approval-md 0.0.1 → 0.2.0

package/dist/src/adapters/vault-provider.js

@@ -0,0 +1,161 @@
+/**
+ * The vault as a {@link CredentialProvider} (SPEC.md §10.4; APRV-68).
+ *
+ * `adapters/contract.ts` left one seam open and named the task that would fill
+ * it: "No vault. {@link CredentialProvider} is the seam a real vault implements
+ * (APRV-68)." This module is that implementation, and it is deliberately thin.
+ * Everything about *when* a credential may be read belongs to the contract;
+ * everything about *how* the bytes are stored belongs to `core/vault.ts`. What
+ * is left here is the translation between the two vocabularies.
+ *
+ * ## The structural rule
+ *
+ * A provider built here is only ever handed to
+ * {@link executeThroughAdapter} through {@link AdapterExecuteOptions.credentials}.
+ * The contract wraps it in a window that closes the instant `act` returns, so
+ * every read during `act` is inside a verified execution. Manual and selected
+ * live paths consume a token; explicitly authorized supervised or autonomous
+ * paths do not. Three things hold that rule up, and none is a convention:
+ *
+ * 1. `core/vault.ts` exports exactly one function that returns a credential
+ *    value (`getCredential`), and this module is its only caller in the
+ *    repository. `tests/vault.test.ts` pins both halves.
+ * 2. There is no CLI verb that prints a value. `approval vault` can set, list
+ *    (names), and remove; it cannot show. See `src/cli/vault.ts`.
+ * 3. The contract scans everything an adapter returns for the values the
+ *    provider handed out and redacts them, so a leak by a careless adapter is
+ *    caught mechanically rather than reviewed for.
+ *
+ * ## What this defends, and what it does not
+ *
+ * Exactly what the vault module's own threat model says, restated because a
+ * reader arriving from the adapter side deserves it here too. **Defended:**
+ * credentials at rest, and casual reads by an agent that can read files in the
+ * working tree — the ciphertext hides the names as well as the values.
+ * **Not defended (SPEC.md §11, plainly):** a compromised host, and an agent that
+ * can read the passphrase environment variable. Such an agent does not need this
+ * provider; it can decrypt the file directly. The vault raises the cost of a
+ * leak from reading a file to owning the session, and claims nothing beyond
+ * that.
+ *
+ * Total and synchronous, as {@link CredentialProvider} requires: nothing here
+ * throws, nothing blocks on a human, and every failure is one of the three
+ * {@link CREDENTIAL_REFUSAL_CODES}.
+ */
+import { defaultSourceRunner } from "../core/env-file.js";
+import { getCredential, passphraseFrom, vaultPathFor, } from "../core/vault.js";
+import { passphraseUnderGrant } from "./env-passphrase.js";
+/**
+ * How a vault refusal is reported to an adapter.
+ *
+ * The contract's union has three members and they answer three different
+ * questions, so the mapping is by *repair* rather than by severity:
+ *
+ * - **`credential-unavailable`** — nothing is configured yet. No vault, no such
+ *   name, no passphrase in the environment. The operator has something to do.
+ * - **`credential-refused`** — the vault exists and would not open: a wrong
+ *   passphrase, an altered file, a format this build does not read, an
+ *   unreadable path. SPEC.md's phrase for this branch is "a locked vault", and
+ *   it is distinct because the repair is investigation, not configuration.
+ * - **`credential-window-closed`** — never produced here. It is the contract's
+ *   own verdict about *when* the question was asked, and this module has no way
+ *   to know that.
+ */
+function mapRefusal(code) {
+    switch (code) {
+        case "vault-absent":
+        case "passphrase-unset":
+        case "credential-absent":
+        case "invalid-name":
+            return "credential-unavailable";
+        case "vault-io":
+        case "vault-malformed":
+        case "vault-version-unsupported":
+        case "vault-unreadable":
+        case "empty-value":
+        case "vault-write-failed":
+            return "credential-refused";
+    }
+}
+/**
+ * A provider that answers from the encrypted vault.
