managed-deepagents 0.5.3-dev.112 → 0.5.3-dev.113

package/dist/identity/github/credentials.js

@@ -1,183 +0,0 @@
-import { importPKCS8, SignJWT } from "jose";
-import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS, } from "../../runtime/http.js";
-import { getGitHubCredentialStore } from "./credentials-store.js";
-const DEFAULT_READ_CHAIN = ["installation", "pat"];
-const DEFAULT_WRITE_CHAIN = ["user"];
-const GITHUB_API_VERSION = "2022-11-28";
-const USER_AGENT = "managed-deepagents";
-/**
- * Build a custom credential resolver for GitHub connection targets.
- *
- * Use this through the GitHub namespace:
- *
- * ```ts
- * import { defineIdentity, github } from "managed-deepagents";
- *
- * export const identity = defineIdentity({
- *   credentials: credentials.github({ repositories: ["acme/*"] }),
- * });
- * ```
- *
- * User-token chains read from `resolveUserToken`, which defaults to the GitHub
- * credential store.
- */
-export function credentials(options = {}) {
-    validateGithubCredentialsOptions(options);
-    return {
-        async resolve({ identity, target }) {
-            if (target.name !== "github") {
-                throw new Error(`credentials.github(...) can only resolve target name "github" (received "${target.name}").`);
-            }
-            const repo = repoFromTarget(target) ?? defaultRepoFromPatterns(options.repositories);
-            assertRepoAllowed(repo, options.repositories);
-            const chain = target.intent === "write"
-                ? (options.write ?? DEFAULT_WRITE_CHAIN)
-                : (options.read ?? DEFAULT_READ_CHAIN);
-            for (const source of chain) {
-                const credential = await resolveSource(source, { identity, target }, options);
-                if (credential) {
-                    return credential;
-                }
-            }
-            throw new Error(`credentials.github(...) could not resolve a GitHub credential for target "${target.name}".`);
-        },
-    };
-}
-function validateGithubCredentialsOptions(options) {
-    validateChain("read", options.read);
-    validateChain("write", options.write);
-    if (options.repositories) {
-        for (const pattern of options.repositories) {
-            if (!isAllowedRepoPattern(pattern)) {
-                throw new Error(`credentials.github(...) repository allowlist entry "${pattern}" must look like "owner/repo" or "owner/*".`);
-            }
-        }
-    }
-}
-function validateChain(name, chain) {
-    if (chain === undefined)
-        return;
-    if (!Array.isArray(chain) || chain.length === 0) {
-        throw new Error(`credentials.github(...) \`${name}\` must be a non-empty token source list.`);
-    }
-    for (const source of chain) {
-        if (source !== "user" && source !== "installation" && source !== "pat") {
-            throw new Error(`credentials.github(...) unknown token source "${String(source)}".`);
-        }
-    }
-}
-async function resolveSource(source, ctx, options) {
-    if (source === "pat") {
-        const token = options.pat ?? process.env.GITHUB_TOKEN ?? process.env.GITHUB_PAT;
-        return token ? bearer(token) : undefined;
-    }
-    if (source === "user") {
-        const resolve = options.resolveUserToken ?? defaultResolveUserToken;
-        const token = await resolve({
-            identity: ctx.identity,
-            scopes: ["repo"],
-        });
-        return token ? bearer(token) : undefined;
-    }
-    return installationCredential(ctx.target, options);
-}
-async function installationCredential(target, options) {
-    const appId = options.appId ?? process.env.GITHUB_APP_ID;
-    const privateKey = options.privateKey ?? process.env.GITHUB_APP_PRIVATE_KEY;
-    const installationId = stringMetadata(target, "installationId") ?? options.installationId;
-    if (!installationId) {
-        return undefined;
-    }
-    if (!appId || !privateKey) {
-        throw new Error('credentials.github(...) token source "installation" requires `appId` and `privateKey` (or GITHUB_APP_ID / GITHUB_APP_PRIVATE_KEY).');
-    }
-    const appJwt = options.createAppJwt
-        ? await options.createAppJwt({ appId, privateKey })
-        : await createGitHubAppJwt({ appId, privateKey });
-    const fetchImpl = options.fetch ?? fetch;
-    const response = await fetchWithTimeout(`https://api.github.com/app/installations/${encodeURIComponent(installationId)}/access_tokens`, {
-        method: "POST",
-        headers: {
-            Accept: "application/vnd.github+json",
-            Authorization: `Bearer ${appJwt}`,
-            "User-Agent": USER_AGENT,
-            "X-GitHub-Api-Version": GITHUB_API_VERSION,
-        },
-    }, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
-    if (!response.ok) {
-        throw new Error(`credentials.github(...) GitHub installation token request failed with ${response.status}.`);
-    }
-    const body = (await response.json());
-    if (typeof body.token !== "string" || body.token.length === 0) {
-        throw new Error("credentials.github(...) GitHub installation token response did not include `token`.");
-    }
-    return {
-        ...bearer(body.token),
-        ...(typeof body.expires_at === "string"
-            ? { expiresAt: body.expires_at }
-            : {}),
-    };
-}
-async function createGitHubAppJwt({ appId, privateKey, }) {
-    const nowSeconds = Math.floor(Date.now() / 1000);
-    const key = await importPKCS8(privateKey, "RS256");
-    return new SignJWT({})
-        .setProtectedHeader({ alg: "RS256" })
-        .setIssuedAt(nowSeconds - 60)
-        .setExpirationTime(nowSeconds + 9 * 60)
-        .setIssuer(appId)
-        .sign(key);
-}
-/**
- * Default user-token lookup: GitHub credential store keyed by user id.
- * Returns undefined when no stored GitHub token exists for the user.
- */
-export async function defaultResolveUserToken(args) {
-    const record = await getGitHubCredentialStore().getByUserId(args.identity.user.id);
-    return record?.accessToken;
-}
-function bearer(token) {
-    return { headers: { Authorization: `Bearer ${token}` } };
-}
-function repoFromTarget(target) {
-    const repo = stringMetadata(target, "repo");
-    if (repo)
-        return repo;
-    const owner = stringMetadata(target, "owner");
-    const name = stringMetadata(target, "repository");
-    return owner && name ? `${owner}/${name}` : undefined;
-}
-function stringMetadata(target, key) {
-    const value = target.metadata?.[key];
-    return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function assertRepoAllowed(repo, patterns) {
-    if (!patterns || patterns.length === 0)
-        return;
-    if (!repo) {
-        throw new Error("credentials.github(...) target metadata must include `repo` when repositories allowlist is configured (or include an exact owner/repo entry to default).");
-    }
-    if (!patterns.some((pattern) => repoMatches(repo, pattern))) {
-        throw new Error(`credentials.github(...) repository "${repo}" is not allowed by the configured repositories allowlist.`);
-    }
-}
-/** First exact `owner/repo` pattern, used when callers omit `metadata.repo`. */
-function defaultRepoFromPatterns(patterns) {
-    if (!patterns)
-        return undefined;
-    for (const pattern of patterns) {
-        if (!pattern.endsWith("/*"))
-            return pattern;
-    }
-    return undefined;
-}
-function repoMatches(repo, pattern) {
-    if (pattern.endsWith("/*")) {
-        return repo.startsWith(`${pattern.slice(0, -2)}/`);
-    }
-    return repo === pattern;
-}
-function isAllowedRepoPattern(pattern) {
-    return /^[A-Za-z0-9_.-]+\/(?:[A-Za-z0-9_.-]+|\*)$/.test(pattern);
-}
-//# sourceMappingURL=credentials.js.map

