@agent-native/core 0.26.5 → 0.26.6

package/dist/mcp-client/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,GAGzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,sEAAsE;AACtE,SAAS,aAAa,CACpB,OAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA6B,EAC7B,KAAqB,EACrB,OAAe,EACf,MAAoB;IAEpB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;QACjD,MAAM;KACP,CAAC;AACJ,CAAC;AAoCD,SAAS,SAAS,CAAC,OAAyB,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAgC;IAEhC,OAAO;QACL,EAAE,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC9B,IAAI,EAAE,UAAU,CAAC,QAAQ;QACzB,GAAG,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAqB,EACrB,UAAgC,EAChC,OAAe;IAEf,OAAO,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAoC,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,CAAC;YACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACjC,MAAM,IAAI,GAAI,KAA+C,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,SAAS;YACxE,oEAAoE;YACpE,gEAAgE;YAChE,sEAAsE;YACtE,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,iCAAiC,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,CAAC;YACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACjC,MAAM,UAAU,GAAG,gCAAgC,CACjD,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,UAAU,CAAC;YACtC,CAAC,CAAE,KAAa,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,EAAE,CACP,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YACD,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;gBACzD,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,qDAAqD,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CAC1G,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,kCAAkC,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAwB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;IAC3D,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAyB;IAEzB,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAChD,IAAI,UAAU,IAAI,CAAC,IAAI,OAAO,WAAW,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAEtE,IAAI,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAClE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,UAAU;YAAE,OAAO;QACvB,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;gBACvC,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAChC,gBAAgB,GAAG,aAAa,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,uCAAuC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC7D,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5C,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAAc;IAKpD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAClB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAChB,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAyB;IACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,OAAyB;IAEzB,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,kCAAkC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAChE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAE7D,+DAA+D;YAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACnE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,qBAAqB;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC9C,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/D,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAClE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBACnD,OAAO,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;gBACpD,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;gBACvD,OAAO,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,4CAA4C,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,EAAoB;IAEpB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,qBAAqB,CAC1B;QACE,SAAS,EAAE,KAAK,IAAI,SAAS;QAC7B,KAAK,EAAE,KAAK,IAAI,SAAS;KAC1B,EACD,EAAE,CACW,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAyB,EACzB,QAAgB;IAEhB,OAAO,OAAO;SACX,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CACnE,CAAC;AACN,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAgB,EAChB,OAAgB;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,YAAY;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAyB,EACzB,QAAgB,EAChB,gBAAwB;IAExB,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAClE,MAAM,IAAI,GACR,OAAO;SACJ,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,YAAY,KAAK,gBAAgB,CAC9C,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAc,EAAE,OAAyB;IAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAIpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,QAAQ,CAC3B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClD,CAAC,CAAE,IAAI,CAAC,SAAqC;gBAC7C,CAAC,CAAC,EAAE,CACP,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,OAAO;YACL,KAAK,EAAE,OAAO;iBACX,iBAAiB,CAAC,QAAQ,CAAC;iBAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACvD,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,gBAAgB,CAAC;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,0BAA0B,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,OAAyB;IAUzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK;QACvB,CAAC,CAAC,MAAM,iCAAiC,CAAC,MAAM,EAAE,KAAK,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,KAAK;QACtB,CAAC,CAAC,MAAM,iCAAiC,CAAC,KAAK,EAAE,KAAK,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,YAAY,EAAE,wBAAwB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;YACxD,MAAM,SAAS,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAG,KAAK;gBACxB,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;gBACnD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,WAAW,GAAG,KAAK;gBACvB,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;gBAClD,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,SAAS;gBACT,iBAAiB,EAAE,SAAS;oBAC1B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,qBAAqB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3D,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;iBACxC;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,YAAY;oBAClB,GAAG,EAAE,WAAW;iBACjB;gBACD,MAAM,EAAE;oBACN,IAAI,EACF,YAAY,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACjD,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;wBAClC,CAAC,CAAC,SAAS;oBACf,GAAG,EACD,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC/C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;wBACjC,CAAC,CAAC,SAAS;iBAChB;aACF,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;QACjC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,KAAc,EAAE,OAAyB;IAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,kEAAkE;aACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,2DAA2D;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,kCAAkC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,gCAAgC,CACpC,KAAK,EACL,OAAO,EACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAC5B,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,KAAK,EACL,OAAO,EACP,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,OAAO,CACb,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kCAAkC,CAAC,EAAU;IACpD,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,oCAAoC,EAAE,GAAG,CAAC;IAClE,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,GAAG,UAAU,CAAC,IAAI,yBAAyB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAAc,EACd,OAAyB;IAOzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,gBAAgB,CACd,CAAC,EACD,MAAM,EACN,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC5D,CACF;QACD,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxB,gBAAgB,CACd,CAAC,EACD,KAAK,EACL,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC3D,CACF;QACD,KAAK;QACL,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAc,EAAE,OAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAMpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+DAA+D;aACvE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE;QACnD,IAAI;QACJ,GAAG;QACH,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,gBAAgB,CACtB,MAAM,CAAC,MAAM,EACb,KAAK,EACL,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,yDAAyD;aACjE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,OAAgC;IAKhC,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,6BAA6B,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxE,MAAM,CAAC,2CAA2C,CAAC;YACnD,MAAM,CAAC,oDAAoD,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YAChE,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1D,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAA6B,CAAC,GAAG,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC","sourcesContent":["/**\n * HTTP routes for user- and org-scope remote MCP server management.\n *\n * Mounted under `/_agent-native/mcp/servers` by `agent-chat-plugin` —\n * requires a reference to the running `McpClientManager` so mutations can\n * hot-reload the configured server set.\n *\n *   GET    /_agent-native/mcp/servers           list user + org servers\n *   POST   /_agent-native/mcp/servers           add a server\n *   DELETE /_agent-native/mcp/servers/:id       remove a server (scope via ?scope=)\n *   POST   /_agent-native/mcp/servers/:id/test  dry-run connect (no persist)\n *   POST   /_agent-native/mcp/servers/test      dry-run a URL before persisting\n *   GET    /_agent-native/mcp/builtin           list built-in capability toggles\n *   POST   /_agent-native/mcp/builtin           update built-in capability toggles\n *   POST   /_agent-native/mcp/apps/call-tool    mediated same-server app tool call\n *   POST   /_agent-native/mcp/apps/list-tools   list tools visible to an app iframe\n *   POST   /_agent-native/mcp/apps/read-resource read a ui:// app resource\n */\n\nimport {\n  defineEventHandler,\n  getMethod,\n  getQuery,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport { getAllSettings } from \"../settings/store.js\";\nimport {\n  buildMcpToolName,\n  parseMcpToolName,\n  type McpClientManager,\n  type McpTool,\n} from \"./manager.js\";\nimport type { McpConfig, McpServerConfig } from \"./config.js\";\nimport { loadMcpConfig, autoDetectMcpConfig } from \"./config.js\";\nimport { formatMcpConnectError } from \"./errors.js\";\nimport {\n  BUILTIN_MCP_CAPABILITIES,\n  getBuiltinMcpCapability,\n  isBuiltinMcpCapabilityAvailable,\n  normalizeBuiltinMcpCapabilityIds,\n  toBuiltinMcpServerConfig,\n  type BuiltinMcpCapability,\n  type BuiltinMcpCapabilityId,\n} from \"./builtin-capabilities.js\";\nimport {\n  builtinMcpCapabilitiesSettingsKey,\n  listEnabledBuiltinMcpCapabilities,\n  setBuiltinMcpCapabilityEnabled,\n  setEnabledBuiltinMcpCapabilities,\n} from \"./builtin-store.js\";\nimport {\n  addRemoteServer,\n  listRemoteServers,\n  mergedConfigKey,\n  removeRemoteServer,\n  toHttpServerConfigAsync,\n  validateRemoteUrl,\n  type RemoteMcpScope,\n  type StoredRemoteMcpServer,\n} from \"./remote-store.js\";\nimport { fetchHubServers } from \"./hub-client.js\";\nimport { loadWorkspaceMcpServers } from \"./workspace-servers.js\";\nimport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nimport { isToolVisibilityModelOnly } from \"@modelcontextprotocol/ext-apps/app-bridge\";\n\nexport { formatMcpConnectError } from \"./errors.js\";\n\n/** Redact obvious auth header values before sending to the client. */\nfunction redactHeaders(\n  headers?: Record<string, string>,\n): Record<string, { set: true }> | undefined {\n  if (!headers) return undefined;\n  const out: Record<string, { set: true }> = {};\n  for (const k of Object.keys(headers)) out[k] = { set: true };\n  return out;\n}\n\nfunction projectForClient(\n  stored: StoredRemoteMcpServer,\n  scope: RemoteMcpScope,\n  ownerId: string,\n  status: ServerStatus,\n): ClientServer {\n  return {\n    id: stored.id,\n    scope,\n    name: stored.name,\n    url: stored.url,\n    headers: redactHeaders(stored.headers),\n    description: stored.description,\n    createdAt: stored.createdAt,\n    mergedId: mergedConfigKey(scope, stored, ownerId),\n    status,\n  };\n}\n\nexport interface ClientServer {\n  id: string;\n  scope: RemoteMcpScope;\n  name: string;\n  url: string;\n  headers?: Record<string, { set: true }>;\n  description?: string;\n  createdAt: number;\n  /** The key under which this server is registered in the running MCP manager. */\n  mergedId: string;\n  status: ServerStatus;\n}\n\nexport interface ClientBuiltinCapability {\n  id: BuiltinMcpCapabilityId;\n  serverId: string;\n  name: string;\n  description: string;\n  command: string;\n  args: string[];\n  exclusiveGroup?: string;\n  available: boolean;\n  unavailableReason?: string;\n  notes?: string;\n  enabled: { user: boolean; org: boolean };\n  mergedIds: { user?: string; org?: string };\n  status: { user?: ServerStatus; org?: ServerStatus };\n}\n\ntype ServerStatus =\n  | { state: \"connected\"; toolCount: number }\n  | { state: \"error\"; error: string }\n  | { state: \"unknown\" };\n\nfunction statusFor(manager: McpClientManager, mergedId: string): ServerStatus {\n  const snap = manager.getStatus();\n  if (snap.connectedServers.includes(mergedId)) {\n    const toolCount = snap.tools.filter((t) => t.source === mergedId).length;\n    return { state: \"connected\", toolCount };\n  }\n  if (snap.errors[mergedId]) {\n    return { state: \"error\", error: snap.errors[mergedId] };\n  }\n  if (snap.configuredServers.includes(mergedId)) {\n    return { state: \"unknown\" };\n  }\n  return { state: \"unknown\" };\n}\n\nfunction pseudoStoredBuiltin(\n  capability: BuiltinMcpCapability,\n): StoredRemoteMcpServer {\n  return {\n    id: `builtin_${capability.id}`,\n    name: capability.serverId,\n    url: `builtin:${capability.id}`,\n    description: capability.description,\n    createdAt: 0,\n  };\n}\n\nexport function builtinMergedConfigKey(\n  scope: RemoteMcpScope,\n  capability: BuiltinMcpCapability,\n  ownerId: string,\n): string {\n  return mergedConfigKey(scope, pseudoStoredBuiltin(capability), ownerId);\n}\n\n/**\n * Build the merged MCP config the manager should run with: file/env config\n * plus **every** user-scope and org-scope remote server persisted in the\n * settings store. Scanning all scopes means a mutation from one user's\n * session never drops another user's servers from the running manager.\n *\n * Each persisted server's merged key includes its owner discriminator\n * (`user_<emailhash>_<name>` or `org_<orgId>_<name>`) so two users' servers\n * with the same name coexist; the request-time gate in\n * `isMcpToolAllowedForRequest` then scopes tool visibility back down to the\n * calling user.\n */\nexport async function buildMergedConfig(): Promise<McpConfig | null> {\n  const base = loadMcpConfig() ?? autoDetectMcpConfig();\n  const servers: Record<string, McpServerConfig> = { ...(base?.servers ?? {}) };\n\n  const all = await getAllSettings().catch(() => ({}));\n  for (const [fullKey, value] of Object.entries(all)) {\n    const userMatch = /^u:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    const orgMatch = /^o:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    let scope: RemoteMcpScope | null = null;\n    let ownerId: string | null = null;\n    if (userMatch) {\n      scope = \"user\";\n      ownerId = userMatch[1];\n    } else if (orgMatch) {\n      scope = \"org\";\n      ownerId = orgMatch[1];\n    }\n    if (!scope || !ownerId) continue;\n    const list = (value as { servers?: StoredRemoteMcpServer[] }).servers;\n    if (!Array.isArray(list)) continue;\n    for (const stored of list) {\n      if (!stored || typeof stored.url !== \"string\" || !stored.name) continue;\n      // Async resolve: decrypts `headerSecretKey` from app_secrets so the\n      // running MCP client gets the cleartext bearer at request time.\n      // Stored row contains only the secret-key reference, never the value.\n      servers[mergedConfigKey(scope, stored, ownerId)] =\n        await toHttpServerConfigAsync(scope, ownerId, stored);\n    }\n  }\n  for (const [fullKey, value] of Object.entries(all)) {\n    const settingsKey = builtinMcpCapabilitiesSettingsKey();\n    const userMatch = new RegExp(`^u:([^:]+):${settingsKey}$`).exec(fullKey);\n    const orgMatch = new RegExp(`^o:([^:]+):${settingsKey}$`).exec(fullKey);\n    let scope: RemoteMcpScope | null = null;\n    let ownerId: string | null = null;\n    if (userMatch) {\n      scope = \"user\";\n      ownerId = userMatch[1];\n    } else if (orgMatch) {\n      scope = \"org\";\n      ownerId = orgMatch[1];\n    }\n    if (!scope || !ownerId) continue;\n    const enabledIds = normalizeBuiltinMcpCapabilityIds(\n      Array.isArray((value as any).enabledIds)\n        ? (value as any).enabledIds.map(String)\n        : [],\n    );\n    for (const id of enabledIds) {\n      const capability = getBuiltinMcpCapability(id);\n      if (!capability || !isBuiltinMcpCapabilityAvailable(capability)) {\n        continue;\n      }\n      servers[builtinMergedConfigKey(scope, capability, ownerId)] =\n        toBuiltinMcpServerConfig(capability);\n    }\n  }\n\n  try {\n    const workspaceServers = await loadWorkspaceMcpServers();\n    for (const [mergedKey, cfg] of Object.entries(workspaceServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] workspace MCP resource merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  // Hub-consume: if this app is configured to consume from a remote hub\n  // (AGENT_NATIVE_MCP_HUB_URL + AGENT_NATIVE_MCP_HUB_TOKEN), pull its\n  // org-scope servers and merge. Hub entries use `hub_<orgId>_<name>` so\n  // they never collide with local `org_<orgId>_<name>` rows.