agentfootprint 9.64.0 → 9.66.0

package/dist/adapters/hosting/foundryResponses.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * adapters/hosting/foundryResponses — an agent behind Microsoft Foundry's
+ * hosted-agent contract.
+ *
+ * ── The split, and why it is here ────────────────────────────────────────────
+ * Two different things are needed to serve a Foundry hosted agent, and only one
+ * of them is Microsoft's:
+ *
+ *   • The **Responses protocol** — `input` items, a `response` object, the
+ *     named streaming lifecycle. That is a protocol several runtimes speak, so
+ *     it lives in `responsesWire.ts` with no vendor in it.
+ *   • The **hosting contract** — port 8088, `POST /responses`, a `HEAD` probe
+ *     on the same path, `GET /readiness` answering `{"status":"healthy"}`, and
+ *     `agent_session_id` as a session alias. That IS this runtime's contract,
+ *     the same way `/invocations` and `X-Amzn-…` are another's, and it is what
+ *     this file supplies.
+ *
+ * So this file is a configuration, not an implementation. Everything hard —
+ * draining on close, aborting when the caller hangs up, failing a handler that
+ * throws or answers nothing — is `httpHost`'s, shared with every other adapter
+ * rather than reimplemented here where the two would drift.
+ *
+ * ── What it does NOT do ──────────────────────────────────────────────────────
+ * **Workflow Visualizer topology is not provided.** The Inspector can invoke
+ * this host and render its answer; it does not learn that the answer came from
+ * four composed agents, because nothing in the Responses protocol carries that
+ * and inventing a channel for it would be claiming a compatibility this has
+ * never demonstrated. An agent's internal structure is readable from
+ * agentfootprint's own recorders.
+ *
+ * Everything the protocol does not carry — tool calls, image and file input,
+ * function-call output, structured output — is refused by name. See
+ * `responsesWire.ts`.
+ *
+ * This is an **inbound hosting adapter**: it is the door callers arrive at. It
+ * is not a model provider, and it has nothing to do with which model the agent
+ * calls — for Foundry models, that is `openai()` with the endpoint's base URL.
+ *
+ * @example  An agent behind the Inspector
+ *   import { foundryResponsesHost, memorySessions, standingAgent } from 'agentfootprint/hosting';
+ *
+ *   const handle = await standingAgent({
+ *     agent,
+ *     sessions: memorySessions(),
+ *     host: foundryResponsesHost(),
+ *   });
+ *   process.on('SIGTERM', () => void handle.close());
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.foundryResponsesHost = exports.FOUNDRY_SESSION_FIELDS = exports.FOUNDRY_READINESS_PATH = exports.FOUNDRY_INVOKE_PATH = exports.DEFAULT_FOUNDRY_PORT = void 0;
+const httpHost_js_1 = require("../../hosting/httpHost.js");
+const responsesWire_js_1 = require("./responsesWire.js");
+/** The port a Foundry hosted agent is expected on. */
+exports.DEFAULT_FOUNDRY_PORT = 8088;
+/** The path that takes a turn. */
+exports.FOUNDRY_INVOKE_PATH = '/responses';
+/** The path a Foundry hosted agent answers a readiness probe on. */
+exports.FOUNDRY_READINESS_PATH = '/readiness';
+/**
+ * Session aliases this contract accepts, in precedence order.
+ *
+ * `conversation` is the protocol's own; `agent_session_id` is this runtime's;
+ * `session_id` is the spelling several clients send anyway. First one present
+ * wins, so a caller using any of the three reaches the same session.
+ */
+exports.FOUNDRY_SESSION_FIELDS = [
+    'conversation',
+    'agent_session_id',
+    'session_id',
+];
+/**
+ * One mebibyte: large enough for any resume or job description this door was
+ * built to carry, small enough that a hostile caller cannot spend the heap.
+ */
+const DEFAULT_MAX_BODY_BYTES = 1_048_576;
+/**
+ * An {@link HttpHost} speaking Foundry's hosted-agent contract.
+ *
+ * @param options - Port, interface, model label and body ceiling.
+ */
+function foundryResponsesHost(options = {}) {
+    const { server, onUnhandled, model, hostname } = options;
+    // `port` and `hostname` name a socket a caller-owned server already bound, so
+    // they are passed only when this host is the one binding. Defaulting the port
+    // unconditionally would turn "attach to my server" into a refusal.
+    const socket = server
+        ? { server }
+        : {
+            port: options.port ?? exports.DEFAULT_FOUNDRY_PORT,
+            ...(hostname === undefined ? {} : { hostname }),
+            ...(onUnhandled === undefined ? {} : { onUnhandled }),
+        };
+    return (0, httpHost_js_1.httpHost)({
+        name: 'foundryResponsesHost',
+        wire: (0, responsesWire_js_1.responsesWire)({
+            ...(model === undefined ? {} : { defaultModel: model }),
+            sessionFields: exports.FOUNDRY_SESSION_FIELDS,
+            health: { status: 'healthy' },
+        }),
+        invokePath: exports.FOUNDRY_INVOKE_PATH,
+        healthPath: exports.FOUNDRY_READINESS_PATH,
+        // The Inspector asks whether the door is there before it uses it.
