managed-deepagents 0.0.3-dev.41 → 0.0.3-dev.43
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/connectors/langsmith.d.ts +3 -2
- package/dist/connectors/langsmith.d.ts.map +1 -1
- package/dist/connectors/langsmith.js +10 -4
- package/dist/connectors/langsmith.js.map +1 -1
- package/dist/identity.d.ts +42 -23
- package/dist/identity.d.ts.map +1 -1
- package/dist/identity.js +74 -10
- package/dist/identity.js.map +1 -1
- package/dist/runtime/auth.d.ts +5 -3
- package/dist/runtime/auth.d.ts.map +1 -1
- package/dist/runtime/auth.js +22 -9
- package/dist/runtime/auth.js.map +1 -1
- package/dist/runtime/credentials.d.ts +14 -6
- package/dist/runtime/credentials.d.ts.map +1 -1
- package/dist/runtime/credentials.js +32 -9
- package/dist/runtime/credentials.js.map +1 -1
- package/dist/runtime/identity-http.js +10 -1
- package/dist/runtime/identity-http.js.map +1 -1
- package/dist/runtime/identity-runtime.d.ts +4 -4
- package/dist/runtime/identity-runtime.js +6 -6
- package/dist/runtime/identity-runtime.js.map +1 -1
- package/dist/runtime/langsmith-connector.d.ts +20 -5
- package/dist/runtime/langsmith-connector.d.ts.map +1 -1
- package/dist/runtime/langsmith-connector.js +236 -23
- package/dist/runtime/langsmith-connector.js.map +1 -1
- package/dist/runtime/managed-tools.d.ts +5 -5
- package/dist/runtime/managed-tools.d.ts.map +1 -1
- package/dist/runtime/managed-tools.js +7 -7
- package/dist/runtime/managed-tools.js.map +1 -1
- package/dist/runtime/validated-token.d.ts +14 -3
- package/dist/runtime/validated-token.d.ts.map +1 -1
- package/dist/runtime/validated-token.js +113 -13
- package/dist/runtime/validated-token.js.map +1 -1
- package/dist/types.d.ts +1 -1
- package/package.json +7 -7
|
@@ -1,16 +1,16 @@
|
|
|
1
1
|
import type { CredentialTarget, IdentityConfig, ResolvedCredential, RuntimeIdentity } from "../identity.js";
|
|
2
2
|
/**
|
|
3
|
-
* Component 5 — Credentials, custom mode
|
|
3
|
+
* Component 5 — Credentials, custom mode.
|
|
4
4
|
*
|
|
5
5
|
* The escape hatch Agent Auth can't cover: bespoke per-actor credential minting
|
|
6
6
|
* via an in-process resolver callback or a hosted token-exchange endpoint. It
|
|
7
7
|
* runs in the worker (not the shared ingress auth handler), applies the output
|
|
8
8
|
* to downstream calls, and caches per `(actor, tenant, target)` until the
|
|
9
9
|
* credential's `expiresAt`. Secrets live only in this in-memory cache keyed by
|
|
10
|
-
* identity — never in thread state or traces
|
|
10
|
+
* identity — never in thread state or traces.
|
|
11
11
|
*
|
|
12
12
|
* The managed modes (`agent`/`actor`) route to Agent Auth
|
|
13
|
-
* (`@langchain/auth`/`langchain-auth
|
|
13
|
+
* (`@langchain/auth`/`langchain-auth`) and are wired separately; this
|
|
14
14
|
* module is only the custom path.
|
|
15
15
|
*/
|
|
16
16
|
/** Env var holding the HMAC secret MDA signs the endpoint assertion with. */
|
|
@@ -38,15 +38,23 @@ export interface CredentialDeps {
|
|
|
38
38
|
/** Signs the assertion MDA presents to a hosted token-exchange endpoint. */
|
|
39
39
|
signAssertion: (identity: RuntimeIdentity, target: CredentialTarget) => Promise<string>;
|
|
40
40
|
}
|
|
41
|
+
/** Default TTL when a resolver omits `expiresAt` (15 minutes). */
|
|
42
|
+
export declare const DEFAULT_CREDENTIAL_TTL_MS: number;
|
|
43
|
+
/** Soft cap on cached credentials per process. */
|
|
44
|
+
export declare const MAX_CREDENTIAL_CACHE_ENTRIES = 1024;
|
|
41
45
|
/**
|
|
42
46
|
* TTL cache for resolved credentials, keyed by `(actor, tenant, target)` so
|
|
43
|
-
* per-repo/per-install tokens never collide. Kept out of thread state
|
|
44
|
-
* expire at the credential's `expiresAt
|
|
47
|
+
* per-repo/per-install tokens never collide. Kept out of thread state. Entries
|
|
48
|
+
* expire at the credential's `expiresAt`, or after a default TTL when omitted.