package/dist/identity/github/credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/identity/github/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AA8ElE,MAAM,kBAAkB,GAAwB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AACxE,MAAM,mBAAmB,GAAwB,CAAC,MAAM,CAAC,CAAC;AAC1D,MAAM,kBAAkB,GAAG,YAAY,CAAC;AACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAExC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CACzB,OAAO,GAA6B,EAAE;IAEtC,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;YAChC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,4EAA4E,MAAM,CAAC,IAAI,KAAK,CAC7F,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GACR,cAAc,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1E,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,KAAK,OAAO;gBACvB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAC;gBACxC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,CAAC;YAC3C,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAG,MAAM,aAAa,CACpC,MAAM,EACN,EAAE,QAAQ,EAAE,MAAM,EAAE,EACpB,OAAO,CACR,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,UAAU,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,6EAA6E,MAAM,CAAC,IAAI,IAAI,CAC7F,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAiC;IAEjC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC3C,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,6CAA6C,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAsB,EAAE,KAAc;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,2CAA2C,CAC7E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,MAAM,CAAC,IAAI,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAyB,EACzB,GAA4B,EAC5B,OAAiC;IAEjC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACpE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,CAAC,MAAM,CAAC;SACjB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAwB,EACxB,OAAiC;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC5E,MAAM,cAAc,GAClB,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC;IACrE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,oIAAoI,CACrI,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY;QACjC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,4CAA4C,kBAAkB,CAC5D,cAAc,CACf,gBAAgB,EACjB;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,YAAY,EAAE,UAAU;YACxB,sBAAsB,EAAE,kBAAkB;SAC3C;KACF,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,yEAAyE,QAAQ,CAAC,MAAM,GAAG,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACrB,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,EAChC,KAAK,EACL,UAAU,GACO;IACjB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,CAAC,UAAU,GAAG,EAAE,CAAC;SAC5B,iBAAiB,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,CAAC;SACtC,SAAS,CAAC,KAAK,CAAC;SAChB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC,WAAW,CACzD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CACtB,CAAC;IACF,OAAO,MAAM,EAAE,WAAW,CAAC;AAC7B,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,MAAwB;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CACrB,MAAwB,EACxB,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAwB,EACxB,QAA8B;IAE9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,0JAA0J,CAC3J,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,4DAA4D,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,uBAAuB,CAC9B,QAA8B;IAE9B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,CAAC;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC"}

