managed-deepagents 0.0.3-dev.33 → 0.0.3-dev.34

package/dist/runtime/identity-http.js

@@ -1,213 +0,0 @@
-import { Hono } from "hono";
-import { cors } from "hono/cors";
-import { resolveRequestIdentity } from "./auth.js";
-import { issueGuestToken } from "./validated-token.js";
-/**
- * Deployment env var carrying the browser origins allowed to call the managed
- * HTTP surface (comma-separated). The managed routes are token-based (Bearer
- * `Authorization`, no ambient cookies), so an unset value defaults to `*`.
- */
-const CORS_ORIGINS_ENV = "MDA_HTTP_CORS_ORIGINS";
-/** Request headers the browser is allowed to send to the managed routes. */
-const CORS_ALLOW_HEADERS = [
-    "Authorization",
-    "Content-Type",
-    "X-Supabase-Region",
-    "X-Auth-Key",
-    "x-mda-actor-id",
-    "x-mda-tenant-id",
-];
-/** Signals a secured route was reached but no identity is declared to resolve it. */
-class IdentityNotConfiguredError extends Error {
-    status = 401;
-    constructor() {
-        super("secured connector route requires an identity declaration, but this " +
-            "deployment has none");
-    }
-}
-/**
- * Build the single managed HTTP app mounted via `langgraph.json` `http.app`.
- *
- * It layers two concerns onto the built-in LangGraph routes:
- *  - **identity** — public guest issuance (`POST /identity/guest`) when the
- *    declared identity enables a guest provider;
- *  - **connectors** — each connector implementing `http` gets a sub-router
- *    namespaced under `/connectors/{kind}` and mounts its own routes.
- *
- * Connector routes are **secure by default**: MDA resolves and enforces the
- * caller's identity before the handler runs, and a route must opt out of
- * authentication explicitly (`router.public.*`). The connector HTTP surface is
- * logged at construction so the (especially unauthenticated) routes are never
- * invisible.
- */
-export function buildManagedHttpApp(inputs) {
-    const app = new Hono();
-    // The managed connector/identity routes are meant to be called directly from
-    // the browser, so CORS (preflight + `Access-Control-*`) must be enabled.
-    // Registered before the routes so it also covers preflight `OPTIONS`.
-    if (hasManagedSurface(inputs)) {
-        applyCors(app);
-    }
-    if (inputs.identity) {
-        mountIdentityRoutes(app, inputs.identity);
-    }
-    const mounted = [];
-    for (const connector of inputs.connectors ?? []) {
-        if (typeof connector.http === "function") {
-            mountConnectorRoutes(app, connector, inputs.identity?.config, mounted);
-        }
-    }
-    logConnectorSurface(mounted);
-    return app;
-}
-/**
- * Whether the project contributes any managed HTTP routes (guest issuance or a
- * connector `http` hook). CORS is only enabled when there is a surface to call,
- * so an empty managed app stays a pure no-op on top of the platform API.
- */
-function hasManagedSurface(inputs) {
-    const http = inputs.identity?.config.ingress.http;
-    const hasGuest = http !== undefined &&
-        http !== "trusted_backend" &&
-        http.providers.some((provider) => provider.guest?.issue);
-    const hasConnectorHttp = (inputs.connectors ?? []).some((connector) => typeof connector.http === "function");
-    return Boolean(hasGuest) || hasConnectorHttp;
-}
-/**
- * Enable CORS on the managed HTTP surface. Origins come from
- * `MDA_HTTP_CORS_ORIGINS` (comma-separated); unset means `*`. A wildcard cannot
- * be combined with credentials per the CORS spec, and the managed routes never
- * rely on cookies, so credentials are only enabled with an explicit allowlist.