+ *
+ * **Lazy, and cached for the life of the provider.** The vault is not opened
+ * until an adapter actually asks for something, so an execution that needs no
+ * credential pays no scrypt cost and touches no ciphertext. Once opened, the
+ * derived value for a name is remembered, because a provider's life *is* one
+ * `act` call: the contract closes it when `act` returns, so the cache cannot
+ * outlive the token window it was built for, and the alternative — a fresh
+ * ~100 ms key derivation per credential — would put a visible tax on an adapter
+ * that needs two.
+ *
+ * The passphrase is read from the environment on every open rather than
+ * captured at construction, so a provider built before the operator exported the
+ * variable is not permanently poisoned.
+ *
+ * **The scoped fallback (APRV-168).** When {@link VaultProviderOptions.envFilePath}
+ * is supplied AND the contract has told this provider it is inside a token
+ * window, a passphrase absent from the environment is resolved from the
+ * instance's `.approval/env` instead. That is the one narrowing of
+ * `core/env-file.ts`'s "no verb reads this file" rule, and the whole argument
+ * for it lives in `adapters/env-passphrase.ts`. The short form: the authority is
+ * the token, and a human tapped Approve for exactly this action. The value is
+ * used to derive one key and reaches no environment, no argv, no log, and no
+ * message; the cache is dropped when the window closes, so a passphrase resolved
+ * under one grant opens nothing under the next.
+ *
+ * Messages name the environment VARIABLE and the credential NAME, and never a
+ * value: an adapter's failure message is one of the strings the contract hands
+ * back to a caller, and a diagnostic that quoted the secret would defeat the
+ * redaction guard by putting the secret in the one place the guard cannot know
+ * to look for it.
+ */
+export function vaultCredentialProvider(location, options) {
+    const vaultPath = "vaultPath" in location ? location.vaultPath : vaultPathFor(location.logPath);
+    const { passphraseEnv } = options;
+    const cache = new Map();
+    // The live grant, set by the contract when the credential window opens and
+    // cleared when it closes. Never read except by the fallback below, and the
+    // fallback is unreachable while it is null.
+    let live = null;
+    return {
+        grant(grant) {
+            live = grant;
+            // A cached credential was derived under the previous window's authority.
+            // Dropping the cache with the grant means the next window pays for its
+            // own passphrase rather than inheriting one.
+            if (grant === null)
+                cache.clear();
+        },
+        get(name) {
+            const cached = cache.get(name);
+            if (cached !== undefined)
+                return { ok: true, value: cached };
+            const passphrase = passphraseFrom(passphraseEnv, options.env ?? process.env) ??
+                // APRV-168. Only inside a window the contract opened against a token a
+                // human's grant minted, and only for the one variable the policy names.
+                // The value goes straight into the key derivation below: it is not
+                // exported, not cached on its own, and it appears in no message on
+                // either branch.
+                (options.envFilePath === undefined
+                    ? null
+                    : passphraseUnderGrant(live, options.envFilePath, passphraseEnv, options.sourceRunner ?? defaultSourceRunner));
+            if (passphrase === null) {
+                return {
+                    ok: false,
+                    code: "credential-unavailable",
+                    message: `credential ${JSON.stringify(name)} lives in the vault at ${vaultPath}, and the passphrase variable ${passphraseEnv} is unset or empty in this process${options.envFilePath === undefined
+                        ? ""
+                        : `, and it did not resolve from ${options.envFilePath} either`}. The policy names the variable and never the value (SPEC.md §5.2, §10.4); export it in the environment that runs the adapter, or give it a line in the environment source map.`,
+                };
+            }
+            const result = getCredential(vaultPath, passphrase, name);
+            if (result.ok) {
+                cache.set(name, result.value);
+                return { ok: true, value: result.value };
+            }
+            return { ok: false, code: mapRefusal(result.code), message: result.message };
+        },
+    };
+}
+//# sourceMappingURL=vault-provider.js.map