package/dist/identity/github/index.d.ts

@@ -1,5 +0,0 @@
-/**
- * GitHub identity helpers — credentials resolver.
- */
-export { credentials, type GitHubUserTokenArgs, type GitHubAppJwtArgs, type GitHubCredentialsOptions, type GitHubTokenSource, } from "./credentials.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/identity/github/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/github/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}

package/dist/identity/github/index.js

@@ -1,5 +0,0 @@
-/**
- * GitHub identity helpers — credentials resolver.
- */
-export { credentials, } from "./credentials.js";
-//# sourceMappingURL=index.js.map

package/dist/identity/github/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/github/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,GAKZ,MAAM,kBAAkB,CAAC"}

package/dist/runtime/credentials.d.ts

@@ -1,68 +0,0 @@
-import type { CredentialTarget, IdentityConfig, ResolvedCredential, RuntimeIdentity } from "../identity/index.js";
-/**
- * Component 5 — Credentials, custom mode.
- *
- * The escape hatch Agent Auth can't cover: bespoke per-caller credential minting
- * via an in-process resolver callback or a hosted token-exchange endpoint. It
- * runs in the worker (not the shared ingress auth handler), applies the output
- * to downstream calls, and caches per `(user, target)` until the credential's
- * `expiresAt`. Secrets live only in this in-memory cache keyed by identity —
- * never in thread state or traces.
- *
- * Managed credential modes (`"user"` / `"agent"`) select downstream credential
- * ownership on the identity axis; only `custom` builds a
- * {@link CredentialsProvider} here.
- */
-/** Env var holding the HMAC secret MDA signs the endpoint assertion with. */
-export declare const CREDENTIAL_SIGNING_SECRET_ENV = "MDA_TOKEN_EXCHANGE_SECRET";
-/** Per-call options for {@link CredentialsProvider.for}. */
-export interface CredentialForOptions {
-    /** Skip the cache and force a fresh mint (e.g. after a downstream 401). */
-    forceRefresh?: boolean;
-}
-/**
- * The per-run credential surface a tool receives as `runtime.credentials`.
- * Tools call `runtime.credentials.for(target)` and attach the returned headers
- * to their downstream request.
- */
-export interface CredentialsProvider {
-    for(target: CredentialTarget, options?: CredentialForOptions): Promise<ResolvedCredential>;
-}
-/**
- * Side effects the executor depends on, injectable so resolution is
- * deterministic under test (no real clock, network, or signing key).
- */
-export interface CredentialDeps {
-    fetch: typeof fetch;
-    now: () => number;
-    /** Signs the assertion MDA presents to a hosted token-exchange endpoint. */
-    signAssertion: (identity: RuntimeIdentity, target: CredentialTarget) => Promise<string>;
-}
-/** Default TTL when a resolver omits `expiresAt` (15 minutes). */
-export declare const DEFAULT_CREDENTIAL_TTL_MS: number;
-/** Soft cap on cached credentials per process. */
-export declare const MAX_CREDENTIAL_CACHE_ENTRIES = 1024;
-/**
- * TTL cache for resolved credentials, keyed by `(user, target)` so
- * per-repo/per-install tokens never collide. Kept out of thread state. Entries
- * expire at the credential's `expiresAt`, or after a default TTL when omitted.
- * The cache is soft-capped to bound memory in long-lived workers.
- */
-export declare class CredentialCache {
-    private readonly defaultTtlMs;
-    private readonly maxEntries;
-    private readonly entries;
-    constructor(defaultTtlMs?: number, maxEntries?: number);
-    get(key: string, nowMs: number): ResolvedCredential | undefined;
-    set(key: string, value: ResolvedCredential, nowMs?: number): void;
-    clear(): void;
-}
-/** Clear the process-level credential cache. Test-only. */
-export declare function clearCredentialCacheForTests(): void;
-/**
- * Build the `runtime.credentials` provider for a run, or `undefined` when the
- * deployment isn't in custom-credentials mode. The provider is bound to the
- * run's resolved identity; every `for(target)` call is scoped to that actor.
- */
-export declare function createCredentialsProvider(cfg: IdentityConfig, identity: RuntimeIdentity | undefined, deps?: Partial<CredentialDeps>, cache?: CredentialCache): CredentialsProvider | undefined;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/runtime/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGV,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAKzE,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CACD,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,4EAA4E;IAC5E,aAAa,EAAE,CACb,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,gBAAgB,KACrB,OAAO,CAAC,MAAM,CAAC,CAAC;CACtB;AAQD,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AACxD,kDAAkD;AAClD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD;;;;;GAKG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YACmB,YAAY,GAAE,MAAkC,EAChD,UAAU,GAAE,MAAqC,EAChE;IAEJ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAU9D;IAED,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,kBAAkB,EACzB,KAAK,GAAE,MAAmB,GACzB,IAAI,CAkBN;IAED,KAAK,IAAI,IAAI,CAEZ;CACF;AAKD,2DAA2D;AAC3D,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,IAAI,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAC9B,KAAK,GAAE,eAA8B,GACpC,mBAAmB,GAAG,SAAS,CA8BjC"}