- */
-function applyCors(app) {
-    const raw = (process.env[CORS_ORIGINS_ENV] ?? "").trim();
-    let origin;
-    let credentials;
-    if (raw && raw !== "*") {
-        origin = raw
-            .split(",")
-            .map((value) => value.trim())
-            .filter(Boolean);
-        credentials = true;
-    }
-    else {
-        origin = "*";
-        credentials = false;
-    }
-    app.use("*", cors({
-        origin,
-        credentials,
-        allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
-        allowHeaders: CORS_ALLOW_HEADERS,
-    }));
-}
-/** Mount the public identity routes (guest issuance) onto `app`. */
-function mountIdentityRoutes(app, identity) {
-    const http = identity.config.ingress.http;
-    if (http === "trusted_backend") {
-        return;
-    }
-    const guestProvider = http.providers.find((provider) => provider.guest?.issue);
-    if (!guestProvider) {
-        return;
-    }
-    app.post("/identity/guest", async (c) => {
-        const token = await issueGuestToken(guestProvider);
-        return c.json({ token });
-    });
-}
-/**
- * Mount a connector's `http` routes on a sub-router namespaced under
- * `/connectors/{kind}`, so connector routes cannot collide with identity/API
- * routes or with each other.
- */
-function mountConnectorRoutes(app, connector, cfg, mounted) {
-    const sub = new Hono();
-    const router = honoConnectorRouter(sub, connector.kind, cfg, mounted);
-    const ctx = {
-        router,
-        identity: cfg,
-        requireIdentity: (request) => {
-            if (!cfg) {
-                return Promise.reject(new Error("identity is not configured for this deployment; declare an " +
-                    "identity to resolve caller identity on connector routes."));
-            }
-            return resolveRequestIdentity(cfg, request);
-        },
-    };
-    connector.http?.(ctx);
-    app.route(`/connectors/${connector.kind}`, sub);
-}
-/**
- * Build the secure-by-default {@link HttpSubRouter} over a Hono sub-app. Secured
- * routes resolve identity (401 on failure) before the handler runs; `public.*`
- * routes skip enforcement. Every registration is recorded in `mounted`.
- */
-function honoConnectorRouter(sub, kind, cfg, mounted) {
-    const secured = (method) => (path, handler) => {
-        mounted.push({ connector: kind, method, path, secured: true });
-        sub[method](path, async (c) => {
-            const request = c.req.raw;
-            if (!cfg) {
-                return unauthorizedResponse(new IdentityNotConfiguredError());
-            }
-            let identity;
-            try {
-                identity = await resolveRequestIdentity(cfg, request);
-            }
-            catch (error) {
-                return unauthorizedResponse(error);
-            }
-            return handler(request, identity);
-        });
-    };
-    const publicRoute = (method) => (path, handler) => {
-        mounted.push({ connector: kind, method, path, secured: false });
-        sub[method](path, (c) => handler(c.req.raw));
-    };
-    return {
-        get: secured("get"),
-        post: secured("post"),
-        put: secured("put"),
-        delete: secured("delete"),
-        public: {
-            get: publicRoute("get"),
-            post: publicRoute("post"),
-            put: publicRoute("put"),
-            delete: publicRoute("delete"),
-        },
-    };
-}
-/** Map a resolution error to a fail-closed JSON response. */
-function unauthorizedResponse(error) {
-    const status = typeof error.status === "number"
-        ? error.status
-        : 401;
-    const message = error instanceof Error && error.message ? error.message : "unauthorized";
-    return new Response(JSON.stringify({ error: message }), {
-        status,
-        headers: { "content-type": "application/json" },
-    });
-}
-/**
- * Log the connector HTTP surface so both secured and (loudly) public routes are
- * visible in deploy/dev startup logs — the routes are mounted at runtime, so
- * this is where the actual surface can be enumerated.
