@agent-native/core 0.122.4 → 0.123.1

package/dist/server/credential-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-provider.js","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAa,EACb,KAAgC,EAChC,IAA+B;IAE/B,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,iBAAiB,CAAU;IAC3B,WAAW,CAAU;IAE9B,YAAY,IAKX;QACC,KAAK,CACH,IAAI,CAAC,OAAO;YACV,gCAAgC,IAAI,CAAC,kBAAkB,yCAAyC,CACnG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;AACvC,CAAC;AAED,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC;IAClD,mBAAmB;IACnB,YAAY;IACZ,8BAA8B;IAC9B,qBAAqB;IACrB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;IACtB,8BAA8B;IAC9B,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,gCAAgC,CAAC,GAAuB;IAC/D,OAAO,CAAC,CAAC,GAAG,IAAI,mCAAmC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iCAAiC;IAC/C,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,GAAY;IAEZ,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,gCAAgC,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,wBAAwB,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,sBAAsB;IACtB,4BAA4B;IAC5B,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;CACjB,CAAC;AAEX,SAAS,sBAAsB,CAAC,GAAW;IACzC,OAAQ,uBAA6C,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,gBAAgB,GAAG,OAAO,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CACnC,CAAC;IACF,OAAO,CACL,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QAC5D,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAAC;QACjE,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC9C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC7B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,SAAS;YACrB,OAAO,CAAC,GAAG,CAAC,MAAM,CACnB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,+CAA+C;IACtD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;IACtD,6EAA6E;IAC7E,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,aAAa,GACjB,CAAC,mBAAmB;QACpB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAEvE,IAAI,wBAAwB,EAAE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAE/D,4EAA4E;IAC5E,OAAO,CAAC,mBAAmB,IAAI,eAAe,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO,aAAa,CAAC,IAAI,CACvB,OAAO,CAAC,GAAG,CAAC,qCAAqC;QAC/C,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,EAAE,CACL,CAAC;AACJ,CAAC;AAgCD,SAAS,2BAA2B,CAAC,KAAiC;IACpE,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAgC;IAEhC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAgC;IAClE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,cAAqE,EACrE,KAAmC,EACnC,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC;QACnC,IAAI,EAAE,uBAAuB;QAC7B,KAAK;QACL,OAAO;KACR,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,GAAW,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAC9E,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,qBAAqB,CAAC;QACxC,SAAS,EAAE,KAAK,CAAC,oBAAoB,CAAC;QACtC,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,kBAAkB,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,kBAAkB,CAAC;QAClC,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC;QAC3C,iBAAiB,EAAE,KAAK,CAAC,4BAA4B,CAAC;QACtD,gBAAgB,EAAE,KAAK,CAAC,2BAA2B,CAAC;QACpD,YAAY,EAAE,0BAA0B,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACxE,aAAa,EAAE,0BAA0B,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3E,MAAM,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK;KACpD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,2BAA2B,CACxC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACnE,OAAO,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,GAAW;IAEX,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,cAAc,GAAG,MAAM,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEhE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;YACrC,GAAG;YACH,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,sBAAsB,CACrE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACrD,CAAC;QAED,IAAI,KAAK,GAA8B,eAAe,EAAE,CAAC;QACzD,IAAI,SAAS,GAA0C,KAAK;YAC1D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC;QACX,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,KAAK;gBAAE,SAAS,GAAG,gBAAgB,CAAC;QAC1C,CAAC;QAED,mEAAmE;QACnE,iEAAiE;QACjE,+DAA+D;QAC/D,6DAA6D;QAC7D,mEAAmE;QACnE,IAAI,KAAK,EAAE,CAAC;YACV,cAAc,GAAG,KAAK,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;gBACpC,GAAG;gBACH,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,cAAc,SAAS,qBAAqB,CAC1G,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACnD,CAAC;YAED,iEAAiE;YACjE,qEAAqE;YACrE,yEAAyE;YACzE,cAAc,GAAG,WAAW,CAAC;YAC7B,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC;gBAC1C,GAAG;gBACH,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,cAAc,SAAS,2BAA2B,CAChH,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/D,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,cAAc,SAAS,gCAAgC,CACrH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,mEAAmE;QACnE,uCAAuC;QACvC,cAAc,GAAG,gBAAgB,CAAC;QAClC,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC;YAC9C,GAAG;YACH,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,QAAQ,KAAK,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,IAAI,QAAQ,cAAc,SAAS,gCAAgC,CACjI,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,IAAI,QAAQ,cAAc,SAAS,eAAe,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CACrL,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,cAAc,UAAW,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CACjH,CAAC;QACJ,CAAC;QACD,8CAA8C;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,KAAK,UAAU,+BAA+B;IAC5C,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAExD,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,cAAc,GAAG,MAAM,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,CACjB,KAAiC,EACjC,OAAe,EACf,KAAK,GAAG,EAAE,EACV,EAAE;YACF,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,OAAO,CAAC,GAAG,CACT,8BAA8B,KAAK,CAAC,MAAM,YAAY,OAAO,UAAU,KAAK,GAAG,KAAK,aAAa,2BAA2B,CAAC,KAAK,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAC9M,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,cAAc,EACd,MAAM,EACN,KAAK,CACN,CAAC;QACF,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,KAAK,GAA8B,eAAe,EAAE,CAAC;QACzD,IAAI,SAAS,GAA0C,KAAK;YAC1D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC;QACX,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,KAAK;gBAAE,SAAS,GAAG,gBAAgB,CAAC;QAC1C,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,cAAc,GAAG,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,cAAc,EACd,KAAK,EACL,KAAK,CACN,CAAC;YACF,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,SAAS,EAAE,CAAC,CAAC;YACvD,IAAI,2BAA2B,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YAClD,CAAC;YAED,cAAc,GAAG,WAAW,CAAC;YAC7B,MAAM,cAAc,GAAG,MAAM,0BAA0B,CACrD,cAAc,EACd,WAAW,EACX,KAAK,CACN,CAAC;YACF,UAAU,CAAC,cAAc,EAAE,KAAK,EAAE,cAAc,SAAS,EAAE,CAAC,CAAC;YAC7D,IAAI,2BAA2B,CAAC,cAAc,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,qEAAqE;QACrE,yBAAyB;QACzB,cAAc,GAAG,gBAAgB,CAAC;QAClC,MAAM,WAAW,GAAG,QAAQ,KAAK,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,cAAc,EACd,WAAW,EACX,WAAW,CACZ,CAAC;QACF,UAAU,CACR,SAAS,EACT,WAAW,EACX,UAAU,KAAK,IAAI,QAAQ,cAAc,SAAS,EAAE,CACrD,CAAC;QACF,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,8BAA8B,KAAK,UAAU,cAAc,sBAAuB,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAClH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,+CAA+C,EAAE;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,GAAG,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,OAAO,CAAC,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IACvD,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B;IAClD,MAAM,QAAQ,GAAG,MAAM,iCAAiC,EAAE,CAAC;IAC3D,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC;IACrD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GACnC,MAAM,+BAA+B,EAAE,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EACJ,UAAU,EACV,SAAS,EACT,MAAM,EACN,OAAO,EACP,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,MAAM,GACP,GAAG,MAAM,CAAC;QACX,OAAO;YACL,UAAU;YACV,SAAS;YACT,MAAM;YACN,OAAO;YACP,OAAO;YACP,YAAY;YACZ,iBAAiB;YACjB,gBAAgB;YAChB,YAAY;YACZ,aAAa;YACb,MAAM;YACN,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,+CAA+C,EAAE,CAAC;IACpE,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC,CAAC,uBAAuB,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,SAAS,GAAG,SAAS;QACzB,CAAC,CAAC,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,MAAM,GAAG,SAAS;QACtB,CAAC,CAAC,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,iBAAiB,GAAG,SAAS;QACjC,CAAC,CAAC,CAAC,uBAAuB,CAAC,4BAA4B,CAAC,IAAI,IAAI,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,SAAS;QAChC,CAAC,CAAC,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,IAAI,IAAI,CAAC;QAChE,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC,0BAA0B,CACxB,uBAAuB,CAAC,uBAAuB,CAAC,CACjD;QACH,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,aAAa,GAAG,SAAS;QAC7B,CAAC,CAAC,0BAA0B,CACxB,uBAAuB,CAAC,yBAAyB,CAAC,CACnD;QACH,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,UAAU;QACV,SAAS;QACT,MAAM;QACN,OAAO;QACP,OAAO;QACP,YAAY;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,aAAa;QACb,MAAM,EAAE,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC9C,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAY7C,MAAM,EACJ,UAAU,EACV,SAAS,EACT,MAAM,EACN,OAAO,EACP,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,GAAG,MAAM,iCAAiC,EAAE,CAAC;IAC9C,OAAO;QACL,UAAU;QACV,SAAS;QACT,MAAM;QACN,OAAO;QACP,OAAO;QACP,YAAY;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AACpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAY1D,MAAM,UAAU,4BAA4B,CAC1C,UAA0B,EAC1B,SAAyB;IAEzB,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,4BAA4B,CAAC,WAAmB;IACvD,OAAO,GAAG,mCAAmC,GAAG,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAK,GAGD,EAAE;IAEN,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,2BAA2B,EAAE,CAAC;YAClD,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjD,MAAM,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,WAAW;YACX,OAAO,EACL,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;gBAC5C,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,mEAAmE;YACzE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzD,EAAE;YACF,UAAU,EACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,OAIxD;IACC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;QACF,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,UAAU,CAAC,4BAA4B,CAAC,WAAW,CAAC,EAAE;YAC1D,WAAW;YACX,OAAO,EACL,OAAO,EAAE,OAAO;gBAChB,mEAAmE;YACrE,GAAG,CAAC,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5C,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,UAAU,EAAE,mBAAmB,EAAE,IAAI,IAAI;YACzC,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;AACH,CAAC;AAED,MAAM,oCAAoC,GAAG,wBAAwB,CAAC;AACtE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAa3D,MAAM,UAAU,6BAA6B,CAC3C,GAAmB,EACnB,KAAqB;IAErB,MAAM,aAAa,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,eAAe,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,6BAA6B,CAAC,WAAmB;IACxD,OAAO,GAAG,oCAAoC,GAAG,WAAW,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,IAGtD;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,4BAA4B,EAAE,CAAC;YACnD,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjD,MAAM,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,WAAW;YACX,GAAG,EACD,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG;gBACpC,CAAC,CAAC,GAAG,CAAC,GAAG;gBACT,CAAC,CAAC,GAAG,IAAI,sBAAsB;YACnC,OAAO,EACL,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;gBAC5C,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,gDAAgD;YACtD,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzD,EAAE;YACF,UAAU,EACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,IAMzD;IACC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,UAAU,CAAC,6BAA6B,CAAC,WAAW,CAAC,EAAE;YAC3D,WAAW;YACX,GAAG;YACH,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gDAAgD;YACzE,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,UAAU,EAAE,mBAAmB,EAAE,IAAI,IAAI;YACzC,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,IAGxD;IACC,MAAM,WAAW,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,KAWC,EACD,OAAyD;IAEzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,uKAAuK,CACxK,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GACvC,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,2BAA2B,CACxC,KAAK,EACL,OAAO,EAAE,KAAK,IAAI,IAAI,EACtB,OAAO,EAAE,IAAI,IAAI,IAAI,CACtB,CAAC;IAEF,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,QAAQ,GAA4B,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC5E,eAAe,CAAC;QACd,GAAG;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACnB,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE5B,MAAM,OAAO,GAA0C;QACrD,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,UAAU,EAAE;QACjD,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE;KAChD,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,4BAA4B;YACjC,KAAK,EAAE,KAAK,CAAC,iBAAiB;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,2BAA2B;YAChC,KAAK,EAAE,KAAK,CAAC,gBAAgB;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,uBAAuB;YAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,yBAAyB;YAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAC7B,cAAc,CAAC;QACb,GAAG;QACH,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CACH,CACF,CAAC;IACF,MAAM,iCAAiC,CAAC;QACtC,UAAU;QACV,SAAS;KACV,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAa,EACb,OAAyD;IAEzD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,2BAA2B,CACxC,KAAK,EACL,OAAO,EAAE,KAAK,IAAI,IAAI,EACtB,OAAO,EAAE,IAAI,IAAI,IAAI,CACtB,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAClC,eAAe,CAAC;QACd,GAAG;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACnB,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,+DAA+D;AAC/D,gFAAgF;AAChF,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAChE,2BAA2B;YAC3B,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;gBACrC,GAAG;gBACH,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,UAAU,EAAE,KAAK,EAAE,CAAC;gBACtB,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,sBAAsB,CACjE,CAAC;gBACJ,CAAC;gBACD,OAAO,UAAU,CAAC,KAAK,CAAC;YAC1B,CAAC;YAED,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,kEAAkE;gBAClE,2CAA2C;gBAC3C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;oBACpC,GAAG;oBACH,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;oBACrB,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,KAAK,qBAAqB,CAC/E,CAAC;oBACJ,CAAC;oBACD,OAAO,SAAS,CAAC,KAAK,CAAC;gBACzB,CAAC;gBAED,6DAA6D;gBAC7D,mEAAmE;gBACnE,4BAA4B;gBAC5B,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC;oBAC1C,GAAG;oBACH,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,eAAe,EAAE,KAAK,EAAE,CAAC;oBAC3B,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,KAAK,2BAA2B,CACrF,CAAC;oBACJ,CAAC;oBACD,OAAO,eAAe,CAAC,KAAK,CAAC;gBAC/B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC;oBAC9C,GAAG;oBACH,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,QAAQ,KAAK,EAAE;iBACzB,CAAC,CAAC;gBACH,IAAI,mBAAmB,EAAE,KAAK,EAAE,CAAC;oBAC/B,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,gCAAgC,CAC3E,CAAC;oBACJ,CAAC;oBACD,OAAO,mBAAmB,CAAC,KAAK,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,oBAAqB,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAC/F,CAAC;YACJ,CAAC;YACD,8CAA8C;QAChD,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,8DAA8D;QAC9D,MAAM,WAAW,GAAG,CAClB,sBAAsB,CAAC,GAAG,CAAC;YACzB,CAAC,CAAC,+CAA+C,EAAE;YACnD,CAAC,CAAC,wCAAwC,CAAC,GAAG,CAAC,CAClD;YACC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;YAC1B,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,eAAe,EAAE,IAAI,QAAQ,UAAU,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,WAAW,EAAE,CACxJ,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvC,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,yCAAyC,CAAC,CAAC,KAAK,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,iEAAiE;AACjE,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qBAAqB;IACnC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,iCAAiC;QAC7C,+CAA+C,CAChD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACvC,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Credential provider abstraction.\n *\n * Every feature that needs an external credential (Anthropic API key,\n * Google OAuth tokens, OpenAI key, Slack bot token, etc.) should go through\n * one of the resolve*() helpers here instead of reading `process.env`\n * directly. That way the same feature can work in three modes:\n *\n *   1. User set their own key in .env              → use it directly\n *   2. User connected Builder via `/cli-auth`      → route through Builder proxy\n *   3. Neither                                      → throw FeatureNotConfigured\n *\n * Templates catch FeatureNotConfigured and show a \"Connect Builder (1 click) /\n * set up your own key (guide)\" card.\n *\n * Today these helpers are used by the Builder-hosted LLM gateway, and the\n * shape is meant to grow to cover future managed credential integrations\n * (e.g. additional Builder-hosted services) without rewrites.\n */\n\nimport { createHash } from \"node:crypto\";\n\nimport { isLocalDatabase } from \"../db/client.js\";\nimport { getRequestUserEmail, getRequestOrgId } from \"./request-context.js\";\n\n/**\n * Decide which `app_secrets` scope a Builder/credential write should use.