package/dist/src/adapters/vault-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-provider.js","sourceRoot":"","sources":["../../../src/adapters/vault-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,mBAAmB,EAAqB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,aAAa,EACb,cAAc,EACd,YAAY,GAEb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAkC3D;;;;;;;;;;;;;;;GAeG;AACH,SAAS,UAAU,CAAC,IAAsB;IACxC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB,CAAC;QACxB,KAAK,mBAAmB,CAAC;QACzB,KAAK,cAAc;YACjB,OAAO,wBAAwB,CAAC;QAClC,KAAK,UAAU,CAAC;QAChB,KAAK,iBAAiB,CAAC;QACvB,KAAK,2BAA2B,CAAC;QACjC,KAAK,kBAAkB,CAAC;QACxB,KAAK,aAAa,CAAC;QACnB,KAAK,oBAAoB;YACvB,OAAO,oBAAoB,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAuB,EACvB,OAA6B;IAE7B,MAAM,SAAS,GAAG,WAAW,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChG,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,2EAA2E;IAC3E,2EAA2E;IAC3E,4CAA4C;IAC5C,IAAI,IAAI,GAA0B,IAAI,CAAC;IAEvC,OAAO;QACL,KAAK,CAAC,KAA4B;YAChC,IAAI,GAAG,KAAK,CAAC;YACb,yEAAyE;YACzE,uEAAuE;YACvE,6CAA6C;YAC7C,IAAI,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACpC,CAAC;QAED,GAAG,CAAC,IAAY;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAE7D,MAAM,UAAU,GACd,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;gBACzD,uEAAuE;gBACvE,wEAAwE;gBACxE,mEAAmE;gBACnE,mEAAmE;gBACnE,iBAAiB;gBACjB,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;oBAChC,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,oBAAoB,CAClB,IAAI,EACJ,OAAO,CAAC,WAAW,EACnB,aAAa,EACb,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAC5C,CAAC,CAAC;YACT,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,SAAS,iCAAiC,aAAa,qCAC1H,OAAO,CAAC,WAAW,KAAK,SAAS;wBAC/B,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,iCAAiC,OAAO,CAAC,WAAW,SAC1D,iLAAiL;iBAClL,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAC3C,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/adapters/zzz.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Credential-custody transport for zzz.bot messages (APRV-320).
+ *
+ * The adapter sends only the JSON value a grant binds. Destination selection
+ * is a strict tagged union over two fixed service origins; neither the CLI nor
+ * the payload can supply an arbitrary URL. The Bearer credential comes only
+ * from the scoped provider opened by the shared adapter contract.
+ */
+import type { CredentialSpec } from "../core/credential-spec.js";
+import { type Adapter, type JsonValue } from "./contract.js";
+export declare const ZZZ_CLASS = "communicate.zzz.external";
+export declare const ZZZ_PRODUCTION_API_BASE = "https://zzz.bot";
+export declare const ZZZ_PREVIEW_API_BASE = "https://zzz-preview.soycarts.workers.dev";
+export declare const ZZZ_DEFAULT_TIMEOUT_MS = 15000;
+export declare const ZZZ_TOKEN_NAME = "zzz.agent_token";
+export declare const ZZZ_FAILURE_CODES: readonly ["zzz-payload-invalid", "zzz-config-invalid", "zzz-invalid-request", "zzz-unauthorized", "zzz-forbidden", "zzz-not-found", "zzz-idempotency-conflict", "zzz-payload-too-large", "zzz-rejected", "zzz-rate-limited", "zzz-unreachable", "zzz-cancelled", "credential-unavailable", "credential-refused", "credential-window-closed"];
+export declare const ZZZ_CREDENTIAL_SPECS: readonly CredentialSpec[];
+type Reference = {
+    kind: "external" | "post";
+    target: string;
+    label: string;
+    relationship: "source" | "context" | "supersedes";
+};
+type Message = {
+    body: string;
+    metadata?: JsonValue;
+    tags?: string[];
+    references?: Reference[];
+};
+export type ZzzPayload = ({
+    environment: "production" | "preview";
+    operation: "create_thread";
+    room_id: string;
+    title: string;
+} & Message) | ({
+    environment: "production" | "preview";
+    operation: "create_reply";
+    thread_id: string;
+} & Message);
+type Validation = {
+    ok: true;
+    payload: ZzzPayload;
+    path: string;
+    body: Record<string, JsonValue>;
+} | {
+    ok: false;
+    message: string;
+};
+export declare function validateZzzPayload(value: JsonValue): Validation;
+export interface ZzzAdapterOptions {
+    fetch?: typeof globalThis.fetch;
+    timeoutMs?: number;
+    /** Constructor-only test seam. The CLI never exposes these values. */
+    origins?: Partial<Record<"production" | "preview", string>>;
+}
+export declare function zzzAdapter(options?: ZzzAdapterOptions): Adapter;
+export type ZzzProbeResult = {
+    ok: true;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+/** Read-only authentication probe. It proves no write scope or room access. */
+export declare function probeZzz(token: string, options?: ZzzAdapterOptions): Promise<ZzzProbeResult>;
+export {};

package/dist/src/adapters/zzz.js

@@ -0,0 +1,299 @@
+/**
+ * Credential-custody transport for zzz.bot messages (APRV-320).