\n  try {\n    const hubServers = await fetchHubServers();\n    for (const [mergedKey, cfg] of Object.entries(hubServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] hub merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  if (Object.keys(servers).length === 0) return null;\n  return { servers, source: base?.source ?? \"merged\" };\n}\n\nfunction sortedConfigSignature(config: McpConfig | null): string {\n  const entries = Object.entries(config?.servers ?? {}).sort(([a], [b]) =>\n    a.localeCompare(b),\n  );\n  return JSON.stringify(entries);\n}\n\nfunction mcpConfigRefreshIntervalMs(): number {\n  const raw = process.env.AGENT_NATIVE_MCP_CONFIG_REFRESH_MS;\n  if (raw?.trim() === \"0\") return 0;\n  const parsed = raw ? Number(raw) : NaN;\n  if (Number.isFinite(parsed) && parsed >= 5_000) return parsed;\n  return 60_000;\n}\n\nexport function startMcpConfigRefresh(\n  manager: McpClientManager,\n): (() => void) | null {\n  const intervalMs = mcpConfigRefreshIntervalMs();\n  if (intervalMs <= 0 || typeof setInterval !== \"function\") return null;\n\n  let currentSignature = sortedConfigSignature(manager.getConfig());\n  let refreshing = false;\n  const refresh = async () => {\n    if (refreshing) return;\n    refreshing = true;\n    try {\n      const next = await buildMergedConfig();\n      const nextSignature = sortedConfigSignature(next);\n      if (nextSignature !== currentSignature) {\n        await manager.reconfigure(next);\n        currentSignature = nextSignature;\n      }\n    } catch (err: any) {\n      console.warn(\n        `[mcp-client] config refresh failed: ${err?.message ?? err}`,\n      );\n    } finally {\n      refreshing = false;\n    }\n  };\n\n  const timer = setInterval(refresh, intervalMs);\n  (timer as { unref?: () => void }).unref?.();\n  return () => clearInterval(timer);\n}\n\nasync function resolveContextForRequest(event: H3Event): Promise<{\n  email: string | null;\n  orgId: string | null;\n  role: string | null;\n}> {\n  let email: string | null = null;\n  try {\n    const session = await getSession(event);\n    email = session?.email ?? null;\n  } catch {\n    email = null;\n  }\n  let orgId: string | null = null;\n  let role: string | null = null;\n  try {\n    const ctx = await getOrgContext(event);\n    orgId = ctx.orgId;\n    role = ctx.role;\n    if (!email) email = ctx.email;\n  } catch {\n    // ignore — no org context\n  }\n  // No silent `local@localhost` fallback — if `getSession` returns nothing in\n  // production (misconfigured deploy, expired token), the caller must reject\n  // rather than silently pool every unauthenticated request under one identity.\n  return { email, orgId, role };\n}\n\nasync function reconfigureManager(manager: McpClientManager): Promise<void> {\n  const merged = await buildMergedConfig();\n  await manager.reconfigure(merged);\n}\n\nexport function mountMcpServersRoutes(\n  nitroApp: any,\n  manager: McpClientManager,\n): void {\n  const mountedApps: WeakSet<object> = ((\n    globalThis as any\n  ).__agentNativeMcpServersMountedApps ??= new WeakSet<object>());\n  if (mountedApps.has(nitroApp)) return;\n  mountedApps.add(nitroApp);\n\n  try {\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/servers\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n\n        // POST /servers/test — dry-run a URL+headers before persisting\n        if (method === \"POST\" && parts.length === 1 && parts[0] === \"test\") {\n          return handleTestUrl(event);\n        }\n\n        // Collection root\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleList(event, manager);\n          if (method === \"POST\") return handleAdd(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        // /:id  /  /:id/test\n        if (parts.length === 1 || parts.length === 2) {\n          const id = parts[0];\n          if (parts.length === 2 && parts[1] === \"test\" && method === \"POST\") {\n            return handleTestExisting(event, manager, id);\n          }\n          if (parts.length === 1 && method === \"DELETE\") {\n            return handleDelete(event, manager, id);\n          }\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/builtin\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleBuiltinList(event, manager);\n          if (method === \"POST\") return handleBuiltinUpdate(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/apps\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (method !== \"POST\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        if (parts.length === 1 && parts[0] === \"call-tool\") {\n          return handleMcpAppCallTool(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"list-tools\") {\n          return handleMcpAppListTools(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"read-resource\") {\n          return handleMcpAppReadResource(event, manager);\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] Failed to mount MCP routes: ${err?.message ?? err}`,\n    );\n  }\n}\n\nasync function withMcpAppRequestContext<T>(\n  event: H3Event,\n  fn: () => Promise<T>,\n): Promise<T | { error: string }> {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  return runWithRequestContext(\n    {\n      userEmail: email ?? undefined,\n      orgId: orgId ?? undefined,\n    },\n    fn,\n  ) as Promise<T>;\n}\n\nfunction serverHasVisibleTools(\n  manager: McpClientManager,\n  serverId: string,\n): boolean {\n  return manager\n    .getToolsForServer(serverId)\n    .some(\n      (tool) =>\n        isMcpToolAllowedForRequest(tool.name) && isVisibleToMcpApp(tool),\n    );\n}\n\nfunction normalizeSameServerToolName(\n  serverId: string,\n  rawName: unknown,\n): string | null {\n  if (typeof rawName !== \"string\" || !rawName.trim()) return null;\n  const name = rawName.trim();\n  const parsed = parseMcpToolName(name);\n  if (!parsed) return name;\n  if (parsed.serverId !== serverId) return null;\n  return parsed.toolName;\n}\n\nfunction isVisibleToMcpApp(tool: McpTool): boolean {\n  try {\n    return !isToolVisibilityModelOnly(tool.raw as any);\n  } catch {\n    return true;\n  }\n}\n\nfunction mcpToolForClient(tool: McpTool) {\n  return {\n    name: tool.originalName,\n    ...(tool.title ? { title: tool.title } : {}),\n    description: tool.description,\n    inputSchema: tool.inputSchema,\n    ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),\n    ...(tool.annotations ? { annotations: tool.annotations } : {}),\n    ...(tool._meta ? { _meta: tool._meta } : {}),\n  };\n}\n\nfunction mcpAppCallableTool(\n  manager: McpClientManager,\n  serverId: string,\n  originalToolName: string,\n): McpTool | null {\n  const prefixedName = buildMcpToolName(serverId, originalToolName);\n  const tool =\n    manager\n      .getToolsForServer(serverId)\n      .find(\n        (candidate) =>\n          candidate.name === prefixedName ||\n          candidate.originalName === originalToolName,\n      ) ?? null;\n  if (!tool) return null;\n  if (!isMcpToolAllowedForRequest(tool.name) || !isVisibleToMcpApp(tool)) {\n    return null;\n  }\n  return tool;\n}\n\nasync function handleMcpAppCallTool(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    toolName?: unknown;\n    arguments?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const originalToolName = normalizeSameServerToolName(serverId, body.toolName);\n  if (!serverId || !originalToolName) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and same-server toolName are required\" };\n  }\n\n  return withMcpAppRequestContext(event, async () => {\n    const tool = mcpAppCallableTool(manager, serverId, originalToolName);\n    if (!tool) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP tool is not available in this request scope\" };\n    }\n    try {\n      return await manager.callTool(\n        tool.name,\n        body.arguments && typeof body.arguments === \"object\"\n          ? (body.arguments as Record<string, unknown>)\n          : {},\n      );\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP tool call failed\" };\n    }\n  });\n}\n\nasync function handleMcpAppListTools(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  if (!serverId) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId is required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    return {\n      tools: manager\n        .getToolsForServer(serverId)\n        .filter((tool) => isMcpToolAllowedForRequest(tool.name))\n        .filter(isVisibleToMcpApp)\n        .map(mcpToolForClient),\n    };\n  });\n}\n\nasync function handleMcpAppReadResource(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    uri?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const uri = typeof body.uri === \"string\" ? body.uri : \"\";\n  if (!serverId || !uri.startsWith(\"ui://\")) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and ui:// uri are required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    try {\n      return await manager.readResource(serverId, uri);\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP resource read failed\" };\n    }\n  });\n}\n\nasync function handleBuiltinList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  capabilities: ClientBuiltinCapability[];\n  user: { enabledIds: BuiltinMcpCapabilityId[] };\n  org: {\n    enabledIds: BuiltinMcpCapabilityId[];\n    orgId: string | null;\n    role: string | null;\n  };\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const userEnabled = email\n    ? await listEnabledBuiltinMcpCapabilities(\"user\", email)\n    : [];\n  const orgEnabled = orgId\n    ? await listEnabledBuiltinMcpCapabilities(\"org\", orgId)\n    : [];\n\n  return {\n    capabilities: BUILTIN_MCP_CAPABILITIES.map((capability) => {\n      const available = isBuiltinMcpCapabilityAvailable(capability);\n      const userMergedId = email\n        ? builtinMergedConfigKey(\"user\", capability, email)\n        : undefined;\n      const orgMergedId = orgId\n        ? builtinMergedConfigKey(\"org\", capability, orgId)\n        : undefined;\n      return {\n        id: capability.id,\n        serverId: capability.serverId,\n        name: capability.name,\n        description: capability.description,\n        command: capability.command,\n        args: capability.args,\n        exclusiveGroup: capability.exclusiveGroup,\n        available,\n        unavailableReason: available\n          ? undefined\n          : `Only available on ${capability.platforms?.join(\", \")}`,\n        notes: capability.notes,\n        enabled: {\n          user: userEnabled.includes(capability.id),\n          org: orgEnabled.includes(capability.id),\n        },\n        mergedIds: {\n          user: userMergedId,\n          org: orgMergedId,\n        },\n        status: {\n          user:\n            userMergedId && userEnabled.includes(capability.id)\n              ? statusFor(manager, userMergedId)\n              : undefined,\n          org:\n            orgMergedId && orgEnabled.includes(capability.id)\n              ? statusFor(manager, orgMergedId)\n              : undefined,\n        },\n      };\n    }),\n    user: { enabledIds: userEnabled },\n    org: { enabledIds: orgEnabled, orgId, role },\n  };\n}\n\nasync function handleBuiltinUpdate(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    enabledIds?: unknown;\n    id?: unknown;\n    enabled?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error:\n          \"You must belong to an organization to change org-scope built-ins\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can change org-scope MCP built-ins\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  if (Array.isArray(body.enabledIds)) {\n    for (const rawId of body.enabledIds) {\n      const error = validateBuiltinCapabilityForEnable(String(rawId));\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    }\n    await setEnabledBuiltinMcpCapabilities(\n      scope,\n      scopeId,\n      body.enabledIds.map(String),\n    );\n  } else if (typeof body.id === \"string\" && typeof body.enabled === \"boolean\") {\n    if (body.enabled) {\n      const error = validateBuiltinCapabilityForEnable(body.id);\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    } else if (!getBuiltinMcpCapability(body.id)) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n    const result = await setBuiltinMcpCapabilityEnabled(\n      scope,\n      scopeId,\n      body.id,\n      body.enabled,\n    );\n    if (!result) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n  } else {\n    setResponseStatus(event, 400);\n    return { error: \"Provide enabledIds or id + enabled\" };\n  }\n\n  await reconfigureManager(manager);\n  return handleBuiltinList(event, manager);\n}\n\nfunction validateBuiltinCapabilityForEnable(id: string): string | null {\n  const capability = getBuiltinMcpCapability(id);\n  if (!capability) return `Unknown built-in MCP capability \"${id}\"`;\n  if (!isBuiltinMcpCapabilityAvailable(capability)) {\n    return `${capability.name} is only available on ${capability.platforms?.join(\", \")}`;\n  }\n  return null;\n}\n\nasync function handleList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  user: ClientServer[];\n  org: ClientServer[];\n  orgId: string | null;\n  role: string | null;\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const userServers = email ? await listRemoteServers(\"user\", email) : [];\n  const orgServers = orgId ? await listRemoteServers(\"org\", orgId) : [];\n  return {\n    user: userServers.map((s) =>\n      projectForClient(\n        s,\n        \"user\",\n        email ?? \"\",\n        statusFor(manager, mergedConfigKey(\"user\", s, email ?? \"\")),\n      ),\n    ),\n    org: orgServers.map((s) =>\n      projectForClient(\n        s,\n        \"org\",\n        orgId ?? \"\",\n        statusFor(manager, mergedConfigKey(\"org\", s, orgId ?? \"\")),\n      ),\n    ),\n    orgId,\n    role,\n  };\n}\n\nasync function handleAdd(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    name?: unknown;\n    url?: unknown;\n    headers?: unknown;\n    description?