|
|
49
|
+
* The cache is soft-capped to bound memory in multi-tenant workers.
|
|
45
50
|
*/
|
|
46
51
|
export declare class CredentialCache {
|
|
52
|
+
private readonly defaultTtlMs;
|
|
53
|
+
private readonly maxEntries;
|
|
47
54
|
private readonly entries;
|
|
55
|
+
constructor(defaultTtlMs?: number, maxEntries?: number);
|
|
48
56
|
get(key: string, nowMs: number): ResolvedCredential | undefined;
|
|
49
|
-
set(key: string, value: ResolvedCredential): void;
|
|
57
|
+
set(key: string, value: ResolvedCredential, nowMs?: number): void;
|
|
50
58
|
clear(): void;
|
|
51
59
|
}
|
|
52
60
|
/** Clear the process-level credential cache. Test-only. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAKzE,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CACD,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,4EAA4E;IAC5E,aAAa,EAAE,CACb,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,gBAAgB,KACrB,OAAO,CAAC,MAAM,CAAC,CAAC;CACtB;AAQD
|
|
1
|
+
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAKzE,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CACD,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,4EAA4E;IAC5E,aAAa,EAAE,CACb,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,gBAAgB,KACrB,OAAO,CAAC,MAAM,CAAC,CAAC;CACtB;AAQD,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AACxD,kDAAkD;AAClD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD;;;;;GAKG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;gBAGtC,YAAY,GAAE,MAAkC,EAChD,UAAU,GAAE,MAAqC;IAGpE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAY/D,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,kBAAkB,EACzB,KAAK,GAAE,MAAmB,GACzB,IAAI;IAoBP,KAAK,IAAI,IAAI;CAGd;AAKD,2DAA2D;AAC3D,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,IAAI,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAC9B,KAAK,GAAE,eAA8B,GACpC,mBAAmB,GAAG,SAAS,CA8BjC"}
|
|
@@ -1,45 +1,68 @@
|
|
|
1
1
|
import { SignJWT } from "jose";
|
|
2
2
|
/**
|
|
3
|
-
* Component 5 — Credentials, custom mode
|
|
3
|
+
* Component 5 — Credentials, custom mode.
|
|
4
4
|
*
|
|
5
5
|
* The escape hatch Agent Auth can't cover: bespoke per-actor credential minting
|
|
6
6
|
* via an in-process resolver callback or a hosted token-exchange endpoint. It
|
|
7
7
|
* runs in the worker (not the shared ingress auth handler), applies the output
|
|
8
8
|
* to downstream calls, and caches per `(actor, tenant, target)` until the
|
|
9
9
|
* credential's `expiresAt`. Secrets live only in this in-memory cache keyed by
|
|
10
|
-
* identity — never in thread state or traces
|
|
10
|
+
* identity — never in thread state or traces.
|
|
11
11
|
*
|
|
12
12
|
* The managed modes (`agent`/`actor`) route to Agent Auth
|
|
13
|
-
* (`@langchain/auth`/`langchain-auth
|
|
13
|
+
* (`@langchain/auth`/`langchain-auth`) and are wired separately; this
|
|
14
14
|
* module is only the custom path.