+ *
+ * The adapter sends only the JSON value a grant binds. Destination selection
+ * is a strict tagged union over two fixed service origins; neither the CLI nor
+ * the payload can supply an arbitrary URL. The Bearer credential comes only
+ * from the scoped provider opened by the shared adapter contract.
+ */
+import { createHash } from "node:crypto";
+import { canonicalize } from "../core/jcs.js";
+import { payloadHash } from "../core/payload.js";
+import { CREDENTIAL_REFUSAL_CODES, PROVIDER_REF_DETAIL_KEY, } from "./contract.js";
+export const ZZZ_CLASS = "communicate.zzz.external";
+export const ZZZ_PRODUCTION_API_BASE = "https://zzz.bot";
+export const ZZZ_PREVIEW_API_BASE = "https://zzz-preview.soycarts.workers.dev";
+export const ZZZ_DEFAULT_TIMEOUT_MS = 15_000;
+export const ZZZ_TOKEN_NAME = "zzz.agent_token";
+const TOKEN = /^[A-Za-z0-9_-]{32,256}$/u;
+const PROVIDER_ID = /^(?:thr|pst)_[a-f0-9]{32}$/u;
+const MAX_MESSAGE_BYTES = 65_536;
+const MAX_RESPONSE_BYTES = 16_384;
+export const ZZZ_FAILURE_CODES = [
+    "zzz-payload-invalid",
+    "zzz-config-invalid",
+    "zzz-invalid-request",
+    "zzz-unauthorized",
+    "zzz-forbidden",
+    "zzz-not-found",
+    "zzz-idempotency-conflict",
+    "zzz-payload-too-large",
+    "zzz-rejected",
+    "zzz-rate-limited",
+    "zzz-unreachable",
+    "zzz-cancelled",
+    ...CREDENTIAL_REFUSAL_CODES,
+];
+export const ZZZ_CREDENTIAL_SPECS = [
+    {
+        name: ZZZ_TOKEN_NAME,
+        kind: "secret",
+        label: "ZZZ agent token",
+        describe: "an invited zzz.bot principal credential with write scope",
+        required: true,
+        validate(value) {
+            return TOKEN.test(value)
+                ? { ok: true }
+                : {
+                    ok: false,
+                    message: "the ZZZ agent token must be 32 to 256 ASCII letters, digits, underscores, or hyphens",
+                };
+        },
+    },
+];
+function object(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : null;
+}
+function exactKeys(value, allowed) {
+    const extra = Object.keys(value).find((key) => !allowed.includes(key));
+    return extra === undefined ? null : extra;
+}
+function boundedString(value, min, max) {
+    return typeof value === "string" && value.length >= min && value.length <= max;
+}
+function validReferences(value) {
+    if (value === undefined)
+        return true;
+    if (!Array.isArray(value) || value.length > 20)
+        return false;
+    return value.every((candidate) => {
+        const ref = object(candidate);
+        if (ref === null || exactKeys(ref, ["kind", "target", "label", "relationship"]) !== null)
+            return false;
+        if (!boundedString(ref["target"], 1, 2048) || !boundedString(ref["label"], 1, 120))
+            return false;
+        if (ref["kind"] !== "external" && ref["kind"] !== "post")
+            return false;
+        if (!["source", "context", "supersedes"].includes(String(ref["relationship"])))
+            return false;
+        if (ref["kind"] === "external") {
+            try {
+                const url = new URL(ref["target"]);
+                if (url.protocol !== "http:" && url.protocol !== "https:")
+                    return false;
+            }
+            catch {
+                return false;
+            }
+        }
+        return true;
+    });
+}
+export function validateZzzPayload(value) {
+    const input = object(value);
+    if (input === null)
+        return { ok: false, message: "the payload must be one JSON object" };
+    if (input["environment"] !== "production" && input["environment"] !== "preview") {
+        return { ok: false, message: "environment must be production or preview" };
+    }
+    if (input["operation"] !== "create_thread" && input["operation"] !== "create_reply") {
+        return { ok: false, message: "operation must be create_thread or create_reply" };