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n  const name = typeof body.name === \"string\" ? body.name : \"\";\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  if (!name.trim() || !url.trim()) {\n    setResponseStatus(event, 400);\n    return { error: \"name and url are required\" };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const description =\n    typeof body.description === \"string\" ? body.description : undefined;\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error: \"You must belong to an organization to add an org-scope server\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return { error: \"Only owners and admins can add org-scope MCP servers\" };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const result = await addRemoteServer(scope, scopeId, {\n    name,\n    url,\n    headers,\n    description,\n  });\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { error: result.error };\n  }\n\n  await reconfigureManager(manager);\n  const mergedId = mergedConfigKey(scope, result.server, scopeId);\n  return {\n    ok: true,\n    server: projectForClient(\n      result.server,\n      scope,\n      scopeId,\n      statusFor(manager, mergedId),\n    ),\n  };\n}\n\nasync function handleDelete(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (parsedScope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"No active organization\" };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can remove org-scope MCP servers\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const removed = await removeRemoteServer(parsedScope, scopeId, id);\n  if (!removed) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  await reconfigureManager(manager);\n  return { ok: true };\n}\n\nasync function handleTestUrl(event: H3Event) {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email && !orgId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    url?: unknown;\n    headers?: unknown;\n  };\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  const check = validateRemoteUrl(url);\n  if (!check.ok) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: check.error };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const result = await tryConnect(check.url!.toString(), headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function handleTestExisting(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId } = await resolveContextForRequest(event);\n  const scopeId = parsedScope === \"user\" ? email : orgId;\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  const list = await listRemoteServers(parsedScope, scopeId);\n  const server = list.find((s) => s.id === id);\n  if (!server) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  const result = await tryConnect(server.url, server.headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function tryConnect(\n  url: string,\n  headers?: Record<string, string>,\n): Promise<\n  | { ok: true; toolCount: number; tools: string[] }\n  | { ok: false; error: string }\n> {\n  try {\n    const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([\n      import(\"@modelcontextprotocol/sdk/client/index.js\"),\n      import(\"@modelcontextprotocol/sdk/client/streamableHttp.js\"),\n    ]);\n    const requestInit: Record<string, unknown> = {};\n    if (headers && Object.keys(headers).length > 0) {\n      requestInit.headers = headers;\n    }\n    const transport = new StreamableHTTPClientTransport(new URL(url), {\n      requestInit,\n    });\n    const client = new Client(\n      { name: \"agent-native-mcp-client-test\", version: \"1.0.0\" },\n      { capabilities: {} },\n    );\n    try {\n      await client.connect(transport);\n      const listed = await client.listTools();\n      const names = ((listed?.tools ?? []) as Array<{ name: string }>).map(\n        (t) => t.name,\n      );\n      return { ok: true, toolCount: names.length, tools: names };\n    } finally {\n      try {\n        await client.close();\n      } catch {}\n      try {\n        await transport.close();\n      } catch {}\n    }\n  } catch (err: any) {\n    return { ok: false, error: formatMcpConnectError(err) };\n  }\n}\n\nfunction normalizeHeaders(input: unknown): Record<string, string> | undefined {\n  if (!input || typeof input !== \"object\") return undefined;\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input as Record<string, unknown>)) {\n    if (typeof k !== \"string\" || !k.trim()) continue;\n    if (typeof v !== \"string\") continue;\n    out[k.trim()] = v;\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n"]}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,EACnC,gCAAgC,EAChC,wBAAwB,GAGzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,sEAAsE;AACtE,SAAS,aAAa,CACpB,OAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA6B,EAC7B,KAAqB,EACrB,OAAe,EACf,MAAoB;IAEpB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;QACjD,MAAM;KACP,CAAC;AACJ,CAAC;AAoCD,SAAS,SAAS,CAAC,OAAyB,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAgC;IAEhC,OAAO;QACL,EAAE,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC9B,IAAI,EAAE,UAAU,CAAC,QAAQ;QACzB,GAAG,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAqB,EACrB,UAAgC,EAChC,OAAe;IAEf,OAAO,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAoC,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,CAAC;YACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACjC,MAAM,IAAI,GAAI,KAA+C,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,SAAS;YACxE,oEAAoE;YACpE,gEAAgE;YAChE,sEAAsE;YACtE,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,kCAAkC,EAAE,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,iCAAiC,EAAE,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxE,IAAI,KAAK,GAA0B,IAAI,CAAC;YACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,GAAG,MAAM,CAAC;gBACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,KAAK,GAAG,KAAK,CAAC;gBACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBAAE,SAAS;YACjC,MAAM,UAAU,GAAG,gCAAgC,CACjD,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,UAAU,CAAC;gBACtC,CAAC,CAAE,KAAa,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBACvC,CAAC,CAAC,EAAE,CACP,CAAC;YACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;gBAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChE,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;oBACzD,wBAAwB,CAAC,UAAU,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,qDAAqD,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CAC1G,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,kCAAkC,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAwB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;IAC3D,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAyB;IAEzB,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAChD,IAAI,UAAU,IAAI,CAAC,IAAI,OAAO,WAAW,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAEtE,IAAI,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAClE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,UAAU;YAAE,OAAO;QACvB,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;gBACvC,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAChC,gBAAgB,GAAG,aAAa,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,uCAAuC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC7D,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5C,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAAc;IAKpD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAClB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAChB,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAyB;IACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,OAAyB;IAEzB,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,kCAAkC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAChE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAE7D,+DAA+D;YAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACnE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,qBAAqB;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC9C,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/D,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAClE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBACnD,OAAO,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;gBACpD,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;gBACvD,OAAO,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,4CAA4C,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,EAAoB;IAEpB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,qBAAqB,CAC1B;QACE,SAAS,EAAE,KAAK,IAAI,SAAS;QAC7B,KAAK,EAAE,KAAK,IAAI,SAAS;KAC1B,EACD,EAAE,CACW,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAyB,EACzB,QAAgB;IAEhB,OAAO,OAAO;SACX,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CACnE,CAAC;AACN,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAgB,EAChB,OAAgB;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,YAAY;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAyB,EACzB,QAAgB,EAChB,gBAAwB;IAExB,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAClE,MAAM,IAAI,GACR,OAAO;SACJ,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,YAAY,KAAK,gBAAgB,CAC9C,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAc,EAAE,OAAyB;IAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAIpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,QAAQ,CAC3B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClD,CAAC,CAAE,IAAI,CAAC,SAAqC;gBAC7C,CAAC,CAAC,EAAE,CACP,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,OAAO;YACL,KAAK,EAAE,OAAO;iBACX,iBAAiB,CAAC,QAAQ,CAAC;iBAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACvD,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,gBAAgB,CAAC;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,0BAA0B,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,OAAyB;IAUzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,kCAAkC,EAAE,CAAC;IACvD,MAAM,WAAW,GACf,SAAS,IAAI,KAAK;QAChB,CAAC,CAAC,MAAM,iCAAiC,CAAC,MAAM,EAAE,KAAK,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GACd,SAAS,IAAI,KAAK;QAChB,CAAC,CAAC,MAAM,iCAAiC,CAAC,KAAK,EAAE,KAAK,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,YAAY,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAC3D,CAAC,UAAU,EAAE,EAAE;YACb,MAAM,SAAS,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAG,KAAK;gBACxB,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;gBACnD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,WAAW,GAAG,KAAK;gBACvB,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;gBAClD,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,SAAS;gBACT,iBAAiB,EAAE,SAAS;oBAC1B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,qBAAqB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3D,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;iBACxC;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,YAAY;oBAClB,GAAG,EAAE,WAAW;iBACjB;gBACD,MAAM,EAAE;oBACN,IAAI,EACF,YAAY,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACjD,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;wBAClC,CAAC,CAAC,SAAS;oBACf,GAAG,EACD,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC/C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;wBACjC,CAAC,CAAC,SAAS;iBAChB;aACF,CAAC;QACJ,CAAC,CACF;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;QACjC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,KAAc,EAAE,OAAyB;IAC1E,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,kEAAkE;aACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,2DAA2D;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,kCAAkC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,gCAAgC,CACpC,KAAK,EACL,OAAO,EACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAC5B,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,KAAK,EACL,OAAO,EACP,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,OAAO,CACb,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kCAAkC,CAAC,EAAU;IACpD,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,oCAAoC,EAAE,GAAG,CAAC;IAClE,IAAI,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;YAC1C,OAAO,0EAA0E,CAAC;QACpF,CAAC;QACD,OAAO,GAAG,UAAU,CAAC,IAAI,yBAAyB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAAc,EACd,OAAyB;IAOzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,gBAAgB,CACd,CAAC,EACD,MAAM,EACN,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC5D,CACF;QACD,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxB,gBAAgB,CACd,CAAC,EACD,KAAK,EACL,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC3D,CACF;QACD,KAAK;QACL,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAc,EAAE,OAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAMpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+DAA+D;aACvE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE;QACnD,IAAI;QACJ,GAAG;QACH,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,gBAAgB,CACtB,MAAM,CAAC,MAAM,EACb,KAAK,EACL,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,yDAAyD;aACjE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,OAAgC;IAKhC,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,6BAA6B,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxE,MAAM,CAAC,2CAA2C,CAAC;YACnD,MAAM,CAAC,oDAAoD,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YAChE,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1D,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAA6B,CAAC,GAAG,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC","sourcesContent":["/**\n * HTTP routes for user- and org-scope remote MCP server management.\n *\n * Mounted under `/_agent-native/mcp/servers` by `agent-chat-plugin` —\n * requires a reference to the running `McpClientManager` so mutations can\n * hot-reload the configured server set.\n *\n *   GET    /_agent-native/mcp/servers           list user + org servers\n *   POST   /_agent-native/mcp/servers           add a server\n *   DELETE /_agent-native/mcp/servers/:id       remove a server (scope via ?scope=)\n *   POST   /_agent-native/mcp/servers/:id/test  dry-run connect (no persist)\n *   POST   /_agent-native/mcp/servers/test      dry-run a URL before persisting\n *   GET    /_agent-native/mcp/builtin           list built-in capability toggles\n *   POST   /_agent-native/mcp/builtin           update built-in capability toggles\n *   POST   /_agent-native/mcp/apps/call-tool    mediated same-server app tool call\n *   POST   /_agent-native/mcp/apps/list-tools   list tools visible to an app iframe\n *   POST   /_agent-native/mcp/apps/read-resource read a ui:// app resource\n */\n\nimport {\n  defineEventHandler,\n  getMethod,\n  getQuery,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport { getAllSettings } from \"../settings/store.js\";\nimport {\n  buildMcpToolName,\n  parseMcpToolName,\n  type McpClientManager,\n  type McpTool,\n} from \"./manager.js\";\nimport type { McpConfig, McpServerConfig } from \"./config.js\";\nimport { loadMcpConfig, autoDetectMcpConfig } from \"./config.js\";\nimport { formatMcpConnectError } from \"./errors.js\";\nimport {\n  areBuiltinMcpCapabilitiesSupported,\n  BUILTIN_MCP_CAPABILITIES,\n  getBuiltinMcpCapability,\n  isBuiltinMcpCapabilityAvailable,\n  listSupportedBuiltinMcpCapabilities,\n  normalizeBuiltinMcpCapabilityIds,\n  toBuiltinMcpServerConfig,\n  type BuiltinMcpCapability,\n  type BuiltinMcpCapabilityId,\n} from \"./builtin-capabilities.js\";\nimport {\n  builtinMcpCapabilitiesSettingsKey,\n  listEnabledBuiltinMcpCapabilities,\n  setBuiltinMcpCapabilityEnabled,\n  setEnabledBuiltinMcpCapabilities,\n} from \"./builtin-store.js\";\nimport {\n  addRemoteServer,\n  listRemoteServers,\n  mergedConfigKey,\n  removeRemoteServer,\n  toHttpServerConfigAsync,\n  validateRemoteUrl,\n  type RemoteMcpScope,\n  type StoredRemoteMcpServer,\n} from \"./remote-store.js\";\nimport { fetchHubServers } from \"./hub-client.js\";\nimport { loadWorkspaceMcpServers } from \"./workspace-servers.js\";\nimport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nimport { isToolVisibilityModelOnly } from \"@modelcontextprotocol/ext-apps/app-bridge\";\n\nexport { formatMcpConnectError } from \"./errors.js\";\n\n/** Redact obvious auth header values before sending to the client. */\nfunction redactHeaders(\n  headers?: Record<string, string>,\n): Record<string, { set: true }> | undefined {\n  if (!headers) return undefined;\n  const out: Record<string, { set: true }> = {};\n  for (const k of Object.keys(headers)) out[k] = { set: true };\n  return out;\n}\n\nfunction projectForClient(\n  stored: StoredRemoteMcpServer,\n  scope: RemoteMcpScope,\n  ownerId: string,\n  status: ServerStatus,\n): ClientServer {\n  return {\n    id: stored.id,\n    scope,\n    name: stored.name,\n    url: stored.url,\n    headers: redactHeaders(stored.headers),\n    description: stored.description,\n    createdAt: stored.createdAt,\n    mergedId: mergedConfigKey(scope, stored, ownerId),\n    status,\n  };\n}\n\nexport interface ClientServer {\n  id: string;\n  scope: RemoteMcpScope;\n  name: string;\n  url: string;\n  headers?: Record<string, { set: true }>;\n  description?: string;\n  createdAt: number;\n  /** The key under which this server is registered in the running MCP manager. */\n  mergedId: string;\n  status: ServerStatus;\n}\n\nexport interface ClientBuiltinCapability {\n  id: BuiltinMcpCapabilityId;\n  serverId: string;\n  name: string;\n  description: string;\n  command: string;\n  args: string[];\n  exclusiveGroup?: string;\n  available: boolean;\n  unavailableReason?: string;\n  notes?: string;\n  enabled: { user: boolean; org: boolean };\n  mergedIds: { user?: string; org?: string };\n  status: { user?: ServerStatus; org?: ServerStatus };\n}\n\ntype ServerStatus =\n  | { state: \"connected\"; toolCount: number }\n  | { state: \"error\"; error: string }\n  | { state: \"unknown\" };\n\nfunction statusFor(manager: McpClientManager, mergedId: string): ServerStatus {\n  const snap = manager.getStatus();\n  if (snap.connectedServers.includes(mergedId)) {\n    const toolCount = snap.tools.filter((t) => t.source === mergedId).length;\n    return { state: \"connected\", toolCount };\n  }\n  if (snap.errors[mergedId]) {\n    return { state: \"error\", error: snap.errors[mergedId] };\n  }\n  if (snap.configuredServers.includes(mergedId)) {\n    return { state: \"unknown\" };\n  }\n  return { state: \"unknown\" };\n}\n\nfunction pseudoStoredBuiltin(\n  capability: BuiltinMcpCapability,\n): StoredRemoteMcpServer {\n  return {\n    id: `builtin_${capability.id}`,\n    name: capability.serverId,\n    url: `builtin:${capability.id}`,\n    description: capability.description,\n    createdAt: 0,\n  };\n}\n\nexport function builtinMergedConfigKey(\n  scope: RemoteMcpScope,\n  capability: BuiltinMcpCapability,\n  ownerId: string,\n): string {\n  return mergedConfigKey(scope, pseudoStoredBuiltin(capability), ownerId);\n}\n\n/**\n * Build the merged MCP config the manager should run with: file/env config\n * plus **every** user-scope and org-scope remote server persisted in the\n * settings store. Scanning all scopes means a mutation from one user's\n * session never drops another user's servers from the running manager.