\n *\n * Org scope (\"everyone in this org sees these credentials\") wins when the\n * connecting user is an owner or admin of an active org — the write\n * privileges shared infra. A plain member or a user without an active\n * org falls through to per-user scope so a teammate can't silently\n * overwrite the org-shared connection.\n */\nexport function resolveCredentialWriteScope(\n  email: string,\n  orgId: string | null | undefined,\n  role: string | null | undefined,\n): { scope: \"user\" | \"org\"; scopeId: string } {\n  if (orgId && (role === \"owner\" || role === \"admin\")) {\n    return { scope: \"org\", scopeId: orgId };\n  }\n  return { scope: \"user\", scopeId: email };\n}\n\nexport class FeatureNotConfiguredError extends Error {\n  readonly requiredCredential: string;\n  readonly builderConnectUrl?: string;\n  readonly byokDocsUrl?: string;\n\n  constructor(opts: {\n    requiredCredential: string;\n    message?: string;\n    builderConnectUrl?: string;\n    byokDocsUrl?: string;\n  }) {\n    super(\n      opts.message ??\n        `Feature requires credential \"${opts.requiredCredential}\". Connect Builder or set your own key.`,\n    );\n    this.name = \"FeatureNotConfiguredError\";\n    this.requiredCredential = opts.requiredCredential;\n    this.builderConnectUrl = opts.builderConnectUrl;\n    this.byokDocsUrl = opts.byokDocsUrl;\n  }\n}\n\n/**\n * Deployment-level credential fallback for single-tenant/local operation.\n * Multi-tenant call sites must gate this explicitly before calling.\n */\nexport function readDeployCredentialEnv(key: string): string | undefined {\n  return process.env[key] || undefined;\n}\n\nconst APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([\n  \"ANTHROPIC_API_KEY\",\n  \"EMAIL_FROM\",\n  \"EMAIL_INBOUND_WEBHOOK_SECRET\",\n  \"EMAIL_AGENT_ADDRESS\",\n  \"OPENAI_API_KEY\",\n  \"OPENAI_BASE_URL\",\n  \"OPENROUTER_API_KEY\",\n  \"GOOGLE_CLIENT_ID\",\n  \"GOOGLE_CLIENT_SECRET\",\n  \"GOOGLE_GENERATIVE_AI_API_KEY\",\n  \"GROQ_API_KEY\",\n  \"MISTRAL_API_KEY\",\n  \"COHERE_API_KEY\",\n  \"RESEND_API_KEY\",\n  \"SENDGRID_API_KEY\",\n]);\n\nfunction isAppProvidedDeployCredentialKey(key: string | undefined): boolean {\n  return !!key && APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS.has(key);\n}\n\n/**\n * Deployment-level credentials are safe as a runtime fallback only in local /\n * single-tenant contexts. In hosted production with a shared database, every\n * signed-in user needs their own user/org/workspace credential for\n * identity-bearing provider keys so one deploy key does not silently\n * impersonate another tenant. App-provided service credentials are different:\n * they configure the deployed app itself rather than identifying a user. This\n * includes LLM keys that let the app developer pay for model usage, email\n * transport configuration owned by the deployment, and OAuth client\n * credentials whose per-user identity remains in scoped OAuth tokens. Key-aware\n * callers may use those env vars.\n *\n * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic\n * provider secrets. This stricter helper remains for legacy call sites with\n * identity-bearing deploy credentials.\n */\nexport function isDeployCredentialFallbackAllowed(): boolean {\n  if (!isProductionLikeRuntime()) return true;\n  return isLocalDatabase();\n}\n\nexport function canUseDeployCredentialFallbackForRequest(\n  key?: string,\n): boolean {\n  const email = getRequestUserEmail();\n  if (!email) return true;\n  if (isAppProvidedDeployCredentialKey(key)) return true;\n  if (isHostedWorkspaceRuntime()) return false;\n  if (!isProductionLikeRuntime()) return true;\n  return isLocalDatabase();\n}\n\nconst BUILDER_CREDENTIAL_KEYS = [\n  \"BUILDER_PRIVATE_KEY\",\n  \"BUILDER_PUBLIC_KEY\",\n  \"BUILDER_USER_ID\",\n  \"BUILDER_ORG_NAME\",\n  \"BUILDER_ORG_KIND\",\n  \"BUILDER_SUBSCRIPTION\",\n  \"BUILDER_SUBSCRIPTION_LEVEL\",\n  \"BUILDER_SUBSCRIPTION_NAME\",\n  \"BUILDER_IS_ENTERPRISE\",\n  \"BUILDER_IS_FREE_ACCOUNT\",\n] as const;\n\nfunction isBuilderCredentialKey(key: string): boolean {\n  return (BUILDER_CREDENTIAL_KEYS as readonly string[]).includes(key);\n}\n\nfunction isHostedWorkspaceRuntime(): boolean {\n  const hasFusionPreview = Boolean(\n    process.env.FUSION_ENVIRONMENT ||\n    process.env.FUSION_ENV_ORIGIN ||\n    process.env.VITE_FUSION_ENV_ORIGIN,\n  );\n  return (\n    /^(1|true)$/i.test(process.env.AGENT_NATIVE_WORKSPACE ?? \"\") ||\n    /^(1|true)$/i.test(process.env.VITE_AGENT_NATIVE_WORKSPACE ?? \"\") ||\n    hasFusionPreview\n  );\n}\n\nfunction isProductionLikeRuntime(): boolean {\n  return (\n    process.env.NODE_ENV === \"production\" ||\n    /^(1|true)$/i.test(process.env.NETLIFY ?? \"\") ||\n    /^(1|true)$/i.test(process.env.VERCEL ?? \"\") ||\n    /^(1|true)$/i.test(process.env.CF_PAGES ?? \"\") ||\n    Boolean(\n      process.env.AWS_LAMBDA_FUNCTION_NAME ||\n      process.env.AWS_EXECUTION_ENV ||\n      process.env.FUNCTIONS_WORKER_RUNTIME ||\n      process.env.K_SERVICE ||\n      process.env.RENDER,\n    )\n  );\n}\n\n/**\n * Whether deployment-level Builder env keys may back the current request.\n *\n * This is intentionally self-contained rather than delegating to\n * `canUseDeployCredentialFallbackForRequest`. That generic helper blocks the\n * deploy fallback for any signed-in user in a hosted workspace runtime, so the\n * Builder dogfooding escape hatch must apply its own hosted-workspace exception\n * here instead of inheriting the generic helper's stricter (and hatch-unaware)\n * decision. Reading the env once into locals keeps the rules legible.\n *\n * Rules (all evaluated against the live request/runtime, not a build-time value):\n *  - No signed-in user → safe to use the deploy env (nobody to mis-identify).\n *  - Hosted workspace + signed-in user → deploy-level Builder keys would\n *    impersonate that user, so block them — UNLESS a developer has explicitly\n *    opted into the local dogfooding escape hatch (non-prod only). Default OFF;\n *    hosted/shared production deployments are never affected.\n *  - Otherwise → allowed in non-prod, or on a local/single-tenant database.\n */\nfunction canUseBuilderDeployCredentialFallbackForRequest(): boolean {\n  const email = getRequestUserEmail();\n  if (!email) return true;\n\n  const isProductionRuntime = isProductionLikeRuntime();\n  // Local dogfooding escape hatch: lets the env / root-`.env` Builder key back\n  // a signed-in user so running the app locally doesn't require completing the\n  // Builder connect flow first. Non-prod only.\n  const localDevOptIn =\n    !isProductionRuntime &&\n    /^(1|true)$/i.test(process.env.AGENT_NATIVE_LOCAL_BUILDER_ENV ?? \"\");\n\n  if (isHostedWorkspaceRuntime() && !localDevOptIn) return false;\n\n  // Deploy fallback is safe in non-prod or on a local/single-tenant database.\n  return !isProductionRuntime || isLocalDatabase();\n}\n\nfunction shouldTraceCredentialResolve(): boolean {\n  return /^(1|true)$/i.test(\n    process.env.AGENT_NATIVE_DEBUG_CREDENTIAL_RESOLVE ??\n      process.env.DEBUG_CREDENTIAL_RESOLVE ??\n      \"\",\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Builder credential resolution:\n//\n//   1. **Request-scoped credentials.** A signed-in user can connect Builder\n//      through the CLI-auth flow. Owner/admin connections land at org scope;\n//      member/no-org connections land at user scope.\n//\n//   2. **Deployment fallback.** BUILDER_PRIVATE_KEY in env still makes local\n//      and single-tenant deploys work out of the box, but it no longer blocks\n//      per-user connect. Request-scoped credentials win whenever present.\n//\n// To run multi-tenant SaaS: prefer leaving BUILDER_PRIVATE_KEY unset unless a\n// shared fallback identity is intentional.\n// ---------------------------------------------------------------------------\n\ntype BuilderCredentialSource = \"user\" | \"org\" | \"workspace\" | \"env\";\ninterface BuilderResolvedCredentials {\n  privateKey: string | null;\n  publicKey: string | null;\n  userId: string | null;\n  orgName: string | null;\n  orgKind: string | null;\n  subscription: string | null;\n  subscriptionLevel: string | null;\n  subscriptionName: string | null;\n  isEnterprise: boolean | null;\n  isFreeAccount: boolean | null;\n  source: Exclude<BuilderCredentialSource, \"env\">;\n}\n\nfunction isCompleteBuilderConnection(creds: BuilderResolvedCredentials) {\n  return Boolean(creds.privateKey && creds.publicKey);\n}\n\nfunction readOptionalBuilderBoolean(\n  value: string | null | undefined,\n): boolean | null {\n  if (value == null || value === \"\") return null;\n  return /^(1|true)$/i.test(value);\n}\n\nexport function isBuilderPrivateKey(value: string | null | undefined): boolean {\n  return typeof value === \"string\" && value.trim().startsWith(\"bpk-\");\n}\n\nasync function readBuilderCredentialScope(\n  readAppSecrets: typeof import(\"../secrets/storage.js\").readAppSecrets,\n  scope: \"user\" | \"org\" | \"workspace\",\n  scopeId: string,\n): Promise<BuilderResolvedCredentials> {\n  const secrets = await readAppSecrets({\n    keys: BUILDER_CREDENTIAL_KEYS,\n    scope,\n    scopeId,\n  });\n  const value = (key: string): string | null => secrets.get(key)?.value ?? null;\n  return {\n    privateKey: value(\"BUILDER_PRIVATE_KEY\"),\n    publicKey: value(\"BUILDER_PUBLIC_KEY\"),\n    userId: value(\"BUILDER_USER_ID\"),\n    orgName: value(\"BUILDER_ORG_NAME\"),\n    orgKind: value(\"BUILDER_ORG_KIND\"),\n    subscription: value(\"BUILDER_SUBSCRIPTION\"),\n    subscriptionLevel: value(\"BUILDER_SUBSCRIPTION_LEVEL\"),\n    subscriptionName: value(\"BUILDER_SUBSCRIPTION_NAME\"),\n    isEnterprise: readOptionalBuilderBoolean(value(\"BUILDER_IS_ENTERPRISE\")),\n    isFreeAccount: readOptionalBuilderBoolean(value(\"BUILDER_IS_FREE_ACCOUNT\")),\n    source: scope === \"workspace\" ? \"workspace\" : scope,\n  };\n}\n\n/**\n * A transient org_members read failure makes getOrgContext report no org, which\n * would otherwise hide an org-scoped Builder connection behind a permanent-\n * sounding \"not configured\" error. resolveOrgIdForEmail honors an explicit\n * Personal selection, so this cannot promote a user into an org they left.\n */\nasync function resolveOrgIdForRequestEmail(\n  email: string,\n): Promise<string | null> {\n  try {\n    const { resolveOrgIdForEmail } = await import(\"../org/context.js\");\n    return await resolveOrgIdForEmail(email);\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveScopedBuilderCredential(\n  key: string,\n): Promise<{ value: string; source: \"user\" | \"org\" | \"workspace\" } | null> {\n  const email = getRequestUserEmail();\n  if (!email) return null;\n\n  // Trace only when explicitly requested. These diagnostics are useful for\n  // support, but they include account identifiers and run on hot paths.\n  const traceLookup = shouldTraceCredentialResolve();\n  let scopeAttempted = \"user\";\n  try {\n    const { readAppSecret } = await import(\"../secrets/storage.js\");\n\n    // 1. Per-user override: a user can paste their own key in settings to\n    //    overrule the org-shared one (handy for a personal sandbox).\n    const userSecret = await readAppSecret({\n      key,\n      scope: \"user\",\n      scopeId: email,\n    });\n    if (userSecret) {\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} scope=user hit=true`,\n        );\n      }\n      return { value: userSecret.value, source: \"user\" };\n    }\n\n    let orgId: string | null | undefined = getRequestOrgId();\n    let orgSource: \"request\" | \"email-fallback\" | \"none\" = orgId\n      ? \"request\"\n      : \"none\";\n    if (!orgId) {\n      orgId = await resolveOrgIdForRequestEmail(email);\n      if (orgId) orgSource = \"email-fallback\";\n    }\n\n    // 2. Per-org shared credential: when one teammate connects Builder\n    //    as an owner/admin we write the OAuth result at org scope so\n    //    every member of that org gets the AI chat working without\n    //    re-running the connect flow. Resolution falls back here\n    //    silently — the caller never has to know which scope answered.\n    if (orgId) {\n      scopeAttempted = \"org\";\n      const orgSecret = await readAppSecret({\n        key,\n        scope: \"org\",\n        scopeId: orgId,\n      });\n      if (orgSecret) {\n        if (traceLookup) {\n          console.log(\n            `[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} scope=org hit=true`,\n          );\n        }\n        return { value: orgSecret.value, source: \"org\" };\n      }\n\n      // Older setup flows wrote shared credentials at workspace scope.\n      // Keep reading those rows so status UIs and runtime resolution agree\n      // for users who connected before org-scoped Builder credentials existed.\n      scopeAttempted = \"workspace\";\n      const workspaceSecret = await readAppSecret({\n        key,\n        scope: \"workspace\",\n        scopeId: orgId,\n      });\n      if (workspaceSecret) {\n        if (traceLookup) {\n          console.log(\n            `[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} scope=workspace hit=true`,\n          );\n        }\n        return { value: workspaceSecret.value, source: \"workspace\" };\n      }\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} miss tried=user,org,workspace`,\n        );\n      }\n    }\n\n    // 3. Solo-workspace fallback: always checked, even when an org id was\n    //    found above. Older no-org connect flows wrote here, so a credential\n    //    written before the user joined/created an org must not become\n    //    unreachable once that org exists.\n    scopeAttempted = \"workspace-solo\";\n    const soloWorkspaceSecret = await readAppSecret({\n      key,\n      scope: \"workspace\",\n      scopeId: `solo:${email}`,\n    });\n    if (soloWorkspaceSecret) {\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} orgId=${orgId ?? \"(none)\"} orgSource=${orgSource} scope=workspace-solo hit=true`,\n        );\n      }\n      return { value: soloWorkspaceSecret.value, source: \"workspace\" };\n    }\n    if (traceLookup) {\n      console.log(\n        `[builder-credential] key=${key} email=${email} orgId=${orgId ?? \"(none)\"} orgSource=${orgSource} miss tried=${orgId ? \"user,org,workspace,workspace-solo\" : \"user,workspace-solo\"}`,\n      );\n    }\n  } catch (err) {\n    if (traceLookup) {\n      console.log(\n        `[builder-credential] key=${key} email=${email} scope=${scopeAttempted} error=${(err as Error)?.message ?? err}`,\n      );\n    }\n    // Secrets table not ready — treat as missing.\n  }\n  return null;\n}\n\ninterface ScopedBuilderCredentialsResult {\n  creds: BuilderResolvedCredentials | null;\n  /**\n   * True when reading the credential store itself threw (db timeout, etc),\n   * as opposed to the store answering cleanly with \"no row\". Callers must\n   * report this as retryable rather than \"not configured\".\n   */\n  lookupFailed: boolean;\n}\n\nasync function resolveScopedBuilderCredentials(): Promise<ScopedBuilderCredentialsResult> {\n  const email = getRequestUserEmail();\n  if (!email) return { creds: null, lookupFailed: false };\n\n  const traceLookup = shouldTraceCredentialResolve();\n  let scopeAttempted = \"user\";\n  try {\n    const { readAppSecrets } = await import(\"../secrets/storage.js\");\n    const traceScope = (\n      creds: BuilderResolvedCredentials,\n      scopeId: string,\n      extra = \"\",\n    ) => {\n      if (!traceLookup) return;\n      console.log(\n        `[builder-credential] scope=${creds.source} scopeId=${scopeId} email=${email}${extra} complete=${isCompleteBuilderConnection(creds)} private=${Boolean(creds.privateKey)} public=${Boolean(creds.publicKey)}`,\n      );\n    };\n\n    const userCreds = await readBuilderCredentialScope(\n      readAppSecrets,\n      \"user\",\n      email,\n    );\n    traceScope(userCreds, email);\n    if (isCompleteBuilderConnection(userCreds)) {\n      return { creds: userCreds, lookupFailed: false };\n    }\n\n    let orgId: string | null | undefined = getRequestOrgId();\n    let orgSource: \"request\" | \"email-fallback\" | \"none\" = orgId\n      ? \"request\"\n      : \"none\";\n    if (!orgId) {\n      orgId = await resolveOrgIdForRequestEmail(email);\n      if (orgId) orgSource = \"email-fallback\";\n    }\n\n    if (orgId) {\n      scopeAttempted = \"org\";\n      const orgCreds = await readBuilderCredentialScope(\n        readAppSecrets,\n        \"org\",\n        orgId,\n      );\n      traceScope(orgCreds, orgId, ` orgSource=${orgSource}`);\n      if (isCompleteBuilderConnection(orgCreds)) {\n        return { creds: orgCreds, lookupFailed: false };\n      }\n\n      scopeAttempted = \"workspace\";\n      const workspaceCreds = await readBuilderCredentialScope(\n        readAppSecrets,\n        \"workspace\",\n        orgId,\n      );\n      traceScope(workspaceCreds, orgId, ` orgSource=${orgSource}`);\n      if (isCompleteBuilderConnection(workspaceCreds)) {\n        return { creds: workspaceCreds, lookupFailed: false };\n      }\n    }\n\n    // Solo-workspace fallback: always checked, even when an org id was found\n    // above. See resolveScopedBuilderCredential for why this must not be\n    // gated behind \"no org\".