agentfootprint 10.4.0 → 10.5.0

package/dist/esm/tools/hostFilled.js

@@ -0,0 +1,509 @@
+/**
+ * hostFilled — tool arguments the HOST fills, from the run's credential or
+ * identity. The model never sees them and cannot set them.
+ *
+ * ```ts
+ * import { hostFilled, fromCredential, fromIdentity } from 'agentfootprint';
+ *
+ * // An MCP server whose every tool takes a `token` argument:
+ * const tools = hostFilled(await crm.tools(), {
+ *   token: fromCredential({ service: 'crm' }),   // ctx.credential, resolved per call
+ *   tenantId: fromIdentity('tenant'),            // ctx.identity.tenant
+ * });
+ * ```
+ *
+ * ── What it does ────────────────────────────────────────────────────────────
+ * 1. **Removes the field from the schema the model sees** (`properties` and
+ *    `required`). The model is never told the argument exists.
+ * 2. **Refuses a model-supplied value by name.** A call that sends the field
+ *    anyway — guessed, injected by a document, copied from another tool — is
+ *    refused with a result naming the argument, and the tool does not run.
+ * 3. **Fills it at the last moment**, inside `execute`, from `ctx.credential`
+ *    (the tool's declared `needs`, which `fromCredential({ service })` sets
+ *    when the tool has none) or `ctx.identity`. A missing value refuses the
+ *    call by name — never an empty or default value.
+ *
+ * ── Why a wrapper around `execute` ──────────────────────────────────────────
+ * The filled value exists only inside the call: the arguments every dispatch
+ * door records (`tool_start`, history, the commit log, a consent pause's
+ * checkpoint) are the MODEL's arguments, which never held it. Wrapping
+ * `execute` makes that true at every door — the agent loop, a resumed call,
+ * an inner `ctx.tools` call and `mcpServe` — without each door knowing.
+ *
+ * A credential value is also SCRUBBED on the way out: every occurrence in the
+ * tool's result is replaced by `[host-filled]`, and a thrown error that
+ * carries it (an SDK that echoes its request) is replaced by one that does
+ * not. That is defence in depth for a server that echoes; it cannot cover a
+ * value the tool transforms (base64, hashing) or sends elsewhere itself.
+ * Identity values are not secrets and are not scrubbed.
+ *
+ * Pattern: Decorator over `Tool` (declaration + execute). Role: tools, argument law.
+ */
+/**
+ * Fill the argument from the call's credential. With `service`, the tool's
+ * `needs` is declared for you (a tool that already declares one must name the
+ * same service, or omit `service`).
+ */
+export function fromCredential(options = {}) {
+    return { from: 'credential', ...options };
+}
+/** Fill the argument from the identity the run's caller named. */
+export function fromIdentity(field) {
+    return { from: 'identity', field };
+}
+/**
+ * A model sent a value for an argument the host fills. The call is refused
+ * and the tool does not run. Names the arguments, never a value.
+ */
+export class HostFilledArgumentError extends Error {
+    toolName;
+    fields;
+    code = 'ERR_HOST_FILLED_ARGUMENT';
+    constructor(toolName, fields) {
+        super(`tool '${toolName}': ${fields.map((f) => `'${f}'`).join(', ')} ` +
+            `${fields.length === 1 ? 'is' : 'are'} filled by the host and cannot be set by the ` +
+            'caller — call the tool again without it.');
+        this.toolName = toolName;
+        this.fields = fields;
+        this.name = 'HostFilledArgumentError';
+    }
+}
+/**
+ * A host-filled argument had no value for this call — no credential was
+ * resolved, the credential has no single value to read, or the run's caller
+ * named no such identity field. The call is refused; nothing is guessed.
+ */
+export class HostFilledValueMissingError extends Error {
+    toolName;
+    field;
+    code = 'ERR_HOST_FILLED_VALUE_MISSING';
+    constructor(toolName, field, why) {
+        super(`tool '${toolName}': argument '${field}' is filled by the host, and ${why}.`);
+        this.toolName = toolName;
+        this.field = field;
+        this.name = 'HostFilledValueMissingError';
+    }
+}
+/** Below this length a credential's OTHER values (header values) are not scrubbed. */
+const MIN_SCRUB_LENGTH = 8;
+/** What replaces a credential value in a result or an error. */
+export const HOST_FILLED_PLACEHOLDER = '[host-filled]';
+export function hostFilled(toolOrTools, fills) {
+    const checked = checkFills(fills);
+    if (!Array.isArray(toolOrTools))
+        return wrapTool(toolOrTools, checked, true);
+    const tools = toolOrTools;
+    const unused = new Set(Object.keys(checked));
+    const out = tools.map((tool) => {
+        const own = Object.fromEntries(
+        // The tools that take the field as an argument of the call. One that
+        // declares it only through a root combinator (`allOf`/`anyOf`/`oneOf`,
+        // `if`/`then`, `$defs`) takes it too, and cannot have it removed — it is
+        // refused, never left model-settable. One that names it only inside a
+        // nested object (a `cursor.token` pagination field) has a different
+        // argument and is left alone.