- */
-function logConnectorSurface(mounted) {
-    if (mounted.length === 0) {
-        return;
-    }
-    console.info(`[mda] connector HTTP surface (${mounted.length} route(s)):`);
-    for (const route of mounted) {
-        const full = `/connectors/${route.connector}${route.path}`;
-        const line = `[mda]   ${route.method.toUpperCase().padEnd(6)} ${full}`;
-        if (route.secured) {
-            console.info(`${line}  (identity enforced)`);
-        }
-        else {
-            console.warn(`${line}  (PUBLIC — no identity enforcement)`);
-        }
-    }
-}
-//# sourceMappingURL=identity-http.js.map

package/dist/runtime/identity-http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-http.js","sourceRoot":"","sources":["../../src/runtime/identity-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAQnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAYvD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG;IACzB,eAAe;IACf,cAAc;IACd,mBAAmB;IACnB,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;CAClB,CAAC;AAUF,qFAAqF;AACrF,MAAM,0BAA2B,SAAQ,KAAK;IACnC,MAAM,GAAG,GAAG,CAAC;IACtB;QACE,KAAK,CACH,qEAAqE;YACnE,qBAAqB,CACxB,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACzC,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAA4B;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IAClD,MAAM,QAAQ,GACZ,IAAI,KAAK,SAAS;QAClB,IAAI,KAAK,iBAAiB;QAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CACrD,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,CACpD,CAAC;IACF,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,GAAS;IAC1B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,MAAyB,CAAC;IAC9B,IAAI,WAAoB,CAAC;IACzB,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG;aACT,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,CAAC;QACb,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,GAAG,CAAC,GAAG,CACL,GAAG,EACH,IAAI,CAAC;QACH,MAAM;QACN,WAAW;QACX,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;QACzD,YAAY,EAAE,kBAAkB;KACjC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,GAAS,EAAE,QAA4B;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CACpC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,GAAS,EACT,SAAoB,EACpB,GAA+B,EAC/B,OAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAgB;QACvB,MAAM;QACN,QAAQ,EAAE,GAAG;QACb,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE;YAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,6DAA6D;oBAC3D,0DAA0D,CAC7D,CACF,CAAC;YACJ,CAAC;YACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;IACF,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACtB,GAAG,CAAC,KAAK,CAAC,eAAe,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,GAAS,EACT,IAAY,EACZ,GAA+B,EAC/B,OAAuB;IAEvB,MAAM,OAAO,GACX,CAAC,MAAkB,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE;QACrE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,oBAAoB,CAAC,IAAI,0BAA0B,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEJ,MAAM,WAAW,GACf,CAAC,MAAkB,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,OAA2B,EAAE,EAAE;QACpE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEJ,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;QACrB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE;YACN,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACvB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACvB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;QACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;QACtC,CAAC,CAAC,GAAG,CAAC;IACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;IAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;QACtD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAuB;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;IAC3E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,eAAe,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/runtime/identity-runtime.d.ts

@@ -1,54 +0,0 @@
-import type { IdentityConfig, MemoryScope, RuntimeIdentity, Tenancy } from "../identity.js";
-import type { ConfigurableCarrier } from "./types.js";
-/**
- * Resolve the LangGraph `configurable` bag from either a flat runtime or the
- * nested `ToolRuntime` shape LangChain passes to tools (`runtime.config.configurable`).
- */
-export declare function resolveRuntimeConfigurable(runtime: RuntimeConfigLike | undefined): Record<string, unknown> | undefined;
-/**
- * Build the frozen identity envelope for the current run from the trusted
- * `langgraph_auth_user` the custom-auth handler produced (§6.1). Returns
- * `undefined` when the deployment has no resolvable actor (identity is opt-in).
- */
-export declare function buildRuntimeIdentity(configurable: Record<string, unknown> | undefined): RuntimeIdentity | undefined;
-/**
- * The durable Store namespace for the run, per `scoping.memory` (§6.2). A
- * `deploymentId` prefix isolates deployments; identity segments follow. Returns
- * `undefined` for `none` (no durable memory). Fail-closed: an `actor` scope with
- * no actor already rejects at ingress, so the segments are never empty here.
- */
-export declare function memoryNamespace(cfg: IdentityConfig, ident: RuntimeIdentity, deploymentId: string): string[] | undefined;
-/**
- * The runtime the managed seam sees: the shared `configurable` carrier, plus the
- * optional nested `config` (e.g. LangGraph `ToolRuntime.config`) and the frozen
- * `identity` envelope the seam layers on. Single source for the tool, middleware,
- * and memory-namespace helpers.