+        invokeHeadProbe: true,
+        maxBodyBytes: options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
+        ...socket,
+    });
+}
+exports.foundryResponsesHost = foundryResponsesHost;
+//# sourceMappingURL=foundryResponses.js.map

package/dist/adapters/hosting/foundryResponses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foundryResponses.js","sourceRoot":"","sources":["../../../src/adapters/hosting/foundryResponses.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;;;AAIH,2DAAoE;AACpE,yDAAmD;AAEnD,sDAAsD;AACzC,QAAA,oBAAoB,GAAG,IAAI,CAAC;AAEzC,kCAAkC;AACrB,QAAA,mBAAmB,GAAG,YAAY,CAAC;AAEhD,oEAAoE;AACvD,QAAA,sBAAsB,GAAG,YAAY,CAAC;AAEnD;;;;;;GAMG;AACU,QAAA,sBAAsB,GAAsB;IACvD,cAAc;IACd,kBAAkB;IAClB,YAAY;CACb,CAAC;AAEF;;;GAGG;AACH,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAqBzC;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,UAAuC,EAAE;IAC5E,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACzD,8EAA8E;IAC9E,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM;QACnB,CAAC,CAAC,EAAE,MAAM,EAAE;QACZ,CAAC,CAAC;YACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,4BAAoB;YAC1C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;SACtD,CAAC;IAEN,OAAO,IAAA,sBAAQ,EAAC;QACd,IAAI,EAAE,sBAAsB;QAC5B,IAAI,EAAE,IAAA,gCAAa,EAAC;YAClB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YACvD,aAAa,EAAE,8BAAsB;YACrC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;SAC9B,CAAC;QACF,UAAU,EAAE,2BAAmB;QAC/B,UAAU,EAAE,8BAAsB;QAClC,kEAAkE;QAClE,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,sBAAsB;QAC5D,GAAG,MAAM;KACV,CAAC,CAAC;AACL,CAAC;AA3BD,oDA2BC"}

package/dist/adapters/hosting/responsesWire.js

@@ -0,0 +1,322 @@
+"use strict";
+/**
+ * adapters/hosting/responsesWire — the Responses protocol, as an `HttpWire`.
+ *
+ * ── What this is, and what it deliberately is not ────────────────────────────
+ * This file speaks the **Responses** wire protocol: a request carries `input`
+ * as text or as message items, a reply is a `response` object with an id and a
+ * status, and a stream is a LIFECYCLE of named events that open the response,
+ * announce output, carry deltas, and close each part before closing the
+ * response itself.
+ *
+ * That protocol is nobody's product. It is the shape a Responses-speaking
+ * client sends and expects, and several hosted runtimes speak it. So it lives
+ * here as a dialect on its own, and the runtimes that CONFIGURE it — their
+ * paths, their ports, their probe bodies, their session aliases — live in their
+ * own files beside this one. Keeping the split means the next runtime that
+ * speaks Responses is a configuration rather than a copy, and it means no
+ * vendor's spelling ends up in the protocol.
+ *
+ * ── The subset ───────────────────────────────────────────────────────────────
+ * A text turn, streamed or not, with a session. Deliberately not the whole
+ * Responses API: tool calls, reasoning items, image/file input, structured
+ * output and function-call output are NOT carried, and each is REFUSED by name
+ * rather than dropped — a request whose content this dialect cannot represent
+ * is answered 400 before a turn is paid for, never answered 200 with the parts
+ * it happened to understand.
+ *
+ * @example  A host that speaks Responses on paths of its own choosing
+ *   httpHost({
+ *     name: 'myResponsesHost',
+ *     wire: responsesWire({ defaultModel: 'my-agent' }),
+ *     invokePath: '/responses',
+ *     healthPath: '/health',
+ *   });
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.responsesWire = exports.readResponsesSession = exports.readResponsesInput = exports.PUBLIC_FAILURE_MESSAGE = exports.DEFAULT_SESSION_FIELDS = void 0;
+const node_crypto_1 = require("node:crypto");
+const errors_js_1 = require("../../hosting/errors.js");
+/** Body fields that may carry a session id, in the order they are consulted. */
+exports.DEFAULT_SESSION_FIELDS = ['conversation', 'session_id'];
+/**
+ * What a caller is told when a handler THREW.
+ *
+ * A thrown error's message is the author's note to their own logs — a query, a
+ * path, a token in a connection string — and none of it is the caller's. A
+ * handler that CHOSE to fail chose its words for the caller, so those travel
+ * unchanged. The host tells this dialect which happened; it never guesses from
+ * the message.
+ */
+exports.PUBLIC_FAILURE_MESSAGE = 'The agent could not complete this request.';
+const DEFAULT_MODEL = 'agentfootprint';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function nonEmptyString(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
+}
+/**
+ * The text of one message's content, or a refusal naming what was in it.
+ *
+ * Every non-text part is refused rather than skipped: a resume with an attached
+ * image, silently reduced to the text around it, is a wrong answer delivered
+ * confidently.
+ */
+function inputTextFromContent(content) {
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content)) {
+        throw new errors_js_1.WireRequestRefusal('unsupported_input', 'message content must be text or an array of input_text parts');
+    }
+    const text = [];
+    for (const part of content) {
+        if (!isRecord(part) || part.type !== 'input_text' || typeof part.text !== 'string') {
+            const kind = isRecord(part) && typeof part.type === 'string' ? part.type : 'unknown';
+            throw new errors_js_1.WireRequestRefusal('unsupported_input', `this dialect carries text input only; '${kind}' input is not supported`);
+        }
+        text.push(part.text);
+    }
+    return text.join('');
+}
+/** The turn's text: a bare string, or the user message items that carry it. */
+function readResponsesInput(input) {
+    if (typeof input === 'string')
+        return input;
+    if (input === undefined || input === null) {
+        throw new errors_js_1.WireRequestRefusal('invalid_input', 'input is required');
+    }
+    if (!Array.isArray(input)) {
+        throw new errors_js_1.WireRequestRefusal('invalid_input', 'input must be text or an array of Responses message items');
+    }
+    const messages = [];
+    for (const item of input) {
+        if (!isRecord(item)) {
+            throw new errors_js_1.WireRequestRefusal('invalid_input', 'each input item must be an object');
+        }
+        // `type` is optional in the Responses grammar for a plain message.
+        if (item.type !== undefined && item.type !== 'message') {
+            throw new errors_js_1.WireRequestRefusal('unsupported_input', `this dialect carries message items only; '${String(item.type)}' items are not supported`);
+        }
+        if (item.role !== 'user') {
+            throw new errors_js_1.WireRequestRefusal('unsupported_input', `this dialect carries user messages only; role '${String(item.role)}' is not supported`);
+        }
+        messages.push(inputTextFromContent(item.content));
+    }
+    return messages.join('\n\n');
+}
+exports.readResponsesInput = readResponsesInput;
+/** The session this request claims, by whichever of its aliases it used. */
+function readResponsesSession(body, fields) {
+    for (const field of fields) {
+        const value = body[field];
+        // `conversation` is an object in the Responses grammar and a bare string in
+        // several dialects of it. Both are read, because refusing the spelling a
+        // client already sends teaches nothing.
