managed-deepagents 0.0.3-dev.33 → 0.0.3-dev.34

package/dist/runtime/managed-tools.js

@@ -1,102 +0,0 @@
-import { createCredentialsProvider, } from "./credentials.js";
-import { buildRuntimeIdentity, resolveRuntimeConfigurable, sanitizeConfigurable, } from "./identity-runtime.js";
-/**
- * Derive the managed runtime primitives for a run from its config. Identity is
- * built only from the trusted `configurable.langgraph_auth_user` the custom-auth
- * handler produced — the field LangGraph propagates to every node and tool.
- */
-export function managedRuntimeExtras(runtime, cfg) {
-    const identity = buildRuntimeIdentity(resolveRuntimeConfigurable(runtime));
-    const extras = {};
-    if (identity) {
-        extras.identity = identity;
-    }
-    if (cfg) {
-        const credentials = createCredentialsProvider(cfg, identity);
-        if (credentials) {
-            extras.credentials = credentials;
-        }
-    }
-    return extras;
-}
-/**
- * The fields MDA overlays onto the runtime a tool/middleware hook receives:
- * the frozen `identity` (when an actor resolved) and a `configurable` with the
- * reserved identity keys stripped (§8) so downstream code can't read a
- * client-spoofed `actor_id`/`tenant_id`. Returns an empty object when there is
- * nothing to change, so the original runtime passes through untouched.
- */
-export function managedRuntimeOverrides(runtime, cfg) {
-    const overrides = {};
-    const configurable = resolveRuntimeConfigurable(runtime);
-    const identity = buildRuntimeIdentity(configurable);
-    if (identity) {
-        overrides.identity = identity;
-    }
-    if (cfg) {
-        const credentials = createCredentialsProvider(cfg, identity);
-        if (credentials) {
-            overrides.credentials = credentials;
-        }
-    }
-    if (configurable) {
-        const sanitized = sanitizeConfigurable(configurable);
-        if (Object.keys(sanitized).length !== Object.keys(configurable).length) {
-            if (runtime?.configurable !== undefined) {
-                overrides.configurable = sanitized;
-            }
-            else if (runtime?.config) {
-                overrides.config = {
-                    ...runtime.config,
-                    configurable: sanitized,
-                };
-            }
-        }
-    }
-    return overrides;
-}
-function augmentToolConfig(config, cfg) {
-    const overrides = managedRuntimeOverrides(config, cfg);
-    return Object.keys(overrides).length > 0
-        ? { ...config, ...overrides }
-        : config;
-}
-function wrapToolCallable(original, cfg, receiver) {
-    return (input, runManager, config) => original.call(receiver, input, runManager, augmentToolConfig(config, cfg));
-}
-/**
- * Wrap a tool so its runtime carries the managed primitives (`runtime.identity`,
- * …) without changing its name, schema, or class.
- *
- * Augments `invoke` (for LangGraph's `ToolNode`) and patches the tool's internal
- * `func`/`coroutine` so identity reaches the authored handler even when LangChain
- * rewrites the runtime into a RunnableConfig before calling the tool function.
- * Every other property/method passes through untouched.