\n    scopeAttempted = \"workspace-solo\";\n    const soloScopeId = `solo:${email}`;\n    const soloCreds = await readBuilderCredentialScope(\n      readAppSecrets,\n      \"workspace\",\n      soloScopeId,\n    );\n    traceScope(\n      soloCreds,\n      soloScopeId,\n      ` orgId=${orgId ?? \"(none)\"} orgSource=${orgSource}`,\n    );\n    if (isCompleteBuilderConnection(soloCreds)) {\n      return { creds: soloCreds, lookupFailed: false };\n    }\n  } catch (err) {\n    if (traceLookup) {\n      console.log(\n        `[builder-credential] email=${email} scope=${scopeAttempted} credentials error=${(err as Error)?.message ?? err}`,\n      );\n    }\n    return { creds: null, lookupFailed: true };\n  }\n  return { creds: null, lookupFailed: false };\n}\n\n/**\n * Resolve a Builder credential for the current request. User/org credentials\n * win; deployment env is only a fallback. This lets local/root .env keys keep\n * a template working while still allowing users to connect their own Builder\n * account from Settings or onboarding.\n */\nexport async function resolveBuilderCredential(\n  key: string,\n): Promise<string | null> {\n  const scoped = await resolveScopedBuilderCredential(key);\n  if (scoped) return scoped.value;\n  if (!canUseBuilderDeployCredentialFallbackForRequest()) return null;\n  return readDeployCredentialEnv(key) ?? null;\n}\n\n/**\n * True when `BUILDER_PRIVATE_KEY` is set at the deployment level. This means\n * a deploy-level fallback exists; it does not prevent per-user connect.\n */\nexport function isBuilderEnvManaged(): boolean {\n  return !!process.env.BUILDER_PRIVATE_KEY;\n}\n\n/**\n * Resolve the Builder private key for the current request. User/org OAuth\n * credentials win; deploy-level `BUILDER_PRIVATE_KEY` is the fallback.\n */\nexport async function resolveBuilderPrivateKey(): Promise<string | null> {\n  return resolveBuilderCredential(\"BUILDER_PRIVATE_KEY\");\n}\n\n/**\n * Resolve the current user's Builder auth header.\n * Returns `\"Bearer <key>\"` or null.\n */\nexport async function resolveBuilderAuthHeader(): Promise<string | null> {\n  const key = await resolveBuilderPrivateKey();\n  return key ? `Bearer ${key}` : null;\n}\n\n/**\n * Check whether the current user has a Builder private key configured\n * (per-user or deployment-level).\n */\nexport async function resolveHasBuilderPrivateKey(): Promise<boolean> {\n  return !!(await resolveBuilderPrivateKey());\n}\n\n/**\n * Check whether the current request has the complete Builder credential bundle\n * needed for Builder-backed assistant/image-generation calls.\n */\nexport async function resolveHasCompleteBuilderConnection(): Promise<boolean> {\n  const creds = await resolveBuilderCredentials();\n  return !!(creds.privateKey && creds.publicKey);\n}\n\n/**\n * Resolve where the effective Builder assistant connection came from. This\n * intentionally requires a complete private+public key pair from one scope so\n * status UIs don't report a mixed user/org credential set as connected.\n */\nexport async function resolveBuilderCredentialSource(): Promise<BuilderCredentialSource | null> {\n  const detailed = await resolveBuilderCredentialsDetailed();\n  return detailed.source;\n}\n\nexport interface BuilderCredentialsDetailed {\n  privateKey: string | null;\n  publicKey: string | null;\n  userId: string | null;\n  orgName: string | null;\n  orgKind: string | null;\n  subscription: string | null;\n  subscriptionLevel: string | null;\n  subscriptionName: string | null;\n  isEnterprise: boolean | null;\n  isFreeAccount: boolean | null;\n  /** Which scope answered, or null when nothing did. */\n  source: BuilderCredentialSource | null;\n  /**\n   * True when reading the credential store itself failed (db timeout, etc).\n   * Callers must report this as retryable rather than \"not configured\".\n   */\n  lookupFailed: boolean;\n}\n\n/**\n * Resolve the Builder assistant credential bundle from one complete scope,\n * plus where it came from and whether the credential-store read itself\n * failed. A partial user row is treated as a miss so the org-shared\n * connection can still power the assistant for teammates.\n *\n * Callers that only need the plain credential bundle (the historical shape)\n * should use `resolveBuilderCredentials()` instead.\n */\nexport async function resolveBuilderCredentialsDetailed(): Promise<BuilderCredentialsDetailed> {\n  const { creds: scoped, lookupFailed } =\n    await resolveScopedBuilderCredentials();\n  if (scoped) {\n    const {\n      privateKey,\n      publicKey,\n      userId,\n      orgName,\n      orgKind,\n      subscription,\n      subscriptionLevel,\n      subscriptionName,\n      isEnterprise,\n      isFreeAccount,\n      source,\n    } = scoped;\n    return {\n      privateKey,\n      publicKey,\n      userId,\n      orgName,\n      orgKind,\n      subscription,\n      subscriptionLevel,\n      subscriptionName,\n      isEnterprise,\n      isFreeAccount,\n      source,\n      lookupFailed: false,\n    };\n  }\n  const canUseEnv = canUseBuilderDeployCredentialFallbackForRequest();\n  const privateKey = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_PRIVATE_KEY\") ?? null)\n    : null;\n  const publicKey = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_PUBLIC_KEY\") ?? null)\n    : null;\n  const userId = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_USER_ID\") ?? null)\n    : null;\n  const orgName = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_ORG_NAME\") ?? null)\n    : null;\n  const orgKind = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_ORG_KIND\") ?? null)\n    : null;\n  const subscription = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION\") ?? null)\n    : null;\n  const subscriptionLevel = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION_LEVEL\") ?? null)\n    : null;\n  const subscriptionName = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION_NAME\") ?? null)\n    : null;\n  const isEnterprise = canUseEnv\n    ? readOptionalBuilderBoolean(\n        readDeployCredentialEnv(\"BUILDER_IS_ENTERPRISE\"),\n      )\n    : null;\n  const isFreeAccount = canUseEnv\n    ? readOptionalBuilderBoolean(\n        readDeployCredentialEnv(\"BUILDER_IS_FREE_ACCOUNT\"),\n      )\n    : null;\n  return {\n    privateKey,\n    publicKey,\n    userId,\n    orgName,\n    orgKind,\n    subscription,\n    subscriptionLevel,\n    subscriptionName,\n    isEnterprise,\n    isFreeAccount,\n    source: canUseEnv && privateKey ? \"env\" : null,\n    lookupFailed,\n  };\n}\n\n/**\n * Resolve the Builder assistant credential bundle from one complete scope.\n * Kept to its original return shape (no `source`/`lookupFailed`) for existing\n * callers; use `resolveBuilderCredentialsDetailed()` for those fields.\n */\nexport async function resolveBuilderCredentials(): Promise<{\n  privateKey: string | null;\n  publicKey: string | null;\n  userId: string | null;\n  orgName: string | null;\n  orgKind: string | null;\n  subscription: string | null;\n  subscriptionLevel: string | null;\n  subscriptionName: string | null;\n  isEnterprise: boolean | null;\n  isFreeAccount: boolean | null;\n}> {\n  const {\n    privateKey,\n    publicKey,\n    userId,\n    orgName,\n    orgKind,\n    subscription,\n    subscriptionLevel,\n    subscriptionName,\n    isEnterprise,\n    isFreeAccount,\n  } = await resolveBuilderCredentialsDetailed();\n  return {\n    privateKey,\n    publicKey,\n    userId,\n    orgName,\n    orgKind,\n    subscription,\n    subscriptionLevel,\n    subscriptionName,\n    isEnterprise,\n    isFreeAccount,\n  };\n}\n\nconst BUILDER_AUTH_FAILURE_SETTING_PREFIX = \"builder-auth-failure:\";\n/**\n * Stale markers expire so a rejected model or a transient gateway failure\n * cannot pin a signed-in user to \"Builder not connected\" forever. Only a\n * successful gateway call clears the marker early, and that call never happens\n * while the marker is what makes the connection look broken.\n */\nexport const BUILDER_AUTH_FAILURE_TTL_MS = 15 * 60 * 1000;\n\nexport interface BuilderCredentialAuthFailure {\n  fingerprint: string;\n  message: string;\n  status?: number;\n  code?: string;\n  at: number;\n  ownerEmail?: string | null;\n  orgId?: string | null;\n}\n\nexport function builderCredentialFingerprint(\n  privateKey?: string | null,\n  publicKey?: string | null,\n): string | null {\n  if (!privateKey || !publicKey) return null;\n  return createHash(\"sha256\")\n    .update(privateKey)\n    .update(\"\\0\")\n    .update(publicKey)\n    .digest(\"hex\")\n    .slice(0, 24);\n}\n\nfunction builderAuthFailureSettingKey(fingerprint: string): string {\n  return `${BUILDER_AUTH_FAILURE_SETTING_PREFIX}${fingerprint}`;\n}\n\nexport async function getBuilderCredentialAuthFailure(\n  creds: {\n    privateKey?: string | null;\n    publicKey?: string | null;\n  } = {},\n): Promise<BuilderCredentialAuthFailure | null> {\n  const fingerprint = builderCredentialFingerprint(\n    creds.privateKey,\n    creds.publicKey,\n  );\n  if (!fingerprint) return null;\n  try {\n    const settings = await import(\"../settings/store.js\");\n    const settingKey = builderAuthFailureSettingKey(fingerprint);\n    const row = await settings.getSetting(settingKey);\n    if (!row) return null;\n    const at = typeof row.at === \"number\" ? row.at : Date.now();\n    if (Date.now() - at > BUILDER_AUTH_FAILURE_TTL_MS) {\n      if (typeof settings.deleteSetting === \"function\") {\n        await settings.deleteSetting(settingKey).catch(() => {});\n      }\n      return null;\n    }\n    return {\n      fingerprint,\n      message:\n        typeof row.message === \"string\" && row.message\n          ? row.message\n          : \"Builder rejected the connected credentials. Reconnect Builder.io.\",\n      status: typeof row.status === \"number\" ? row.status : undefined,\n      code: typeof row.code === \"string\" ? row.code : undefined,\n      at,\n      ownerEmail:\n        typeof row.ownerEmail === \"string\" ? row.ownerEmail : undefined,\n      orgId: typeof row.orgId === \"string\" ? row.orgId : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function recordBuilderCredentialAuthFailure(details?: {\n  status?: number;\n  code?: string;\n  message?: string;\n}): Promise<void> {\n  try {\n    const creds = await resolveBuilderCredentials();\n    const fingerprint = builderCredentialFingerprint(\n      creds.privateKey,\n      creds.publicKey,\n    );\n    if (!fingerprint) return;\n    const { putSetting } = await import(\"../settings/store.js\");\n    await putSetting(builderAuthFailureSettingKey(fingerprint), {\n      fingerprint,\n      message:\n        details?.message ||\n        \"Builder rejected the connected credentials. Reconnect Builder.io.\",\n      ...(typeof details?.status === \"number\" && { status: details.status }),\n      ...(details?.code && { code: details.code }),\n      at: Date.now(),\n      ownerEmail: getRequestUserEmail() ?? null,\n      orgId: getRequestOrgId() ?? null,\n    });\n  } catch {\n    // Best-effort marker only; the chat error is still returned to the user.\n  }\n}\n\nexport async function clearBuilderCredentialAuthFailure(creds: {\n  privateKey?: string | null;\n  publicKey?: string | null;\n}): Promise<void> {\n  const fingerprint = builderCredentialFingerprint(\n    creds.privateKey,\n    creds.publicKey,\n  );\n  if (!fingerprint) return;\n  try {\n    const { deleteSetting } = await import(\"../settings/store.js\");\n    await deleteSetting(builderAuthFailureSettingKey(fingerprint));\n  } catch {\n    // A stale failure marker should not block writing fresh credentials.\n  }\n}\n\nconst PROVIDER_AUTH_FAILURE_SETTING_PREFIX = \"provider-auth-failure:\";\n/** Stale failure markers expire so a transient 401 cannot permanently block deploy keys. */\nexport const PROVIDER_AUTH_FAILURE_TTL_MS = 15 * 60 * 1000;\n\nexport interface ProviderCredentialAuthFailure {\n  fingerprint: string;\n  key: string;\n  message: string;\n  status?: number;\n  code?: string;\n  at: number;\n  ownerEmail?: string | null;\n  orgId?: string | null;\n}\n\nexport function providerCredentialFingerprint(\n  key?: string | null,\n  value?: string | null,\n): string | null {\n  const normalizedKey = key?.trim().toUpperCase();\n  const normalizedValue = value?.trim();\n  if (!normalizedKey || !normalizedValue) return null;\n  return createHash(\"sha256\")\n    .update(normalizedKey)\n    .update(\"\\0\")\n    .update(normalizedValue)\n    .digest(\"hex\")\n    .slice(0, 24);\n}\n\nfunction providerAuthFailureSettingKey(fingerprint: string): string {\n  return `${PROVIDER_AUTH_FAILURE_SETTING_PREFIX}${fingerprint}`;\n}\n\nexport async function getProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n}): Promise<ProviderCredentialAuthFailure | null> {\n  const key = opts.key?.trim().toUpperCase() ?? \"\";\n  const fingerprint = providerCredentialFingerprint(key, opts.value);\n  if (!fingerprint) return null;\n  try {\n    const settings = await import(\"../settings/store.js\");\n    const settingKey = providerAuthFailureSettingKey(fingerprint);\n    const row = await settings.getSetting(settingKey);\n    if (!row) return null;\n    if (row.fingerprint !== fingerprint) return null;\n    const at = typeof row.at === \"number\" ? row.at : Date.now();\n    if (Date.now() - at > PROVIDER_AUTH_FAILURE_TTL_MS) {\n      if (typeof settings.deleteSetting === \"function\") {\n        await settings.deleteSetting(settingKey).catch(() => {});\n      }\n      return null;\n    }\n    return {\n      fingerprint,\n      key:\n        typeof row.key === \"string\" && row.key\n          ? row.key\n          : key || \"UNKNOWN_PROVIDER_KEY\",\n      message:\n        typeof row.message === \"string\" && row.message\n          ? row.message\n          : \"The model provider rejected the saved API key.\",\n      status: typeof row.status === \"number\" ? row.status : undefined,\n      code: typeof row.code === \"string\" ? row.code : undefined,\n      at,\n      ownerEmail:\n        typeof row.ownerEmail === \"string\" ? row.ownerEmail : undefined,\n      orgId: typeof row.orgId === \"string\" ? row.orgId : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function recordProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n  status?: number;\n  code?: string;\n  message?: string;\n}): Promise<void> {\n  try {\n    const key = opts.key?.trim().toUpperCase() ?? \"\";\n    const value = opts.value?.trim();\n    const fingerprint = providerCredentialFingerprint(key, value);\n    if (!fingerprint) return;\n    const { putSetting } = await import(\"../settings/store.js\");\n    await putSetting(providerAuthFailureSettingKey(fingerprint), {\n      fingerprint,\n      key,\n      message: opts.message || \"The model provider rejected the saved API key.\",\n      ...(typeof opts.status === \"number\" && { status: opts.status }),\n      ...(opts.code && { code: opts.code }),\n      at: Date.now(),\n      ownerEmail: getRequestUserEmail() ?? null,\n      orgId: getRequestOrgId() ?? null,\n    });\n  } catch {\n    // Best-effort marker only; the chat error is still returned to the user.\n  }\n}\n\nexport async function clearProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n}): Promise<void> {\n  const fingerprint = providerCredentialFingerprint(opts.key, opts.value);\n  if (!fingerprint) return;\n  try {\n    const { deleteSetting } = await import(\"../settings/store.js\");\n    await deleteSetting(providerAuthFailureSettingKey(fingerprint));\n  } catch {\n    // A stale failure marker should not block writing or using fresh keys.\n  }\n}\n\n/**\n * Write Builder credentials to `app_secrets`.\n *\n * Scope decision (see `resolveCredentialWriteScope`): when the connecting\n * user is owner/admin of an active org we write at `scope: \"org\"` so every\n * member of that org auto-resolves the credentials via\n * `resolveBuilderCredential`'s org fallback — no per-user re-connect\n * needed. A plain member or a user with no active org writes at\n * `scope: \"user\"` (the safe default that doesn't trample the org's shared\n * connection).\n *\n * Stale-credential cleanup: before writing the new values we (1) clear ALL\n * five BUILDER_* keys at the target scope, so optional fields the new\n * connection doesn't carry (e.g. user picked a Builder space that returns\n * no orgName) don't leave the previous connection's metadata behind, and\n * (2) when writing at org scope, also clear the writer's own user-scope\n * BUILDER_* rows so a stale personal override from an earlier connect\n * doesn't shadow the new org write on resolution (user scope wins org\n * scope by design — see `resolveScopedBuilderCredential`). The org-scope\n * row is intentionally left alone when writing at user scope: that row is\n * shared with the rest of the org and a single user's personal override\n * shouldn't blow it away. (Victoria's \"I signed in again with my Builder\n * space and it still says no credits\" report on 2026-05-11 was exactly\n * this stale-shadow case.)