\n *\n * Each persisted server's merged key includes its owner discriminator\n * (`user_<emailhash>_<name>` or `org_<orgId>_<name>`) so two users' servers\n * with the same name coexist; the request-time gate in\n * `isMcpToolAllowedForRequest` then scopes tool visibility back down to the\n * calling user.\n */\nexport async function buildMergedConfig(): Promise<McpConfig | null> {\n  const base = loadMcpConfig() ?? autoDetectMcpConfig();\n  const servers: Record<string, McpServerConfig> = { ...(base?.servers ?? {}) };\n\n  const all = await getAllSettings().catch(() => ({}));\n  for (const [fullKey, value] of Object.entries(all)) {\n    const userMatch = /^u:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    const orgMatch = /^o:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    let scope: RemoteMcpScope | null = null;\n    let ownerId: string | null = null;\n    if (userMatch) {\n      scope = \"user\";\n      ownerId = userMatch[1];\n    } else if (orgMatch) {\n      scope = \"org\";\n      ownerId = orgMatch[1];\n    }\n    if (!scope || !ownerId) continue;\n    const list = (value as { servers?: StoredRemoteMcpServer[] }).servers;\n    if (!Array.isArray(list)) continue;\n    for (const stored of list) {\n      if (!stored || typeof stored.url !== \"string\" || !stored.name) continue;\n      // Async resolve: decrypts `headerSecretKey` from app_secrets so the\n      // running MCP client gets the cleartext bearer at request time.\n      // Stored row contains only the secret-key reference, never the value.\n      servers[mergedConfigKey(scope, stored, ownerId)] =\n        await toHttpServerConfigAsync(scope, ownerId, stored);\n    }\n  }\n  if (areBuiltinMcpCapabilitiesSupported()) {\n    for (const [fullKey, value] of Object.entries(all)) {\n      const settingsKey = builtinMcpCapabilitiesSettingsKey();\n      const userMatch = new RegExp(`^u:([^:]+):${settingsKey}$`).exec(fullKey);\n      const orgMatch = new RegExp(`^o:([^:]+):${settingsKey}$`).exec(fullKey);\n      let scope: RemoteMcpScope | null = null;\n      let ownerId: string | null = null;\n      if (userMatch) {\n        scope = \"user\";\n        ownerId = userMatch[1];\n      } else if (orgMatch) {\n        scope = \"org\";\n        ownerId = orgMatch[1];\n      }\n      if (!scope || !ownerId) continue;\n      const enabledIds = normalizeBuiltinMcpCapabilityIds(\n        Array.isArray((value as any).enabledIds)\n          ? (value as any).enabledIds.map(String)\n          : [],\n      );\n      for (const id of enabledIds) {\n        const capability = getBuiltinMcpCapability(id);\n        if (!capability || !isBuiltinMcpCapabilityAvailable(capability)) {\n          continue;\n        }\n        servers[builtinMergedConfigKey(scope, capability, ownerId)] =\n          toBuiltinMcpServerConfig(capability);\n      }\n    }\n  }\n\n  try {\n    const workspaceServers = await loadWorkspaceMcpServers();\n    for (const [mergedKey, cfg] of Object.entries(workspaceServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] workspace MCP resource merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  // Hub-consume: if this app is configured to consume from a remote hub\n  // (AGENT_NATIVE_MCP_HUB_URL + AGENT_NATIVE_MCP_HUB_TOKEN), pull its\n  // org-scope servers and merge. Hub entries use `hub_<orgId>_<name>` so\n  // they never collide with local `org_<orgId>_<name>` rows.\n  try {\n    const hubServers = await fetchHubServers();\n    for (const [mergedKey, cfg] of Object.entries(hubServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] hub merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  if (Object.keys(servers).length === 0) return null;\n  return { servers, source: base?.source ?? \"merged\" };\n}\n\nfunction sortedConfigSignature(config: McpConfig | null): string {\n  const entries = Object.entries(config?.servers ?? {}).sort(([a], [b]) =>\n    a.localeCompare(b),\n  );\n  return JSON.stringify(entries);\n}\n\nfunction mcpConfigRefreshIntervalMs(): number {\n  const raw = process.env.AGENT_NATIVE_MCP_CONFIG_REFRESH_MS;\n  if (raw?.trim() === \"0\") return 0;\n  const parsed = raw ? Number(raw) : NaN;\n  if (Number.isFinite(parsed) && parsed >= 5_000) return parsed;\n  return 60_000;\n}\n\nexport function startMcpConfigRefresh(\n  manager: McpClientManager,\n): (() => void) | null {\n  const intervalMs = mcpConfigRefreshIntervalMs();\n  if (intervalMs <= 0 || typeof setInterval !== \"function\") return null;\n\n  let currentSignature = sortedConfigSignature(manager.getConfig());\n  let refreshing = false;\n  const refresh = async () => {\n    if (refreshing) return;\n    refreshing = true;\n    try {\n      const next = await buildMergedConfig();\n      const nextSignature = sortedConfigSignature(next);\n      if (nextSignature !== currentSignature) {\n        await manager.reconfigure(next);\n        currentSignature = nextSignature;\n      }\n    } catch (err: any) {\n      console.warn(\n        `[mcp-client] config refresh failed: ${err?.message ?? err}`,\n      );\n    } finally {\n      refreshing = false;\n    }\n  };\n\n  const timer = setInterval(refresh, intervalMs);\n  (timer as { unref?: () => void }).unref?.();\n  return () => clearInterval(timer);\n}\n\nasync function resolveContextForRequest(event: H3Event): Promise<{\n  email: string | null;\n  orgId: string | null;\n  role: string | null;\n}> {\n  let email: string | null = null;\n  try {\n    const session = await getSession(event);\n    email = session?.email ?? null;\n  } catch {\n    email = null;\n  }\n  let orgId: string | null = null;\n  let role: string | null = null;\n  try {\n    const ctx = await getOrgContext(event);\n    orgId = ctx.orgId;\n    role = ctx.role;\n    if (!email) email = ctx.email;\n  } catch {\n    // ignore — no org context\n  }\n  // No silent `local@localhost` fallback — if `getSession` returns nothing in\n  // production (misconfigured deploy, expired token), the caller must reject\n  // rather than silently pool every unauthenticated request under one identity.\n  return { email, orgId, role };\n}\n\nasync function reconfigureManager(manager: McpClientManager): Promise<void> {\n  const merged = await buildMergedConfig();\n  await manager.reconfigure(merged);\n}\n\nexport function mountMcpServersRoutes(\n  nitroApp: any,\n  manager: McpClientManager,\n): void {\n  const mountedApps: WeakSet<object> = ((\n    globalThis as any\n  ).__agentNativeMcpServersMountedApps ??= new WeakSet<object>());\n  if (mountedApps.has(nitroApp)) return;\n  mountedApps.add(nitroApp);\n\n  try {\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/servers\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n\n        // POST /servers/test — dry-run a URL+headers before persisting\n        if (method === \"POST\" && parts.length === 1 && parts[0] === \"test\") {\n          return handleTestUrl(event);\n        }\n\n        // Collection root\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleList(event, manager);\n          if (method === \"POST\") return handleAdd(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        // /:id  /  /:id/test\n        if (parts.length === 1 || parts.length === 2) {\n          const id = parts[0];\n          if (parts.length === 2 && parts[1] === \"test\" && method === \"POST\") {\n            return handleTestExisting(event, manager, id);\n          }\n          if (parts.length === 1 && method === \"DELETE\") {\n            return handleDelete(event, manager, id);\n          }\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/builtin\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleBuiltinList(event, manager);\n          if (method === \"POST\") return handleBuiltinUpdate(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/apps\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (method !== \"POST\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        if (parts.length === 1 && parts[0] === \"call-tool\") {\n          return handleMcpAppCallTool(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"list-tools\") {\n          return handleMcpAppListTools(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"read-resource\") {\n          return handleMcpAppReadResource(event, manager);\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] Failed to mount MCP routes: ${err?.message ?? err}`,\n    );\n  }\n}\n\nasync function withMcpAppRequestContext<T>(\n  event: H3Event,\n  fn: () => Promise<T>,\n): Promise<T | { error: string }> {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  return runWithRequestContext(\n    {\n      userEmail: email ?? undefined,\n      orgId: orgId ?? undefined,\n    },\n    fn,\n  ) as Promise<T>;\n}\n\nfunction serverHasVisibleTools(\n  manager: McpClientManager,\n  serverId: string,\n): boolean {\n  return manager\n    .getToolsForServer(serverId)\n    .some(\n      (tool) =>\n        isMcpToolAllowedForRequest(tool.name) && isVisibleToMcpApp(tool),\n    );\n}\n\nfunction normalizeSameServerToolName(\n  serverId: string,\n  rawName: unknown,\n): string | null {\n  if (typeof rawName !== \"string\" || !rawName.trim()) return null;\n  const name = rawName.trim();\n  const parsed = parseMcpToolName(name);\n  if (!parsed) return name;\n  if (parsed.serverId !== serverId) return null;\n  return parsed.toolName;\n}\n\nfunction isVisibleToMcpApp(tool: McpTool): boolean {\n  try {\n    return !isToolVisibilityModelOnly(tool.raw as any);\n  } catch {\n    return true;\n  }\n}\n\nfunction mcpToolForClient(tool: McpTool) {\n  return {\n    name: tool.originalName,\n    ...(tool.title ? { title: tool.title } : {}),\n    description: tool.description,\n    inputSchema: tool.inputSchema,\n    ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),\n    ...(tool.annotations ? { annotations: tool.annotations } : {}),\n    ...(tool._meta ? { _meta: tool._meta } : {}),\n  };\n}\n\nfunction mcpAppCallableTool(\n  manager: McpClientManager,\n  serverId: string,\n  originalToolName: string,\n): McpTool | null {\n  const prefixedName = buildMcpToolName(serverId, originalToolName);\n  const tool =\n    manager\n      .getToolsForServer(serverId)\n      .find(\n        (candidate) =>\n          candidate.name === prefixedName ||\n          candidate.originalName === originalToolName,\n      ) ?? null;\n  if (!tool) return null;\n  if (!isMcpToolAllowedForRequest(tool.name) || !isVisibleToMcpApp(tool)) {\n    return null;\n  }\n  return tool;\n}\n\nasync function handleMcpAppCallTool(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    toolName?: unknown;\n    arguments?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const originalToolName = normalizeSameServerToolName(serverId, body.toolName);\n  if (!serverId || !originalToolName) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and same-server toolName are required\" };\n  }\n\n  return withMcpAppRequestContext(event, async () => {\n    const tool = mcpAppCallableTool(manager, serverId, originalToolName);\n    if (!tool) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP tool is not available in this request scope\" };\n    }\n    try {\n      return await manager.callTool(\n        tool.name,\n        body.arguments && typeof body.arguments === \"object\"\n          ? (body.arguments as Record<string, unknown>)\n          : {},\n      );\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP tool call failed\" };\n    }\n  });\n}\n\nasync function handleMcpAppListTools(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  if (!serverId) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId is required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    return {\n      tools: manager\n        .getToolsForServer(serverId)\n        .filter((tool) => isMcpToolAllowedForRequest(tool.name))\n        .filter(isVisibleToMcpApp)\n        .map(mcpToolForClient),\n    };\n  });\n}\n\nasync function handleMcpAppReadResource(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    uri?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const uri = typeof body.uri === \"string\" ? body.uri : \"\";\n  if (!serverId || !uri.startsWith(\"ui://\")) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and ui:// uri are required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    try {\n      return await manager.readResource(serverId, uri);\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP resource read failed\" };\n    }\n  });\n}\n\nasync function handleBuiltinList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  capabilities: ClientBuiltinCapability[];\n  user: { enabledIds: BuiltinMcpCapabilityId[] };\n  org: {\n    enabledIds: BuiltinMcpCapabilityId[];\n    orgId: string | null;\n    role: string | null;\n  };\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const supported = areBuiltinMcpCapabilitiesSupported();\n  const userEnabled =\n    supported && email\n      ? await listEnabledBuiltinMcpCapabilities(\"user\", email)\n      : [];\n  const orgEnabled =\n    supported && orgId\n      ? await listEnabledBuiltinMcpCapabilities(\"org\", orgId)\n      : [];\n\n  return {\n    capabilities: (supported ? BUILTIN_MCP_CAPABILITIES : []).map(\n      (capability) => {\n        const available = isBuiltinMcpCapabilityAvailable(capability);\n        const userMergedId = email\n          ? builtinMergedConfigKey(\"user\", capability, email)\n          : undefined;\n        const orgMergedId = orgId\n          ? builtinMergedConfigKey(\"org\", capability, orgId)\n          : undefined;\n        return {\n          id: capability.id,\n          serverId: capability.serverId,\n          name: capability.name,\n          description: capability.description,\n          command: capability.command,\n          args: capability.args,\n          exclusiveGroup: capability.exclusiveGroup,\n          available,\n          unavailableReason: available\n            ? undefined\n            : `Only available on ${capability.platforms?.join(\", \")}`,\n          notes: capability.notes,\n          enabled: {\n            user: userEnabled.includes(capability.id),\n            org: orgEnabled.includes(capability.id),\n          },\n          mergedIds: {\n            user: userMergedId,\n            org: orgMergedId,\n          },\n          status: {\n            user:\n              userMergedId && userEnabled.includes(capability.id)\n                ? statusFor(manager, userMergedId)\n                : undefined,\n            org:\n              orgMergedId && orgEnabled.includes(capability.id)\n                ? statusFor(manager, orgMergedId)\n                : undefined,\n          },\n        };\n      },\n    ),\n    user: { enabledIds: userEnabled },\n    org: { enabledIds: orgEnabled, orgId, role },\n  };\n}\n\nasync function handleBuiltinUpdate(event: H3Event, manager: McpClientManager) {\n  if (!areBuiltinMcpCapabilitiesSupported()) {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"Built-in local MCP capabilities are only available in local development.\",\n    };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    enabledIds?: unknown;\n    id?: unknown;\n    enabled?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error:\n          \"You must belong to an organization to change org-scope built-ins\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can change org-scope MCP built-ins\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  if (Array.isArray(body.enabledIds)) {\n    for (const rawId of body.enabledIds) {\n      const error = validateBuiltinCapabilityForEnable(String(rawId));\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    }\n    await setEnabledBuiltinMcpCapabilities(\n      scope,\n      scopeId,\n      body.enabledIds.map(String),\n    );\n  } else if (typeof body.id === \"string\" && typeof body.enabled === \"boolean\") {\n    if (body.enabled) {\n      const error = validateBuiltinCapabilityForEnable(body.id);\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    } else if (!getBuiltinMcpCapability(body.id)) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n    const result = await setBuiltinMcpCapabilityEnabled(\n      scope,\n      scopeId,\n      body.id,\n      body.enabled,\n    );\n    if (!result) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n  } else {\n    setResponseStatus(event, 400);\n    return { error: \"Provide enabledIds or id + enabled\" };\n  }\n\n  await reconfigureManager(manager);\n  return handleBuiltinList(event, manager);\n}\n\nfunction validateBuiltinCapabilityForEnable(id: string): string | null {\n  const capability = getBuiltinMcpCapability(id);\n  if (!capability) return `Unknown built-in MCP capability \"${id}\"`;\n  if (!listSupportedBuiltinMcpCapabilities().includes(capability)) {\n    if (!areBuiltinMcpCapabilitiesSupported()) {\n      return \"Built-in local MCP capabilities are only available in local development.