|
|
15
15
|
*/
|
|
16
16
|
/** Env var holding the HMAC secret MDA signs the endpoint assertion with. */
|
|
17
17
|
export const CREDENTIAL_SIGNING_SECRET_ENV = "MDA_TOKEN_EXCHANGE_SECRET";
|
|
18
18
|
/** How long a signed endpoint assertion is valid, in seconds. */
|
|
19
19
|
const ASSERTION_TTL_SECONDS = 60;
|
|
20
|
+
/** Default TTL when a resolver omits `expiresAt` (15 minutes). */
|
|
21
|
+
export const DEFAULT_CREDENTIAL_TTL_MS = 15 * 60 * 1000;
|
|
22
|
+
/** Soft cap on cached credentials per process. */
|
|
23
|
+
export const MAX_CREDENTIAL_CACHE_ENTRIES = 1024;
|
|
20
24
|
/**
|
|
21
25
|
* TTL cache for resolved credentials, keyed by `(actor, tenant, target)` so
|
|
22
|
-
* per-repo/per-install tokens never collide. Kept out of thread state
|
|
23
|
-
* expire at the credential's `expiresAt
|
|
26
|
+
* per-repo/per-install tokens never collide. Kept out of thread state. Entries
|
|
27
|
+
* expire at the credential's `expiresAt`, or after a default TTL when omitted.
|
|
28
|
+
* The cache is soft-capped to bound memory in multi-tenant workers.
|
|
24
29
|
*/
|
|
25
30
|
export class CredentialCache {
|
|
31
|
+
defaultTtlMs;
|
|
32
|
+
maxEntries;
|
|
26
33
|
entries = new Map();
|
|
34
|
+
constructor(defaultTtlMs = DEFAULT_CREDENTIAL_TTL_MS, maxEntries = MAX_CREDENTIAL_CACHE_ENTRIES) {
|
|
35
|
+
this.defaultTtlMs = defaultTtlMs;
|
|
36
|
+
this.maxEntries = maxEntries;
|
|
37
|
+
}
|
|
27
38
|
get(key, nowMs) {
|
|
28
39
|
const hit = this.entries.get(key);
|
|
29
40
|
if (!hit) {
|
|
30
41
|
return undefined;
|
|
31
42
|
}
|
|
32
|
-
if (
|
|
43
|
+
if (nowMs >= hit.expiresAtMs) {
|
|
33
44
|
this.entries.delete(key);
|
|
34
45
|
return undefined;
|
|
35
46
|
}
|
|
36
47
|
return hit.value;
|
|
37
48
|
}
|
|
38
|
-
set(key, value) {
|
|
49
|
+
set(key, value, nowMs = Date.now()) {
|
|
39
50
|
let expiresAtMs;
|
|
40
51
|
if (value.expiresAt) {
|
|
41
52
|
const parsed = Date.parse(value.expiresAt);
|
|
42
|
-
expiresAtMs = Number.isNaN(parsed) ?
|
|
53
|
+
expiresAtMs = Number.isNaN(parsed) ? nowMs + this.defaultTtlMs : parsed;
|
|
54
|
+
}
|
|
55
|
+
else {
|
|
56
|
+
expiresAtMs = nowMs + this.defaultTtlMs;
|
|
57
|
+
}
|
|
58
|
+
if (!this.entries.has(key)) {
|
|
59
|
+
while (this.entries.size >= this.maxEntries) {
|
|
60
|
+
const oldest = this.entries.keys().next().value;
|
|
61
|
+
if (oldest === undefined) {
|
|
62
|
+
break;
|
|
63
|
+
}
|
|
64
|
+
this.entries.delete(oldest);
|
|
65
|
+
}
|
|
43
66
|
}
|
|
44
67
|
this.entries.set(key, { value, expiresAtMs });
|
|
45
68
|
}
|
|
@@ -134,7 +157,7 @@ async function defaultSignAssertion(identity, target) {
|
|
|
134
157
|
}
|
|
135
158
|
/**
|
|
136
159
|
* The cache key that discriminates a minted credential: the actor + tenant it
|
|
137
|
-
* belongs to, plus the target's kind/name/intent/thread and metadata
|
|
160
|
+
* belongs to, plus the target's kind/name/intent/thread and metadata.
