@agent-native/core 0.104.0 → 0.106.0

package/dist/server/workspace-provider-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-provider-oauth.js","sourceRoot":"","sources":["../../src/server/workspace-provider-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EACL,8BAA8B,GAE/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAI7D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAgC;IACjE,OAAO;IACP,cAAc;IACd,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC;AACjC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,CAAC;AAa/C,MAAM,UAAU,0BAA0B,CACxC,QAAuC,EACvC,KAA2B;IAE3B,OAAO,oCAAoC,QAAQ,IAAI,KAAK,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,QAAuC,EACvC,KAA2B;IAE3B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,KAAK,KAAK,OAAO;QACf,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,QAAQ,CAAC;QACpD,CAAC,CAAC,oCAAoC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAc,EACd,UAAyC;IAEzC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,CAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,6BAA6B;QACzC,OAAO,CAAC,GAAG,CAAC,kCAAkC;QAC9C,kBAAkB,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,uBAAuB,CACzC,KAAK,EACL,0BAA0B,CAAC,UAAU,EAAE,UAAU,CAAC,CACnD,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAClD,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,aAAa,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACpD,aAAa,CAAC,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,+CAA+C;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,WAAW,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,kBAAkB;YAClC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,KAAK;YACV,SAAS;YACT,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,GAA+B;YACvC,QAAQ,EAAE,UAAU;YACpB,MAAM;YACN,QAAQ;YACR,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,KAAK;SACjD,CAAC;QACF,SAAS,CACP,KAAK,EACL,cAAc,CAAC,UAAU,CAAC,EAC1B,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EACxC;YACE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;YAC1C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,gBAAgB;SACzB,CACF,CAAC;QACF,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;YAC9D,QAAQ;YACR,QAAQ;YACR,WAAW;YACX,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAc,EACd,UAAyC;IAEzC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,aAAa,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/C,IACE,CAAC,IAAI;QACL,CAAC,iCAAiC,CAAC;YACjC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,OAAO,CAAC,KAAK;YAC3B,YAAY,EAAE,OAAO,CAAC,KAAK;SAC5B,CAAC,EACF,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAClD,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,aAAa,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACpD,aAAa,CAAC,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,+CAA+C;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC;YACtD,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CACrD,UAAU,EACV,MAAM,CACP,CAAC;QACF,MAAM,eAAe,CACnB,QAAQ,CAAC,KAAM,CAAC,QAAQ,EACxB,QAAQ,CAAC,SAAS,EAClB,MAAM,EACN,OAAO,CAAC,KAAK,CACd,CAAC;QACF,MAAM,mBAAmB,CACvB,QAAQ,CAAC,KAAM,CAAC,QAAQ,EACxB,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,KAAK,CACf,CAAC;QACF,MAAM,QAAQ,GAAG,CACf,MAAM,wBAAwB,CAAC;YAC7B,QAAQ,EAAE,UAAU;YACpB,eAAe,EAAE,IAAI;SACtB,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,yBAAyB,CACtC,QAAQ,EAAE,MAAM,IAAI,EAAE,EACtB,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAM,CAAC,MAAM,CAAC,CAC5C,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC;YACjD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE;YAC7C,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,QAAQ,CAAC,KAAK;YAC5B,MAAM,EAAE,WAAW;YACnB,MAAM;YACN,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,EAAE;YACxC,MAAM,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE;YACnC,aAAa,EAAE,IAAI,IAAI,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,8BAA8B,CAAC;YACnC,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,UAAU;YACpB,MAAM;YACN,MAAM,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE;SACpC,CAAC,CAAC;QACH,MAAM,UAAU,GACd,KAAK,CAAC,SAAS;YACf,mCAAmC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;QACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3G,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,cAAc;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EACL,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC3B,CAAC,CAAC;gBACE,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACH,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO;gBAC5B,CAAC,CAAC;oBACE,aAAa,EAAE,aAAa;oBAC5B,cAAc,EAAE,mCAAmC;iBACpD;gBACH,CAAC,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC/D,IAAI,EACF,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC;KAClC,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,UAAyC,EACzC,MAA+B;IAE/B,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,OAAO;YACL,SAAS;YACT,KAAK,EACH,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC3B,kBAAkB;SACrB,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,8FAA8F,EAC9F,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EACvD,cAAc,CACf,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EACH,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;gBACxB,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;gBACvB,sBAAsB;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,wBAAwB,CAC3D,6BAA6B,EAC7B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EACvD,OAAO,CACR,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAyC;IAEzC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,KAAK;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,2BAA2B,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,QAAuC;IAEvC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CACf,kBAAkB,CAAC,SAAS,CAAC,CACA,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAOjD;IACC,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACtC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;QACxC,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW;QAClD,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACtC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACvC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACtC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACvC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,GAAW,EACX,IAAiB,EACjB,aAAqB;IAErB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,GAAG,IAAI;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,2BAA2B,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IACE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC/B,cAAc,GAAG,2BAA2B,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YACtB,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,IAAI,MAAM,GAAG,2BAA2B,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,GAAG,2BAA2B,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,MAA+B,EAC/B,QAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAA2B,EAC3B,QAA2B;IAE3B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAuC,EACvC,KAAsB;IAEtB,MAAM,MAAM,GACV,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClE,OAAO,GAAG,MAAM,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,QAAuC;IAC7D,OAAO,sBAAsB,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport {\n  deleteCookie,\n  defineEventHandler,\n  getCookie,\n  getMethod,\n  getQuery,\n  setCookie,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport {\n  getWorkspaceConnectionProvider,\n  type WorkspaceConnectionProvider,\n} from \"../connections/catalog.js\";\nimport { saveOAuthTokens, setOAuthDisplayName } from \"../oauth-tokens/store.js\";\nimport { decryptSecretValue, encryptSecretValue } from \"../secrets/crypto.js\";\nimport {\n  listWorkspaceConnections,\n  upsertWorkspaceConnection,\n  upsertWorkspaceConnectionGrant,\n} from \"../workspace-connections/store.js\";\nimport { getSession, safeReturnPath } from \"./auth.js\";\nimport { resolveSecret } from \"./credential-provider.js\";\nimport {\n  decodeOAuthState,\n  encodeOAuthState,\n  getAppUrl,\n  resolveOAuthRedirectUri,\n  type OAuthStatePayload,\n} from \"./google-oauth.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport type GenericWorkspaceOAuthProvider = \"figma\" | \"google_drive\" | \"notion\";\n\nconst SUPPORTED_PROVIDERS = new Set<GenericWorkspaceOAuthProvider>([\n  \"figma\",\n  \"google_drive\",\n  \"notion\",\n]);\nconst FLOW_TTL_SECONDS = 10 * 60;\nconst PROVIDER_REQUEST_TIMEOUT_MS = 10_000;\nconst PROVIDER_RESPONSE_MAX_BYTES = 256 * 1024;\n\nexport interface WorkspaceProviderOAuthFlow {\n  provider: GenericWorkspaceOAuthProvider;\n  flowId: string;\n  verifier: string;\n  redirectUri: string;\n  owner: string;\n  orgId?: string;\n  appId: string;\n  expiresAt: number;\n}\n\nexport function workspaceProviderOAuthPath(\n  provider: GenericWorkspaceOAuthProvider,\n  phase: \"start\" | \"callback\",\n): string {\n  return `/_agent-native/connections/oauth/${provider}/${phase}`;\n}\n\nexport function createWorkspaceProviderOAuthHandler(\n  provider: GenericWorkspaceOAuthProvider,\n  phase: \"start\" | \"callback\",\n) {\n  if (!SUPPORTED_PROVIDERS.has(provider)) {\n    throw new Error(`Unsupported workspace OAuth provider: ${provider}`);\n  }\n  return defineEventHandler((event) =>\n    phase === \"start\"\n      ? handleWorkspaceProviderOAuthStart(event, provider)\n      : handleWorkspaceProviderOAuthCallback(event, provider),\n  );\n}\n\nexport async function handleWorkspaceProviderOAuthStart(\n  event: H3Event,\n  providerId: GenericWorkspaceOAuthProvider,\n): Promise<Response | Record<string, unknown>> {\n  if (getMethod(event) !