+        Object.entries(checked).filter(([field]) => {
+            if (Object.hasOwn(propertiesOf(tool), field))
+                return true;
+            if (declaresAtRoot(tool.schema?.inputSchema, field))
+                refuseNested(tool, field);
+            return false;
+        }));
+        for (const field of Object.keys(own))
+            unused.delete(field);
+        return Object.keys(own).length === 0 ? tool : wrapTool(tool, own, false);
+    });
+    if (unused.size > 0) {
+        throw new TypeError(`hostFilled: no tool in the list declares ${[...unused].map((f) => `'${f}'`).join(', ')}.`);
+    }
+    return out;
+}
+// ─── Build-time checks ──────────────────────────────────────────────
+function checkFills(fills) {
+    if (fills === null || typeof fills !== 'object' || Array.isArray(fills)) {
+        throw new TypeError('hostFilled: `fills` must be an object of argument → fill.');
+    }
+    const names = Object.keys(fills);
+    if (names.length === 0)
+        throw new TypeError('hostFilled: `fills` names no argument.');
+    for (const name of names) {
+        const fill = fills[name];
+        const ok = (fill?.from === 'credential' &&
+            (fill.read === undefined ||
+                typeof fill.read === 'function')) ||
+            (fill?.from === 'identity' &&
+                ['principal', 'tenant', 'conversationId'].includes(fill.field));
+        if (!ok) {
+            throw new TypeError(`hostFilled: argument '${name}' needs fromCredential(…) or fromIdentity('principal' | ` +
+                "'tenant' | 'conversationId').");
+        }
+    }
+    return fills;
+}
+function propertiesOf(tool) {
+    const props = tool.schema?.inputSchema
+        ?.properties;
+    return props !== null && typeof props === 'object' ? props : {};
+}
+/** The one service a tool's credential fills read, checked against its own `needs`. */
+function needsFor(tool, fills) {
+    const name = tool.schema.name;
+    const credentialFills = Object.entries(fills).filter((e) => e[1].from === 'credential');
+    if (credentialFills.length === 0)
+        return tool.needs;
+    const named = new Set(credentialFills.map(([, f]) => f.service).filter((s) => s !== undefined));
+    if (named.size > 1) {
+        throw new TypeError(`hostFilled: tool '${name}' takes ONE credential (its \`needs\`), and the fills name ` +
+            `${[...named].map((s) => `'${s}'`).join(' and ')}.`);
+    }
+    const service = [...named][0];
+    if (tool.needs !== undefined) {
+        if (service !== undefined && service !== tool.needs.credential) {
+            throw new TypeError(`hostFilled: tool '${name}' already needs credential '${tool.needs.credential}', and a ` +
+                `fill names '${service}'.`);
+        }
+        return tool.needs;
+    }
+    if (service === undefined) {
+        throw new TypeError(`hostFilled: tool '${name}' declares no \`needs\` — say which credential fills ` +
+            `${credentialFills.map(([f]) => `'${f}'`).join(', ')}: fromCredential({ service }).`);
+    }
+    const declared = credentialFills.find(([, f]) => f.service === service)?.[1];
+    return {
+        credential: service,
+        ...(declared?.scopes !== undefined && { scopes: declared.scopes }),
+        ...(declared?.mode !== undefined && { mode: declared.mode }),
+    };
+}
+function wrapTool(tool, fills, strict) {
+    const name = tool.schema.name;
+    const props = propertiesOf(tool);
+    for (const field of Object.keys(fills)) {
+        if (strict && !Object.hasOwn(props, field)) {
+            if (declaresAtRoot(tool.schema.inputSchema, field))
+                refuseNested(tool, field);
+            throw new TypeError(`hostFilled: tool '${name}' has no argument '${field}'.`);
+        }
+        // Also named in a combinator or a nested schema: it cannot be removed from
+        // everything the model reads, so the tool is refused rather than left
+        // half-hidden.
+        if (mentionsElsewhere(tool.schema.inputSchema, field))
+            refuseNested(tool, field);
+        if (tool.wants !== undefined && Object.hasOwn(tool.wants, field)) {
+            throw new TypeError(`hostFilled: tool '${name}' declares '${field}' under \`wants\` — an argument is filled ` +
+                'by the host or resolved from a ref, not both.');
+        }
+        if (tool.askOrAssume !== undefined && Object.hasOwn(tool.askOrAssume, field)) {
+            throw new TypeError(`hostFilled: tool '${name}' declares '${field}' under \`askOrAssume\` — an argument is ` +
+                'filled by the host or asked of a person, not both.');
+        }
+    }
+    const needs = needsFor(tool, fills);
+    const inputSchema = withoutFields(tool.schema.inputSchema, Object.keys(fills));
+    const fieldNames = Object.keys(fills);
+    const inner = tool.execute.bind(tool);
+    return {
+        ...tool,
+        schema: { ...tool.schema, inputSchema },
+        ...(needs !== undefined && { needs }),
+        async execute(args, ctx) {
+            const given = isRecord(args) ? fieldNames.filter((f) => Object.hasOwn(args, f)) : [];
+            if (given.length > 0)
+                throw new HostFilledArgumentError(name, given);
+            const filled = {};
+            const secrets = [];
+            for (const field of fieldNames) {
+                const fill = fills[field];
+                const value = valueOf(name, field, fill, ctx);
+                filled[field] = value;
+                if (fill.from === 'credential')
+                    secrets.push(value, ...credentialValues(ctx.credential));
+            }
+            const base = isRecord(args) ? args : {};
+            try {
+                const result = await inner({ ...base, ...filled }, ctx);
+                return secrets.length === 0 ? result : scrubValue(result, secrets);
+            }
+            catch (err) {
+                throw secrets.length === 0 || !carries(err, secrets, 0, new Set())
+                    ? err
+                    : scrubbedError(err, secrets);
+            }
+        },
+    };
+}
+/**
+ * Whether `field` is named anywhere in the schema OTHER than the root's own
+ * `properties` / `required` — a combinator (`allOf`/`anyOf`/`oneOf`, `if`/
+ * `then`/`else`, `not`), `$defs`, `dependentRequired`/`dependencies`, or a
+ * nested object's `properties`/`required`. The root's own property schema is
+ * not walked.
+ */
+function mentionsElsewhere(schema, field) {
+    if (schema === null || typeof schema !== 'object')
+        return false;
+    const seen = new Set();
+    const walk = (node, root) => {
+        if (node === null || typeof node !== 'object' || seen.has(node))
+            return false;
+        seen.add(node);
+        if (Array.isArray(node))
+            return node.some((n) => walk(n, false));
+        const obj = node;
+        if (!root) {
+            const props = obj.properties;
+            if (props !== null && typeof props === 'object' && Object.hasOwn(props, field))
+                return true;
+            if (Array.isArray(obj.required) && obj.required.includes(field))
+                return true;
+        }
+        for (const key of ['dependentRequired', 'dependencies', 'dependentSchemas']) {
+            const dep = obj[key];
+            if (dep !== null && typeof dep === 'object') {
+                if (Object.hasOwn(dep, field))
+                    return true;
+                for (const v of Object.values(dep)) {
+                    if (Array.isArray(v) && v.includes(field))
+                        return true;
+                }
+            }
+        }
+        for (const [key, value] of Object.entries(obj)) {
+            if (root && key === 'required')
+                continue;
+            if (root && key === 'properties' && value !== null && typeof value === 'object') {
+                for (const [prop, sub] of Object.entries(value)) {
+                    if (prop !== field && walk(sub, false))
+                        return true;
+                }
+                continue;
+            }
+            if (walk(value, false))
+                return true;
+        }
+        return false;
+    };
+    return walk(schema, true);
+}
+/**
+ * Whether the ROOT object's shape names `field` through a combinator or a
+ * definition — anything that makes it an argument of the call without being
+ * one of the root's own `properties`. Nested objects' properties are not
+ * walked.