+        const found = isRecord(value) ? nonEmptyString(value.id) : nonEmptyString(value);
+        if (found !== undefined)
+            return found;
+    }
+    return undefined;
+}
+exports.readResponsesSession = readResponsesSession;
+function identityFor(facts, options) {
+    const body = facts?.body ?? {};
+    const nonce = (0, node_crypto_1.randomUUID)().replaceAll('-', '');
+    return {
+        responseId: `resp_${nonce}`,
+        messageId: `msg_${nonce}`,
+        createdAt: Math.floor(Date.now() / 1000),
+        model: nonEmptyString(body.model) ?? options.defaultModel,
+        sessionId: readResponsesSession(body, options.sessionFields),
+    };
+}
+function outputPart(text) {
+    return { type: 'output_text', text, annotations: [], logprobs: [] };
+}
+function outputItem(identity, text, status) {
+    return {
+        id: identity.messageId,
+        type: 'message',
+        status,
+        role: 'assistant',
+        content: status === 'completed' ? [outputPart(text)] : [],
+    };
+}
+function responseObject(identity, status, text = '', error = null) {
+    return {
+        id: identity.responseId,
+        object: 'response',
+        created_at: identity.createdAt,
+        status,
+        error,
+        incomplete_details: null,
+        instructions: null,
+        parallel_tool_calls: true,
+        model: identity.model,
+        output: status === 'completed' ? [outputItem(identity, text, 'completed')] : [],
+        conversation: identity.sessionId === undefined ? null : { id: identity.sessionId },
+        usage: null,
+    };
+}
+/**
+ * What a caller may be told about a failure.
+ *
+ * A refusal this library authored carries a `code` and says what it says. A
+ * handler that threw carries none, and its words do not travel.
+ */
+function errorBody(message, code, origin) {
+    if (origin === 'threw') {
+        return { code: 'server_error', message: exports.PUBLIC_FAILURE_MESSAGE, type: 'server_error' };
+    }
+    return code === undefined
+        ? { code: 'server_error', message, type: 'server_error' }
+        : { code, message, type: 'invalid_request_error' };
+}
+/**
+ * The nine-event lifecycle one streamed response is made of.
+ *
+ * Holds this response's identity and its sequence counter, which is why it is
+ * built per request: two callers sharing a counter would each see a stream that
+ * skips numbers, and two sharing an id would see each other's response.
+ */
+function responsesFraming(identity) {
+    let sequence = 0;
+    let outputStarted = false;
+    let streamed = '';
+    let sawDelta = false;
+    const frame = (event, fields) => ({
+        event,
+        data: { type: event, sequence_number: sequence++, ...fields },
+    });
+    /**
+     * The two frames that must precede any text. Emitted on the first delta
+     * rather than at open, because a response that fails before producing a word
+     * never opened an output item and should not claim it did.
+     */
+    const begin = () => {
+        if (outputStarted)
+            return [];
+        outputStarted = true;
+        return [
+            frame('response.output_item.added', {
+                output_index: 0,
+                item: outputItem(identity, '', 'in_progress'),
+            }),
+            frame('response.content_part.added', {
+                item_id: identity.messageId,
+                output_index: 0,
+                content_index: 0,
+                part: outputPart(''),
+            }),
+        ];
+    };
+    const delta = (text) => {
+        if (text === '')
+            return [];
+        const frames = begin();
+        sawDelta = true;
+        streamed += text;
+        frames.push(frame('response.output_text.delta', {
+            item_id: identity.messageId,
+            output_index: 0,
+            content_index: 0,
+            delta: text,
+            logprobs: [],
+        }));
+        return frames;
+    };
+    return {
+        open: () => [
+            frame('response.created', { response: responseObject(identity, 'in_progress') }),
+            frame('response.in_progress', { response: responseObject(identity, 'in_progress') }),
+        ],
+        chunk: (text) => delta(text),
+        complete: (output) => {
+            const frames = [];
+            // A handler that streamed nothing still owes the caller its text, and one
+            // that streamed a PREFIX of it owes the rest. Anything else — a final
+            // output that contradicts what was streamed — is left as it was streamed:
+            // frames already on the wire cannot be taken back, and re-sending the
+            // whole text would duplicate what the caller already rendered.
+            if (!sawDelta)
+                frames.push(...delta(output));
+            else if (output.startsWith(streamed) && output.length > streamed.length) {
+                frames.push(...delta(output.slice(streamed.length)));
+            }
+            frames.push(...begin());
+            // THE COMPLETION IS AUTHORITATIVE — this library's law, and it outranks
+            // the protocol's own tidiness. When a handler's chunks were a preview of
+            // different final text rather than a prefix of it, the deltas already on
+            // the wire cannot be recalled, and this reports the ANSWER rather than
+            // the preview. The two then disagree, which is a documented limit of
+            // streaming a preview; reporting the preview as the answer would be a
+            // wrong answer, which is not.
+            const text = output;
+            frames.push(frame('response.output_text.done', {
+                item_id: identity.messageId,
+                output_index: 0,
+                content_index: 0,
+                text,
+                logprobs: [],
+            }), frame('response.content_part.done', {
+                item_id: identity.messageId,
+                output_index: 0,
+                content_index: 0,
+                part: outputPart(text),
+            }), frame('response.output_item.done', {
+                output_index: 0,
+                item: outputItem(identity, text, 'completed'),
+            }), frame('response.completed', { response: responseObject(identity, 'completed', text) }));
+            return frames;
+        },
+        failure: (message, code, origin) => [
+            frame('response.failed', {
+                response: responseObject(identity, 'failed', '', errorBody(message, code, origin)),
+            }),
+        ],
+    };
+}
+/**
+ * An `HttpWire` speaking the Responses protocol.