package/dist/runtime/credentials.js

@@ -1,235 +0,0 @@
-import { SignJWT } from "jose";
-import { credentialTargetNames, isSingleCredentialResolver, } from "../identity/index.js";
-import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "./http.js";
-/**
- * Component 5 — Credentials, custom mode.
- *
- * The escape hatch Agent Auth can't cover: bespoke per-caller credential minting
- * via an in-process resolver callback or a hosted token-exchange endpoint. It
- * runs in the worker (not the shared ingress auth handler), applies the output
- * to downstream calls, and caches per `(user, target)` until the credential's
- * `expiresAt`. Secrets live only in this in-memory cache keyed by identity —
- * never in thread state or traces.
- *
- * Managed credential modes (`"user"` / `"agent"`) select downstream credential
- * ownership on the identity axis; only `custom` builds a
- * {@link CredentialsProvider} here.
- */
-/** Env var holding the HMAC secret MDA signs the endpoint assertion with. */
-export const CREDENTIAL_SIGNING_SECRET_ENV = "MDA_TOKEN_EXCHANGE_SECRET";
-/** How long a signed endpoint assertion is valid, in seconds. */
-const ASSERTION_TTL_SECONDS = 60;
-/** Default TTL when a resolver omits `expiresAt` (15 minutes). */
-export const DEFAULT_CREDENTIAL_TTL_MS = 15 * 60 * 1000;
-/** Soft cap on cached credentials per process. */
-export const MAX_CREDENTIAL_CACHE_ENTRIES = 1024;
-/**
- * TTL cache for resolved credentials, keyed by `(user, target)` so
- * per-repo/per-install tokens never collide. Kept out of thread state. Entries
- * expire at the credential's `expiresAt`, or after a default TTL when omitted.
- * The cache is soft-capped to bound memory in long-lived workers.
- */
-export class CredentialCache {
-    defaultTtlMs;
-    maxEntries;
-    entries = new Map();
-    constructor(defaultTtlMs = DEFAULT_CREDENTIAL_TTL_MS, maxEntries = MAX_CREDENTIAL_CACHE_ENTRIES) {
-        this.defaultTtlMs = defaultTtlMs;
-        this.maxEntries = maxEntries;
-    }
-    get(key, nowMs) {
-        const hit = this.entries.get(key);
-        if (!hit) {
-            return undefined;
-        }
-        if (nowMs >= hit.expiresAtMs) {
-            this.entries.delete(key);
-            return undefined;
-        }
-        return hit.value;
-    }
-    set(key, value, nowMs = Date.now()) {
-        let expiresAtMs;
-        if (value.expiresAt) {
-            const parsed = Date.parse(value.expiresAt);
-            expiresAtMs = Number.isNaN(parsed) ? nowMs + this.defaultTtlMs : parsed;
-        }
-        else {
-            expiresAtMs = nowMs + this.defaultTtlMs;
-        }
-        if (!this.entries.has(key)) {
-            while (this.entries.size >= this.maxEntries) {
-                const oldest = this.entries.keys().next().value;
-                if (oldest === undefined) {
-                    break;
-                }
-                this.entries.delete(oldest);
-            }
-        }
-        this.entries.set(key, { value, expiresAtMs });
-    }
-    clear() {
-        this.entries.clear();
-    }
-}
-/** Process-level cache shared across runs for the lifetime of the deployment. */
-const defaultCache = new CredentialCache();
-/** Clear the process-level credential cache. Test-only. */
-export function clearCredentialCacheForTests() {
-    defaultCache.clear();
-}
-/**
- * Build the `runtime.credentials` provider for a run, or `undefined` when the
- * deployment isn't in custom-credentials mode. The provider is bound to the
- * run's resolved identity; every `for(target)` call is scoped to that actor.
- */
-export function createCredentialsProvider(cfg, identity, deps, cache = defaultCache) {
-    if (cfg.scope.credentials !== "custom" || !cfg.credentials) {
-        return undefined;
-    }
-    const resolved = {
-        fetch: deps?.fetch ?? fetch,
-        now: deps?.now ?? (() => Date.now()),
-        signAssertion: deps?.signAssertion ?? defaultSignAssertion,
-    };
-    return {
-        async for(target, options) {
-            if (!identity) {
-                throw new Error("runtime.credentials.for(...) requires a resolved identity, but none " +
-                    "was available for this run.");
-            }
-            const key = cacheKey(identity, target);
-            if (!options?.forceRefresh) {
-                const hit = cache.get(key, resolved.now());
-                if (hit) {
-                    return hit;
-                }
-            }
-            // Fail-closed: a resolver/endpoint error propagates and nothing is cached.
-            const out = await resolveCredential(cfg, identity, target, resolved);
-            cache.set(key, out);
-            return out;
-        },
-    };
-}