\n *\n * Returns the actual scope/scopeId used so the caller can show \"Connected\n * for Builder.io\" vs \"Connected (personal)\" in the UI.\n */\nexport async function writeBuilderCredentials(\n  email: string,\n  creds: {\n    privateKey: string;\n    publicKey: string;\n    userId?: string | null;\n    orgName?: string | null;\n    orgKind?: string | null;\n    subscription?: string | null;\n    subscriptionLevel?: string | null;\n    subscriptionName?: string | null;\n    isEnterprise?: boolean | null;\n    isFreeAccount?: boolean | null;\n  },\n  options?: { orgId?: string | null; role?: string | null },\n): Promise<{ scope: \"user\" | \"org\"; scopeId: string }> {\n  const privateKey = creds.privateKey.trim();\n  const publicKey = creds.publicKey.trim();\n  if (!isBuilderPrivateKey(privateKey)) {\n    throw new Error(\n      \"Builder returned a credential that is not a Builder private key (expected bpk-...). Restart the Builder connect flow and choose a space that can issue a private key.\",\n    );\n  }\n  if (!publicKey) {\n    throw new Error(\n      \"Builder did not return a public API key. Restart the Builder connect flow.\",\n    );\n  }\n\n  const { writeAppSecret, deleteAppSecret } =\n    await import(\"../secrets/storage.js\");\n  const target = resolveCredentialWriteScope(\n    email,\n    options?.orgId ?? null,\n    options?.role ?? null,\n  );\n\n  // Clear stale rows before writing the new connection. See the function's\n  // doc comment for the two cases this handles.\n  const cleanups: Array<Promise<unknown>> = BUILDER_CREDENTIAL_KEYS.map((key) =>\n    deleteAppSecret({\n      key,\n      scope: target.scope,\n      scopeId: target.scopeId,\n    }).catch(() => {}),\n  );\n  if (target.scope === \"org\") {\n    for (const key of BUILDER_CREDENTIAL_KEYS) {\n      cleanups.push(\n        deleteAppSecret({ key, scope: \"user\", scopeId: email }).catch(() => {}),\n      );\n    }\n  }\n  await Promise.all(cleanups);\n\n  const entries: Array<{ key: string; value: string }> = [\n    { key: \"BUILDER_PRIVATE_KEY\", value: privateKey },\n    { key: \"BUILDER_PUBLIC_KEY\", value: publicKey },\n  ];\n  if (creds.userId) {\n    entries.push({ key: \"BUILDER_USER_ID\", value: creds.userId });\n  }\n  if (creds.orgName) {\n    entries.push({ key: \"BUILDER_ORG_NAME\", value: creds.orgName });\n  }\n  if (creds.orgKind) {\n    entries.push({ key: \"BUILDER_ORG_KIND\", value: creds.orgKind });\n  }\n  if (creds.subscription) {\n    entries.push({ key: \"BUILDER_SUBSCRIPTION\", value: creds.subscription });\n  }\n  if (creds.subscriptionLevel) {\n    entries.push({\n      key: \"BUILDER_SUBSCRIPTION_LEVEL\",\n      value: creds.subscriptionLevel,\n    });\n  }\n  if (creds.subscriptionName) {\n    entries.push({\n      key: \"BUILDER_SUBSCRIPTION_NAME\",\n      value: creds.subscriptionName,\n    });\n  }\n  if (typeof creds.isEnterprise === \"boolean\") {\n    entries.push({\n      key: \"BUILDER_IS_ENTERPRISE\",\n      value: String(creds.isEnterprise),\n    });\n  }\n  if (typeof creds.isFreeAccount === \"boolean\") {\n    entries.push({\n      key: \"BUILDER_IS_FREE_ACCOUNT\",\n      value: String(creds.isFreeAccount),\n    });\n  }\n  await Promise.all(\n    entries.map(({ key, value }) =>\n      writeAppSecret({\n        key,\n        value,\n        scope: target.scope,\n        scopeId: target.scopeId,\n      }),\n    ),\n  );\n  await clearBuilderCredentialAuthFailure({\n    privateKey,\n    publicKey,\n  });\n  return target;\n}\n\n/**\n * Delete Builder credentials.\n *\n * Default behaviour: clears only this user's per-user override (so a\n * member can disconnect their personal Builder identity without\n * collapsing the org-wide connection for every teammate). To revoke the\n * org's shared connection, pass `{ orgId, role }` for an owner/admin —\n * matching the same authority gate `writeBuilderCredentials` uses on\n * write. Plain members can never reach the org-scoped row.\n */\nexport async function deleteBuilderCredentials(\n  email: string,\n  options?: { orgId?: string | null; role?: string | null },\n): Promise<{ scope: \"user\" | \"org\"; scopeId: string }> {\n  const { deleteAppSecret } = await import(\"../secrets/storage.js\");\n  const target = resolveCredentialWriteScope(\n    email,\n    options?.orgId ?? null,\n    options?.role ?? null,\n  );\n  await Promise.all(\n    BUILDER_CREDENTIAL_KEYS.map((key) =>\n      deleteAppSecret({\n        key,\n        scope: target.scope,\n        scopeId: target.scopeId,\n      }).catch(() => {}),\n    ),\n  );\n  return target;\n}\n\n// ---------------------------------------------------------------------------\n// Generic request-scoped secret resolution\n//\n// New consumers should prefer this over reading `process.env.X` directly.\n// User-pasted and shared secrets live in `app_secrets` (encrypted). The\n// settings UI / onboarding panels can write user, org, or workspace rows.\n// Deploy-level env vars are the fallback for unauthenticated/CLI/background\n// contexts where there's no user to scope by. Authenticated requests may also\n// use app-provided LLM provider keys such as OPENAI_API_KEY or\n// ANTHROPIC_API_KEY, but Builder identity keys keep the stricter scoped policy.\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve a request-scoped secret. Reads from `app_secrets` first (current\n * user override, active org, then workspace row); falls back to `process.env`\n * only when the deploy fallback policy allows it.\n */\nexport async function resolveSecret(key: string): Promise<string | null> {\n  const traceLookup = shouldTraceCredentialResolve();\n  const email = getRequestUserEmail();\n  if (email) {\n    try {\n      const { readAppSecret } = await import(\"../secrets/storage.js\");\n      // Per-user override first.\n      const userSecret = await readAppSecret({\n        key,\n        scope: \"user\",\n        scopeId: email,\n      });\n      if (userSecret?.value) {\n        if (traceLookup) {\n          console.log(\n            `[resolve-secret] key=${key} email=${email} scope=user hit=true`,\n          );\n        }\n        return userSecret.value;\n      }\n\n      const orgId = getRequestOrgId();\n      if (orgId) {\n        // Fall back to the active org's shared row, when present. Builder\n        // Connect uses this first-class org scope.\n        const orgSecret = await readAppSecret({\n          key,\n          scope: \"org\",\n          scopeId: orgId,\n        });\n        if (orgSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} orgId=${orgId} scope=org hit=true`,\n            );\n          }\n          return orgSecret.value;\n        }\n\n        // Registered secrets historically used \"workspace\" scope for\n        // org-shared configuration. Keep reading it so Settings status and\n        // runtime resolution agree.\n        const workspaceSecret = await readAppSecret({\n          key,\n          scope: \"workspace\",\n          scopeId: orgId,\n        });\n        if (workspaceSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} orgId=${orgId} scope=workspace hit=true`,\n            );\n          }\n          return workspaceSecret.value;\n        }\n      } else {\n        const soloWorkspaceSecret = await readAppSecret({\n          key,\n          scope: \"workspace\",\n          scopeId: `solo:${email}`,\n        });\n        if (soloWorkspaceSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} scope=workspace-solo hit=true`,\n            );\n          }\n          return soloWorkspaceSecret.value;\n        }\n      }\n    } catch (err) {\n      if (traceLookup) {\n        console.log(\n          `[resolve-secret] key=${key} email=${email} scope=error err=${(err as Error)?.message ?? err}`,\n        );\n      }\n      // Secrets table not ready — treat as missing.\n    }\n    // Read deployment-provided env values as fallbacks; framework code must not\n    // write to `process.env`, but keys supplied by the host remain valid config.\n    // Builder credentials keep a narrower path below because those keys carry a\n    // Builder identity rather than just enabling a provider call.\n    const envFallback = (\n      isBuilderCredentialKey(key)\n        ? canUseBuilderDeployCredentialFallbackForRequest()\n        : canUseDeployCredentialFallbackForRequest(key)\n    )\n      ? process.env[key] || null\n      : null;\n    if (traceLookup) {\n      console.log(\n        `[resolve-secret] key=${key} email=${email} orgId=${getRequestOrgId() ?? \"(none)\"} scope=${envFallback ? \"env-fallback\" : \"none\"} hit=${!!envFallback}`,\n      );\n    }\n    return envFallback;\n  }\n  // Unauthenticated / local-dev / CLI / background context: env fallback\n  // is safe because there's no user to mis-identify.\n  const value = process.env[key] || null;\n  if (traceLookup) {\n    console.log(\n      `[resolve-secret] key=${key} email=(none) scope=env-anonymous hit=${!!value}`,\n    );\n  }\n  return value;\n}\n\n// ---------------------------------------------------------------------------\n// Synchronous helpers — env-only fallbacks for contexts where per-user\n// lookup isn't possible (sync isConfigured checks, CLI scripts).\n// ---------------------------------------------------------------------------\n\n/**\n * True when a Builder private key is configured at the deployment level.\n *\n * This is the same env-only check as `isBuilderEnvManaged()`. For \"does this\n * request have access to Builder via user/org/env credentials?\" use the async\n * `resolveHasBuilderPrivateKey()`.\n */\nexport function hasBuilderPrivateKey(): boolean {\n  return !!process.env.BUILDER_PRIVATE_KEY;\n}\n\n/** The origin for Builder-proxied API calls. Overridable for testing. */\nexport function getBuilderProxyOrigin(): string {\n  return (\n    process.env.BUILDER_PROXY_ORIGIN ||\n    process.env.AIR_HOST ||\n    process.env.BUILDER_API_HOST ||\n    \"https://api.builder.io\"\n  );\n}\n\n/**\n * Base URL for the public Builder LLM gateway, which lives at\n * api.builder.io/agent-native/gateway.\n * Override via BUILDER_GATEWAY_BASE_URL for staging / testing.\n */\nexport function getBuilderGatewayBaseUrl(): string {\n  return (\n    process.env.BUILDER_GATEWAY_BASE_URL ||\n    \"https://api.builder.io/agent-native/gateway/v1\"\n  );\n}\n\n/**\n * Base URL for Builder-managed image generation.\n * Override via BUILDER_IMAGE_GENERATION_BASE_URL for staging / testing.\n */\nexport function getBuilderImageGenerationBaseUrl(): string {\n  return (\n    process.env.BUILDER_IMAGE_GENERATION_BASE_URL ||\n    \"https://api.builder.io/agent-native/images/v1\"\n  );\n}\n\n/**\n * Base URL for Builder-managed web search.\n * Override via BUILDER_WEB_SEARCH_BASE_URL for staging / testing.\n */\nexport function getBuilderWebSearchBaseUrl(): string {\n  return (\n    process.env.BUILDER_WEB_SEARCH_BASE_URL ||\n    \"https://api.builder.io/agent-native/web-search/v1\"\n  );\n}\n\n/** Authorization header value for Builder-proxied calls (env-only). */\nexport function getBuilderAuthHeader(): string | null {\n  const key = process.env.BUILDER_PRIVATE_KEY;\n  return key ? `Bearer ${key}` : null;\n}\n"]}
+{"version":3,"file":"credential-provider.js","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,uCAAuC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAa,EACb,KAAgC,EAChC,IAA+B;IAE/B,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,iBAAiB,CAAU;IAC3B,WAAW,CAAU;IAE9B,YAAY,IAKX;QACC,KAAK,CACH,IAAI,CAAC,OAAO;YACV,gCAAgC,IAAI,CAAC,kBAAkB,yCAAyC,CACnG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,SAAS,GAAG,uCAAuC,CAAC;IACpD,SAAS,GAAG,IAAI,CAAC;IAE1B,YAAY,KAAe;QACzB,KAAK,CACH,oHAAoH,EACpH,EAAE,KAAK,EAAE,CACV,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAG7C;IACC,IAAI,MAAM,CAAC,YAAY,IAAI,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;AACvC,CAAC;AAED,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC;IAClD,mBAAmB;IACnB,YAAY;IACZ,8BAA8B;IAC9B,qBAAqB;IACrB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;IACtB,8BAA8B;IAC9B,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,gCAAgC,CAAC,GAAuB;IAC/D,OAAO,CAAC,CAAC,GAAG,IAAI,mCAAmC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iCAAiC;IAC/C,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,GAAY;IAEZ,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,gCAAgC,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,wBAAwB,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,sBAAsB;IACtB,4BAA4B;IAC5B,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;CACjB,CAAC;AAEX,SAAS,sBAAsB,CAAC,GAAW;IACzC,OAAQ,uBAA6C,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,gBAAgB,GAAG,OAAO,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CACnC,CAAC;IACF,OAAO,CACL,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QAC5D,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAAC;QACjE,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC9C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC7B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,SAAS;YACrB,OAAO,CAAC,GAAG,CAAC,MAAM,CACnB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,+CAA+C;IACtD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;IACtD,6EAA6E;IAC7E,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,aAAa,GACjB,CAAC,mBAAmB;QACpB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAEvE,IAAI,wBAAwB,EAAE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAE/D,4EAA4E;IAC5E,OAAO,CAAC,mBAAmB,IAAI,eAAe,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO,aAAa,CAAC,IAAI,CACvB,OAAO,CAAC,GAAG,CAAC,qCAAqC;QAC/C,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,EAAE,CACL,CAAC;AACJ,CAAC;AAgCD,SAAS,2BAA2B,CAAC,KAAiC;IACpE,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAgC;IAEhC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAgC;IAClE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,cAAqE,EACrE,KAAmC,EACnC,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC;QACnC,IAAI,EAAE,uBAAuB;QAC7B,KAAK;QACL,OAAO;KACR,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,GAAW,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAC9E,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,qBAAqB,CAAC;QACxC,SAAS,EAAE,KAAK,CAAC,oBAAoB,CAAC;QACtC,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,kBAAkB,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,kBAAkB,CAAC;QAClC,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC;QAC3C,iBAAiB,EAAE,KAAK,CAAC,4BAA4B,CAAC;QACtD,gBAAgB,EAAE,KAAK,CAAC,2BAA2B,CAAC;QACpD,YAAY,EAAE,0BAA0B,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACxE,aAAa,EAAE,0BAA0B,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3E,MAAM,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK;KACpD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,2BAA2B,CACxC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,kEAAkE;QAClE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAcD,MAAM,SAAS,GAA2B;IACxC,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,YAAY,EAAE,KAAK;CACpB,CAAC;AAEF,KAAK,UAAU,8BAA8B,CAC3C,GAAW;IAEX,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,cAAc,GAAG,MAAM,CAAC;IAC5B,IAAI,cAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEhE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;YACrC,GAAG;YACH,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,sBAAsB,CACrE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC1E,CAAC;QAED,IAAI,KAAK,GAA8B,eAAe,EAAE,CAAC;QACzD,IAAI,SAAS,GAA0C,KAAK;YAC1D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC;QACX,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;YAC1D,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC;YAChC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YACvB,IAAI,KAAK;gBAAE,SAAS,GAAG,gBAAgB,CAAC;QAC1C,CAAC;QAED,mEAAmE;QACnE,iEAAiE;QACjE,+DAA+D;QAC/D,6DAA6D;QAC7D,mEAAmE;QACnE,IAAI,KAAK,EAAE,CAAC;YACV,cAAc,GAAG,KAAK,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;gBACpC,GAAG;gBACH,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,cAAc,SAAS,qBAAqB,CAC1G,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YACxE,CAAC;YAED,iEAAiE;YACjE,qEAAqE;YACrE,yEAAyE;YACzE,cAAc,GAAG,WAAW,CAAC;YAC7B,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC;gBAC1C,GAAG;gBACH,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,cAAc,SAAS,2BAA2B,CAChH,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,KAAK,EAAE,eAAe,CAAC,KAAK;oBAC5B,MAAM,EAAE,WAAW;oBACnB,YAAY,EAAE,KAAK;iBACpB,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,cAAc,SAAS,gCAAgC,CACrH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,2EAA2E;QAC3E,oCAAoC;QACpC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,YAAY,EAAE,IAAI;gBAClB,KAAK,EAAE,cAAc;aACtB,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,mEAAmE;QACnE,uCAAuC;QACvC,cAAc,GAAG,gBAAgB,CAAC;QAClC,