner holds one run's context, and one shared between requests would ` +
+            `hand one caller's run to another.`);
+    }
+    if (sessions !== undefined && threads === undefined) {
+        throw new TypeError(`[hosting] '${name}': sessions needs threads. A conversation is kept under the key the ` +
+            `app binds to its caller (threads.bind), never under the id a request names.`);
+    }
+    const limit = positive(options.maxBodyBytes, DEFAULT_STREAM_MAX_BODY_BYTES, 'maxBodyBytes', name);
+    const heartbeatMs = options.heartbeatMs ?? DEFAULT_STREAM_HEARTBEAT_MS;
+    if (!Number.isFinite(heartbeatMs) || heartbeatMs < 0) {
+        throw new TypeError(`[hosting] '${name}': heartbeatMs must be 0 (off) or a positive number.`);
+    }
+    const guard = doorGuard({ ...options, name });
+    const framing = adapter.framing();
+    const seal = requestSealing(options.sealRequest, name);
+    const bytes = new TextEncoder();
+    /**
+     * Bound conversations with a turn in flight — the key, and who holds it (so
+     * anybody else hears "not found", never "busy").
+     */
+    const inFlight = new Map();
+    /** Runners already used, by identity — so a factory that shares one is caught. */
+    const used = new WeakSet();
+    /** One answer for "none", "another's" and "nobody's" — a caller learns no ids. */
+    const notFound = () => new WireRequestRefusal('ERR_SESSION_NOT_FOUND', `'${name}': that conversation is not one you can open.`, 404);
+    /** Bind the conversation the request names to its caller — the app's port decides. */
+    async function bind(request, headers) {
+        if (threads === undefined)
+            return undefined;
+        const thread = await threads.bind({ conversation: adapter.conversation(request), headers });
+        if (thread === null || typeof thread !== 'object' || typeof thread.sessionId !== 'string') {
+            throw new TypeError('threads.bind returned no session');
+        }
+        const bad = checkSessionId(thread.sessionId, name);
+        if (bad !== undefined)
+            throw bad;
+        return thread;
+    }
+    /**
+     * The stored conversation, when it is the caller's — refusing one that is not.
+     * Asked BEFORE anything about the conversation's activity, so a caller it is
+     * not learns "not found" and never "busy" — and never holds its turn.
+     */
+    async function ownersOnly(thread) {
+        if (sessions === undefined || thread === undefined)
+            return undefined;
+        await sessions.onWake?.(thread.sessionId, 'invoke');
+        const stored = await sessions.hydrate(thread.sessionId);
+        // Whose conversation this is, before a line of it is read. One answer for
+        // "none", "another's" and "nobody's", so a caller learns no ids.
+        if (stored !== undefined && envelopeOwner(stored) !== thread.identity?.principal)
+            throw notFound();
+        return stored;
+    }
+    /** Read what the server holds for the bound conversation — under the turn's claim. */
+    async function hold(thread) {
+        const stored = await ownersOnly(thread);
+        if (stored === undefined)
+            return { view: { continues: false } };
+        if (stored.format === 'flowchart-v1') {
+            const paused = readPausedRun(stored);
+            const record = paused.wire?.protocol === adapter.name ? paused.wire.record : undefined;
+            return {
+                paused,
+                view: {
+                    continues: false,
+                    awaiting: {
+                        pending: paused.pending,
+                        ...(record !== undefined && { suspension: record }),
+                    },
+                },
+            };
+        }
+        const prior = readEnvelope(stored);
+        return { prior, view: { continues: true } };
+    }
+    /** A fresh runner for this request — never one the factory handed out before. */
+    function build(context) {
+        const runner = options.agent(context);
+        if (runner === null ||
+            typeof runner !== 'object' ||
+            typeof runner.on !== 'function' ||
+            typeof runner.run !== 'function') {
+            throw new TypeError('agent returned no runner');
+        }
+        if (used.has(runner)) {
+            throw new WireRequestRefusal('ERR_RUNNER_REUSED', `'${name}': the agent factory returned a runner it returned before. Every ` +
+                `request needs a FRESH runner — a shared one hands one caller's run to another.`, 500);
+        }
+        used.add(runner);
+        return runner;
+    }
+    /** Keep what the run left behind, then say how it ended — kept FIRST, told after. */
+    async function keep(turn, out, recordRunId) {
+        const { thread, runner, held, translation } = turn;
+        const store = thread === undefined ? undefined : sessions;
+        if (isPaused(out)) {
+            const awaiting = adapter.awaitsCaller?.(out.pauseData) === true ? 'caller' : 'person';
+            if (store !== undefined && thread !== undefined) {
+                const record = translation.suspension?.(awaiting);
+                const conversation = runner.checkpoint?.() ?? noConversation(turn, recordRunId, thread.identity);
+                await store.persist(thread.sessionId, toPausedEnvelope({
+                    checkpoint: out.checkpoint,
+                    conversation,
+                    pending: describePause(out, thread.sessionId),
+                    ...(record !== undefined && { wire: { protocol: adapter.name, record } }),
+                }));
+            }
+            return { kind: 'paused', awaiting };
+        }
+        if (store !== undefined && thread !== undefined) {
+            const conversation = runner.checkpoint?.();
+            if (conversation !== undefined)
+                await store.persist(thread.sessionId, toEnvelope(conversation));
+            // A runner that keeps no conversation still clears the pause it continued.