- */
-export function withManagedRuntime(managedTool, cfg) {
-    const patchable = managedTool;
-    if (typeof patchable.func === "function") {
-        patchable.func = wrapToolCallable(patchable.func.bind(managedTool), cfg, managedTool);
-    }
-    if (typeof patchable.coroutine === "function") {
-        patchable.coroutine = wrapToolCallable(patchable.coroutine.bind(managedTool), cfg, managedTool);
-    }
-    return new Proxy(managedTool, {
-        get(target, property, receiver) {
-            if (property === "invoke") {
-                return (input, runtime) => {
-                    const overrides = managedRuntimeOverrides(runtime, cfg);
-                    return target.invoke(input, Object.keys(overrides).length > 0
-                        ? { ...runtime, ...overrides }
-                        : runtime);
-                };
-            }
-            return Reflect.get(target, property, receiver);
-        },
-    });
-}
-/** Wrap every tool in a list with {@link withManagedRuntime}. */
-export function wrapToolsWithManagedRuntime(tools, cfg) {
-    return tools.map((managedTool) => withManagedRuntime(managedTool, cfg));
-}
-//# sourceMappingURL=managed-tools.js.map

package/dist/runtime/managed-tools.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"managed-tools.js","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAmC/B;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsC,EACtC,GAAoB;IAEpB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7B,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsC,EACtC,GAAoB;IAEpB,MAAM,SAAS,GAGX,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,CAAC,WAAW,GAAG,WAAW,CAAC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YACvE,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxC,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC;YACrC,CAAC;iBAAM,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC3B,SAAS,CAAC,MAAM,GAAG;oBACjB,GAAG,OAAO,CAAC,MAAM;oBACjB,YAAY,EAAE,SAAS;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAqC,EACrC,GAAoB;IAEpB,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAyC,EACzC,GAA+B,EAC/B,QAAiB;IAEjB,OAAO,CAAC,KAAc,EAAE,UAAmB,EAAE,MAAe,EAAE,EAAE,CAC9D,QAAQ,CAAC,IAAI,CACX,QAAQ,EACR,KAAK,EACL,UAAU,EACV,iBAAiB,CAAC,MAAuC,EAAE,GAAG,CAAC,CAChE,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAc,EACd,GAAoB;IAEpB,MAAM,SAAS,GAAG,WAGjB,CAAC;IACF,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzC,SAAS,CAAC,IAAI,GAAG,gBAAgB,CAC/B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAChC,GAAG,EACH,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC9C,SAAS,CAAC,SAAS,GAAG,gBAAgB,CACpC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,GAAG,EACH,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE;QAC5B,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC5B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAc,EAAE,OAA2B,EAAE,EAAE;oBACrD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACxD,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,EACL,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;wBAC/B,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE;wBAC9B,CAAC,CAAC,OAAO,CACZ,CAAC;gBACJ,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,2BAA2B,CACzC,KAAmB,EACnB,GAAoB;IAEpB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/runtime/validated-token.d.ts

@@ -1,25 +0,0 @@
-import { type JWTPayload } from "jose";
-import type { IdentityConfig, ValidatedTokenIngress, ValidatedTokenProvider } from "../identity.js";
-import type { ManagedUser } from "./auth.js";
-/**
- * Resolve the caller identity for the `validated_token` ingress mode (§6.2): pick
- * the provider by token issuer, verify the token (JWKS / introspection / guest),
- * then map its claims into the identity envelope. Fail-closed (401) throughout.
- */
-export declare function resolveValidatedTokenUser(cfg: IdentityConfig, ingress: ValidatedTokenIngress, request: Request): Promise<ManagedUser>;
-/** Extract the bearer token from the `Authorization` header, or 401. */
-export declare function bearerToken(request: Request): string;
-/**
- * Select the provider that should verify `token`. A single-provider deployment
- * always uses its one entry; otherwise selection is by the token's `iss` claim
- * (guest tokens carry MDA's own issuer). Fail-closed on no match (401).
- */
-export declare function selectProvider(providers: ValidatedTokenProvider[], token: string): ValidatedTokenProvider;
-/** Map verified token claims into the managed user envelope, per `provider.claims`. */
-export declare function claimsToUser(provider: ValidatedTokenProvider, claims: JWTPayload): ManagedUser;
-/**
- * Mint a short-lived guest token for an anonymous caller. Exposed for the guest
- * issue/reissue route; the same deployment key verifies it on later calls.
