@agent-native/core 0.103.1 → 0.104.0

package/dist/server/workspace-provider-oauth.js

@@ -0,0 +1,415 @@
+import crypto from "node:crypto";
+import { deleteCookie, defineEventHandler, getCookie, getMethod, getQuery, setCookie, setResponseStatus, } from "h3";
+import { getWorkspaceConnectionProvider, } from "../connections/catalog.js";
+import { saveOAuthTokens, setOAuthDisplayName } from "../oauth-tokens/store.js";
+import { decryptSecretValue, encryptSecretValue } from "../secrets/crypto.js";
+import { listWorkspaceConnections, upsertWorkspaceConnection, upsertWorkspaceConnectionGrant, } from "../workspace-connections/store.js";
+import { getSession, safeReturnPath } from "./auth.js";
+import { resolveSecret } from "./credential-provider.js";
+import { decodeOAuthState, encodeOAuthState, getAppUrl, resolveOAuthRedirectUri, } from "./google-oauth.js";
+import { runWithRequestContext } from "./request-context.js";
+const SUPPORTED_PROVIDERS = new Set([
+    "figma",
+    "google_drive",
+    "notion",
+]);
+const FLOW_TTL_SECONDS = 10 * 60;
+const PROVIDER_REQUEST_TIMEOUT_MS = 10_000;
+const PROVIDER_RESPONSE_MAX_BYTES = 256 * 1024;
+export function workspaceProviderOAuthPath(provider, phase) {
+    return `/_agent-native/connections/oauth/${provider}/${phase}`;
+}
+export function createWorkspaceProviderOAuthHandler(provider, phase) {
+    if (!SUPPORTED_PROVIDERS.has(provider)) {
+        throw new Error(`Unsupported workspace OAuth provider: ${provider}`);
+    }
+    return defineEventHandler((event) => phase === "start"
+        ? handleWorkspaceProviderOAuthStart(event, provider)
+        : handleWorkspaceProviderOAuthCallback(event, provider));
+}
+export async function handleWorkspaceProviderOAuthStart(event, providerId) {
+    if (getMethod(event) !== "GET")
+        return methodNotAllowed(event);
+    const session = await getSession(event).catch(() => null);
+    if (!session?.email)
+        return unauthorized(event);
+    const provider = requiredProvider(providerId);
+    const query = getQuery(event);
+    const appId = normalizeAppId(text(query.appId) ??
+        process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??
+        process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID ??
+        "creative-context");
+    const redirectUri = resolveOAuthRedirectUri(event, workspaceProviderOAuthPath(providerId, "callback"));
+    if (!redirectUri) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid OAuth redirect URI." };
+    }
+    return runWithRequestContext({ userEmail: session.email, orgId: session.orgId }, async () => {
+        const [clientId, clientSecret] = await Promise.all([
+            resolveSecret(clientCredentialKey(providerId, "id")),
+            resolveSecret(clientCredentialKey(providerId, "secret")),
+        ]);
+        if (!clientId || !clientSecret) {
+            setResponseStatus(event, 503);
+            return {
+                error: `${provider.label} OAuth client credentials are not configured.`,
+            };
+        }
+        const verifier = crypto.randomBytes(48).toString("base64url");
+        const challenge = crypto
+            .createHash("sha256")
+            .update(verifier)
+            .digest("base64url");
+        const flowId = crypto.randomUUID();
+        const requestedReturnUrl = text(query.return);
+        const returnUrl = requestedReturnUrl
+            ? safeReturnPath(requestedReturnUrl)
+            : undefined;
+        const state = encodeOAuthState({
+            redirectUri,
+            owner: session.email,
+            orgId: session.orgId,
+            app: appId,
+            returnUrl,
+            flowId,
+        });
+        const flow = {
+            provider: providerId,
+            flowId,
+            verifier,
+            redirectUri,
+            owner: session.email,
+            ...(session.orgId ? { orgId: session.orgId } : {}),
+            appId,
+            expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
+        };
+        setCookie(event, flowCookieName(providerId), encryptSecretValue(JSON.stringify(flow)), {
+            httpOnly: true,
+            secure: redirectUri.startsWith("https://"),
+            sameSite: "lax",
+            path: "/",
+            maxAge: FLOW_TTL_SECONDS,
+        });
+        const authorizationUrl = buildWorkspaceProviderAuthorizationUrl({
+            provider,
+            clientId,
+            redirectUri,
+            state,
+            challenge,
+        });
+        return Response.redirect(authorizationUrl, 302);
+    });
+}
+export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
+    if (getMethod(event) !== "GET")
+        return methodNotAllowed(event);
+    const session = await getSession(event).catch(() => null);
+    if (!session?.email)
+        return unauthorized(event);
+    const query = getQuery(event);
+    const code = text(query.code);
+    const stateParam = text(query.state);
+    const providerError = text(query.error);
+    if (providerError) {
+        setResponseStatus(event, 400);
+        return { error: "OAuth authorization was not completed." };
+    }
+    if (!code || !stateParam) {
+        setResponseStatus(event, 400);
+        return { error: "OAuth callback is missing code or state." };
+    }
+    const flow = readStoredFlow(event, providerId);
+    deleteCookie(event, flowCookieName(providerId), { path: "/" });
+    const state = decodeOAuthState(stateParam, "");
+    if (!flow ||
+        !isWorkspaceProviderOAuthFlowValid({
+            flow,
+            state,
+            provider: providerId,
+            sessionEmail: session.email,
+            sessionOrgId: session.orgId,
+        })) {
+        setResponseStatus(event, 400);
+        return { error: "OAuth state is invalid or expired." };
+    }
+    const provider = requiredProvider(providerId);
+    return runWithRequestContext({ userEmail: session.email, orgId: session.orgId }, async () => {
+        const [clientId, clientSecret] = await Promise.all([
+            resolveSecret(clientCredentialKey(providerId, "id")),
+            resolveSecret(clientCredentialKey(providerId, "secret")),
+        ]);
+        if (!clientId || !clientSecret) {
+            setResponseStatus(event, 503);
+            return {
+                error: `${provider.label} OAuth client credentials are not configured.`,
+            };
+        }
+        const tokens = await exchangeWorkspaceProviderOAuthCode({
+            providerId,
+            provider,
+            clientId,
+            clientSecret,
+            code,
+            verifier: flow.verifier,
+            redirectUri: flow.redirectUri,
+        });
+        const identity = await resolveWorkspaceProviderIdentity(providerId, tokens);
+        await saveOAuthTokens(provider.oauth.provider, identity.accountId, tokens, session.email);
+        await setOAuthDisplayName(provider.oauth.provider, identity.accountId, identity.label);
+        const existing = (await listWorkspaceConnections({
+            provider: providerId,
+            includeDisabled: true,
+        })).find((connection) => connection.accountId === identity.accountId);
+        const scopes = mergeWorkspaceOAuthValues(existing?.scopes ?? [], tokenScopes(tokens, provider.oauth.scopes));
+        const connection = await upsertWorkspaceConnection({
+            ...(existing ? { id: existing.id } : {}),
+            provider: providerId,
+            label: `${provider.label}: ${identity.label}`,
+            accountId: identity.accountId,
+            accountLabel: identity.label,
+            status: "connected",
+            scopes,
+            allowedApps: existing?.allowedApps ?? [],
+            config: { credentialMode: "oauth" },
+            lastCheckedAt: new Date(),
+            lastError: null,
+        });
+        await upsertWorkspaceConnectionGrant({
+            connectionId: connection.id,
+            appId: flow.appId,
+            provider: providerId,
+            scopes,
+            config: { credentialMode: "oauth" },
+        });
+        const returnPath = state.returnUrl ??
+            `/settings/connections?connected=${encodeURIComponent(providerId)}`;
+        return Response.redirect(getAppUrl(event, returnPath), 302);
+    });
+}
+export function buildWorkspaceProviderAuthorizationUrl(input) {
+    if (!input.provider.oauth)
+        throw new Error("Provider does not support OAuth.");
