@agent-native/core 0.31.0 → 0.31.2

package/dist/mcp/connect-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-store.d.ts","sourceRoot":"","sources":["../../src/mcp/connect-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAElE,6CAA6C;AAC7C,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AA+C7C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBhE;AAED,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,EAAE,CAAC,CAsB3B;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/D;AAMD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAmBD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAgD/D;AAgBD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAc/B;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAc/B;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC,CAuB9D;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAY/B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAW/B;AAED,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYxE"}
+{"version":3,"file":"connect-store.d.ts","sourceRoot":"","sources":["../../src/mcp/connect-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAElE,6CAA6C;AAC7C,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AA+C7C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBhE;AAED,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,EAAE,CAAC,CAsB3B;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/D;AAMD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAmBD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAgD/D;AAgBD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAc/B;AAoBD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC,CAuB9D;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAY/B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAW/B;AAED,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYxE"}

package/dist/mcp/connect-store.js

@@ -12,9 +12,9 @@
  *     (`consumed_at`), rate-limited at creation.
  *
  * Mirrors `application-state/store.ts`: lazy `ensureTable()`, `getDbExec()`,
- * `isPostgres()` dialect branching for upserts, `isConnectionError()` swallow
- * so a transient Neon WS drop never 500s. `CREATE TABLE IF NOT EXISTS` only —
- * strictly additive, never DROP / ALTER (shared prod DB rule).
+ * `isConnectionError()` swallow so a transient Neon WS drop never 500s.
+ * `CREATE TABLE IF NOT EXISTS` only — strictly additive, never DROP / ALTER
+ * (shared prod DB rule).
  */
 import { getDbExec, isConnectionError, intType } from "../db/client.js";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -295,7 +295,7 @@ export async function getDeviceCode(deviceCode) {
         throw err;
     }
 }
-export async function getDeviceCodeByUserCode(userCode) {
+async function getDeviceCodeByUserCode(userCode) {
     try {
         await ensureTable();
         const client = getDbExec();

package/dist/mcp/connect-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-store.js","sourceRoot":"","sources":["../../src/mcp/connect-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,IAAI,YAAuC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAElE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAC1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;uBAOJ,OAAO,EAAE;yBACP,OAAO,EAAE;uBACX,OAAO,EAAE;;OAEzB,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;uBAQJ,OAAO,EAAE;uBACT,OAAO,EAAE;wBACR,OAAO,EAAE;;OAE1B,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,uEAAuE;YACvE,kEAAkE;YAClE,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAiBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAKvC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,4IAA4I;QACjJ,IAAI,EAAE;YACJ,EAAE;YACF,MAAM,CAAC,GAAG;YACV,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,KAAK,IAAI,IAAI;YACpB,MAAM,CAAC,KAAK,IAAI,IAAI;YACpB,IAAI,CAAC,GAAG,EAAE;YACV,IAAI;YACJ,IAAI;SACL;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,yDAAyD;YAC9D,IAAI,EAAE,CAAC,GAAG,CAAC;SACZ,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,OAAO,SAAS,IAAI,IAAI,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;QACpE,uEAAuE;QACvE,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,yJAAyJ;YAC9J,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,EAAE,EAAE,CAAC,CAAC,EAAY;YAClB,GAAG,EAAE,CAAC,CAAC,GAAa;YACpB,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAW;YACrD,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAkB;YACrD,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAkB;YACzC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;YACjD,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC;YACrD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;SAClD,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAkB,EAClB,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,sGAAsG;QAC3G,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,8DAA8D;YACnE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAkBD,MAAM,kBAAkB,GAAG,kCAAkC,CAAC,CAAC,mCAAmC;AAElG,qEAAqE;AACrE,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,IAAI,GAAG,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,iEAAiE;YACtE,IAAI,EAAE,CAAC,GAAG,GAAG,sBAAsB,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,gBAAgB,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc;YAAE,MAAM,GAAG,CAAC;QAC/C,sEAAsE;QACtE,qEAAqE;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,GAAG,kBAAkB,CAAC;IAC3C,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,uKAAuK;QAC5K,IAAI,EAAE;YACJ,UAAU;YACV,QAAQ;YACR,IAAI;YACJ,IAAI;YACJ,SAAS;YACT,IAAI;YACJ,GAAG;YACH,SAAS;YACT,IAAI;SACL;KACF,CAAC,CAAC;IACH,OAAO;QACL,UAAU;QACV,QAAQ;QACR,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,GAAG;QACd,SAAS;QACT,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAM;IAC1B,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAW;QACrD,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAW;QAC/C,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAkB;QACpE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAkB;QACrD,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAA4B;QAC1D,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAkB;QAC9D,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;QACjD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;QACjD,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,sDAAsD;YAC3D,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,oDAAoD;YACzD,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,UAAkB,EAClB,KAAoB;IAEpB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,WAAW,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,yHAAyH;QAC9H,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,uEAAuE;QACvE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACvE,CAAC;IACD,OAAO;QACL,GAAG,GAAG;QACN,MAAM,EAAE,UAAU;QAClB,UAAU;QACV,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,QAAgB;IAEhB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,+HAA+H;QACpI,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2BAA2B;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,QAAgB;IAEhB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,8HAA8H;QACnI,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,QAAgB;IAEhB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,gHAAgH;QACrH,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;KAC7B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,sJAAsJ;YAC3J,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,wEAAwE;IAC1E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,2GAA2G;YAChH,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC","sourcesContent":["/**\n * Framework-table store for the \"connect external agents\" feature.\n *\n * Two additive, dialect-agnostic tables back the browser **Connect** page and\n * the OAuth-style **device-code flow** a CLI drives:\n *\n *   - `mcp_connect_tokens`  — one row per minted MCP token. We never store the\n *     token value (it's a signed JWT); only its `jti` so revocation is a\n *     SQL lookup. Revoking sets `revoked_at`; the row is never deleted.\n *   - `mcp_device_codes`    — short-lived (10 min) device/user code pairs for\n *     the OAuth 2.0 device-authorization-style CLI flow. Single-use\n *     (`consumed_at`), rate-limited at creation.\n *\n * Mirrors `application-state/store.ts`: lazy `ensureTable()`, `getDbExec()`,\n * `isPostgres()` dialect branching for upserts, `isConnectionError()` swallow\n * so a transient Neon WS drop never 500s. `CREATE TABLE IF NOT EXISTS` only —\n * strictly additive, never DROP / ALTER (shared prod DB rule).\n */\n\nimport { getDbExec, isConnectionError, intType } from \"../db/client.js\";\nimport { randomBytes, randomUUID } from \"node:crypto\";\n\nlet _initPromise: Promise<void> | undefined;\n\n/**\n * Scope claim that marks a connect-minted token (vs. an ordinary A2A\n * delegation JWT). Only tokens carrying this scope go through the revoke\n * lookup in `verifyAuth` — defined here so both `connect-route.ts` and\n * `build-server.ts` import it from the leaf store without a cycle.\n */\nexport const MCP_CONNECT_SCOPE = \"mcp-connect\";\n\n/**\n * Client id used when connect/device flows have to mint a standard MCP OAuth\n * access token instead of an A2A JWT (for deployments without A2A_SECRET).\n */\nexport const MCP_CONNECT_OAUTH_CLIENT_ID = \"agent-native-connect\";\n\n/** Device codes are valid for 10 minutes. */\nexport const DEVICE_CODE_TTL_MS = 10 * 60_000;\n\n/** Default minted-token lifetime. Configurable per-request 1–365 days. */\nexport const DEFAULT_TOKEN_TTL_DAYS = 365;\nexport const MIN_TOKEN_TTL_DAYS = 1;\nexport const MAX_TOKEN_TTL_DAYS = 365;\n\n/**\n * Rate limit for `device/start`: at most this many device codes may be created\n * within `DEVICE_START_WINDOW_MS`. Unauthenticated endpoint — keep it tight so\n * a hostile client can't flood the table or brute-force user codes.\n */\nexport const DEVICE_START_MAX = 20;\nexport const DEVICE_START_WINDOW_MS = 60_000;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      // Additive only. Never DROP / ALTER — this DB is shared across every\n      // deploy context (preview/branch/prod) for hosted templates.\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS mcp_connect_tokens (\n          id TEXT PRIMARY KEY,\n          jti TEXT UNIQUE NOT NULL,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          label TEXT,\n          created_at ${intType()},\n          last_used_at ${intType()},\n          revoked_at ${intType()}\n        )\n      `);\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS mcp_device_codes (\n          device_code TEXT PRIMARY KEY,\n          user_code TEXT NOT NULL,\n          owner_email TEXT,\n          org_id TEXT,\n          status TEXT NOT NULL DEFAULT 'pending',\n          token_jti TEXT,\n          created_at ${intType()},\n          expires_at ${intType()},\n          consumed_at ${intType()}\n        )\n      `);\n    })().catch((err) => {\n      // Don't cache a rejected init. A transient DB blip should let the next\n      // connect/mint/revoke call retry rather than wedging the process.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n// ---------------------------------------------------------------------------\n// Minted-token records\n// ---------------------------------------------------------------------------\n\nexport interface MintedTokenRow {\n  id: string;\n  jti: string;\n  ownerEmail: string;\n  orgId: string | null;\n  label: string | null;\n  createdAt: number | null;\n  lastUsedAt: number | null;\n  revokedAt: number | null;\n}\n\n/**\n * Persist a record of a minted token. The token value itself (a signed JWT)\n * is NEVER stored — only its `jti`, so revocation is a cheap SQL lookup.\n */\nexport async function recordMintedToken(params: {\n  jti: string;\n  ownerEmail: string;\n  orgId?: string | null;\n  label?: string | null;\n}): Promise<string> {\n  await ensureTable();\n  const client = getDbExec();\n  const id = randomUUID();\n  await client.execute({\n    sql: `INSERT INTO mcp_connect_tokens (id, jti, owner_email, org_id, label, created_at, last_used_at, revoked_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      params.jti,\n      params.ownerEmail,\n      params.orgId ?? null,\n      params.label ?? null,\n      Date.now(),\n      null,\n      null,\n    ],\n  });\n  return id;\n}\n\n/**\n * Returns true when the given `jti` corresponds to a token that has been\n * revoked. Fails OPEN on a store/DB error: a transient Neon WS drop must not\n * lock every connected agent out. Signature verification is unaffected — this\n * is only the post-verify revoke check (see `verifyAuth` in build-server.ts).\n */\nexport async function isJtiRevoked(jti: string): Promise<boolean> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `SELECT revoked_at FROM mcp_connect_tokens WHERE jti = ?`,\n      args: [jti],\n    });\n    if (rows.length === 0) return false;\n    const revokedAt = rows[0].revoked_at ?? rows[0].revokedAt;\n    return revokedAt != null;\n  } catch (err) {\n    // Fail open: a DB blip must not turn every minted token into a 401.\n    // (Signature checks already passed; this only gates explicit revokes.)\n    if (isConnectionError(err)) return false;\n    return false;\n  }\n}\n\nexport async function listTokens(\n  ownerEmail: string,\n): Promise<MintedTokenRow[]> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `SELECT id, jti, owner_email, org_id, label, created_at, last_used_at, revoked_at FROM mcp_connect_tokens WHERE owner_email = ? ORDER BY created_at DESC`,\n      args: [ownerEmail],\n    });\n    return rows.map((r: any) => ({\n      id: r.id as string,\n      jti: r.jti as string,\n      ownerEmail: (r.owner_email ?? r.ownerEmail) as string,\n      orgId: (r.org_id ?? r.orgId ?? null) as string | null,\n      label: (r.label ?? null) as string | null,\n      createdAt: numOrNull(r.created_at ?? r.createdAt),\n      lastUsedAt: numOrNull(r.last_used_at ?? r.lastUsedAt),\n      revokedAt: numOrNull(r.revoked_at ?? r.revokedAt),\n    }));\n  } catch (err) {\n    if (isConnectionError(err)) return [];\n    throw err;\n  }\n}\n\n/**\n * Revoke a token, but ONLY if it is owned by `ownerEmail` (the caller). The\n * `owner_email = ?` predicate is the access scope — a caller can never revoke\n * another user's token. Idempotent: re-revoking keeps the first timestamp.\n * Returns true when a row was actually transitioned to revoked.\n */\nexport async function revokeToken(\n  ownerEmail: string,\n  id: string,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const result = await client.execute({\n    sql: `UPDATE mcp_connect_tokens SET revoked_at = ? WHERE id = ? AND owner_email = ? AND revoked_at IS NULL`,\n    args: [Date.now(), id, ownerEmail],\n  });\n  return result.rowsAffected > 0;\n}\n\n/**\n * Best-effort: stamp `last_used_at` for a token. Swallows all errors — this is\n * pure telemetry and must never affect the auth path.\n */\nexport async function touchTokenUsed(jti: string): Promise<void> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    await client.execute({\n      sql: `UPDATE mcp_connect_tokens SET last_used_at = ? WHERE jti = ?`,\n      args: [Date.now(), jti],\n    });\n  } catch {\n    // last_used_at is informational only — never throw from the hot path.