- */
-export declare function issueGuestToken(provider: ValidatedTokenProvider, subject?: string): Promise<string>;
-//# sourceMappingURL=validated-token.d.ts.map

package/dist/runtime/validated-token.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validated-token.d.ts","sourceRoot":"","sources":["../../src/runtime/validated-token.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,MAAM,CAAC;AAEd,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAc7C;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAQpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,sBAAsB,EAAE,EACnC,KAAK,EAAE,MAAM,GACZ,sBAAsB,CAsBxB;AAED,uFAAuF;AACvF,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,sBAAsB,EAChC,MAAM,EAAE,UAAU,GACjB,WAAW,CA0Bb;AA0JD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,sBAAsB,EAChC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAejB"}

package/dist/runtime/validated-token.js

@@ -1,260 +0,0 @@
-import { HTTPException } from "@langchain/langgraph-sdk/auth";
-import { createRemoteJWKSet, decodeJwt, jwtVerify, SignJWT, } from "jose";
-/** Issuer stamped on MDA-minted guest tokens, used to route them at selection. */
-const GUEST_ISSUER = "mda:guest";
-/** Deployment env var carrying the HS256 key MDA signs/verifies guest tokens with. */
-const GUEST_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
-/** Remote JWKS key sets, cached per resolved JWKS URI for the process lifetime. */
-const jwksCache = new Map();
-/** OIDC `discover` results (issuer → jwks_uri), cached for the process lifetime. */
-const discoverCache = new Map();
-/**
- * Resolve the caller identity for the `validated_token` ingress mode (§6.2): pick
- * the provider by token issuer, verify the token (JWKS / introspection / guest),
- * then map its claims into the identity envelope. Fail-closed (401) throughout.
- */
-export async function resolveValidatedTokenUser(cfg, ingress, request) {
-    const token = bearerToken(request);
-    const provider = selectProvider(ingress.providers, token);
-    const claims = await verifyProviderClaims(provider, token, request.headers);
-    const user = claimsToUser(provider, claims);
-    if (cfg.tenancy === "multi" && !user.mda_tenant_id) {
-        throw new HTTPException(401, {
-            message: "missing tenant for multi-tenant deployment",
-        });
-    }
-    return user;
-}
-/** Extract the bearer token from the `Authorization` header, or 401. */
-export function bearerToken(request) {
-    const header = request.headers.get("authorization") ?? "";
-    const match = /^Bearer\s+(.+)$/i.exec(header);
-    const token = match?.[1];
-    if (!token) {
-        throw new HTTPException(401, { message: "missing bearer token" });
-    }
-    return token.trim();
-}
-/**
- * Select the provider that should verify `token`. A single-provider deployment
- * always uses its one entry; otherwise selection is by the token's `iss` claim
- * (guest tokens carry MDA's own issuer). Fail-closed on no match (401).
- */
-export function selectProvider(providers, token) {
-    const [only] = providers;
-    if (only && providers.length === 1) {
-        return only;
-    }
-    let issuer;
-    try {
-        issuer = decodeJwt(token).iss;
-    }
-    catch {
-        throw new HTTPException(401, { message: "malformed token" });
-    }
-    const match = providers.find((p) => p.issuer && p.issuer === issuer);
-    if (match) {
-        return match;
-    }
-    if (issuer === GUEST_ISSUER) {
-        const guest = providers.find((p) => p.guest);
-        if (guest) {
-            return guest;
-        }
-    }
-    throw new HTTPException(401, { message: "no provider matches token issuer" });
-}
-/** Map verified token claims into the managed user envelope, per `provider.claims`. */
-export function claimsToUser(provider, claims) {
-    const actor = claims[provider.claims.actor];
-    if (actor == null || actor === "") {
-        throw new HTTPException(401, {
-            message: `token missing actor claim "${provider.claims.actor}"`,
-        });
-    }
-    const user = {
-        identity: String(actor),
-        permissions: [],
-        mda_actor_id: String(actor),