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC;YAC9C,GAAG;YACH,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,QAAQ,KAAK,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,IAAI,QAAQ,cAAc,SAAS,gCAAgC,CACjI,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,mBAAmB,CAAC,KAAK;gBAChC,MAAM,EAAE,WAAW;gBACnB,YAAY,EAAE,KAAK;aACpB,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,IAAI,QAAQ,cAAc,SAAS,eAAe,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CACrL,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,cAAc,UAAW,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CACjH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACvE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,cAAc,KAAK,SAAS;QAC1C,KAAK,EAAE,cAAc;KACtB,CAAC;AACJ,CAAC;AAcD,KAAK,UAAU,+BAA+B;IAC5C,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAExD,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,cAAc,GAAG,MAAM,CAAC;IAC5B,IAAI,cAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,CACjB,KAAiC,EACjC,OAAe,EACf,KAAK,GAAG,EAAE,EACV,EAAE;YACF,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,OAAO,CAAC,GAAG,CACT,8BAA8B,KAAK,CAAC,MAAM,YAAY,OAAO,UAAU,KAAK,GAAG,KAAK,aAAa,2BAA2B,CAAC,KAAK,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAC9M,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,cAAc,EACd,MAAM,EACN,KAAK,CACN,CAAC;QACF,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,KAAK,GAA8B,eAAe,EAAE,CAAC;QACzD,IAAI,SAAS,GAA0C,KAAK;YAC1D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC;QACX,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;YAC1D,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC;YAChC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YACvB,IAAI,KAAK;gBAAE,SAAS,GAAG,gBAAgB,CAAC;QAC1C,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,cAAc,GAAG,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,cAAc,EACd,KAAK,EACL,KAAK,CACN,CAAC;YACF,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,SAAS,EAAE,CAAC,CAAC;YACvD,IAAI,2BAA2B,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YAClD,CAAC;YAED,cAAc,GAAG,WAAW,CAAC;YAC7B,MAAM,cAAc,GAAG,MAAM,0BAA0B,CACrD,cAAc,EACd,WAAW,EACX,KAAK,CACN,CAAC;YACF,UAAU,CAAC,cAAc,EAAE,KAAK,EAAE,cAAc,SAAS,EAAE,CAAC,CAAC;YAC7D,IAAI,2BAA2B,CAAC,cAAc,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACpE,CAAC;QAED,yEAAyE;QACzE,qEAAqE;QACrE,yBAAyB;QACzB,cAAc,GAAG,gBAAgB,CAAC;QAClC,MAAM,WAAW,GAAG,QAAQ,KAAK,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,cAAc,EACd,WAAW,EACX,WAAW,CACZ,CAAC;QACF,UAAU,CACR,SAAS,EACT,WAAW,EACX,UAAU,KAAK,IAAI,QAAQ,cAAc,SAAS,EAAE,CACrD,CAAC;QACF,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,8BAA8B,KAAK,UAAU,cAAc,sBAAuB,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAClH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACzD,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,cAAc,KAAK,SAAS;QAC1C,KAAK,EAAE,cAAc;KACtB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,+CAA+C,EAAE;QAChE,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,uEAAuE;IACvE,8CAA8C;IAC9C,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,GAAG,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,OAAO,CAAC,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IACvD,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B;IAClD,MAAM,QAAQ,GAAG,MAAM,iCAAiC,EAAE,CAAC;IAC3D,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAwBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC;IACrD,MAAM,EACJ,KAAK,EAAE,MAAM,EACb,YAAY,EACZ,KAAK,GACN,GAAG,MAAM,+BAA+B,EAAE,CAAC;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EACJ,UAAU,EACV,SAAS,EACT,MAAM,EACN,OAAO,EACP,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,MAAM,GACP,GAAG,MAAM,CAAC;QACX,OAAO;YACL,UAAU;YACV,SAAS;YACT,MAAM;YACN,OAAO;YACP,OAAO;YACP,YAAY;YACZ,iBAAiB;YACjB,gBAAgB;YAChB,YAAY;YACZ,aAAa;YACb,MAAM;YACN,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,+CAA+C,EAAE,CAAC;IACpE,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC,CAAC,uBAAuB,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,SAAS,GAAG,SAAS;QACzB,CAAC,CAAC,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,MAAM,GAAG,SAAS;QACtB,CAAC,CAAC,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,iBAAiB,GAAG,SAAS;QACjC,CAAC,CAAC,CAAC,uBAAuB,CAAC,4BAA4B,CAAC,IAAI,IAAI,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,SAAS;QAChC,CAAC,CAAC,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,IAAI,IAAI,CAAC;QAChE,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC,0BAA0B,CACxB,uBAAuB,CAAC,uBAAuB,CAAC,CACjD;QACH,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,aAAa,GAAG,SAAS;QAC7B,CAAC,CAAC,0BAA0B,CACxB,uBAAuB,CAAC,yBAAyB,CAAC,CACnD;QACH,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,UAAU;QACV,SAAS;QACT,MAAM;QACN,OAAO;QACP,OAAO;QACP,YAAY;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,aAAa;QACb,MAAM,EAAE,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC9C,YAAY;QACZ,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAY7C,MAAM,EACJ,UAAU,EACV,SAAS,EACT,MAAM,EACN,OAAO,EACP,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,GAAG,MAAM,iCAAiC,EAAE,CAAC;IAC9C,OAAO;QACL,UAAU;QACV,SAAS;QACT,MAAM;QACN,OAAO;QACP,OAAO;QACP,YAAY;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AACpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAY1D,MAAM,UAAU,4BAA4B,CAC1C,UAA0B,EAC1B,SAAyB;IAEzB,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,4BAA4B,CAAC,WAAmB;IACvD,OAAO,GAAG,mCAAmC,GAAG,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAK,GAGD,EAAE;IAEN,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,2BAA2B,EAAE,CAAC;YAClD,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjD,MAAM,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,WAAW;YACX,OAAO,EACL,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;gBAC5C,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,mEAAmE;YACzE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzD,EAAE;YACF,UAAU,EACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,OAIxD;IACC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;QACF,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,UAAU,CAAC,4BAA4B,CAAC,WAAW,CAAC,EAAE;YAC1D,WAAW;YACX,OAAO,EACL,OAAO,EAAE,OAAO;gBAChB,mEAAmE;YACrE,GAAG,CAAC,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5C,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,UAAU,EAAE,mBAAmB,EAAE,IAAI,IAAI;YACzC,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;AACH,CAAC;AAED,MAAM,oCAAoC,GAAG,wBAAwB,CAAC;AACtE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAa3D,MAAM,UAAU,6BAA6B,CAC3C,GAAmB,EACnB,KAAqB;IAErB,MAAM,aAAa,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,eAAe,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,6BAA6B,CAAC,WAAmB;IACxD,OAAO,GAAG,oCAAoC,GAAG,WAAW,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,IAGtD;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,4BAA4B,EAAE,CAAC;YACnD,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjD,MAAM,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,WAAW;YACX,GAAG,EACD,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG;gBACpC,CAAC,CAAC,GAAG,CAAC,GAAG;gBACT,CAAC,CAAC,GAAG,IAAI,sBAAsB;YACnC,OAAO,EACL,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;gBAC5C,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,gDAAgD;YACtD,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzD,EAAE;YACF,UAAU,EACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,IAMzD;IACC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,UAAU,CAAC,6BAA6B,CAAC,WAAW,CAAC,EAAE;YAC3D,WAAW;YACX,GAAG;YACH,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gDAAgD;YACzE,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,UAAU,EAAE,mBAAmB,EAAE,IAAI,IAAI;YACzC,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,IAGxD;IACC,MAAM,WAAW,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,KAWC,EACD,OAAyD;IAEzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,uKAAuK,CACxK,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GACvC,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,2BAA2B,CACxC,KAAK,EACL,OAAO,EAAE,KAAK,IAAI,IAAI,EACtB,OAAO,EAAE,IAAI,IAAI,IAAI,CACtB,CAAC;IAEF,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,QAAQ,GAA4B,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC5E,eAAe,CAAC;QACd,GAAG;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACnB,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE5B,MAAM,OAAO,GAA0C;QACrD,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,UAAU,EAAE;QACjD,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE;KAChD,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,4BAA4B;YACjC,KAAK,EAAE,KAAK,CAAC,iBAAiB;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,2BAA2B;YAChC,KAAK,EAAE,KAAK,CAAC,gBAAgB;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,uBAAuB;YAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,yBAAyB;YAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAC7B,cAAc,CAAC;QACb,GAAG;QACH,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CACH,CACF,CAAC;IACF,MAAM,iCAAiC,CAAC;QACtC,UAAU;QACV,SAAS;KACV,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAa,EACb,OAAyD;IAEzD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,2BAA2B,CACxC,KAAK,EACL,OAAO,EAAE,KAAK,IAAI,IAAI,EACtB,OAAO,EAAE,IAAI,IAAI,IAAI,CACtB,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAClC,eAAe,CAAC;QACd,GAAG;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACnB,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,+DAA+D;AAC/D,gFAAgF;AAChF,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;IAC1C,0EAA0E;IAC1E,uEAAuE;IACvE,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAW;IAEX,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAc,CAAC;IACnB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAChE,2BAA2B;YAC3B,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;gBACrC,GAAG;gBACH,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,UAAU,EAAE,KAAK,EAAE,CAAC;gBACtB,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,sBAAsB,CACjE,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YAC1D,CAAC;YAED,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,KAAK,GAA8B,eAAe,EAAE,CAAC;YACzD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;gBAC1D,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;gBACvB,YAAY,GAAG,KAAK,KAAK,SAAS,CAAC;gBACnC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YACzB,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,kEAAkE;gBAClE,2CAA2C;gBAC3C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;oBACpC,GAAG;oBACH,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;oBACrB,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,KAAK,qBAAqB,CAC/E,CAAC;oBACJ,CAAC;oBACD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;gBACzD,CAAC;gBAED,6DAA6D;gBAC7D,mEAAmE;gBACnE,4BAA4B;gBAC5B,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC;oBAC1C,GAAG;oBACH,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,eAAe,EAAE,KAAK,EAAE,CAAC;oBAC3B,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,KAAK,2BAA2B,CACrF,CAAC;oBACJ,CAAC;oBACD,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;YAED,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACpD,CAAC;YAED,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,gEAAgE;YAChE,8DAA8D;YAC9D,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC;gBAC9C,GAAG;gBACH,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,QAAQ,KAAK,EAAE;aACzB,CAAC,CAAC;YACH,IAAI,mBAAmB,EAAE,KAAK,EAAE,CAAC;gBAC/B,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,KAAK,IAAI,QAAQ,gCAAgC,CACtG,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,oBAAqB,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAC/F,CAAC;YACJ,CAAC;YACD,yEAAyE;YACzE,oCAAoC;YACpC,YAAY,GAAG,IAAI,CAAC;YACpB,KAAK,GAAG,GAAG,CAAC;QACd,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,8DAA8D;QAC9D,MAAM,WAAW,GAAG,CAClB,sBAAsB,CAAC,GAAG,CAAC;YACzB,CAAC,CAAC,+CAA+C,EAAE;YACnD,CAAC,CAAC,wCAAwC,CAAC,GAAG,CAAC,CAClD;YACC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;YAC1B,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,eAAe,EAAE,IAAI,QAAQ,UAAU,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,WAAW,EAAE,CACxJ,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,YAAY,EAAE,YAAY,IAAI,CAAC,WAAW;YAC1C,KAAK;SACN,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvC,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,yCAAyC,CAAC,CAAC,KAAK,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,iEAAiE;AACjE,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qBAAqB;IACnC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,iCAAiC;QAC7C,+CAA+C,CAChD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACvC,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Credential provider abstraction.\n *\n * Every feature that needs an external credential (Anthropic API key,\n * Google OAuth tokens, OpenAI key, Slack bot token, etc.) should go through\n * one of the resolve*() helpers here instead of reading `process.env`\n * directly. That way the same feature can work in three modes:\n *\n *   1. User set their own key in .env              → use it directly\n *   2. User connected Builder via `/cli-auth`      → route through Builder proxy\n *   3. Neither                                      → throw FeatureNotConfigured\n *\n * Templates catch FeatureNotConfigured and show a \"Connect Builder (1 click) /\n * set up your own key (guide)\" card.\n *\n * Today these helpers are used by the Builder-hosted LLM gateway, and the\n * shape is meant to grow to cover future managed credential integrations\n * (e.g. additional Builder-hosted services) without rewrites.\n */\n\nimport { createHash } from \"node:crypto\";\n\nimport { CREDENTIAL_STORE_UNAVAILABLE_ERROR_CODE } from \"../agent/engine/credential-errors.js\";\nimport { isLocalDatabase, isTransientDatabaseError } from \"../db/client.js\";\nimport { getRequestUserEmail, getRequestOrgId } from \"./request-context.js\";\n\n/**\n * Decide which `app_secrets` scope a Builder/credential write should use.\n *\n * Org scope (\"everyone in this org sees these credentials\") wins when the\n * connecting user is an owner or admin of an active org — the write\n * privileges shared infra. A plain member or a user without an active\n * org falls through to per-user scope so a teammate can't silently\n * overwrite the org-shared connection.\n */\nexport function resolveCredentialWriteScope(\n  email: string,\n  orgId: string | null | undefined,\n  role: string | null | undefined,\n): { scope: \"user\" | \"org\"; scopeId: string } {\n  if (orgId && (role === \"owner\" || role === \"admin\")) {\n    return { scope: \"org\", scopeId: orgId };\n  }\n  return { scope: \"user\", scopeId: email };\n}\n\nexport class FeatureNotConfiguredError extends Error {\n  readonly requiredCredential: string;\n  readonly builderConnectUrl?: string;\n  readonly byokDocsUrl?: string;\n\n  constructor(opts: {\n    requiredCredential: string;\n    message?: string;\n    builderConnectUrl?: string;\n    byokDocsUrl?: string;\n  }) {\n    super(\n      opts.message ??\n        `Feature requires credential \"${opts.requiredCredential}\". Connect Builder or set your own key.`,\n    );\n    this.name = \"FeatureNotConfiguredError\";\n    this.requiredCredential = opts.requiredCredential;\n    this.builderConnectUrl = opts.builderConnectUrl;\n    this.byokDocsUrl = opts.byokDocsUrl;\n  }\n}\n\n/**\n * The credential store could not be read — which is NOT the same as the\n * credential being absent. Never render this as \"not configured\": the user has\n * nothing to configure, they have something to retry.\n */\nexport class CredentialStoreUnavailableError extends Error {\n  readonly errorCode = CREDENTIAL_STORE_UNAVAILABLE_ERROR_CODE;\n  readonly retryable = true;\n\n  constructor(cause?: unknown) {\n    super(\n      \"Could not read your saved connections — the app database did not answer. This is temporary; try again in a moment.\",\n      { cause },\n    );\n    this.name = \"CredentialStoreUnavailableError\";\n  }\n}\n\n/**\n * The one place that decides when an unanswered credential lookup becomes a\n * user-visible retryable error. A store that is not configured at all is a real\n * \"no credential\"; a store that timed out or dropped the connection is not.\n */\nexport function assertCredentialStoreReadable(result: {\n  lookupFailed: boolean;\n  cause?: unknown;\n}): void {\n  if (result.lookupFailed && isTransientDatabaseError(result.cause)) {\n    throw new CredentialStoreUnavailableError(result.cause);\n  }\n}\n\n/**\n * Deployment-level credential fallback for single-tenant/local operation.\n * Multi-tenant call sites must gate this explicitly before calling.