+    const url = new URL(input.provider.oauth.authorizationUrl);
+    url.searchParams.set("client_id", input.clientId);
+    url.searchParams.set("redirect_uri", input.redirectUri);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("state", input.state);
+    if (input.provider.id === "figma") {
+        url.searchParams.set("code_challenge", input.challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+    }
+    if (input.provider.id === "google_drive") {
+        url.searchParams.set("access_type", "offline");
+        url.searchParams.set("include_granted_scopes", "true");
+        url.searchParams.set("prompt", "consent");
+    }
+    if (input.provider.oauth.scopes.length) {
+        url.searchParams.set("scope", input.provider.oauth.scopes.join(" "));
+    }
+    if (input.provider.id === "notion")
+        url.searchParams.set("owner", "user");
+    return url.href;
+}
+export async function exchangeWorkspaceProviderOAuthCode(input) {
+    const tokenUrl = input.provider.oauth?.tokenUrl;
+    if (!tokenUrl)
+        throw new Error("Provider does not support OAuth.");
+    const authorization = `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString("base64")}`;
+    const fields = {
+        grant_type: "authorization_code",
+        code: input.code,
+        redirect_uri: input.redirectUri,
+        ...(input.providerId === "figma" ? { code_verifier: input.verifier } : {}),
+        ...(input.providerId === "google_drive"
+            ? { client_id: input.clientId, client_secret: input.clientSecret }
+            : {}),
+    };
+    const { response, body } = await fetchBoundedProviderJson(tokenUrl, {
+        method: "POST",
+        headers: input.providerId === "notion"
+            ? {
+                Authorization: authorization,
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            }
+            : input.providerId === "figma"
+                ? {
+                    Authorization: authorization,
+                    "Content-Type": "application/x-www-form-urlencoded",
+                }
+                : { "Content-Type": "application/x-www-form-urlencoded" },
+        body: input.providerId === "notion"
+            ? JSON.stringify(fields)
+            : new URLSearchParams(fields),
+    }, input.provider.label);
+    const accessToken = text(body.access_token);
+    if (!response.ok || !accessToken) {
+        throw new Error(`${input.provider.label} OAuth token exchange failed (${response.status}).`);
+    }
+    const expiresIn = Number(body.expires_in);
+    return {
+        ...body,
+        ...(Number.isFinite(expiresIn) && expiresIn > 0
+            ? { expiry_date: Date.now() + expiresIn * 1_000 }
+            : {}),
+    };
+}
+export async function resolveWorkspaceProviderIdentity(providerId, tokens) {
+    if (providerId === "notion") {
+        const owner = record(tokens.owner);
+        const user = record(owner?.user);
+        const person = record(user?.person);
+        const accountId = text(user?.id) ??
+            text(person?.email) ??
+            text(tokens.workspace_id) ??
+            text(tokens.bot_id);
+        if (!accountId)
+            throw new Error("Notion OAuth response did not identify the connected user.");
+        return {
+            accountId,
+            label: text(person?.email) ??
+                text(tokens.workspace_name) ??
+                "Notion workspace",
+        };
+    }
+    if (providerId === "google_drive") {
+        const accessToken = text(tokens.access_token);
+        const { response, body } = await fetchBoundedProviderJson("https://www.googleapis.com/drive/v3/about?fields=user(displayName,emailAddress,permissionId)", { headers: { Authorization: `Bearer ${accessToken}` } }, "Google Drive");
+        const user = record(body.user);
+        const accountId = text(user?.permissionId) ?? text(user?.emailAddress);
+        if (!response.ok || !accountId) {
+            throw new Error("Google Drive OAuth response did not identify the connected account.");
+        }
+        return {
+            accountId,
+            label: text(user?.emailAddress) ??
+                text(user?.displayName) ??
+                "Google Drive account",
+        };
+    }
+    const accessToken = text(tokens.access_token);
+    const { response, body: me } = await fetchBoundedProviderJson("https://api.figma.com/v1/me", { headers: { Authorization: `Bearer ${accessToken}` } }, "Figma");
+    const accountId = text(me.id) ?? text(me.email) ?? text(tokens.user_id);
+    if (!response.ok || !accountId) {
+        throw new Error("Figma OAuth response did not identify the connected user.");
+    }
+    return {
+        accountId,
+        label: text(me.email) ?? text(me.handle) ?? "Figma account",
+    };
+}
+function requiredProvider(providerId) {
+    const provider = getWorkspaceConnectionProvider(providerId);
+    if (!provider?.oauth)
+        throw new Error(`${providerId} OAuth is not configured.`);
+    return provider;
+}
+function readStoredFlow(event, provider) {
+    const encrypted = getCookie(event, flowCookieName(provider));
+    if (!encrypted)
+        return null;
+    try {
+        return JSON.parse(decryptSecretValue(encrypted));
+    }
+    catch {
+        return null;
+    }
+}
+export function isWorkspaceProviderOAuthFlowValid(input) {
+    return (input.flow.expiresAt >= (input.now ?? Date.now()) &&
+        input.flow.provider === input.provider &&
+        input.state.flowId === input.flow.flowId &&
+        input.state.redirectUri === input.flow.redirectUri &&
+        input.state.owner === input.flow.owner &&
+        input.sessionEmail === input.flow.owner &&
+        input.state.orgId === input.flow.orgId &&
+        input.sessionOrgId === input.flow.orgId &&
+        input.state.app === input.flow.appId);
+}
+async function fetchBoundedProviderJson(url, init, providerLabel) {
+    let response;
+    try {
+        response = await fetch(url, {
+            ...init,
+            signal: AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch {
+        throw new Error(`${providerLabel} OAuth request failed.`);
+    }
+    const declaredLength = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declaredLength) &&
+        declaredLength > PROVIDER_RESPONSE_MAX_BYTES) {
+        throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);
+    }
+    if (!response.body)
+        return { response, body: {} };
+    const reader = response.body.getReader();
+    const chunks = [];
+    let length = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            length += chunk.value.byteLength;
+            if (length > PROVIDER_RESPONSE_MAX_BYTES) {
+                await reader.cancel();
+                break;
+            }
+            chunks.push(chunk.value);
+        }
+    }
+    catch {
+        throw new Error(`${providerLabel} OAuth request failed.`);
+    }
+    if (length > PROVIDER_RESPONSE_MAX_BYTES) {
+        throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);
+    }
+    try {
+        const json = Buffer.concat(chunks).toString("utf8");
+        const body = JSON.parse(json);
+        return { response, body: record(body) ?? {} };
+    }
+    catch {
+        return { response, body: {} };
+    }
+}
+function tokenScopes(tokens, fallback) {
+    const scope = text(tokens.scope);
+    return scope ? scope.split(/[ ,]+/).filter(Boolean) : [...fallback];
+}
+export function mergeWorkspaceOAuthValues(existing, incoming) {
+    return [...new Set([...existing, ...incoming])];
+}
+function clientCredentialKey(provider, field) {
+    const prefix = provider === "google_drive" ? "GOOGLE" : provider.toUpperCase();
+    return `${prefix}_CLIENT_${field === "id" ? "ID" : "SECRET"}`;
+}
+function flowCookieName(provider) {
+    return `an_workspace_oauth_${provider}`;
+}
+function normalizeAppId(value) {
+    const normalized = value.trim().toLowerCase();
+    if (!/^[a-z0-9][a-z0-9_-]{0,99}$/.test(normalized)) {
+        throw new Error("OAuth appId is invalid.");
+    }
+    return normalized;
+}
+function text(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function methodNotAllowed(event) {
+    setResponseStatus(event, 405);
+    return { error: "Method not allowed" };
+}
+function unauthorized(event) {
+    setResponseStatus(event, 401);
+    return { error: "Authentication required" };
+}
+//# sourceMappingURL=workspace-provider-oauth.js.map