+ *
+ * Pair it with `httpHost` and the paths your deployment contract names. The
+ * host keeps its own promises — draining, aborting on disconnect, failing a
+ * handler that throws or answers nothing — and this supplies only the dialect.
+ */
+function responsesWire(options = {}) {
+    const resolved = {
+        defaultModel: options.defaultModel ?? DEFAULT_MODEL,
+        sessionFields: options.sessionFields ?? exports.DEFAULT_SESSION_FIELDS,
+    };
+    const health = options.health ?? { status: 'ok' };
+    return {
+        readRequest(facts) {
+            const input = readResponsesInput(facts.body.input);
+            if (input.trim() === '') {
+                throw new errors_js_1.WireRequestRefusal('invalid_input', 'input text must not be empty');
+            }
+            const sessionId = readResponsesSession(facts.body, resolved.sessionFields);
+            return { input, ...(sessionId === undefined ? {} : { sessionId }) };
+        },
+        // This dialect's callers choose in the body and never touch `Accept`.
+        wantsStream: (facts) => facts.body.stream === true,
+        stream: (facts) => responsesFraming(identityFor(facts, resolved)),
+        health: () => health,
+        output: (output, facts) => responseObject(identityFor(facts, resolved), 'completed', output),
+        chunk: (text) => ({ type: 'response.output_text.delta', delta: text }),
+        failure: (message, code, facts, origin) => {
+            // A terminal that ended an ACCEPTED response is reported as a failed
+            // response object — that is what the protocol says a response that got
+            // as far as running and then stopped looks like. A coded refusal ended
+            // the REQUEST before any of that, and gets the error envelope a client
+            // reads off a 4xx.
+            if (code === undefined) {
+                return responseObject(identityFor(facts, resolved), 'failed', '', errorBody(message, undefined, origin));
+            }
+            return { error: errorBody(message, code, origin) };
+        },
+    };
+}
+exports.responsesWire = responsesWire;
+//# sourceMappingURL=responsesWire.js.map

package/dist/adapters/hosting/responsesWire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responsesWire.js","sourceRoot":"","sources":["../../../src/adapters/hosting/responsesWire.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;AAEH,6CAAyC;AAEzC,uDAA6D;AAS7D,gFAAgF;AACnE,QAAA,sBAAsB,GAAsB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;AAExF;;;;;;;;GAQG;AACU,QAAA,sBAAsB,GAAG,4CAA4C,CAAC;AAEnF,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAmBvC,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,8BAAkB,CAC1B,mBAAmB,EACnB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACrF,MAAM,IAAI,8BAAkB,CAC1B,mBAAmB,EACnB,0CAA0C,IAAI,0BAA0B,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,+EAA+E;AAC/E,SAAgB,kBAAkB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,8BAAkB,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,8BAAkB,CAC1B,eAAe,EACf,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,8BAAkB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACrF,CAAC;QACD,mEAAmE;QACnE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,IAAI,8BAAkB,CAC1B,mBAAmB,EACnB,6CAA6C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,8BAAkB,CAC1B,mBAAmB,EACnB,kDAAkD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CACxF,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAhCD,gDAgCC;AAED,4EAA4E;AAC5E,SAAgB,oBAAoB,CAClC,IAAgB,EAChB,MAAyB;IAEzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,4EAA4E;QAC5E,yEAAyE;QACzE,wCAAwC;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAbD,oDAaC;AAUD,SAAS,WAAW,CAClB,KAAmC,EACnC,OAA+E;IAE/E,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAA,wBAAU,GAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO;QACL,UAAU,EAAE,QAAQ,KAAK,EAAE;QAC3B,SAAS,EAAE,OAAO,KAAK,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACxC,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY;QACzD,SAAS,EAAE,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CACjB,QAA0B,EAC1B,IAAY,EACZ,MAAmC;IAEnC,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,SAAS;QACtB,IAAI,EAAE,SAAS;QACf,MAAM;QACN,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,QAA0B,EAC1B,MAA8C,EAC9C,IAAI,GAAG,EAAE,EACT,QAA2B,IAAI;IAE/B,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,UAAU;QACvB,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,QAAQ,CAAC,SAAS;QAC9B,MAAM;QACN,KAAK;QACL,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,IAAI;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/E,YAAY,EAAE,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE;QAClF,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,OAAe,EACf,IAAwB,EACxB,MAAiC;IAEjC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,8BAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;QACzD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,QAA0B;IAClD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,MAAkB,EAAe,EAAE,CAAC,CAAC;QACjE,KAAK;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE;KAC9D,CAAC,CAAC;IAEH;;;;OAIG;IACH,MAAM,KAAK,GAAG,GAAkB,EAAE;QAChC,IAAI,aAAa;YAAE,OAAO,EAAE,CAAC;QAC7B,aAAa,GAAG,IAAI,CAAC;QACrB,OAAO;YACL,KAAK,CAAC,4BAA4B,EAAE;gBAClC,YAAY,EAAE,CAAC;gBACf,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,EAAE,aAAa,CAAC;aAC9C,CAAC;YACF,KAAK,CAAC,6BAA6B,EAAE;gBACnC,OAAO,EAAE,QAAQ,CAAC,SAAS;gBAC3B,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,CAAC;gBAChB,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;aACrB,CAAC;SACH,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAiB,EAAE;QAC5C,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;QACvB,QAAQ,GAAG,IAAI,CAAC;QAChB,QAAQ,IAAI,IAAI,CAAC;QACjB,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,4BAA4B,EAAE;YAClC,OAAO,EAAE,QAAQ,CAAC,SAAS;YAC3B,YAAY,EAAE,CAAC;YACf,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,EAAE;SACb,CAAC,CACH,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC;YACV,KAAK,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YAChF,KAAK,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;SACrF;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5B,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YACnB,MAAM,MAAM,GAAkB,EAAE,CAAC;YACjC,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,sEAAsE;YACtE,+DAA+D;YAC/D,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;iBACxC,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;YACxB,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,8BAA8B;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC;YACpB,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,2BAA2B,EAAE;gBACjC,OAAO,EAAE,QAAQ,CAAC,SAAS;gBAC3B,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