\n */\nexport function readDeployCredentialEnv(key: string): string | undefined {\n  return process.env[key] || undefined;\n}\n\nconst APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([\n  \"ANTHROPIC_API_KEY\",\n  \"EMAIL_FROM\",\n  \"EMAIL_INBOUND_WEBHOOK_SECRET\",\n  \"EMAIL_AGENT_ADDRESS\",\n  \"OPENAI_API_KEY\",\n  \"OPENAI_BASE_URL\",\n  \"OPENROUTER_API_KEY\",\n  \"GOOGLE_CLIENT_ID\",\n  \"GOOGLE_CLIENT_SECRET\",\n  \"GOOGLE_GENERATIVE_AI_API_KEY\",\n  \"GROQ_API_KEY\",\n  \"MISTRAL_API_KEY\",\n  \"COHERE_API_KEY\",\n  \"RESEND_API_KEY\",\n  \"SENDGRID_API_KEY\",\n]);\n\nfunction isAppProvidedDeployCredentialKey(key: string | undefined): boolean {\n  return !!key && APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS.has(key);\n}\n\n/**\n * Deployment-level credentials are safe as a runtime fallback only in local /\n * single-tenant contexts. In hosted production with a shared database, every\n * signed-in user needs their own user/org/workspace credential for\n * identity-bearing provider keys so one deploy key does not silently\n * impersonate another tenant. App-provided service credentials are different:\n * they configure the deployed app itself rather than identifying a user. This\n * includes LLM keys that let the app developer pay for model usage, email\n * transport configuration owned by the deployment, and OAuth client\n * credentials whose per-user identity remains in scoped OAuth tokens. Key-aware\n * callers may use those env vars.\n *\n * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic\n * provider secrets. This stricter helper remains for legacy call sites with\n * identity-bearing deploy credentials.\n */\nexport function isDeployCredentialFallbackAllowed(): boolean {\n  if (!isProductionLikeRuntime()) return true;\n  return isLocalDatabase();\n}\n\nexport function canUseDeployCredentialFallbackForRequest(\n  key?: string,\n): boolean {\n  const email = getRequestUserEmail();\n  if (!email) return true;\n  if (isAppProvidedDeployCredentialKey(key)) return true;\n  if (isHostedWorkspaceRuntime()) return false;\n  if (!isProductionLikeRuntime()) return true;\n  return isLocalDatabase();\n}\n\nconst BUILDER_CREDENTIAL_KEYS = [\n  \"BUILDER_PRIVATE_KEY\",\n  \"BUILDER_PUBLIC_KEY\",\n  \"BUILDER_USER_ID\",\n  \"BUILDER_ORG_NAME\",\n  \"BUILDER_ORG_KIND\",\n  \"BUILDER_SUBSCRIPTION\",\n  \"BUILDER_SUBSCRIPTION_LEVEL\",\n  \"BUILDER_SUBSCRIPTION_NAME\",\n  \"BUILDER_IS_ENTERPRISE\",\n  \"BUILDER_IS_FREE_ACCOUNT\",\n] as const;\n\nfunction isBuilderCredentialKey(key: string): boolean {\n  return (BUILDER_CREDENTIAL_KEYS as readonly string[]).includes(key);\n}\n\nfunction isHostedWorkspaceRuntime(): boolean {\n  const hasFusionPreview = Boolean(\n    process.env.FUSION_ENVIRONMENT ||\n    process.env.FUSION_ENV_ORIGIN ||\n    process.env.VITE_FUSION_ENV_ORIGIN,\n  );\n  return (\n    /^(1|true)$/i.test(process.env.AGENT_NATIVE_WORKSPACE ?? \"\") ||\n    /^(1|true)$/i.test(process.env.VITE_AGENT_NATIVE_WORKSPACE ?? \"\") ||\n    hasFusionPreview\n  );\n}\n\nfunction isProductionLikeRuntime(): boolean {\n  return (\n    process.env.NODE_ENV === \"production\" ||\n    /^(1|true)$/i.test(process.env.NETLIFY ?? \"\") ||\n    /^(1|true)$/i.test(process.env.VERCEL ?? \"\") ||\n    /^(1|true)$/i.test(process.env.CF_PAGES ?? \"\") ||\n    Boolean(\n      process.env.AWS_LAMBDA_FUNCTION_NAME ||\n      process.env.AWS_EXECUTION_ENV ||\n      process.env.FUNCTIONS_WORKER_RUNTIME ||\n      process.env.K_SERVICE ||\n      process.env.RENDER,\n    )\n  );\n}\n\n/**\n * Whether deployment-level Builder env keys may back the current request.\n *\n * This is intentionally self-contained rather than delegating to\n * `canUseDeployCredentialFallbackForRequest`. That generic helper blocks the\n * deploy fallback for any signed-in user in a hosted workspace runtime, so the\n * Builder dogfooding escape hatch must apply its own hosted-workspace exception\n * here instead of inheriting the generic helper's stricter (and hatch-unaware)\n * decision. Reading the env once into locals keeps the rules legible.\n *\n * Rules (all evaluated against the live request/runtime, not a build-time value):\n *  - No signed-in user → safe to use the deploy env (nobody to mis-identify).\n *  - Hosted workspace + signed-in user → deploy-level Builder keys would\n *    impersonate that user, so block them — UNLESS a developer has explicitly\n *    opted into the local dogfooding escape hatch (non-prod only). Default OFF;\n *    hosted/shared production deployments are never affected.\n *  - Otherwise → allowed in non-prod, or on a local/single-tenant database.\n */\nfunction canUseBuilderDeployCredentialFallbackForRequest(): boolean {\n  const email = getRequestUserEmail();\n  if (!email) return true;\n\n  const isProductionRuntime = isProductionLikeRuntime();\n  // Local dogfooding escape hatch: lets the env / root-`.env` Builder key back\n  // a signed-in user so running the app locally doesn't require completing the\n  // Builder connect flow first. Non-prod only.\n  const localDevOptIn =\n    !isProductionRuntime &&\n    /^(1|true)$/i.test(process.env.AGENT_NATIVE_LOCAL_BUILDER_ENV ?? \"\");\n\n  if (isHostedWorkspaceRuntime() && !localDevOptIn) return false;\n\n  // Deploy fallback is safe in non-prod or on a local/single-tenant database.\n  return !isProductionRuntime || isLocalDatabase();\n}\n\nfunction shouldTraceCredentialResolve(): boolean {\n  return /^(1|true)$/i.test(\n    process.env.AGENT_NATIVE_DEBUG_CREDENTIAL_RESOLVE ??\n      process.env.DEBUG_CREDENTIAL_RESOLVE ??\n      \"\",\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Builder credential resolution:\n//\n//   1. **Request-scoped credentials.** A signed-in user can connect Builder\n//      through the CLI-auth flow. Owner/admin connections land at org scope;\n//      member/no-org connections land at user scope.\n//\n//   2. **Deployment fallback.** BUILDER_PRIVATE_KEY in env still makes local\n//      and single-tenant deploys work out of the box, but it no longer blocks\n//      per-user connect. Request-scoped credentials win whenever present.\n//\n// To run multi-tenant SaaS: prefer leaving BUILDER_PRIVATE_KEY unset unless a\n// shared fallback identity is intentional.\n// ---------------------------------------------------------------------------\n\ntype BuilderCredentialSource = \"user\" | \"org\" | \"workspace\" | \"env\";\ninterface BuilderResolvedCredentials {\n  privateKey: string | null;\n  publicKey: string | null;\n  userId: string | null;\n  orgName: string | null;\n  orgKind: string | null;\n  subscription: string | null;\n  subscriptionLevel: string | null;\n  subscriptionName: string | null;\n  isEnterprise: boolean | null;\n  isFreeAccount: boolean | null;\n  source: Exclude<BuilderCredentialSource, \"env\">;\n}\n\nfunction isCompleteBuilderConnection(creds: BuilderResolvedCredentials) {\n  return Boolean(creds.privateKey && creds.publicKey);\n}\n\nfunction readOptionalBuilderBoolean(\n  value: string | null | undefined,\n): boolean | null {\n  if (value == null || value === \"\") return null;\n  return /^(1|true)$/i.test(value);\n}\n\nexport function isBuilderPrivateKey(value: string | null | undefined): boolean {\n  return typeof value === \"string\" && value.trim().startsWith(\"bpk-\");\n}\n\nasync function readBuilderCredentialScope(\n  readAppSecrets: typeof import(\"../secrets/storage.js\").readAppSecrets,\n  scope: \"user\" | \"org\" | \"workspace\",\n  scopeId: string,\n): Promise<BuilderResolvedCredentials> {\n  const secrets = await readAppSecrets({\n    keys: BUILDER_CREDENTIAL_KEYS,\n    scope,\n    scopeId,\n  });\n  const value = (key: string): string | null => secrets.get(key)?.value ?? null;\n  return {\n    privateKey: value(\"BUILDER_PRIVATE_KEY\"),\n    publicKey: value(\"BUILDER_PUBLIC_KEY\"),\n    userId: value(\"BUILDER_USER_ID\"),\n    orgName: value(\"BUILDER_ORG_NAME\"),\n    orgKind: value(\"BUILDER_ORG_KIND\"),\n    subscription: value(\"BUILDER_SUBSCRIPTION\"),\n    subscriptionLevel: value(\"BUILDER_SUBSCRIPTION_LEVEL\"),\n    subscriptionName: value(\"BUILDER_SUBSCRIPTION_NAME\"),\n    isEnterprise: readOptionalBuilderBoolean(value(\"BUILDER_IS_ENTERPRISE\")),\n    isFreeAccount: readOptionalBuilderBoolean(value(\"BUILDER_IS_FREE_ACCOUNT\")),\n    source: scope === \"workspace\" ? \"workspace\" : scope,\n  };\n}\n\n/**\n * A transient org_members read failure makes getOrgContext report no org, which\n * would otherwise hide an org-scoped Builder connection behind a permanent-\n * sounding \"not configured\" error. resolveOrgIdForEmail honors an explicit\n * Personal selection, so this cannot promote a user into an org they left.\n */\nasync function resolveOrgIdForRequestEmail(\n  email: string,\n): Promise<{ orgId: string | null; cause?: unknown }> {\n  try {\n    const { resolveOrgIdForEmail } = await import(\"../org/context.js\");\n    return { orgId: await resolveOrgIdForEmail(email) };\n  } catch (err) {\n    // Could not read org membership, so org- and workspace-scoped rows were\n    // never searched. Report the failure instead of the empty answer.\n    return { orgId: null, cause: err };\n  }\n}\n\ninterface ScopedCredentialResult {\n  value: string | null;\n  source: \"user\" | \"org\" | \"workspace\" | null;\n  /** The failure, when there was one, so callers can classify it. */\n  cause?: unknown;\n  /**\n   * True when reading the store (or the org membership that decides which\n   * scopes to search) failed, as opposed to the store answering \"no row\".\n   */\n  lookupFailed: boolean;\n}\n\nconst NOT_FOUND: ScopedCredentialResult = {\n  value: null,\n  source: null,\n  lookupFailed: false,\n};\n\nasync function resolveScopedBuilderCredential(\n  key: string,\n): Promise<ScopedCredentialResult> {\n  const email = getRequestUserEmail();\n  if (!email) return NOT_FOUND;\n\n  // Trace only when explicitly requested. These diagnostics are useful for\n  // support, but they include account identifiers and run on hot paths.\n  const traceLookup = shouldTraceCredentialResolve();\n  let scopeAttempted = \"user\";\n  let orgLookupCause: unknown;\n  try {\n    const { readAppSecret } = await import(\"../secrets/storage.js\");\n\n    // 1. Per-user override: a user can paste their own key in settings to\n    //    overrule the org-shared one (handy for a personal sandbox).\n    const userSecret = await readAppSecret({\n      key,\n      scope: \"user\",\n      scopeId: email,\n    });\n    if (userSecret) {\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} scope=user hit=true`,\n        );\n      }\n      return { value: userSecret.value, source: \"user\", lookupFailed: false };\n    }\n\n    let orgId: string | null | undefined = getRequestOrgId();\n    let orgSource: \"request\" | \"email-fallback\" | \"none\" = orgId\n      ? \"request\"\n      : \"none\";\n    if (!orgId) {\n      const resolved = await resolveOrgIdForRequestEmail(email);\n      orgLookupCause = resolved.cause;\n      orgId = resolved.orgId;\n      if (orgId) orgSource = \"email-fallback\";\n    }\n\n    // 2. Per-org shared credential: when one teammate connects Builder\n    //    as an owner/admin we write the OAuth result at org scope so\n    //    every member of that org gets the AI chat working without\n    //    re-running the connect flow. Resolution falls back here\n    //    silently — the caller never has to know which scope answered.\n    if (orgId) {\n      scopeAttempted = \"org\";\n      const orgSecret = await readAppSecret({\n        key,\n        scope: \"org\",\n        scopeId: orgId,\n      });\n      if (orgSecret) {\n        if (traceLookup) {\n          console.log(\n            `[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} scope=org hit=true`,\n          );\n        }\n        return { value: orgSecret.value, source: \"org\", lookupFailed: false };\n      }\n\n      // Older setup flows wrote shared credentials at workspace scope.\n      // Keep reading those rows so status UIs and runtime resolution agree\n      // for users who connected before org-scoped Builder credentials existed.\n      scopeAttempted = \"workspace\";\n      const workspaceSecret = await readAppSecret({\n        key,\n        scope: \"workspace\",\n        scopeId: orgId,\n      });\n      if (workspaceSecret) {\n        if (traceLookup) {\n          console.log(\n            `[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} scope=workspace hit=true`,\n          );\n        }\n        return {\n          value: workspaceSecret.value,\n          source: \"workspace\",\n          lookupFailed: false,\n        };\n      }\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} miss tried=user,org,workspace`,\n        );\n      }\n    }\n\n    // Membership lookup failure means the org scopes were never searched.\n    // Do not let a pre-org solo row silently impersonate the current org while\n    // the membership read is retryable.\n    if (orgLookupCause !== undefined) {\n      return {\n        value: null,\n        source: null,\n        lookupFailed: true,\n        cause: orgLookupCause,\n      };\n    }\n\n    // 3. Solo-workspace fallback: always checked, even when an org id was\n    //    found above. Older no-org connect flows wrote here, so a credential\n    //    written before the user joined/created an org must not become\n    //    unreachable once that org exists.\n    scopeAttempted = \"workspace-solo\";\n    const soloWorkspaceSecret = await readAppSecret({\n      key,\n      scope: \"workspace\",\n      scopeId: `solo:${email}`,\n    });\n    if (soloWorkspaceSecret) {\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} orgId=${orgId ?? \"(none)\"} orgSource=${orgSource} scope=workspace-solo hit=true`,\n        );\n      }\n      return {\n        value: soloWorkspaceSecret.value,\n        source: \"workspace\",\n        lookupFailed: false,\n      };\n    }\n    if (traceLookup) {\n      console.log(\n        `[builder-credential] key=${key} email=${email} orgId=${orgId ?? \"(none)\"} orgSource=${orgSource} miss tried=${orgId ? \"user,org,workspace,workspace-solo\" : \"user,workspace-solo\"}`,\n      );\n    }\n  } catch (err) {\n    if (traceLookup) {\n      console.log(\n        `[builder-credential] key=${key} email=${email} scope=${scopeAttempted} error=${(err as Error)?.message ?? err}`,\n      );\n    }\n    return { value: null, source: null, lookupFailed: true, cause: err };\n  }\n  return {\n    value: null,\n    source: null,\n    lookupFailed: orgLookupCause !== undefined,\n    cause: orgLookupCause,\n  };\n}\n\ninterface ScopedBuilderCredentialsResult {\n  creds: BuilderResolvedCredentials | null;\n  /** The failure, when there was one, so callers can classify it. */\n  cause?: unknown;\n  /**\n   * True when reading the credential store itself threw (db timeout, etc),\n   * as opposed to the store answering cleanly with \"no row\". Callers must\n   * report this as retryable rather than \"not configured\".\n   */\n  lookupFailed: boolean;\n}\n\nasync function resolveScopedBuilderCredentials(): Promise<ScopedBuilderCredentialsResult> {\n  const email = getRequestUserEmail();\n  if (!email) return { creds: null, lookupFailed: false };\n\n  const traceLookup = shouldTraceCredentialResolve();\n  let scopeAttempted = \"user\";\n  let orgLookupCause: unknown;\n  try {\n    const { readAppSecrets } = await import(\"../secrets/storage.js\");\n    const traceScope = (\n      creds: BuilderResolvedCredentials,\n      scopeId: string,\n      extra = \"\",\n    ) => {\n      if (!traceLookup) return;\n      console.log(\n        `[builder-credential] scope=${creds.source} scopeId=${scopeId} email=${email}${extra} complete=${isCompleteBuilderConnection(creds)} private=${Boolean(creds.privateKey)} public=${Boolean(creds.publicKey)}`,\n      );\n    };\n\n    const userCreds = await readBuilderCredentialScope(\n      readAppSecrets,\n      \"user\",\n      email,\n    );\n    traceScope(userCreds, email);\n    if (isCompleteBuilderConnection(userCreds)) {\n      return { creds: userCreds, lookupFailed: false };\n    }\n\n    let orgId: string | null | undefined = getRequestOrgId();\n    let orgSource: \"request\" | \"email-fallback\" | \"none\" = orgId\n      ? \"request\"\n      : \"none\";\n    if (!orgId) {\n      const resolved = await resolveOrgIdForRequestEmail(email);\n      orgLookupCause = resolved.cause;\n      orgId = resolved.orgId;\n      if (orgId) orgSource = \"email-fallback\";\n    }\n\n    if (orgId) {\n      scopeAttempted = \"org\";\n      const orgCreds = await readBuilderCredentialScope(\n        readAppSecrets,\n        \"org\",\n        orgId,\n      );\n      traceScope(orgCreds, orgId, ` orgSource=${orgSource}`);\n      if (isCompleteBuilderConnection(orgCreds)) {\n        return { creds: orgCreds, lookupFailed: false };\n      }\n\n      scopeAttempted = \"workspace\";\n      const workspaceCreds = await readBuilderCredentialScope(\n        readAppSecrets,\n        \"workspace\",\n        orgId,\n      );\n      traceScope(workspaceCreds, orgId, ` orgSource=${orgSource}`);\n      if (isCompleteBuilderConnection(workspaceCreds)) {\n        return { creds: workspaceCreds, lookupFailed: false };\n      }\n    }\n\n    if (orgLookupCause !== undefined) {\n      return { creds: null, lookupFailed: true, cause: orgLookupCause };\n    }\n\n    // Solo-workspace fallback: always checked, even when an org id was found\n    // above. See resolveScopedBuilderCredential for why this must not be\n    // gated behind \"no org\".