-        mda_claims: { ...claims },
-    };
-    const tenant = provider.claims.tenant
-        ? claims[provider.claims.tenant]
-        : undefined;
-    if (tenant != null && tenant !== "") {
-        user.mda_tenant_id = String(tenant);
-    }
-    const email = provider.claims.email
-        ? claims[provider.claims.email]
-        : undefined;
-    if (email) {
-        user.mda_actor_email = String(email);
-    }
-    return user;
-}
-async function verifyProviderClaims(provider, token, headers) {
-    if (provider.introspect) {
-        return introspectClaims(provider, token, headers);
-    }
-    if (provider.guest) {
-        return verifyGuestToken(token);
-    }
-    return jwksVerifyClaims(provider, token);
-}
-async function jwksVerifyClaims(provider, token) {
-    const keySet = await providerKeySet(provider);
-    try {
-        const { payload } = await jwtVerify(token, keySet, {
-            issuer: provider.issuer,
-            audience: provider.audience,
-            algorithms: provider.algorithms,
-        });
-        return payload;
-    }
-    catch {
-        throw new HTTPException(401, {
-            message: "token signature verification failed",
-        });
-    }
-}
-async function providerKeySet(provider) {
-    const uri = await resolveJwksUri(provider);
-    let keySet = jwksCache.get(uri);
-    if (!keySet) {
-        keySet = createRemoteJWKSet(new URL(uri));
-        jwksCache.set(uri, keySet);
-    }
-    return keySet;
-}
-async function resolveJwksUri(provider) {
-    if (provider.jwks) {
-        return provider.jwks;
-    }
-    if (provider.discover && provider.issuer) {
-        const cached = discoverCache.get(provider.issuer);
-        if (cached) {
-            return cached;
-        }
-        const base = provider.issuer.replace(/\/$/, "");
-        const response = await fetch(`${base}/.well-known/openid-configuration`);
-        if (!response.ok) {
-            throw new HTTPException(401, {
-                message: "failed to resolve OIDC configuration",
-            });
-        }
-        const config = (await response.json());
-        if (!config.jwks_uri) {
-            throw new HTTPException(401, {
-                message: "OIDC configuration has no jwks_uri",
-            });
-        }
-        discoverCache.set(provider.issuer, config.jwks_uri);
-        return config.jwks_uri;
-    }
-    throw new HTTPException(500, {
-        message: "validated_token provider declares neither jwks nor discover",
-    });
-}
-async function introspectClaims(provider, token, headers) {
-    const introspect = provider.introspect;
-    const target = resolveIntrospection(provider, headers);
-    const requestHeaders = {};
-    // Base headers first, then the selected region's headers so a region can
-    // override the shared default (e.g. a per-region Supabase `apikey`).
-    for (const [key, value] of Object.entries(introspect.headers ?? {})) {
-        requestHeaders[key] = expandEnv(value);
-    }
-    for (const [key, value] of Object.entries(target.headers ?? {})) {
-        requestHeaders[key] = expandEnv(value);
-    }
-    if ((introspect.tokenIn ?? "authorization") === "authorization") {
-        requestHeaders.authorization = `Bearer ${token}`;
-    }
-    else {
-        requestHeaders[introspect.header ?? "authorization"] = token;
-    }
-    // Expand `${ENV}` in the endpoint so region URLs can stay deployment-driven
-    // (e.g. `${SUPABASE_EU_URL}/auth/v1/user`) rather than baked in at authoring.
-    const response = await fetch(expandEnv(target.url), {
-        headers: requestHeaders,
-    });
-    if (!response.ok) {
-        throw new HTTPException(401, { message: "token introspection failed" });
-    }
-    return (await response.json());
-}
-/**
- * Resolve the introspection endpoint (and any region-specific headers) for the
- * request. A single-endpoint provider uses `introspect.url`; a multi-region
- * provider selects by the `regionHeader` value, where each region maps either to
- * a bare URL (shared headers) or a `{ url, headers }` object carrying its own
- * credential (e.g. a per-region Supabase `apikey`). Fail-closed (401/500).