+            else if (held.paused !== undefined)
+                await store.persist(thread.sessionId, toEnvelope(noConversation(turn, recordRunId, thread.identity)));
+        }
+        return { kind: 'finished' };
+    }
+    /** Run the turn; every event the run serves goes through the translation; settle once. */
+    async function serve(turn, write, signal, release) {
+        const { plan, held, thread, runner, translation, request } = turn;
+        // A translation that throws is a fault in the adapter, never the run's: the
+        // run goes on, and the stream still ends.
+        const safely = (produce) => {
+            try {
+                write(produce());
+            }
+            catch {
+                // nothing more this request can be told
+            }
+        };
+        let runId;
+        let off;
+        let settlement;
+        try {
+            // The runner is this request's alone; the run filter still holds a fact a
+            // shared resource stamped for another run or session out of the stream.
+            off = runner.on('*', (event) => {
+                const named = event.meta?.runId;
+                if (runId === undefined && typeof named === 'string' && named !== CONSUMER_SCOPE_RUN_ID)
+                    runId = named;
+                if (!eventBelongsToRun(event.meta, { runId: runId ?? '', sessionId: thread?.sessionId }))
+                    return;
+                safely(() => translation.event(event));
+            });
+            if (signal.aborted)
+                throw new Error('the caller left before the run started');
+            const runOptions = {
+                signal,
+                ...(thread !== undefined && { sessionId: thread.sessionId }),
+                ...(thread?.identity !== undefined && { identity: thread.identity }),
+                ...(request !== undefined && { request }),
+            };
+            const out = plan.turn.kind === 'answer'
+                ? await runner.resume(held.paused.checkpoint, plan.turn.answer, runOptions)
+                : await runner.run((typeof runner.checkpoint === 'function' && held.prior !== undefined
+                    ? { message: plan.turn.message, continueFrom: held.prior }
+                    : { message: plan.turn.message }), runOptions);
+            settlement = await keep(turn, out, runId);
+        }
+        catch {
+            settlement = { kind: signal.aborted ? 'cancelled' : 'failed' };
+        }
+        finally {
+            // The conversation is free BEFORE the caller hears the end — and before
+            // anything else that could throw: a client that answers on RUN_FINISHED
+            // must not find its own turn still running, ever.
+            release();
+            try {
+                if (typeof off === 'function')
+                    off();
+            }
+            catch {
+                // a runner that cannot unsubscribe is thrown away with this request
+            }
+        }
+        safely(() => translation.settle(settlement));
+        // Tool sessions this request's runner opened close with it; a strategy the
+        // app shares between runners is drained, never stopped.
+        void runner.shutdown?.({ stop: false })?.catch(() => undefined);
+    }
+    function respond(turn, request, release) {
+        const abort = new AbortController();
+        const hangUp = () => abort.abort();
+        // A caller already gone never starts its run.
+        if (request.signal?.aborted === true)
+            abort.abort();
+        else
+            request.signal?.addEventListener('abort', hangUp, { once: true });
+        let closed = false;
+        let heartbeat;
+        const stop = () => {
+            closed = true;
+            if (heartbeat !== undefined)
+                clearInterval(heartbeat);
+            request.signal?.removeEventListener('abort', hangUp);
+        };
+        const body = new ReadableStream({
+            start(controller) {
+                const send = (text) => {
+                    if (closed)
+                        return;
+                    try {
+                        controller.enqueue(bytes.encode(text));
+                    }
+                    catch {
+                        stop(); // the stream went away under us
+                    }
+                };
+                // This stream's own count — never the framing's, never another stream's.