|
|
138
161
|
*/
|
|
139
162
|
function cacheKey(identity, target) {
|
|
140
163
|
return stableStringify([
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAS/B;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAwCjC
|
|
1
|
+
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAS/B;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAwCjC,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,kDAAkD;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAIP;IACA;IAJF,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEzD,YACmB,eAAuB,yBAAyB,EAChD,aAAqB,4BAA4B;QADjD,iBAAY,GAAZ,YAAY,CAAoC;QAChD,eAAU,GAAV,UAAU,CAAuC;IACjE,CAAC;IAEJ,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CACD,GAAW,EACX,KAAyB,EACzB,QAAgB,IAAI,CAAC,GAAG,EAAE;QAE1B,IAAI,WAAmB,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,UAAU,4BAA4B;IAC1C,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAmB,EACnB,QAAqC,EACrC,IAA8B,EAC9B,QAAyB,YAAY;IAErC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAmB;QAC/B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;QAC3B,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,oBAAoB;KAC3D,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;YACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sEAAsE;oBACpE,6BAA6B,CAChC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC3C,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;YACD,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAmB,EACnB,QAAyB,EACzB,MAAwB,EACxB,IAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,OAAO,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,SAAiB,EACjB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,SAAS,EAAE;SACrC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,cAAc,QAAQ,CAAC,MAAM,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAyB,EACzB,MAAwB;IAExB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,GAAG,6BAA6B,iCAAiC,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QACjB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC3B,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI;QAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE;QAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KACxE,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;SAC7B,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,QAAQ,GAAG,qBAAqB,CAAC;SACnD,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAyB,EAAE,MAAwB;IACnE,OAAO,eAAe,CAAC;QACrB,QAAQ,CAAC,KAAK,CAAC,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI;QAC3B,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,MAAM,CAAC,QAAQ,IAAI,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CACxB,KAAc,EACd,WAAmB;IAEnB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,cAAc,WAAW,gCAAgC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAG9B,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,sCAAsC,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAA2B,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,YAAY,IAAI,qBAAqB,CAC/D,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAuB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,uCAAuC,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
|
@@ -57,6 +57,10 @@ function mountIdentityRoutes(app, identity) {
|
|
|
57
57
|
* Mount a connector's `http` routes on a sub-router namespaced under
|
|
58
58
|
* `/connectors/{kind}`, so connector routes cannot collide with identity/API
|
|
59
59
|
* routes or with each other.
|
|
60
|
+
*
|
|
61
|
+
* The connector's `http` hook must mount synchronously. Async hooks are rejected
|
|
62
|
+
* because LangGraph captures custom routes when the module is imported — a
|
|
63
|
+
* deferred mount leaves those paths as platform 404s.
|
|
60
64
|
*/
|
|
61
65
|
function mountConnectorRoutes(app, connector, cfg, mounted) {
|
|
62
66
|
const sub = new Hono();
|
|
@@ -72,7 +76,12 @@ function mountConnectorRoutes(app, connector, cfg, mounted) {
|
|
|
72
76
|
return resolveRequestIdentity(cfg, request);
|
|
73
77
|
},
|
|
74
78
|
};
|
|
75
|
-
connector.http?.(ctx);
|
|
79
|
+
const result = connector.http?.(ctx);
|
|
80
|
+
if (result != null &&
|
|
81
|
+
typeof result.then === "function") {
|
|
82
|
+
throw new Error(`Connector "${connector.kind}" http() returned a Promise. HTTP hooks must ` +
|
|
83
|
+
`mount routes synchronously so LangGraph can capture them at import time.`);
|
|
84
|
+
}
|
|
76
85
|
app.route(`/connectors/${connector.kind}`, sub);
|
|
77
86
|
}
|
|
78
87