,CAAC;gBAChB,IAAI;gBACJ,QAAQ,EAAE,EAAE;aACb,CAAC,EACF,KAAK,CAAC,4BAA4B,EAAE;gBAClC,OAAO,EAAE,QAAQ,CAAC,SAAS;gBAC3B,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,CAAC;gBAChB,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;aACvB,CAAC,EACF,KAAK,CAAC,2BAA2B,EAAE;gBACjC,YAAY,EAAE,CAAC;gBACf,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC;aAC9C,CAAC,EACF,KAAK,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CACvF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,iBAAiB,EAAE;gBACvB,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;aACnF,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,UAAgC,EAAE;IAC9D,MAAM,QAAQ,GAAG;QACf,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,aAAa;QACnD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,8BAAsB;KAC/D,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAElD,OAAO;QACL,WAAW,CAAC,KAAK;YACf,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,8BAAkB,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC3E,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACtE,CAAC;QACD,sEAAsE;QACtE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;QAClD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;QAC5F,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACtE,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,mBAAmB;YACnB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,cAAc,CACnB,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAC5B,QAAQ,EACR,EAAE,EACF,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAvCD,sCAuCC"}

package/dist/adapters/identity/agentcore.js

@@ -84,7 +84,7 @@
  * `getCredential` first runs (or never, if you inject `_client` / `_sdk`).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.agentCoreIdentity = void 0;
+exports.completeAgentCoreAuthorization = exports.agentCoreIdentity = void 0;
 const lazyRequire_js_1 = require("../../lib/lazyRequire.js");
 const kinds_js_1 = require("../../identity/kinds.js");
 /**
@@ -223,6 +223,20 @@ function createIdentityClient(options) {
         async getWorkloadAccessTokenForUserId(input) {
             return ((await send(mod.GetWorkloadAccessTokenForUserIdCommand, 'GetWorkloadAccessTokenForUserIdCommand', input)) ?? {});
         },
+        async getResourceApiKey(input) {
+            const r = (await send(mod.GetResourceApiKeyCommand, 'GetResourceApiKeyCommand', input));
+            return { ...(r?.apiKey !== undefined && { apiKey: r.apiKey }) };
+        },
+        async completeResourceTokenAuth(input) {
+            // `CompleteResourceTokenAuthRequest` is `{ sessionUri, userIdentifier }`,
+            // where userIdentifier is a UNION with exactly one member set — the
+            // person's own token, or the id the agent asserts for them. Success is an
+            // empty 200, so there is nothing to map back.
+            await send(mod.CompleteResourceTokenAuthCommand, 'CompleteResourceTokenAuthCommand', {
+                sessionUri: input.sessionId,
+                userIdentifier: input.userToken !== undefined ? { userToken: input.userToken } : { userId: input.userId },
+            });
+        },
         async getWorkloadAccessTokenForJWT(input) {
             // `GetWorkloadAccessTokenForJWTRequest` is `{ workloadName, userToken }`,
             // both required, and the response is `{ workloadAccessToken }` — verified
@@ -310,14 +324,50 @@ function agentCoreIdentity(options = {}) {
         }
         return requireWorkloadAccessToken(await c.getWorkloadAccessTokenForUserId({ workloadName: options.workloadName, userId }), 'GetWorkloadAccessTokenForUserId');
     };
+    const userFlow = options.userFlow ?? 'consent';
+    const apiKeyServices = new Set(options.apiKeyServices ?? []);
+    const apiKeyHeader = options.apiKeyHeader ?? 'x-api-key';
     return {
         id: options.id ?? 'agentcore-identity',
         async getCredential(req) {
             const workloadIdentityToken = await resolveWorkloadToken(req);
+            // An API-key service never touches the OAuth path: different operation,
+            // different credential kind, and no consent round-trip exists for it.
+            if (apiKeyServices.has(req.service)) {
+                const c = getClient();
+                if (!c.getResourceApiKey) {
+                    throw new Error(`agentCoreIdentity: '${req.service}' is listed in \`apiKeyServices\` but the ` +
+                        'injected `_client` has no getResourceApiKey. Implement it, or drop the service ' +
+                        'from the list to vend it as OAuth.');
+                }
+                if (!workloadIdentityToken) {
+                    // Required on `GetResourceApiKeyRequest`, exactly as on the OAuth
+                    // call — verified against the real SDK's types, not assumed. Sending
+                    // without one buys an opaque ValidationException; this names the two
+                    // ways to supply it instead.
+                    throw new Error(`agentCoreIdentity: GetResourceApiKey for '${req.service}' requires a workload ` +
+                        'identity token, and none was available for this request.\n' +
+                        '  Inside AgentCore Runtime the container is given one — pass it as ' +
+                        '`workloadIdentityToken`.\n' +
+                        '  Elsewhere, configure `workloadName` so a per-user token is resolved first.');
+                }
+                const keyRes = await c.getResourceApiKey({
+                    resourceCredentialProviderName: req.service,
+                    workloadIdentityToken,
+                });
+                if (!keyRes.apiKey) {
+                    throw new Error(`agentCoreIdentity: GetResourceApiKey for '${req.service}' returned no key.`);
+                }
+                return { status: 'issued', credential: (0, kinds_js_1.apiKey)(keyRes.apiKey, apiKeyHeader) };
+            }
             const res = await getClient().getResourceOauth2Token({
                 resourceCredentialProviderName: req.service,
                 scopes: req.scopes ?? [],
-                oauth2Flow: req.mode === 'user' ? 'USER_FEDERATION' : 'M2M',
+                oauth2Flow: req.mode === 'user'
+                    ? userFlow === 'exchange'
+                        ? 'ON_BEHALF_OF_TOKEN_EXCHANGE'
+                        : 'USER_FEDERATION'
+                    : 'M2M',
                 forceAuthentication: req.forceReauth ?? false,
                 ...(workloadIdentityToken && { workloadIdentityToken }),
             });
@@ -342,4 +392,70 @@ function agentCoreIdentity(options = {}) {
     };
 }
 exports.agentCoreIdentity = agentCoreIdentity;
+/**
+ * Tell AgentCore the person finished consenting, so the token lands in the vault.