\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Device-code flow (OAuth 2.0 device-authorization style)\n// ---------------------------------------------------------------------------\n\nexport interface DeviceCodeRow {\n  deviceCode: string;\n  userCode: string;\n  ownerEmail: string | null;\n  orgId: string | null;\n  status: \"pending\" | \"approved\" | \"minting\" | \"consumed\" | \"expired\";\n  tokenJti: string | null;\n  createdAt: number | null;\n  expiresAt: number | null;\n  consumedAt: number | null;\n}\n\nconst USER_CODE_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZ234567\"; // Crockford-ish base32, no 0/1/O/I\n\n/** Crypto-random short human-typable code, formatted `XXXX-XXXX`. */\nfunction generateUserCode(): string {\n  const bytes = randomBytes(8);\n  let out = \"\";\n  for (let i = 0; i < 8; i++) {\n    out += USER_CODE_ALPHABET[bytes[i] % USER_CODE_ALPHABET.length];\n    if (i === 3) out += \"-\";\n  }\n  return out;\n}\n\nfunction generateDeviceCode(): string {\n  return randomBytes(32).toString(\"base64url\");\n}\n\n/**\n * Create a new device+user code pair. Rate-limited: at most\n * `DEVICE_START_MAX` codes within `DEVICE_START_WINDOW_MS`. The window count\n * is a coarse global cap (this endpoint is unauthenticated) — enough to stop\n * table flooding / user-code brute force without per-IP plumbing.\n *\n * Throws `RATE_LIMITED` when the cap is exceeded so the route can map it to a\n * 429.\n */\nexport async function createDeviceCode(): Promise<DeviceCodeRow> {\n  await ensureTable();\n  const client = getDbExec();\n\n  const now = Date.now();\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT COUNT(*) AS n FROM mcp_device_codes WHERE created_at > ?`,\n      args: [now - DEVICE_START_WINDOW_MS],\n    });\n    const n = Number(rows[0]?.n ?? rows[0]?.[\"COUNT(*)\"] ?? 0);\n    if (Number.isFinite(n) && n >= DEVICE_START_MAX) {\n      throw new Error(\"RATE_LIMITED\");\n    }\n  } catch (err: any) {\n    if (err?.message === \"RATE_LIMITED\") throw err;\n    // A read failure here should not block legitimate device starts — the\n    // single-use + short-TTL design is the primary protection. Continue.\n  }\n\n  const deviceCode = generateDeviceCode();\n  const userCode = generateUserCode();\n  const expiresAt = now + DEVICE_CODE_TTL_MS;\n  await client.execute({\n    sql: `INSERT INTO mcp_device_codes (device_code, user_code, owner_email, org_id, status, token_jti, created_at, expires_at, consumed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      deviceCode,\n      userCode,\n      null,\n      null,\n      \"pending\",\n      null,\n      now,\n      expiresAt,\n      null,\n    ],\n  });\n  return {\n    deviceCode,\n    userCode,\n    ownerEmail: null,\n    orgId: null,\n    status: \"pending\",\n    tokenJti: null,\n    createdAt: now,\n    expiresAt,\n    consumedAt: null,\n  };\n}\n\nfunction mapDeviceRow(r: any): DeviceCodeRow {\n  return {\n    deviceCode: (r.device_code ?? r.deviceCode) as string,\n    userCode: (r.user_code ?? r.userCode) as string,\n    ownerEmail: (r.owner_email ?? r.ownerEmail ?? null) as string | null,\n    orgId: (r.org_id ?? r.orgId ?? null) as string | null,\n    status: (r.status ?? \"pending\") as DeviceCodeRow[\"status\"],\n    tokenJti: (r.token_jti ?? r.tokenJti ?? null) as string | null,\n    createdAt: numOrNull(r.created_at ?? r.createdAt),\n    expiresAt: numOrNull(r.expires_at ?? r.expiresAt),\n    consumedAt: numOrNull(r.consumed_at ?? r.consumedAt),\n  };\n}\n\nexport async function getDeviceCode(\n  deviceCode: string,\n): Promise<DeviceCodeRow | null> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `SELECT * FROM mcp_device_codes WHERE device_code = ?`,\n      args: [deviceCode],\n    });\n    if (rows.length === 0) return null;\n    return mapDeviceRow(rows[0]);\n  } catch (err) {\n    if (isConnectionError(err)) return null;\n    throw err;\n  }\n}\n\nexport async function getDeviceCodeByUserCode(\n  userCode: string,\n): Promise<DeviceCodeRow | null> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `SELECT * FROM mcp_device_codes WHERE user_code = ?`,\n      args: [userCode],\n    });\n    if (rows.length === 0) return null;\n    return mapDeviceRow(rows[0]);\n  } catch (err) {\n    if (isConnectionError(err)) return null;\n    throw err;\n  }\n}\n\n/**\n * Bind the logged-in user (email + org) to a pending device code, identified\n * by its human-typable `user_code`. Only transitions a non-expired, still\n * `pending` row. Returns the bound row, or a string error code:\n *   - `not_found`  — no such user_code\n *   - `expired`    — past its TTL\n *   - `already`    — already approved/consumed (not re-bindable)\n */\nexport async function approveDeviceCode(\n  userCode: string,\n  ownerEmail: string,\n  orgId: string | null,\n): Promise<DeviceCodeRow | \"not_found\" | \"expired\" | \"already\"> {\n  await ensureTable();\n  const client = getDbExec();\n  const row = await getDeviceCodeByUserCode(userCode);\n  if (!row) return \"not_found\";\n  if ((row.expiresAt ?? 0) < Date.now()) return \"expired\";\n  if (row.status !== \"pending\") return \"already\";\n\n  const result = await client.execute({\n    sql: `UPDATE mcp_device_codes SET status = 'approved', owner_email = ?, org_id = ? WHERE user_code = ? AND status = 'pending'`,\n    args: [ownerEmail, orgId, userCode],\n  });\n  if (result.rowsAffected === 0) {\n    // Lost a race with another approve — re-read to report the real state.\n    const fresh = await getDeviceCodeByUserCode(userCode);\n    return fresh && fresh.status !== \"pending\" ? \"already\" : \"not_found\";\n  }\n  return {\n    ...row,\n    status: \"approved\",\n    ownerEmail,\n    orgId,\n  };\n}\n\n/**\n * Atomically transition an approved device code to consumed and stamp the\n * minted token's jti. Single-use: only succeeds when the row is currently\n * `approved` (not already consumed). Returns the pre-consume row on success,\n * or null when it could not be consumed (already consumed / not approved /\n * gone). The caller mints the token only after this returns a row.\n */\nexport async function consumeDeviceCode(\n  deviceCode: string,\n  tokenJti: string,\n): Promise<DeviceCodeRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const row = await getDeviceCode(deviceCode);\n  if (!row) return null;\n  if (row.status !== \"approved\") return null;\n  const result = await client.execute({\n    sql: `UPDATE mcp_device_codes SET status = 'consumed', token_jti = ?, consumed_at = ? WHERE device_code = ? AND status = 'approved'`,\n    args: [tokenJti, Date.now(), deviceCode],\n  });\n  if (result.rowsAffected === 0) return null; // lost the single-use race\n  return row;\n}\n\n/**\n * Claim an approved device code for token minting without making it terminal.\n * If signing or token recording fails, callers release this back to approved\n * so the CLI can retry the poll instead of being stuck at \"consumed\".\n */\nexport async function claimDeviceCodeForMint(\n  deviceCode: string,\n  tokenJti: string,\n): Promise<DeviceCodeRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const row = await getDeviceCode(deviceCode);\n  if (!row || row.status !== \"approved\") return null;\n  const result = await client.execute({\n    sql: `UPDATE mcp_device_codes SET status = 'minting', token_jti = ?, consumed_at = ? WHERE device_code = ? AND status = 'approved'`,\n    args: [tokenJti, Date.now(), deviceCode],\n  });\n  if (result.rowsAffected === 0) return null;\n  return row;\n}\n\nexport async function finishDeviceCodeMint(\n  deviceCode: string,\n  tokenJti: string,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const result = await client.execute({\n    sql: `UPDATE mcp_device_codes SET status = 'consumed' WHERE device_code = ? AND status = 'minting' AND token_jti = ?`,\n    args: [deviceCode, tokenJti],\n  });\n  return result.rowsAffected > 0;\n}\n\nexport async function releaseDeviceCodeMint(\n  deviceCode: string,\n  tokenJti: string,\n): Promise<void> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    await client.execute({\n      sql: `UPDATE mcp_device_codes SET status = 'approved', token_jti = NULL, consumed_at = NULL WHERE device_code = ? AND status = 'minting' AND token_jti = ?`,\n      args: [deviceCode, tokenJti],\n    });\n  } catch {\n    // The next poll will keep returning pending for a minting row until a\n    // later cleanup/retry path can observe or repair it. Do not throw here.\n  }\n}\n\n/**\n * Best-effort: flip an expired, still-pending/approved row to `expired` so\n * the poll endpoint can report a clean terminal state. Swallows errors.\n */\nexport async function expireDeviceCode(deviceCode: string): Promise<void> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    await client.execute({\n      sql: `UPDATE mcp_device_codes SET status = 'expired' WHERE device_code = ? AND status IN ('pending','approved')`,\n      args: [deviceCode],\n    });\n  } catch {\n    // The poll handler already treats past-TTL rows as expired regardless of\n    // whether this housekeeping write lands.\n  }\n}\n\nfunction numOrNull(v: unknown): number | null {\n  if (v == null) return null;\n  const n = Number(v);\n  return Number.isFinite(n) ? n : null;\n}\n"]}
+{"version":3,"file":"connect-store.js","sourceRoot":"","sources":["../../src/mcp/connect-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,IAAI,YAAuC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAElE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAC1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;uBAOJ,OAAO,EAAE;yBACP,OAAO,EAAE;uBACX,OAAO,EAAE;;OAEzB,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;uBAQJ,OAAO,EAAE;uBACT,OAAO,EAAE;wBACR,OAAO,EAAE;;OAE1B,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,uEAAuE;YACvE,kEAAkE;YAClE,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAiBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAKvC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,4IAA4I;QACjJ,IAAI,EAAE;YACJ,EAAE;YACF,MAAM,CAAC,GAAG;YACV,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,KAAK,IAAI,IAAI;YACpB,MAAM,CAAC,KAAK,IAAI,IAAI;YACpB,IAAI,CAAC,GAAG,EAAE;YACV,IAAI;YACJ,IAAI;SACL;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,yDAAyD;YAC9D,IAAI,EAAE,CAAC,GAAG,CAAC;SACZ,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,OAAO,SAAS,IAAI,IAAI,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;QACpE,uEAAuE;QACvE,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,yJAAyJ;YAC9J,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,EAAE,EAAE,CAAC,CAAC,EAAY;YAClB,GAAG,EAAE,CAAC,CAAC,GAAa;YACpB,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAW;YACrD,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAkB;YACrD,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAkB;YACzC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;YACjD,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC;YACrD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;SAClD,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAkB,EAClB,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,sGAAsG;QAC3G,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,8DAA8D;YACnE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAkBD,MAAM,kBAAkB,GAAG,kCAAkC,CAAC,CAAC,mCAAmC;AAElG,qEAAqE;AACrE,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,IAAI,GAAG,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,iEAAiE;YACtE,IAAI,EAAE,CAAC,GAAG,GAAG,sBAAsB,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,gBAAgB,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc;YAAE,MAAM,GAAG,CAAC;QAC/C,sEAAsE;QACtE,qEAAqE;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,GAAG,kBAAkB,CAAC;IAC3C,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,uKAAuK;QAC5K,IAAI,EAAE;YACJ,UAAU;YACV,QAAQ;YACR,IAAI;YACJ,IAAI;YACJ,SAAS;YACT,IAAI;YACJ,GAAG;YACH,SAAS;YACT,IAAI;SACL;KACF,CAAC,CAAC;IACH,OAAO;QACL,UAAU;QACV,QAAQ;QACR,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,GAAG;QACd,SAAS;QACT,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAM;IAC1B,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAW;QACrD,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAW;QAC/C,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAkB;QACpE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAkB;QACrD,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAA4B;QAC1D,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAkB;QAC9D,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;QACjD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;QACjD,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,sDAAsD;YAC3D,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,oDAAoD;YACzD,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,UAAkB,EAClB,KAAoB;IAEpB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,WAAW,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,yHAAyH;QAC9H,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,uEAAuE;QACvE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACvE,CAAC;IACD,OAAO;QACL,GAAG,GAAG;QACN,MAAM,EAAE,UAAU;QAClB,UAAU;QACV,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,QAAgB;IAEhB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,+HAA+H;QACpI,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2BAA2B;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,QAAgB;IAEhB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,8HAA8H;QACnI,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,QAAgB;IAEhB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,gHAAgH;QACrH,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;KAC7B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,sJAAsJ;YAC3J,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,wEAAwE;IAC1E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,2GAA2G;YAChH,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC","sourcesContent":["/**\n * Framework-table store for the \"connect external agents\" feature.\n *\n * Two additive, dialect-agnostic tables back the browser **Connect** page and\n * the OAuth-style **device-code flow** a CLI drives:\n *\n *   - `mcp_connect_tokens`  — one row per minted MCP token. We never store the\n *     token value (it's a signed JWT); only its `jti` so revocation is a\n *     SQL lookup. Revoking sets `revoked_at`; the row is never deleted.\n *   - `mcp_device_codes`    — short-lived (10 min) device/user code pairs for\n *     the OAuth 2.0 device-authorization-style CLI flow. Single-use\n *     (`consumed_at`), rate-limited at creation.\n *\n * Mirrors `application-state/store.ts`: lazy `ensureTable()`, `getDbExec()`,\n * `isConnectionError()` swallow so a transient Neon WS drop never 500s.\n * `CREATE TABLE IF NOT EXISTS` only — strictly additive, never DROP / ALTER\n * (shared prod DB rule).\n */\n\nimport { getDbExec, isConnectionError, intType } from \"../db/client.js\";\nimport { randomBytes, randomUUID } from \"node:crypto\";\n\nlet _initPromise: Promise<void> | undefined;\n\n/**\n * Scope claim that marks a connect-minted token (vs. an ordinary A2A\n * delegation JWT). Only tokens carrying this scope go through the revoke\n * lookup in `verifyAuth` — defined here so both `connect-route.ts` and\n * `build-server.ts` import it from the leaf store without a cycle.\n */\nexport const MCP_CONNECT_SCOPE = \"mcp-connect\";\n\n/**\n * Client id used when connect/device flows have to mint a standard MCP OAuth\n * access token instead of an A2A JWT (for deployments without A2A_SECRET).\n */\nexport const MCP_CONNECT_OAUTH_CLIENT_ID = \"agent-native-connect\";\n\n/** Device codes are valid for 10 minutes. */\nexport const DEVICE_CODE_TTL_MS = 10 * 60_000;\n\n/** Default minted-token lifetime. Configurable per-request 1–365 days. */\nexport const DEFAULT_TOKEN_TTL_DAYS = 365;\nexport const MIN_TOKEN_TTL_DAYS = 1;\nexport const MAX_TOKEN_TTL_DAYS = 365;\n\n/**\n * Rate limit for `device/start`: at most this many device codes may be created\n * within `DEVICE_START_WINDOW_MS`. Unauthenticated endpoint — keep it tight so\n * a hostile client can't flood the table or brute-force user codes.