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identity-http.js","sourceRoot":"","sources":["../../src/runtime/identity-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAQnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAoBvD,qFAAqF;AACrF,MAAM,0BAA2B,SAAQ,KAAK;IACnC,MAAM,GAAG,GAAG,CAAC;IACtB;QACE,KAAK,CACH,qEAAqE;YACnE,qBAAqB,CACxB,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACzC,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,GAAS,EAAE,QAA4B;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CACpC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"identity-http.js","sourceRoot":"","sources":["../../src/runtime/identity-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAQnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAoBvD,qFAAqF;AACrF,MAAM,0BAA2B,SAAQ,KAAK;IACnC,MAAM,GAAG,GAAG,CAAC;IACtB;QACE,KAAK,CACH,qEAAqE;YACnE,qBAAqB,CACxB,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACzC,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,GAAS,EAAE,QAA4B;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CACpC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAC3B,GAAS,EACT,SAAoB,EACpB,GAA+B,EAC/B,OAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAgB;QACvB,MAAM;QACN,QAAQ,EAAE,GAAG;QACb,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE;YAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,6DAA6D;oBAC3D,0DAA0D,CAC7D,CACF,CAAC;YACJ,CAAC;YACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAyB,CAAC;IAC7D,IACE,MAAM,IAAI,IAAI;QACd,OAAQ,MAA4B,CAAC,IAAI,KAAK,UAAU,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,CAAC,IAAI,+CAA+C;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,eAAe,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,GAAS,EACT,IAAY,EACZ,GAA+B,EAC/B,OAAuB;IAEvB,MAAM,OAAO,GACX,CAAC,MAAkB,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE;QACrE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,oBAAoB,CAAC,IAAI,0BAA0B,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEJ,MAAM,WAAW,GACf,CAAC,MAAkB,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,OAA2B,EAAE,EAAE;QACpE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEJ,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;QACrB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE;YACN,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACvB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACvB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;QACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;QACtC,CAAC,CAAC,GAAG,CAAC;IACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;IAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;QACtD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAuB;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;IAC3E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,eAAe,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC"}
|
|
@@ -7,12 +7,12 @@ import type { ConfigurableCarrier } from "./types.js";
|
|
|
7
7
|
export declare function resolveRuntimeConfigurable(runtime: RuntimeConfigLike | undefined): Record<string, unknown> | undefined;
|
|
8
8
|
/**
|
|
9
9
|
* Build the frozen identity envelope for the current run from the trusted
|
|
10
|
-
* `langgraph_auth_user` the custom-auth handler produced
|
|
10
|
+
* `langgraph_auth_user` the custom-auth handler produced. Returns
|
|
11
11
|
* `undefined` when the deployment has no resolvable actor (identity is opt-in).
|
|
12
12
|
*/
|
|
13
13
|
export declare function buildRuntimeIdentity(configurable: Record<string, unknown> | undefined): RuntimeIdentity | undefined;
|
|
14
14
|
/**
|
|
15
|
-
* The durable Store namespace for the run, per `scoping.memory
|
|
15
|
+
* The durable Store namespace for the run, per `scoping.memory`. A
|
|
16
16
|
* `deploymentId` prefix isolates deployments; identity segments follow. Returns
|
|
17
17
|
* `undefined` for `none` (no durable memory). Fail-closed: an `actor` scope with
|
|
18
18
|
* no actor already rejects at ingress, so the segments are never empty here.
|
|
@@ -32,7 +32,7 @@ export interface RuntimeConfigLike extends ConfigurableCarrier {
|
|
|
32
32
|
}
|
|
33
33
|
/**
|
|
34
34
|
* Resolve the durable memory namespace for a run directly from the runtime the
|
|
35
|
-
* memory `StoreBackend` receives, per `scoping.memory
|
|
35
|
+
* memory `StoreBackend` receives, per `scoping.memory`. This is the
|
|
36
36
|
* plug-in point for the (deferred) Store-backed memory: a `StoreBackend`
|
|
37
37
|
* namespace factory becomes `(ctx) => memoryNamespaceFor(ctx.runtime, cfg, id)`.
|
|
38
38
|
* Returns `undefined` when the run has no durable namespace (`none`, or a
|
|
@@ -47,7 +47,7 @@ export declare function memoryNamespaceFor(runtime: RuntimeConfigLike | undefine
|
|
|
47
47
|
export declare function memoryIdentitySegments(scope: MemoryScope, tenancy: Tenancy, actorId: string | undefined, tenantId: string | undefined): string[];
|
|
48
48
|
/**
|
|
49
49
|
* Strip client-supplied identity keys from an incoming `configurable` so a
|
|
50
|
-
* request body can never spoof the actor/tenant the handler resolved
|
|
50
|
+
* request body can never spoof the actor/tenant the handler resolved. The
|
|
51
51
|
* platform-set `langgraph_auth_user` is preserved — it is the only trusted source.