-async function resolveCredential(cfg, identity, target, deps) {
-    const creds = cfg.credentials;
-    if (!creds) {
-        throw new Error("No credentials resolver is configured for this deployment.");
-    }
-    return resolveOne(selectResolver(creds, target), identity, target, deps, creds);
-}
-/**
- * Pick the resolver for this target: the single one, or the map entry whose key
- * matches `target.name`.
- */
-function selectResolver(creds, target) {
-    if (isSingleCredentialResolver(creds)) {
-        return creds;
-    }
-    const entry = Object.hasOwn(creds, target.name)
-        ? creds[target.name]
-        : undefined;
-    if (!entry) {
-        const configured = credentialTargetNames(creds).join(", ");
-        throw new Error(`runtime.credentials.for(...) has no resolver for target "${target.name}". ` +
-            `Configured targets: ${configured}.`);
-    }
-    return entry;
-}
-async function resolveOne(config, identity, target, deps, creds) {
-    const label = isSingleCredentialResolver(creds)
-        ? "resolver"
-        : `resolver for "${target.name}"`;
-    if ("resolve" in config) {
-        return normalizeResolved(await config.resolve({ identity, target }), label);
-    }
-    const assertion = await deps.signAssertion(identity, target);
-    return callTokenExchange(config.endpoint.url, assertion, deps);
-}
-async function callTokenExchange(url, assertion, deps) {
-    const response = await fetchWithTimeout(url, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            authorization: `Bearer ${assertion}`,
-        },
-        body: JSON.stringify({ assertion }),
-    }, PROVIDER_HTTP_TIMEOUT_MS, deps.fetch);
-    if (!response.ok) {
-        throw new Error(`Credential token-exchange endpoint ${url} responded ${response.status}.`);
-    }
-    return normalizeResolved(await response.json(), `endpoint ${url}`);
-}
-async function defaultSignAssertion(identity, target) {
-    const secret = process.env[CREDENTIAL_SIGNING_SECRET_ENV];
-    if (!secret) {
-        throw new Error(`A hosted credential endpoint requires a signing secret. Set ` +
-            `${CREDENTIAL_SIGNING_SECRET_ENV} in the deployment environment.`);
-    }
-    const issuedAt = Math.floor(Date.now() / 1000);
-    return new SignJWT({
-        user_id: identity.user.id,
-        user_kind: identity.user.kind,
-        target: { kind: target.kind, name: target.name, intent: target.intent },
-    })
-        .setProtectedHeader({ alg: "HS256" })
-        .setSubject(identity.user.id)
-        .setIssuedAt(issuedAt)
-        .setExpirationTime(issuedAt + ASSERTION_TTL_SECONDS)
-        .sign(new TextEncoder().encode(secret));
-}
-/**
- * The cache key that discriminates a minted credential: the user it belongs to,
- * plus the target's kind/name/intent/thread and metadata.
- */
-function cacheKey(identity, target) {
-    return stableStringify([
-        identity.user.id,
-        target.kind,
-        target.name,
-        target.intent ?? null,
-        target.threadId ?? null,
-        target.metadata ?? null,
-    ]);
-}
-/** Deterministic JSON with object keys sorted, so the cache key is stable. */
-function stableStringify(value) {
-    if (value === null || typeof value !== "object") {
-        return JSON.stringify(value) ?? "null";
-    }
-    if (Array.isArray(value)) {
-        return `[${value.map(stableStringify).join(",")}]`;
-    }
-    const obj = value;
-    return `{${Object.keys(obj)
-        .sort()
-        .map((key) => `${JSON.stringify(key)}:${stableStringify(obj[key])}`)
-        .join(",")}}`;
-}
-/** Validate a resolver/endpoint result into a {@link ResolvedCredential}. */
-function normalizeResolved(value, sourceLabel) {
-    if (!value || typeof value !== "object") {
-        throw new Error(`Credential ${sourceLabel} returned a non-object result.`);
-    }
-    const { headers, expiresAt } = value;
-    if (!headers || typeof headers !== "object" || Array.isArray(headers)) {
-        throw new Error(`Credential ${sourceLabel} result is missing a headers object.`);
-    }
-    const normalizedHeaders = {};
-    for (const [name, headerValue] of Object.entries(headers)) {
-        if (typeof headerValue !== "string") {
-            throw new Error(`Credential ${sourceLabel} header "${name}" must be a string.`);
-        }
-        normalizedHeaders[name] = headerValue;
-    }
-    const result = { headers: normalizedHeaders };
-    if (expiresAt !== undefined) {
-        if (typeof expiresAt !== "string") {
-            throw new Error(`Credential ${sourceLabel} \`expiresAt\` must be an ISO string.`);
-        }
-        result.expiresAt = expiresAt;
-    }
-    return result;
-}
-//# sourceMappingURL=credentials.js.map