\";\n    }\n    return `${capability.name} is only available on ${capability.platforms?.join(\", \")}`;\n  }\n  return null;\n}\n\nasync function handleList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  user: ClientServer[];\n  org: ClientServer[];\n  orgId: string | null;\n  role: string | null;\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const userServers = email ? await listRemoteServers(\"user\", email) : [];\n  const orgServers = orgId ? await listRemoteServers(\"org\", orgId) : [];\n  return {\n    user: userServers.map((s) =>\n      projectForClient(\n        s,\n        \"user\",\n        email ?? \"\",\n        statusFor(manager, mergedConfigKey(\"user\", s, email ?? \"\")),\n      ),\n    ),\n    org: orgServers.map((s) =>\n      projectForClient(\n        s,\n        \"org\",\n        orgId ?? \"\",\n        statusFor(manager, mergedConfigKey(\"org\", s, orgId ?? \"\")),\n      ),\n    ),\n    orgId,\n    role,\n  };\n}\n\nasync function handleAdd(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    name?: unknown;\n    url?: unknown;\n    headers?: unknown;\n    description?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n  const name = typeof body.name === \"string\" ? body.name : \"\";\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  if (!name.trim() || !url.trim()) {\n    setResponseStatus(event, 400);\n    return { error: \"name and url are required\" };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const description =\n    typeof body.description === \"string\" ? body.description : undefined;\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error: \"You must belong to an organization to add an org-scope server\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return { error: \"Only owners and admins can add org-scope MCP servers\" };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const result = await addRemoteServer(scope, scopeId, {\n    name,\n    url,\n    headers,\n    description,\n  });\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { error: result.error };\n  }\n\n  await reconfigureManager(manager);\n  const mergedId = mergedConfigKey(scope, result.server, scopeId);\n  return {\n    ok: true,\n    server: projectForClient(\n      result.server,\n      scope,\n      scopeId,\n      statusFor(manager, mergedId),\n    ),\n  };\n}\n\nasync function handleDelete(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (parsedScope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"No active organization\" };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can remove org-scope MCP servers\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const removed = await removeRemoteServer(parsedScope, scopeId, id);\n  if (!removed) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  await reconfigureManager(manager);\n  return { ok: true };\n}\n\nasync function handleTestUrl(event: H3Event) {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email && !orgId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    url?: unknown;\n    headers?: unknown;\n  };\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  const check = validateRemoteUrl(url);\n  if (!check.ok) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: check.error };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const result = await tryConnect(check.url!.toString(), headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function handleTestExisting(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId } = await resolveContextForRequest(event);\n  const scopeId = parsedScope === \"user\" ? email : orgId;\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  const list = await listRemoteServers(parsedScope, scopeId);\n  const server = list.find((s) => s.id === id);\n  if (!server) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  const result = await tryConnect(server.url, server.headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function tryConnect(\n  url: string,\n  headers?: Record<string, string>,\n): Promise<\n  | { ok: true; toolCount: number; tools: string[] }\n  | { ok: false; error: string }\n> {\n  try {\n    const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([\n      import(\"@modelcontextprotocol/sdk/client/index.js\"),\n      import(\"@modelcontextprotocol/sdk/client/streamableHttp.js\"),\n    ]);\n    const requestInit: Record<string, unknown> = {};\n    if (headers && Object.keys(headers).length > 0) {\n      requestInit.headers = headers;\n    }\n    const transport = new StreamableHTTPClientTransport(new URL(url), {\n      requestInit,\n    });\n    const client = new Client(\n      { name: \"agent-native-mcp-client-test\", version: \"1.0.0\" },\n      { capabilities: {} },\n    );\n    try {\n      await client.connect(transport);\n      const listed = await client.listTools();\n      const names = ((listed?.tools ?? []) as Array<{ name: string }>).map(\n        (t) => t.name,\n      );\n      return { ok: true, toolCount: names.length, tools: names };\n    } finally {\n      try {\n        await client.close();\n      } catch {}\n      try {\n        await transport.close();\n      } catch {}\n    }\n  } catch (err: any) {\n    return { ok: false, error: formatMcpConnectError(err) };\n  }\n}\n\nfunction normalizeHeaders(input: unknown): Record<string, string> | undefined {\n  if (!input || typeof input !== \"object\") return undefined;\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input as Record<string, unknown>)) {\n    if (typeof k !== \"string\" || !k.trim()) continue;\n    if (typeof v !== \"string\") continue;\n    out[k.trim()] = v;\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n"]}

package/dist/onboarding/default-steps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-steps.d.ts","sourceRoot":"","sources":["../../src/onboarding/default-steps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2RH,6DAA6D;AAC7D,wBAAgB,8BAA8B,IAAI,IAAI,CAOrD"}
+{"version":3,"file":"default-steps.d.ts","sourceRoot":"","sources":["../../src/onboarding/default-steps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6RH,6DAA6D;AAC7D,wBAAgB,8BAA8B,IAAI,IAAI,CAOrD"}

package/dist/onboarding/default-steps.js

@@ -94,13 +94,14 @@ const llmStep = {
     ],
     isComplete: async () => {
         try {
-            const { resolveHasBuilderPrivateKey } = await import("../server/credential-provider.js");
-            if (await resolveHasBuilderPrivateKey())
+            const { resolveHasCompleteBuilderConnection } = await import("../server/credential-provider.js");
+            if (await resolveHasCompleteBuilderConnection())
                 return true;
         }
         catch {
-            if (process.env.BUILDER_PRIVATE_KEY)
+            if (process.env.BUILDER_PRIVATE_KEY && process.env.BUILDER_PUBLIC_KEY) {
                 return true;
+            }
         }
         try {
             if (await detectEngineFromUserSecrets())

package/dist/onboarding/default-steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"default-steps.js","sourceRoot":"","sources":["../../src/onboarding/default-steps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAUlD,MAAM,eAAe,GAAmB;IACtC;QACE,QAAQ,EAAE,WAAW;QACrB,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,sCAAsC;KACpD;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,YAAY;QACtB,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,SAAS;QACnB,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,yCAAyC;KACvD;CACF,CAAC;AAEF,MAAM,OAAO,GAAmB;IAC9B,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,gEAAgE;IAC7E,OAAO,EAAE;QACP;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACT,mNAAmN;YACrN,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,KAAK,EAAE,KAAK;aACb;SACF;QACD,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;YACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE;gBACF,IAAI,EAAE,MAAe;gBACrB,KAAK;gBACL,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,OAAO,EAAE;oBACP,UAAU,EAAE,WAAoB;oBAChC,MAAM,EAAE;wBACN;4BACE,GAAG,EAAE,IAAI,CAAC,MAAM;4BAChB,KAAK,EAAE,IAAI,CAAC,MAAM;4BAClB,WAAW,EAAE,IAAI,CAAC,WAAW;4BAC7B,MAAM,EAAE,IAAI;yBACb;qBACF;iBACF;aACF,CAAC;QACJ,CAAC,CAAC;KACH;IACD,UAAU,EAAE,KAAK,IAAI,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,2BAA2B,EAAE,GACnC,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACnD,IAAI,MAAM,2BAA2B,EAAE;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;gBAAE,OAAO,IAAI,CAAC;QACnD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,2BAA2B,EAAE;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,CAAC;YACH,OAAO,8BAA8B,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,YAAY,GAAmB;IACnC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,UAAU;IACjB,WAAW,EACT,+GAA+G;IACjH,OAAO,EAAE;QACP;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,sDAAsD;YACnE,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,cAAc;wBACnB,KAAK,EAAE,cAAc;wBACrB,WAAW,EAAE,kDAAkD;qBAChE;oBACD;wBACE,GAAG,EAAE,qBAAqB;wBAC1B,KAAK,EAAE,iCAAiC;wBACxC,WAAW,EAAE,0CAA0C;wBACvD,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;KACF;IACD,kEAAkE;IAClE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;CACvB,CAAC;AAEF,yEAAyE;AACzE,MAAM,QAAQ,GAAmB;IAC/B,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,qHAAqH;IACvH,OAAO,EAAE;QACP;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBACtD;wBACE,GAAG,EAAE,sBAAsB;wBAC3B,KAAK,EAAE,sBAAsB;wBAC7B,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;QACD;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBACtD;wBACE,GAAG,EAAE,sBAAsB;wBAC3B,KAAK,EAAE,sBAAsB;wBAC7B,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;KACF;IACD,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;CACvB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,SAAS,GAAmB;IAChC,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,iIAAiI;IACnI,OAAO,EAAE;QACP;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,qCAAqC;YAClD,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,gBAAgB;wBACrB,KAAK,EAAE,gBAAgB;wBACvB,WAAW,EAAE,QAAQ;wBACrB,MAAM,EAAE,IAAI;qBACb;oBACD;wBACE,GAAG,EAAE,YAAY;wBACjB,KAAK,EAAE,2BAA2B;wBAClC,WAAW,EAAE,uCAAuC;qBACrD;oBACD;wBACE,GAAG,EAAE,UAAU;wBACf,KAAK,EAAE,mCAAmC;wBAC1C,WAAW,EAAE,YAAY;qBAC1B;iBACF;aACF;SACF;QACD;YACE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,uCAAuC;YACpD,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,kBAAkB;wBACvB,KAAK,EAAE,kBAAkB;wBACzB,WAAW,EAAE,QAAQ;wBACrB,MAAM,EAAE,IAAI;qBACb;oBACD;wBACE,GAAG,EAAE,YAAY;wBACjB,KAAK,EAAE,2BAA2B;wBAClC,WAAW,EAAE,uCAAuC;qBACrD;iBACF;aACF;SACF;KACF;IACD,UAAU,EAAE,GAAG,EAAE;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC5C,uEAAuE;QACvE,wEAAwE;QACxE,iBAAiB;QACjB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAC;AAEF,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB,6DAA6D;AAC7D,MAAM,UAAU,8BAA8B;IAC5C,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAClB,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACrC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACjC,sBAAsB,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC","sourcesContent":["/**\n * Default framework-level onboarding steps.\n *\n * Registered when `createOnboardingPlugin()` mounts (auto-mount or explicit).\n * Templates can override any step by registering another step with the same\n * `id` after these have been registered.\n */\n\nimport { registerOnboardingStep } from \"./registry.js\";\nimport type { OnboardingStep } from \"./types.js\";\nimport {\n  PROVIDER_ENV_META,\n  PROVIDER_ENV_VARS,\n} from \"../agent/engine/provider-env-vars.js\";\nimport {\n  detectEngineFromUserSecrets,\n  isAgentEngineSettingConfigured,\n} from \"../agent/engine/registry.js\";\nimport { getSetting } from \"../settings/store.js\";\n\ntype LlmKeyMethod = {\n  provider: keyof typeof PROVIDER_ENV_META;\n  id: string;\n  label: string;\n  description: string;\n  primary?: boolean;\n};\n\nconst LLM_KEY_METHODS: LlmKeyMethod[] = [\n  {\n    provider: \"anthropic\",\n    id: \"anthropic-key\",\n    label: \"Anthropic\",\n    description: \"Claude models with your own Anthropic key.\",\n  },\n  {\n    provider: \"openai\",\n    id: \"openai-key\",\n    label: \"OpenAI\",\n    description: \"GPT models with your own OpenAI key.\",\n  },\n  {\n    provider: \"google\",\n    id: \"google-key\",\n    label: \"Google Gemini\",\n    description: \"Gemini models with your own Google AI key.\",\n  },\n  {\n    provider: \"openrouter\",\n    id: \"openrouter-key\",\n    label: \"OpenRouter\",\n    description: \"OpenRouter models with your own OpenRouter key.\",\n  },\n  {\n    provider: \"groq\",\n    id: \"groq-key\",\n    label: \"Groq\",\n    description: \"Groq-hosted models with your own Groq key.\",\n  },\n  {\n    provider: \"mistral\",\n    id: \"mistral-key\",\n    label: \"Mistral\",\n    description: \"Mistral models with your own Mistral key.\",\n  },\n  {\n    provider: \"cohere\",\n    id: \"cohere-key\",\n    label: \"Cohere\",\n    description: \"Cohere models with your own Cohere key.\",\n  },\n];\n\nconst llmStep: OnboardingStep = {\n  id: \"llm\",\n  order: 10,\n  required: true,\n  title: \"Connect an AI engine\",\n  description: \"Use Builder's managed gateway, or bring your own provider key.\",\n  methods: [\n    {\n      id: \"builder\",\n      kind: \"builder-cli-auth\",\n      label: \"Connect Builder\",\n      description:\n        \"Connect the Builder space where this app should run. This unlocks managed LLM credits, browser automation, and file uploads. Cloud code changes appear when Builder Cloud Agents are available for the workspace.\",\n      primary: true,\n      payload: {\n        scope: \"llm\",\n      },\n    },\n    ...LLM_KEY_METHODS.map(({ provider, id, label, description, primary }) => {\n      const meta = PROVIDER_ENV_META[provider];\n      return {\n        id,\n        kind: \"form\" as const,\n        label,\n        description,\n        ...(primary ? { primary: true } : {}),\n        payload: {\n          writeScope: \"workspace\" as const,\n          fields: [\n            {\n              key: meta.envVar,\n              label: meta.envVar,\n              placeholder: meta.placeholder,\n              secret: true,\n            },\n          ],\n        },\n      };\n    }),\n  ],\n  isComplete: async () => {\n    try {\n      const { resolveHasBuilderPrivateKey } =\n        await import(\"../server/credential-provider.js\");\n      if (await resolveHasBuilderPrivateKey()) return true;\n    } catch {\n      if (process.env.BUILDER_PRIVATE_KEY) return true;\n    }\n    try {\n      if (await detectEngineFromUserSecrets()) return true;\n    } catch {\n      // Fall through to legacy/env detection.\n    }\n    if (PROVIDER_ENV_VARS.some((k) => !!process.env[k])) return true;\n    try {\n      return isAgentEngineSettingConfigured(await getSetting(\"agent-engine\"));\n    } catch {\n      return false;\n    }\n  },\n};\n\n/** Step 2 — where application data lives. The default DB is non-blocking. */\nconst databaseStep: OnboardingStep = {\n  id: \"database\",\n  order: 20,\n  required: false,\n  title: \"Database\",\n  description:\n    \"Agent-native stores app data in SQL. Set DATABASE_URL when you want to point this app at a specific database.\",\n  methods: [\n    {\n      id: \"database-url\",\n      kind: \"form\",\n      label: \"Set DATABASE_URL\",\n      description: \"Paste the SQL connection string this app should use.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"DATABASE_URL\",\n            label: \"DATABASE_URL\",\n            placeholder: \"postgres://..., libsql://..., file:./data/app.db\",\n          },\n          {\n            key: \"DATABASE_AUTH_TOKEN\",\n            label: \"DATABASE_AUTH_TOKEN (if needed)\",\n            placeholder: \"Token for providers such as Turso/libSQL\",\n            secret: true,\n          },\n        ],\n      },\n    },\n  ],\n  // The default local database means this step is always satisfied.