|
|
52
52
|
*/
|
|
53
53
|
export declare function sanitizeConfigurable(configurable: Record<string, unknown> | undefined): Record<string, unknown>;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Identity fields a client must never assert via `config.configurable`; only the
|
|
3
|
-
* custom-auth handler (`langgraph_auth_user`) is trusted
|
|
3
|
+
* custom-auth handler (`langgraph_auth_user`) is trusted.
|
|
4
4
|
*/
|
|
5
5
|
const RESERVED_CONFIGURABLE_KEYS = new Set([
|
|
6
6
|
"actor_id",
|
|
@@ -29,7 +29,7 @@ export function resolveRuntimeConfigurable(runtime) {
|
|
|
29
29
|
}
|
|
30
30
|
/**
|
|
31
31
|
* Build the frozen identity envelope for the current run from the trusted
|
|
32
|
-
* `langgraph_auth_user` the custom-auth handler produced
|
|
32
|
+
* `langgraph_auth_user` the custom-auth handler produced. Returns
|
|
33
33
|
* `undefined` when the deployment has no resolvable actor (identity is opt-in).
|
|
34
34
|
*/
|
|
35
35
|
export function buildRuntimeIdentity(configurable) {
|
|
@@ -55,7 +55,7 @@ export function buildRuntimeIdentity(configurable) {
|
|
|
55
55
|
if (user.mda_claims && typeof user.mda_claims === "object") {
|
|
56
56
|
identity.claims = user.mda_claims;
|
|
57
57
|
}
|
|
58
|
-
// Immutable: tools/middleware get a read-only view they cannot tamper with
|
|
58
|
+
// Immutable: tools/middleware get a read-only view they cannot tamper with.
|
|
59
59
|
return deepFreeze(identity);
|
|
60
60
|
}
|
|
61
61
|
/** Recursively freeze an object graph so the identity envelope is read-only. */
|
|
@@ -69,7 +69,7 @@ function deepFreeze(value) {
|
|
|
69
69
|
return value;
|
|
70
70
|
}
|
|
71
71
|
/**
|
|
72
|
-
* The durable Store namespace for the run, per `scoping.memory
|
|
72
|
+
* The durable Store namespace for the run, per `scoping.memory`. A
|
|
73
73
|
* `deploymentId` prefix isolates deployments; identity segments follow. Returns
|
|
74
74
|
* `undefined` for `none` (no durable memory). Fail-closed: an `actor` scope with
|
|
75
75
|
* no actor already rejects at ingress, so the segments are never empty here.
|
|
@@ -89,7 +89,7 @@ export function memoryNamespace(cfg, ident, deploymentId) {
|
|
|
89
89
|
}
|
|
90
90
|
/**
|
|
91
91
|
* Resolve the durable memory namespace for a run directly from the runtime the
|
|
92
|
-
* memory `StoreBackend` receives, per `scoping.memory
|
|
92
|
+
* memory `StoreBackend` receives, per `scoping.memory`. This is the
|
|
93
93
|
* plug-in point for the (deferred) Store-backed memory: a `StoreBackend`
|
|
94
94
|
* namespace factory becomes `(ctx) => memoryNamespaceFor(ctx.runtime, cfg, id)`.
|
|
95
95
|
* Returns `undefined` when the run has no durable namespace (`none`, or a
|
|
@@ -128,7 +128,7 @@ export function memoryIdentitySegments(scope, tenancy, actorId, tenantId) {
|
|
|
128
128
|
}
|
|
129
129
|
/**
|
|
130
130
|
* Strip client-supplied identity keys from an incoming `configurable` so a
|
|
131
|
-
* request body can never spoof the actor/tenant the handler resolved
|
|
131
|
+
* request body can never spoof the actor/tenant the handler resolved. The
|
|
132
132
|
* platform-set `langgraph_auth_user` is preserved — it is the only trusted source.