\n    scopeAttempted = \"workspace-solo\";\n    const soloScopeId = `solo:${email}`;\n    const soloCreds = await readBuilderCredentialScope(\n      readAppSecrets,\n      \"workspace\",\n      soloScopeId,\n    );\n    traceScope(\n      soloCreds,\n      soloScopeId,\n      ` orgId=${orgId ?? \"(none)\"} orgSource=${orgSource}`,\n    );\n    if (isCompleteBuilderConnection(soloCreds)) {\n      return { creds: soloCreds, lookupFailed: false };\n    }\n  } catch (err) {\n    if (traceLookup) {\n      console.log(\n        `[builder-credential] email=${email} scope=${scopeAttempted} credentials error=${(err as Error)?.message ?? err}`,\n      );\n    }\n    return { creds: null, lookupFailed: true, cause: err };\n  }\n  return {\n    creds: null,\n    lookupFailed: orgLookupCause !== undefined,\n    cause: orgLookupCause,\n  };\n}\n\n/**\n * Resolve a Builder credential for the current request. User/org credentials\n * win; deployment env is only a fallback. This lets local/root .env keys keep\n * a template working while still allowing users to connect their own Builder\n * account from Settings or onboarding.\n */\nexport async function resolveBuilderCredential(\n  key: string,\n): Promise<string | null> {\n  const scoped = await resolveScopedBuilderCredential(key);\n  if (scoped.value) return scoped.value;\n  const envValue = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(key) ?? null)\n    : null;\n  if (envValue) return envValue;\n  // Nothing answered AND the store never gave a real answer: that is not\n  // \"not connected\", it is \"we could not look\".\n  assertCredentialStoreReadable(scoped);\n  return null;\n}\n\n/**\n * True when `BUILDER_PRIVATE_KEY` is set at the deployment level. This means\n * a deploy-level fallback exists; it does not prevent per-user connect.\n */\nexport function isBuilderEnvManaged(): boolean {\n  return !!process.env.BUILDER_PRIVATE_KEY;\n}\n\n/**\n * Resolve the Builder private key for the current request. User/org OAuth\n * credentials win; deploy-level `BUILDER_PRIVATE_KEY` is the fallback.\n */\nexport async function resolveBuilderPrivateKey(): Promise<string | null> {\n  return resolveBuilderCredential(\"BUILDER_PRIVATE_KEY\");\n}\n\n/**\n * Resolve the current user's Builder auth header.\n * Returns `\"Bearer <key>\"` or null.\n */\nexport async function resolveBuilderAuthHeader(): Promise<string | null> {\n  const key = await resolveBuilderPrivateKey();\n  return key ? `Bearer ${key}` : null;\n}\n\n/**\n * Check whether the current user has a Builder private key configured\n * (per-user or deployment-level).\n */\nexport async function resolveHasBuilderPrivateKey(): Promise<boolean> {\n  return !!(await resolveBuilderPrivateKey());\n}\n\n/**\n * Check whether the current request has the complete Builder credential bundle\n * needed for Builder-backed assistant/image-generation calls.\n */\nexport async function resolveHasCompleteBuilderConnection(): Promise<boolean> {\n  const creds = await resolveBuilderCredentials();\n  return !!(creds.privateKey && creds.publicKey);\n}\n\n/**\n * Resolve where the effective Builder assistant connection came from. This\n * intentionally requires a complete private+public key pair from one scope so\n * status UIs don't report a mixed user/org credential set as connected.\n */\nexport async function resolveBuilderCredentialSource(): Promise<BuilderCredentialSource | null> {\n  const detailed = await resolveBuilderCredentialsDetailed();\n  return detailed.source;\n}\n\nexport interface BuilderCredentialsDetailed {\n  privateKey: string | null;\n  publicKey: string | null;\n  userId: string | null;\n  orgName: string | null;\n  orgKind: string | null;\n  subscription: string | null;\n  subscriptionLevel: string | null;\n  subscriptionName: string | null;\n  isEnterprise: boolean | null;\n  isFreeAccount: boolean | null;\n  /** Which scope answered, or null when nothing did. */\n  source: BuilderCredentialSource | null;\n  /**\n   * True when reading the credential store itself failed (db timeout, etc).\n   * Callers must report this as retryable rather than \"not configured\".\n   */\n  lookupFailed: boolean;\n  /** The failure, when there was one, so callers can classify it. */\n  cause?: unknown;\n}\n\n/**\n * Resolve the Builder assistant credential bundle from one complete scope,\n * plus where it came from and whether the credential-store read itself\n * failed. A partial user row is treated as a miss so the org-shared\n * connection can still power the assistant for teammates.\n *\n * Callers that only need the plain credential bundle (the historical shape)\n * should use `resolveBuilderCredentials()` instead.\n */\nexport async function resolveBuilderCredentialsDetailed(): Promise<BuilderCredentialsDetailed> {\n  const {\n    creds: scoped,\n    lookupFailed,\n    cause,\n  } = await resolveScopedBuilderCredentials();\n  if (scoped) {\n    const {\n      privateKey,\n      publicKey,\n      userId,\n      orgName,\n      orgKind,\n      subscription,\n      subscriptionLevel,\n      subscriptionName,\n      isEnterprise,\n      isFreeAccount,\n      source,\n    } = scoped;\n    return {\n      privateKey,\n      publicKey,\n      userId,\n      orgName,\n      orgKind,\n      subscription,\n      subscriptionLevel,\n      subscriptionName,\n      isEnterprise,\n      isFreeAccount,\n      source,\n      lookupFailed: false,\n    };\n  }\n  const canUseEnv = canUseBuilderDeployCredentialFallbackForRequest();\n  const privateKey = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_PRIVATE_KEY\") ?? null)\n    : null;\n  const publicKey = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_PUBLIC_KEY\") ?? null)\n    : null;\n  const userId = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_USER_ID\") ?? null)\n    : null;\n  const orgName = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_ORG_NAME\") ?? null)\n    : null;\n  const orgKind = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_ORG_KIND\") ?? null)\n    : null;\n  const subscription = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION\") ?? null)\n    : null;\n  const subscriptionLevel = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION_LEVEL\") ?? null)\n    : null;\n  const subscriptionName = canUseEnv\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION_NAME\") ?? null)\n    : null;\n  const isEnterprise = canUseEnv\n    ? readOptionalBuilderBoolean(\n        readDeployCredentialEnv(\"BUILDER_IS_ENTERPRISE\"),\n      )\n    : null;\n  const isFreeAccount = canUseEnv\n    ? readOptionalBuilderBoolean(\n        readDeployCredentialEnv(\"BUILDER_IS_FREE_ACCOUNT\"),\n      )\n    : null;\n  return {\n    privateKey,\n    publicKey,\n    userId,\n    orgName,\n    orgKind,\n    subscription,\n    subscriptionLevel,\n    subscriptionName,\n    isEnterprise,\n    isFreeAccount,\n    source: canUseEnv && privateKey ? \"env\" : null,\n    lookupFailed,\n    cause,\n  };\n}\n\n/**\n * Resolve the Builder assistant credential bundle from one complete scope.\n * Kept to its original return shape (no `source`/`lookupFailed`) for existing\n * callers; use `resolveBuilderCredentialsDetailed()` for those fields.\n */\nexport async function resolveBuilderCredentials(): Promise<{\n  privateKey: string | null;\n  publicKey: string | null;\n  userId: string | null;\n  orgName: string | null;\n  orgKind: string | null;\n  subscription: string | null;\n  subscriptionLevel: string | null;\n  subscriptionName: string | null;\n  isEnterprise: boolean | null;\n  isFreeAccount: boolean | null;\n}> {\n  const {\n    privateKey,\n    publicKey,\n    userId,\n    orgName,\n    orgKind,\n    subscription,\n    subscriptionLevel,\n    subscriptionName,\n    isEnterprise,\n    isFreeAccount,\n  } = await resolveBuilderCredentialsDetailed();\n  return {\n    privateKey,\n    publicKey,\n    userId,\n    orgName,\n    orgKind,\n    subscription,\n    subscriptionLevel,\n    subscriptionName,\n    isEnterprise,\n    isFreeAccount,\n  };\n}\n\nconst BUILDER_AUTH_FAILURE_SETTING_PREFIX = \"builder-auth-failure:\";\n/**\n * Stale markers expire so a rejected model or a transient gateway failure\n * cannot pin a signed-in user to \"Builder not connected\" forever. Only a\n * successful gateway call clears the marker early, and that call never happens\n * while the marker is what makes the connection look broken.\n */\nexport const BUILDER_AUTH_FAILURE_TTL_MS = 15 * 60 * 1000;\n\nexport interface BuilderCredentialAuthFailure {\n  fingerprint: string;\n  message: string;\n  status?: number;\n  code?: string;\n  at: number;\n  ownerEmail?: string | null;\n  orgId?: string | null;\n}\n\nexport function builderCredentialFingerprint(\n  privateKey?: string | null,\n  publicKey?: string | null,\n): string | null {\n  if (!privateKey || !publicKey) return null;\n  return createHash(\"sha256\")\n    .update(privateKey)\n    .update(\"\\0\")\n    .update(publicKey)\n    .digest(\"hex\")\n    .slice(0, 24);\n}\n\nfunction builderAuthFailureSettingKey(fingerprint: string): string {\n  return `${BUILDER_AUTH_FAILURE_SETTING_PREFIX}${fingerprint}`;\n}\n\nexport async function getBuilderCredentialAuthFailure(\n  creds: {\n    privateKey?: string | null;\n    publicKey?: string | null;\n  } = {},\n): Promise<BuilderCredentialAuthFailure | null> {\n  const fingerprint = builderCredentialFingerprint(\n    creds.privateKey,\n    creds.publicKey,\n  );\n  if (!fingerprint) return null;\n  try {\n    const settings = await import(\"../settings/store.js\");\n    const settingKey = builderAuthFailureSettingKey(fingerprint);\n    const row = await settings.getSetting(settingKey);\n    if (!row) return null;\n    const at = typeof row.at === \"number\" ? row.at : Date.now();\n    if (Date.now() - at > BUILDER_AUTH_FAILURE_TTL_MS) {\n      if (typeof settings.deleteSetting === \"function\") {\n        await settings.deleteSetting(settingKey).catch(() => {});\n      }\n      return null;\n    }\n    return {\n      fingerprint,\n      message:\n        typeof row.message === \"string\" && row.message\n          ? row.message\n          : \"Builder rejected the connected credentials. Reconnect Builder.io.\",\n      status: typeof row.status === \"number\" ? row.status : undefined,\n      code: typeof row.code === \"string\" ? row.code : undefined,\n      at,\n      ownerEmail:\n        typeof row.ownerEmail === \"string\" ? row.ownerEmail : undefined,\n      orgId: typeof row.orgId === \"string\" ? row.orgId : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function recordBuilderCredentialAuthFailure(details?: {\n  status?: number;\n  code?: string;\n  message?: string;\n}): Promise<void> {\n  try {\n    const creds = await resolveBuilderCredentials();\n    const fingerprint = builderCredentialFingerprint(\n      creds.privateKey,\n      creds.publicKey,\n    );\n    if (!fingerprint) return;\n    const { putSetting } = await import(\"../settings/store.js\");\n    await putSetting(builderAuthFailureSettingKey(fingerprint), {\n      fingerprint,\n      message:\n        details?.message ||\n        \"Builder rejected the connected credentials. Reconnect Builder.io.\",\n      ...(typeof details?.status === \"number\" && { status: details.status }),\n      ...(details?.code && { code: details.code }),\n      at: Date.now(),\n      ownerEmail: getRequestUserEmail() ?? null,\n      orgId: getRequestOrgId() ?? null,\n    });\n  } catch {\n    // Best-effort marker only; the chat error is still returned to the user.\n  }\n}\n\nexport async function clearBuilderCredentialAuthFailure(creds: {\n  privateKey?: string | null;\n  publicKey?: string | null;\n}): Promise<void> {\n  const fingerprint = builderCredentialFingerprint(\n    creds.privateKey,\n    creds.publicKey,\n  );\n  if (!fingerprint) return;\n  try {\n    const { deleteSetting } = await import(\"../settings/store.js\");\n    await deleteSetting(builderAuthFailureSettingKey(fingerprint));\n  } catch {\n    // A stale failure marker should not block writing fresh credentials.\n  }\n}\n\nconst PROVIDER_AUTH_FAILURE_SETTING_PREFIX = \"provider-auth-failure:\";\n/** Stale failure markers expire so a transient 401 cannot permanently block deploy keys. */\nexport const PROVIDER_AUTH_FAILURE_TTL_MS = 15 * 60 * 1000;\n\nexport interface ProviderCredentialAuthFailure {\n  fingerprint: string;\n  key: string;\n  message: string;\n  status?: number;\n  code?: string;\n  at: number;\n  ownerEmail?: string | null;\n  orgId?: string | null;\n}\n\nexport function providerCredentialFingerprint(\n  key?: string | null,\n  value?: string | null,\n): string | null {\n  const normalizedKey = key?.trim().toUpperCase();\n  const normalizedValue = value?.trim();\n  if (!normalizedKey || !normalizedValue) return null;\n  return createHash(\"sha256\")\n    .update(normalizedKey)\n    .update(\"\\0\")\n    .update(normalizedValue)\n    .digest(\"hex\")\n    .slice(0, 24);\n}\n\nfunction providerAuthFailureSettingKey(fingerprint: string): string {\n  return `${PROVIDER_AUTH_FAILURE_SETTING_PREFIX}${fingerprint}`;\n}\n\nexport async function getProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n}): Promise<ProviderCredentialAuthFailure | null> {\n  const key = opts.key?.trim().toUpperCase() ?? \"\";\n  const fingerprint = providerCredentialFingerprint(key, opts.value);\n  if (!fingerprint) return null;\n  try {\n    const settings = await import(\"../settings/store.js\");\n    const settingKey = providerAuthFailureSettingKey(fingerprint);\n    const row = await settings.getSetting(settingKey);\n    if (!row) return null;\n    if (row.fingerprint !== fingerprint) return null;\n    const at = typeof row.at === \"number\" ? row.at : Date.now();\n    if (Date.now() - at > PROVIDER_AUTH_FAILURE_TTL_MS) {\n      if (typeof settings.deleteSetting === \"function\") {\n        await settings.deleteSetting(settingKey).catch(() => {});\n      }\n      return null;\n    }\n    return {\n      fingerprint,\n      key:\n        typeof row.key === \"string\" && row.key\n          ? row.key\n          : key || \"UNKNOWN_PROVIDER_KEY\",\n      message:\n        typeof row.message === \"string\" && row.message\n          ? row.message\n          : \"The model provider rejected the saved API key.\",\n      status: typeof row.status === \"number\" ? row.status : undefined,\n      code: typeof row.code === \"string\" ? row.code : undefined,\n      at,\n      ownerEmail:\n        typeof row.ownerEmail === \"string\" ? row.ownerEmail : undefined,\n      orgId: typeof row.orgId === \"string\" ? row.orgId : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function recordProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n  status?: number;\n  code?: string;\n  message?: string;\n}): Promise<void> {\n  try {\n    const key = opts.key?.trim().toUpperCase() ?? \"\";\n    const value = opts.value?.trim();\n    const fingerprint = providerCredentialFingerprint(key, value);\n    if (!fingerprint) return;\n    const { putSetting } = await import(\"../settings/store.js\");\n    await putSetting(providerAuthFailureSettingKey(fingerprint), {\n      fingerprint,\n      key,\n      message: opts.message || \"The model provider rejected the saved API key.\",\n      ...(typeof opts.status === \"number\" && { status: opts.status }),\n      ...(opts.code && { code: opts.code }),\n      at: Date.now(),\n      ownerEmail: getRequestUserEmail() ?? null,\n      orgId: getRequestOrgId() ?? null,\n    });\n  } catch {\n    // Best-effort marker only; the chat error is still returned to the user.\n  }\n}\n\nexport async function clearProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n}): Promise<void> {\n  const fingerprint = providerCredentialFingerprint(opts.key, opts.value);\n  if (!fingerprint) return;\n  try {\n    const { deleteSetting } = await import(\"../settings/store.js\");\n    await deleteSetting(providerAuthFailureSettingKey(fingerprint));\n  } catch {\n    // A stale failure marker should not block writing or using fresh keys.\n  }\n}\n\n/**\n * Write Builder credentials to `app_secrets`.\n *\n * Scope decision (see `resolveCredentialWriteScope`): when the connecting\n * user is owner/admin of an active org we write at `scope: \"org\"` so every\n * member of that org auto-resolves the credentials via\n * `resolveBuilderCredential`'s org fallback — no per-user re-connect\n * needed. A plain member or a user with no active org writes at\n * `scope: \"user\"` (the safe default that doesn't trample the org's shared\n * connection).