- */
-export interface RuntimeConfigLike extends ConfigurableCarrier {
-    identity?: RuntimeIdentity;
-    config?: {
-        configurable?: Record<string, unknown>;
-    };
-}
-/**
- * Resolve the durable memory namespace for a run directly from the runtime the
- * memory `StoreBackend` receives, per `scoping.memory` (§6.2). This is the
- * plug-in point for the (deferred) Store-backed memory: a `StoreBackend`
- * namespace factory becomes `(ctx) => memoryNamespaceFor(ctx.runtime, cfg, id)`.
- * Returns `undefined` when the run has no durable namespace (`none`, or a
- * per-actor scope with no resolved actor).
- */
-export declare function memoryNamespaceFor(runtime: RuntimeConfigLike | undefined, cfg: IdentityConfig, deploymentId: string): string[] | undefined;
-/**
- * The identity portion of the memory namespace (no deployment prefix), shared by
- * the memory `StoreBackend` and the `@auth.on.store` boundary check so both agree
- * on exactly which segments identify a namespace.
- */
-export declare function memoryIdentitySegments(scope: MemoryScope, tenancy: Tenancy, actorId: string | undefined, tenantId: string | undefined): string[];
-/**
- * Strip client-supplied identity keys from an incoming `configurable` so a
- * request body can never spoof the actor/tenant the handler resolved (§8). The
- * platform-set `langgraph_auth_user` is preserved — it is the only trusted source.
- */
-export declare function sanitizeConfigurable(configurable: Record<string, unknown> | undefined): Record<string, unknown>;
-//# sourceMappingURL=identity-runtime.d.ts.map

package/dist/runtime/identity-runtime.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-runtime.d.ts","sourceRoot":"","sources":["../../src/runtime/identity-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,eAAe,EACf,OAAO,EACR,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AA0BtD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAErC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAChD,eAAe,GAAG,SAAS,CAyB7B;AAaD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,GAAG,SAAS,CAiBtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,iBAAiB,GAAG,SAAS,EACtC,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,GAAG,SAAS,CAQtB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,EAAE,CAgBV;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB"}

package/dist/runtime/identity-runtime.js

@@ -1,151 +0,0 @@
-/**
- * Identity fields a client must never assert via `config.configurable`; only the
- * custom-auth handler (`langgraph_auth_user`) is trusted (§8, tamper-proofing).
- */
-const RESERVED_CONFIGURABLE_KEYS = new Set([
-    "actor_id",
-    "tenant_id",
-    "mda_actor_id",
-    "mda_tenant_id",
-    "mda_actor_email",
-    "mda_claims",
-    "mda_actor_type",
-    "mda_source_thread_id",
-]);
-/** Source channels a run can originate from (`runtime.identity.source.provider`). */
-const SOURCE_PROVIDERS = new Set([
-    "http",
-    "slack",
-    "schedule",
-    "cli",
-    "studio",
-]);
-/**
- * Resolve the LangGraph `configurable` bag from either a flat runtime or the
- * nested `ToolRuntime` shape LangChain passes to tools (`runtime.config.configurable`).
- */
-export function resolveRuntimeConfigurable(runtime) {
-    return runtime?.configurable ?? runtime?.config?.configurable;
-}
-/**
- * Build the frozen identity envelope for the current run from the trusted
- * `langgraph_auth_user` the custom-auth handler produced (§6.1). Returns
- * `undefined` when the deployment has no resolvable actor (identity is opt-in).
- */
-export function buildRuntimeIdentity(configurable) {
-    const user = configurable?.langgraph_auth_user;
-    const actorId = user?.mda_actor_id;
-    if (!user || !actorId) {
-        return undefined;
-    }
-    const identity = {
-        actor: {
-            type: user.mda_actor_type === "service" ? "service" : "user",
-            id: String(actorId),
-            ...(user.mda_actor_email ? { email: String(user.mda_actor_email) } : {}),
-        },
-        source: {
-            provider: sourceProvider(configurable),
-            ...(threadId(configurable) ? { threadId: threadId(configurable) } : {}),
-        },
-    };
-    if (user.mda_tenant_id) {
-        identity.tenant = { id: String(user.mda_tenant_id) };
-    }
-    if (user.mda_claims && typeof user.mda_claims === "object") {
-        identity.claims = user.mda_claims;
-    }
-    // Immutable: tools/middleware get a read-only view they cannot tamper with (§8).