|
|
133
133
|
*/
|
|
134
134
|
export function sanitizeConfigurable(configurable) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identity-runtime.js","sourceRoot":"","sources":["../../src/runtime/identity-runtime.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,OAAO;IACP,UAAU;IACV,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAsC;IAEtC,OAAO,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,EAAE,YAAY,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAoB;QAChC,KAAK,EAAE;YACL,IAAI,EAAE,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YAC5D,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,cAAc,CAAC,YAAY,CAAC;YACtC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE;KACF,CAAC;IACF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3D,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,UAAqC,CAAC;IAC/D,CAAC;IACD,
|
|
1
|
+
{"version":3,"file":"identity-runtime.js","sourceRoot":"","sources":["../../src/runtime/identity-runtime.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,OAAO;IACP,UAAU;IACV,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAsC;IAEtC,OAAO,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,EAAE,YAAY,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAoB;QAChC,KAAK,EAAE;YACL,IAAI,EAAE,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YAC5D,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,cAAc,CAAC,YAAY,CAAC;YACtC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE;KACF,CAAC;IACF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3D,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,UAAqC,CAAC;IAC/D,CAAC;IACD,4EAA4E;IAC5E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAmB,EACnB,KAAsB,EACtB,YAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO;QACL,YAAY;QACZ,GAAG,sBAAsB,CACvB,KAAK,EACL,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,KAAK,CAAC,EAAE,EACd,KAAK,CAAC,MAAM,EAAE,EAAE,CACjB;KACF,CAAC;AACJ,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAsC,EACtC,GAAmB,EACnB,YAAoB;IAEpB,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;IAC5E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IACD,+EAA+E;IAC/E,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAkB,EAClB,OAAgB,EAChB,OAA2B,EAC3B,QAA4B;IAE5B,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,OAAO,IAAI,QAAQ,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IACD,uEAAuE;IACvE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CACjC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAChD,CACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,YAAiD;IAEjD,MAAM,QAAQ,GAAG,YAAY,EAAE,mBAAmB,CAAC;IACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,QAAiD,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CACf,YAAiD;IAEjD,MAAM,KAAK,GAAG,YAAY,EAAE,SAAS,CAAC;IACtC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC"}
|
|
@@ -8,12 +8,11 @@
|
|
|
8
8
|
*
|
|
9
9
|
* with a JSON body naming the `action` and its parameters. Per request the
|
|
10
10
|
* engine resolves identity (resolve-or-401), checks the caller surface, checks
|
|
11
|
-
* the action,
|
|
12
|
-
* server-side with the workspace
|
|
11
|
+
* the action, proves capability ownership from `runtime.identity`, validates typed
|
|
12
|
+
* constraints, performs the LangSmith operation server-side with the workspace
|
|
13
|
+
* key, and returns an allowlisted response.
|
|
13
14
|
*
|
|
14
|
-
* v0
|
|
15
|
-
* capability, matching the app being replaced), and has no rate limiting, audit,
|
|
16
|
-
* or multi-workspace fan-out.
|
|
15
|
+
* v0 has no rate limiting, audit, or multi-workspace fan-out.