package/dist/server/workspace-provider-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-provider-oauth.js","sourceRoot":"","sources":["../../src/server/workspace-provider-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EACL,8BAA8B,GAE/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAI7D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAgC;IACjE,OAAO;IACP,cAAc;IACd,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC;AACjC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,CAAC;AAa/C,MAAM,UAAU,0BAA0B,CACxC,QAAuC,EACvC,KAA2B;IAE3B,OAAO,oCAAoC,QAAQ,IAAI,KAAK,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,QAAuC,EACvC,KAA2B;IAE3B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,KAAK,KAAK,OAAO;QACf,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,QAAQ,CAAC;QACpD,CAAC,CAAC,oCAAoC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAc,EACd,UAAyC;IAEzC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,CAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,6BAA6B;QACzC,OAAO,CAAC,GAAG,CAAC,kCAAkC;QAC9C,kBAAkB,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,uBAAuB,CACzC,KAAK,EACL,0BAA0B,CAAC,UAAU,EAAE,UAAU,CAAC,CACnD,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAClD,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,aAAa,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACpD,aAAa,CAAC,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,+CAA+C;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,WAAW,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,kBAAkB;YAClC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,KAAK;YACV,SAAS;YACT,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,GAA+B;YACvC,QAAQ,EAAE,UAAU;YACpB,MAAM;YACN,QAAQ;YACR,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,KAAK;SACjD,CAAC;QACF,SAAS,CACP,KAAK,EACL,cAAc,CAAC,UAAU,CAAC,EAC1B,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EACxC;YACE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;YAC1C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,gBAAgB;SACzB,CACF,CAAC;QACF,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;YAC9D,QAAQ;YACR,QAAQ;YACR,WAAW;YACX,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAc,EACd,UAAyC;IAEzC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,aAAa,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/C,IACE,CAAC,IAAI;QACL,CAAC,iCAAiC,CAAC;YACjC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,OAAO,CAAC,KAAK;YAC3B,YAAY,EAAE,OAAO,CAAC,KAAK;SAC5B,CAAC,EACF,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAClD,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,aAAa,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACpD,aAAa,CAAC,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,+CAA+C;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC;YACtD,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CACrD,UAAU,EACV,MAAM,CACP,CAAC;QACF,MAAM,eAAe,CACnB,QAAQ,CAAC,KAAM,CAAC,QAAQ,EACxB,QAAQ,CAAC,SAAS,EAClB,MAAM,EACN,OAAO,CAAC,KAAK,CACd,CAAC;QACF,MAAM,mBAAmB,CACvB,QAAQ,CAAC,KAAM,CAAC,QAAQ,EACxB,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,KAAK,CACf,CAAC;QACF,MAAM,QAAQ,GAAG,CACf,MAAM,wBAAwB,CAAC;YAC7B,QAAQ,EAAE,UAAU;YACpB,eAAe,EAAE,IAAI;SACtB,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,yBAAyB,CACtC,QAAQ,EAAE,MAAM,IAAI,EAAE,EACtB,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAM,CAAC,MAAM,CAAC,CAC5C,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC;YACjD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE;YAC7C,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,QAAQ,CAAC,KAAK;YAC5B,MAAM,EAAE,WAAW;YACnB,MAAM;YACN,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,EAAE;YACxC,MAAM,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE;YACnC,aAAa,EAAE,IAAI,IAAI,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,8BAA8B,CAAC;YACnC,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,UAAU;YACpB,MAAM;YACN,MAAM,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE;SACpC,CAAC,CAAC;QACH,MAAM,UAAU,GACd,KAAK,CAAC,SAAS;YACf,mCAAmC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;QACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3G,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,cAAc;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EACL,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC3B,CAAC,CAAC;gBACE,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACH,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO;gBAC5B,CAAC,CAAC;oBACE,aAAa,EAAE,aAAa;oBAC5B,cAAc,EAAE,mCAAmC;iBACpD;gBACH,CAAC,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC/D,IAAI,EACF,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC;KAClC,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,UAAyC,EACzC,MAA+B;IAE/B,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,OAAO;YACL,SAAS;YACT,KAAK,EACH,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC3B,kBAAkB;SACrB,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,8FAA8F,EAC9F,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EACvD,cAAc,CACf,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EACH,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;gBACxB,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;gBACvB,sBAAsB;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,wBAAwB,CAC3D,6BAA6B,EAC7B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EACvD,OAAO,CACR,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAyC;IAEzC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,KAAK;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,2BAA2B,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,QAAuC;IAEvC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CACf,kBAAkB,CAAC,SAAS,CAAC,CACA,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAOjD;IACC,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACtC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;QACxC,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW;QAClD,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACtC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACvC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACtC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACvC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,GAAW,EACX,IAAiB,EACjB,aAAqB;IAErB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,GAAG,IAAI;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,2BAA2B,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IACE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC/B,cAAc,GAAG,2BAA2B,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YACtB,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,IAAI,MAAM,GAAG,2BAA2B,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,GAAG,2BAA2B,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,MAA+B,EAC/B,QAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAA2B,EAC3B,QAA2B;IAE3B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAuC,EACvC,KAAsB;IAEtB,MAAM,MAAM,GACV,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClE,OAAO,GAAG,MAAM,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,QAAuC;IAC7D,OAAO,sBAAsB,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport {\n  deleteCookie,\n  defineEventHandler,\n  getCookie,\n  getMethod,\n  getQuery,\n  setCookie,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport {\n  getWorkspaceConnectionProvider,\n  type WorkspaceConnectionProvider,\n} from \"../connections/catalog.js\";\nimport { saveOAuthTokens, setOAuthDisplayName } from \"../oauth-tokens/store.js\";\nimport { decryptSecretValue, encryptSecretValue } from \"../secrets/crypto.js\";\nimport {\n  listWorkspaceConnections,\n  upsertWorkspaceConnection,\n  upsertWorkspaceConnectionGrant,\n} from \"../workspace-connections/store.js\";\nimport { getSession, safeReturnPath } from \"./auth.js\";\nimport { resolveSecret } from \"./credential-provider.js\";\nimport {\n  decodeOAuthState,\n  encodeOAuthState,\n  getAppUrl,\n  resolveOAuthRedirectUri,\n  type OAuthStatePayload,\n} from \"./google-oauth.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport type GenericWorkspaceOAuthProvider = \"figma\" | \"google_drive\" | \"notion\";\n\nconst SUPPORTED_PROVIDERS = new Set<GenericWorkspaceOAuthProvider>([\n  \"figma\",\n  \"google_drive\",\n  \"notion\",\n]);\nconst FLOW_TTL_SECONDS = 10 * 60;\nconst PROVIDER_REQUEST_TIMEOUT_MS = 10_000;\nconst PROVIDER_RESPONSE_MAX_BYTES = 256 * 1024;\n\nexport interface WorkspaceProviderOAuthFlow {\n  provider: GenericWorkspaceOAuthProvider;\n  flowId: string;\n  verifier: string;\n  redirectUri: string;\n  owner: string;\n  orgId?: string;\n  appId: string;\n  expiresAt: number;\n}\n\nexport function workspaceProviderOAuthPath(\n  provider: GenericWorkspaceOAuthProvider,\n  phase: \"start\" | \"callback\",\n): string {\n  return `/_agent-native/connections/oauth/${provider}/${phase}`;\n}\n\nexport function createWorkspaceProviderOAuthHandler(\n  provider: GenericWorkspaceOAuthProvider,\n  phase: \"start\" | \"callback\",\n) {\n  if (!SUPPORTED_PROVIDERS.has(provider)) {\n    throw new Error(`Unsupported workspace OAuth provider: ${provider}`);\n  }\n  return defineEventHandler((event) =>\n    phase === \"start\"\n      ? handleWorkspaceProviderOAuthStart(event, provider)\n      : handleWorkspaceProviderOAuthCallback(event, provider),\n  );\n}\n\nexport async function handleWorkspaceProviderOAuthStart(\n  event: H3Event,\n  providerId: GenericWorkspaceOAuthProvider,\n): Promise<Response | Record<string, unknown>> {\n  if (getMethod(event) !== \"GET\") return methodNotAllowed(event);\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n  const provider = requiredProvider(providerId);\n  const query = getQuery(event);\n  const appId = normalizeAppId(\n    text(query.appId) ??\n      process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??\n      process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID ??\n      \"creative-context\",\n  );\n  const redirectUri = resolveOAuthRedirectUri(\n    event,\n    workspaceProviderOAuthPath(providerId, \"callback\"),\n  );\n  if (!redirectUri) {\n    setResponseStatus(event, 400);\n    return { error: \"Invalid OAuth redirect URI.\" };\n  }\n  return runWithRequestContext(\n    { userEmail: session.email, orgId: session.orgId },\n    async () => {\n      const [clientId, clientSecret] = await Promise.all([\n        resolveSecret(clientCredentialKey(providerId, \"id\")),\n        resolveSecret(clientCredentialKey(providerId, \"secret\")),\n      ]);\n      if (!clientId || !clientSecret) {\n        setResponseStatus(event, 503);\n        return {\n          error: `${provider.label} OAuth client credentials are not configured.`,\n        };\n      }\n      const verifier = crypto.randomBytes(48).toString(\"base64url\");\n      const challenge = crypto\n        .createHash(\"sha256\")\n        .update(verifier)\n        .digest(\"base64url\");\n      const flowId = crypto.randomUUID();\n      const requestedReturnUrl = text(query.return);\n      const returnUrl = requestedReturnUrl\n        ? safeReturnPath(requestedReturnUrl)\n        : undefined;\n      const state = encodeOAuthState({\n        redirectUri,\n        owner: session.email,\n        orgId: session.orgId,\n        app: appId,\n        returnUrl,\n        flowId,\n      });\n      const flow: WorkspaceProviderOAuthFlow = {\n        provider: providerId,\n        flowId,\n        verifier,\n        redirectUri,\n        owner: session.email,\n        ...(session.orgId ? { orgId: session.orgId } : {}),\n        appId,\n        expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,\n      };\n      setCookie(\n        event,\n        flowCookieName(providerId),\n        encryptSecretValue(JSON.stringify(flow)),\n        {\n          httpOnly: true,\n          secure: redirectUri.startsWith(\"https://\"),\n          sameSite: \"lax\",\n          path: \"/\",\n          maxAge: FLOW_TTL_SECONDS,\n        },\n      );\n      const authorizationUrl = buildWorkspaceProviderAuthorizationUrl({\n        provider,\n        clientId,\n        redirectUri,\n        state,\n        challenge,\n      });\n      return Response.redirect(authorizationUrl, 302);\n    },\n  );\n}\n\nexport async function handleWorkspaceProviderOAuthCallback(\n  event: H3Event,\n  providerId: GenericWorkspaceOAuthProvider,\n): Promise<Response | Record<string, unknown>> {\n  if (getMethod(event) !== \"GET\") return methodNotAllowed(event);\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n  const query = getQuery(event);\n  const code = text(query.code);\n  const stateParam = text(query.state);\n  const providerError = text(query.error);\n  if (providerError) {\n    setResponseStatus(event, 400);\n    return { error: \"OAuth authorization was not completed.