\n  isComplete: () => true,\n};\n\n/** Step 3 — how users sign in. Built-in account auth is non-blocking. */\nconst authStep: OnboardingStep = {\n  id: \"auth\",\n  order: 30,\n  required: false,\n  title: \"Authentication\",\n  description:\n    \"Built-in email/password accounts work by default. Add OAuth or access tokens only if you want another sign-in path.\",\n  methods: [\n    {\n      id: \"google-oauth\",\n      kind: \"form\",\n      label: \"Google OAuth\",\n      description: \"Add Google as an optional sign-in provider.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          { key: \"GOOGLE_CLIENT_ID\", label: \"GOOGLE_CLIENT_ID\" },\n          {\n            key: \"GOOGLE_CLIENT_SECRET\",\n            label: \"GOOGLE_CLIENT_SECRET\",\n            secret: true,\n          },\n        ],\n      },\n    },\n    {\n      id: \"github-oauth\",\n      kind: \"form\",\n      label: \"GitHub OAuth\",\n      description: \"Add GitHub as an optional sign-in provider.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          { key: \"GITHUB_CLIENT_ID\", label: \"GITHUB_CLIENT_ID\" },\n          {\n            key: \"GITHUB_CLIENT_SECRET\",\n            label: \"GITHUB_CLIENT_SECRET\",\n            secret: true,\n          },\n        ],\n      },\n    },\n  ],\n  isComplete: () => true,\n};\n\n/** Step 4 — transactional email (password resets, invitations). Optional. */\nconst emailStep: OnboardingStep = {\n  id: \"email\",\n  order: 40,\n  required: false,\n  title: \"Email delivery\",\n  description:\n    \"Optional for local work. Before deploying with password resets, invitations, or share notifications, connect an email provider.\",\n  methods: [\n    {\n      id: \"resend\",\n      kind: \"form\",\n      label: \"Resend\",\n      description: \"Use Resend for transactional email.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"RESEND_API_KEY\",\n            label: \"RESEND_API_KEY\",\n            placeholder: \"re_...\",\n            secret: true,\n          },\n          {\n            key: \"EMAIL_FROM\",\n            label: \"EMAIL_FROM (from address)\",\n            placeholder: \"Agent Native <noreply@yourdomain.com>\",\n          },\n          {\n            key: \"APP_NAME\",\n            label: \"APP_NAME (shown in invite emails)\",\n            placeholder: \"Acme Forms\",\n          },\n        ],\n      },\n    },\n    {\n      id: \"sendgrid\",\n      kind: \"form\",\n      label: \"SendGrid\",\n      description: \"Use SendGrid for transactional email.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"SENDGRID_API_KEY\",\n            label: \"SENDGRID_API_KEY\",\n            placeholder: \"SG....\",\n            secret: true,\n          },\n          {\n            key: \"EMAIL_FROM\",\n            label: \"EMAIL_FROM (from address)\",\n            placeholder: \"Agent Native <noreply@yourdomain.com>\",\n          },\n        ],\n      },\n    },\n  ],\n  isComplete: () => {\n    if (process.env.RESEND_API_KEY) return true;\n    // SendGrid rejects Resend's sandbox sender, so EMAIL_FROM must also be\n    // set — otherwise sendEmail() throws at runtime even though the API key\n    // is configured.\n    if (process.env.SENDGRID_API_KEY) return !!process.env.EMAIL_FROM;\n    return false;\n  },\n};\n\nlet registered = false;\n\n/** Idempotent. Safe to call from every plugin-mount call. */\nexport function registerDefaultOnboardingSteps(): void {\n  if (registered) return;\n  registered = true;\n  registerOnboardingStep(llmStep);\n  registerOnboardingStep(databaseStep);\n  registerOnboardingStep(authStep);\n  registerOnboardingStep(emailStep);\n}\n"]}
+{"version":3,"file":"default-steps.js","sourceRoot":"","sources":["../../src/onboarding/default-steps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAUlD,MAAM,eAAe,GAAmB;IACtC;QACE,QAAQ,EAAE,WAAW;QACrB,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,sCAAsC;KACpD;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,YAAY;QACtB,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,SAAS;QACnB,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,yCAAyC;KACvD;CACF,CAAC;AAEF,MAAM,OAAO,GAAmB;IAC9B,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,gEAAgE;IAC7E,OAAO,EAAE;QACP;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACT,mNAAmN;YACrN,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,KAAK,EAAE,KAAK;aACb;SACF;QACD,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;YACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE;gBACF,IAAI,EAAE,MAAe;gBACrB,KAAK;gBACL,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,OAAO,EAAE;oBACP,UAAU,EAAE,WAAoB;oBAChC,MAAM,EAAE;wBACN;4BACE,GAAG,EAAE,IAAI,CAAC,MAAM;4BAChB,KAAK,EAAE,IAAI,CAAC,MAAM;4BAClB,WAAW,EAAE,IAAI,CAAC,WAAW;4BAC7B,MAAM,EAAE,IAAI;yBACb;qBACF;iBACF;aACF,CAAC;QACJ,CAAC,CAAC;KACH;IACD,UAAU,EAAE,KAAK,IAAI,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,mCAAmC,EAAE,GAC3C,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACnD,IAAI,MAAM,mCAAmC,EAAE;gBAAE,OAAO,IAAI,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,2BAA2B,EAAE;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,CAAC;YACH,OAAO,8BAA8B,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,YAAY,GAAmB;IACnC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,UAAU;IACjB,WAAW,EACT,+GAA+G;IACjH,OAAO,EAAE;QACP;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,sDAAsD;YACnE,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,cAAc;wBACnB,KAAK,EAAE,cAAc;wBACrB,WAAW,EAAE,kDAAkD;qBAChE;oBACD;wBACE,GAAG,EAAE,qBAAqB;wBAC1B,KAAK,EAAE,iCAAiC;wBACxC,WAAW,EAAE,0CAA0C;wBACvD,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;KACF;IACD,kEAAkE;IAClE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;CACvB,CAAC;AAEF,yEAAyE;AACzE,MAAM,QAAQ,GAAmB;IAC/B,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,qHAAqH;IACvH,OAAO,EAAE;QACP;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBACtD;wBACE,GAAG,EAAE,sBAAsB;wBAC3B,KAAK,EAAE,sBAAsB;wBAC7B,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;QACD;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBACtD;wBACE,GAAG,EAAE,sBAAsB;wBAC3B,KAAK,EAAE,sBAAsB;wBAC7B,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;KACF;IACD,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;CACvB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,SAAS,GAAmB;IAChC,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,iIAAiI;IACnI,OAAO,EAAE;QACP;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,qCAAqC;YAClD,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,gBAAgB;wBACrB,KAAK,EAAE,gBAAgB;wBACvB,WAAW,EAAE,QAAQ;wBACrB,MAAM,EAAE,IAAI;qBACb;oBACD;wBACE,GAAG,EAAE,YAAY;wBACjB,KAAK,EAAE,2BAA2B;wBAClC,WAAW,EAAE,uCAAuC;qBACrD;oBACD;wBACE,GAAG,EAAE,UAAU;wBACf,KAAK,EAAE,mCAAmC;wBAC1C,WAAW,EAAE,YAAY;qBAC1B;iBACF;aACF;SACF;QACD;YACE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,uCAAuC;YACpD,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,kBAAkB;wBACvB,KAAK,EAAE,kBAAkB;wBACzB,WAAW,EAAE,QAAQ;wBACrB,MAAM,EAAE,IAAI;qBACb;oBACD;wBACE,GAAG,EAAE,YAAY;wBACjB,KAAK,EAAE,2BAA2B;wBAClC,WAAW,EAAE,uCAAuC;qBACrD;iBACF;aACF;SACF;KACF;IACD,UAAU,EAAE,GAAG,EAAE;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC5C,uEAAuE;QACvE,wEAAwE;QACxE,iBAAiB;QACjB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAC;AAEF,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB,6DAA6D;AAC7D,MAAM,UAAU,8BAA8B;IAC5C,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAClB,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACrC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACjC,sBAAsB,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC","sourcesContent":["/**\n * Default framework-level onboarding steps.\n *\n * Registered when `createOnboardingPlugin()` mounts (auto-mount or explicit).\n * Templates can override any step by registering another step with the same\n * `id` after these have been registered.\n */\n\nimport { registerOnboardingStep } from \"./registry.js\";\nimport type { OnboardingStep } from \"./types.js\";\nimport {\n  PROVIDER_ENV_META,\n  PROVIDER_ENV_VARS,\n} from \"../agent/engine/provider-env-vars.js\";\nimport {\n  detectEngineFromUserSecrets,\n  isAgentEngineSettingConfigured,\n} from \"../agent/engine/registry.js\";\nimport { getSetting } from \"../settings/store.js\";\n\ntype LlmKeyMethod = {\n  provider: keyof typeof PROVIDER_ENV_META;\n  id: string;\n  label: string;\n  description: string;\n  primary?: boolean;\n};\n\nconst LLM_KEY_METHODS: LlmKeyMethod[] = [\n  {\n    provider: \"anthropic\",\n    id: \"anthropic-key\",\n    label: \"Anthropic\",\n    description: \"Claude models with your own Anthropic key.\",\n  },\n  {\n    provider: \"openai\",\n    id: \"openai-key\",\n    label: \"OpenAI\",\n    description: \"GPT models with your own OpenAI key.\",\n  },\n  {\n    provider: \"google\",\n    id: \"google-key\",\n    label: \"Google Gemini\",\n    description: \"Gemini models with your own Google AI key.\",\n  },\n  {\n    provider: \"openrouter\",\n    id: \"openrouter-key\",\n    label: \"OpenRouter\",\n    description: \"OpenRouter models with your own OpenRouter key.\",\n  },\n  {\n    provider: \"groq\",\n    id: \"groq-key\",\n    label: \"Groq\",\n    description: \"Groq-hosted models with your own Groq key.\",\n  },\n  {\n    provider: \"mistral\",\n    id: \"mistral-key\",\n    label: \"Mistral\",\n    description: \"Mistral models with your own Mistral key.\",\n  },\n  {\n    provider: \"cohere\",\n    id: \"cohere-key\",\n    label: \"Cohere\",\n    description: \"Cohere models with your own Cohere key.\",\n  },\n];\n\nconst llmStep: OnboardingStep = {\n  id: \"llm\",\n  order: 10,\n  required: true,\n  title: \"Connect an AI engine\",\n  description: \"Use Builder's managed gateway, or bring your own provider key.\",\n  methods: [\n    {\n      id: \"builder\",\n      kind: \"builder-cli-auth\",\n      label: \"Connect Builder\",\n      description:\n        \"Connect the Builder space where this app should run. This unlocks managed LLM credits, browser automation, and file uploads. Cloud code changes appear when Builder Cloud Agents are available for the workspace.\",\n      primary: true,\n      payload: {\n        scope: \"llm\",\n      },\n    },\n    ...LLM_KEY_METHODS.map(({ provider, id, label, description, primary }) => {\n      const meta = PROVIDER_ENV_META[provider];\n      return {\n        id,\n        kind: \"form\" as const,\n        label,\n        description,\n        ...(primary ? { primary: true } : {}),\n        payload: {\n          writeScope: \"workspace\" as const,\n          fields: [\n            {\n              key: meta.envVar,\n              label: meta.envVar,\n              placeholder: meta.placeholder,\n              secret: true,\n            },\n          ],\n        },\n      };\n    }),\n  ],\n  isComplete: async () => {\n    try {\n      const { resolveHasCompleteBuilderConnection } =\n        await import(\"../server/credential-provider.js\");\n      if (await resolveHasCompleteBuilderConnection()) return true;\n    } catch {\n      if (process.env.BUILDER_PRIVATE_KEY && process.env.BUILDER_PUBLIC_KEY) {\n        return true;\n      }\n    }\n    try {\n      if (await detectEngineFromUserSecrets()) return true;\n    } catch {\n      // Fall through to legacy/env detection.\n    }\n    if (PROVIDER_ENV_VARS.some((k) => !!process.env[k])) return true;\n    try {\n      return isAgentEngineSettingConfigured(await getSetting(\"agent-engine\"));\n    } catch {\n      return false;\n    }\n  },\n};\n\n/** Step 2 — where application data lives. The default DB is non-blocking. */\nconst databaseStep: OnboardingStep = {\n  id: \"database\",\n  order: 20,\n  required: false,\n  title: \"Database\",\n  description:\n    \"Agent-native stores app data in SQL. Set DATABASE_URL when you want to point this app at a specific database.\",\n  methods: [\n    {\n      id: \"database-url\",\n      kind: \"form\",\n      label: \"Set DATABASE_URL\",\n      description: \"Paste the SQL connection string this app should use.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"DATABASE_URL\",\n            label: \"DATABASE_URL\",\n            placeholder: \"postgres://..., libsql://..., file:./data/app.db\",\n          },\n          {\n            key: \"DATABASE_AUTH_TOKEN\",\n            label: \"DATABASE_AUTH_TOKEN (if needed)\",\n            placeholder: \"Token for providers such as Turso/libSQL\",\n            secret: true,\n          },\n        ],\n      },\n    },\n  ],\n  // The default local database means this step is always satisfied.\n  isComplete: () => true,\n};\n\n/** Step 3 — how users sign in. Built-in account auth is non-blocking. */\nconst authStep: OnboardingStep = {\n  id: \"auth\",\n  order: 30,\n  required: false,\n  title: \"Authentication\",\n  description:\n    \"Built-in email/password accounts work by default. Add OAuth or access tokens only if you want another sign-in path.\",\n  methods: [\n    {\n      id: \"google-oauth\",\n      kind: \"form\",\n      label: \"Google OAuth\",\n      description: \"Add Google as an optional sign-in provider.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          { key: \"GOOGLE_CLIENT_ID\", label: \"GOOGLE_CLIENT_ID\" },\n          {\n            key: \"GOOGLE_CLIENT_SECRET\",\n            label: \"GOOGLE_CLIENT_SECRET\",\n            secret: true,\n          },\n        ],\n      },\n    },\n    {\n      id: \"github-oauth\",\n      kind: \"form\",\n      label: \"GitHub OAuth\",\n      description: \"Add GitHub as an optional sign-in provider.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          { key: \"GITHUB_CLIENT_ID\", label: \"GITHUB_CLIENT_ID\" },\n          {\n            key: \"GITHUB_CLIENT_SECRET\",\n            label: \"GITHUB_CLIENT_SECRET\",\n            secret: true,\n          },\n        ],\n      },\n    },\n  ],\n  isComplete: () => true,\n};\n\n/** Step 4 — transactional email (password resets, invitations). Optional. */\nconst emailStep: OnboardingStep = {\n  id: \"email\",\n  order: 40,\n  required: false,\n  title: \"Email delivery\",\n  description:\n    \"Optional for local work. Before deploying with password resets, invitations, or share notifications, connect an email provider.\",\n  methods: [\n    {\n      id: \"resend\",\n      kind: \"form\",\n      label: \"Resend\",\n      description: \"Use Resend for transactional email.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"RESEND_API_KEY\",\n            label: \"RESEND_API_KEY\",\n            placeholder: \"re_...\",\n            secret: true,\n          },\n          {\n            key: \"EMAIL_FROM\",\n            label: \"EMAIL_FROM (from address)\",\n            placeholder: \"Agent Native <noreply@yourdomain.com>\",\n          },\n          {\n            key: \"APP_NAME\",\n            label: \"APP_NAME (shown in invite emails)\",\n            placeholder: \"Acme Forms\",\n          },\n        ],\n      },\n    },\n    {\n      id: \"sendgrid\",\n      kind: \"form\",\n      label: \"SendGrid\",\n      description: \"Use SendGrid for transactional email.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"SENDGRID_API_KEY\",\n            label: \"SENDGRID_API_KEY\",\n            placeholder: \"SG....\",\n            secret: true,\n          },\n          {\n            key: \"EMAIL_FROM\",\n            label: \"EMAIL_FROM (from address)\",\n            placeholder: \"Agent Native <noreply@yourdomain.com>\",\n          },\n        ],\n      },\n    },\n  ],\n  isComplete: () => {\n    if (process.env.RESEND_API_KEY) return true;\n    // SendGrid rejects Resend's sandbox sender, so EMAIL_FROM must also be\n    // set — otherwise sendEmail() throws at runtime even though the API key\n    // is configured.\n    if (process.env.SENDGRID_API_KEY) return !!process.env.EMAIL_FROM;\n    return false;\n  },\n};\n\nlet registered = false;\n\n/** Idempotent. Safe to call from every plugin-mount call. */\nexport function registerDefaultOnboardingSteps(): void {\n  if (registered) return;\n  registered = true;\n  registerOnboardingStep(llmStep);\n  registerOnboardingStep(databaseStep);\n  registerOnboardingStep(authStep);\n  registerOnboardingStep(emailStep);\n}\n"]}