== \"GET\") return methodNotAllowed(event);\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n  const provider = requiredProvider(providerId);\n  const query = getQuery(event);\n  const appId = normalizeAppId(\n    text(query.appId) ??\n      process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??\n      process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID ??\n      \"creative-context\",\n  );\n  const redirectUri = resolveOAuthRedirectUri(\n    event,\n    workspaceProviderOAuthPath(providerId, \"callback\"),\n  );\n  if (!redirectUri) {\n    setResponseStatus(event, 400);\n    return { error: \"Invalid OAuth redirect URI.\" };\n  }\n  return runWithRequestContext(\n    { userEmail: session.email, orgId: session.orgId },\n    async () => {\n      const [clientId, clientSecret] = await Promise.all([\n        resolveSecret(clientCredentialKey(providerId, \"id\")),\n        resolveSecret(clientCredentialKey(providerId, \"secret\")),\n      ]);\n      if (!clientId || !clientSecret) {\n        setResponseStatus(event, 503);\n        return {\n          error: `${provider.label} OAuth client credentials are not configured.`,\n        };\n      }\n      const verifier = crypto.randomBytes(48).toString(\"base64url\");\n      const challenge = crypto\n        .createHash(\"sha256\")\n        .update(verifier)\n        .digest(\"base64url\");\n      const flowId = crypto.randomUUID();\n      const requestedReturnUrl = text(query.return);\n      const returnUrl = requestedReturnUrl\n        ? safeReturnPath(requestedReturnUrl)\n        : undefined;\n      const state = encodeOAuthState({\n        redirectUri,\n        owner: session.email,\n        orgId: session.orgId,\n        app: appId,\n        returnUrl,\n        flowId,\n      });\n      const flow: WorkspaceProviderOAuthFlow = {\n        provider: providerId,\n        flowId,\n        verifier,\n        redirectUri,\n        owner: session.email,\n        ...(session.orgId ? { orgId: session.orgId } : {}),\n        appId,\n        expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,\n      };\n      setCookie(\n        event,\n        flowCookieName(providerId),\n        encryptSecretValue(JSON.stringify(flow)),\n        {\n          httpOnly: true,\n          secure: redirectUri.startsWith(\"https://\"),\n          sameSite: \"lax\",\n          path: \"/\",\n          maxAge: FLOW_TTL_SECONDS,\n        },\n      );\n      const authorizationUrl = buildWorkspaceProviderAuthorizationUrl({\n        provider,\n        clientId,\n        redirectUri,\n        state,\n        challenge,\n      });\n      return Response.redirect(authorizationUrl, 302);\n    },\n  );\n}\n\nexport async function handleWorkspaceProviderOAuthCallback(\n  event: H3Event,\n  providerId: GenericWorkspaceOAuthProvider,\n): Promise<Response | Record<string, unknown>> {\n  if (getMethod(event) !== \"GET\") return methodNotAllowed(event);\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n  const query = getQuery(event);\n  const code = text(query.code);\n  const stateParam = text(query.state);\n  const providerError = text(query.error);\n  if (providerError) {\n    setResponseStatus(event, 400);\n    return { error: \"OAuth authorization was not completed.\" };\n  }\n  if (!code || !stateParam) {\n    setResponseStatus(event, 400);\n    return { error: \"OAuth callback is missing code or state.\" };\n  }\n  const flow = readStoredFlow(event, providerId);\n  deleteCookie(event, flowCookieName(providerId), { path: \"/\" });\n  const state = decodeOAuthState(stateParam, \"\");\n  if (\n    !flow ||\n    !isWorkspaceProviderOAuthFlowValid({\n      flow,\n      state,\n      provider: providerId,\n      sessionEmail: session.email,\n      sessionOrgId: session.orgId,\n    })\n  ) {\n    setResponseStatus(event, 400);\n    return { error: \"OAuth state is invalid or expired.\" };\n  }\n  const provider = requiredProvider(providerId);\n  return runWithRequestContext(\n    { userEmail: session.email, orgId: session.orgId },\n    async () => {\n      const [clientId, clientSecret] = await Promise.all([\n        resolveSecret(clientCredentialKey(providerId, \"id\")),\n        resolveSecret(clientCredentialKey(providerId, \"secret\")),\n      ]);\n      if (!clientId || !clientSecret) {\n        setResponseStatus(event, 503);\n        return {\n          error: `${provider.label} OAuth client credentials are not configured.`,\n        };\n      }\n      const tokens = await exchangeWorkspaceProviderOAuthCode({\n        providerId,\n        provider,\n        clientId,\n        clientSecret,\n        code,\n        verifier: flow.verifier,\n        redirectUri: flow.redirectUri,\n      });\n      const identity = await resolveWorkspaceProviderIdentity(\n        providerId,\n        tokens,\n      );\n      await saveOAuthTokens(\n        provider.oauth!.provider,\n        identity.accountId,\n        tokens,\n        session.email,\n      );\n      await setOAuthDisplayName(\n        provider.oauth!.provider,\n        identity.accountId,\n        identity.label,\n      );\n      const existing = (\n        await listWorkspaceConnections({\n          provider: providerId,\n          includeDisabled: true,\n        })\n      ).find((connection) => connection.accountId === identity.accountId);\n      const scopes = mergeWorkspaceOAuthValues(\n        existing?.scopes ?? [],\n        tokenScopes(tokens, provider.oauth!.scopes),\n      );\n      const connection = await upsertWorkspaceConnection({\n        ...(existing ? { id: existing.id } : {}),\n        provider: providerId,\n        label: `${provider.label}: ${identity.label}`,\n        accountId: identity.accountId,\n        accountLabel: identity.label,\n        status: \"connected\",\n        scopes,\n        allowedApps: existing?.allowedApps ?? [],\n        config: { credentialMode: \"oauth\" },\n        lastCheckedAt: new Date(),\n        lastError: null,\n      });\n      await upsertWorkspaceConnectionGrant({\n        connectionId: connection.id,\n        appId: flow.appId,\n        provider: providerId,\n        scopes,\n        config: { credentialMode: \"oauth\" },\n      });\n      const returnPath =\n        state.returnUrl ??\n        `/settings/connections?connected=${encodeURIComponent(providerId)}`;\n      return Response.redirect(getAppUrl(event, returnPath), 302);\n    },\n  );\n}\n\nexport function buildWorkspaceProviderAuthorizationUrl(input: {\n  provider: WorkspaceConnectionProvider;\n  clientId: string;\n  redirectUri: string;\n  state: string;\n  challenge: string;\n}): string {\n  if (!input.provider.oauth)\n    throw new Error(\"Provider does not support OAuth.\");\n  const url = new URL(input.provider.oauth.authorizationUrl);\n  url.searchParams.set(\"client_id\", input.clientId);\n  url.searchParams.set(\"redirect_uri\", input.redirectUri);\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"state\", input.state);\n  if (input.provider.id === \"figma\") {\n    url.searchParams.set(\"code_challenge\", input.challenge);\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n  }\n  if (input.provider.id === \"google_drive\") {\n    url.searchParams.set(\"access_type\", \"offline\");\n    url.searchParams.set(\"include_granted_scopes\", \"true\");\n    url.searchParams.set(\"prompt\", \"consent\");\n  }\n  if (input.provider.oauth.scopes.length) {\n    url.searchParams.set(\"scope\", input.provider.oauth.scopes.join(\" \"));\n  }\n  if (input.provider.id === \"notion\") url.searchParams.set(\"owner\", \"user\");\n  return url.href;\n}\n\nexport async function exchangeWorkspaceProviderOAuthCode(input: {\n  providerId: GenericWorkspaceOAuthProvider;\n  provider: WorkspaceConnectionProvider;\n  clientId: string;\n  clientSecret: string;\n  code: string;\n  verifier: string;\n  redirectUri: string;\n}): Promise<Record<string, unknown>> {\n  const tokenUrl = input.provider.oauth?.tokenUrl;\n  if (!tokenUrl) throw new Error(\"Provider does not support OAuth.\");\n  const authorization = `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString(\"base64\")}`;\n  const fields = {\n    grant_type: \"authorization_code\",\n    code: input.code,\n    redirect_uri: input.redirectUri,\n    ...(input.providerId === \"figma\" ? { code_verifier: input.verifier } : {}),\n    ...(input.providerId === \"google_drive\"\n      ? { client_id: input.clientId, client_secret: input.clientSecret }\n      : {}),\n  };\n  const { response, body } = await fetchBoundedProviderJson(\n    tokenUrl,\n    {\n      method: \"POST\",\n      headers:\n        input.providerId === \"notion\"\n          ? {\n              Authorization: authorization,\n              Accept: \"application/json\",\n              \"Content-Type\": \"application/json\",\n            }\n          : input.providerId === \"figma\"\n            ? {\n                Authorization: authorization,\n                \"Content-Type\": \"application/x-www-form-urlencoded\",\n              }\n            : { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body:\n        input.providerId === \"notion\"\n          ? JSON.stringify(fields)\n          : new URLSearchParams(fields),\n    },\n    input.provider.label,\n  );\n  const accessToken = text(body.access_token);\n  if (!response.ok || !accessToken) {\n    throw new Error(\n      `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n    );\n  }\n  const expiresIn = Number(body.expires_in);\n  return {\n    ...body,\n    ...