\" };\n  }\n  if (!code || !stateParam) {\n    setResponseStatus(event, 400);\n    return { error: \"OAuth callback is missing code or state.\" };\n  }\n  const flow = readStoredFlow(event, providerId);\n  deleteCookie(event, flowCookieName(providerId), { path: \"/\" });\n  const state = decodeOAuthState(stateParam, \"\");\n  if (\n    !flow ||\n    !isWorkspaceProviderOAuthFlowValid({\n      flow,\n      state,\n      provider: providerId,\n      sessionEmail: session.email,\n      sessionOrgId: session.orgId,\n    })\n  ) {\n    setResponseStatus(event, 400);\n    return { error: \"OAuth state is invalid or expired.\" };\n  }\n  const provider = requiredProvider(providerId);\n  return runWithRequestContext(\n    { userEmail: session.email, orgId: session.orgId },\n    async () => {\n      const [clientId, clientSecret] = await Promise.all([\n        resolveSecret(clientCredentialKey(providerId, \"id\")),\n        resolveSecret(clientCredentialKey(providerId, \"secret\")),\n      ]);\n      if (!clientId || !clientSecret) {\n        setResponseStatus(event, 503);\n        return {\n          error: `${provider.label} OAuth client credentials are not configured.`,\n        };\n      }\n      const tokens = await exchangeWorkspaceProviderOAuthCode({\n        providerId,\n        provider,\n        clientId,\n        clientSecret,\n        code,\n        verifier: flow.verifier,\n        redirectUri: flow.redirectUri,\n      });\n      const identity = await resolveWorkspaceProviderIdentity(\n        providerId,\n        tokens,\n      );\n      await saveOAuthTokens(\n        provider.oauth!.provider,\n        identity.accountId,\n        tokens,\n        session.email,\n      );\n      await setOAuthDisplayName(\n        provider.oauth!.provider,\n        identity.accountId,\n        identity.label,\n      );\n      const existing = (\n        await listWorkspaceConnections({\n          provider: providerId,\n          includeDisabled: true,\n        })\n      ).find((connection) => connection.accountId === identity.accountId);\n      const scopes = mergeWorkspaceOAuthValues(\n        existing?.scopes ?? [],\n        tokenScopes(tokens, provider.oauth!.scopes),\n      );\n      const connection = await upsertWorkspaceConnection({\n        ...(existing ? { id: existing.id } : {}),\n        provider: providerId,\n        label: `${provider.label}: ${identity.label}`,\n        accountId: identity.accountId,\n        accountLabel: identity.label,\n        status: \"connected\",\n        scopes,\n        allowedApps: existing?.allowedApps ?? [],\n        config: { credentialMode: \"oauth\" },\n        lastCheckedAt: new Date(),\n        lastError: null,\n      });\n      await upsertWorkspaceConnectionGrant({\n        connectionId: connection.id,\n        appId: flow.appId,\n        provider: providerId,\n        scopes,\n        config: { credentialMode: \"oauth\" },\n      });\n      const returnPath =\n        state.returnUrl ??\n        `/settings/connections?connected=${encodeURIComponent(providerId)}`;\n      return Response.redirect(getAppUrl(event, returnPath), 302);\n    },\n  );\n}\n\nexport function buildWorkspaceProviderAuthorizationUrl(input: {\n  provider: WorkspaceConnectionProvider;\n  clientId: string;\n  redirectUri: string;\n  state: string;\n  challenge: string;\n}): string {\n  if (!input.provider.oauth)\n    throw new Error(\"Provider does not support OAuth.\");\n  const url = new URL(input.provider.oauth.authorizationUrl);\n  url.searchParams.set(\"client_id\", input.clientId);\n  url.searchParams.set(\"redirect_uri\", input.redirectUri);\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"state\", input.state);\n  if (input.provider.id === \"figma\") {\n    url.searchParams.set(\"code_challenge\", input.challenge);\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n  }\n  if (input.provider.id === \"google_drive\") {\n    url.searchParams.set(\"access_type\", \"offline\");\n    url.searchParams.set(\"include_granted_scopes\", \"true\");\n    url.searchParams.set(\"prompt\", \"consent\");\n  }\n  if (input.provider.oauth.scopes.length) {\n    url.searchParams.set(\"scope\", input.provider.oauth.scopes.join(\" \"));\n  }\n  if (input.provider.id === \"notion\") url.searchParams.set(\"owner\", \"user\");\n  return url.href;\n}\n\nexport async function exchangeWorkspaceProviderOAuthCode(input: {\n  providerId: GenericWorkspaceOAuthProvider;\n  provider: WorkspaceConnectionProvider;\n  clientId: string;\n  clientSecret: string;\n  code: string;\n  verifier: string;\n  redirectUri: string;\n}): Promise<Record<string, unknown>> {\n  const tokenUrl = input.provider.oauth?.tokenUrl;\n  if (!tokenUrl) throw new Error(\"Provider does not support OAuth.\");\n  const authorization = `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString(\"base64\")}`;\n  const fields = {\n    grant_type: \"authorization_code\",\n    code: input.code,\n    redirect_uri: input.redirectUri,\n    ...(input.providerId === \"figma\" ? { code_verifier: input.verifier } : {}),\n    ...(input.providerId === \"google_drive\"\n      ? { client_id: input.clientId, client_secret: input.clientSecret }\n      : {}),\n  };\n  const { response, body } = await fetchBoundedProviderJson(\n    tokenUrl,\n    {\n      method: \"POST\",\n      headers:\n        input.providerId === \"notion\"\n          ? {\n              Authorization: authorization,\n              Accept: \"application/json\",\n              \"Content-Type\": \"application/json\",\n            }\n          : input.providerId === \"figma\"\n            ? {\n                Authorization: authorization,\n                \"Content-Type\": \"application/x-www-form-urlencoded\",\n              }\n            : { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body:\n        input.providerId === \"notion\"\n          ? JSON.stringify(fields)\n          : new URLSearchParams(fields),\n    },\n    input.provider.label,\n  );\n  const accessToken = text(body.access_token);\n  if (!response.ok || !accessToken) {\n    throw new Error(\n      `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n    );\n  }\n  const expiresIn = Number(body.expires_in);\n  return {\n    ...body,\n    ...