+                let written = 0;
+                const write = (events) => {
+                    for (const event of events) {
+                        const frame = framing.frame(event, { sequence: written + 1 });
+                        written += 1;
+                        send(frame);
+                    }
+                };
+                if (heartbeatMs > 0) {
+                    heartbeat = setInterval(() => send(': ping\n\n'), heartbeatMs);
+                    heartbeat.unref?.();
+                }
+                const end = () => {
+                    if (closed)
+                        return;
+                    stop();
+                    try {
+                        controller.close();
+                    }
+                    catch {
+                        // already closed by the reader
+                    }
+                };
+                void serve(turn, write, abort.signal, release).then(end, end);
+            },
+            cancel() {
+                stop();
+                abort.abort();
+            },
+        });
+        return new Response(body, {
+            status: 200,
+            headers: {
+                'content-type': framing.contentType,
+                'cache-control': 'no-cache, no-transform',
+                'x-accel-buffering': 'no',
+            },
+        });
+    }
+    return async (request) => {
+        /** The conversation this request holds while it is in flight — released exactly once. */
+        let claimed;
+        const release = () => {
+            if (claimed !== undefined)
+                inFlight.delete(claimed);
+            claimed = undefined;
+        };
+        try {
+            if (request.method !== 'POST') {
+                return refusal(405, `[hosting] '${name}' answers POST only.`, 'ERR_METHOD_NOT_ALLOWED', {
+                    allow: 'POST',
+                });
+            }
+            // Frozen: the reader, the binder and the sealer each read the same headers.
+            const headers = Object.freeze(headersOf(request));
+            const refused = guard.check({ method: request.method, headers });
+            if (refused !== undefined)
+                return refusal(refused.status, refused.message, refused.code);
+            const text = await readBody(request, limit, name);
+            let body;
+            try {
+                body = text.trim() === '' ? {} : JSON.parse(text);
+            }
+            catch {
+                return refusal(400, `[hosting] '${name}': the request body is not JSON.`, 'ERR_INVALID_JSON');
+            }
+            const read = adapter.readRequest({ body, headers });
+            const thread = await bind(read, headers);
+            if (thread !== undefined) {
+                // Ownership first: a caller the conversation is not answered "not
+                // found" whether or not a turn is running, and never claims it.
+                await ownersOnly(thread);
+                const principal = thread.identity?.principal;
+                if (inFlight.has(thread.sessionId)) {
+                    // Even before a first turn has stored anything: the claimant is the owner.
+                    if (inFlight.get(thread.sessionId) !== principal)
+                        throw notFound();
+                    return refusal(409, `[hosting] '${name}': a turn of that conversation is already in flight. Send the ` +
+                        `next turn when it ends.`, 'ERR_CONCURRENT_RUN');
+                }
+                inFlight.set(thread.sessionId, principal);
+                claimed = thread.sessionId;
+            }
+            const held = await hold(thread);
+            const plan = adapter.plan(read, held.view, {
+                headers,
+                ...(thread !== undefined && { thread }),
+                keepsConversation: threads !== undefined,
+                keepsPauses: threads !== undefined && sessions !== undefined,
+            });
+            // Sealed only for a request that runs: every refusal is behind it.
+            const sealed = await seal?.({ headers });
+            const runner = build({
+                tools: plan.tools ?? [],
+                accepted: plan.accepted ?? {},
+                ...(thread !== undefined && { thread }),
+            });
+            const translation = adapter.open(read, plan.turn.kind === 'answer' ? held.view.awaiting?.suspension : undefined);
+            // The stream owns the claim from here: released when the run ends.
+            const owned = claimed;
+            claimed = undefined;
+            return respond({
+                plan,
+                held,
+                ...(thread !== undefined && { thread }),
+                runner,
+                translation,
+                ...(sealed !== undefined && { request: sealed }),
+            }, request, () => {
+                if (owned !== undefined)
+                    inFlight.delete(owned);
+            });
+        }
+        catch (err) {
+            return failure(err, name);
+        }
+        finally {
+            release();
+        }
+    };
+}
+/**
+ * A conversation record for a runner that keeps none (an `LLMCall`, a
+ * composition): no history, only what a stored session needs — the run, the
+ * message, and whose it is.