(Number.isFinite(expiresIn) && expiresIn > 0\n      ? { expiry_date: Date.now() + expiresIn * 1_000 }\n      : {}),\n  };\n}\n\nexport async function resolveWorkspaceProviderIdentity(\n  providerId: GenericWorkspaceOAuthProvider,\n  tokens: Record<string, unknown>,\n): Promise<{ accountId: string; label: string }> {\n  if (providerId === \"notion\") {\n    const owner = record(tokens.owner);\n    const user = record(owner?.user);\n    const person = record(user?.person);\n    const accountId =\n      text(user?.id) ??\n      text(person?.email) ??\n      text(tokens.workspace_id) ??\n      text(tokens.bot_id);\n    if (!accountId)\n      throw new Error(\n        \"Notion OAuth response did not identify the connected user.\",\n      );\n    return {\n      accountId,\n      label:\n        text(person?.email) ??\n        text(tokens.workspace_name) ??\n        \"Notion workspace\",\n    };\n  }\n  if (providerId === \"google_drive\") {\n    const accessToken = text(tokens.access_token)!;\n    const { response, body } = await fetchBoundedProviderJson(\n      \"https://www.googleapis.com/drive/v3/about?fields=user(displayName,emailAddress,permissionId)\",\n      { headers: { Authorization: `Bearer ${accessToken}` } },\n      \"Google Drive\",\n    );\n    const user = record(body.user);\n    const accountId = text(user?.permissionId) ?? text(user?.emailAddress);\n    if (!response.ok || !accountId) {\n      throw new Error(\n        \"Google Drive OAuth response did not identify the connected account.\",\n      );\n    }\n    return {\n      accountId,\n      label:\n        text(user?.emailAddress) ??\n        text(user?.displayName) ??\n        \"Google Drive account\",\n    };\n  }\n  const accessToken = text(tokens.access_token)!;\n  const { response, body: me } = await fetchBoundedProviderJson(\n    \"https://api.figma.com/v1/me\",\n    { headers: { Authorization: `Bearer ${accessToken}` } },\n    \"Figma\",\n  );\n  const accountId = text(me.id) ?? text(me.email) ?? text(tokens.user_id);\n  if (!response.ok || !accountId) {\n    throw new Error(\n      \"Figma OAuth response did not identify the connected user.\",\n    );\n  }\n  return {\n    accountId,\n    label: text(me.email) ?? text(me.handle) ?? \"Figma account\",\n  };\n}\n\nfunction requiredProvider(\n  providerId: GenericWorkspaceOAuthProvider,\n): WorkspaceConnectionProvider {\n  const provider = getWorkspaceConnectionProvider(providerId);\n  if (!provider?.oauth)\n    throw new Error(`${providerId} OAuth is not configured.`);\n  return provider;\n}\n\nfunction readStoredFlow(\n  event: H3Event,\n  provider: GenericWorkspaceOAuthProvider,\n): WorkspaceProviderOAuthFlow | null {\n  const encrypted = getCookie(event, flowCookieName(provider));\n  if (!encrypted) return null;\n  try {\n    return JSON.parse(\n      decryptSecretValue(encrypted),\n    ) as WorkspaceProviderOAuthFlow;\n  } catch {\n    return null;\n  }\n}\n\nexport function isWorkspaceProviderOAuthFlowValid(input: {\n  flow: WorkspaceProviderOAuthFlow;\n  state: OAuthStatePayload;\n  provider: GenericWorkspaceOAuthProvider;\n  sessionEmail: string;\n  sessionOrgId?: string;\n  now?: number;\n}): boolean {\n  return (\n    input.flow.expiresAt >= (input.now ?? Date.now()) &&\n    input.flow.provider === input.provider &&\n    input.state.flowId === input.flow.flowId &&\n    input.state.redirectUri === input.flow.redirectUri &&\n    input.state.owner === input.flow.owner &&\n    input.sessionEmail === input.flow.owner &&\n    input.state.orgId === input.flow.orgId &&\n    input.sessionOrgId === input.flow.orgId &&\n    input.state.app === input.flow.appId\n  );\n}\n\nasync function fetchBoundedProviderJson(\n  url: string,\n  init: RequestInit,\n  providerLabel: string,\n): Promise<{ response: Response; body: Record<string, unknown> }> {\n  let response: Response;\n  try {\n    response = await fetch(url, {\n      ...init,\n      signal: AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS),\n    });\n  } catch {\n    throw new Error(`${providerLabel} OAuth request failed.`);\n  }\n  const declaredLength = Number(response.headers.get(\"content-length\"));\n  if (\n    Number.isFinite(declaredLength) &&\n    declaredLength > PROVIDER_RESPONSE_MAX_BYTES\n  ) {\n    throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);\n  }\n  if (!response.body) return { response, body: {} };\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let length = 0;\n  try {\n    while (true) {\n      const chunk = await reader.read();\n      if (chunk.done) break;\n      length += chunk.value.byteLength;\n      if (length > PROVIDER_RESPONSE_MAX_BYTES) {\n        await reader.cancel();\n        break;\n      }\n      chunks.push(chunk.value);\n    }\n  } catch {\n    throw new Error(`${providerLabel} OAuth request failed.`);\n  }\n  if (length > PROVIDER_RESPONSE_MAX_BYTES) {\n    throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);\n  }\n  try {\n    const json = Buffer.concat(chunks).toString(\"utf8\");\n    const body = JSON.parse(json) as unknown;\n    return { response, body: record(body) ?? {} };\n  } catch {\n    return { response, body: {} };\n  }\n}\n\nfunction tokenScopes(\n  tokens: Record<string, unknown>,\n  fallback: readonly string[],\n): string[] {\n  const scope = text(tokens.scope);\n  return scope ? scope.split(/[ ,]+/).filter(Boolean) : [...fallback];\n}\n\nexport function mergeWorkspaceOAuthValues(\n  existing: readonly string[],\n  incoming: readonly string[],\n): string[] {\n  return [...new Set([...existing, ...incoming])];\n}\n\nfunction clientCredentialKey(\n  provider: GenericWorkspaceOAuthProvider,\n  field: \"id\" | \"secret\",\n): string {\n  const prefix =\n    provider === \"google_drive\" ? \"GOOGLE\" : provider.toUpperCase();\n  return `${prefix}_CLIENT_${field === \"id\" ? \"ID\" : \"SECRET\"}`;\n}\n\nfunction flowCookieName(provider: GenericWorkspaceOAuthProvider): string {\n  return `an_workspace_oauth_${provider}`;\n}\n\nfunction normalizeAppId(value: string): string {\n  const normalized = value.trim().toLowerCase();\n  if (!/^[a-z0-9][a-z0-9_-]{0,99}$/.test(normalized)) {\n    throw new Error(\"OAuth appId is invalid.\");\n  }\n  return normalized;\n}\n\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction methodNotAllowed(event: H3Event) {\n  setResponseStatus(event, 405);\n  return { error: \"Method not allowed\" };\n}\n\nfunction unauthorized(event: H3Event) {\n  setResponseStatus(event, 401);\n  return { error: \"Authentication required\" };\n}\n"]}
+{"version":3,"file":"workspace-provider-oauth.js","sourceRoot":"","sources":["../../src/server/workspace-provider-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EACL,8BAA8B,GAE/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAW7D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAgC;IACjE,OAAO;IACP,cAAc;IACd,QAAQ;IACR,SAAS;IACT,MAAM;IACN,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC;AACjC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,CAAC;AAa/C,MAAM,UAAU,0BAA0B,CACxC,QAAuC,EACvC,KAA2B;IAE3B,OAAO,oCAAoC,QAAQ,IAAI,KAAK,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,QAAuC,EACvC,KAA2B;IAE3B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,KAAK,KAAK,OAAO;QACf,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,QAAQ,CAAC;QACpD,CAAC,CAAC,oCAAoC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAc,EACd,UAAyC;IAEzC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,CAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,6BAA6B;QACzC,OAAO,CAAC,GAAG,CAAC,kCAAkC;QAC9C,kBAAkB,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,uBAAuB,CACzC,KAAK,EACL,0BAA0B,CAAC,UAAU,EAAE,UAAU,CAAC,CACnD,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EACnC,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAC5B,MAAM,gCAAgC,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,+CAA+C;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,WAAW,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,kBAAkB;YAClC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK;YACL,GAAG,EAAE,KAAK;YACV,SAAS;YACT,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,GAA+B;YACvC,QAAQ,EAAE,UAAU;YACpB,MAAM;YACN,QAAQ;YACR,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK;YACL,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,KAAK;SACjD,CAAC;QACF,SAAS,CACP,KAAK,EACL,cAAc,CAAC,UAAU,CAAC,EAC1B,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EACxC;YACE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;YAC1C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,gBAAgB;SACzB,CACF,CAAC;QACF,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;YAC9D,QAAQ;YACR,QAAQ;YACR,WAAW;YACX,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAc,EACd,UAAyC;IAEzC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,aAAa,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/C,IACE,CAAC,IAAI;QACL,CAAC,iCAAiC,CAAC;YACjC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,OAAO,CAAC,KAAK;YAC3B,YAAY,EAAE,KAAK;SACpB,CAAC,EACF,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EACnC,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAC5B,MAAM,gCAAgC,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,+CAA+C;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC;YACtD,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,kCAAkC,CACzD,UAAU,EACV,MAAM,CACP,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,KAAK,8CAA8C,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CAAC;YACzD,QAAQ,EAAE,UAAU;YACpB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,