package/dist/secrets/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAuHjD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3C;AAMD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA0C3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAItD;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA2B5B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CA0BvB;AAeD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAStE"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA0HjD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3C;AAMD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA0C3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAItD;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA2B5B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CA0BvB;AAeD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAStE"}

package/dist/secrets/storage.js

@@ -42,7 +42,10 @@ async function ensureTable() {
             catch {
                 // Column already exists — expected
             }
-        })();
+        })().catch((err) => {
+            _initPromise = undefined;
+            throw err;
+        });
     }
     return _initPromise;
 }

package/dist/secrets/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,UAAU,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAGrD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,GAAG,GAAG,UAAU,EAAE;gBACtB,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC;gBAC1D,CAAC,CAAC,sBAAsB,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAE1B,2DAA2D;YAC3D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qDAAqD,CACtD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;YAED,2CAA2C;YAC3C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB;IACvB,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAEvE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,0FAA0F;gBAC1F,yFAAyF;gBACzF,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,IAAI,CAAC;YACvB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,0FAA0F;gBACxF,qEAAqE;gBACrE,iEAAiE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,wBAAwB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;IACrE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,4EAA4E;AAC5E,SAAS,YAAY,CAAC,SAAiB;IACrC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAC1B,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAoBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAEtC,4EAA4E;IAC5E,0BAA0B;IAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yEAAyE;QAC9E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAY,CAAC;QAChC,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,6GAA6G;YAClH,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,4JAA4J;QACjK,IAAI,EAAE;YACJ,EAAE;YACF,KAAK;YACL,OAAO;YACP,GAAG;YACH,SAAS;YACT,WAAW,IAAI,IAAI;YACnB,YAAY,IAAI,IAAI;YACpB,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,0GAA0G;QAC/G,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAyB,CAAC,CAAC;QAC9D,OAAO;YACL,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAc;IAEd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,kJAAkJ;QACvJ,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;QAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG;QACH,KAAK;QACL,OAAO;QACP,KAAK,EAAE,UAAU;QACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkB,EAClB,OAAe;IAEf,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,4JAA4J;QACjK,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;YAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAa;YACtB,KAAK;YACL,OAAO;YACP,KAAK,EAAE,UAAU;YACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;YACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;YAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;SACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAkB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc;IAClD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC5C,GAAG,EAAE,sEAAsE;QAC3E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["/**\n * Storage layer for the framework secrets registry.\n *\n * Values are encrypted at rest with AES-256-GCM. The encryption key is\n * derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the existing\n * `BETTER_AUTH_SECRET` env var (fallback so templates don't need a second\n * secret during development). If neither is set in production we fall back\n * to a machine-local key derived from the cwd — the secret is still only\n * readable on this machine, but consider setting `SECRETS_ENCRYPTION_KEY`\n * for a stable, rotatable key.\n *\n * Secret values are NEVER logged and NEVER returned from any route handler.\n */\n\nimport {\n  randomUUID,\n  randomBytes,\n  createCipheriv,\n  createDecipheriv,\n  createHash,\n} from \"node:crypto\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { APP_SECRETS_CREATE_SQL } from \"./schema.js\";\nimport type { SecretScope } from \"./register.js\";\n\n// ---------------------------------------------------------------------------\n// Table bootstrap\n// ---------------------------------------------------------------------------\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      // Postgres version of the CREATE TABLE — the generic `INTEGER` maps to\n      // BIGINT on Postgres, which we need for millisecond timestamps.\n      const sql = isPostgres()\n        ? APP_SECRETS_CREATE_SQL.replace(/\\bINTEGER\\b/g, \"BIGINT\")\n        : APP_SECRETS_CREATE_SQL;\n      await client.execute(sql);\n\n      // Additive migration: description column (for ad-hoc keys)\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN description TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n\n      // Additive migration: url_allowlist column\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN url_allowlist TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n    })();\n  }\n  return _initPromise;\n}\n\n// ---------------------------------------------------------------------------\n// Encryption\n// ---------------------------------------------------------------------------\n\n/**\n * Derive a 32-byte AES key from the configured secret material via SHA-256.\n * Re-derived per-request (cheap, stateless, and makes rotation easy).\n *\n * In production we refuse to start with the CWD-derived fallback. Same\n * posture `resolveAuthSecret` takes for `BETTER_AUTH_SECRET` — fail loud\n * rather than encrypt every secret with a key that's effectively static\n * across the whole deployment (Lambda CWD is `/var/task`, etc.). Anyone\n * with read access to the DB (forgotten backup, pg_dump, downgraded env)\n * could otherwise decrypt every user's secrets with trivial work.\n */\nfunction getEncryptionKey(): Buffer {\n  const explicit =\n    process.env.SECRETS_ENCRYPTION_KEY || process.env.BETTER_AUTH_SECRET;\n\n  if (!explicit) {\n    if (process.env.NODE_ENV === \"production\") {\n      throw new Error(\n        \"[agent-native/secrets] Refusing to start in production without an encryption key. \" +\n          \"Set SECRETS_ENCRYPTION_KEY (preferred) or BETTER_AUTH_SECRET in the deploy environment. \" +\n          \"The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), \" +\n          \"which means anyone with read access to the secrets table could decrypt every user's secrets.\",\n      );\n    }\n    if (!_warnedFallback) {\n      _warnedFallback = true;\n      // eslint-disable-next-line no-console\n      console.warn(\n        \"[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. \" +\n          \"Set SECRETS_ENCRYPTION_KEY (or BETTER_AUTH_SECRET) for production. \" +\n          \"Production deploys without one of these env vars now hard-fail.\",\n      );\n    }\n  }\n\n  const material = explicit || `agent-native-secrets:${process.cwd()}`;\n  return createHash(\"sha256\").update(material).digest();\n}\n\nlet _warnedFallback = false;\n\n/** Encrypt a plain-text value. Returns `v1:<iv-hex>:<ct-hex>:<tag-hex>`. */\nfunction encryptValue(plaintext: string): string {\n  const key = getEncryptionKey();\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n  const ct = Buffer.concat([cipher.update(plaintext, \"utf8\"), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return `v1:${iv.toString(\"hex\")}:${ct.toString(\"hex\")}:${tag.toString(\"hex\")}`;\n}\n\n/** Decrypt a value produced by `encryptValue`. Throws on tampering. */\nfunction decryptValue(encrypted: string): string {\n  if (!encrypted.startsWith(\"v1:\")) {\n    throw new Error(\"Unrecognised secret encoding\");\n  }\n  const [, ivHex, ctHex, tagHex] = encrypted.split(\":\");\n  if (!ivHex || !ctHex || !tagHex) {\n    throw new Error(\"Corrupt secret payload\");\n  }\n  const key = getEncryptionKey();\n  const decipher = createDecipheriv(\n    \"aes-256-gcm\",\n    key,\n    Buffer.from(ivHex, \"hex\"),\n  );\n  decipher.setAuthTag(Buffer.from(tagHex, \"hex\"));\n  const pt = Buffer.concat([\n    decipher.update(Buffer.from(ctHex, \"hex\")),\n    decipher.final(),\n  ]);\n  return pt.toString(\"utf8\");\n}\n\n/**\n * Return the last 4 characters of a secret, with any leading characters\n * masked. Used to show a preview without leaking the value.\n */\nexport function last4(value: string): string {\n  if (!value) return \"\";\n  if (value.length <= 4) return \"••••\";\n  return \"••••\" + value.slice(-4);\n}\n\n// ---------------------------------------------------------------------------\n// CRUD\n// ---------------------------------------------------------------------------\n\nexport interface SecretRef {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n}\n\nexport interface WriteSecretArgs extends SecretRef {\n  value: string;\n  /** Optional human-readable description (used for ad-hoc keys). */\n  description?: string;\n  /** Optional JSON-stringified array of allowed URL origins. */\n  urlAllowlist?: string;\n}\n\n/**\n * Write (insert or update) a secret. The value is encrypted before being\n * stored — the caller's plaintext is never persisted. Returns the new\n * record's id.\n */\nexport async function writeAppSecret(args: WriteSecretArgs): Promise<string> {\n  await ensureTable();\n  const { key, value, scope, scopeId, description, urlAllowlist } = args;\n  if (!key || !value || !scope || !scopeId) {\n    throw new Error(\n      \"writeAppSecret: key, value, scope, and scopeId are all required\",\n    );\n  }\n  const client = getDbExec();\n  const now = Date.now();\n  const encrypted = encryptValue(value);\n\n  // Upsert by (scope, scope_id, key). Keep the existing row's id on update so\n  // references stay stable.\n  const { rows } = await client.execute({\n    sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length > 0) {\n    const id = rows[0].id as string;\n    await client.execute({\n      sql: `UPDATE app_secrets SET encrypted_value = ?, description = ?, url_allowlist = ?, updated_at = ? WHERE id = ?`,\n      args: [encrypted, description ?? null, urlAllowlist ?? null, now, id],\n    });\n    return id;\n  }\n  const id = randomUUID();\n  await client.execute({\n    sql: `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      scope,\n      scopeId,\n      key,\n      encrypted,\n      description ?? null,\n      urlAllowlist ?? null,\n      now,\n      now,\n    ],\n  });\n  return id;\n}\n\nexport interface ReadSecretResult {\n  value: string;\n  last4: string;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's plaintext value. Returns null when not found. The caller\n * is responsible for never logging the returned value.\n */\nexport async function readAppSecret(\n  ref: SecretRef,\n): Promise<ReadSecretResult | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  try {\n    const value = decryptValue(rows[0].encrypted_value as string);\n    return {\n      value,\n      last4: last4(value),\n      updatedAt: Number(rows[0].updated_at ?? 0),\n    };\n  } catch {\n    // Decryption failure — key rotated, tampered row, etc. Don't throw up the\n    // stack in a way that could leak the ciphertext; just report missing.\n    return null;\n  }\n}\n\n/**\n * Return just the metadata for a secret (no value). Used by the list route so\n * the UI can show the \"Set\" pill and last-4 without the decrypted value going\n * over the wire.\n */\nexport async function getAppSecretMeta(\n  ref: SecretRef,\n): Promise<{ last4: string; updatedAt: number } | null> {\n  const result = await readAppSecret(ref);\n  if (!result) return null;\n  return { last4: result.last4, updatedAt: result.updatedAt };\n}\n\nexport interface SecretMeta {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n  last4: string;\n  description: string | null;\n  urlAllowlist: string[] | null;\n  createdAt: number;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's metadata, including ad-hoc fields (description, allowlist),\n * without ever decrypting or returning the plaintext value. Used by the\n * ad-hoc list route and any UI that wants to render a key tile.\n */\nexport async function readAppSecretMeta(\n  ref: SecretRef,\n): Promise<SecretMeta | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  const row = rows[0];\n  let last4Value = \"\";\n  try {\n    const value = decryptValue(row.encrypted_value as string);\n    last4Value = last4(value);\n  } catch {\n    last4Value = \"\";\n  }\n  return {\n    key,\n    scope,\n    scopeId,\n    last4: last4Value,\n    description: (row.description as string | null) ?? null,\n    urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\n/**\n * List all secrets for a given scope. Returns metadata only — values are\n * never decrypted or returned. Used by the ad-hoc list route to surface\n * user-created keys.\n */\nexport async function listAppSecretsForScope(\n  scope: SecretScope,\n  scopeId: string,\n): Promise<SecretMeta[]> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT key, encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? ORDER BY updated_at DESC`,\n    args: [scope, scopeId],\n  });\n  return rows.map((row) => {\n    let last4Value = \"\";\n    try {\n      const value = decryptValue(row.encrypted_value as string);\n      last4Value = last4(value);\n    } catch {\n      last4Value = \"\";\n    }\n    return {\n      key: row.key as string,\n      scope,\n      scopeId,\n      last4: last4Value,\n      description: (row.description as string | null) ?? null,\n      urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n      createdAt: Number(row.created_at ?? 0),\n      updatedAt: Number(row.updated_at ?? 0),\n    };\n  });\n}\n\nfunction parseAllowlist(raw: string | null): string[] | null {\n  if (!raw) return null;\n  try {\n    const parsed = JSON.parse(raw);\n    if (Array.isArray(parsed) && parsed.every((v) => typeof v === \"string\")) {\n      return parsed;\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function deleteAppSecret(ref: SecretRef): Promise<boolean> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rowsAffected } = await client.execute({\n    sql: `DELETE FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,\n    args: [scope, scopeId, key],\n  });\n  return rowsAffected > 0;\n}\n"]}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,UAAU,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAGrD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,GAAG,GAAG,UAAU,EAAE;gBACtB,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC;gBAC1D,CAAC,CAAC,sBAAsB,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAE1B,2DAA2D;YAC3D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qDAAqD,CACtD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;YAED,2CAA2C;YAC3C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB;IACvB,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAEvE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,0FAA0F;gBAC1F,yFAAyF;gBACzF,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,IAAI,CAAC;YACvB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,0FAA0F;gBACxF,qEAAqE;gBACrE,iEAAiE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,wBAAwB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;IACrE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,4EAA4E;AAC5E,SAAS,YAAY,CAAC,SAAiB;IACrC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAC1B,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAoBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAEtC,4EAA4E;IAC5E,0BAA0B;IAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yEAAyE;QAC9E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAY,CAAC;QAChC,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,6GAA6G;YAClH,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,4JAA4J;QACjK,IAAI,EAAE;YACJ,EAAE;YACF,KAAK;YACL,OAAO;YACP,GAAG;YACH,SAAS;YACT,WAAW,IAAI,IAAI;YACnB,YAAY,IAAI,IAAI;YACpB,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,0GAA0G;QAC/G,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAyB,CAAC,CAAC;QAC9D,OAAO;YACL,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAc;IAEd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,kJAAkJ;QACvJ,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;QAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG;QACH,KAAK;QACL,OAAO;QACP,KAAK,EAAE,UAAU;QACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkB,EAClB,OAAe;IAEf,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,4JAA4J;QACjK,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;YAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAa;YACtB,KAAK;YACL,OAAO;YACP,KAAK,EAAE,UAAU;YACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;YACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;YAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;SACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAkB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc;IAClD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC5C,GAAG,EAAE,sEAAsE;QAC3E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["/**\n * Storage layer for the framework secrets registry.