-    return deepFreeze(identity);
-}
-/** Recursively freeze an object graph so the identity envelope is read-only. */
-function deepFreeze(value) {
-    if (value && typeof value === "object" && !Object.isFrozen(value)) {
-        for (const nested of Object.values(value)) {
-            deepFreeze(nested);
-        }
-        Object.freeze(value);
-    }
-    return value;
-}
-/**
- * The durable Store namespace for the run, per `scoping.memory` (§6.2). A
- * `deploymentId` prefix isolates deployments; identity segments follow. Returns
- * `undefined` for `none` (no durable memory). Fail-closed: an `actor` scope with
- * no actor already rejects at ingress, so the segments are never empty here.
- */
-export function memoryNamespace(cfg, ident, deploymentId) {
-    const scope = cfg.scoping.memory;
-    if (scope === "none") {
-        return undefined;
-    }
-    if (scope === "agent") {
-        return [deploymentId, "agent"];
-    }
-    return [
-        deploymentId,
-        ...memoryIdentitySegments(scope, cfg.tenancy, ident.actor.id, ident.tenant?.id),
-    ];
-}
-/**
- * Resolve the durable memory namespace for a run directly from the runtime the
- * memory `StoreBackend` receives, per `scoping.memory` (§6.2). This is the
- * plug-in point for the (deferred) Store-backed memory: a `StoreBackend`
- * namespace factory becomes `(ctx) => memoryNamespaceFor(ctx.runtime, cfg, id)`.
- * Returns `undefined` when the run has no durable namespace (`none`, or a
- * per-actor scope with no resolved actor).
- */
-export function memoryNamespaceFor(runtime, cfg, deploymentId) {
-    const configurable = runtime?.configurable ?? runtime?.config?.configurable;
-    const identity = buildRuntimeIdentity(configurable);
-    if (identity) {
-        return memoryNamespace(cfg, identity, deploymentId);
-    }
-    // No resolved actor: only the actor-independent `agent` scope has a namespace.
-    return cfg.scoping.memory === "agent" ? [deploymentId, "agent"] : undefined;
-}
-/**
- * The identity portion of the memory namespace (no deployment prefix), shared by
- * the memory `StoreBackend` and the `@auth.on.store` boundary check so both agree
- * on exactly which segments identify a namespace.
- */
-export function memoryIdentitySegments(scope, tenancy, actorId, tenantId) {
-    if (scope === "actor") {
-        const segments = [];
-        if (tenancy === "multi" && tenantId) {
-            segments.push(tenantId);
-        }
-        if (actorId) {
-            segments.push(actorId);
-        }
-        return segments;
-    }
-    if (scope === "tenant") {
-        return tenantId ? [tenantId] : [];
-    }
-    // "agent" (shared) | "none" (no memory) → no per-identity restriction.
-    return [];
-}
-/**
- * Strip client-supplied identity keys from an incoming `configurable` so a
- * request body can never spoof the actor/tenant the handler resolved (§8). The
- * platform-set `langgraph_auth_user` is preserved — it is the only trusted source.