+ */
+function noConversation(turn, recordRunId, identity) {
+    const message = turn.plan.turn.kind === 'message'
+        ? turn.plan.turn.message
+        : turn.held.paused?.conversation.originalInput.message ?? '';
+    return {
+        version: 1,
+        runId: recordRunId ?? 'unknown',
+        history: [],
+        lastCompletedIteration: 0,
+        originalInput: { message },
+        checkpointedAt: Date.now(),
+        ...(identity !== undefined && { identity }),
+    };
+}
+/** The refusal an error means — its own status and code, or a 500 that quotes nothing. */
+function failure(err, name) {
+    if (err instanceof RequestTooLargeError)
+        return refusal(413, err.message, err.code);
+    if (err instanceof WireRequestRefusal)
+        return refusal(err.status, err.message, err.code);
+    const code = err?.code;
+    if (err instanceof Error && typeof code === 'string' && REFUSAL_STATUS[code] !== undefined) {
+        return refusal(REFUSAL_STATUS[code], err.message, code);
+    }
+    // Never the thrown message: it is the author's note to their own logs.
+    return refusal(500, `[hosting] '${name}' could not serve the request.`, 'ERR_INTERNAL');
+}
+/** A JSON refusal: `{ error, code }` under the refusal's own status. */
+function refusal(status, message, code, headers = {}) {
+    return new Response(toWireJson({ error: message, code }), {
+        status,
+        headers: { 'content-type': 'application/json', ...headers },
+    });
+}
+/** The request's headers, names lower-cased (the door guard's and an adapter's view). */
+function headersOf(request) {
+    const out = {};
+    request.headers.forEach((value, key) => {
+        out[key.toLowerCase()] = value;
+    });
+    return out;
+}
+/** The body as text, refused at the byte that crosses `limit`. */
+async function readBody(request, limit, name) {
+    const declared = Number(request.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > limit)
+        throw new RequestTooLargeError(limit, name);
+    if (request.body === null)
+        return '';
+    const reader = request.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > limit) {
+            await reader.cancel().catch(() => undefined);
+            throw new RequestTooLargeError(limit, name);
+        }
+        chunks.push(value);
+    }
+    const all = new Uint8Array(size);
+    let at = 0;
+    for (const chunk of chunks) {
+        all.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return new TextDecoder().decode(all);
+}
+function positive(value, fallback, field, name) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new TypeError(`[hosting] '${name}': ${field} must be a positive whole number of bytes.`);
+    }
+    return value;
+}
+//# sourceMappingURL=streamHandler.js.map

package/dist/esm/hosting/streamHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamHandler.js","sourceRoot":"","sources":["../../../src/hosting/streamHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAA2B,MAAM,kBAAkB,CAAC;AAGrE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAyB,MAAM,gBAAgB,CAAC;AAClF,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,UAAU,EACV,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAWhD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAsB,MAAM,qBAAqB,CAAC;AAIzE,gEAAgE;AAChE,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAkFlD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA+C;IAE/C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,SAAS,CAAC;IACtD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CACjB,cAAc,IAAI,mEAAmE;YACnF,oFAAoF;YACpF,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CACjB,cAAc,IAAI,sEAAsE;YACtF,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,6BAA6B,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAClG,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,2BAA2B,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,cAAc,IAAI,sDAAsD,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAChC;;;OAGG;IACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IACvD,kFAAkF;IAClF,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IAEnC,kFAAkF;IAClF,MAAM,QAAQ,GAAG,GAAuB,EAAE,CACxC,IAAI,kBAAkB,CACpB,uBAAuB,EACvB,IAAI,IAAI,+CAA+C,EACvD,GAAG,CACJ,CAAC;IAEJ,sFAAsF;IACtF,KAAK,UAAU,IAAI,CAAC,OAAiB,EAAE,OAAyC;QAC9E,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1F,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,GAAG,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,UAAU,CAAC,MAAiC;QACzD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACrE,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,MAAM,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS;YAC9E,MAAM,QAAQ,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sFAAsF;IACtF,KAAK,UAAU,IAAI,CAAC,MAAiC;QACnD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,OAAO;gBACL,MAAM;gBACN,IAAI,EAAE;oBACJ,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE;wBACR,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;qBACpD;iBACF;aACF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,iFAAiF;IACjF,SAAS,KAAK,CAAC,OAAyB;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IACE,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,OAAO,MAAM,CAAC,EAAE,KAAK,UAAU;YAC/B,OAAO,MAAM,CAAC,GAAG,KAAK,UAAU,EAChC,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,IAAI,IAAI,mEAAmE;gBACzE,gFAAgF,EAClF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qFAAqF;IACrF,KAAK,UAAU,IAAI,CACjB,IAAkB,EAClB,GAAY,EACZ,WAA+B;QAE/B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1D,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtF,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAClD,MAAM,YAAY,GAChB,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC9E,MAAM,KAAK,CAAC,OAAO,CACjB,MAAM,CAAC,SAAS,EAChB,gBAAgB,CAAC;oBACf,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY;oBACZ,OAAO,EAAE,aAAa,CAAC,GAAyB,EAAE,MAAM,CAAC,SAAS,CAAC;oBACnE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;iBAC1E,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YAC3C,IAAI,YAAY,KAAK,SAAS;gBAC5B,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;YAClE,2EAA2E;iBACtE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAChC,MAAM,KAAK,CAAC,OAAO,CACjB,MAAM,CAAC,SAAS,EAChB,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAC/D,CAAC;QACN,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,0FAA0F;IAC1F,KAAK,UAAU,KAAK,CAClB,IAAkB,EAClB,KAA0C,EAC1C,MAAmB,EACnB,OAAmB;QAEnB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAClE,4EAA4E;QAC5E,0CAA0C;QAC1C,MAAM,MAAM,GAAG,CAAC,OAAgC,EAAQ,EAAE;YACxD,IAAI,CAAC;gBACH,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;YAC1C,CAAC;QACH,CAAC,CAAC;QACF,IAAI,KAAyB,CAAC;QAC9B,IAAI,GAAY,CAAC;QACjB,IAAI,UAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,0EAA0E;YAC1E,wEAAwE;YACxE,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;gBAChC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,qBAAqB;oBACrF,KAAK,GAAG,KAAK,CAAC;gBAChB,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;oBACtF,OAAO;gBACT,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC9E,MAAM,UAAU,GAAG;gBACjB,MAAM;gBACN,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC5D,GAAG,CAAC,MAAM,EAAE,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;aAC1C,CAAC;YACF,MAAM,GAAG,GACP,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;gBACzB,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAChB,IAAI,CAAC,MAAoB,CAAC,UAAmB,EAC9C,IAAI,CAAC,IAAI,CAAC,MAAe,EACzB,UAAmB,CACpB;gBACH,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CACd,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;oBAClE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE;oBAC1D,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAU,EAC5C,UAAmB,CACpB,CAAC;YACR,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjE,CAAC;gBAAS,CAAC;YACT,wEAAwE;YACxE,wEAAwE;YACxE,kDAAkD;YAClD,OAAO,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,OAAO,GAAG,KAAK,UAAU;oBAAE,GAAG,EAAE,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,wDAAwD;QACxD,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,SAAS,OAAO,CAAC,IAAkB,EAAE,OAAgB,EAAE,OAAmB;QACxE,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzC,8CAA8C;QAC9C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;;YAC/C,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,SAAqD,CAAC;QAC1D,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,SAAS,KAAK,SAAS;gBAAE,aAAa,CAAC,SAAS,CAAC,CAAC;YACtD,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,cAAc,CAAa;YAC1C,KAAK,CAAC,UAAU;gBACd,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;oBAClC,IAAI,MAAM;wBAAE,OAAO;oBACnB,IAAI,CAAC;wBACH,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;oBACzC,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,EAAE,CAAC,CAAC,gCAAgC;oBAC1C,CAAC;gBACH,CAAC,CAAC;gBACF,yEAAyE;gBACzE,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,CAAC,MAAyB,EAAQ,EAAE;oBAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC9D,OAAO,IAAI,CAAC,CAAC;wBACb,IAAI,CAAC,KAAK,CAAC,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC;gBACF,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;oBACpB,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,CAAC;oBAC9D,SAAoC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAClD,CAAC;gBACD,MAAM,GAAG,GAAG,GAAS,EAAE;oBACrB,IAAI,MAAM;wBAAE,OAAO;oBACnB,IAAI,EAAE,CAAC;oBACP,IAAI,CAAC;wBACH,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC;oBAAC,MAAM,CAAC;wBACP,+BAA+B;oBACjC,CAAC;gBACH,CAAC,CAAC;gBACF,KAAK,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,MAAM;gBACJ,IAAI,EAAE,CAAC;gBACP,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC;SACF,CAAC,CAAC;QACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,OAAO,CAAC,WAAW;gBACnC,eAAe,EAAE,wBAAwB;gBACzC,mBAAmB,EAAE,IAAI;aAC1B;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,yFAAyF;QACzF,IAAI,OAA2B,CAAC;QAChC,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,IAAI,OAAO,KAAK,SAAS;gBAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpD,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC;QACF,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,OAAO,OAAO,CAAC,GAAG,EAAE,cAAc,IAAI,sBAAsB,EAAE,wBAAwB,EAAE;oBACtF,KAAK,EAAE,MAAM;iBACd,CAAC,CAAC;YACL,CAAC;YACD,4EAA4E;YAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACjE,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACzF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,OAAO,CACZ,GAAG,EACH,cAAc,IAAI,kCAAkC,EACpD,kBAAkB,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,gEAAgE;gBAChE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;gBACzB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC;gBAC7C,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnC,2EAA2E;oBAC3E,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;wBAAE,MAAM,QAAQ,EAAE,CAAC;oBACnE,OAAO,OAAO,CACZ,GAAG,EACH,cAAc,IAAI,gEAAgE;wBAChF,yBAAyB,EAC3B,oBAAoB,CACrB,CAAC;gBACJ,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC1C,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;YAC7B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACzC,OAAO;gBACP,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvC,iBAAiB,EAAE,OAAO,KAAK,SAAS;gBACxC,WAAW,EAAE,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;aAC7D,CAAC,CAAC;YACH,mEAAmE;YACnE,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;gBAC7B,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAC9B,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CACzE,CAAC;YACF,mEAAmE;YACnE,MAAM,KAAK,GAAG,OAAO,CAAC;YACtB,OAAO,GAAG,SAAS,CAAC;YACpB,OAAO,OAAO,CACZ;gBACE,IAAI;gBACJ,IAAI;gBACJ,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvC,MAAM;gBACN,WAAW;gBACX,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;aACjD,EACD,OAAO,EACP,GAAG,EAAE;gBACH,IAAI,KAAK,KAAK,SAAS;oBAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClD,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,IAAmB,EACnB,WAA+B,EAC/B,QAAmC;IAEnC,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;QAC/B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;QACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,aAAa,CAAC,OAAO,IAAI,EAAE,CAAC;IACjE,OAAO;QACL,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,WAAW,IAAI,SAAS;QAC/B,OAAO,EAAE,EAAE;QACX,sBAAsB,EAAE,CAAC;QACzB,aAAa,EAAE,EAAE,OAAO,EAAE;QAC1B,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE;QAC1B,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,OAAO,CAAC,GAAY,EAAE,IAAY;IACzC,IAAI,GAAG,YAAY,oBAAoB;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpF,IAAI,GAAG,YAAY,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACzF,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,IAAI,GAAG,YAAY,KAAK,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,OAAO,CAAC,cAAc,CAAC,IAAI,CAAW,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,uEAAuE;IACvE,OAAO,OAAO,CAAC,GAAG,EAAE,cAAc,IAAI,gCAAgC,EAAE,cAAc,CAAC,CAAC;AAC1F,CAAC;AAED,wEAAwE;AACxE,SAAS,OAAO,CACd,MAAc,EACd,OAAe,EACf,IAAY,EACZ,UAA4C,EAAE;IAE9C,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;QACxD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,SAAS,SAAS,CAAC,OAAgB;IACjC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,KAAa,EAAE,IAAY;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,KAAK;QAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;QACzB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACjB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,IAAI,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnB,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CACf,KAAyB,EACzB,QAAgB,EAChB,KAAa,EACb,IAAY;IAEZ,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,cAAc,IAAI,MAAM,KAAK,4CAA4C,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/esm/hosting/types.d.ts

@@ -34,6 +34,7 @@ import type { AnswerAccountsOptions } from './answerAccounts.js';
 import type { DoorIdentity } from './identityVerification.js';
 import type { AdmissionPolicy } from './admission.js';
 import type { IngressSink } from './ingressRecord.js';
+import type { RequestSealer } from './requestSealing.js';
 import type { SessionSummary, SessionWireRequest, SessionWireResult } from './sessionWire.js';
 export type { Unsubscribe };
 /**
@@ -871,6 +872,21 @@ export interface PausedRun {
     readonly conversation: AgentRunCheckpoint;
     /** What the run is waiting on, as data. */
     readonly pending: PendingAsk;
+    /**
+     * What the WIRE that served the pause recorded about it — the ids it handed
+     * the caller for the answer — so a later request on that wire is matched to
+     * this pause and continued as the same invocation (`streamHandler` keeps the
+     * AG-UI adapter's record here). Absent for a pause a door with nothing to
+     * remember stored, and opaque to the store and to every other door.