+ *
+ * ── Where this runs, and why it is not a provider method ─────────────────────
+ * A 3LO consent has three actors and two processes. The agent asks for a
+ * credential and gets back `authorization-required` with a URL and a session
+ * id; the PERSON opens that URL in their browser and approves; AgentCore then
+ * redirects their browser to a callback route **your web app** owns. That route
+ * is where this belongs — a different process from the agent run, often a
+ * different service — so it takes its own connection options rather than
+ * pretending to be a method on a provider that route has never seen.
+ *
+ * Your route's job before calling this is the part nobody else can do: confirm
+ * the browser session really belongs to the user you are about to name. This
+ * function is the handshake, not the authentication.
+ *
+ * ── After it returns ─────────────────────────────────────────────────────────
+ * Nothing is handed back — success is an empty acknowledgement. The token now
+ * exists in the vault for that (workload, user), and the way to obtain it is to
+ * run the agent's request again: the next `getCredential` for that service
+ * returns `issued` where the last one returned `authorization-required`. In
+ * agentfootprint terms the consent is a PAUSE, and this is what makes the
+ * resume succeed.
+ *
+ * The authorization URL and its session are short-lived (AWS documents ten
+ * minutes) — a person who wanders off has to start the consent again, and the
+ * refusal you get is AgentCore's, not this adapter's.
+ *
+ * @example  An Express-style callback route
+ *   app.get('/oauth/callback', async (req, res) => {
+ *     const user = await requireSignedInUser(req);   // yours, and load-bearing
+ *     await completeAgentCoreAuthorization({
+ *       sessionId: String(req.query.session),
+ *       userId: user.id,
+ *       region: 'us-east-1',
+ *     });
+ *     res.send('Approved — you can return to the assistant.');
+ *   });
+ */
+async function completeAgentCoreAuthorization(options) {
+    if (!options.sessionId) {
+        throw new Error('completeAgentCoreAuthorization: `sessionId` is required — it is the `sessionId` from ' +
+            'the `authorization-required` result that started this consent.');
+    }
+    if ((options.userToken === undefined) === (options.userId === undefined)) {
+        // Both or neither. Naming a person twice is ambiguous; naming them zero
+        // times completes a consent for nobody.
+        throw new Error('completeAgentCoreAuthorization: pass exactly one of `userToken` (the person’s own JWT, ' +
+            'preferred) or `userId` (an id you assert for them).');
+    }
+    const client = options._client ??
+        createIdentityClient({
+            ...(options.region !== undefined && { region: options.region }),
+            ...(options._sdk !== undefined && { _sdk: options._sdk }),
+        });
+    if (!client.completeResourceTokenAuth) {
+        throw new Error('completeAgentCoreAuthorization: the injected `_client` has no ' +
+            'completeResourceTokenAuth. Implement it, or omit `_client` to use the SDK.');
+    }
+    await client.completeResourceTokenAuth({
+        sessionId: options.sessionId,
+        ...(options.userToken !== undefined && { userToken: options.userToken }),
+        ...(options.userId !== undefined && { userId: options.userId }),
+    });
+}
+exports.completeAgentCoreAuthorization = completeAgentCoreAuthorization;
 //# sourceMappingURL=agentcore.js.map

package/dist/adapters/identity/agentcore.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.js","sourceRoot":"","sources":["../../../src/adapters/identity/agentcore.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;;;AAEH,6DAAuD;AAMvD,sDAAiD;AAsGjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,GAAY;IAC/C,MAAM,CAAC,GAAG,GAA0E,CAAC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC9F,MAAM,MAAM,GAAG,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC;IAC5C,OAAO,IAAI,KAAK,CACd,sBAAsB,OAAO,aAAa,IAAI,EAAE;QAC9C,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,wFAAwF;QACxF,iFAAiF,CACpF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,0BAA0B,CACjC,QAAsE,EACtE,SAAiB;IAEjB,MAAM,KAAK,GAAG,QAAQ,EAAE,mBAAmB,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,0DAA0D;QACvF,mFAAmF;QACnF,uBAAuB;QACvB,0BAA0B,MAAM,CAAC,MAAM,WAAW;QAClD,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACrD,2FAA2F,CAC9F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,OAAiC;IAC7D,IAAI,GAAsC,CAAC;IAC3C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,sFAAsF;YACtF,GAAG,GAAG,IAAA,4BAAW,EAAoC,mCAAmC,CAAC,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,uFAAuF;gBACrF,6DAA6D;gBAC7D,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAElG,MAAM,IAAI,GAAG,KAAK,EAChB,IAA+C,EAC/C,IAAY,EACZ,KAAc,EACI,EAAE;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,uEAAuE,IAAI,IAAI;gBAC7E,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,sBAAsB,CAAC,KAAK;YAChC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;gBACjC,wEAAwE;gBACxE,uEAAuE;gBACvE,+DAA+D;gBAC/D,MAAM,IAAI,KAAK,CACb,oFAAoF;oBAClF,wCAAwC;oBACxC,iFAAiF;oBACjF,4BAA4B;oBAC5B,4EAA4E;oBAC5E,4EAA4E,CAC/E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CACnB,GAAG,CAAC,6BAA6B,EACjC,+BAA+B,EAC/B,KAAK,CACN,CAIO,CAAC;YACT,OAAO;gBACL,GAAG,CAAC,CAAC,EAAE,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnE,GAAG,CAAC,CAAC,EAAE,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;gBAClF,yEAAyE;gBACzE,GAAG,CAAC,CAAC,EAAE,UAAU,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,EAAE;QACF,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,wDAAwD;QACxD,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,6DAA6D;QAC7D,KAAK,CAAC,+BAA+B,CAAC,KAAK;YACzC,OAAO,CACJ,CAAC,MAAM,IAAI,CACV,GAAG,CAAC,sCAAsC,EAC1C,wCAAwC,EACxC,KAAK,CACN,CAA6C,IAAI,EAAE,CACrD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,4BAA4B,CAAC,KAAK;YACtC,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,oEAAoE;YACpE,+CAA+C;YAC/C,OAAO,CACJ,CAAC,MAAM,IAAI,CACV,GAAG,CAAC,mCAAmC,EACvC,qCAAqC,EACrC,KAAK,CACN,CAA6C,IAAI,EAAE,CACrD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAiC;IACtD,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC5C,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,QAAyC,EAAsB,EAAE,CACzF,QAAQ,CAAC,SAAS,CAAC;AAErB,mFAAmF;AACnF,SAAgB,iBAAiB,CAAC,UAAoC,EAAE;IACtE,IAAI,MAA+C,CAAC;IACpD,MAAM,SAAS,GAAG,GAAgC,EAAE,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAExD,2EAA2E;IAC3E,yEAAyE;IACzE,mEAAmE;IACnE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAsB,EAA+B,EAAE;QACzF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;QAEtC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,sEAAsE;gBACtE,oEAAoE;gBACpE,mEAAmE;gBACnE,6CAA6C;gBAC7C,MAAM,IAAI,KAAK,CACb,sFAAsF;oBACpF,gFAAgF;oBAChF,gFAAgF,CACnF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,mFAAmF;oBACjF,gFAAgF;oBAChF,yEAAyE;oBACzE,iFAAiF;oBACjF,cAAc,CACjB,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,CAAC,4BAA4B,KAAK,UAAU,EAAE,CAAC;gBACzD,uEAAuE;gBACvE,uCAAuC;gBACvC,MAAM,IAAI,KAAK,CACb,8EAA8E;oBAC5E,0EAA0E,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,0BAA0B,CAC/B,MAAM,CAAC,CAAC,4BAA4B,CAAC;gBACnC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,EACF,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,IAAI,SAAS,EAAE,CAAC;YACnD,yEAAyE;YACzE,sEAAsE;YACtE,4CAA4C;YAC5C,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,IAAI,GAAG,CAAC,OAAO,+BAA+B;gBAC9C,kFAAkF;gBAClF,kFAAkF;gBAClF,cAAc;gBACd,sEAAsE,CACzE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC;QAExF,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;YAC5D,sEAAsE;YACtE,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,IAAI,KAAK,CACb,iFAAiF;gBAC/E,mFAAmF;gBACnF,yEAAyE,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO,0BAA0B,CAC/B,MAAM,CAAC,CAAC,+BAA+B,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,EACvF,iCAAiC,CAClC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,oBAAoB;QACtC,KAAK,CAAC,aAAa,CAAC,GAAsB;YACxC,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,sBAAsB,CAAC;gBACnD,8BAA8B,EAAE,GAAG,CAAC,OAAO;gBAC3C,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;gBACxB,UAAU,EAAE,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK;gBAC3D,mBAAmB,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;gBAC7C,GAAG,CAAC,qBAAqB,IAAI,EAAE,qBAAqB,EAAE,CAAC;aACxD,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,sEAAsE;gBACtE,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,UAAU,EAAE,IAAA,iBAAM,EAAC,GAAG,CAAC,WAAW,CAAC;oBACnC,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;iBACjE,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACzB,OAAO;oBACL,MAAM,EAAE,wBAAwB;oBAChC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;oBACtC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;iBAC/B,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,CAAC,OAAO,qBAAqB;gBAChF,2CAA2C,CAC9C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAzHD,8CAyHC"}
+{"version":3,"file":"agentcore.js","sourceRoot":"","sources":["../../../src/adapters/identity/agentcore.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;;;AAEH,6DAAuD;AAMvD,sDAAyD;AA6JzD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,GAAY;IAC/C,MAAM,CAAC,GAAG,GAA0E,CAAC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC9F,MAAM,MAAM,GAAG,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC;IAC5C,OAAO,IAAI,KAAK,CACd,sBAAsB,OAAO,aAAa,IAAI,EAAE;QAC9C,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,wFAAwF;QACxF,iFAAiF,CACpF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,0BAA0B,CACjC,QAAsE,EACtE,SAAiB;IAEjB,MAAM,KAAK,GAAG,QAAQ,EAAE,mBAAmB,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,0DAA0D;QACvF,mFAAmF;QACnF,uBAAuB;QACvB,0BAA0B,MAAM,CAAC,MAAM,WAAW;QAClD,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACrD,2FAA2F,CAC9F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,OAAiC;IAC7D,IAAI,GAAsC,CAAC;IAC3C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,sFAAsF;YACtF,GAAG,GAAG,IAAA,4BAAW,EAAoC,mCAAmC,CAAC,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,uFAAuF;gBACrF,6DAA6D;gBAC7D,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAElG,MAAM,IAAI,GAAG,KAAK,EAChB,IAA+C,EAC/C,IAAY,EACZ,KAAc,EACI,EAAE;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,uEAAuE,IAAI,IAAI;gBAC7E,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,sBAAsB,CAAC,KAAK;YAChC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;gBACjC,wEAAwE;gBACxE,uEAAuE;gBACvE,+DAA+D;gBAC/D,MAAM,IAAI,KAAK,CACb,oFAAoF;oBAClF,wCAAwC;oBACxC,iFAAiF;oBACjF,4BAA4B;oBAC5B,4EAA4E;oBAC5E,4EAA4E,CAC/E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CACnB,GAAG,CAAC,6BAA6B,EACjC,+BAA+B,EAC/B,KAAK,CACN,CAIO,CAAC;YACT,OAAO;gBACL,GAAG,CAAC,CAAC,EAAE,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnE,GAAG,CAAC,CAAC,EAAE,