oBAAoB,CACpC,UAAU,EACV,OAAO,CAAC,KAAK,EACb,QAAQ,CAAC,SAAS,CACnB,CAAC;YACF,MAAM,eAAe,CACnB,QAAQ,CAAC,KAAM,CAAC,QAAQ,EACxB,SAAS,EACT,MAAM,EACN,OAAO,CAAC,KAAK,CACd,CAAC;YACF,MAAM,mBAAmB,CACvB,QAAQ,CAAC,KAAM,CAAC,QAAQ,EACxB,SAAS,EACT,QAAQ,CAAC,KAAK,CACf,CAAC;YACF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CACvC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,CACnD,CAAC;YACF,MAAM,MAAM,GAAG,yBAAyB,CACtC,QAAQ,EAAE,MAAM,IAAI,EAAE,EACtB,QAAQ,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAM,CAAC,MAAM,CAAC,CAC/D,CAAC;YACF,MAAM,gBAAgB,GAAG;gBACvB,cAAc,EAAE,OAAO;gBACvB,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM;oBACnD,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,SAAS,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;aAC3B,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC;gBACjD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxC,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE;gBAC7C,SAAS;gBACT,YAAY,EAAE,QAAQ,CAAC,KAAK;gBAC5B,MAAM,EAAE,WAAW;gBACnB,MAAM;gBACN,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,EAAE;gBACxC,MAAM,EAAE,gBAAgB;gBACxB,aAAa,EAAE,IAAI,IAAI,EAAE;gBACzB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,MAAM,8BAA8B,CAAC;gBACnC,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,UAAU;gBACpB,MAAM;gBACN,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GACd,KAAK,CAAC,SAAS;YACf,mCAAmC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;QACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3G,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE;gBAC/D,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE;gBAC/D,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,6BAA6B,CAC5D,QAAQ,EACR;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/C,OAAO;YACL,GAAG,SAAS;YACZ,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;gBAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC/D,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE;YACnC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC/B,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,cAAc;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EACL,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC3B,CAAC,CAAC;gBACE,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACH,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO;gBAC5B,CAAC,CAAC;oBACE,aAAa,EAAE,aAAa;oBAC5B,cAAc,EAAE,mCAAmC;iBACpD;gBACH,CAAC,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC/D,IAAI,EACF,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC;KAClC,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,UAAyC,EACzC,MAA+B;IAE/B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,kCAAkC,CACzD,UAAU,EACV,MAAM,CACP,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,8CAA8C,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,UAAyC,EACzC,MAA+B;IAE/B,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,6BAA6B,CAC5D,4DAA4D,EAC5D;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,EACD,MAAM,CACP,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;YACpC,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IACE,SAAS,CAAC,QAAQ,KAAK,QAAQ;gBAC/B,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAC9C,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;gBACzC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CACjB,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL;oBACE,SAAS,EAAE,OAAO;oBAClB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ;oBAC9C,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,MAAM,EAAE;wBACN,gBAAgB,EAAE,OAAO;wBACzB,mBAAmB,EAAE,qCAAqC,kBAAkB,CAAC,OAAO,CAAC,EAAE;wBACvF,OAAO,EAAE,SAAS,CAAC,MAAM;qBAC1B;iBACF;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,MAAM,sCAAsC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AASD,KAAK,UAAU,sCAAsC,CACnD,UAAyC,EACzC,MAA+B;IAE/B,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,OAAO;YACL,SAAS;YACT,KAAK,EACH,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC3B,kBAAkB;SACrB,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAC7D,6BAA6B,EAC7B;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,sBAAsB,EAAE,YAAY;aACrC;SACF,EACD,QAAQ,CACT,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,iDAAiD,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAClF,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAC3C,SAAS,CACV,CAAC;QACF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,kBAAkB,SAAS,EAAE;SAC9D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAC7D,mCAAmC,EACnC;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,EACD,QAAQ,CACT,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,gBAAgB;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,8FAA8F,EAC9F,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EACvD,cAAc,CACf,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EACH,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;gBACxB,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;gBACvB,sBAAsB;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,wBAAwB,CAC3D,6BAA6B,EAC7B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EACvD,OAAO,CACR,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAyC;IAEzC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,KAAK;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,2BAA2B,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,QAAuC;IAEvC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CACf,kBAAkB,CAAC,SAAS,CAAC,CACA,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAOjD;IACC,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACtC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;QACxC,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW;QAClD,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACtC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACvC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACtC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACvC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAgC,EAChC,IAA+B;IAE/B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAuC,EACvC,KAAa,EACb,SAAiB;IAEjB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM;SACpB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,GAAG,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;SACnD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,GAAW,EACX,IAAiB,EACjB,aAAqB;IAErB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,6BAA6B,CAC5D,GAAG,EACH,IAAI,EACJ,aAAa,CACd,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,GAAW,EACX,IAAiB,EACjB,aAAqB;IAErB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,GAAG,IAAI;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,2BAA2B,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IACE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC/B,cAAc,GAAG,2BAA2B,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YACtB,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,IAAI,MAAM,GAAG,2BAA2B,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,GAAG,2BAA2B,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,MAA+B,EAC/B,QAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAA2B,EAC3B,QAA2B;IAE3B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAuC,EACvC,KAAsB;IAEtB,MAAM,MAAM,GACV,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,iBAAiB,GAAG,6BAA6B,MAAM,EAAE,CAAC;QAChE,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,iBAAiB,GAAG,8BAA8B,MAAM,EAAE,CAAC;QACjE,OAAO,CAAC,iBAAiB,EAAE,kBAAkB,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,WAAW,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,QAAuC;IAEvC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/C,CAAC,IAAI,EAAE,QAAQ,CAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9C,KAAK,MAAM,GAAG,IAAI,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CAAC;IACF,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,QAAuC;IAC7D,OAAO,sBAAsB,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,KAAc;IAC9D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7D,IACE,CAAC,OAAO;QACR,CAAC,gCAAgC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAC9D,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport {\n  deleteCookie,\n  defineEventHandler,\n  getCookie,\n  getMethod,\n  getQuery,\n  setCookie,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport {\n  getWorkspaceConnectionProvider,\n  type WorkspaceConnectionProvider,\n} from \"../connections/catalog.js\";\nimport { saveOAuthTokens, setOAuthDisplayName } from \"../oauth-tokens/store.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { decryptSecretValue, encryptSecretValue } from \"../secrets/crypto.js\";\nimport {\n  listWorkspaceConnections,\n  upsertWorkspaceConnection,\n  upsertWorkspaceConnectionGrant,\n} from \"../workspace-connections/store.js\";\nimport { getSession, safeReturnPath } from \"./auth.js\";\nimport { resolveSecret } from \"./credential-provider.js\";\nimport {\n  decodeOAuthState,\n  encodeOAuthState,\n  getAppUrl,\n  resolveOAuthRedirectUri,\n  type OAuthStatePayload,\n} from \"./google-oauth.