+     */
+    readonly wire?: PausedWire;
+}
+/** One wire protocol's own record of a pause it served — see {@link PausedRun.wire}. */
+export interface PausedWire {
+    /** The protocol that recorded it: the protocol adapter's `name`. */
+    readonly protocol: string;
+    /** Plain JSON, the protocol's own; ids and names, never a value of the run. */
+    readonly record: unknown;
 }
 /**
  * The question a paused run is waiting on — the part of a pause that is safe to
@@ -1402,6 +1418,34 @@ export interface StandingAgentBaseOptions<TH extends HostHandle = HostHandle> {
      * decided against a window none of them had joined.
      */
     readonly admission?: AdmissionPolicy;
+    /**
+     * Seal the credential a request carries for its run — a gateway's
+     * per-request token in a header, read by a `requestCredentials` provider
+     * (`agentfootprint/security`) for the tools that declare a `needs` for it.
+     *
+     * Called once per request that RUNS (a turn or an answer — never an
+     * artifact or session op, never a refused request), after the caller is
+     * verified and the session's ownership is checked, with the request's
+     * headers ({@link HostRequest.headers}: `nodeHost` and `httpHost` deliver
+     * them) and nothing else. Return
+     * `requestContext({ secrets })`, or `undefined` for a request that carries
+     * none; the handle goes to THAT request's `run()` / `resume()` only — never
+     * the reply, the stored session or the checkpoint, so a resumed run is
+     * served the RESUMING request's credential. A handle any host was handed
+     * before is refused; a sealer that throws refuses the request in fixed words
+     * (`ERR_REQUEST_NOT_SEALED`, 400) — so decrypt at vend time
+     * (`decodedWith`), not here. The HANDLE never reaches a reply; a tool that
+     * returns the credential's value itself does (`hostFilled` scrubs an echo).
+     *
+     * Unset — the default — no run carries a request, exactly as before.
+     *
+     * @example
+     *   sealRequest: ({ headers }) =>
+     *     headers['x-crm-token'] === undefined
+     *       ? undefined
+     *       : requestContext({ secrets: { crmToken: headers['x-crm-token'] } }),
+     */
+    readonly sealRequest?: RequestSealer;
     /**
      * Where this door's ingress decisions go (9.32.0) — one record per request,
      * including every request that never became a run.

package/dist/esm/hosting/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/hosting/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAoxCH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AA2QxC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD;iFACiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/hosting/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAqyCH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAuSxC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD;iFACiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC"}

package/dist/esm/hosting/verifiedThreads.d.ts

@@ -0,0 +1,29 @@
+/**
+ * verifiedThreads — the {@link ThreadBinder} that binds a thread to a VERIFIED
+ * caller, so the secure binding is the one-line one.
+ *
+ * A request names a thread; naming one proves nothing. This binder checks the
+ * caller's credential with the door's own identity verification
+ * (`verifyRequestIdentity` — the bearer token, through your verifier), never a
+ * header read as a name, and keys the conversation by WHO
+ * plus WHICH: the same thread id from two people is two conversations. The
+ * run's `identity` names the verified person, so a stored conversation records
+ * its owner and a later request from anyone else is refused as not found.
+ *
+ * A caller with no credential is REFUSED (401), even at a door that allows
+ * anonymous requests elsewhere: a thread with no owner would be anybody's who
+ * guessed its id.
+ */
+import { type IdentityVerificationOptions } from './identityVerification.js';
+import type { ThreadBinder } from './protocolAdapter.js';
+/**
+ * Bind every thread to the caller `identity` verifies.
+ *
+ * @example
+ * ```ts
+ * import { jwksIdentity } from 'agentfootprint/security';
+ * const threads = verifiedThreads(jwksIdentity({ jwksUrl, issuer, audience }));
+ * streamHandler({ agent, adapter: agUi(), threads, sessions: memorySessions() });
+ * ```
+ */
+export declare function verifiedThreads(identity: IdentityVerificationOptions): ThreadBinder;