package/dist/runtime/credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAS9B,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAwCjC,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,kDAAkD;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAIP,YAAY;IACZ,UAAU;IAJZ,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEzD,YACmB,YAAY,GAAW,yBAAyB,EAChD,UAAU,GAAW,4BAA4B;4BADjD,YAAY;0BACZ,UAAU;IAC1B,CAAC;IAEJ,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CACD,GAAW,EACX,KAAyB,EACzB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;QAE1B,IAAI,WAAmB,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,UAAU,4BAA4B;IAC1C,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAmB,EACnB,QAAqC,EACrC,IAA8B,EAC9B,KAAK,GAAoB,YAAY;IAErC,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAmB;QAC/B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;QAC3B,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,oBAAoB;KAC3D,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;YACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sEAAsE;oBACpE,6BAA6B,CAChC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC3C,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;YACD,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAmB,EACnB,QAAyB,EACzB,MAAwB,EACxB,IAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CACf,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,EAC7B,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,KAAqD,EACrD,MAAwB;IAExB,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,IAAI,KAAK;YAC1E,uBAAuB,UAAU,GAAG,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAgC,EAChC,QAAyB,EACzB,MAAwB,EACxB,IAAoB,EACpB,KAAqD;IAErD,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,iBAAiB,MAAM,CAAC,IAAI,GAAG,CAAC;IACpC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,OAAO,iBAAiB,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,SAAiB,EACjB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,SAAS,EAAE;SACrC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;KACpC,EACD,wBAAwB,EACxB,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,cAAc,QAAQ,CAAC,MAAM,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAyB,EACzB,MAAwB;IAExB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,GAAG,6BAA6B,iCAAiC,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QACjB,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;QACzB,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KACxE,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,QAAQ,GAAG,qBAAqB,CAAC;SACnD,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAyB,EAAE,MAAwB;IACnE,OAAO,eAAe,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE;QAChB,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,MAAM,CAAC,QAAQ,IAAI,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CACxB,KAAc,EACd,WAAmB;IAEnB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,cAAc,WAAW,gCAAgC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAG9B,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,sCAAsC,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAA2B,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,YAAY,IAAI,qBAAqB,CAC/D,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAuB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,uCAAuC,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}