\n */\nexport const DEVICE_START_MAX = 20;\nexport const DEVICE_START_WINDOW_MS = 60_000;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      // Additive only. Never DROP / ALTER — this DB is shared across every\n      // deploy context (preview/branch/prod) for hosted templates.\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS mcp_connect_tokens (\n          id TEXT PRIMARY KEY,\n          jti TEXT UNIQUE NOT NULL,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          label TEXT,\n          created_at ${intType()},\n          last_used_at ${intType()},\n          revoked_at ${intType()}\n        )\n      `);\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS mcp_device_codes (\n          device_code TEXT PRIMARY KEY,\n          user_code TEXT NOT NULL,\n          owner_email TEXT,\n          org_id TEXT,\n          status TEXT NOT NULL DEFAULT 'pending',\n          token_jti TEXT,\n          created_at ${intType()},\n          expires_at ${intType()},\n          consumed_at ${intType()}\n        )\n      `);\n    })().catch((err) => {\n      // Don't cache a rejected init. A transient DB blip should let the next\n      // connect/mint/revoke call retry rather than wedging the process.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n// ---------------------------------------------------------------------------\n// Minted-token records\n// ---------------------------------------------------------------------------\n\nexport interface MintedTokenRow {\n  id: string;\n  jti: string;\n  ownerEmail: string;\n  orgId: string | null;\n  label: string | null;\n  createdAt: number | null;\n  lastUsedAt: number | null;\n  revokedAt: number | null;\n}\n\n/**\n * Persist a record of a minted token. The token value itself (a signed JWT)\n * is NEVER stored — only its `jti`, so revocation is a cheap SQL lookup.\n */\nexport async function recordMintedToken(params: {\n  jti: string;\n  ownerEmail: string;\n  orgId?: string | null;\n  label?: string | null;\n}): Promise<string> {\n  await ensureTable();\n  const client = getDbExec();\n  const id = randomUUID();\n  await client.execute({\n    sql: `INSERT INTO mcp_connect_tokens (id, jti, owner_email, org_id, label, created_at, last_used_at, revoked_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      params.jti,\n      params.ownerEmail,\n      params.orgId ?? null,\n      params.label ?? null,\n      Date.now(),\n      null,\n      null,\n    ],\n  });\n  return id;\n}\n\n/**\n * Returns true when the given `jti` corresponds to a token that has been\n * revoked. Fails OPEN on a store/DB error: a transient Neon WS drop must not\n * lock every connected agent out. Signature verification is unaffected — this\n * is only the post-verify revoke check (see `verifyAuth` in build-server.ts).\n */\nexport async function isJtiRevoked(jti: string): Promise<boolean> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `SELECT revoked_at FROM mcp_connect_tokens WHERE jti = ?`,\n      args: [jti],\n    });\n    if (rows.length === 0) return false;\n    const revokedAt = rows[0].revoked_at ?? rows[0].revokedAt;\n    return revokedAt != null;\n  } catch (err) {\n    // Fail open: a DB blip must not turn every minted token into a 401.\n    // (Signature checks already passed; this only gates explicit revokes.)\n    if (isConnectionError(err)) return false;\n    return false;\n  }\n}\n\nexport async function listTokens(\n  ownerEmail: string,\n): Promise<MintedTokenRow[]> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `SELECT id, jti, owner_email, org_id, label, created_at, last_used_at, revoked_at FROM mcp_connect_tokens WHERE owner_email = ? ORDER BY created_at DESC`,\n      args: [ownerEmail],\n    });\n    return rows.map((r: any) => ({\n      id: r.id as string,\n      jti: r.jti as string,\n      ownerEmail: (r.owner_email ?? r.ownerEmail) as string,\n      orgId: (r.org_id ?? r.orgId ?? null) as string | null,\n      label: (r.label ?? null) as string | null,\n      createdAt: numOrNull(r.created_at ?? r.createdAt),\n      lastUsedAt: numOrNull(r.last_used_at ?? r.lastUsedAt),\n      revokedAt: numOrNull(r.revoked_at ?? r.revokedAt),\n    }));\n  } catch (err) {\n    if (isConnectionError(err)) return [];\n    throw err;\n  }\n}\n\n/**\n * Revoke a token, but ONLY if it is owned by `ownerEmail` (the caller). The\n * `owner_email = ?` predicate is the access scope — a caller can never revoke\n * another user's token. Idempotent: re-revoking keeps the first timestamp.\n * Returns true when a row was actually transitioned to revoked.\n */\nexport async function revokeToken(\n  ownerEmail: string,\n  id: string,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const result = await client.execute({\n    sql: `UPDATE mcp_connect_tokens SET revoked_at = ? WHERE id = ? AND owner_email = ? AND revoked_at IS NULL`,\n    args: [Date.now(), id, ownerEmail],\n  });\n  return result.rowsAffected > 0;\n}\n\n/**\n * Best-effort: stamp `last_used_at` for a token. Swallows all errors — this is\n * pure telemetry and must never affect the auth path.\n */\nexport async function touchTokenUsed(jti: string): Promise<void> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    await client.execute({\n      sql: `UPDATE mcp_connect_tokens SET last_used_at = ? WHERE jti = ?`,\n      args: [Date.now(), jti],\n    });\n  } catch {\n    // last_used_at is informational only — never throw from the hot path.\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Device-code flow (OAuth 2.0 device-authorization style)\n// ---------------------------------------------------------------------------\n\nexport interface DeviceCodeRow {\n  deviceCode: string;\n  userCode: string;\n  ownerEmail: string | null;\n  orgId: string | null;\n  status: \"pending\" | \"approved\" | \"minting\" | \"consumed\" | \"expired\";\n  tokenJti: string | null;\n  createdAt: number | null;\n  expiresAt: number | null;\n  consumedAt: number | null;\n}\n\nconst USER_CODE_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZ234567\"; // Crockford-ish base32, no 0/1/O/I\n\n/** Crypto-random short human-typable code, formatted `XXXX-XXXX`. */\nfunction generateUserCode(): string {\n  const bytes = randomBytes(8);\n  let out = \"\";\n  for (let i = 0; i < 8; i++) {\n    out += USER_CODE_ALPHABET[bytes[i] % USER_CODE_ALPHABET.length];\n    if (i === 3) out += \"-\";\n  }\n  return out;\n}\n\nfunction generateDeviceCode(): string {\n  return randomBytes(32).toString(\"base64url\");\n}\n\n/**\n * Create a new device+user code pair. Rate-limited: at most\n * `DEVICE_START_MAX` codes within `DEVICE_START_WINDOW_MS`. The window count\n * is a coarse global cap (this endpoint is unauthenticated) — enough to stop\n * table flooding / user-code brute force without per-IP plumbing.\n *\n * Throws `RATE_LIMITED` when the cap is exceeded so the route can map it to a\n * 429.\n */\nexport async function createDeviceCode(): Promise<DeviceCodeRow> {\n  await ensureTable();\n  const client = getDbExec();\n\n  const now = Date.now();\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT COUNT(*) AS n FROM mcp_device_codes WHERE created_at > ?`,\n      args: [now - DEVICE_START_WINDOW_MS],\n    });\n    const n = Number(rows[0]?.n ?? rows[0]?.[\"COUNT(*)\"] ?? 0);\n    if (Number.isFinite(n) && n >= DEVICE_START_MAX) {\n      throw new Error(\"RATE_LIMITED\");\n    }\n  } catch (err: any) {\n    if (err?.message === \"RATE_LIMITED\") throw err;\n    // A read failure here should not block legitimate device starts — the\n    // single-use + short-TTL design is the primary protection. Continue.\n  }\n\n  const deviceCode = generateDeviceCode();\n  const userCode = generateUserCode();\n  const expiresAt = now + DEVICE_CODE_TTL_MS;\n  await client.execute({\n    sql: `INSERT INTO mcp_device_codes (device_code, user_code, owner_email, org_id, status, token_jti, created_at, expires_at, consumed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      deviceCode,\n      userCode,\n      null,\n      null,\n      \"pending\",\n      null,\n      now,\n      expiresAt,\n      null,\n    ],\n  });\n  return {\n    deviceCode,\n    userCode,\n    ownerEmail: null,\n    orgId: null,\n    status: \"pending\",\n    tokenJti: null,\n    createdAt: now,\n    expiresAt,\n    consumedAt: null,\n  };\n}\n\nfunction mapDeviceRow(r: any): DeviceCodeRow {\n  return {\n    deviceCode: (r.device_code ?? r.deviceCode) as string,\n    userCode: (r.user_code ?? r.userCode) as string,\n    ownerEmail: (r.owner_email ?? r.ownerEmail ?? null) as string | null,\n    orgId: (r.org_id ?? r.orgId ?? null) as string | null,\n    status: (r.status ?? \"pending\") as DeviceCodeRow[\"status\"],\n    tokenJti: (r.token_jti ?? r.tokenJti ?? null) as string | null,\n    createdAt: numOrNull(r.created_at ?? r.createdAt),\n    expiresAt: numOrNull(r.expires_at ?? r.expiresAt),\n    consumedAt: numOrNull(r.consumed_at ?? r.consumedAt),\n  };\n}\n\nexport async function getDeviceCode(\n  deviceCode: string,\n): Promise<DeviceCodeRow | null> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `SELECT * FROM mcp_device_codes WHERE device_code = ?`,\n      args: [deviceCode],\n    });\n    if (rows.length === 0) return null;\n    return mapDeviceRow(rows[0]);\n  } catch (err) {\n    if (isConnectionError(err)) return null;\n    throw err;\n  }\n}\n\nasync function getDeviceCodeByUserCode(\n  userCode: string,\n): Promise<DeviceCodeRow | null> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `SELECT * FROM mcp_device_codes WHERE user_code = ?`,\n      args: [userCode],\n    });\n    if (rows.length === 0) return null;\n    return mapDeviceRow(rows[0]);\n  } catch (err) {\n    if (isConnectionError(err)) return null;\n    throw err;\n  }\n}\n\n/**\n * Bind the logged-in user (email + org) to a pending device code, identified\n * by its human-typable `user_code`. Only transitions a non-expired, still\n * `pending` row. Returns the bound row, or a string error code:\n *   - `not_found`  — no such user_code\n *   - `expired`    — past its TTL\n *   - `already`    — already approved/consumed (not re-bindable)\n */\nexport async function approveDeviceCode(\n  userCode: string,\n  ownerEmail: string,\n  orgId: string | null,\n): Promise<DeviceCodeRow | \"not_found\" | \"expired\" | \"already\"> {\n  await ensureTable();\n  const client = getDbExec();\n  const row = await getDeviceCodeByUserCode(userCode);\n  if (!row) return \"not_found\";\n  if ((row.expiresAt ?? 0) < Date.now()) return \"expired\";\n  if (row.status !== \"pending\") return \"already\";\n\n  const result = await client.execute({\n    sql: `UPDATE mcp_device_codes SET status = 'approved', owner_email = ?, org_id = ? WHERE user_code = ? AND status = 'pending'`,\n    args: [ownerEmail, orgId, userCode],\n  });\n  if (result.rowsAffected === 0) {\n    // Lost a race with another approve — re-read to report the real state.\n    const fresh = await getDeviceCodeByUserCode(userCode);\n    return fresh && fresh.status !== \"pending\" ? \"already\" : \"not_found\";\n  }\n  return {\n    ...row,\n    status: \"approved\",\n    ownerEmail,\n    orgId,\n  };\n}\n\n/**\n * Atomically transition an approved device code to consumed and stamp the\n * minted token's jti. Single-use: only succeeds when the row is currently\n * `approved` (not already consumed). Returns the pre-consume row on success,\n * or null when it could not be consumed (already consumed / not approved /\n * gone). The caller mints the token only after this returns a row.\n */\nexport async function consumeDeviceCode(\n  deviceCode: string,\n  tokenJti: string,\n): Promise<DeviceCodeRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const row = await getDeviceCode(deviceCode);\n  if (!row) return null;\n  if (row.status !== \"approved\") return null;\n  const result = await client.execute({\n    sql: `UPDATE mcp_device_codes SET status = 'consumed', token_jti = ?, consumed_at = ? WHERE device_code = ? AND status = 'approved'`,\n    args: [tokenJti, Date.now(), deviceCode],\n  });\n  if (result.rowsAffected === 0) return null; // lost the single-use race\n  return row;\n}\n\n/**\n * Claim an approved device code for token minting without making it terminal.\n * If signing or token recording fails, callers release this back to approved\n * so the CLI can retry the poll instead of being stuck at \"consumed\".\n */\nexport async function claimDeviceCodeForMint(\n  deviceCode: string,\n  tokenJti: string,\n): Promise<DeviceCodeRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const row = await getDeviceCode(deviceCode);\n  if (!row || row.status !== \"approved\") return null;\n  const result = await client.execute({\n    sql: `UPDATE mcp_device_codes SET status = 'minting', token_jti = ?, consumed_at = ? WHERE device_code = ? AND status = 'approved'`,\n    args: [tokenJti, Date.now(), deviceCode],\n  });\n  if (result.rowsAffected === 0) return null;\n  return row;\n}\n\nexport async function finishDeviceCodeMint(\n  deviceCode: string,\n  tokenJti: string,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const result = await client.execute({\n    sql: `UPDATE mcp_device_codes SET status = 'consumed' WHERE device_code = ? AND status = 'minting' AND token_jti = ?`,\n    args: [deviceCode, tokenJti],\n  });\n  return result.rowsAffected > 0;\n}\n\nexport async function releaseDeviceCodeMint(\n  deviceCode: string,\n  tokenJti: string,\n): Promise<void> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    await client.execute({\n      sql: `UPDATE mcp_device_codes SET status = 'approved', token_jti = NULL, consumed_at = NULL WHERE device_code = ? AND status = 'minting' AND token_jti = ?`,\n      args: [deviceCode, tokenJti],\n    });\n  } catch {\n    // The next poll will keep returning pending for a minting row until a\n    // later cleanup/retry path can observe or repair it. Do not throw here.\n  }\n}\n\n/**\n * Best-effort: flip an expired, still-pending/approved row to `expired` so\n * the poll endpoint can report a clean terminal state. Swallows errors.\n */\nexport async function expireDeviceCode(deviceCode: string): Promise<void> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    await client.execute({\n      sql: `UPDATE mcp_device_codes SET status = 'expired' WHERE device_code = ? AND status IN ('pending','approved')`,\n      args: [deviceCode],\n    });\n  } catch {\n    // The poll handler already treats past-TTL rows as expired regardless of\n    // whether this housekeeping write lands.\n  }\n}\n\nfunction numOrNull(v: unknown): number | null {\n  if (v == null) return null;\n  const n = Number(v);\n  return Number.isFinite(n) ? n : null;\n}\n"]}

package/dist/mcp-client/routes.js

@@ -747,7 +747,12 @@ async function handleTestExisting(event, manager, id) {
         setResponseStatus(event, 404);
         return { error: "Server not found" };
     }
-    const result = await tryConnect(server.url, server.headers);
+    // `server.headers` holds only the cleartext (non-secret) subset; auth headers
+    // (Authorization, API keys) live encrypted in app_secrets and are resolved by
+    // toHttpServerConfigAsync. Testing with cleartext-only headers would fail for
+    // any server that uses encrypted credentials.