(Number.isFinite(expiresIn) && expiresIn > 0\n      ? { expiry_date: Date.now() + expiresIn * 1_000 }\n      : {}),\n  };\n}\n\nexport async function resolveWorkspaceProviderIdentity(\n  providerId: GenericWorkspaceOAuthProvider,\n  tokens: Record<string, unknown>,\n): Promise<{ accountId: string; label: string }> {\n  if (providerId === \"notion\") {\n    const owner = record(tokens.owner);\n    const user = record(owner?.user);\n    const person = record(user?.person);\n    const accountId =\n      text(user?.id) ??\n      text(person?.email) ??\n      text(tokens.workspace_id) ??\n      text(tokens.bot_id);\n    if (!accountId)\n      throw new Error(\n        \"Notion OAuth response did not identify the connected user.\",\n      );\n    return {\n      accountId,\n      label:\n        text(person?.email) ??\n        text(tokens.workspace_name) ??\n        \"Notion workspace\",\n    };\n  }\n  if (providerId === \"google_drive\") {\n    const accessToken = text(tokens.access_token)!;\n    const { response, body } = await fetchBoundedProviderJson(\n      \"https://www.googleapis.com/drive/v3/about?fields=user(displayName,emailAddress,permissionId)\",\n      { headers: { Authorization: `Bearer ${accessToken}` } },\n      \"Google Drive\",\n    );\n    const user = record(body.user);\n    const accountId = text(user?.permissionId) ?? text(user?.emailAddress);\n    if (!response.ok || !accountId) {\n      throw new Error(\n        \"Google Drive OAuth response did not identify the connected account.\",\n      );\n    }\n    return {\n      accountId,\n      label:\n        text(user?.emailAddress) ??\n        text(user?.displayName) ??\n        \"Google Drive account\",\n    };\n  }\n  const accessToken = text(tokens.access_token)!;\n  const { response, body: me } = await fetchBoundedProviderJson(\n    \"https://api.figma.com/v1/me\",\n    { headers: { Authorization: `Bearer ${accessToken}` } },\n    \"Figma\",\n  );\n  const accountId = text(me.id) ?? text(me.email) ?? text(tokens.user_id);\n  if (!response.ok || !accountId) {\n    throw new Error(\n      \"Figma OAuth response did not identify the connected user.\",\n    );\n  }\n  return {\n    accountId,\n    label: text(me.email) ?? text(me.handle) ?? \"Figma account\",\n  };\n}\n\nfunction requiredProvider(\n  providerId: GenericWorkspaceOAuthProvider,\n): WorkspaceConnectionProvider {\n  const provider = getWorkspaceConnectionProvider(providerId);\n  if (!provider?.oauth)\n    throw new Error(`${providerId} OAuth is not configured.`);\n  return provider;\n}\n\nfunction readStoredFlow(\n  event: H3Event,\n  provider: GenericWorkspaceOAuthProvider,\n): WorkspaceProviderOAuthFlow | null {\n  const encrypted = getCookie(event, flowCookieName(provider));\n  if (!encrypted) return null;\n  try {\n    return JSON.parse(\n      decryptSecretValue(encrypted),\n    ) as WorkspaceProviderOAuthFlow;\n  } catch {\n    return null;\n  }\n}\n\nexport function isWorkspaceProviderOAuthFlowValid(input: {\n  flow: WorkspaceProviderOAuthFlow;\n  state: OAuthStatePayload;\n  provider: GenericWorkspaceOAuthProvider;\n  sessionEmail: string;\n  sessionOrgId?: string;\n  now?: number;\n}): boolean {\n  return (\n    input.flow.expiresAt >= (input.now ?? Date.now()) &&\n    input.flow.provider === input.provider &&\n    input.state.flowId === input.flow.flowId &&\n    input.state.redirectUri === input.flow.redirectUri &&\n    input.state.owner === input.flow.owner &&\n    input.sessionEmail === input.flow.owner &&\n    input.state.orgId === input.flow.orgId &&\n    input.sessionOrgId === input.flow.orgId &&\n    input.state.app === input.flow.appId\n  );\n}\n\nasync function fetchBoundedProviderJson(\n  url: string,\n  init: RequestInit,\n  providerLabel: string,\n): Promise<{ response: Response; body: Record<string, unknown> }> {\n  let response: Response;\n  try {\n    response = await fetch(url, {\n      ...init,\n      signal: AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS),\n    });\n  } catch {\n    throw new Error(`${providerLabel} OAuth request failed.`);\n  }\n  const declaredLength = Number(response.headers.get(\"content-length\"));\n  if (\n    Number.isFinite(declaredLength) &&\n    declaredLength > PROVIDER_RESPONSE_MAX_BYTES\n  ) {\n    throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);\n  }\n  if (!response.body) return { response, body: {} };\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let length = 0;\n  try {\n    while (true) {\n      const chunk = await reader.read();\n      if (chunk.done) break;\n      length += chunk.value.byteLength;\n      if (length > PROVIDER_RESPONSE_MAX_BYTES) {\n        await reader.cancel();\n        break;\n      }\n      chunks.push(chunk.value);\n    }\n  } catch {\n    throw new Error(`${providerLabel} OAuth request failed.`);\n  }\n  if (length > PROVIDER_RESPONSE_MAX_BYTES) {\n    throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);\n  }\n  try {\n    const json = Buffer.concat(chunks).toString(\"utf8\");\n    const body = JSON.parse(json) as unknown;\n    return { response, body: record(body) ?? {} };\n  } catch {\n    return { response, body: {} };\n  }\n}\n\nfunction tokenScopes(\n  tokens: Record<string, unknown>,\n  fallback: readonly string[],\n): string[] {\n  const scope = text(tokens.scope);\n  return scope ? scope.split(/[ ,]+/).filter(Boolean) : [...fallback];\n}\n\nexport function mergeWorkspaceOAuthValues(\n  existing: readonly string[],\n  incoming: readonly string[],\n): string[] {\n  return [...new Set([...existing, ...incoming])];\n}\n\nfunction clientCredentialKey(\n  provider: GenericWorkspaceOAuthProvider,\n  field: \"id\" | \"secret\",\n): string {\n  const prefix =\n    provider === \"google_drive\" ? \"GOOGLE\" : provider.toUpperCase();\n  return `${prefix}_CLIENT_${field === \"id\" ? \"ID\" : \"SECRET\"}`;\n}\n\nfunction flowCookieName(provider: GenericWorkspaceOAuthProvider): string {\n  return `an_workspace_oauth_${provider}`;\n}\n\nfunction normalizeAppId(value: string): string {\n  const normalized = value.trim().toLowerCase();\n  if (!/^[a-z0-9][a-z0-9_-]{0,99}$/.test(normalized)) {\n    throw new Error(\"OAuth appId is invalid.\");\n  }\n  return normalized;\n}\n\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction methodNotAllowed(event: H3Event) {\n  setResponseStatus(event, 405);\n  return { error: \"Method not allowed\" };\n}\n\nfunction unauthorized(event: H3Event) {\n  setResponseStatus(event, 401);\n  return { error: \"Authentication required\" };\n}\n"]}