- */
-export function sanitizeConfigurable(configurable) {
-    if (!configurable) {
-        return {};
-    }
-    return Object.fromEntries(Object.entries(configurable).filter(([key]) => !RESERVED_CONFIGURABLE_KEYS.has(key)));
-}
-function sourceProvider(configurable) {
-    const declared = configurable?.mda_source_provider;
-    if (typeof declared === "string" && SOURCE_PROVIDERS.has(declared)) {
-        return declared;
-    }
-    return "http";
-}
-function threadId(configurable) {
-    const value = configurable?.thread_id;
-    return value == null ? undefined : String(value);
-}
-//# sourceMappingURL=identity-runtime.js.map

package/dist/runtime/identity-runtime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-runtime.js","sourceRoot":"","sources":["../../src/runtime/identity-runtime.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,OAAO;IACP,UAAU;IACV,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAsC;IAEtC,OAAO,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,EAAE,YAAY,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAoB;QAChC,KAAK,EAAE;YACL,IAAI,EAAE,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YAC5D,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,cAAc,CAAC,YAAY,CAAC;YACtC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE;KACF,CAAC;IACF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3D,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,UAAqC,CAAC;IAC/D,CAAC;IACD,iFAAiF;IACjF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAmB,EACnB,KAAsB,EACtB,YAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO;QACL,YAAY;QACZ,GAAG,sBAAsB,CACvB,KAAK,EACL,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,KAAK,CAAC,EAAE,EACd,KAAK,CAAC,MAAM,EAAE,EAAE,CACjB;KACF,CAAC;AACJ,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAsC,EACtC,GAAmB,EACnB,YAAoB;IAEpB,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;IAC5E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IACD,+EAA+E;IAC/E,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAkB,EAClB,OAAgB,EAChB,OAA2B,EAC3B,QAA4B;IAE5B,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,OAAO,IAAI,QAAQ,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IACD,uEAAuE;IACvE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CACjC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAChD,CACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,YAAiD;IAEjD,MAAM,QAAQ,GAAG,YAAY,EAAE,mBAAmB,CAAC;IACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,QAAiD,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CACf,YAAiD;IAEjD,MAAM,KAAK,GAAG,YAAY,EAAE,SAAS,CAAC;IACtC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC"}

package/dist/runtime/langsmith-connector.d.ts

@@ -1,112 +0,0 @@
-/**
- * LangSmith connector — runtime enforcement engine.
- *
- * Mounted by the connector's `http(ctx)` hook on its namespaced sub-router.
- * Exposes one uniform endpoint per capability:
- *
- *   POST /connectors/langsmith/capabilities/{capability_id}
- *
- * with a JSON body naming the `action` and its parameters. Per request the
- * engine resolves identity (resolve-or-401), checks the caller surface, checks
- * the action, validates typed constraints, performs the LangSmith operation
- * server-side with the workspace key, and returns an allowlisted response.
- *
- * v0 does NOT prove object ownership (`runId` is treated as an unguessable
- * capability, matching the app being replaced), and has no rate limiting, audit,
- * or multi-workspace fan-out.
- */
-import type { Example, Feedback, KVMap, Prompt, Run, ScoreType, ValueType } from "langsmith/schemas";
-import type { IdentityConfig, RuntimeIdentity } from "../identity.js";
-import type { LangSmithCapability, LangSmithCallerSurface } from "../connectors/langsmith.js";
-import type { HttpContext } from "./connector.js";
-/**
- * The thin LangSmith operations the engine needs, typed against the `langsmith`
- * SDK's own schemas. {@link defaultClient} wraps a real {@link Client}; tests
- * inject a fake so the enforcement logic is verified without network or SDK
- * specifics.
- *
- * A connector "score" is a categorical value (e.g. `"positive"`), so it maps to
- * a LangSmith `score` when numeric/boolean and to a feedback `value` otherwise —
- * hence the `ScoreType | ValueType` inputs.