+    const config = await toHttpServerConfigAsync(parsedScope, scopeId, server);
+    const result = await tryConnect(server.url, config.headers);
     if (result.ok !== true) {
         setResponseStatus(event, 400);
         return { ok: false, error: result.error };

package/dist/mcp-client/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,EACnC,gCAAgC,EAChC,wBAAwB,GAGzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,sEAAsE;AACtE,SAAS,aAAa,CACpB,OAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA6B,EAC7B,KAAqB,EACrB,OAAe,EACf,MAAoB;IAEpB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;QACjD,MAAM;KACP,CAAC;AACJ,CAAC;AAoCD,SAAS,SAAS,CAAC,OAAyB,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAgC;IAEhC,OAAO;QACL,EAAE,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC9B,IAAI,EAAE,UAAU,CAAC,QAAQ;QACzB,GAAG,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAqB,EACrB,UAAgC,EAChC,OAAe;IAEf,OAAO,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAoC,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,CAAC;YACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACjC,MAAM,IAAI,GAAI,KAA+C,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,SAAS;YACxE,oEAAoE;YACpE,gEAAgE;YAChE,sEAAsE;YACtE,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,kCAAkC,EAAE,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,iCAAiC,EAAE,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxE,IAAI,KAAK,GAA0B,IAAI,CAAC;YACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,GAAG,MAAM,CAAC;gBACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,KAAK,GAAG,KAAK,CAAC;gBACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBAAE,SAAS;YACjC,MAAM,UAAU,GAAG,gCAAgC,CACjD,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,UAAU,CAAC;gBACtC,CAAC,CAAE,KAAa,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBACvC,CAAC,CAAC,EAAE,CACP,CAAC;YACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;gBAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChE,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;oBACzD,wBAAwB,CAAC,UAAU,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,qDAAqD,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CAC1G,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,kCAAkC,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAwB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;IAC3D,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAyB;IAEzB,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAChD,IAAI,UAAU,IAAI,CAAC,IAAI,OAAO,WAAW,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAEtE,IAAI,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAClE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,UAAU;YAAE,OAAO;QACvB,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;gBACvC,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAChC,gBAAgB,GAAG,aAAa,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,uCAAuC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC7D,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5C,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAAc;IAKpD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAClB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAChB,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAyB;IACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,OAAyB;IAEzB,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,kCAAkC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAChE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAE7D,+DAA+D;YAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACnE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,qBAAqB;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC9C,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/D,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAClE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBACnD,OAAO,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;gBACpD,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;gBACvD,OAAO,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,4CAA4C,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,EAAoB;IAEpB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,qBAAqB,CAC1B;QACE,SAAS,EAAE,KAAK,IAAI,SAAS;QAC7B,KAAK,EAAE,KAAK,IAAI,SAAS;KAC1B,EACD,EAAE,CACW,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAyB,EACzB,QAAgB;IAEhB,OAAO,OAAO;SACX,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CACnE,CAAC;AACN,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAgB,EAChB,OAAgB;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,YAAY;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAyB,EACzB,QAAgB,EAChB,gBAAwB;IAExB,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAClE,MAAM,IAAI,GACR,OAAO;SACJ,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,YAAY,KAAK,gBAAgB,CAC9C,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAc,EAAE,OAAyB;IAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAIpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,QAAQ,CAC3B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClD,CAAC,CAAE,IAAI,CAAC,SAAqC;gBAC7C,CAAC,CAAC,EAAE,CACP,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,OAAO;YACL,KAAK,EAAE,OAAO;iBACX,iBAAiB,CAAC,QAAQ,CAAC;iBAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACvD,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,gBAAgB,CAAC;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,0BAA0B,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,OAAyB;IAUzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,kCAAkC,EAAE,CAAC;IACvD,MAAM,WAAW,GACf,SAAS,IAAI,KAAK;QAChB,CAAC,CAAC,MAAM,iCAAiC,CAAC,MAAM,EAAE,KAAK,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GACd,SAAS,IAAI,KAAK;QAChB,CAAC,CAAC,MAAM,iCAAiC,CAAC,KAAK,EAAE,KAAK,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,YAAY,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAC3D,CAAC,UAAU,EAAE,EAAE;YACb,MAAM,SAAS,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAG,KAAK;gBACxB,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;gBACnD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,WAAW,GAAG,KAAK;gBACvB,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;gBAClD,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,SAAS;gBACT,iBAAiB,EAAE,SAAS;oBAC1B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,qBAAqB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3D,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;iBACxC;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,YAAY;oBAClB,GAAG,EAAE,WAAW;iBACjB;gBACD,MAAM,EAAE;oBACN,IAAI,EACF,YAAY,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACjD,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;wBAClC,CAAC,CAAC,SAAS;oBACf,GAAG,EACD,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC/C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;wBACjC,CAAC,CAAC,SAAS;iBAChB;aACF,CAAC;QACJ,CAAC,CACF;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;QACjC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,KAAc,EAAE,OAAyB;IAC1E,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,kEAAkE;aACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,2DAA2D;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,kCAAkC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,gCAAgC,CACpC,KAAK,EACL,OAAO,EACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAC5B,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,KAAK,EACL,OAAO,EACP,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,OAAO,CACb,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kCAAkC,CAAC,EAAU;IACpD,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,oCAAoC,EAAE,GAAG,CAAC;IAClE,IAAI,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;YAC1C,OAAO,0EAA0E,CAAC;QACpF,CAAC;QACD,OAAO,GAAG,UAAU,CAAC,IAAI,yBAAyB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAAc,EACd,OAAyB;IAOzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,gBAAgB,CACd,CAAC,EACD,MAAM,EACN,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC5D,CACF;QACD,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxB,gBAAgB,CACd,CAAC,EACD,KAAK,EACL,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC3D,CACF;QACD,KAAK;QACL,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAc,EAAE,OAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAMpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+DAA+D;aACvE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE;QACnD,IAAI;QACJ,GAAG;QACH,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,gBAAgB,CACtB,MAAM,CAAC,MAAM,EACb,KAAK,EACL,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,yDAAyD;aACjE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,OAAgC;IAKhC,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,6BAA6B,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxE,MAAM,CAAC,2CAA2C,CAAC;YACnD,MAAM,CAAC,oDAAoD,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YAChE,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1D,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAA6B,CAAC,GAAG,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC","sourcesContent":["/**\n * HTTP routes for user- and org-scope remote MCP server management.\n *\n * Mounted under `/_agent-native/mcp/servers` by `agent-chat-plugin` —\n * requires a reference to the running `McpClientManager` so mutations can\n * hot-reload the configured server set.\n *\n *   GET    /_agent-native/mcp/servers           list user + org servers\n *   POST   /_agent-native/mcp/servers           add a server\n *   DELETE /_agent-native/mcp/servers/:id       remove a server (scope via ?scope=)\n *   POST   /_agent-native/mcp/servers/:id/test  dry-run connect (no persist)\n *   POST   /_agent-native/mcp/servers/test      dry-run a URL before persisting\n *   GET    /_agent-native/mcp/builtin           list built-in capability toggles\n *   POST   /_agent-native/mcp/builtin           update built-in capability toggles\n *   POST   /_agent-native/mcp/apps/call-tool    mediated same-server app tool call\n *   POST   /_agent-native/mcp/apps/list-tools   list tools visible to an app iframe\n *   POST   /_agent-native/mcp/apps/read-resource read a ui:// app resource\n */\n\nimport {\n  defineEventHandler,\n  getMethod,\n  getQuery,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport { getAllSettings } from \"../settings/store.js\";\nimport {\n  buildMcpToolName,\n  parseMcpToolName,\n  type McpClientManager,\n  type McpTool,\n} from \"./manager.js\";\nimport type { McpConfig, McpServerConfig } from \"./config.js\";\nimport { loadMcpConfig, autoDetectMcpConfig } from \"./config.js\";\nimport { formatMcpConnectError } from \"./errors.js\";\nimport {\n  areBuiltinMcpCapabilitiesSupported,\n  BUILTIN_MCP_CAPABILITIES,\n  getBuiltinMcpCapability,\n  isBuiltinMcpCapabilityAvailable,\n  listSupportedBuiltinMcpCapabilities,\n  normalizeBuiltinMcpCapabilityIds,\n  toBuiltinMcpServerConfig,\n  type BuiltinMcpCapability,\n  type BuiltinMcpCapabilityId,\n} from \"./builtin-capabilities.js\";\nimport {\n  builtinMcpCapabilitiesSettingsKey,\n  listEnabledBuiltinMcpCapabilities,\n  setBuiltinMcpCapabilityEnabled,\n  setEnabledBuiltinMcpCapabilities,\n} from \"./builtin-store.js\";\nimport {\n  addRemoteServer,\n  listRemoteServers,\n  mergedConfigKey,\n  removeRemoteServer,\n  toHttpServerConfigAsync,\n  validateRemoteUrl,\n  type RemoteMcpScope,\n  type StoredRemoteMcpServer,\n} from \"./remote-store.js\";\nimport { fetchHubServers } from \"./hub-client.js\";\nimport { loadWorkspaceMcpServers } from \"./workspace-servers.js\";\nimport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nimport { isToolVisibilityModelOnly } from \"@modelcontextprotocol/ext-apps/app-bridge\";\n\nexport { formatMcpConnectError } from \"./errors.js\";\n\n/** Redact obvious auth header values before sending to the client. */\nfunction redactHeaders(\n  headers?: Record<string, string>,\n): Record<string, { set: true }> | undefined {\n  if (!headers) return undefined;\n  const out: Record<string, { set: true }> = {};\n  for (const k of Object.keys(headers)) out[k] = { set: true };\n  return out;\n}\n\nfunction projectForClient(\n  stored: StoredRemoteMcpServer,\n  scope: RemoteMcpScope,\n  ownerId: string,\n  status: ServerStatus,\n): ClientServer {\n  return {\n    id: stored.id,\n    scope,\n    name: stored.name,\n    url: stored.url,\n    headers: redactHeaders(stored.headers),\n    description: stored.description,\n    createdAt: stored.createdAt,\n    mergedId: mergedConfigKey(scope, stored, ownerId),\n    status,\n  };\n}\n\nexport interface ClientServer {\n  id: string;\n  scope: RemoteMcpScope;\n  name: string;\n  url: string;\n  headers?: Record<string, { set: true }>;\n  description?: string;\n  createdAt: number;\n  /** The key under which this server is registered in the running MCP manager. */\n  mergedId: string;\n  status: ServerStatus;\n}\n\nexport interface ClientBuiltinCapability {\n  id: BuiltinMcpCapabilityId;\n  serverId: string;\n  name: string;\n  description: string;\n  command: string;\n  args: string[];\n  exclusiveGroup?: string;\n  available: boolean;\n  unavailableReason?: string;\n  notes?: string;\n  enabled: { user: boolean; org: boolean };\n  mergedIds: { user?: string; org?: string };\n  status: { user?: ServerStatus; org?: ServerStatus };\n}\n\ntype ServerStatus =\n  | { state: \"connected\"; toolCount: number }\n  | { state: \"error\"; error: string }\n  | { state: \"unknown\" };\n\nfunction statusFor(manager: McpClientManager, mergedId: string): ServerStatus {\n  const snap = manager.getStatus();\n  if (snap.connectedServers.includes(mergedId)) {\n    const toolCount = snap.tools.filter((t) => t.source === mergedId).length;\n    return { state: \"connected\", toolCount };\n  }\n  if (snap.errors[mergedId]) {\n    return { state: \"error\", error: snap.errors[mergedId] };\n  }\n  if (snap.configuredServers.includes(mergedId)) {\n    return { state: \"unknown\" };\n  }\n  return { state: \"unknown\" };\n}\n\nfunction pseudoStoredBuiltin(\n  capability: BuiltinMcpCapability,\n): StoredRemoteMcpServer {\n  return {\n    id: `builtin_${capability.id}`,\n    name: capability.serverId,\n    url: `builtin:${capability.id}`,\n    description: capability.description,\n    createdAt: 0,\n  };\n}\n\nexport function builtinMergedConfigKey(\n  scope: RemoteMcpScope,\n  capability: BuiltinMcpCapability,\n  ownerId: string,\n): string {\n  return mergedConfigKey(scope, pseudoStoredBuiltin(capability), ownerId);\n}\n\n/**\n * Build the merged MCP config the manager should run with: file/env config\n * plus **every** user-scope and org-scope remote server persisted in the\n * settings store. Scanning all scopes means a mutation from one user's\n * session never drops another user's servers from the running manager.\n *\n * Each persisted server's merged key includes its owner discriminator\n * (`user_<emailhash>_<name>` or `org_<orgId>_<name>`) so two users' servers\n * with the same name coexist; the request-time gate in\n * `isMcpToolAllowedForRequest` then scopes tool visibility back down to the\n * calling user.\n */\nexport async function buildMergedConfig(): Promise<McpConfig | null> {\n  const base = loadMcpConfig() ?? autoDetectMcpConfig();\n  const servers: Record<string, McpServerConfig> = { ...