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport type GenericWorkspaceOAuthProvider =\n  | \"figma\"\n  | \"google_drive\"\n  | \"github\"\n  | \"hubspot\"\n  | \"jira\"\n  | \"sentry\"\n  | \"notion\";\n\nconst SUPPORTED_PROVIDERS = new Set<GenericWorkspaceOAuthProvider>([\n  \"figma\",\n  \"google_drive\",\n  \"github\",\n  \"hubspot\",\n  \"jira\",\n  \"sentry\",\n  \"notion\",\n]);\nconst FLOW_TTL_SECONDS = 10 * 60;\nconst PROVIDER_REQUEST_TIMEOUT_MS = 10_000;\nconst PROVIDER_RESPONSE_MAX_BYTES = 256 * 1024;\n\nexport interface WorkspaceProviderOAuthFlow {\n  provider: GenericWorkspaceOAuthProvider;\n  flowId: string;\n  verifier: string;\n  redirectUri: string;\n  owner: string;\n  orgId?: string;\n  appId: string;\n  expiresAt: number;\n}\n\nexport function workspaceProviderOAuthPath(\n  provider: GenericWorkspaceOAuthProvider,\n  phase: \"start\" | \"callback\",\n): string {\n  return `/_agent-native/connections/oauth/${provider}/${phase}`;\n}\n\nexport function createWorkspaceProviderOAuthHandler(\n  provider: GenericWorkspaceOAuthProvider,\n  phase: \"start\" | \"callback\",\n) {\n  if (!SUPPORTED_PROVIDERS.has(provider)) {\n    throw new Error(`Unsupported workspace OAuth provider: ${provider}`);\n  }\n  return defineEventHandler((event) =>\n    phase === \"start\"\n      ? handleWorkspaceProviderOAuthStart(event, provider)\n      : handleWorkspaceProviderOAuthCallback(event, provider),\n  );\n}\n\nexport async function handleWorkspaceProviderOAuthStart(\n  event: H3Event,\n  providerId: GenericWorkspaceOAuthProvider,\n): Promise<Response | Record<string, unknown>> {\n  if (getMethod(event) !== \"GET\") return methodNotAllowed(event);\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n  const orgContext = await requireWorkspaceProviderOAuthAdmin(event);\n  if (!orgContext) {\n    return {\n      error:\n        \"Only organization owners and admins can connect shared OAuth accounts.\",\n    };\n  }\n  const orgId = orgContext.orgId;\n  if (!orgId) {\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"Only organization owners and admins can connect shared OAuth accounts.\",\n    };\n  }\n  const provider = requiredProvider(providerId);\n  const query = getQuery(event);\n  const appId = normalizeAppId(\n    text(query.appId) ??\n      process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??\n      process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID ??\n      \"creative-context\",\n  );\n  const redirectUri = resolveOAuthRedirectUri(\n    event,\n    workspaceProviderOAuthPath(providerId, \"callback\"),\n  );\n  if (!redirectUri) {\n    setResponseStatus(event, 400);\n    return { error: \"Invalid OAuth redirect URI.\" };\n  }\n  return runWithRequestContext(\n    { userEmail: session.email, orgId },\n    async () => {\n      const [clientId, clientSecret] =\n        await resolveProviderClientCredentials(providerId);\n      if (!clientId || !clientSecret) {\n        setResponseStatus(event, 503);\n        return {\n          error: `${provider.label} OAuth client credentials are not configured.`,\n        };\n      }\n      const verifier = crypto.randomBytes(48).toString(\"base64url\");\n      const challenge = crypto\n        .createHash(\"sha256\")\n        .update(verifier)\n        .digest(\"base64url\");\n      const flowId = crypto.randomUUID();\n      const requestedReturnUrl = text(query.return);\n      const returnUrl = requestedReturnUrl\n        ? safeReturnPath(requestedReturnUrl)\n        : undefined;\n      const state = encodeOAuthState({\n        redirectUri,\n        owner: session.email,\n        orgId,\n        app: appId,\n        returnUrl,\n        flowId,\n      });\n      const flow: WorkspaceProviderOAuthFlow = {\n        provider: providerId,\n        flowId,\n        verifier,\n        redirectUri,\n        owner: session.email,\n        orgId,\n        appId,\n        expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,\n      };\n      setCookie(\n        event,\n        flowCookieName(providerId),\n        encryptSecretValue(JSON.stringify(flow)),\n        {\n          httpOnly: true,\n          secure: redirectUri.startsWith(\"https://\"),\n          sameSite: \"lax\",\n          path: \"/\",\n          maxAge: FLOW_TTL_SECONDS,\n        },\n      );\n      const authorizationUrl = buildWorkspaceProviderAuthorizationUrl({\n        provider,\n        clientId,\n        redirectUri,\n        state,\n        challenge,\n      });\n      return Response.redirect(authorizationUrl, 302);\n    },\n  );\n}\n\nexport async function handleWorkspaceProviderOAuthCallback(\n  event: H3Event,\n  providerId: GenericWorkspaceOAuthProvider,\n): Promise<Response | Record<string, unknown>> {\n  if (getMethod(event) !== \"GET\") return methodNotAllowed(event);\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n  const orgContext = await requireWorkspaceProviderOAuthAdmin(event);\n  if (!orgContext) {\n    return {\n      error:\n        \"Only organization owners and admins can connect shared OAuth accounts.\",\n    };\n  }\n  const orgId = orgContext.orgId;\n  if (!orgId) {\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"Only organization owners and admins can connect shared OAuth accounts.\",\n    };\n  }\n  const query = getQuery(event);\n  const code = text(query.code);\n  const stateParam = text(query.state);\n  const providerError = text(query.error);\n  if (providerError) {\n    setResponseStatus(event, 400);\n    return { error: \"OAuth authorization was not completed.\" };\n  }\n  if (!code || !stateParam) {\n    setResponseStatus(event, 400);\n    return { error: \"OAuth callback is missing code or state.\" };\n  }\n  const flow = readStoredFlow(event, providerId);\n  deleteCookie(event, flowCookieName(providerId), { path: \"/\" });\n  const state = decodeOAuthState(stateParam, \"\");\n  if (\n    !flow ||\n    !isWorkspaceProviderOAuthFlowValid({\n      flow,\n      state,\n      provider: providerId,\n      sessionEmail: session.email,\n      sessionOrgId: orgId,\n    })\n  ) {\n    setResponseStatus(event, 400);\n    return { error: \"OAuth state is invalid or expired.\" };\n  }\n  const provider = requiredProvider(providerId);\n  return runWithRequestContext(\n    { userEmail: session.email, orgId },\n    async () => {\n      const [clientId, clientSecret] =\n        await resolveProviderClientCredentials(providerId);\n      if (!clientId || !clientSecret) {\n        setResponseStatus(event, 503);\n        return {\n          error: `${provider.label} OAuth client credentials are not configured.`,\n        };\n      }\n      const tokens = await exchangeWorkspaceProviderOAuthCode({\n        providerId,\n        provider,\n        clientId,\n        clientSecret,\n        code,\n        verifier: flow.verifier,\n        redirectUri: flow.redirectUri,\n      });\n      const identities = await resolveWorkspaceProviderIdentities(\n        providerId,\n        tokens,\n      );\n      if (!identities.length) {\n        throw new Error(\n          `${provider.label} OAuth did not return an accessible account.`,\n        );\n      }\n      const existingConnections = await listWorkspaceConnections({\n        provider: providerId,\n        includeDisabled: true,\n      });\n      for (const identity of identities) {\n        const accountId = scopedOAuthAccountId(\n          providerId,\n          session.email,\n          identity.accountId,\n        );\n        await saveOAuthTokens(\n          provider.oauth!.provider,\n          accountId,\n          tokens,\n          session.email,\n        );\n        await setOAuthDisplayName(\n          provider.oauth!.provider,\n          accountId,\n          identity.label,\n        );\n        const existing = existingConnections.find(\n          (connection) => connection.accountId === accountId,\n        );\n        const scopes = mergeWorkspaceOAuthValues(\n          existing?.scopes ?? [],\n          identity.scopes ?? tokenScopes(tokens, provider.oauth!.scopes),\n        );\n        const connectionConfig = {\n          credentialMode: \"oauth\",\n          ...(providerId === \"hubspot\" || providerId === \"jira\"\n            ? { externalAccountId: identity.accountId }\n            : {}),\n          ...(identity.config ?? {}),\n        };\n        const connection = await upsertWorkspaceConnection({\n          ...(existing ? { id: existing.id } : {}),\n          provider: providerId,\n          label: `${provider.label}: ${identity.label}`,\n          accountId,\n          accountLabel: identity.label,\n          status: \"connected\",\n          scopes,\n          allowedApps: existing?.allowedApps ?? [],\n          config: connectionConfig,\n          lastCheckedAt: new Date(),\n          lastError: null,\n        });\n        await upsertWorkspaceConnectionGrant({\n          connectionId: connection.id,\n          appId: flow.appId,\n          provider: providerId,\n          scopes,\n          config: connectionConfig,\n        });\n      }\n      const returnPath =\n        state.returnUrl ??\n        `/settings/connections?connected=${encodeURIComponent(providerId)}`;\n      return Response.redirect(getAppUrl(event, returnPath), 302);\n    },\n  );\n}\n\nexport function buildWorkspaceProviderAuthorizationUrl(input: {\n  provider: WorkspaceConnectionProvider;\n  clientId: string;\n  redirectUri: string;\n  state: string;\n  challenge: string;\n}): string {\n  if (!input.provider.oauth)\n    throw new Error(\"Provider does not support OAuth.