- */
-function resolveIntrospection(provider, headers) {
-    const introspect = provider.introspect;
-    if (introspect.url) {
-        return { url: introspect.url };
-    }
-    if (introspect.regionHeader && introspect.regions) {
-        const region = headers.get(introspect.regionHeader);
-        const entry = region ? introspect.regions[region] : undefined;
-        if (!entry) {
-            throw new HTTPException(401, {
-                message: "unknown or missing region for introspection",
-            });
-        }
-        return typeof entry === "string" ? { url: entry } : entry;
-    }
-    throw new HTTPException(500, {
-        message: "introspection provider declares neither url nor regions",
-    });
-}
-/** Verify an MDA-minted guest token (HS256, signed with the deployment key). */
-async function verifyGuestToken(token) {
-    try {
-        const { payload } = await jwtVerify(token, guestSigningKey(), {
-            issuer: GUEST_ISSUER,
-            algorithms: ["HS256"],
-        });
-        return payload;
-    }
-    catch {
-        throw new HTTPException(401, { message: "invalid guest token" });
-    }
-}
-/**
- * Mint a short-lived guest token for an anonymous caller. Exposed for the guest
- * issue/reissue route; the same deployment key verifies it on later calls.
- */
-export async function issueGuestToken(provider, subject) {
-    const guest = provider.guest;
-    if (!guest?.issue) {
-        throw new HTTPException(400, {
-            message: "provider does not allow guest issuance",
-        });
-    }
-    const sub = `${guest.actorPrefix ?? ""}${subject ?? crypto.randomUUID()}`;
-    return new SignJWT({})
-        .setProtectedHeader({ alg: "HS256" })
-        .setIssuer(GUEST_ISSUER)
-        .setSubject(sub)
-        .setIssuedAt()
-        .setExpirationTime(guest.ttl ?? "24h")
-        .sign(guestSigningKey());
-}
-function guestSigningKey() {
-    const key = process.env[GUEST_KEY_ENV];
-    if (!key) {
-        throw new HTTPException(500, {
-            message: `guest tokens require ${GUEST_KEY_ENV}`,
-        });
-    }
-    return new TextEncoder().encode(key);
-}
-/** Expand a single `${ENV_VAR}` reference in a header value (e.g. Supabase apikey). */
-function expandEnv(value) {
-    return value.replace(/\$\{([A-Z0-9_]+)\}/g, (_match, name) => {
-        return process.env[name] ?? "";
-    });
-}
-//# sourceMappingURL=validated-token.js.map

package/dist/runtime/validated-token.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"validated-token.js","sourceRoot":"","sources":["../../src/runtime/validated-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EACL,kBAAkB,EAClB,SAAS,EAET,SAAS,EACT,OAAO,GACR,MAAM,MAAM,CAAC;AASd,kFAAkF;AAClF,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,sFAAsF;AACtF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAI9C,mFAAmF;AACnF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;AAClD,oFAAoF;AACpF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAmB,EACnB,OAA8B,EAC9B,OAAgB;IAEhB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAmC,EACnC,KAAa;IAEb,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACzB,IAAI,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACrE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAC1B,QAAgC,EAChC,MAAkB;IAElB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG;SAChE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAgB;QACxB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC;QAC3B,UAAU,EAAE,EAAE,GAAG,MAAM,EAAE;KAC1B,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM;QACnC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK;QACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAgC,EAChC,KAAa,EACb,OAAgB;IAEhB,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAgC,EAChC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YACjD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgC;IAEhC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgC;IAEhC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,sCAAsC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,oCAAoC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,6DAA6D;KACvE,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAgC,EAChC,KAAa,EACb,OAAgB;IAEhB,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAW,CAAC;IACxC,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,cAAc,GAA2B,EAAE,CAAC;IAClD,yEAAyE;IACzE,qEAAqE;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,cAAc,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,cAAc,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,eAAe,CAAC,KAAK,eAAe,EAAE,CAAC;QAChE,cAAc,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,CAAC;IAC/D,CAAC;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QAClD,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAe,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,QAAgC,EAChC,OAAgB;IAEhB,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAW,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,yDAAyD;KACnE,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE;YAC5D,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgC,EAChC,OAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,GAAG,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAC1E,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,YAAY,CAAC;SACvB,UAAU,CAAC,GAAG,CAAC;SACf,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC;SACrC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,wBAAwB,aAAa,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QACnE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC"}