(base?.servers ?? {}) };\n\n  const all = await getAllSettings().catch(() => ({}));\n  for (const [fullKey, value] of Object.entries(all)) {\n    const userMatch = /^u:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    const orgMatch = /^o:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    let scope: RemoteMcpScope | null = null;\n    let ownerId: string | null = null;\n    if (userMatch) {\n      scope = \"user\";\n      ownerId = userMatch[1];\n    } else if (orgMatch) {\n      scope = \"org\";\n      ownerId = orgMatch[1];\n    }\n    if (!scope || !ownerId) continue;\n    const list = (value as { servers?: StoredRemoteMcpServer[] }).servers;\n    if (!Array.isArray(list)) continue;\n    for (const stored of list) {\n      if (!stored || typeof stored.url !== \"string\" || !stored.name) continue;\n      // Async resolve: decrypts `headerSecretKey` from app_secrets so the\n      // running MCP client gets the cleartext bearer at request time.\n      // Stored row contains only the secret-key reference, never the value.\n      servers[mergedConfigKey(scope, stored, ownerId)] =\n        await toHttpServerConfigAsync(scope, ownerId, stored);\n    }\n  }\n  if (areBuiltinMcpCapabilitiesSupported()) {\n    for (const [fullKey, value] of Object.entries(all)) {\n      const settingsKey = builtinMcpCapabilitiesSettingsKey();\n      const userMatch = new RegExp(`^u:([^:]+):${settingsKey}$`).exec(fullKey);\n      const orgMatch = new RegExp(`^o:([^:]+):${settingsKey}$`).exec(fullKey);\n      let scope: RemoteMcpScope | null = null;\n      let ownerId: string | null = null;\n      if (userMatch) {\n        scope = \"user\";\n        ownerId = userMatch[1];\n      } else if (orgMatch) {\n        scope = \"org\";\n        ownerId = orgMatch[1];\n      }\n      if (!scope || !ownerId) continue;\n      const enabledIds = normalizeBuiltinMcpCapabilityIds(\n        Array.isArray((value as any).enabledIds)\n          ? (value as any).enabledIds.map(String)\n          : [],\n      );\n      for (const id of enabledIds) {\n        const capability = getBuiltinMcpCapability(id);\n        if (!capability || !isBuiltinMcpCapabilityAvailable(capability)) {\n          continue;\n        }\n        servers[builtinMergedConfigKey(scope, capability, ownerId)] =\n          toBuiltinMcpServerConfig(capability);\n      }\n    }\n  }\n\n  try {\n    const workspaceServers = await loadWorkspaceMcpServers();\n    for (const [mergedKey, cfg] of Object.entries(workspaceServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] workspace MCP resource merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  // Hub-consume: if this app is configured to consume from a remote hub\n  // (AGENT_NATIVE_MCP_HUB_URL + AGENT_NATIVE_MCP_HUB_TOKEN), pull its\n  // org-scope servers and merge. Hub entries use `hub_<orgId>_<name>` so\n  // they never collide with local `org_<orgId>_<name>` rows.\n  try {\n    const hubServers = await fetchHubServers();\n    for (const [mergedKey, cfg] of Object.entries(hubServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] hub merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  if (Object.keys(servers).length === 0) return null;\n  return { servers, source: base?.source ?? \"merged\" };\n}\n\nfunction sortedConfigSignature(config: McpConfig | null): string {\n  const entries = Object.entries(config?.servers ?? {}).sort(([a], [b]) =>\n    a.localeCompare(b),\n  );\n  return JSON.stringify(entries);\n}\n\nfunction mcpConfigRefreshIntervalMs(): number {\n  const raw = process.env.AGENT_NATIVE_MCP_CONFIG_REFRESH_MS;\n  if (raw?.trim() === \"0\") return 0;\n  const parsed = raw ? Number(raw) : NaN;\n  if (Number.isFinite(parsed) && parsed >= 5_000) return parsed;\n  return 60_000;\n}\n\nexport function startMcpConfigRefresh(\n  manager: McpClientManager,\n): (() => void) | null {\n  const intervalMs = mcpConfigRefreshIntervalMs();\n  if (intervalMs <= 0 || typeof setInterval !== \"function\") return null;\n\n  let currentSignature = sortedConfigSignature(manager.getConfig());\n  let refreshing = false;\n  const refresh = async () => {\n    if (refreshing) return;\n    refreshing = true;\n    try {\n      const next = await buildMergedConfig();\n      const nextSignature = sortedConfigSignature(next);\n      if (nextSignature !== currentSignature) {\n        await manager.reconfigure(next);\n        currentSignature = nextSignature;\n      }\n    } catch (err: any) {\n      console.warn(\n        `[mcp-client] config refresh failed: ${err?.message ?? err}`,\n      );\n    } finally {\n      refreshing = false;\n    }\n  };\n\n  const timer = setInterval(refresh, intervalMs);\n  (timer as { unref?: () => void }).unref?.();\n  return () => clearInterval(timer);\n}\n\nasync function resolveContextForRequest(event: H3Event): Promise<{\n  email: string | null;\n  orgId: string | null;\n  role: string | null;\n}> {\n  let email: string | null = null;\n  try {\n    const session = await getSession(event);\n    email = session?.email ?? null;\n  } catch {\n    email = null;\n  }\n  let orgId: string | null = null;\n  let role: string | null = null;\n  try {\n    const ctx = await getOrgContext(event);\n    orgId = ctx.orgId;\n    role = ctx.role;\n    if (!email) email = ctx.email;\n  } catch {\n    // ignore — no org context\n  }\n  // No silent `local@localhost` fallback — if `getSession` returns nothing in\n  // production (misconfigured deploy, expired token), the caller must reject\n  // rather than silently pool every unauthenticated request under one identity.\n  return { email, orgId, role };\n}\n\nasync function reconfigureManager(manager: McpClientManager): Promise<void> {\n  const merged = await buildMergedConfig();\n  await manager.reconfigure(merged);\n}\n\nexport function mountMcpServersRoutes(\n  nitroApp: any,\n  manager: McpClientManager,\n): void {\n  const mountedApps: WeakSet<object> = ((\n    globalThis as any\n  ).__agentNativeMcpServersMountedApps ??= new WeakSet<object>());\n  if (mountedApps.has(nitroApp)) return;\n  mountedApps.add(nitroApp);\n\n  try {\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/servers\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n\n        // POST /servers/test — dry-run a URL+headers before persisting\n        if (method === \"POST\" && parts.length === 1 && parts[0] === \"test\") {\n          return handleTestUrl(event);\n        }\n\n        // Collection root\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleList(event, manager);\n          if (method === \"POST\") return handleAdd(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        // /:id  /  /:id/test\n        if (parts.length === 1 || parts.length === 2) {\n          const id = parts[0];\n          if (parts.length === 2 && parts[1] === \"test\" && method === \"POST\") {\n            return handleTestExisting(event, manager, id);\n          }\n          if (parts.length === 1 && method === \"DELETE\") {\n            return handleDelete(event, manager, id);\n          }\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/builtin\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleBuiltinList(event, manager);\n          if (method === \"POST\") return handleBuiltinUpdate(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/apps\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (method !== \"POST\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        if (parts.length === 1 && parts[0] === \"call-tool\") {\n          return handleMcpAppCallTool(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"list-tools\") {\n          return handleMcpAppListTools(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"read-resource\") {\n          return handleMcpAppReadResource(event, manager);\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] Failed to mount MCP routes: ${err?.message ?? err}`,\n    );\n  }\n}\n\nasync function withMcpAppRequestContext<T>(\n  event: H3Event,\n  fn: () => Promise<T>,\n): Promise<T | { error: string }> {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  return runWithRequestContext(\n    {\n      userEmail: email ?? undefined,\n      orgId: orgId ?? undefined,\n    },\n    fn,\n  ) as Promise<T>;\n}\n\nfunction serverHasVisibleTools(\n  manager: McpClientManager,\n  serverId: string,\n): boolean {\n  return manager\n    .getToolsForServer(serverId)\n    .some(\n      (tool) =>\n        isMcpToolAllowedForRequest(tool.name) && isVisibleToMcpApp(tool),\n    );\n}\n\nfunction normalizeSameServerToolName(\n  serverId: string,\n  rawName: unknown,\n): string | null {\n  if (typeof rawName !== \"string\" || !rawName.trim()) return null;\n  const name = rawName.trim();\n  const parsed = parseMcpToolName(name);\n  if (!parsed) return name;\n  if (parsed.serverId !== serverId) return null;\n  return parsed.toolName;\n}\n\nfunction isVisibleToMcpApp(tool: McpTool): boolean {\n  try {\n    return !isToolVisibilityModelOnly(tool.raw as any);\n  } catch {\n    return true;\n  }\n}\n\nfunction mcpToolForClient(tool: McpTool) {\n  return {\n    name: tool.originalName,\n    ...(tool.title ? { title: tool.title } : {}),\n    description: tool.description,\n    inputSchema: tool.inputSchema,\n    ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),\n    ...(tool.annotations ? { annotations: tool.annotations } : {}),\n    ...(tool._meta ? { _meta: tool._meta } : {}),\n  };\n}\n\nfunction mcpAppCallableTool(\n  manager: McpClientManager,\n  serverId: string,\n  originalToolName: string,\n): McpTool | null {\n  const prefixedName = buildMcpToolName(serverId, originalToolName);\n  const tool =\n    manager\n      .getToolsForServer(serverId)\n      .find(\n        (candidate) =>\n          candidate.name === prefixedName ||\n          candidate.originalName === originalToolName,\n      ) ?? null;\n  if (!tool) return null;\n  if (!isMcpToolAllowedForRequest(tool.name) || !isVisibleToMcpApp(tool)) {\n    return null;\n  }\n  return tool;\n}\n\nasync function handleMcpAppCallTool(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    toolName?: unknown;\n    arguments?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const originalToolName = normalizeSameServerToolName(serverId, body.toolName);\n  if (!serverId || !originalToolName) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and same-server toolName are required\" };\n  }\n\n  return withMcpAppRequestContext(event, async () => {\n    const tool = mcpAppCallableTool(manager, serverId, originalToolName);\n    if (!tool) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP tool is not available in this request scope\" };\n    }\n    try {\n      return await manager.callTool(\n        tool.name,\n        body.arguments && typeof body.arguments === \"object\"\n          ? (body.arguments as Record<string, unknown>)\n          : {},\n      );\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP tool call failed\" };\n    }\n  });\n}\n\nasync function handleMcpAppListTools(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  if (!serverId) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId is required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    return {\n      tools: manager\n        .getToolsForServer(serverId)\n        .filter((tool) => isMcpToolAllowedForRequest(tool.name))\n        .filter(isVisibleToMcpApp)\n        .map(mcpToolForClient),\n    };\n  });\n}\n\nasync function handleMcpAppReadResource(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    uri?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const uri = typeof body.uri === \"string\" ? body.uri : \"\";\n  if (!serverId || !uri.startsWith(\"ui://\")) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and ui:// uri are required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    try {\n      return await manager.readResource(serverId, uri);\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP resource read failed\" };\n    }\n  });\n}\n\nasync function handleBuiltinList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  capabilities: ClientBuiltinCapability[];\n  user: { enabledIds: BuiltinMcpCapabilityId[] };\n  org: {\n    enabledIds: BuiltinMcpCapabilityId[];\n    orgId: string | null;\n    role: string | null;\n  };\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const supported = areBuiltinMcpCapabilitiesSupported();\n  const userEnabled =\n    supported && email\n      ? await listEnabledBuiltinMcpCapabilities(\"user\", email)\n      : [];\n  const orgEnabled =\n    supported && orgId\n      ? await listEnabledBuiltinMcpCapabilities(\"org\", orgId)\n      : [];\n\n  return {\n    capabilities: (supported ? BUILTIN_MCP_CAPABILITIES : []).map(\n      (capability) => {\n        const available = isBuiltinMcpCapabilityAvailable(capability);\n        const userMergedId = email\n          ? builtinMergedConfigKey(\"user\", capability, email)\n          : undefined;\n        const orgMergedId = orgId\n          ? builtinMergedConfigKey(\"org\", capability, orgId)\n          : undefined;\n        return {\n          id: capability.id,\n          serverId: capability.serverId,\n          name: capability.name,\n          description: capability.description,\n          command: capability.command,\n          args: capability.args,\n          exclusiveGroup: capability.exclusiveGroup,\n          available,\n          unavailableReason: available\n            ? undefined\n            : `Only available on ${capability.platforms?.join(\", \")}`,\n          notes: capability.notes,\n          enabled: {\n            user: userEnabled.includes(capability.id),\n            org: orgEnabled.includes(capability.id),\n          },\n          mergedIds: {\n            user: userMergedId,\n            org: orgMergedId,\n          },\n          status: {\n            user:\n              userMergedId && userEnabled.includes(capability.id)\n                ? statusFor(manager, userMergedId)\n                : undefined,\n            org:\n              orgMergedId && orgEnabled.includes(capability.id)\n                ? statusFor(manager, orgMergedId)\n                : undefined,\n          },\n        };\n      },\n    ),\n    user: { enabledIds: userEnabled },\n    org: { enabledIds: orgEnabled, orgId, role },\n  };\n}\n\nasync function handleBuiltinUpdate(event: H3Event, manager: McpClientManager) {\n  if (!areBuiltinMcpCapabilitiesSupported()) {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"Built-in local MCP capabilities are only available in local development.\",\n    };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    enabledIds?: unknown;\n    id?: unknown;\n    enabled?