- */
-export interface LangSmithClient {
-    createFeedback(input: {
-        runId: string;
-        key: string;
-        score?: ScoreType | ValueType;
-        comment?: string;
-        feedbackId?: string;
-    }): Promise<Feedback>;
-    updateFeedback(input: {
-        feedbackId: string;
-        score?: ScoreType | ValueType;
-        comment?: string;
-    }): Promise<void>;
-    deleteFeedback(input: {
-        feedbackId: string;
-    }): Promise<void>;
-    readRun(input: {
-        runId: string;
-    }): Promise<Run>;
-    shareRun(input: {
-        runId: string;
-    }): Promise<{
-        url: string;
-    }>;
-    createExample(input: {
-        dataset: string;
-        inputs: KVMap;
-        outputs?: KVMap;
-    }): Promise<Example>;
-    enqueueRun(input: {
-        queue: string;
-        runId: string;
-        priority?: string;
-        note?: string;
-    }): Promise<void>;
-    readPrompt(input: {
-        name: string;
-    }): Promise<Prompt | null>;
-    readThread(input: {
-        threadId: string;
-    }): Promise<Run>;
-    updateThreadMetadata(input: {
-        threadId: string;
-        metadata: KVMap;
-    }): Promise<void>;
-}
-/** An error carrying an HTTP status the engine surfaces to the caller. */
-export declare class EnforcementError extends Error {
-    readonly status: number;
-    constructor(status: number, message: string);
-}
-/** Options the engine handler closes over. */
-export interface HandlerDeps {
-    capabilitiesById: Map<string, LangSmithCapability>;
-    client: LangSmithClient;
-    identityConfig?: IdentityConfig;
-}
-/**
- * Mount the capability route on the connector's namespaced sub-router. Runs the
- * identity-dependent authoring checks at mount time (fails startup on an illegal
- * scope/ingress combination), then registers the uniform POST endpoint.
- */
-export declare function mountLangSmithRoutes(ctx: HttpContext, capabilities: LangSmithCapability[], client?: LangSmithClient): void;
-/** Identity-aware authoring validation, run when the app is constructed. */
-export declare function validateAgainstIdentity(capabilities: LangSmithCapability[], identity: IdentityConfig | undefined): void;
-/** The per-request enforcement pipeline. Returns a JSON `Response`. */
-export declare function handleCapabilityRequest(request: Request, identity: RuntimeIdentity, deps: HandlerDeps): Promise<Response>;
-/** Map the resolved identity + ingress mode to a caller surface. */
-export declare function callerSurface(identity: RuntimeIdentity, identityConfig: IdentityConfig | undefined): LangSmithCallerSurface;
-/** Apply the capability's `include` allowlist, then drop any `redact` roots. */
-export declare function shapeResponse(raw: Record<string, unknown>, capability: LangSmithCapability): Record<string, unknown>;
-/**
- * Default client backed by the `langsmith` SDK {@link Client}. The underlying
- * client is created on first use so building the engine (e.g. for an app with no
- * requests yet) never requires `LANGSMITH_API_KEY`.
- *
- * A connector "score" is numeric/boolean → LangSmith `score`, or categorical
- * (string/object) → LangSmith feedback `value`.
- */
-export declare function defaultClient(): LangSmithClient;
-//# sourceMappingURL=langsmith-connector.d.ts.map

package/dist/runtime/langsmith-connector.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"langsmith-connector.d.ts","sourceRoot":"","sources":["../../src/runtime/langsmith-connector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EACV,OAAO,EACP,QAAQ,EACR,KAAK,EACL,MAAM,EACN,GAAG,EACH,SAAS,EACT,SAAS,EACV,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,KAAK,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB,cAAc,CAAC,KAAK,EAAE;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,cAAc,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,aAAa,CAAC,KAAK,EAAE;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,CAAC,EAAE,KAAK,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrB,UAAU,CAAC,KAAK,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,UAAU,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D,UAAU,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,oBAAoB,CAAC,KAAK,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,KAAK,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,0EAA0E;AAC1E,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAKlB;AAED,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnD,MAAM,EAAE,eAAe,CAAC;IACxB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,WAAW,EAChB,YAAY,EAAE,mBAAmB,EAAE,EACnC,MAAM,GAAE,eAAiC,GACxC,IAAI,CAeN;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,mBAAmB,EAAE,EACnC,QAAQ,EAAE,cAAc,GAAG,SAAS,GACnC,IAAI,CA6CN;AAED,uEAAuE;AACvE,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,QAAQ,CAAC,CAqCnB;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,GAAG,SAAS,GACzC,sBAAsB,CAYxB;AAkMD,gFAAgF;AAChF,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,UAAU,EAAE,mBAAmB,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBzB;AAwHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,eAAe,CA0C/C"}