+    }
+    const common = ["environment", "operation", "body", "metadata", "tags", "references"];
+    const allowed = input["operation"] === "create_thread"
+        ? [...common, "room_id", "title"]
+        : [...common, "thread_id"];
+    const extra = exactKeys(input, allowed);
+    if (extra !== null)
+        return { ok: false, message: `unknown payload field ${JSON.stringify(extra)}` };
+    if (!boundedString(input["body"], 1, 65_536))
+        return { ok: false, message: "body must contain 1 to 65536 characters" };
+    if (input["tags"] !== undefined &&
+        (!Array.isArray(input["tags"]) || input["tags"].length > 10 ||
+            !input["tags"].every((tag) => boundedString(tag, 1, 40)))) {
+        return { ok: false, message: "tags must contain at most 10 strings of 1 to 40 characters" };
+    }
+    if (!validReferences(input["references"]))
+        return { ok: false, message: "references do not match the ZZZ API contract" };
+    let path;
+    if (input["operation"] === "create_thread") {
+        if (!boundedString(input["room_id"], 1, 256) || !boundedString(input["title"], 1, 200)) {
+            return { ok: false, message: "create_thread needs a room_id and a title of 1 to 200 characters" };
+        }
+        path = `/api/v1/rooms/${encodeURIComponent(input["room_id"])}/threads`;
+    }
+    else {
+        if (!boundedString(input["thread_id"], 1, 256))
+            return { ok: false, message: "create_reply needs a thread_id" };
+        path = `/api/v1/threads/${encodeURIComponent(input["thread_id"])}/posts`;
+    }
+    const body = {
+        ...(input["operation"] === "create_thread" ? { title: input["title"] } : {}),
+        body: input["body"],
+        ...(input["metadata"] === undefined ? {} : { metadata: input["metadata"] }),
+        ...(input["tags"] === undefined ? {} : { tags: input["tags"] }),
+        ...(input["references"] === undefined ? {} : { references: input["references"] }),
+    };
+    if (new TextEncoder().encode(canonicalize(body)).byteLength > MAX_MESSAGE_BYTES) {
+        return { ok: false, message: "the canonical ZZZ message exceeds 65536 UTF-8 bytes" };
+    }
+    return { ok: true, payload: input, path, body };
+}
+function idempotencyKey(actionKey, hash) {
+    const bytes = canonicalize({ action_key: actionKey, payload_hash: hash });
+    return `approval:${createHash("sha256").update(bytes, "utf8").digest("hex")}`;
+}
+function codeForStatus(status) {
+    if (status === 400)
+        return "zzz-invalid-request";
+    if (status === 401)
+        return "zzz-unauthorized";
+    if (status === 403)
+        return "zzz-forbidden";
+    if (status === 404)
+        return "zzz-not-found";
+    if (status === 409)
+        return "zzz-idempotency-conflict";
+    if (status === 413)
+        return "zzz-payload-too-large";
+    if (status === 422)
+        return "zzz-rejected";
+    if (status === 429)
+        return "zzz-rate-limited";
+    return "zzz-rejected";
+}
+async function boundedJson(response) {
+    const reader = response.body?.getReader();
+    if (reader === undefined)
+        throw new Error("ZZZ returned no response body");
+    const chunks = [];
+    let size = 0;
+    while (true) {
+        const item = await reader.read();
+        if (item.done)
+            break;
+        size += item.value.byteLength;
+        if (size > MAX_RESPONSE_BYTES) {
+            await reader.cancel();
+            throw new Error("ZZZ returned an oversized response");
+        }
+        chunks.push(item.value);
+    }
+    const joined = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        joined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return JSON.parse(new TextDecoder().decode(joined));
+}
+function originFor(environment, options) {
+    return options.origins?.[environment] ??