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error:\n          \"You must belong to an organization to change org-scope built-ins\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can change org-scope MCP built-ins\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  if (Array.isArray(body.enabledIds)) {\n    for (const rawId of body.enabledIds) {\n      const error = validateBuiltinCapabilityForEnable(String(rawId));\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    }\n    await setEnabledBuiltinMcpCapabilities(\n      scope,\n      scopeId,\n      body.enabledIds.map(String),\n    );\n  } else if (typeof body.id === \"string\" && typeof body.enabled === \"boolean\") {\n    if (body.enabled) {\n      const error = validateBuiltinCapabilityForEnable(body.id);\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    } else if (!getBuiltinMcpCapability(body.id)) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n    const result = await setBuiltinMcpCapabilityEnabled(\n      scope,\n      scopeId,\n      body.id,\n      body.enabled,\n    );\n    if (!result) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n  } else {\n    setResponseStatus(event, 400);\n    return { error: \"Provide enabledIds or id + enabled\" };\n  }\n\n  await reconfigureManager(manager);\n  return handleBuiltinList(event, manager);\n}\n\nfunction validateBuiltinCapabilityForEnable(id: string): string | null {\n  const capability = getBuiltinMcpCapability(id);\n  if (!capability) return `Unknown built-in MCP capability \"${id}\"`;\n  if (!listSupportedBuiltinMcpCapabilities().includes(capability)) {\n    if (!areBuiltinMcpCapabilitiesSupported()) {\n      return \"Built-in local MCP capabilities are only available in local development.\";\n    }\n    return `${capability.name} is only available on ${capability.platforms?.join(\", \")}`;\n  }\n  return null;\n}\n\nasync function handleList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  user: ClientServer[];\n  org: ClientServer[];\n  orgId: string | null;\n  role: string | null;\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const userServers = email ? await listRemoteServers(\"user\", email) : [];\n  const orgServers = orgId ? await listRemoteServers(\"org\", orgId) : [];\n  return {\n    user: userServers.map((s) =>\n      projectForClient(\n        s,\n        \"user\",\n        email ?? \"\",\n        statusFor(manager, mergedConfigKey(\"user\", s, email ?? \"\")),\n      ),\n    ),\n    org: orgServers.map((s) =>\n      projectForClient(\n        s,\n        \"org\",\n        orgId ?? \"\",\n        statusFor(manager, mergedConfigKey(\"org\", s, orgId ?? \"\")),\n      ),\n    ),\n    orgId,\n    role,\n  };\n}\n\nasync function handleAdd(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    name?: unknown;\n    url?: unknown;\n    headers?: unknown;\n    description?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n  const name = typeof body.name === \"string\" ? body.name : \"\";\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  if (!name.trim() || !url.trim()) {\n    setResponseStatus(event, 400);\n    return { error: \"name and url are required\" };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const description =\n    typeof body.description === \"string\" ? body.description : undefined;\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error: \"You must belong to an organization to add an org-scope server\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return { error: \"Only owners and admins can add org-scope MCP servers\" };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const result = await addRemoteServer(scope, scopeId, {\n    name,\n    url,\n    headers,\n    description,\n  });\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { error: result.error };\n  }\n\n  await reconfigureManager(manager);\n  const mergedId = mergedConfigKey(scope, result.server, scopeId);\n  return {\n    ok: true,\n    server: projectForClient(\n      result.server,\n      scope,\n      scopeId,\n      statusFor(manager, mergedId),\n    ),\n  };\n}\n\nasync function handleDelete(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (parsedScope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"No active organization\" };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can remove org-scope MCP servers\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const removed = await removeRemoteServer(parsedScope, scopeId, id);\n  if (!removed) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  await reconfigureManager(manager);\n  return { ok: true };\n}\n\nasync function handleTestUrl(event: H3Event) {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email && !orgId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    url?: unknown;\n    headers?: unknown;\n  };\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  const check = validateRemoteUrl(url);\n  if (!check.ok) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: check.error };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const result = await tryConnect(check.url!.toString(), headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function handleTestExisting(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId } = await resolveContextForRequest(event);\n  const scopeId = parsedScope === \"user\" ? email : orgId;\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  const list = await listRemoteServers(parsedScope, scopeId);\n  const server = list.find((s) => s.id === id);\n  if (!server) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  const result = await tryConnect(server.url, server.headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function tryConnect(\n  url: string,\n  headers?: Record<string, string>,\n): Promise<\n  | { ok: true; toolCount: number; tools: string[] }\n  | { ok: false; error: string }\n> {\n  try {\n    const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([\n      import(\"@modelcontextprotocol/sdk/client/index.js\"),\n      import(\"@modelcontextprotocol/sdk/client/streamableHttp.js\"),\n    ]);\n    const requestInit: Record<string, unknown> = {};\n    if (headers && Object.keys(headers).length > 0) {\n      requestInit.headers = headers;\n    }\n    const transport = new StreamableHTTPClientTransport(new URL(url), {\n      requestInit,\n    });\n    const client = new Client(\n      { name: \"agent-native-mcp-client-test\", version: \"1.0.0\" },\n      { capabilities: {} },\n    );\n    try {\n      await client.connect(transport);\n      const listed = await client.listTools();\n      const names = ((listed?.tools ?? []) as Array<{ name: string }>).map(\n        (t) => t.name,\n      );\n      return { ok: true, toolCount: names.length, tools: names };\n    } finally {\n      try {\n        await client.close();\n      } catch {}\n      try {\n        await transport.close();\n      } catch {}\n    }\n  } catch (err: any) {\n    return { ok: false, error: formatMcpConnectError(err) };\n  }\n}\n\nfunction normalizeHeaders(input: unknown): Record<string, string> | undefined {\n  if (!input || typeof input !== \"object\") return undefined;\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input as Record<string, unknown>)) {\n    if (typeof k !== \"string\" || !k.trim()) continue;\n    if (typeof v !== \"string\") continue;\n    out[k.trim()] = v;\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n"]}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,EACnC,gCAAgC,EAChC,wBAAwB,GAGzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,sEAAsE;AACtE,SAAS,aAAa,CACpB,OAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA6B,EAC7B,KAAqB,EACrB,OAAe,EACf,MAAoB;IAEpB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;QACjD,MAAM;KACP,CAAC;AACJ,CAAC;AAoCD,SAAS,SAAS,CAAC,OAAyB,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAgC;IAEhC,OAAO;QACL,EAAE,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC9B,IAAI,EAAE,UAAU,CAAC,QAAQ;QACzB,GAAG,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAqB,EACrB,UAAgC,EAChC,OAAe;IAEf,OAAO,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAoC,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,CAAC;YACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACjC,MAAM,IAAI,GAAI,KAA+C,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,SAAS;YACxE,oEAAoE;YACpE,gEAAgE;YAChE,sEAAsE;YACtE,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,kCAAkC,EAAE,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,iCAAiC,EAAE,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxE,IAAI,KAAK,GAA0B,IAAI,CAAC;YACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,GAAG,MAAM,CAAC;gBACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,KAAK,GAAG,KAAK,CAAC;gBACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBAAE,SAAS;YACjC,MAAM,UAAU,GAAG,gCAAgC,CACjD,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,UAAU,CAAC;gBACtC,CAAC,CAAE,KAAa,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBACvC,CAAC,CAAC,EAAE,CACP,CAAC;YACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;gBAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChE,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;oBACzD,wBAAwB,CAAC,UAAU,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,qDAAqD,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CAC1G,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,kCAAkC,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAwB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;IAC3D,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAyB;IAEzB,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAChD,IAAI,UAAU,IAAI,CAAC,IAAI,OAAO,WAAW,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAEtE,IAAI,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAClE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,UAAU;YAAE,OAAO;QACvB,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;gBACvC,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAChC,gBAAgB,GAAG,aAAa,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,uCAAuC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC7D,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5C,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAAc;IAKpD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAClB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAChB,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAyB;IACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,OAAyB;IAEzB,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,kCAAkC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAChE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAE7D,+DAA+D;YAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACnE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,qBAAqB;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC9C,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/D,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAClE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBACnD,OAAO,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;gBACpD,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;gBACvD,OAAO,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,4CAA4C,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,EAAoB;IAEpB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,qBAAqB,CAC1B;QACE,SAAS,EAAE,KAAK,IAAI,SAAS;QAC7B,KAAK,EAAE,KAAK,IAAI,SAAS;KAC1B,EACD,EAAE,CACW,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAyB,EACzB,QAAgB;IAEhB,OAAO,OAAO;SACX,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CACnE,CAAC;AACN,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAgB,EAChB,OAAgB;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,YAAY;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAyB,EACzB,QAAgB,EAChB,gBAAwB;IAExB,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAClE,MAAM,IAAI,GACR,OAAO;SACJ,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,YAAY,KAAK,gBAAgB,CAC9C,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAc,EAAE,OAAyB;IAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAIpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,QAAQ,CAC3B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClD,CAAC,CAAE,IAAI,CAAC,SAAqC;gBAC7C,CAAC,CAAC,EAAE,CACP,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,OAAO;YACL,KAAK,EAAE,OAAO;iBACX,iBAAiB,CAAC,QAAQ,CAAC;iBAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACvD,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,gBAAgB,CAAC;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,0BAA0B,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,OAAyB;IAUzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,kCAAkC,EAAE,CAAC;IACvD,MAAM,WAAW,GACf,SAAS,IAAI,KAAK;QAChB,CAAC,CAAC,MAAM,iCAAiC,CAAC,MAAM,EAAE,KAAK,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GACd,SAAS,IAAI,KAAK;QAChB,CAAC,CAAC,MAAM,iCAAiC,CAAC,KAAK,EAAE,KAAK,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,YAAY,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAC3D,CAAC,UAAU,EAAE,EAAE;YACb,MAAM,SAAS,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAG,KAAK;gBACxB,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;gBACnD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,WAAW,GAAG,KAAK;gBACvB,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;gBAClD,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,SAAS;gBACT,iBAAiB,EAAE,SAAS;oBAC1B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,qBAAqB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3D,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;iBACxC;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,YAAY;oBAClB,GAAG,EAAE,WAAW;iBACjB;gBACD,MAAM,EAAE;oBACN,IAAI,EACF,YAAY,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACjD,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;wBAClC,CAAC,CAAC,SAAS;oBACf,GAAG,EACD,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC/C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;wBACjC,CAAC,CAAC,SAAS;iBAChB;aACF,CAAC;QACJ,CAAC,CACF;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;QACjC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,KAAc,EAAE,OAAyB;IAC1E,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,kEAAkE;aACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,2DAA2D;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,kCAAkC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,gCAAgC,CACpC,KAAK,EACL,OAAO,EACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAC5B,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,KAAK,EACL,OAAO,EACP,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,OAAO,CACb,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kCAAkC,CAAC,EAAU;IACpD,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,oCAAoC,EAAE,GAAG,CAAC;IAClE,IAAI,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;YAC1C,OAAO,0EAA0E,CAAC;QACpF,CAAC;QACD,OAAO,GAAG,UAAU,CAAC,IAAI,yBAAyB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAAc,EACd,OAAyB;IAOzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,gBAAgB,CACd,CAAC,EACD,MAAM,EACN,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC5D,CACF;QACD,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxB,gBAAgB,CACd,CAAC,EACD,KAAK,EACL,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC3D,CACF;QACD,KAAK;QACL,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAc,EAAE,OAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAMpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+DAA+D;aACvE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE;QACnD,IAAI;QACJ,GAAG;QACH,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,gBAAgB,CACtB,MAAM,CAAC,MAAM,EACb,KAAK,EACL,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,yDAAyD;aACjE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,OAAgC;IAKhC,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,6BAA6B,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxE,MAAM,CAAC,2CAA2C,CAAC;YACnD,MAAM,CAAC,oDAAoD,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YAChE,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1D,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAA6B,CAAC,GAAG,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC","sourcesContent":["/**\n * HTTP routes for user- and org-scope remote MCP server management.