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;gBAClF,yEAAyE;gBACzE,GAAG,CAAC,CAAC,EAAE,UAAU,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,EAAE;QACF,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,wDAAwD;QACxD,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,6DAA6D;QAC7D,KAAK,CAAC,+BAA+B,CAAC,KAAK;YACzC,OAAO,CACJ,CAAC,MAAM,IAAI,CACV,GAAG,CAAC,sCAAsC,EAC1C,wCAAwC,EACxC,KAAK,CACN,CAA6C,IAAI,EAAE,CACrD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAE9E,CAAC;YACT,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,yBAAyB,CAAC,KAAK;YACnC,0EAA0E;YAC1E,oEAAoE;YACpE,0EAA0E;YAC1E,8CAA8C;YAC9C,MAAM,IAAI,CAAC,GAAG,CAAC,gCAAgC,EAAE,kCAAkC,EAAE;gBACnF,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,cAAc,EACZ,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,4BAA4B,CAAC,KAAK;YACtC,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,oEAAoE;YACpE,+CAA+C;YAC/C,OAAO,CACJ,CAAC,MAAM,IAAI,CACV,GAAG,CAAC,mCAAmC,EACvC,qCAAqC,EACrC,KAAK,CACN,CAA6C,IAAI,EAAE,CACrD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAiC;IACtD,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC5C,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,QAAyC,EAAsB,EAAE,CACzF,QAAQ,CAAC,SAAS,CAAC;AAErB,mFAAmF;AACnF,SAAgB,iBAAiB,CAAC,UAAoC,EAAE;IACtE,IAAI,MAA+C,CAAC;IACpD,MAAM,SAAS,GAAG,GAAgC,EAAE,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAExD,2EAA2E;IAC3E,yEAAyE;IACzE,mEAAmE;IACnE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAsB,EAA+B,EAAE;QACzF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;QAEtC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,sEAAsE;gBACtE,oEAAoE;gBACpE,mEAAmE;gBACnE,6CAA6C;gBAC7C,MAAM,IAAI,KAAK,CACb,sFAAsF;oBACpF,gFAAgF;oBAChF,gFAAgF,CACnF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,mFAAmF;oBACjF,gFAAgF;oBAChF,yEAAyE;oBACzE,iFAAiF;oBACjF,cAAc,CACjB,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,CAAC,4BAA4B,KAAK,UAAU,EAAE,CAAC;gBACzD,uEAAuE;gBACvE,uCAAuC;gBACvC,MAAM,IAAI,KAAK,CACb,8EAA8E;oBAC5E,0EAA0E,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,0BAA0B,CAC/B,MAAM,CAAC,CAAC,4BAA4B,CAAC;gBACnC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,EACF,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,IAAI,SAAS,EAAE,CAAC;YACnD,yEAAyE;YACzE,sEAAsE;YACtE,4CAA4C;YAC5C,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,IAAI,GAAG,CAAC,OAAO,+BAA+B;gBAC9C,kFAAkF;gBAClF,kFAAkF;gBAClF,cAAc;gBACd,sEAAsE,CACzE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC;QAExF,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;YAC5D,sEAAsE;YACtE,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,IAAI,KAAK,CACb,iFAAiF;gBAC/E,mFAAmF;gBACnF,yEAAyE,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO,0BAA0B,CAC/B,MAAM,CAAC,CAAC,+BAA+B,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,EACvF,iCAAiC,CAClC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,WAAW,CAAC;IAEzD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,oBAAoB;QACtC,KAAK,CAAC,aAAa,CAAC,GAAsB;YACxC,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAE9D,wEAAwE;YACxE,sEAAsE;YACtE,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,CAAC,OAAO,4CAA4C;wBAC5E,iFAAiF;wBACjF,oCAAoC,CACvC,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBAC3B,kEAAkE;oBAClE,qEAAqE;oBACrE,qEAAqE;oBACrE,6BAA6B;oBAC7B,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,CAAC,OAAO,wBAAwB;wBAC9E,4DAA4D;wBAC5D,qEAAqE;wBACrE,4BAA4B;wBAC5B,8EAA8E,CACjF,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,iBAAiB,CAAC;oBACvC,8BAA8B,EAAE,GAAG,CAAC,OAAO;oBAC3C,qBAAqB;iBACtB,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,CAAC,OAAO,oBAAoB,CAC7E,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAA,iBAAM,EAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YAC/E,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,sBAAsB,CAAC;gBACnD,8BAA8B,EAAE,GAAG,CAAC,OAAO;gBAC3C,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;gBACxB,UAAU,EACR,GAAG,CAAC,IAAI,KAAK,MAAM;oBACjB,CAAC,CAAC,QAAQ,KAAK,UAAU;wBACvB,CAAC,CAAC,6BAA6B;wBAC/B,CAAC,CAAC,iBAAiB;oBACrB,CAAC,CAAC,KAAK;gBACX,mBAAmB,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;gBAC7C,GAAG,CAAC,qBAAqB,IAAI,EAAE,qBAAqB,EAAE,CAAC;aACxD,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,sEAAsE;gBACtE,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,UAAU,EAAE,IAAA,iBAAM,EAAC,GAAG,CAAC,WAAW,CAAC;oBACnC,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;iBACjE,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACzB,OAAO;oBACL,MAAM,EAAE,wBAAwB;oBAChC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;oBACtC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;iBAC/B,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,CAAC,OAAO,qBAAqB;gBAChF,2CAA2C,CAC9C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAvKD,8CAuKC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACI,KAAK,UAAU,8BAA8B,CAClD,OAA8C;IAE9C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uFAAuF;YACrF,gEAAgE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACzE,wEAAwE;QACxE,wCAAwC;QACxC,MAAM,IAAI,KAAK,CACb,yFAAyF;YACvF,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,OAAO,CAAC,OAAO;QACf,oBAAoB,CAAC;YACnB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;SAC1D,CAAC,CAAC;IACL,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,CAAC,yBAAyB,CAAC;QACrC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACxE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC,CAAC;AACL,CAAC;AAlCD,wEAkCC"}