+ */
+function declaresAtRoot(schema, field) {
+    const SHAPE_KEYS = [
+        'allOf',
+        'anyOf',
+        'oneOf',
+        'not',
+        'if',
+        'then',
+        'else',
+        '$defs',
+        'definitions',
+    ];
+    const seen = new Set();
+    const walk = (node, root) => {
+        if (node === null || typeof node !== 'object' || seen.has(node))
+            return false;
+        seen.add(node);
+        if (Array.isArray(node))
+            return node.some((n) => walk(n, false));
+        const obj = node;
+        if (!root) {
+            const props = obj.properties;
+            if (props !== null && typeof props === 'object' && Object.hasOwn(props, field))
+                return true;
+            if (Array.isArray(obj.required) && obj.required.includes(field))
+                return true;
+        }
+        for (const key of ['dependentRequired', 'dependencies', 'dependentSchemas']) {
+            const dep = obj[key];
+            if (dep !== null && typeof dep === 'object' && Object.hasOwn(dep, field))
+                return true;
+        }
+        for (const key of SHAPE_KEYS) {
+            const value = obj[key];
+            if (value === null || typeof value !== 'object')
+                continue;
+            // `$defs` / `definitions` are maps of schemas; the others are schemas or lists.
+            const children = key === '$defs' || key === 'definitions' ? Object.values(value) : [value];
+            if (children.some((c) => walk(c, false)))
+                return true;
+        }
+        return false;
+    };
+    return walk(schema, true);
+}
+function refuseNested(tool, field) {
+    throw new TypeError(`hostFilled: tool '${tool.schema.name}' names '${field}' inside a nested schema or a ` +
+        'combinator (allOf/anyOf/oneOf, $defs, dependentRequired …), where it cannot be removed ' +
+        'from what the model reads — declare it as a top-level property, or wrap the tool yourself.');
+}
+function withoutFields(schema, fields) {
+    const props = { ...(schema.properties ?? {}) };
+    for (const f of fields)
+        delete props[f];
+    const out = { ...schema, properties: props };
+    if (Array.isArray(schema.required)) {
+        const required = schema.required.filter((r) => typeof r !== 'string' || !fields.includes(r));
+        if (required.length > 0)
+            out.required = required;
+        else
+            delete out.required;
+    }
+    return out;
+}
+// ─── Dispatch-time fill ─────────────────────────────────────────────
+function valueOf(tool, field, fill, ctx) {
+    if (fill.from === 'identity') {
+        const value = ctx?.identity?.[fill.field];
+        if (typeof value !== 'string' || value === '') {
+            throw new HostFilledValueMissingError(tool, field, `the run's caller named no identity ${fill.field}`);
+        }
+        return value;
+    }
+    const credential = ctx?.credential;
+    if (credential === undefined) {
+        throw new HostFilledValueMissingError(tool, field, 'no credential was resolved for the call');
+    }
+    let value;
+    try {
+        value = fill.read !== undefined ? fill.read(credential) : defaultRead(credential);
+    }
+    catch {
+        value = undefined;
+    }
+    if (typeof value !== 'string' || value === '') {
+        throw new HostFilledValueMissingError(tool, field, `its '${credential.kind}' credential has no single value to fill it with` +
+            (fill.read === undefined ? ' — pass fromCredential({ read })' : ''));
+    }
+    return value;
+}
+/**
+ * Every value of the credential itself, beside the filled one — its raw
+ * token or key and its header values — so an echo of the bare token is
+ * scrubbed even when `read` filled a decorated form (`Bearer …`).
+ */
+function credentialValues(credential) {
+    if (credential === undefined)
+        return [];
+    const out = [defaultRead(credential)];
+    try {
+        for (const v of Object.values(credential.toHeaders())) {
+            out.push(v);
+            if (typeof v === 'string' && /^(?:Bearer|Basic) /.test(v))
+                out.push(v.slice(v.indexOf(' ') + 1));
+        }
+    }
+    catch {
+        // A credential that cannot produce headers adds nothing.
+    }
+    // A short value (a header like `json`) would mangle ordinary text; only a
+    // value long enough to be a credential is scrubbed. The filled value itself
+    // is always scrubbed.
+    return out.filter((v) => typeof v === 'string' && v.length >= MIN_SCRUB_LENGTH);
+}
+function defaultRead(credential) {
+    const c = credential;
+    if (c.kind === 'bearer')
+        return c.token;
+    if (c.kind === 'apiKey')
+        return c.key;
+    return undefined;
+}
+// ─── Scrub on the way out ───────────────────────────────────────────
+function isRecord(v) {
+    return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+function isPlainContainer(v) {
+    if (Array.isArray(v))
+        return true;
+    if (v === null || typeof v !== 'object')
+        return false;
+    const proto = Object.getPrototypeOf(v);
+    return proto === Object.prototype || proto === null;
+}
+function scrubText(text, secrets) {
+    let out = text;
+    // Longest first, so `Bearer x` is replaced whole before `x`.
+    for (const s of [...new Set(secrets)].sort((a, b) => b.length - a.length)) {
+        out = out.split(s).join(HOST_FILLED_PLACEHOLDER);
+    }
+    return out;
+}
+/** The value with every occurrence of a secret replaced; the SAME value when none. */
+function scrubValue(value, secrets, seen = new Map()) {
+    if (typeof value === 'string')
+        return scrubText(value, secrets);
+    if (!isPlainContainer(value))
+        return value;
+    const prior = seen.get(value);
+    if (prior !== undefined)
+        return prior;
+    if (Array.isArray(value)) {
+        const out = [];
+        seen.set(value, out);
+        let changed = false;
+        for (const item of value) {
+            const next = scrubValue(item, secrets, seen);
+            if (next !== item)
+                changed = true;
+            out.push(next);
+        }
+        if (!changed)
+            seen.set(value, value);
+        return changed ? out : value;
+    }
+    const out = {};
+    seen.set(value, out);
+    let changed = false;
+    for (const key of Object.keys(value)) {
+        const item = value[key];
+        const next = scrubValue(item, secrets, seen);
+        if (next !== item)
+            changed = true;
+        out[key] = next;
+    }
+    if (!changed)
+        seen.set(value, value);
+    return changed ? out : value;
+}
+/** Whether a thrown value carries a secret anywhere a reader could find it. */
+function carries(value, secrets, depth, seen) {
+    if (typeof value === 'string')
+        return secrets.some((s) => value.includes(s));
+    if (value === null || typeof value !== 'object' || depth > 8 || seen.has(value))
+        return false;
+    seen.add(value);
+    // An error's own fields are mostly non-enumerable (`message`, `stack`,
+    // `cause`, `AggregateError.errors`), so every own name is read.