\n *\n * Mounted under `/_agent-native/mcp/servers` by `agent-chat-plugin` —\n * requires a reference to the running `McpClientManager` so mutations can\n * hot-reload the configured server set.\n *\n *   GET    /_agent-native/mcp/servers           list user + org servers\n *   POST   /_agent-native/mcp/servers           add a server\n *   DELETE /_agent-native/mcp/servers/:id       remove a server (scope via ?scope=)\n *   POST   /_agent-native/mcp/servers/:id/test  dry-run connect (no persist)\n *   POST   /_agent-native/mcp/servers/test      dry-run a URL before persisting\n *   GET    /_agent-native/mcp/builtin           list built-in capability toggles\n *   POST   /_agent-native/mcp/builtin           update built-in capability toggles\n *   POST   /_agent-native/mcp/apps/call-tool    mediated same-server app tool call\n *   POST   /_agent-native/mcp/apps/list-tools   list tools visible to an app iframe\n *   POST   /_agent-native/mcp/apps/read-resource read a ui:// app resource\n */\n\nimport {\n  defineEventHandler,\n  getMethod,\n  getQuery,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport { getAllSettings } from \"../settings/store.js\";\nimport {\n  buildMcpToolName,\n  parseMcpToolName,\n  type McpClientManager,\n  type McpTool,\n} from \"./manager.js\";\nimport type { McpConfig, McpServerConfig } from \"./config.js\";\nimport { loadMcpConfig, autoDetectMcpConfig } from \"./config.js\";\nimport { formatMcpConnectError } from \"./errors.js\";\nimport {\n  areBuiltinMcpCapabilitiesSupported,\n  BUILTIN_MCP_CAPABILITIES,\n  getBuiltinMcpCapability,\n  isBuiltinMcpCapabilityAvailable,\n  listSupportedBuiltinMcpCapabilities,\n  normalizeBuiltinMcpCapabilityIds,\n  toBuiltinMcpServerConfig,\n  type BuiltinMcpCapability,\n  type BuiltinMcpCapabilityId,\n} from \"./builtin-capabilities.js\";\nimport {\n  builtinMcpCapabilitiesSettingsKey,\n  listEnabledBuiltinMcpCapabilities,\n  setBuiltinMcpCapabilityEnabled,\n  setEnabledBuiltinMcpCapabilities,\n} from \"./builtin-store.js\";\nimport {\n  addRemoteServer,\n  listRemoteServers,\n  mergedConfigKey,\n  removeRemoteServer,\n  toHttpServerConfigAsync,\n  validateRemoteUrl,\n  type RemoteMcpScope,\n  type StoredRemoteMcpServer,\n} from \"./remote-store.js\";\nimport { fetchHubServers } from \"./hub-client.js\";\nimport { loadWorkspaceMcpServers } from \"./workspace-servers.js\";\nimport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nimport { isToolVisibilityModelOnly } from \"@modelcontextprotocol/ext-apps/app-bridge\";\n\nexport { formatMcpConnectError } from \"./errors.js\";\n\n/** Redact obvious auth header values before sending to the client. */\nfunction redactHeaders(\n  headers?: Record<string, string>,\n): Record<string, { set: true }> | undefined {\n  if (!headers) return undefined;\n  const out: Record<string, { set: true }> = {};\n  for (const k of Object.keys(headers)) out[k] = { set: true };\n  return out;\n}\n\nfunction projectForClient(\n  stored: StoredRemoteMcpServer,\n  scope: RemoteMcpScope,\n  ownerId: string,\n  status: ServerStatus,\n): ClientServer {\n  return {\n    id: stored.id,\n    scope,\n    name: stored.name,\n    url: stored.url,\n    headers: redactHeaders(stored.headers),\n    description: stored.description,\n    createdAt: stored.createdAt,\n    mergedId: mergedConfigKey(scope, stored, ownerId),\n    status,\n  };\n}\n\nexport interface ClientServer {\n  id: string;\n  scope: RemoteMcpScope;\n  name: string;\n  url: string;\n  headers?: Record<string, { set: true }>;\n  description?: string;\n  createdAt: number;\n  /** The key under which this server is registered in the running MCP manager. */\n  mergedId: string;\n  status: ServerStatus;\n}\n\nexport interface ClientBuiltinCapability {\n  id: BuiltinMcpCapabilityId;\n  serverId: string;\n  name: string;\n  description: string;\n  command: string;\n  args: string[];\n  exclusiveGroup?: string;\n  available: boolean;\n  unavailableReason?: string;\n  notes?: string;\n  enabled: { user: boolean; org: boolean };\n  mergedIds: { user?: string; org?: string };\n  status: { user?: ServerStatus; org?: ServerStatus };\n}\n\ntype ServerStatus =\n  | { state: \"connected\"; toolCount: number }\n  | { state: \"error\"; error: string }\n  | { state: \"unknown\" };\n\nfunction statusFor(manager: McpClientManager, mergedId: string): ServerStatus {\n  const snap = manager.getStatus();\n  if (snap.connectedServers.includes(mergedId)) {\n    const toolCount = snap.tools.filter((t) => t.source === mergedId).length;\n    return { state: \"connected\", toolCount };\n  }\n  if (snap.errors[mergedId]) {\n    return { state: \"error\", error: snap.errors[mergedId] };\n  }\n  if (snap.configuredServers.includes(mergedId)) {\n    return { state: \"unknown\" };\n  }\n  return { state: \"unknown\" };\n}\n\nfunction pseudoStoredBuiltin(\n  capability: BuiltinMcpCapability,\n): StoredRemoteMcpServer {\n  return {\n    id: `builtin_${capability.id}`,\n    name: capability.serverId,\n    url: `builtin:${capability.id}`,\n    description: capability.description,\n    createdAt: 0,\n  };\n}\n\nexport function builtinMergedConfigKey(\n  scope: RemoteMcpScope,\n  capability: BuiltinMcpCapability,\n  ownerId: string,\n): string {\n  return mergedConfigKey(scope, pseudoStoredBuiltin(capability), ownerId);\n}\n\n/**\n * Build the merged MCP config the manager should run with: file/env config\n * plus **every** user-scope and org-scope remote server persisted in the\n * settings store. Scanning all scopes means a mutation from one user's\n * session never drops another user's servers from the running manager.\n *\n * Each persisted server's merged key includes its owner discriminator\n * (`user_<emailhash>_<name>` or `org_<orgId>_<name>`) so two users' servers\n * with the same name coexist; the request-time gate in\n * `isMcpToolAllowedForRequest` then scopes tool visibility back down to the\n * calling user.\n */\nexport async function buildMergedConfig(): Promise<McpConfig | null> {\n  const base = loadMcpConfig() ?? autoDetectMcpConfig();\n  const servers: Record<string, McpServerConfig> = { ...(base?.servers ?? {}) };\n\n  const all = await getAllSettings().catch(() => ({}));\n  for (const [fullKey, value] of Object.entries(all)) {\n    const userMatch = /^u:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    const orgMatch = /^o:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    let scope: RemoteMcpScope | null = null;\n    let ownerId: string | null = null;\n    if (userMatch) {\n      scope = \"user\";\n      ownerId = userMatch[1];\n    } else if (orgMatch) {\n      scope = \"org\";\n      ownerId = orgMatch[1];\n    }\n    if (!scope || !ownerId) continue;\n    const list = (value as { servers?: StoredRemoteMcpServer[] }).servers;\n    if (!Array.isArray(list)) continue;\n    for (const stored of list) {\n      if (!stored || typeof stored.url !== \"string\" || !stored.name) continue;\n      // Async resolve: decrypts `headerSecretKey` from app_secrets so the\n      // running MCP client gets the cleartext bearer at request time.\n      // Stored row contains only the secret-key reference, never the value.\n      servers[mergedConfigKey(scope, stored, ownerId)] =\n        await toHttpServerConfigAsync(scope, ownerId, stored);\n    }\n  }\n  if (areBuiltinMcpCapabilitiesSupported()) {\n    for (const [fullKey, value] of Object.entries(all)) {\n      const settingsKey = builtinMcpCapabilitiesSettingsKey();\n      const userMatch = new RegExp(`^u:([^:]+):${settingsKey}$`).exec(fullKey);\n      const orgMatch = new RegExp(`^o:([^:]+):${settingsKey}$`).exec(fullKey);\n      let scope: RemoteMcpScope | null = null;\n      let ownerId: string | null = null;\n      if (userMatch) {\n        scope = \"user\";\n        ownerId = userMatch[1];\n      } else if (orgMatch) {\n        scope = \"org\";\n        ownerId = orgMatch[1];\n      }\n      if (!scope || !ownerId) continue;\n      const enabledIds = normalizeBuiltinMcpCapabilityIds(\n        Array.isArray((value as any).enabledIds)\n          ? (value as any).enabledIds.map(String)\n          : [],\n      );\n      for (const id of enabledIds) {\n        const capability = getBuiltinMcpCapability(id);\n        if (!capability || !isBuiltinMcpCapabilityAvailable(capability)) {\n          continue;\n        }\n        servers[builtinMergedConfigKey(scope, capability, ownerId)] =\n          toBuiltinMcpServerConfig(capability);\n      }\n    }\n  }\n\n  try {\n    const workspaceServers = await loadWorkspaceMcpServers();\n    for (const [mergedKey, cfg] of Object.entries(workspaceServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] workspace MCP resource merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  // Hub-consume: if this app is configured to consume from a remote hub\n  // (AGENT_NATIVE_MCP_HUB_URL + AGENT_NATIVE_MCP_HUB_TOKEN), pull its\n  // org-scope servers and merge. Hub entries use `hub_<orgId>_<name>` so\n  // they never collide with local `org_<orgId>_<name>` rows.\n  try {\n    const hubServers = await fetchHubServers();\n    for (const [mergedKey, cfg] of Object.entries(hubServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] hub merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  if (Object.keys(servers).length === 0) return null;\n  return { servers, source: base?.source ?? \"merged\" };\n}\n\nfunction sortedConfigSignature(config: McpConfig | null): string {\n  const entries = Object.entries(config?.servers ?? {}).sort(([a], [b]) =>\n    a.localeCompare(b),\n  );\n  return JSON.stringify(entries);\n}\n\nfunction mcpConfigRefreshIntervalMs(): number {\n  const raw = process.env.AGENT_NATIVE_MCP_CONFIG_REFRESH_MS;\n  if (raw?.trim() === \"0\") return 0;\n  const parsed = raw ? Number(raw) : NaN;\n  if (Number.isFinite(parsed) && parsed >= 5_000) return parsed;\n  return 60_000;\n}\n\nexport function startMcpConfigRefresh(\n  manager: McpClientManager,\n): (() => void) | null {\n  const intervalMs = mcpConfigRefreshIntervalMs();\n  if (intervalMs <= 0 || typeof setInterval !== \"function\") return null;\n\n  let currentSignature = sortedConfigSignature(manager.getConfig());\n  let refreshing = false;\n  const refresh = async () => {\n    if (refreshing) return;\n    refreshing = true;\n    try {\n      const next = await buildMergedConfig();\n      const nextSignature = sortedConfigSignature(next);\n      if (nextSignature !== currentSignature) {\n        await manager.reconfigure(next);\n        currentSignature = nextSignature;\n      }\n    } catch (err: any) {\n      console.warn(\n        `[mcp-client] config refresh failed: ${err?.message ?? err}`,\n      );\n    } finally {\n      refreshing = false;\n    }\n  };\n\n  const timer = setInterval(refresh, intervalMs);\n  (timer as { unref?: () => void }).unref?.();\n  return () => clearInterval(timer);\n}\n\nasync function resolveContextForRequest(event: H3Event): Promise<{\n  email: string | null;\n  orgId: string | null;\n  role: string | null;\n}> {\n  let email: string | null = null;\n  try {\n    const session = await getSession(event);\n    email = session?.email ?? null;\n  } catch {\n    email = null;\n  }\n  let orgId: string | null = null;\n  let role: string | null = null;\n  try {\n    const ctx = await getOrgContext(event);\n    orgId = ctx.orgId;\n    role = ctx.role;\n    if (!email) email = ctx.email;\n  } catch {\n    // ignore — no org context\n  }\n  // No silent `local@localhost` fallback — if `getSession` returns nothing in\n  // production (misconfigured deploy, expired token), the caller must reject\n  // rather than silently pool every unauthenticated request under one identity.\n  return { email, orgId, role };\n}\n\nasync function reconfigureManager(manager: McpClientManager): Promise<void> {\n  const merged = await buildMergedConfig();\n  await manager.reconfigure(merged);\n}\n\nexport function mountMcpServersRoutes(\n  nitroApp: any,\n  manager: McpClientManager,\n): void {\n  const mountedApps: WeakSet<object> = ((\n    globalThis as any\n  ).__agentNativeMcpServersMountedApps ??= new WeakSet<object>());\n  if (mountedApps.has(nitroApp)) return;\n  mountedApps.add(nitroApp);\n\n  try {\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/servers\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n\n        // POST /servers/test — dry-run a URL+headers before persisting\n        if (method === \"POST\" && parts.length === 1 && parts[0] === \"test\") {\n          return handleTestUrl(event);\n        }\n\n        // Collection root\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleList(event, manager);\n          if (method === \"POST\") return handleAdd(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        // /:id  /  /:id/test\n        if (parts.length === 1 || parts.length === 2) {\n          const id = parts[0];\n          if (parts.length === 2 && parts[1] === \"test\" && method === \"POST\") {\n            return handleTestExisting(event, manager, id);\n          }\n          if (parts.length === 1 && method === \"DELETE\") {\n            return handleDelete(event, manager, id);\n          }\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/builtin\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleBuiltinList(event, manager);\n          if (method === \"POST\") return handleBuiltinUpdate(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/apps\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (method !== \"POST\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        if (parts.length === 1 && parts[0] === \"call-tool\") {\n          return handleMcpAppCallTool(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"list-tools\") {\n          return handleMcpAppListTools(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"read-resource\") {\n          return handleMcpAppReadResource(event, manager);\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] Failed to mount MCP routes: ${err?.message ?? err}`,\n    );\n  }\n}\n\nasync function withMcpAppRequestContext<T>(\n  event: H3Event,\n  fn: () => Promise<T>,\n): Promise<T | { error: string }> {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  return runWithRequestContext(\n    {\n      userEmail: email ?? undefined,\n      orgId: orgId ?? undefined,\n    },\n    fn,\n  ) as Promise<T>;\n}\n\nfunction serverHasVisibleTools(\n  manager: McpClientManager,\n  serverId: string,\n): boolean {\n  return manager\n    .getToolsForServer(serverId)\n    .some(\n      (tool) =>\n        isMcpToolAllowedForRequest(tool.name) && isVisibleToMcpApp(tool),\n    );\n}\n\nfunction normalizeSameServerToolName(\n  serverId: string,\n  rawName: unknown,\n): string | null {\n  if (typeof rawName !== \"string\" || !rawName.trim()) return null;\n  const name = rawName.trim();\n  const parsed = parseMcpToolName(name);\n  if (!parsed) return name;\n  if (parsed.serverId !== serverId) return null;\n  return parsed.toolName;\n}\n\nfunction isVisibleToMcpApp(tool: McpTool): boolean {\n  try {\n    return !isToolVisibilityModelOnly(tool.raw as any);\n  } catch {\n    return true;\n  }\n}\n\nfunction mcpToolForClient(tool: McpTool) {\n  return {\n    name: tool.originalName,\n    ...