\");\n  const url = new URL(input.provider.oauth.authorizationUrl);\n  url.searchParams.set(\"client_id\", input.clientId);\n  url.searchParams.set(\"redirect_uri\", input.redirectUri);\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"state\", input.state);\n  if (input.provider.id === \"figma\" || input.provider.id === \"sentry\") {\n    url.searchParams.set(\"code_challenge\", input.challenge);\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n  }\n  if (input.provider.id === \"github\") {\n    url.searchParams.set(\"allow_signup\", \"true\");\n  }\n  if (input.provider.id === \"jira\") {\n    url.searchParams.set(\"audience\", \"api.atlassian.com\");\n    url.searchParams.set(\"prompt\", \"consent\");\n  }\n  if (input.provider.id === \"google_drive\") {\n    url.searchParams.set(\"access_type\", \"offline\");\n    url.searchParams.set(\"include_granted_scopes\", \"true\");\n    url.searchParams.set(\"prompt\", \"consent\");\n  }\n  if (input.provider.oauth.scopes.length) {\n    url.searchParams.set(\"scope\", input.provider.oauth.scopes.join(\" \"));\n  }\n  if (input.provider.id === \"notion\") url.searchParams.set(\"owner\", \"user\");\n  return url.href;\n}\n\nexport async function exchangeWorkspaceProviderOAuthCode(input: {\n  providerId: GenericWorkspaceOAuthProvider;\n  provider: WorkspaceConnectionProvider;\n  clientId: string;\n  clientSecret: string;\n  code: string;\n  verifier: string;\n  redirectUri: string;\n}): Promise<Record<string, unknown>> {\n  const tokenUrl = input.provider.oauth?.tokenUrl;\n  if (!tokenUrl) throw new Error(\"Provider does not support OAuth.\");\n  const authorization = `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString(\"base64\")}`;\n  if (input.providerId === \"github\") {\n    const { response, body } = await fetchBoundedProviderJson(\n      tokenUrl,\n      {\n        method: \"POST\",\n        headers: {\n          Accept: \"application/json\",\n          \"Content-Type\": \"application/json\",\n        },\n        body: JSON.stringify({\n          client_id: input.clientId,\n          client_secret: input.clientSecret,\n          code: input.code,\n          redirect_uri: input.redirectUri,\n        }),\n      },\n      input.provider.label,\n    );\n    const accessToken = text(body.access_token);\n    if (!response.ok || !accessToken) {\n      throw new Error(\n        `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n      );\n    }\n    return {\n      ...body,\n      ...(Number.isFinite(Number(body.expires_in)) &&\n      Number(body.expires_in) > 0\n        ? { expiry_date: Date.now() + Number(body.expires_in) * 1_000 }\n        : {}),\n    };\n  }\n  if (input.providerId === \"hubspot\") {\n    const { response, body } = await fetchBoundedProviderJson(\n      tokenUrl,\n      {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          grant_type: \"authorization_code\",\n          client_id: input.clientId,\n          client_secret: input.clientSecret,\n          code: input.code,\n          redirect_uri: input.redirectUri,\n        }),\n      },\n      input.provider.label,\n    );\n    const accessToken = text(body.access_token);\n    if (!response.ok || !accessToken) {\n      throw new Error(\n        `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n      );\n    }\n    return {\n      ...body,\n      ...(Number.isFinite(Number(body.expires_in)) &&\n      Number(body.expires_in) > 0\n        ? { expiry_date: Date.now() + Number(body.expires_in) * 1_000 }\n        : {}),\n    };\n  }\n  if (input.providerId === \"jira\") {\n    const { response, body } = await fetchBoundedProviderJsonValue(\n      tokenUrl,\n      {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({\n          grant_type: \"authorization_code\",\n          client_id: input.clientId,\n          client_secret: input.clientSecret,\n          code: input.code,\n          redirect_uri: input.redirectUri,\n        }),\n      },\n      input.provider.label,\n    );\n    const tokenBody = record(body) ?? {};\n    const accessToken = text(tokenBody.access_token);\n    if (!response.ok || !accessToken) {\n      throw new Error(\n        `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n      );\n    }\n    const expiresIn = Number(tokenBody.expires_in);\n    return {\n      ...tokenBody,\n      ...(Number.isFinite(expiresIn) && expiresIn > 0\n        ? { expiry_date: Date.now() + expiresIn * 1_000 }\n        : {}),\n    };\n  }\n  const fields = {\n    grant_type: \"authorization_code\",\n    code: input.code,\n    redirect_uri: input.redirectUri,\n    ...(input.providerId === \"figma\" || input.providerId === \"sentry\"\n      ? { code_verifier: input.verifier }\n      : {}),\n    ...(input.providerId === \"sentry\"\n      ? { client_id: input.clientId, client_secret: input.clientSecret }\n      : {}),\n    ...(input.providerId === \"google_drive\"\n      ? { client_id: input.clientId, client_secret: input.clientSecret }\n      : {}),\n  };\n  const { response, body } = await fetchBoundedProviderJson(\n    tokenUrl,\n    {\n      method: \"POST\",\n      headers:\n        input.providerId === \"notion\"\n          ? {\n              Authorization: authorization,\n              Accept: \"application/json\",\n              \"Content-Type\": \"application/json\",\n            }\n          : input.providerId === \"figma\"\n            ? {\n                Authorization: authorization,\n                \"Content-Type\": \"application/x-www-form-urlencoded\",\n              }\n            : { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body:\n        input.providerId === \"notion\"\n          ? JSON.stringify(fields)\n          : new URLSearchParams(fields),\n    },\n    input.provider.label,\n  );\n  const accessToken = text(body.access_token);\n  if (!response.ok || !accessToken) {\n    throw new Error(\n      `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n    );\n  }\n  const expiresIn = Number(body.expires_in);\n  return {\n    ...body,\n    ...(Number.isFinite(expiresIn) && expiresIn > 0\n      ? { expiry_date: Date.now() + expiresIn * 1_000 }\n      : {}),\n  };\n}\n\nexport async function resolveWorkspaceProviderIdentity(\n  providerId: GenericWorkspaceOAuthProvider,\n  tokens: Record<string, unknown>,\n): Promise<WorkspaceProviderIdentity> {\n  const [identity] = await resolveWorkspaceProviderIdentities(\n    providerId,\n    tokens,\n  );\n  if (!identity) {\n    throw new Error(\n      `${providerId} OAuth response did not identify an account.`,\n    );\n  }\n  return identity;\n}\n\nexport async function resolveWorkspaceProviderIdentities(\n  providerId: GenericWorkspaceOAuthProvider,\n  tokens: Record<string, unknown>,\n): Promise<WorkspaceProviderIdentity[]> {\n  if (providerId === \"jira\") {\n    const accessToken = text(tokens.access_token);\n    if (!accessToken) {\n      throw new Error(\"Jira OAuth response did not include an access token.\");\n    }\n    const { response, body } = await fetchBoundedProviderJsonValue(\n      \"https://api.atlassian.com/oauth/token/accessible-resources\",\n      {\n        headers: {\n          Accept: \"application/json\",\n          Authorization: `Bearer ${accessToken}`,\n        },\n      },\n      \"Jira\",\n    );\n    if (!response.ok || !Array.isArray(body)) {\n      throw new Error(\"Jira OAuth response did not identify accessible sites.\");\n    }\n    return body.flatMap((resource) => {\n      const entry = record(resource);\n      const cloudId = text(entry?.id);\n      const siteUrl = text(entry?.url);\n      if (!cloudId || !siteUrl) return [];\n      let parsedUrl: URL;\n      try {\n        parsedUrl = new URL(siteUrl);\n      } catch {\n        return [];\n      }\n      if (\n        parsedUrl.protocol !== \"https:\" ||\n        !parsedUrl.hostname.endsWith(\".atlassian.net\")\n      ) {\n        return [];\n      }\n      const scopes = Array.isArray(entry?.scopes)\n        ? entry.scopes.filter(\n            (scope): scope is string => typeof scope === \"string\",\n          )\n        : undefined;\n      return [\n        {\n          accountId: cloudId,\n          label: text(entry?.name) ?? parsedUrl.hostname,\n          ...(scopes?.length ? { scopes } : {}),\n          config: {\n            atlassianCloudId: cloudId,\n            atlassianApiBaseUrl: `https://api.atlassian.com/ex/jira/${encodeURIComponent(cloudId)}`,\n            siteUrl: parsedUrl.origin,\n          },\n        },\n      ];\n    });\n  }\n  return [await resolveWorkspaceProviderIdentitySingle(providerId, tokens)];\n}\n\ntype WorkspaceProviderIdentity = {\n  accountId: string;\n  label: string;\n  scopes?: string[];\n  config?: Record<string, unknown>;\n};\n\nasync function resolveWorkspaceProviderIdentitySingle(\n  providerId: GenericWorkspaceOAuthProvider,\n  tokens: Record<string, unknown>,\n): Promise<WorkspaceProviderIdentity> {\n  if (providerId === \"notion\") {\n    const owner = record(tokens.owner);\n    const user = record(owner?.user);\n    const person = record(user?.person);\n    const accountId =\n      text(user?.id) ??\n      text(person?.email) ??\n      text(tokens.workspace_id) ??\n      text(tokens.bot_id);\n    if (!accountId)\n      throw new Error(\n        \"Notion OAuth response did not identify the connected user.\",\n      );\n    return {\n      accountId,\n      label:\n        text(person?.email) ??\n        text(tokens.workspace_name) ??\n        \"Notion workspace\",\n    };\n  }\n  if (providerId === \"github\") {\n    const accessToken = text(tokens.access_token)!;\n    const { response, body: user } = await fetchBoundedProviderJson(\n      \"https://api.github.com/user\",\n      {\n        headers: {\n          Accept: \"application/vnd.github+json\",\n          Authorization: `Bearer ${accessToken}`,\n          \"X-GitHub-Api-Version\": \"2022-11-28\",\n        },\n      },\n      \"GitHub\",\n    );\n    const accountId = text(user.login) ?? text(user.id);\n    if (!response.ok || !accountId) {\n      throw new Error(\n        \"GitHub OAuth response did not identify the connected user.