+        (environment === "production" ? ZZZ_PRODUCTION_API_BASE : ZZZ_PREVIEW_API_BASE);
+}
+export function zzzAdapter(options = {}) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const timeoutMs = options.timeoutMs ?? ZZZ_DEFAULT_TIMEOUT_MS;
+    return {
+        name: "zzz",
+        classes: [ZZZ_CLASS],
+        requiredCredentials: [ZZZ_TOKEN_NAME],
+        precheck(input) {
+            const checked = validateZzzPayload(input.payload);
+            return checked.ok
+                ? { ok: true }
+                : { ok: false, code: "zzz-payload-invalid", message: `${checked.message}. Nothing was sent` };
+        },
+        async act(input) {
+            const checked = validateZzzPayload(input.payload);
+            if (!checked.ok)
+                return { ok: false, code: "zzz-payload-invalid", message: `${checked.message}. Nothing was sent` };
+            const credential = input.credentials.get(ZZZ_TOKEN_NAME);
+            if (!credential.ok)
+                return { ok: false, code: credential.code, message: credential.message };
+            if (!TOKEN.test(credential.value)) {
+                return { ok: false, code: "zzz-config-invalid", message: "the vault's ZZZ agent token does not match the service credential shape. Nothing was sent" };
+            }
+            if (input.signal?.aborted === true) {
+                return { ok: false, code: "zzz-cancelled", message: "the ZZZ message was cancelled before the HTTP request. Nothing was sent" };
+            }
+            const environment = checked.payload.environment;
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            const abort = () => controller.abort();
+            input.signal?.addEventListener("abort", abort, { once: true });
+            try {
+                const response = await fetchImpl(new URL(checked.path, originFor(environment, options)), {
+                    method: "POST",
+                    redirect: "error",
+                    signal: controller.signal,
+                    headers: {
+                        Authorization: `Bearer ${credential.value}`,
+                        "Content-Type": "application/json",
+                        "Idempotency-Key": idempotencyKey(input.actionKey, payloadHash(input.payload)),
+                    },
+                    body: canonicalize(checked.body),
+                });
+                const definiteRefusal = [400, 401, 403, 404, 409, 413, 422, 429].includes(response.status);
+                if (response.status !== 200 && response.status !== 201 && !definiteRefusal) {
+                    await response.body?.cancel().catch(() => undefined);
+                    throw new Error(`ZZZ answered an ambiguous HTTP status ${String(response.status)}`);
+                }
+                if (definiteRefusal) {
+                    await response.body?.cancel().catch(() => undefined);
+                    return { ok: false, code: codeForStatus(response.status), message: `ZZZ refused the message with HTTP ${String(response.status)}. No response text was recorded` };
+                }
+                const answer = await boundedJson(response);
+                const parsed = object(answer);
+                const expectedPrefix = checked.payload.operation === "create_thread" ? "thr_" : "pst_";
+                if (parsed === null || exactKeys(parsed, ["id", "replayed"]) !== null ||
+                    typeof parsed["id"] !== "string" || !PROVIDER_ID.test(parsed["id"]) ||
+                    !parsed["id"].startsWith(expectedPrefix) || typeof parsed["replayed"] !== "boolean" ||
+                    parsed["replayed"] !== (response.status === 200)) {
+                    throw new Error("ZZZ returned an inconsistent success receipt");
+                }
+                return {
+                    ok: true,
+                    detail: {
+                        [PROVIDER_REF_DETAIL_KEY]: parsed["id"],
+                        replayed: parsed["replayed"],
+                        operation: checked.payload.operation,
+                        payload_hash: payloadHash(input.payload),
+                    },
+                };
+            }
+            finally {
+                clearTimeout(timer);
+                input.signal?.removeEventListener("abort", abort);
+            }
+        },
+    };
+}
+/** Read-only authentication probe. It proves no write scope or room access. */
+export async function probeZzz(token, options = {}) {
+    if (!TOKEN.test(token))
+        return { ok: false, code: "zzz-config-invalid", message: "the ZZZ agent token does not match the service credential shape" };
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? ZZZ_DEFAULT_TIMEOUT_MS);
+    try {
+        const response = await (options.fetch ?? globalThis.fetch)(new URL("/api/v1/rooms", originFor("production", options)), {
+            method: "GET",
+            redirect: "error",
+            signal: controller.signal,
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        await response.body?.cancel().catch(() => undefined);
+        if (response.status === 200)
+            return { ok: true };
+        return { ok: false, code: codeForStatus(response.status), message: `ZZZ answered HTTP ${String(response.status)}; no response text was recorded` };
+    }
+    catch {
+        return { ok: false, code: "zzz-unreachable", message: "ZZZ could not be reached for the read-only credential check" };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=zzz.js.map