+    const keys = value instanceof Error ? Object.getOwnPropertyNames(value) : Object.keys(value);
+    for (const key of keys) {
+        let item;
+        try {
+            item = value[key];
+        }
+        catch {
+            continue;
+        }
+        if (carries(item, secrets, depth + 1, seen))
+            return true;
+    }
+    return false;
+}
+/** A replacement error: the name and the scrubbed message, nothing else. */
+function scrubbedError(err, secrets) {
+    let message;
+    try {
+        message = err instanceof Error ? String(err.message) : String(err);
+    }
+    catch {
+        message = 'the tool failed';
+    }
+    const out = new Error(scrubText(message, secrets));
+    out.name = err instanceof Error ? scrubText(err.name, secrets) : 'Error';
+    return out;
+}
+//# sourceMappingURL=hostFilled.js.map

package/dist/esm/tools/hostFilled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostFilled.js","sourceRoot":"","sources":["../../../src/tools/hostFilled.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AA6BH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAgD,EAAE;IAElD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,KAA8B;IACzD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAG3B;IAA2B;IAFvC,IAAI,GAAG,0BAAmC,CAAC;IAEpD,YAAqB,QAAgB,EAAW,MAAyB;QACvE,KAAK,CACH,SAAS,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC9D,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,+CAA+C;YACpF,0CAA0C,CAC7C,CAAC;QALiB,aAAQ,GAAR,QAAQ,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAmB;QAMvE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAG/B;IAA2B;IAFvC,IAAI,GAAG,+BAAwC,CAAC;IAEzD,YAAqB,QAAgB,EAAW,KAAa,EAAE,GAAW;QACxE,KAAK,CAAC,SAAS,QAAQ,gBAAgB,KAAK,gCAAgC,GAAG,GAAG,CAAC,CAAC;QADjE,aAAQ,GAAR,QAAQ,CAAQ;QAAW,UAAK,GAAL,KAAK,CAAQ;QAE3D,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAwBvD,MAAM,UAAU,UAAU,CACxB,WAAmC,EACnC,KAAyC;IAEzC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,QAAQ,CAAC,WAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,WAA8B,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW;QAC5B,qEAAqE;QACrE,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,oEAAoE;QACpE,8BAA8B;QAC9B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1D,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC;gBAAE,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CACH,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CACjB,4CAA4C,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uEAAuE;AAEvE,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IACtF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAI,KAAiC,CAAC,IAAI,CAAkC,CAAC;QACvF,MAAM,EAAE,GACN,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY;YAC1B,CAAE,IAA+B,CAAC,IAAI,KAAK,SAAS;gBAClD,OAAQ,IAA+B,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;YACjE,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU;gBACxB,CAAC,WAAW,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAC/C,IAA6B,CAAC,KAAe,CAC/C,CAAC,CAAC;QACP,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,SAAS,CACjB,yBAAyB,IAAI,0DAA0D;gBACrF,+BAA+B,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAA2C,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,IAAU;IAC9B,MAAM,KAAK,GAAI,IAAI,CAAC,MAAM,EAAE,WAA6D;QACvF,EAAE,UAAU,CAAC;IACf,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,uFAAuF;AACvF,SAAS,QAAQ,CAAC,IAAU,EAAE,KAAyC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAyC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CACzE,CAAC;IACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CACjB,qBAAqB,IAAI,6DAA6D;YACpF,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC/D,MAAM,IAAI,SAAS,CACjB,qBAAqB,IAAI,+BAA+B,IAAI,CAAC,KAAK,CAAC,UAAU,WAAW;gBACtF,eAAe,OAAO,IAAI,CAC7B,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CACjB,qBAAqB,IAAI,uDAAuD;YAC9E,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,KAAyC,EAAE,MAAe;IACtF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC;gBAAE,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC9E,MAAM,IAAI,SAAS,CAAC,qBAAqB,IAAI,sBAAsB,KAAK,IAAI,CAAC,CAAC;QAChF,CAAC;QACD,2EAA2E;QAC3E,sEAAsE;QACtE,eAAe;QACf,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC;YAAE,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,SAAS,CACjB,qBAAqB,IAAI,eAAe,KAAK,4CAA4C;gBACvF,+CAA+C,CAClD,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,SAAS,CACjB,qBAAqB,IAAI,eAAe,KAAK,2CAA2C;gBACtF,oDAAoD,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE;QACvC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;QACrC,KAAK,CAAC,OAAO,CAAC,IAAa,EAAE,GAAyB;YACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrE,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAa,CAAC;gBACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;gBACtB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;oBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;gBACxD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC;oBAChE,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;KACM,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,MAAe,EAAE,KAAa;IACvD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,IAAa,EAAW,EAAE;QACrD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;YAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/E,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC5E,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACzD,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,IAAI,IAAI,GAAG,KAAK,UAAU;gBAAE,SAAS;YACzC,IAAI,IAAI,IAAI,GAAG,KAAK,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,MAAe,EAAE,KAAa;IACpD,MAAM,UAAU,GAAG;QACjB,OAAO;QACP,OAAO;QACP,OAAO;QACP,KAAK;QACL,IAAI;QACJ,MAAM;QACN,MAAM;QACN,OAAO;QACP,aAAa;KACd,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,IAAa,EAAW,EAAE;QACrD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;YAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/E,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC5E,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxF,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAC1D,gFAAgF;YAChF,MAAM,QAAQ,GAAG,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3F,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,YAAY,CAAC,IAAU,EAAE,KAAa;IAC7C,MAAM,IAAI,SAAS,CACjB,qBAAqB,IAAI,CAAC,MAAM,CAAC,IAAI,YAAY,KAAK,gCAAgC;QACpF,yFAAyF;QACzF,4FAA4F,CAC/F,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,MAAyC,EACzC,MAAyB;IAEzB,MAAM,KAAK,GAAG,EAAE,GAAG,CAAE,MAAM,CAAC,UAAkD,IAAI,EAAE,CAAC,EAAE,CAAC;IACxF,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAA4B,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACtE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAI,MAAM,CAAC,QAAsB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CACpD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;;YAC5C,OAAO,GAAG,CAAC,QAAQ,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uEAAuE;AAEvE,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,IAAc,EAAE,GAAyB;IACrF,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,2BAA2B,CACnC,IAAI,EACJ,KAAK,EACL,sCAAsC,IAAI,CAAC,KAAK,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,EAAE,UAAU,CAAC;IACnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,2BAA2B,CAAC,IAAI,EAAE,KAAK,EAAE,yCAAyC,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,SAAS,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,2BAA2B,CACnC,IAAI,EACJ,KAAK,EACL,QAAQ,UAAU,CAAC,IAAI,kDAAkD;YACvE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,UAAkC;IAC1D,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,GAAG,GAAc,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;IAC3D,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,sBAAsB;IACtB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAC,UAAsB;IACzC,MAAM,CAAC,GAAG,UAA+E,CAAC;IAC1F,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC;IACtC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uEAAuE;AAEvE,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,OAA0B;IACzD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,6DAA6D;IAC7D,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,SAAS,UAAU,CACjB,KAAc,EACd,OAA0B,EAC1B,OAAO,IAAI,GAAG,EAAmB;IAEjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,GAAG,IAAI,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CACd,KAAc,EACd,OAA0B,EAC1B,KAAa,EACb,IAAiB;IAEjB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9F,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7F,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,GAAY,EAAE,OAA0B;IAC7D,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,iBAAiB,CAAC;IAC9B,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,GAAG,CAAC,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/hosting/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hosting/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;;;;;AAEH,6CAMuB;AALrB,uGAAA,QAAQ,OAAA;AACR,uGAAA,QAAQ,OAAA;AACR,2GAAA,YAAY,OAAA;AACZ,qHAAA,sBAAsB,OAAA;AACtB,0HAAA,2BAA2B,OAAA;AAG7B,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAC/E,oCAAoC;AAEpC,6CAAsD;AAA7C,uGAAA,QAAQ,OAAA;AAAE,0GAAA,WAAW,OAAA;AA6B9B,uDAO4B;AAN1B,iHAAA,aAAa,OAAA;AACb,+HAAA,2BAA2B,OAAA;AAC3B,iIAAA,6BAA6B,OAAA;AAK/B,2DAAuD;AAA9C,qHAAA,eAAe,OAAA;AAExB,yDAAqD;AAA5C,mHAAA,cAAc,OAAA;AACvB,yDAI6B;AAH3B,mHAAA,cAAc,OAAA;AACd,2HAAA,sBAAsB,OAAA;AACtB,+HAAA,0BAA0B,OAAA;AAM5B,6CAQuB;AAPrB,yGAAA,UAAU,OAAA;AACV,4GAAA,aAAa,OAAA;AACb,iHAAA,kBAAkB,OAAA;AAClB,+GAAA,gBAAgB,OAAA;AAChB,2GAAA,YAAY,OAAA;AACZ,4GAAA,aAAa,OAAA;AACb,4GAAA,aAAa,OAAA;AAEf,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AAEtB,uCAKoB;AAJlB,4HAAA,gCAAgC,OAAA;AAChC,uHAAA,2BAA2B,OAAA;AAC3B,+GAAA,mBAAmB,OAAA;AACnB,qHAAA,yBAAyB,OAAA;AAG3B,yCAkCqB;AAjCnB,8GAAA,iBAAiB,OAAA;AACjB,4GAAA,eAAe,OAAA;AACf,+GAAA,kBAAkB,OAAA;AAClB,iHAAA,oBAAoB,OAAA;AACpB,kHAAA,qBAAqB,OAAA;AACrB,8GAAA,iBAAiB,OAAA;AACjB,oHAAA,uBAAuB,OAAA;AACvB,oHAAA,uBAAuB,OAAA;AACvB,+GAAA,kBAAkB,OAAA;AAClB,+GAAA,kBAAkB,OAAA;AAClB,yHAAA,4BAA4B,OAAA;AAC5B,iHAAA,oBAAoB,OAAA;AACpB,kHAAA,qBAAqB,OAAA;AACrB,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,6HAAA,gCAAgC,OAAA;AAChC,sHAAA,yBAAyB,OAAA;AACzB,yHAAA,4BAA4B,OAAA;AAC5B,qHAAA,wBAAwB,OAAA;AACxB,qHAAA,wBAAwB,OAAA;AACxB,kHAAA,qBAAqB,OAAA;AACrB,wHAAA,2BAA2B,OAAA;AAC3B,yHAAA,4BAA4B,OAAA;AAC5B,6HAAA,gCAAgC,OAAA;AAChC,iHAAA,oBAAoB,OAAA;AACpB,0HAAA,6BAA6B,OAAA;AAC7B,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,+GAAA,kBAAkB,OAAA;AAClB,sHAAA,yBAAyB,OAAA;AACzB,kHAAA,qBAAqB,OAAA;AACrB,gHAAA,mBAAmB,OAAA;AACnB,kHAAA,qBAAqB,OAAA;AAIvB,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,0DAA0D;AAC1D,+CAAkF;AAAzE,8GAAA,cAAc,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,qHAAA,qBAAqB,OAAA;AASzD,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,kCAAkC;AAClC,6DAAyD;AAAhD,uHAAA,gBAAgB,OAAA;AAEzB,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,cAAc;AACd,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAE5B,4EAA4E;AAC5E,4EAA4E;AAC5E,4CAA4C;AAC5C,yCAAyC;AACzC,mDAKgC;AAJ9B,mHAAA,uBAAuB,OAAA;AACvB,mHAAA,uBAAuB,OAAA;AACvB,0HAAA,8BAA8B,OAAA;AAC9B,uHAAA,2BAA2B,OAAA;AAY7B,2EAA2E;AAC3E,iEAAiE;AACjE,8EAA8E;AAC9E,yDAAyD;AACzD,qEAA+E;AAAtE,sHAAA,WAAW,OAAA;AAAE,gIAAA,qBAAqB,OAAA;AAS3C,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,6DAA6D;AAC7D,gDAO4B;AAN1B,+GAAA,kBAAkB,OAAA;AAClB,uGAAA,UAAU,OAAA;AACV,wGAAA,WAAW,OAAA;AACX,+GAAA,kBAAkB,OAAA;AAIpB,gDAA0F;AAAjF,yGAAA,YAAY,OAAA;AACrB,+EAA+E;AAC/E,uEAAuE;AACvE,4CAM0B;AALxB,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,oHAAA,yBAAyB,OAAA;AAI3B,8DAMmC;AALjC,uHAAA,mBAAmB,OAAA;AACnB,gIAAA,4BAA4B,OAAA;AAC5B,iHAAA,aAAa,OAAA;AAIf,gDAK4B;AAJ1B,qHAAA,wBAAwB,OAAA;AACxB,0HAAA,6BAA6B,OAAA;AAC7B,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AAGtB,8EAA8E;AAC9E,0DAA0D;AAC1D,8CAU2B;AATzB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AAUjB,oDAAoD;AAA3C,2GAAA,YAAY,OAAA;AACrB,4CAA4E;AAAnE,wGAAA,aAAa,OAAA;AAAE,sGAAA,WAAW,OAAA;AACnC,8CAe2B;AAdzB,0GAAA,cAAc,OAAA;AACd,oHAAA,wBAAwB,OAAA;AAExB,+GAAA,mBAAmB,OAAA;AAarB,+EAA+E;AAC/E,uEAAuE;AACvE,2DAA2D;AAC3D,+CAAwE;AAA/D,2GAAA,WAAW,OAAA;AAAE,2GAAA,WAAW,OAAA;AAAE,4GAAA,YAAY,OAAA;AAuB/C,+EAA+E;AAC/E,yEAAyE;AACzE,qBAAqB;AACrB,mDAM0B;AALxB,mHAAA,iBAAiB,OAAA;AACjB,iHAAA,eAAe,OAAA;AACf,iHAAA,eAAe,OAAA;AACf,uHAAA,qBAAqB,OAAA;AACrB,oHAAA,kBAAkB,OAAA;AAQpB,2CAAqF;AAA5E,0GAAA,YAAY,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,iHAAA,mBAAmB,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAG9D,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2BAA2B;AAC3B,qDAK2B;AAJzB,qHAAA,kBAAkB,OAAA;AAClB,mHAAA,gBAAgB,OAAA;AAChB,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hosting/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;;;;;AAEH,6CAMuB;AALrB,uGAAA,QAAQ,OAAA;AACR,uGAAA,QAAQ,OAAA;AACR,2GAAA,YAAY,OAAA;AACZ,qHAAA,sBAAsB,OAAA;AACtB,0HAAA,2BAA2B,OAAA;AAG7B,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAC/E,oCAAoC;AAEpC,6CAAsD;AAA7C,uGAAA,QAAQ,OAAA;AAAE,0GAAA,WAAW,OAAA;AA6B9B,uDAO4B;AAN1B,iHAAA,aAAa,OAAA;AACb,+HAAA,2BAA2B,OAAA;AAC3B,iIAAA,6BAA6B,OAAA;AAK/B,2DAAuD;AAA9C,qHAAA,eAAe,OAAA;AAKxB,yDAAqD;AAA5C,mHAAA,cAAc,OAAA;AACvB,yDAI6B;AAH3B,mHAAA,cAAc,OAAA;AACd,2HAAA,sBAAsB,OAAA;AACtB,+HAAA,0BAA0B,OAAA;AAM5B,6CAQuB;AAPrB,yGAAA,UAAU,OAAA;AACV,4GAAA,aAAa,OAAA;AACb,iHAAA,kBAAkB,OAAA;AAClB,+GAAA,gBAAgB,OAAA;AAChB,2GAAA,YAAY,OAAA;AACZ,4GAAA,aAAa,OAAA;AACb,4GAAA,aAAa,OAAA;AAEf,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AAEtB,uCAKoB;AAJlB,4HAAA,gCAAgC,OAAA;AAChC,uHAAA,2BAA2B,OAAA;AAC3B,+GAAA,mBAAmB,OAAA;AACnB,qHAAA,yBAAyB,OAAA;AAG3B,yCAkCqB;AAjCnB,8GAAA,iBAAiB,OAAA;AACjB,4GAAA,eAAe,OAAA;AACf,+GAAA,kBAAkB,OAAA;AAClB,iHAAA,oBAAoB,OAAA;AACpB,kHAAA,qBAAqB,OAAA;AACrB,8GAAA,iBAAiB,OAAA;AACjB,oHAAA,uBAAuB,OAAA;AACvB,oHAAA,uBAAuB,OAAA;AACvB,+GAAA,kBAAkB,OAAA;AAClB,+GAAA,kBAAkB,OAAA;AAClB,yHAAA,4BAA4B,OAAA;AAC5B,iHAAA,oBAAoB,OAAA;AACpB,kHAAA,qBAAqB,OAAA;AACrB,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,6HAAA,gCAAgC,OAAA;AAChC,sHAAA,yBAAyB,OAAA;AACzB,yHAAA,4BAA4B,OAAA;AAC5B,qHAAA,wBAAwB,OAAA;AACxB,qHAAA,wBAAwB,OAAA;AACxB,kHAAA,qBAAqB,OAAA;AACrB,wHAAA,2BAA2B,OAAA;AAC3B,yHAAA,4BAA4B,OAAA;AAC5B,6HAAA,gCAAgC,OAAA;AAChC,iHAAA,oBAAoB,OAAA;AACpB,0HAAA,6BAA6B,OAAA;AAC7B,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