\",\n      );\n    }\n    return {\n      accountId,\n      label: text(user.name) ?? text(user.login) ?? \"GitHub account\",\n    };\n  }\n  if (providerId === \"hubspot\") {\n    const accessToken = text(tokens.access_token)!;\n    const { response, body } = await fetchBoundedProviderJson(\n      `https://api.hubapi.com/oauth/v1/access-tokens/${encodeURIComponent(accessToken)}`,\n      { headers: { Accept: \"application/json\" } },\n      \"HubSpot\",\n    );\n    const accountId = scalarText(body.hub_id) ?? scalarText(body.user_id);\n    if (!response.ok || !accountId) {\n      throw new Error(\n        \"HubSpot OAuth response did not identify the connected portal.\",\n      );\n    }\n    return {\n      accountId,\n      label: text(body.hub_domain) ?? `HubSpot portal ${accountId}`,\n    };\n  }\n  if (providerId === \"sentry\") {\n    const accessToken = text(tokens.access_token)!;\n    const { response, body: user } = await fetchBoundedProviderJson(\n      \"https://sentry.io/api/0/users/me/\",\n      {\n        headers: {\n          Accept: \"application/json\",\n          Authorization: `Bearer ${accessToken}`,\n        },\n      },\n      \"Sentry\",\n    );\n    const accountId = text(user.id);\n    if (!response.ok || !accountId) {\n      throw new Error(\n        \"Sentry OAuth response did not identify the connected account.\",\n      );\n    }\n    return {\n      accountId,\n      label: text(user?.email) ?? text(user?.name) ?? \"Sentry account\",\n    };\n  }\n  if (providerId === \"google_drive\") {\n    const accessToken = text(tokens.access_token)!;\n    const { response, body } = await fetchBoundedProviderJson(\n      \"https://www.googleapis.com/drive/v3/about?fields=user(displayName,emailAddress,permissionId)\",\n      { headers: { Authorization: `Bearer ${accessToken}` } },\n      \"Google Drive\",\n    );\n    const user = record(body.user);\n    const accountId = text(user?.permissionId) ?? text(user?.emailAddress);\n    if (!response.ok || !accountId) {\n      throw new Error(\n        \"Google Drive OAuth response did not identify the connected account.\",\n      );\n    }\n    return {\n      accountId,\n      label:\n        text(user?.emailAddress) ??\n        text(user?.displayName) ??\n        \"Google Drive account\",\n    };\n  }\n  const accessToken = text(tokens.access_token)!;\n  const { response, body: me } = await fetchBoundedProviderJson(\n    \"https://api.figma.com/v1/me\",\n    { headers: { Authorization: `Bearer ${accessToken}` } },\n    \"Figma\",\n  );\n  const accountId = text(me.id) ?? text(me.email) ?? text(tokens.user_id);\n  if (!response.ok || !accountId) {\n    throw new Error(\n      \"Figma OAuth response did not identify the connected user.\",\n    );\n  }\n  return {\n    accountId,\n    label: text(me.email) ?? text(me.handle) ?? \"Figma account\",\n  };\n}\n\nfunction requiredProvider(\n  providerId: GenericWorkspaceOAuthProvider,\n): WorkspaceConnectionProvider {\n  const provider = getWorkspaceConnectionProvider(providerId);\n  if (!provider?.oauth)\n    throw new Error(`${providerId} OAuth is not configured.`);\n  return provider;\n}\n\nfunction readStoredFlow(\n  event: H3Event,\n  provider: GenericWorkspaceOAuthProvider,\n): WorkspaceProviderOAuthFlow | null {\n  const encrypted = getCookie(event, flowCookieName(provider));\n  if (!encrypted) return null;\n  try {\n    return JSON.parse(\n      decryptSecretValue(encrypted),\n    ) as WorkspaceProviderOAuthFlow;\n  } catch {\n    return null;\n  }\n}\n\nexport function isWorkspaceProviderOAuthFlowValid(input: {\n  flow: WorkspaceProviderOAuthFlow;\n  state: OAuthStatePayload;\n  provider: GenericWorkspaceOAuthProvider;\n  sessionEmail: string;\n  sessionOrgId?: string;\n  now?: number;\n}): boolean {\n  return (\n    input.flow.expiresAt >= (input.now ?? Date.now()) &&\n    input.flow.provider === input.provider &&\n    input.state.flowId === input.flow.flowId &&\n    input.state.redirectUri === input.flow.redirectUri &&\n    input.state.owner === input.flow.owner &&\n    input.sessionEmail === input.flow.owner &&\n    input.state.orgId === input.flow.orgId &&\n    input.sessionOrgId === input.flow.orgId &&\n    input.state.app === input.flow.appId\n  );\n}\n\nexport function canConnectWorkspaceProviderOAuth(\n  orgId: string | null | undefined,\n  role: string | null | undefined,\n): boolean {\n  return Boolean(orgId) && (role === \"owner\" || role === \"admin\");\n}\n\nexport function scopedOAuthAccountId(\n  provider: GenericWorkspaceOAuthProvider,\n  owner: string,\n  accountId: string,\n): string {\n  if (provider !== \"hubspot\" && provider !== \"jira\") return accountId;\n  const ownerKey = crypto\n    .createHash(\"sha256\")\n    .update(`${provider}:${owner.trim().toLowerCase()}`)\n    .digest(\"hex\")\n    .slice(0, 24);\n  return `${accountId}::${ownerKey}`;\n}\n\nasync function fetchBoundedProviderJson(\n  url: string,\n  init: RequestInit,\n  providerLabel: string,\n): Promise<{ response: Response; body: Record<string, unknown> }> {\n  const { response, body } = await fetchBoundedProviderJsonValue(\n    url,\n    init,\n    providerLabel,\n  );\n  return { response, body: record(body) ?? {} };\n}\n\nasync function fetchBoundedProviderJsonValue(\n  url: string,\n  init: RequestInit,\n  providerLabel: string,\n): Promise<{ response: Response; body: unknown }> {\n  let response: Response;\n  try {\n    response = await fetch(url, {\n      ...init,\n      signal: AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS),\n    });\n  } catch {\n    throw new Error(`${providerLabel} OAuth request failed.`);\n  }\n  const declaredLength = Number(response.headers.get(\"content-length\"));\n  if (\n    Number.isFinite(declaredLength) &&\n    declaredLength > PROVIDER_RESPONSE_MAX_BYTES\n  ) {\n    throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);\n  }\n  if (!response.body) return { response, body: {} };\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let length = 0;\n  try {\n    while (true) {\n      const chunk = await reader.read();\n      if (chunk.done) break;\n      length += chunk.value.byteLength;\n      if (length > PROVIDER_RESPONSE_MAX_BYTES) {\n        await reader.cancel();\n        break;\n      }\n      chunks.push(chunk.value);\n    }\n  } catch {\n    throw new Error(`${providerLabel} OAuth request failed.`);\n  }\n  if (length > PROVIDER_RESPONSE_MAX_BYTES) {\n    throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);\n  }\n  try {\n    const json = Buffer.concat(chunks).toString(\"utf8\");\n    const body = JSON.parse(json) as unknown;\n    return { response, body };\n  } catch {\n    return { response, body: {} };\n  }\n}\n\nfunction tokenScopes(\n  tokens: Record<string, unknown>,\n  fallback: readonly string[],\n): string[] {\n  const scope = text(tokens.scope);\n  return scope ? scope.split(/[ ,]+/).filter(Boolean) : [...fallback];\n}\n\nexport function mergeWorkspaceOAuthValues(\n  existing: readonly string[],\n  incoming: readonly string[],\n): string[] {\n  return [...new Set([...existing, ...incoming])];\n}\n\nfunction clientCredentialKeys(\n  provider: GenericWorkspaceOAuthProvider,\n  field: \"id\" | \"secret\",\n): string[] {\n  const prefix =\n    provider === \"google_drive\" ? \"GOOGLE\" : provider.toUpperCase();\n  const suffix = field === \"id\" ? \"ID\" : \"SECRET\";\n  if (provider === \"github\") {\n    const integrationPrefix = `GITHUB_INTEGRATION_CLIENT_${suffix}`;\n    return [integrationPrefix, `GITHUB_CLIENT_${suffix}`];\n  }\n  if (provider === \"hubspot\") {\n    const integrationPrefix = `HUBSPOT_INTEGRATION_CLIENT_${suffix}`;\n    return [integrationPrefix, `HUBSPOT_CLIENT_${suffix}`];\n  }\n  return [`${prefix}_CLIENT_${suffix}`];\n}\n\nasync function resolveProviderClientCredentials(\n  provider: GenericWorkspaceOAuthProvider,\n): Promise<[string | null, string | null]> {\n  const [clientId, clientSecret] = await Promise.all(\n    ([\"id\", \"secret\"] as const).map(async (field) => {\n      for (const key of clientCredentialKeys(provider, field)) {\n        const value = await resolveSecret(key);\n        if (value) return value;\n      }\n      return null;\n    }),\n  );\n  return [clientId, clientSecret];\n}\n\nfunction flowCookieName(provider: GenericWorkspaceOAuthProvider): string {\n  return `an_workspace_oauth_${provider}`;\n}\n\nfunction normalizeAppId(value: string): string {\n  const normalized = value.trim().toLowerCase();\n  if (!/^[a-z0-9][a-z0-9_-]{0,99}$/.test(normalized)) {\n    throw new Error(\"OAuth appId is invalid.\");\n  }\n  return normalized;\n}\n\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction scalarText(value: unknown): string | undefined {\n  if (typeof value === \"number\" && Number.isFinite(value)) return String(value);\n  return text(value);\n}\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction methodNotAllowed(event: H3Event) {\n  setResponseStatus(event, 405);\n  return { error: \"Method not allowed\" };\n}\n\nfunction unauthorized(event: H3Event) {\n  setResponseStatus(event, 401);\n  return { error: \"Authentication required\" };\n}\n\nasync function requireWorkspaceProviderOAuthAdmin(event: H3Event) {\n  const context = await getOrgContext(event).catch(() => null);\n  if (\n    !context ||\n    !canConnectWorkspaceProviderOAuth(context.orgId, context.role)\n  ) {\n    setResponseStatus(event, 403);\n    return null;\n  }\n  return context;\n}\n"]}