package/dist/src/adapters/zzz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zzz.js","sourceRoot":"","sources":["../../../src/adapters/zzz.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAC;AACpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD,MAAM,KAAK,GAAG,0BAA0B,CAAC;AACzC,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,eAAe;IACf,eAAe;IACf,0BAA0B;IAC1B,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,iBAAiB;IACjB,eAAe;IACf,GAAG,wBAAwB;CACnB,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAA8B;IAC7D;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,0DAA0D;QACpE,QAAQ,EAAE,IAAI;QACd,QAAQ,CAAC,KAAa;YACpB,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC;oBACE,EAAE,EAAE,KAAK;oBACT,OAAO,EACL,sFAAsF;iBACzF,CAAC;QACR,CAAC;KACF;CACF,CAAC;AAwBF,SAAS,MAAM,CAAC,KAAgB;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,SAAS,CAAC,KAAgC,EAAE,OAA0B;IAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,KAA4B,EAAE,GAAW,EAAE,GAAW;IAC3E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;AACjF,CAAC;AAED,SAAS,eAAe,CAAC,KAA4B;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACvG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACjG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACvE,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7F,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;YAC1E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAgB;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IACzF,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,YAAY,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,eAAe,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,cAAc,EAAE,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,eAAe;QACpD,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;QACjC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACpG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACvH,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS;QAC3B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,EAAE;YAC1D,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAEzH,IAAI,IAAY,CAAC;IACjB,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,eAAe,EAAE,CAAC;QAC3C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;QACpG,CAAC;QACD,IAAI,GAAG,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;QAChH,IAAI,GAAG,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAED,MAAM,IAAI,GAA8B;QACtC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACnB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;KAClF,CAAC;IACF,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,iBAAiB,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,IAAY;IACrD,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,OAAO,YAAY,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,qBAAqB,CAAC;IACjD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAC9C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC;IAC3C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC;IAC3C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,0BAA0B,CAAC;IACtD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,uBAAuB,CAAC;IACnD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAC9C,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAkB;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM;QACrB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAC9B,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAC9B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAAC,CAAC;IACtF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAY,CAAC;AACjE,CAAC;AASD,SAAS,SAAS,CAAC,WAAqC,EAAE,OAA0B;IAClF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC;QACnC,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAO,GAAsB,EAAE;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC9D,OAAO;QACL,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,CAAC,SAAS,CAAC;QACpB,mBAAmB,EAAE,CAAC,cAAc,CAAC;QACrC,QAAQ,CAAC,KAAoB;YAC3B,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClD,OAAO,OAAO,CAAC,EAAE;gBACf,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,oBAAoB,EAAE,CAAC;QAClG,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAe;YACvB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,oBAAoB,EAAE,CAAC;YACpH,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACzD,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;YAC7F,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC;YACzJ,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,yEAAyE,EAAE,CAAC;YAClI,CAAC;YACD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;YAChD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,EAAE;oBACvF,MAAM,EAAE,MAAM;oBACd,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,UAAU,CAAC,KAAK,EAAE;wBAC3C,cAAc,EAAE,kBAAkB;wBAClC,iBAAiB,EAAE,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;qBAC/E;oBACD,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;iBACjC,CAAC,CAAC;gBACH,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC3F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC3E,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACtF,CAAC;gBACD,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,qCAAqC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC;gBACrK,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAmB,CAAC,CAAC;gBAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvF,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,KAAK,IAAI;oBACjE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACnE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS;oBACnF,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;gBACD,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE;wBACN,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;wBACvC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;wBAC5B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;wBACpC,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;qBACzC;iBACF,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAID,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa,EAAE,OAAO,GAAsB,EAAE;IAC3E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAAC;IACrJ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,EAAE;YACrH,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,qBAAqB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC;IACrJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,6DAA6D,EAAE,CAAC;IACxH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}