\n *\n * Values are encrypted at rest with AES-256-GCM. The encryption key is\n * derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the existing\n * `BETTER_AUTH_SECRET` env var (fallback so templates don't need a second\n * secret during development). If neither is set in production we fall back\n * to a machine-local key derived from the cwd — the secret is still only\n * readable on this machine, but consider setting `SECRETS_ENCRYPTION_KEY`\n * for a stable, rotatable key.\n *\n * Secret values are NEVER logged and NEVER returned from any route handler.\n */\n\nimport {\n  randomUUID,\n  randomBytes,\n  createCipheriv,\n  createDecipheriv,\n  createHash,\n} from \"node:crypto\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { APP_SECRETS_CREATE_SQL } from \"./schema.js\";\nimport type { SecretScope } from \"./register.js\";\n\n// ---------------------------------------------------------------------------\n// Table bootstrap\n// ---------------------------------------------------------------------------\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      // Postgres version of the CREATE TABLE — the generic `INTEGER` maps to\n      // BIGINT on Postgres, which we need for millisecond timestamps.\n      const sql = isPostgres()\n        ? APP_SECRETS_CREATE_SQL.replace(/\\bINTEGER\\b/g, \"BIGINT\")\n        : APP_SECRETS_CREATE_SQL;\n      await client.execute(sql);\n\n      // Additive migration: description column (for ad-hoc keys)\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN description TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n\n      // Additive migration: url_allowlist column\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN url_allowlist TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n// ---------------------------------------------------------------------------\n// Encryption\n// ---------------------------------------------------------------------------\n\n/**\n * Derive a 32-byte AES key from the configured secret material via SHA-256.\n * Re-derived per-request (cheap, stateless, and makes rotation easy).\n *\n * In production we refuse to start with the CWD-derived fallback. Same\n * posture `resolveAuthSecret` takes for `BETTER_AUTH_SECRET` — fail loud\n * rather than encrypt every secret with a key that's effectively static\n * across the whole deployment (Lambda CWD is `/var/task`, etc.). Anyone\n * with read access to the DB (forgotten backup, pg_dump, downgraded env)\n * could otherwise decrypt every user's secrets with trivial work.\n */\nfunction getEncryptionKey(): Buffer {\n  const explicit =\n    process.env.SECRETS_ENCRYPTION_KEY || process.env.BETTER_AUTH_SECRET;\n\n  if (!explicit) {\n    if (process.env.NODE_ENV === \"production\") {\n      throw new Error(\n        \"[agent-native/secrets] Refusing to start in production without an encryption key. \" +\n          \"Set SECRETS_ENCRYPTION_KEY (preferred) or BETTER_AUTH_SECRET in the deploy environment. \" +\n          \"The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), \" +\n          \"which means anyone with read access to the secrets table could decrypt every user's secrets.\",\n      );\n    }\n    if (!_warnedFallback) {\n      _warnedFallback = true;\n      // eslint-disable-next-line no-console\n      console.warn(\n        \"[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. \" +\n          \"Set SECRETS_ENCRYPTION_KEY (or BETTER_AUTH_SECRET) for production. \" +\n          \"Production deploys without one of these env vars now hard-fail.\",\n      );\n    }\n  }\n\n  const material = explicit || `agent-native-secrets:${process.cwd()}`;\n  return createHash(\"sha256\").update(material).digest();\n}\n\nlet _warnedFallback = false;\n\n/** Encrypt a plain-text value. Returns `v1:<iv-hex>:<ct-hex>:<tag-hex>`. */\nfunction encryptValue(plaintext: string): string {\n  const key = getEncryptionKey();\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n  const ct = Buffer.concat([cipher.update(plaintext, \"utf8\"), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return `v1:${iv.toString(\"hex\")}:${ct.toString(\"hex\")}:${tag.toString(\"hex\")}`;\n}\n\n/** Decrypt a value produced by `encryptValue`. Throws on tampering. */\nfunction decryptValue(encrypted: string): string {\n  if (!encrypted.startsWith(\"v1:\")) {\n    throw new Error(\"Unrecognised secret encoding\");\n  }\n  const [, ivHex, ctHex, tagHex] = encrypted.split(\":\");\n  if (!ivHex || !ctHex || !tagHex) {\n    throw new Error(\"Corrupt secret payload\");\n  }\n  const key = getEncryptionKey();\n  const decipher = createDecipheriv(\n    \"aes-256-gcm\",\n    key,\n    Buffer.from(ivHex, \"hex\"),\n  );\n  decipher.setAuthTag(Buffer.from(tagHex, \"hex\"));\n  const pt = Buffer.concat([\n    decipher.update(Buffer.from(ctHex, \"hex\")),\n    decipher.final(),\n  ]);\n  return pt.toString(\"utf8\");\n}\n\n/**\n * Return the last 4 characters of a secret, with any leading characters\n * masked. Used to show a preview without leaking the value.\n */\nexport function last4(value: string): string {\n  if (!value) return \"\";\n  if (value.length <= 4) return \"••••\";\n  return \"••••\" + value.slice(-4);\n}\n\n// ---------------------------------------------------------------------------\n// CRUD\n// ---------------------------------------------------------------------------\n\nexport interface SecretRef {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n}\n\nexport interface WriteSecretArgs extends SecretRef {\n  value: string;\n  /** Optional human-readable description (used for ad-hoc keys). */\n  description?: string;\n  /** Optional JSON-stringified array of allowed URL origins. */\n  urlAllowlist?: string;\n}\n\n/**\n * Write (insert or update) a secret. The value is encrypted before being\n * stored — the caller's plaintext is never persisted. Returns the new\n * record's id.\n */\nexport async function writeAppSecret(args: WriteSecretArgs): Promise<string> {\n  await ensureTable();\n  const { key, value, scope, scopeId, description, urlAllowlist } = args;\n  if (!key || !value || !scope || !scopeId) {\n    throw new Error(\n      \"writeAppSecret: key, value, scope, and scopeId are all required\",\n    );\n  }\n  const client = getDbExec();\n  const now = Date.now();\n  const encrypted = encryptValue(value);\n\n  // Upsert by (scope, scope_id, key). Keep the existing row's id on update so\n  // references stay stable.\n  const { rows } = await client.execute({\n    sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length > 0) {\n    const id = rows[0].id as string;\n    await client.execute({\n      sql: `UPDATE app_secrets SET encrypted_value = ?, description = ?, url_allowlist = ?, updated_at = ? WHERE id = ?`,\n      args: [encrypted, description ?? null, urlAllowlist ?? null, now, id],\n    });\n    return id;\n  }\n  const id = randomUUID();\n  await client.execute({\n    sql: `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      scope,\n      scopeId,\n      key,\n      encrypted,\n      description ?? null,\n      urlAllowlist ?? null,\n      now,\n      now,\n    ],\n  });\n  return id;\n}\n\nexport interface ReadSecretResult {\n  value: string;\n  last4: string;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's plaintext value. Returns null when not found. The caller\n * is responsible for never logging the returned value.\n */\nexport async function readAppSecret(\n  ref: SecretRef,\n): Promise<ReadSecretResult | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  try {\n    const value = decryptValue(rows[0].encrypted_value as string);\n    return {\n      value,\n      last4: last4(value),\n      updatedAt: Number(rows[0].updated_at ?? 0),\n    };\n  } catch {\n    // Decryption failure — key rotated, tampered row, etc. Don't throw up the\n    // stack in a way that could leak the ciphertext; just report missing.\n    return null;\n  }\n}\n\n/**\n * Return just the metadata for a secret (no value). Used by the list route so\n * the UI can show the \"Set\" pill and last-4 without the decrypted value going\n * over the wire.\n */\nexport async function getAppSecretMeta(\n  ref: SecretRef,\n): Promise<{ last4: string; updatedAt: number } | null> {\n  const result = await readAppSecret(ref);\n  if (!result) return null;\n  return { last4: result.last4, updatedAt: result.updatedAt };\n}\n\nexport interface SecretMeta {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n  last4: string;\n  description: string | null;\n  urlAllowlist: string[] | null;\n  createdAt: number;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's metadata, including ad-hoc fields (description, allowlist),\n * without ever decrypting or returning the plaintext value. Used by the\n * ad-hoc list route and any UI that wants to render a key tile.\n */\nexport async function readAppSecretMeta(\n  ref: SecretRef,\n): Promise<SecretMeta | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  const row = rows[0];\n  let last4Value = \"\";\n  try {\n    const value = decryptValue(row.encrypted_value as string);\n    last4Value = last4(value);\n  } catch {\n    last4Value = \"\";\n  }\n  return {\n    key,\n    scope,\n    scopeId,\n    last4: last4Value,\n    description: (row.description as string | null) ?? null,\n    urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\n/**\n * List all secrets for a given scope. Returns metadata only — values are\n * never decrypted or returned. Used by the ad-hoc list route to surface\n * user-created keys.\n */\nexport async function listAppSecretsForScope(\n  scope: SecretScope,\n  scopeId: string,\n): Promise<SecretMeta[]> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT key, encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? ORDER BY updated_at DESC`,\n    args: [scope, scopeId],\n  });\n  return rows.map((row) => {\n    let last4Value = \"\";\n    try {\n      const value = decryptValue(row.encrypted_value as string);\n      last4Value = last4(value);\n    } catch {\n      last4Value = \"\";\n    }\n    return {\n      key: row.key as string,\n      scope,\n      scopeId,\n      last4: last4Value,\n      description: (row.description as string | null) ?? null,\n      urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n      createdAt: Number(row.created_at ?? 0),\n      updatedAt: Number(row.updated_at ?? 0),\n    };\n  });\n}\n\nfunction parseAllowlist(raw: string | null): string[] | null {\n  if (!raw) return null;\n  try {\n    const parsed = JSON.parse(raw);\n    if (Array.isArray(parsed) && parsed.every((v) => typeof v === \"string\")) {\n      return parsed;\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function deleteAppSecret(ref: SecretRef): Promise<boolean> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rowsAffected } = await client.execute({\n    sql: `DELETE FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,\n    args: [scope, scopeId, key],\n  });\n  return rowsAffected > 0;\n}\n"]}

package/dist/server/agent-chat-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AAaA,OAAO,EASL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAqBtC,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAElB,eAAe,EAEhB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,gBAAgB,EAajB,MAAM,wBAAwB,CAAC;AA+DhC,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAiUrC,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,KAAK,CAAC;IACP,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;CACzC,CAAC,CASD;AAmBD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,OAAO,GAAE,0BAA0B,GAAG;IAAE,KAAK,CAAC,EAAE,GAAG,CAAA;CAAO,GACzD;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAO7C;AAk2CD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,wCAAwC;IACxC,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;sDAGkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EACH,OAAO,0BAA0B,EAAE,WAAW,GAC9C,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,gBAAgB,CAAC,EACb,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QACd,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,uEAAuE;QACvE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gFAAgF;QAChF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gFAAgF;QAChF,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,8BAA8B,EAAE,2BAA2B,CAAC;IACxF;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;KACtB,KACG,IAAI,GACJ;QACE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,GACD,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,CAAC,CAAC;IACP;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,OAAO,iBAAiB,EAAE,OAAO,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAC;QACrD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,KACG,OAAO,iBAAiB,EAAE,OAAO,GACjC,MAAM,GACN,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,OAAO,iBAAiB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CAC5E;AA4iBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,UAAQ,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA8KjB;AA6ND,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,OAAO,CA2BV;AAED,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CA62GhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAa9E,yEAAyE;AACzE,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAE7D"}
+{"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AAaA,OAAO,EASL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAqBtC,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAElB,eAAe,EAEhB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,gBAAgB,EAcjB,MAAM,wBAAwB,CAAC;AA+DhC,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAiUrC,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,KAAK,CAAC;IACP,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;CACzC,CAAC,CASD;AAmBD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,OAAO,GAAE,0BAA0B,GAAG;IAAE,KAAK,CAAC,EAAE,GAAG,CAAA;CAAO,GACzD;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAO7C;AAy2CD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,wCAAwC;IACxC,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;sDAGkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EACH,OAAO,0BAA0B,EAAE,WAAW,GAC9C,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,gBAAgB,CAAC,EACb,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QACd,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,uEAAuE;QACvE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gFAAgF;QAChF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gFAAgF;QAChF,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,8BAA8B,EAAE,2BAA2B,CAAC;IACxF;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;KACtB,KACG,IAAI,GACJ;QACE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,GACD,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,CAAC,CAAC;IACP;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,OAAO,iBAAiB,EAAE,OAAO,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAC;QACrD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,KACG,OAAO,iBAAiB,EAAE,OAAO,GACjC,MAAM,GACN,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,OAAO,iBAAiB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CAC5E;AA4iBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,UAAQ,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA8KjB;AA6ND,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,OAAO,CA2BV;AAED,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CA62GhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAa9E,yEAAyE;AACzE,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAE7D"}