package/dist/templates/default/AGENTS.md

@@ -133,13 +133,15 @@ capability is missing, add or extend a `defineAction` so both the agent and UI
 share the same operation. Do not create `/api/*` routes that only call,
 repackage, or proxy an action.
 
-| Action        | Args                              | Purpose                         |
-| ------------- | --------------------------------- | ------------------------------- |
-| `view-screen` |                                   | See current UI state            |
-| `navigate`    | `--view <name>` or `--path <url>` | Navigate the UI                 |
-| `hello`       | `[--name <name>]`                 | Example script                  |
-| `db-schema`   |                                   | Show all tables, columns, types |
-| `db-query`    | `--sql "SELECT ..."`              | Run a SELECT query              |
+| Action           | Args                                                   | Purpose                                                   |
+| ---------------- | ------------------------------------------------------ | --------------------------------------------------------- |
+| `view-screen`    |                                                        | See current UI state                                      |
+| `navigate`       | `--view <name>` or `--path <url>`                      | Navigate the UI                                           |
+| `hello`          | `[--name <name>]`                                      | Example script                                            |
+| `db-schema`      |                                                        | Show all tables, columns, types                           |
+| `db-query`       | `--sql "SELECT ..."`                                   | Run a SELECT query                                        |
+| `list-mcp-tools` | `--serverId <id>`                                      | List connected MCP tools visible to the authenticated app |
+| `call-mcp-tool`  | `--serverId <id> --toolName <name> --arguments <json>` | Call a connected MCP tool through the scoped app API      |
 
 **For data changes, pick the right surface:**
 

package/dist/templates/workspace-core/.agents/skills/external-agents/SKILL.md

@@ -68,6 +68,52 @@ the real app focused on exactly what was produced. It reuses the existing
 `navigate` / `application_state` contract the UI already drains every 2s (see
 **context-awareness**) — we never invent a second navigation mechanism.
 
+## App-facing MCP connectors
+
+Apps can also consume connected remote MCP servers as a server-side API. The
+framework stores each connector's OAuth client registration, discovery metadata,
+access token, and refresh token in the encrypted `oauth_tokens` store, scoped to
+the user or organization. The browser and sandboxed MCP App iframes never
+receive those credentials.
+
+Use the hidden core actions `list-mcp-tools` and `call-mcp-tool` when an app UI
+needs a request-scoped API surface. Server-side app actions can import
+`listVisibleMcpTools` and `callMcpTool` from `@agent-native/core/mcp-client`.
+Both paths require an authenticated request context and enforce user/org server
+visibility plus MCP App visibility metadata. Pass the configured server id and
+the server's original tool name; the framework resolves the internal prefixed
+tool name and injects the connector's bearer token.
+
+```ts
+import { callMcpTool } from "@agent-native/core/mcp-client";
+
+const result = await callMcpTool("org_acme_linear", "list_issues", {
+  project: "<PROJECT_ID>",
+});
+```
+
+Use this for bounded product workflows (for example, syncing issues or
+refreshing analytics). Do not expose a raw token, arbitrary server URL, or
+unbounded proxy from an app action. Keep provider-specific schemas and access
+checks in the app action, and use the connector catalog/OAuth button for setup.
+
+## Provider API connectors
+
+The shared workspace connection catalog is also the setup surface for provider
+APIs. When a provider advertises OAuth, show that connection as the primary
+setup action and retain its API key or token as an explicit fallback. Current
+shared OAuth providers include Figma, GitHub, Google Drive, HubSpot, Jira Cloud, Notion, and Sentry. Slack
+uses its managed messaging-install OAuth flow. Gmail,
+Calendar, and Slides may use template-owned Google OAuth flows with broader
+scopes; do not replace those flows with the narrower Drive connection.
+
+Provider API actions resolve credentials server-side. Pass a granted
+`connectionId` when a request must use a particular OAuth account; never copy
+the access token into a browser, extension, MCP App, prompt, or stored action
+payload. Key-only providers should remain in the normal scoped secrets flow
+until their upstream OAuth app, scopes, refresh behavior, and identity mapping
+have been implemented and configured.
+
 ## How
 
 ### 1. Connect to hosted apps

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.104.0",
+  "version": "0.106.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -338,7 +338,7 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
-    "@agent-native/recap-cli": "0.4.2",
+    "@agent-native/recap-cli": "0.4.4",
     "@agent-native/toolkit": "^0.4.10"
   },
   "devDependencies": {

package/src/templates/default/AGENTS.md

@@ -133,13 +133,15 @@ capability is missing, add or extend a `defineAction` so both the agent and UI
 share the same operation. Do not create `/api/*` routes that only call,
 repackage, or proxy an action.
 
-| Action        | Args                              | Purpose                         |
-| ------------- | --------------------------------- | ------------------------------- |
-| `view-screen` |                                   | See current UI state            |
-| `navigate`    | `--view <name>` or `--path <url>` | Navigate the UI                 |
-| `hello`       | `[--name <name>]`                 | Example script                  |
-| `db-schema`   |                                   | Show all tables, columns, types |
-| `db-query`    | `--sql "SELECT ..."`              | Run a SELECT query              |
+| Action           | Args                                                   | Purpose                                                   |
+| ---------------- | ------------------------------------------------------ | --------------------------------------------------------- |
+| `view-screen`    |                                                        | See current UI state                                      |
+| `navigate`       | `--view <name>` or `--path <url>`                      | Navigate the UI                                           |
+| `hello`          | `[--name <name>]`                                      | Example script                                            |
+| `db-schema`      |                                                        | Show all tables, columns, types                           |
+| `db-query`       | `--sql "SELECT ..."`                                   | Run a SELECT query                                        |
+| `list-mcp-tools` | `--serverId <id>`                                      | List connected MCP tools visible to the authenticated app |
+| `call-mcp-tool`  | `--serverId <id> --toolName <name> --arguments <json>` | Call a connected MCP tool through the scoped app API      |
 
 **For data changes, pick the right surface:**
 

package/src/templates/workspace-core/.agents/skills/external-agents/SKILL.md

@@ -68,6 +68,52 @@ the real app focused on exactly what was produced. It reuses the existing
 `navigate` / `application_state` contract the UI already drains every 2s (see
 **context-awareness**) — we never invent a second navigation mechanism.
 
+## App-facing MCP connectors
+
+Apps can also consume connected remote MCP servers as a server-side API. The
+framework stores each connector's OAuth client registration, discovery metadata,
+access token, and refresh token in the encrypted `oauth_tokens` store, scoped to
+the user or organization. The browser and sandboxed MCP App iframes never
+receive those credentials.
+
+Use the hidden core actions `list-mcp-tools` and `call-mcp-tool` when an app UI
+needs a request-scoped API surface. Server-side app actions can import
+`listVisibleMcpTools` and `callMcpTool` from `@agent-native/core/mcp-client`.
+Both paths require an authenticated request context and enforce user/org server
+visibility plus MCP App visibility metadata. Pass the configured server id and
+the server's original tool name; the framework resolves the internal prefixed
+tool name and injects the connector's bearer token.
+
+```ts
+import { callMcpTool } from "@agent-native/core/mcp-client";
+
+const result = await callMcpTool("org_acme_linear", "list_issues", {
+  project: "<PROJECT_ID>",
+});
+```
+
+Use this for bounded product workflows (for example, syncing issues or
+refreshing analytics). Do not expose a raw token, arbitrary server URL, or
+unbounded proxy from an app action. Keep provider-specific schemas and access
+checks in the app action, and use the connector catalog/OAuth button for setup.
+
+## Provider API connectors
+
+The shared workspace connection catalog is also the setup surface for provider
+APIs. When a provider advertises OAuth, show that connection as the primary
+setup action and retain its API key or token as an explicit fallback. Current
+shared OAuth providers include Figma, GitHub, Google Drive, HubSpot, Jira Cloud, Notion, and Sentry. Slack
+uses its managed messaging-install OAuth flow. Gmail,
+Calendar, and Slides may use template-owned Google OAuth flows with broader
+scopes; do not replace those flows with the narrower Drive connection.
+
+Provider API actions resolve credentials server-side. Pass a granted
+`connectionId` when a request must use a particular OAuth account; never copy
+the access token into a browser, extension, MCP App, prompt, or stored action
+payload. Key-only providers should remain in the normal scoped secrets flow
+until their upstream OAuth app, scopes, refresh behavior, and identity mapping
+have been implemented and configured.
+
 ## How
 
 ### 1. Connect to hosted apps