,+GAAA,kBAAkB,OAAA;AAClB,sHAAA,yBAAyB,OAAA;AACzB,kHAAA,qBAAqB,OAAA;AACrB,gHAAA,mBAAmB,OAAA;AACnB,kHAAA,qBAAqB,OAAA;AAIvB,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,0DAA0D;AAC1D,+CAAkF;AAAzE,8GAAA,cAAc,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,qHAAA,qBAAqB,OAAA;AASzD,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,kCAAkC;AAClC,6DAAyD;AAAhD,uHAAA,gBAAgB,OAAA;AAEzB,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,cAAc;AACd,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAE5B,4EAA4E;AAC5E,4EAA4E;AAC5E,4CAA4C;AAC5C,yCAAyC;AACzC,mDAKgC;AAJ9B,mHAAA,uBAAuB,OAAA;AACvB,mHAAA,uBAAuB,OAAA;AACvB,0HAAA,8BAA8B,OAAA;AAC9B,uHAAA,2BAA2B,OAAA;AAY7B,2EAA2E;AAC3E,iEAAiE;AACjE,8EAA8E;AAC9E,yDAAyD;AACzD,qEAA+E;AAAtE,sHAAA,WAAW,OAAA;AAAE,gIAAA,qBAAqB,OAAA;AAS3C,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,6DAA6D;AAC7D,gDAO4B;AAN1B,+GAAA,kBAAkB,OAAA;AAClB,uGAAA,UAAU,OAAA;AACV,wGAAA,WAAW,OAAA;AACX,+GAAA,kBAAkB,OAAA;AAIpB,gDAA0F;AAAjF,yGAAA,YAAY,OAAA;AACrB,+EAA+E;AAC/E,uEAAuE;AACvE,4CAM0B;AALxB,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,oHAAA,yBAAyB,OAAA;AAI3B,8DAMmC;AALjC,uHAAA,mBAAmB,OAAA;AACnB,gIAAA,4BAA4B,OAAA;AAC5B,iHAAA,aAAa,OAAA;AAIf,gDAK4B;AAJ1B,qHAAA,wBAAwB,OAAA;AACxB,0HAAA,6BAA6B,OAAA;AAC7B,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AAGtB,8EAA8E;AAC9E,0DAA0D;AAC1D,8CAU2B;AATzB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AAUjB,oDAAoD;AAA3C,2GAAA,YAAY,OAAA;AACrB,4CAA4E;AAAnE,wGAAA,aAAa,OAAA;AAAE,sGAAA,WAAW,OAAA;AACnC,8CAe2B;AAdzB,0GAAA,cAAc,OAAA;AACd,oHAAA,wBAAwB,OAAA;AAExB,+GAAA,mBAAmB,OAAA;AAarB,+EAA+E;AAC/E,uEAAuE;AACvE,2DAA2D;AAC3D,+CAAwE;AAA/D,2GAAA,WAAW,OAAA;AAAE,2GAAA,WAAW,OAAA;AAAE,4GAAA,YAAY,OAAA;AAuB/C,+EAA+E;AAC/E,yEAAyE;AACzE,qBAAqB;AACrB,mDAM0B;AALxB,mHAAA,iBAAiB,OAAA;AACjB,iHAAA,eAAe,OAAA;AACf,iHAAA,eAAe,OAAA;AACf,uHAAA,qBAAqB,OAAA;AACrB,oHAAA,kBAAkB,OAAA;AAQpB,2CAAqF;AAA5E,0GAAA,YAAY,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,iHAAA,mBAAmB,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAG9D,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2BAA2B;AAC3B,qDAK2B;AAJzB,qHAAA,kBAAkB,OAAA;AAClB,mHAAA,gBAAgB,OAAA;AAChB,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA"}

package/dist/hosting/refusalStatus.js

@@ -80,5 +80,9 @@ exports.REFUSAL_STATUS = Object.freeze({
     ERR_ORIGIN_NOT_ALLOWED: 403,
     ERR_HOST_NOT_ALLOWED: 421,
     ERR_INVALID_SESSION_ID: 400,
+    // The app's `sealRequest` could not seal the credential the request carries
+    // (a header missing or unreadable) — the request is what is wrong, and the
+    // same caller can send it again with the credential.
+    ERR_REQUEST_NOT_SEALED: 400,
 });
 //# sourceMappingURL=refusalStatus.js.map

package/dist/hosting/refusalStatus.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusalStatus.js","sourceRoot":"","sources":["../../src/hosting/refusalStatus.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACU,QAAA,cAAc,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,GAAG;IACpB,kBAAkB,EAAE,GAAG;IACvB,qBAAqB,EAAE,GAAG;IAC1B,qBAAqB,EAAE,GAAG;IAC1B,kBAAkB,EAAE,GAAG;IACvB,qBAAqB,EAAE,GAAG;IAC1B,yBAAyB,EAAE,GAAG;IAC9B,mBAAmB,EAAE,GAAG;IACxB,6BAA6B,EAAE,GAAG;IAClC,sBAAsB,EAAE,GAAG;IAC3B,qBAAqB,EAAE,GAAG;IAC1B,wBAAwB,EAAE,GAAG;IAC7B,8EAA8E;IAC9E,8EAA8E;IAC9E,mCAAmC,EAAE,GAAG;IACxC,yEAAyE;IACzE,qBAAqB,EAAE,GAAG;IAC1B,wDAAwD;IACxD,6EAA6E;IAC7E,2DAA2D;IAC3D,6EAA6E;IAC7E,4EAA4E;IAC5E,oDAAoD;IACpD,4EAA4E;IAC5E,iEAAiE;IACjE,yEAAyE;IACzE,uCAAuC;IACvC,2EAA2E;IAC3E,0EAA0E;IAC1E,iEAAiE;IACjE,yBAAyB,EAAE,GAAG;IAC9B,iCAAiC,EAAE,GAAG;IACtC,qBAAqB,EAAE,GAAG;IAC1B,qBAAqB,EAAE,GAAG;IAC1B,6BAA6B,EAAE,GAAG;IAClC,6BAA6B,EAAE,GAAG;IAClC,wBAAwB,EAAE,GAAG;IAC7B,qBAAqB,EAAE,GAAG;IAC1B,6EAA6E;IAC7E,0EAA0E;IAC1E,yDAAyD;IACzD,mEAAmE;IACnE,iEAAiE;IACjE,gFAAgF;IAChF,0EAA0E;IAC1E,0BAA0B,EAAE,GAAG;IAC/B,sBAAsB,EAAE,GAAG;IAC3B,oBAAoB,EAAE,GAAG;IACzB,sBAAsB,EAAE,GAAG;CAC5B,CAAC,CAAC"}
+{"version":3,"file":"refusalStatus.js","sourceRoot":"","sources":["../../src/hosting/refusalStatus.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACU,QAAA,cAAc,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,GAAG;IACpB,kBAAkB,EAAE,GAAG;IACvB,qBAAqB,EAAE,GAAG;IAC1B,qBAAqB,EAAE,GAAG;IAC1B,kBAAkB,EAAE,GAAG;IACvB,qBAAqB,EAAE,GAAG;IAC1B,yBAAyB,EAAE,GAAG;IAC9B,mBAAmB,EAAE,GAAG;IACxB,6BAA6B,EAAE,GAAG;IAClC,sBAAsB,EAAE,GAAG;IAC3B,qBAAqB,EAAE,GAAG;IAC1B,wBAAwB,EAAE,GAAG;IAC7B,8EAA8E;IAC9E,8EAA8E;IAC9E,mCAAmC,EAAE,GAAG;IACxC,yEAAyE;IACzE,qBAAqB,EAAE,GAAG;IAC1B,wDAAwD;IACxD,6EAA6E;IAC7E,2DAA2D;IAC3D,6EAA6E;IAC7E,4EAA4E;IAC5E,oDAAoD;IACpD,4EAA4E;IAC5E,iEAAiE;IACjE,yEAAyE;IACzE,uCAAuC;IACvC,2EAA2E;IAC3E,0EAA0E;IAC1E,iEAAiE;IACjE,yBAAyB,EAAE,GAAG;IAC9B,iCAAiC,EAAE,GAAG;IACtC,qBAAqB,EAAE,GAAG;IAC1B,qBAAqB,EAAE,GAAG;IAC1B,6BAA6B,EAAE,GAAG;IAClC,6BAA6B,EAAE,GAAG;IAClC,wBAAwB,EAAE,GAAG;IAC7B,qBAAqB,EAAE,GAAG;IAC1B,6EAA6E;IAC7E,0EAA0E;IAC1E,yDAAyD;IACzD,mEAAmE;IACnE,iEAAiE;IACjE,gFAAgF;IAChF,0EAA0E;IAC1E,0BAA0B,EAAE,GAAG;IAC/B,sBAAsB,EAAE,GAAG;IAC3B,oBAAoB,EAAE,GAAG;IACzB,sBAAsB,EAAE,GAAG;IAC3B,4EAA4E;IAC5E,2EAA2E;IAC3E,qDAAqD;IACrD,sBAAsB,EAAE,GAAG;CAC5B,CAAC,CAAC"}