|
|
17
16
|
*/
|
|
18
17
|
import type { Example, Feedback, KVMap, Prompt, Run, ScoreType, ValueType } from "langsmith/schemas";
|
|
19
18
|
import type { IdentityConfig, RuntimeIdentity } from "../identity.js";
|
|
@@ -36,6 +35,7 @@ export interface LangSmithClient {
|
|
|
36
35
|
score?: ScoreType | ValueType;
|
|
37
36
|
comment?: string;
|
|
38
37
|
feedbackId?: string;
|
|
38
|
+
metadata?: KVMap;
|
|
39
39
|
}): Promise<Feedback>;
|
|
40
40
|
updateFeedback(input: {
|
|
41
41
|
feedbackId: string;
|
|
@@ -45,6 +45,9 @@ export interface LangSmithClient {
|
|
|
45
45
|
deleteFeedback(input: {
|
|
46
46
|
feedbackId: string;
|
|
47
47
|
}): Promise<void>;
|
|
48
|
+
listFeedbackForRun(input: {
|
|
49
|
+
runId: string;
|
|
50
|
+
}): Promise<Feedback[]>;
|
|
48
51
|
readRun(input: {
|
|
49
52
|
runId: string;
|
|
50
53
|
}): Promise<Run>;
|
|
@@ -57,7 +60,12 @@ export interface LangSmithClient {
|
|
|
57
60
|
dataset: string;
|
|
58
61
|
inputs: KVMap;
|
|
59
62
|
outputs?: KVMap;
|
|
63
|
+
metadata?: KVMap;
|
|
60
64
|
}): Promise<Example>;
|
|
65
|
+
listExamples(input: {
|
|
66
|
+
dataset: string;
|
|
67
|
+
metadata?: KVMap;
|
|
68
|
+
}): Promise<Example[]>;
|
|
61
69
|
enqueueRun(input: {
|
|
62
70
|
queue: string;
|
|
63
71
|
runId: string;
|
|
@@ -98,8 +106,15 @@ export declare function validateAgainstIdentity(capabilities: LangSmithCapabilit
|
|
|
98
106
|
export declare function handleCapabilityRequest(request: Request, identity: RuntimeIdentity, deps: HandlerDeps): Promise<Response>;
|
|
99
107
|
/** Map the resolved identity + ingress mode to a caller surface. */
|
|
100
108
|
export declare function callerSurface(identity: RuntimeIdentity, identityConfig: IdentityConfig | undefined): LangSmithCallerSurface;
|
|
109
|
+
/**
|
|
110
|
+
* Prove the capability's ownership scope from `runtime.identity` before the
|
|
111
|
+
* LangSmith call.
|
|
112
|
+
*/
|
|
113
|
+
export declare function assertCapabilityScope(capability: LangSmithCapability, identity: RuntimeIdentity, body: Record<string, unknown>, client: LangSmithClient): Promise<void>;
|
|
101
114
|
/** Apply the capability's `include` allowlist, then drop any `redact` roots. */
|
|
102
115
|
export declare function shapeResponse(raw: Record<string, unknown>, capability: LangSmithCapability): Record<string, unknown>;
|
|
116
|
+
/** Read a required string from the body, accepting either camelCase or snake_case. */
|
|
117
|
+
export declare function bodyString(body: Record<string, unknown>, camel: string, snake: string): string;
|
|
103
118
|
/**
|
|
104
119
|
* Default client backed by the `langsmith` SDK {@link Client}. The underlying
|
|
105
120
|
* client is created on first use so building the engine (e.g. for an app with no
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"langsmith-connector.d.ts","sourceRoot":"","sources":["../../src/runtime/langsmith-connector.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"langsmith-connector.d.ts","sourceRoot":"","sources":["../../src/runtime/langsmith-connector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EACV,OAAO,EACP,QAAQ,EACR,KAAK,EACL,MAAM,EACN,GAAG,EACH,SAAS,EACT,SAAS,EACV,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,KAAK,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,KAAK,CAAC;KAClB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB,cAAc,CAAC,KAAK,EAAE;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,cAAc,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,kBAAkB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,aAAa,CAAC,KAAK,EAAE;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,CAAC,EAAE,KAAK,CAAC;QAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;KAClB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrB,YAAY,CAAC,KAAK,EAAE;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;KAClB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACvB,UAAU,CAAC,KAAK,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,UAAU,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D,UAAU,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,oBAAoB,CAAC,KAAK,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,KAAK,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,0EAA0E;AAC1E,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAKlB;AAED,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnD,MAAM,EAAE,eAAe,CAAC;IACxB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,WAAW,EAChB,YAAY,EAAE,mBAAmB,EAAE,EACnC,MAAM,GAAE,eAAiC,GACxC,IAAI,CAeN;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,mBAAmB,EAAE,EACnC,QAAQ,EAAE,cAAc,GAAG,SAAS,GACnC,IAAI,CA6CN;AAED,uEAAuE;AACvE,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,QAAQ,CAAC,CAuCnB;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,GAAG,SAAS,GACzC,sBAAsB,CAYxB;AAYD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,mBAAmB,EAC/B,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAkEf;AA6TD,gFAAgF;AAChF,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,UAAU,EAAE,mBAAmB,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBzB;AAgDD,sFAAsF;AACtF,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,MAAM,CAMR;AA8GD;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,eAAe,CAiE/C"}
|