(tool.title ? { title: tool.title } : {}),\n    description: tool.description,\n    inputSchema: tool.inputSchema,\n    ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),\n    ...(tool.annotations ? { annotations: tool.annotations } : {}),\n    ...(tool._meta ? { _meta: tool._meta } : {}),\n  };\n}\n\nfunction mcpAppCallableTool(\n  manager: McpClientManager,\n  serverId: string,\n  originalToolName: string,\n): McpTool | null {\n  const prefixedName = buildMcpToolName(serverId, originalToolName);\n  const tool =\n    manager\n      .getToolsForServer(serverId)\n      .find(\n        (candidate) =>\n          candidate.name === prefixedName ||\n          candidate.originalName === originalToolName,\n      ) ?? null;\n  if (!tool) return null;\n  if (!isMcpToolAllowedForRequest(tool.name) || !isVisibleToMcpApp(tool)) {\n    return null;\n  }\n  return tool;\n}\n\nasync function handleMcpAppCallTool(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    toolName?: unknown;\n    arguments?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const originalToolName = normalizeSameServerToolName(serverId, body.toolName);\n  if (!serverId || !originalToolName) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and same-server toolName are required\" };\n  }\n\n  return withMcpAppRequestContext(event, async () => {\n    const tool = mcpAppCallableTool(manager, serverId, originalToolName);\n    if (!tool) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP tool is not available in this request scope\" };\n    }\n    try {\n      return await manager.callTool(\n        tool.name,\n        body.arguments && typeof body.arguments === \"object\"\n          ? (body.arguments as Record<string, unknown>)\n          : {},\n      );\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP tool call failed\" };\n    }\n  });\n}\n\nasync function handleMcpAppListTools(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  if (!serverId) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId is required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    return {\n      tools: manager\n        .getToolsForServer(serverId)\n        .filter((tool) => isMcpToolAllowedForRequest(tool.name))\n        .filter(isVisibleToMcpApp)\n        .map(mcpToolForClient),\n    };\n  });\n}\n\nasync function handleMcpAppReadResource(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    uri?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const uri = typeof body.uri === \"string\" ? body.uri : \"\";\n  if (!serverId || !uri.startsWith(\"ui://\")) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and ui:// uri are required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    try {\n      return await manager.readResource(serverId, uri);\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP resource read failed\" };\n    }\n  });\n}\n\nasync function handleBuiltinList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  capabilities: ClientBuiltinCapability[];\n  user: { enabledIds: BuiltinMcpCapabilityId[] };\n  org: {\n    enabledIds: BuiltinMcpCapabilityId[];\n    orgId: string | null;\n    role: string | null;\n  };\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const supported = areBuiltinMcpCapabilitiesSupported();\n  const userEnabled =\n    supported && email\n      ? await listEnabledBuiltinMcpCapabilities(\"user\", email)\n      : [];\n  const orgEnabled =\n    supported && orgId\n      ? await listEnabledBuiltinMcpCapabilities(\"org\", orgId)\n      : [];\n\n  return {\n    capabilities: (supported ? BUILTIN_MCP_CAPABILITIES : []).map(\n      (capability) => {\n        const available = isBuiltinMcpCapabilityAvailable(capability);\n        const userMergedId = email\n          ? builtinMergedConfigKey(\"user\", capability, email)\n          : undefined;\n        const orgMergedId = orgId\n          ? builtinMergedConfigKey(\"org\", capability, orgId)\n          : undefined;\n        return {\n          id: capability.id,\n          serverId: capability.serverId,\n          name: capability.name,\n          description: capability.description,\n          command: capability.command,\n          args: capability.args,\n          exclusiveGroup: capability.exclusiveGroup,\n          available,\n          unavailableReason: available\n            ? undefined\n            : `Only available on ${capability.platforms?.join(\", \")}`,\n          notes: capability.notes,\n          enabled: {\n            user: userEnabled.includes(capability.id),\n            org: orgEnabled.includes(capability.id),\n          },\n          mergedIds: {\n            user: userMergedId,\n            org: orgMergedId,\n          },\n          status: {\n            user:\n              userMergedId && userEnabled.includes(capability.id)\n                ? statusFor(manager, userMergedId)\n                : undefined,\n            org:\n              orgMergedId && orgEnabled.includes(capability.id)\n                ? statusFor(manager, orgMergedId)\n                : undefined,\n          },\n        };\n      },\n    ),\n    user: { enabledIds: userEnabled },\n    org: { enabledIds: orgEnabled, orgId, role },\n  };\n}\n\nasync function handleBuiltinUpdate(event: H3Event, manager: McpClientManager) {\n  if (!areBuiltinMcpCapabilitiesSupported()) {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"Built-in local MCP capabilities are only available in local development.\",\n    };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    enabledIds?: unknown;\n    id?: unknown;\n    enabled?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error:\n          \"You must belong to an organization to change org-scope built-ins\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can change org-scope MCP built-ins\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  if (Array.isArray(body.enabledIds)) {\n    for (const rawId of body.enabledIds) {\n      const error = validateBuiltinCapabilityForEnable(String(rawId));\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    }\n    await setEnabledBuiltinMcpCapabilities(\n      scope,\n      scopeId,\n      body.enabledIds.map(String),\n    );\n  } else if (typeof body.id === \"string\" && typeof body.enabled === \"boolean\") {\n    if (body.enabled) {\n      const error = validateBuiltinCapabilityForEnable(body.id);\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    } else if (!getBuiltinMcpCapability(body.id)) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n    const result = await setBuiltinMcpCapabilityEnabled(\n      scope,\n      scopeId,\n      body.id,\n      body.enabled,\n    );\n    if (!result) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n  } else {\n    setResponseStatus(event, 400);\n    return { error: \"Provide enabledIds or id + enabled\" };\n  }\n\n  await reconfigureManager(manager);\n  return handleBuiltinList(event, manager);\n}\n\nfunction validateBuiltinCapabilityForEnable(id: string): string | null {\n  const capability = getBuiltinMcpCapability(id);\n  if (!capability) return `Unknown built-in MCP capability \"${id}\"`;\n  if (!listSupportedBuiltinMcpCapabilities().includes(capability)) {\n    if (!areBuiltinMcpCapabilitiesSupported()) {\n      return \"Built-in local MCP capabilities are only available in local development.\";\n    }\n    return `${capability.name} is only available on ${capability.platforms?.join(\", \")}`;\n  }\n  return null;\n}\n\nasync function handleList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  user: ClientServer[];\n  org: ClientServer[];\n  orgId: string | null;\n  role: string | null;\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const userServers = email ? await listRemoteServers(\"user\", email) : [];\n  const orgServers = orgId ? await listRemoteServers(\"org\", orgId) : [];\n  return {\n    user: userServers.map((s) =>\n      projectForClient(\n        s,\n        \"user\",\n        email ?? \"\",\n        statusFor(manager, mergedConfigKey(\"user\", s, email ?? \"\")),\n      ),\n    ),\n    org: orgServers.map((s) =>\n      projectForClient(\n        s,\n        \"org\",\n        orgId ?? \"\",\n        statusFor(manager, mergedConfigKey(\"org\", s, orgId ?? \"\")),\n      ),\n    ),\n    orgId,\n    role,\n  };\n}\n\nasync function handleAdd(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    name?: unknown;\n    url?: unknown;\n    headers?: unknown;\n    description?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n  const name = typeof body.name === \"string\" ? body.name : \"\";\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  if (!name.trim() || !url.trim()) {\n    setResponseStatus(event, 400);\n    return { error: \"name and url are required\" };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const description =\n    typeof body.description === \"string\" ? body.description : undefined;\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error: \"You must belong to an organization to add an org-scope server\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return { error: \"Only owners and admins can add org-scope MCP servers\" };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const result = await addRemoteServer(scope, scopeId, {\n    name,\n    url,\n    headers,\n    description,\n  });\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { error: result.error };\n  }\n\n  await reconfigureManager(manager);\n  const mergedId = mergedConfigKey(scope, result.server, scopeId);\n  return {\n    ok: true,\n    server: projectForClient(\n      result.server,\n      scope,\n      scopeId,\n      statusFor(manager, mergedId),\n    ),\n  };\n}\n\nasync function handleDelete(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (parsedScope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"No active organization\" };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can remove org-scope MCP servers\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const removed = await removeRemoteServer(parsedScope, scopeId, id);\n  if (!removed) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  await reconfigureManager(manager);\n  return { ok: true };\n}\n\nasync function handleTestUrl(event: H3Event) {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email && !orgId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    url?: unknown;\n    headers?: unknown;\n  };\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  const check = validateRemoteUrl(url);\n  if (!check.ok) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: check.error };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const result = await tryConnect(check.url!.toString(), headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function handleTestExisting(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId } = await resolveContextForRequest(event);\n  const scopeId = parsedScope === \"user\" ? email : orgId;\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  const list = await listRemoteServers(parsedScope, scopeId);\n  const server = list.find((s) => s.id === id);\n  if (!server) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  // `server.headers` holds only the cleartext (non-secret) subset; auth headers\n  // (Authorization, API keys) live encrypted in app_secrets and are resolved by\n  // toHttpServerConfigAsync. Testing with cleartext-only headers would fail for\n  // any server that uses encrypted credentials.\n  const config = await toHttpServerConfigAsync(parsedScope, scopeId, server);\n  const result = await tryConnect(server.url, config.headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function tryConnect(\n  url: string,\n  headers?: Record<string, string>,\n): Promise<\n  | { ok: true; toolCount: number; tools: string[] }\n  | { ok: false; error: string }\n> {\n  try {\n    const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([\n      import(\"@modelcontextprotocol/sdk/client/index.js\"),\n      import(\"@modelcontextprotocol/sdk/client/streamableHttp.js\"),\n    ]);\n    const requestInit: Record<string, unknown> = {};\n    if (headers && Object.keys(headers).length > 0) {\n      requestInit.headers = headers;\n    }\n    const transport = new StreamableHTTPClientTransport(new URL(url), {\n      requestInit,\n    });\n    const client = new Client(\n      { name: \"agent-native-mcp-client-test\", version: \"1.0.0\" },\n      { capabilities: {} },\n    );\n    try {\n      await client.connect(transport);\n      const listed = await client.listTools();\n      const names = ((listed?.tools ?? []) as Array<{ name: string }>).map(\n        (t) => t.name,\n      );\n      return { ok: true, toolCount: names.length, tools: names };\n    } finally {\n      try {\n        await client.close();\n      } catch {}\n      try {\n        await transport.close();\n      } catch {}\n    }\n  } catch (err: any) {\n    return { ok: false, error: formatMcpConnectError(err) };\n  }\n}\n\nfunction normalizeHeaders(input: unknown): Record<string, string> | undefined {\n  if (!input || typeof input !== \"object\") return undefined;\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input as Record<string, unknown>)) {\n    if (typeof k !== \"string\" || !k.trim()) continue;\n    if (typeof v !== \"string\") continue;\n    out[k.trim()] = v;\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n"]}

package/dist/oauth-tokens/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/oauth-tokens/store.ts"],"names":[],"mappings":"AA8CA,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAUzC;AAED;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAC1D,QAAQ,CAAC,UAAU,OAAO;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBACpB,IAAI,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;KACxB;CAUF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CA4Df;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAChE,KAAK,CAAC;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC,CACH,CAaA;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CACR,KAAK,CAAC;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC,CACH,CAaA;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CASlB"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/oauth-tokens/store.ts"],"names":[],"mappings":"AAkDA,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAUzC;AAED;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAC1D,QAAQ,CAAC,UAAU,OAAO;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBACpB,IAAI,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;KACxB;CAUF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CA4Df;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAChE,KAAK,CAAC;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC,CACH,CAaA;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CACR,KAAK,CAAC;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC,CACH,CAaA;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CASlB"}

package/dist/oauth-tokens/store.js

@@ -34,7 +34,11 @@ async function ensureTable() {
             }
             // Backfill: set owner = account_id for existing rows without an owner
             await client.execute(`UPDATE ${table} SET owner = account_id WHERE owner IS NULL`);
-        })();
+        })().catch((err) => {
+            // Retry init on the next call after a failed startup.
+            _initPromise = undefined;
+            throw err;
+        });
     }
     return _initPromise;
 }