package/dist/styles/agent-native.css

@@ -155,6 +155,11 @@
     box-shadow 260ms var(--ease-drawer);
 }
 
+.agent-sidebar-shell[data-agent-sidebar-resizing="true"],
+.agent-sidebar-shell[data-agent-sidebar-resizing="true"] * {
+  transition: none !important;
+}
+
 .agent-native-app-main {
   container: agent-native-main / inline-size;
 }
@@ -237,6 +242,10 @@
   transition: width 260ms var(--ease-drawer);
 }
 
+.agent-sidebar-panel[data-agent-sidebar-animation="desktop"][data-agent-sidebar-resizing="true"] {
+  transition: none;
+}
+
 .agent-sidebar-panel[data-agent-sidebar-animation="desktop"][data-agent-sidebar-state="open"] {
   width: var(--agent-sidebar-width);
 }

package/dist/templates/chat/app/i18n/en-US.ts

@@ -11,10 +11,10 @@ const messages = {
       "Manage team members, organization access, and shared workspace preferences.",
     openTeamSettings: "Open team settings",
     openResourceSettings: "Open resource settings",
-    agentTitle: "Agent settings",
+    agentTitle: "Agent workspace",
     agentDescription:
-      "Open the agent sidebar settings for model, API keys, automations, voice, and other agent controls.",
-    openAgentSettings: "Open agent settings",
+      "Open the agent workspace for model, API keys, automations, voice, and other agent controls.",
+    openAgentSettings: "Open agent workspace",
   },
   chat: {
     archiveChat: "Archive Chat",

package/dist/templates/chat/app/lib/agent-page.tsx

@@ -8,6 +8,8 @@ type AgentClientModule = {
   AgentChatSurface: ComponentType<{
     mode?: "panel" | "page";
     className?: string;
+    showHeader?: boolean;
+    showTabBar?: boolean;
   }>;
   AgentTabsPage?: ComponentType<AgentPageProps>;
 };
@@ -33,7 +35,14 @@ export function resolveAgentPageComponent(
   if (existing) return existing;
 
   const legacyAgentPage = function LegacyAgentPage() {
-    return <client.AgentChatSurface mode="page" className="h-full" />;
+    return (
+      <client.AgentChatSurface
+        mode="page"
+        className="h-full"
+        showHeader={false}
+        showTabBar={false}
+      />
+    );
   };
   legacyAgentPages.set(client, legacyAgentPage);
   return legacyAgentPage;

package/dist/templates/default/app/i18n/en-US.ts

@@ -18,10 +18,10 @@ const messages = {
     languageDescription:
       "Choose the interface language. This preference is saved for your account.",
     languageLabel: "Interface language",
-    agentTitle: "Agent settings",
+    agentTitle: "Agent workspace",
     agentDescription:
-      "Open the agent sidebar settings for model, API keys, automations, voice, and other agent controls.",
-    openAgentSettings: "Open agent settings",
+      "Open the agent workspace for model, API keys, automations, voice, and other agent controls.",
+    openAgentSettings: "Open agent workspace",
     workspaceTitle: "Workspace",
     workspaceDescription: "Manage team access and shared workspace resources.",
     openTeamSettings: "Open team settings",

package/dist/templates/workspace-core/.agents/skills/extensions/SKILL.md

@@ -200,9 +200,10 @@ extension content:
 ```
 
 `update-extension` accepts the same `contentFromAttachment` for full-body
-replacement. Inline `content` still works for everything you author yourself —
-use `contentFromAttachment` only to avoid regurgitating something the user
-already pasted.
+replacement, but full-body replacement requires `allowFullReplacement: true`.
+Inline `content` still works for everything you author yourself — use
+`contentFromAttachment` only to avoid regurgitating something the user already
+pasted.
 
 ## Editing an extension
 
@@ -211,6 +212,13 @@ changes instead of regenerating the full HTML. For medium/large extensions,
 add stable section comments around major blocks so future agents can target
 them without touching unrelated indentation:
 
+For data-only repairs, preserve the existing layout, CSS, copy, and
+interactions. Do not reconstruct and submit the entire body. The action and
+store reject full-body replacement unless `allowFullReplacement: true` is
+explicitly supplied for a user-requested visual rewrite or complete replacement
+body. If a focused edit fails, inspect the current body and adjust its target;
+do not retry unchanged arguments.
+
 ```html
 <!-- agent-native:section npm-daily-chart -->
 <section>...</section>
@@ -243,7 +251,8 @@ Supported `edits` operations:
 Use `expectedMatches` when ambiguity would be dangerous. Missing required
 targets fail instead of silently doing nothing. Pass `format: true` to run
 Prettier on the final HTML after the patch. Full `content` replacement is
-still available for broad rewrites.
+still available for broad rewrites when `allowFullReplacement: true` is
+supplied.
 