\n *\n * Stale-credential cleanup: before writing the new values we (1) clear ALL\n * five BUILDER_* keys at the target scope, so optional fields the new\n * connection doesn't carry (e.g. user picked a Builder space that returns\n * no orgName) don't leave the previous connection's metadata behind, and\n * (2) when writing at org scope, also clear the writer's own user-scope\n * BUILDER_* rows so a stale personal override from an earlier connect\n * doesn't shadow the new org write on resolution (user scope wins org\n * scope by design — see `resolveScopedBuilderCredential`). The org-scope\n * row is intentionally left alone when writing at user scope: that row is\n * shared with the rest of the org and a single user's personal override\n * shouldn't blow it away. (Victoria's \"I signed in again with my Builder\n * space and it still says no credits\" report on 2026-05-11 was exactly\n * this stale-shadow case.)\n *\n * Returns the actual scope/scopeId used so the caller can show \"Connected\n * for Builder.io\" vs \"Connected (personal)\" in the UI.\n */\nexport async function writeBuilderCredentials(\n  email: string,\n  creds: {\n    privateKey: string;\n    publicKey: string;\n    userId?: string | null;\n    orgName?: string | null;\n    orgKind?: string | null;\n    subscription?: string | null;\n    subscriptionLevel?: string | null;\n    subscriptionName?: string | null;\n    isEnterprise?: boolean | null;\n    isFreeAccount?: boolean | null;\n  },\n  options?: { orgId?: string | null; role?: string | null },\n): Promise<{ scope: \"user\" | \"org\"; scopeId: string }> {\n  const privateKey = creds.privateKey.trim();\n  const publicKey = creds.publicKey.trim();\n  if (!isBuilderPrivateKey(privateKey)) {\n    throw new Error(\n      \"Builder returned a credential that is not a Builder private key (expected bpk-...). Restart the Builder connect flow and choose a space that can issue a private key.\",\n    );\n  }\n  if (!publicKey) {\n    throw new Error(\n      \"Builder did not return a public API key. Restart the Builder connect flow.\",\n    );\n  }\n\n  const { writeAppSecret, deleteAppSecret } =\n    await import(\"../secrets/storage.js\");\n  const target = resolveCredentialWriteScope(\n    email,\n    options?.orgId ?? null,\n    options?.role ?? null,\n  );\n\n  // Clear stale rows before writing the new connection. See the function's\n  // doc comment for the two cases this handles.\n  const cleanups: Array<Promise<unknown>> = BUILDER_CREDENTIAL_KEYS.map((key) =>\n    deleteAppSecret({\n      key,\n      scope: target.scope,\n      scopeId: target.scopeId,\n    }).catch(() => {}),\n  );\n  if (target.scope === \"org\") {\n    for (const key of BUILDER_CREDENTIAL_KEYS) {\n      cleanups.push(\n        deleteAppSecret({ key, scope: \"user\", scopeId: email }).catch(() => {}),\n      );\n    }\n  }\n  await Promise.all(cleanups);\n\n  const entries: Array<{ key: string; value: string }> = [\n    { key: \"BUILDER_PRIVATE_KEY\", value: privateKey },\n    { key: \"BUILDER_PUBLIC_KEY\", value: publicKey },\n  ];\n  if (creds.userId) {\n    entries.push({ key: \"BUILDER_USER_ID\", value: creds.userId });\n  }\n  if (creds.orgName) {\n    entries.push({ key: \"BUILDER_ORG_NAME\", value: creds.orgName });\n  }\n  if (creds.orgKind) {\n    entries.push({ key: \"BUILDER_ORG_KIND\", value: creds.orgKind });\n  }\n  if (creds.subscription) {\n    entries.push({ key: \"BUILDER_SUBSCRIPTION\", value: creds.subscription });\n  }\n  if (creds.subscriptionLevel) {\n    entries.push({\n      key: \"BUILDER_SUBSCRIPTION_LEVEL\",\n      value: creds.subscriptionLevel,\n    });\n  }\n  if (creds.subscriptionName) {\n    entries.push({\n      key: \"BUILDER_SUBSCRIPTION_NAME\",\n      value: creds.subscriptionName,\n    });\n  }\n  if (typeof creds.isEnterprise === \"boolean\") {\n    entries.push({\n      key: \"BUILDER_IS_ENTERPRISE\",\n      value: String(creds.isEnterprise),\n    });\n  }\n  if (typeof creds.isFreeAccount === \"boolean\") {\n    entries.push({\n      key: \"BUILDER_IS_FREE_ACCOUNT\",\n      value: String(creds.isFreeAccount),\n    });\n  }\n  await Promise.all(\n    entries.map(({ key, value }) =>\n      writeAppSecret({\n        key,\n        value,\n        scope: target.scope,\n        scopeId: target.scopeId,\n      }),\n    ),\n  );\n  await clearBuilderCredentialAuthFailure({\n    privateKey,\n    publicKey,\n  });\n  return target;\n}\n\n/**\n * Delete Builder credentials.\n *\n * Default behaviour: clears only this user's per-user override (so a\n * member can disconnect their personal Builder identity without\n * collapsing the org-wide connection for every teammate). To revoke the\n * org's shared connection, pass `{ orgId, role }` for an owner/admin —\n * matching the same authority gate `writeBuilderCredentials` uses on\n * write. Plain members can never reach the org-scoped row.\n */\nexport async function deleteBuilderCredentials(\n  email: string,\n  options?: { orgId?: string | null; role?: string | null },\n): Promise<{ scope: \"user\" | \"org\"; scopeId: string }> {\n  const { deleteAppSecret } = await import(\"../secrets/storage.js\");\n  const target = resolveCredentialWriteScope(\n    email,\n    options?.orgId ?? null,\n    options?.role ?? null,\n  );\n  await Promise.all(\n    BUILDER_CREDENTIAL_KEYS.map((key) =>\n      deleteAppSecret({\n        key,\n        scope: target.scope,\n        scopeId: target.scopeId,\n      }).catch(() => {}),\n    ),\n  );\n  return target;\n}\n\n// ---------------------------------------------------------------------------\n// Generic request-scoped secret resolution\n//\n// New consumers should prefer this over reading `process.env.X` directly.\n// User-pasted and shared secrets live in `app_secrets` (encrypted). The\n// settings UI / onboarding panels can write user, org, or workspace rows.\n// Deploy-level env vars are the fallback for unauthenticated/CLI/background\n// contexts where there's no user to scope by. Authenticated requests may also\n// use app-provided LLM provider keys such as OPENAI_API_KEY or\n// ANTHROPIC_API_KEY, but Builder identity keys keep the stricter scoped policy.\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve a request-scoped secret. Reads from `app_secrets` first (current\n * user override, active org, workspace row for that org, then the solo\n * workspace row); falls back to `process.env` only when the deploy fallback\n * policy allows it.\n */\nexport async function resolveSecret(key: string): Promise<string | null> {\n  const resolved = await resolveSecretDetailed(key);\n  if (resolved.value) return resolved.value;\n  // Nothing answered AND the store never gave a real answer. Reporting null\n  // here is what turns a database blip into \"you never configured this\".\n  assertCredentialStoreReadable(resolved);\n  return null;\n}\n\n/**\n * `resolveSecret` without the throw: reports whether the miss is definitive\n * (`lookupFailed: false` — no such row anywhere the caller can reach) or just\n * unknown (`lookupFailed: true` — the store or the org membership behind it\n * could not be read).\n */\nexport async function resolveSecretDetailed(\n  key: string,\n): Promise<{ value: string | null; lookupFailed: boolean; cause?: unknown }> {\n  const traceLookup = shouldTraceCredentialResolve();\n  const email = getRequestUserEmail();\n  let lookupFailed = false;\n  let cause: unknown;\n  if (email) {\n    try {\n      const { readAppSecret } = await import(\"../secrets/storage.js\");\n      // Per-user override first.\n      const userSecret = await readAppSecret({\n        key,\n        scope: \"user\",\n        scopeId: email,\n      });\n      if (userSecret?.value) {\n        if (traceLookup) {\n          console.log(\n            `[resolve-secret] key=${key} email=${email} scope=user hit=true`,\n          );\n        }\n        return { value: userSecret.value, lookupFailed: false };\n      }\n\n      // Mirrors resolveScopedBuilderCredential: a transient org_members read\n      // failure makes getOrgContext report no org, which would otherwise hide\n      // an org-scoped vault row behind an intermittent \"not configured\" error.\n      let orgId: string | null | undefined = getRequestOrgId();\n      if (!orgId) {\n        const resolved = await resolveOrgIdForRequestEmail(email);\n        cause = resolved.cause;\n        lookupFailed = cause !== undefined;\n        orgId = resolved.orgId;\n      }\n\n      if (orgId) {\n        // Fall back to the active org's shared row, when present. Builder\n        // Connect uses this first-class org scope.\n        const orgSecret = await readAppSecret({\n          key,\n          scope: \"org\",\n          scopeId: orgId,\n        });\n        if (orgSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} orgId=${orgId} scope=org hit=true`,\n            );\n          }\n          return { value: orgSecret.value, lookupFailed: false };\n        }\n\n        // Registered secrets historically used \"workspace\" scope for\n        // org-shared configuration. Keep reading it so Settings status and\n        // runtime resolution agree.\n        const workspaceSecret = await readAppSecret({\n          key,\n          scope: \"workspace\",\n          scopeId: orgId,\n        });\n        if (workspaceSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} orgId=${orgId} scope=workspace hit=true`,\n            );\n          }\n          return { value: workspaceSecret.value, lookupFailed: false };\n        }\n      }\n\n      if (lookupFailed) {\n        return { value: null, lookupFailed: true, cause };\n      }\n\n      // Solo-workspace fallback: always checked, even when an org id was found\n      // above. A secret written before the user joined/created an org lives\n      // here, and must not become unreachable once that org exists. It stays\n      // inside this try so a failed org-scoped read still surfaces as\n      // retryable instead of being answered by a stale pre-org row.\n      const soloWorkspaceSecret = await readAppSecret({\n        key,\n        scope: \"workspace\",\n        scopeId: `solo:${email}`,\n      });\n      if (soloWorkspaceSecret?.value) {\n        if (traceLookup) {\n          console.log(\n            `[resolve-secret] key=${key} email=${email} orgId=${orgId ?? \"(none)\"} scope=workspace-solo hit=true`,\n          );\n        }\n        return { value: soloWorkspaceSecret.value, lookupFailed: false };\n      }\n    } catch (err) {\n      if (traceLookup) {\n        console.log(\n          `[resolve-secret] key=${key} email=${email} scope=error err=${(err as Error)?.message ?? err}`,\n        );\n      }\n      // Keep looking (env may still have the key), but remember that the store\n      // never actually answered \"no row\".\n      lookupFailed = true;\n      cause = err;\n    }\n    // Read deployment-provided env values as fallbacks; framework code must not\n    // write to `process.env`, but keys supplied by the host remain valid config.\n    // Builder credentials keep a narrower path below because those keys carry a\n    // Builder identity rather than just enabling a provider call.\n    const envFallback = (\n      isBuilderCredentialKey(key)\n        ? canUseBuilderDeployCredentialFallbackForRequest()\n        : canUseDeployCredentialFallbackForRequest(key)\n    )\n      ? process.env[key] || null\n      : null;\n    if (traceLookup) {\n      console.log(\n        `[resolve-secret] key=${key} email=${email} orgId=${getRequestOrgId() ?? \"(none)\"} scope=${envFallback ? \"env-fallback\" : \"none\"} hit=${!!envFallback}`,\n      );\n    }\n    return {\n      value: envFallback,\n      lookupFailed: lookupFailed && !envFallback,\n      cause,\n    };\n  }\n  // Unauthenticated / local-dev / CLI / background context: env fallback\n  // is safe because there's no user to mis-identify.\n  const value = process.env[key] || null;\n  if (traceLookup) {\n    console.log(\n      `[resolve-secret] key=${key} email=(none) scope=env-anonymous hit=${!!value}`,\n    );\n  }\n  return { value, lookupFailed: false };\n}\n\n// ---------------------------------------------------------------------------\n// Synchronous helpers — env-only fallbacks for contexts where per-user\n// lookup isn't possible (sync isConfigured checks, CLI scripts).\n// ---------------------------------------------------------------------------\n\n/**\n * True when a Builder private key is configured at the deployment level.\n *\n * This is the same env-only check as `isBuilderEnvManaged()`. For \"does this\n * request have access to Builder via user/org/env credentials?\" use the async\n * `resolveHasBuilderPrivateKey()`.\n */\nexport function hasBuilderPrivateKey(): boolean {\n  return !!process.env.BUILDER_PRIVATE_KEY;\n}\n\n/** The origin for Builder-proxied API calls. Overridable for testing. */\nexport function getBuilderProxyOrigin(): string {\n  return (\n    process.env.BUILDER_PROXY_ORIGIN ||\n    process.env.AIR_HOST ||\n    process.env.BUILDER_API_HOST ||\n    \"https://api.builder.io\"\n  );\n}\n\n/**\n * Base URL for the public Builder LLM gateway, which lives at\n * api.builder.io/agent-native/gateway.\n * Override via BUILDER_GATEWAY_BASE_URL for staging / testing.\n */\nexport function getBuilderGatewayBaseUrl(): string {\n  return (\n    process.env.BUILDER_GATEWAY_BASE_URL ||\n    \"https://api.builder.io/agent-native/gateway/v1\"\n  );\n}\n\n/**\n * Base URL for Builder-managed image generation.\n * Override via BUILDER_IMAGE_GENERATION_BASE_URL for staging / testing.\n */\nexport function getBuilderImageGenerationBaseUrl(): string {\n  return (\n    process.env.BUILDER_IMAGE_GENERATION_BASE_URL ||\n    \"https://api.builder.io/agent-native/images/v1\"\n  );\n}\n\n/**\n * Base URL for Builder-managed web search.\n * Override via BUILDER_WEB_SEARCH_BASE_URL for staging / testing.\n */\nexport function getBuilderWebSearchBaseUrl(): string {\n  return (\n    process.env.BUILDER_WEB_SEARCH_BASE_URL ||\n    \"https://api.builder.io/agent-native/web-search/v1\"\n  );\n}\n\n/** Authorization header value for Builder-proxied calls (env-only). */\nexport function getBuilderAuthHeader(): string | null {\n  const key = process.env.BUILDER_PRIVATE_KEY;\n  return key ? `Bearer ${key}` : null;\n}\n"]}

package/dist/server/embed-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embed-session.d.ts","sourceRoot":"","sources":["../../src/server/embed-session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAoBlC,QAAA,MAAM,UAAU,+BAA+B,CAAC;AA6ChD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,OAAO,UAAU,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA0UF,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM,GACjB,OAAO,CAYT;AAiBD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,IAAI,CA8Bf;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CA6C5C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAeT;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAC/B,6BAA6B,CAsC/B;AAiCD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQzE;AAyBD,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAuCtC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA2BjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAS1D"}
+{"version":3,"file":"embed-session.d.ts","sourceRoot":"","sources":["../../src/server/embed-session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAqBlC,QAAA,MAAM,UAAU,+BAA+B,CAAC;AA6ChD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,OAAO,UAAU,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA0UF,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM,GACjB,OAAO,CAYT;AAiBD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC9B,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,IAAI,CAuCf;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CA6C5C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAeT;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAC/B,6BAA6B,CAsC/B;AAiCD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQzE;AAyBD,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAuCtC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA2BjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAS1D"}

package/dist/server/embed-session.js

@@ -3,6 +3,7 @@ import { getCookie, getHeader, getQuery, setCookie, setResponseHeader, } from "h
 import { getDbExec, intType, isPostgres } from "../db/client.js";
 import { ensureTableExists } from "../db/ddl-guard.js";
 import { EMBED_MODE_QUERY_PARAM, EMBED_SESSION_COOKIE, EMBED_TARGET_HEADER, EMBED_TOKEN_QUERY_PARAM, } from "../shared/embed-auth.js";
+import { normalizeAppPath } from "../shared/sign-in-journey.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 const TOKEN_KIND = "agent-native-embed-session";
@@ -382,6 +383,15 @@ export function normalizeEmbedTargetPath(raw, requestOrigin) {
         return null;
     if (/^\/[a-z][a-z0-9+.-]*:/i.test(path))
         return null;
+    // A ticket minted for an auth entry path used to be honoured, redirecting
+    // the embed straight at a login form. Fails closed on the existing
+    // "Invalid embed target." 400 instead.
+    const base = getConfiguredAppBasePath();
+    const pathForValidation = base && (path === base || path.startsWith(`${base}/`))
+        ? path
+        : `${base}${path}`;
+    if (normalizeAppPath(pathForValidation, base) === null)
+        return null;
     return stripConfiguredBasePath(path);
 }
 export async function createEmbedSessionTicket(input) {