package/dist/hosting/requestSealing.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * requestSealing — a host hands each run the credential that arrived with ITS
+ * request, sealed for that run alone.
+ *
+ * `requestContext({ secrets })` (`agentfootprint/security`) seals a request's
+ * secrets; `requestCredentials` vends them to the tools that declare a `needs`
+ * for them. A host that runs the agent for you (`standingAgent`,
+ * `streamHandler`) cannot know which header holds the credential, so it asks
+ * the app — once per request, with the request's headers — through the
+ * {@link RequestSealer} option `sealRequest`, and passes the handle to that
+ * request's `run()` / `resume()` and nowhere else. The sealer is handed the
+ * headers ONLY: nothing about who is calling, so it can never be tempted to
+ * look a stored credential up by a name the caller could have claimed.
+ *
+ * THE RULES, in one funnel ({@link requestSealing}):
+ *   - asked only for a request that runs, after the caller is bound and every
+ *     refusal is behind it — a refused request never seals anything;
+ *   - the answer is a handle `requestContext` built, or `undefined` (no
+ *     request: a tool that needs one fails closed, by name);
+ *   - ONE HANDLE, ONE RUN, PROCESS-WIDE: a handle any host was handed before
+ *     is refused, so a sealer that caches one — even one shared by two doors
+ *     — cannot hand one caller's credential to another caller's run;
+ *   - a sealer that throws refuses the request in FIXED words
+ *     (`ERR_REQUEST_NOT_SEALED`, 400). Its own message is never sent: it may
+ *     quote the value it could not read.
+ * The handle never enters a frame, a stored session or a checkpoint; the
+ * headers never leave the sealer.
+ *
+ * Pattern: guarded strategy call. Role: hosting, run input.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestSealing = exports.REQUEST_NOT_SEALED = void 0;
+const requestContext_js_1 = require("../identity/requestContext.js");
+const errors_js_1 = require("./errors.js");
+/** The code a request refused by its sealer carries — the status is 400. */
+exports.REQUEST_NOT_SEALED = 'ERR_REQUEST_NOT_SEALED';
+/**
+ * Every handle any host in this process handed to a run — held weakly,
+ * compared by identity. Module-wide on purpose: two doors sharing one caching
+ * sealer must not each accept the same handle once.
+ */
+const handedToARun = new WeakSet();
+/**
+ * The one funnel a host seals through: the app's sealer, checked. `undefined`
+ * when no sealer was given — the host passes no request, exactly as before.
+ *
+ * @throws TypeError at construction when `sealer` is not a function.
+ */
+function requestSealing(sealer, door) {
+    if (sealer === undefined)
+        return undefined;
+    if (typeof sealer !== 'function') {
+        throw new TypeError(`[hosting] '${door}': sealRequest must be a function that returns ` +
+            'requestContext({ secrets }) for one request, or undefined.');
+    }
+    return async (facts) => {
+        let handle;
+        try {
+            handle = await sealer(facts);
+        }
+        catch {
+            // Never the sealer's message: it may quote the value it could not read.
+            throw new errors_js_1.WireRequestRefusal(exports.REQUEST_NOT_SEALED, `'${door}': the credentials this request carries could not be sealed for its run.`, 400);
+        }
+        if (handle === undefined)
+            return undefined;
+        if (!(0, requestContext_js_1.isRequestContext)(handle)) {
+            throw new TypeError(`[hosting] '${door}': sealRequest must return a handle built by ` +
+                'requestContext({ secrets }), or undefined — a plain object is refused, because its ' +
+                'values would travel wherever the run options are logged or copied.');
+        }
+        if (handedToARun.has(handle)) {
+            throw new TypeError(`[hosting] '${door}': sealRequest returned a handle it returned before. Every ` +
+                "request seals its own — a shared handle hands one caller's credential to another " +
+                "caller's run.");
+        }
+        handedToARun.add(handle);
+        return handle;
+    };
+}
+exports.requestSealing = requestSealing;
+//# sourceMappingURL=requestSealing.js.map