 Legacy `patches` still work for simple literal replacements:
 
@@ -264,7 +273,7 @@ To replace the full content instead:
 
 ```
 PUT /_agent-native/extensions/:id
-{ "content": "full new HTML" }
+{ "content": "full new HTML", "allowFullReplacement": true }
 ```
 
 ## History and rollback

package/dist/templates/workspace-root/.env.example

@@ -70,6 +70,18 @@ DISPATCH_DEFAULT_OWNER_EMAIL=
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 
+# Optional workspace connectors. Register the matching callback URLs in each
+# provider using APP_URL as the origin:
+#   /_agent-native/connections/oauth/google_drive/callback
+#   /_agent-native/connections/oauth/figma/callback
+#   /_agent-native/connections/oauth/notion/callback
+# Google reuses the client above. User access and refresh tokens are encrypted
+# in the workspace token store.
+FIGMA_CLIENT_ID=
+FIGMA_CLIENT_SECRET=
+NOTION_CLIENT_ID=
+NOTION_CLIENT_SECRET=
+
 # Optional: GitHub sign-in.
 GITHUB_CLIENT_ID=
 GITHUB_CLIENT_SECRET=

package/dist/workspace-connections/index.d.ts

@@ -1,3 +1,4 @@
 export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, type ListWorkspaceConnectionProviderCatalogForAppOptions, type ListWorkspaceConnectionGrantsOptions, type ListWorkspaceConnectionsOptions, type ListWorkspaceConnectionsForAppOptions, type MarkWorkspaceConnectionUsedOptions, type MarkWorkspaceConnectionUsedResult, type ResolvedWorkspaceConnectionForApp, type ResolveWorkspaceConnectionForAppOptions, type SerializedWorkspaceConnectionGrant, type SerializedWorkspaceConnection, type SummarizeWorkspaceConnectionProviderForAppOptions, type SummarizeWorkspaceConnectionProviderReadinessOptions, type UpsertWorkspaceConnectionGrantInput, type UpsertWorkspaceConnectionInput, type WorkspaceConnectionAppAccess, type WorkspaceConnectionAppAccessMode, type WorkspaceConnection, type WorkspaceConnectionCredentialRef, type WorkspaceConnectionExplicitGrantSummary, type WorkspaceConnectionForApp, type WorkspaceConnectionForAppSummary, type WorkspaceConnectionGrant, type WorkspaceConnectionGrantAvailability, type WorkspaceConnectionGrantState, type WorkspaceConnectionProviderAppSummary, type WorkspaceConnectionProviderLike, type WorkspaceConnectionProviderCatalogForApp, type WorkspaceConnectionProviderCatalogForAppItem, type WorkspaceConnectionProviderReadiness, type WorkspaceConnectionProviderReadinessStatus, type WorkspaceConnectionPublicCredentialRef, type WorkspaceConnectionStatus, workspaceConnectionIsAvailableToApp, } from "./store.js";
 export { resolveWorkspaceConnectionCredentialForApp, resolveWorkspaceConnectionCredentialsForApp, type ResolveWorkspaceConnectionCredentialForAppOptions, type ResolveWorkspaceConnectionCredentialsForAppOptions, type WorkspaceConnectionCredentialBackend, type WorkspaceConnectionCredentialProvenance, type WorkspaceConnectionCredentialResolution, type WorkspaceConnectionCredentialResolutionCheck, type WorkspaceConnectionCredentialResolutionStatus, type WorkspaceConnectionCredentialsResolution, } from "./credentials.js";
+export { registerWorkspaceConnectionLifecycleListener, type WorkspaceConnectionLifecycleEvent, type WorkspaceConnectionLifecycleListener, } from "./lifecycle.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/workspace-connections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/workspace-connections/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,EACtB,2BAA2B,EAC3B,4CAA4C,EAC5C,6BAA6B,EAC7B,wBAAwB,EACxB,8BAA8B,EAC9B,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,0CAA0C,EAC1C,6CAA6C,EAC7C,8BAA8B,EAC9B,yBAAyB,EACzB,KAAK,mDAAmD,EACxD,KAAK,oCAAoC,EACzC,KAAK,+BAA+B,EACpC,KAAK,qCAAqC,EAC1C,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACtC,KAAK,iCAAiC,EACtC,KAAK,uCAAuC,EAC5C,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,KAAK,iDAAiD,EACtD,KAAK,oDAAoD,EACzD,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,uCAAuC,EAC5C,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,wBAAwB,EAC7B,KAAK,oCAAoC,EACzC,KAAK,6BAA6B,EAClC,KAAK,qCAAqC,EAC1C,KAAK,+BAA+B,EACpC,KAAK,wCAAwC,EAC7C,KAAK,4CAA4C,EACjD,KAAK,oCAAoC,EACzC,KAAK,0CAA0C,EAC/C,KAAK,sCAAsC,EAC3C,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,0CAA0C,EAC1C,2CAA2C,EAC3C,KAAK,iDAAiD,EACtD,KAAK,kDAAkD,EACvD,KAAK,oCAAoC,EACzC,KAAK,uCAAuC,EAC5C,KAAK,uCAAuC,EAC5C,KAAK,4CAA4C,EACjD,KAAK,6CAA6C,EAClD,KAAK,wCAAwC,GAC9C,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/workspace-connections/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,EACtB,2BAA2B,EAC3B,4CAA4C,EAC5C,6BAA6B,EAC7B,wBAAwB,EACxB,8BAA8B,EAC9B,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,0CAA0C,EAC1C,6CAA6C,EAC7C,8BAA8B,EAC9B,yBAAyB,EACzB,KAAK,mDAAmD,EACxD,KAAK,oCAAoC,EACzC,KAAK,+BAA+B,EACpC,KAAK,qCAAqC,EAC1C,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACtC,KAAK,iCAAiC,EACtC,KAAK,uCAAuC,EAC5C,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,KAAK,iDAAiD,EACtD,KAAK,oDAAoD,EACzD,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,uCAAuC,EAC5C,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,wBAAwB,EAC7B,KAAK,oCAAoC,EACzC,KAAK,6BAA6B,EAClC,KAAK,qCAAqC,EAC1C,KAAK,+BAA+B,EACpC,KAAK,wCAAwC,EAC7C,KAAK,4CAA4C,EACjD,KAAK,oCAAoC,EACzC,KAAK,0CAA0C,EAC/C,KAAK,sCAAsC,EAC3C,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,0CAA0C,EAC1C,2CAA2C,EAC3C,KAAK,iDAAiD,EACtD,KAAK,kDAAkD,EACvD,KAAK,oCAAoC,EACzC,KAAK,uCAAuC,EAC5C,KAAK,uCAAuC,EAC5C,KAAK,4CAA4C,EACjD,KAAK,6CAA6C,EAClD,KAAK,wCAAwC,GAC9C,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,4CAA4C,EAC5C,KAAK,iCAAiC,EACtC,KAAK,oCAAoC,GAC1C,MAAM,gBAAgB,CAAC"}