@agent-native/core 0.40.2 → 0.41.1

package/dist/extensions/routes.js

@@ -5,7 +5,7 @@ import { getSession } from "../server/auth.js";
 import { runWithRequestContext, getRequestOrgId, } from "../server/request-context.js";
 import { getOrgContext } from "../org/context.js";
 import { getDbExec, isPostgres } from "../db/client.js";
-import { listExtensions, getExtension, getExtensionHistoryVersion, listExtensionHistory, createExtension, updateExtension, updateExtensionContent, restoreExtensionHistoryVersion, deleteExtension, hideExtension, unhideExtension, ensureExtensionsTables, } from "./store.js";
+import { listExtensions, getExtension, getExtensionHistoryVersion, listExtensionHistory, createExtension, updateExtension, updateExtensionContent, restoreExtensionHistoryVersion, deleteExtension, hideExtension, unhideExtension, globalHideExtension, globalUnhideExtension, ensureExtensionsTables, } from "./store.js";
 import { buildExtensionHtml, EXTENSION_IFRAME_CSP } from "./html-shell.js";
 import { getThemeVars } from "./theme.js";
 import { resolveKeyReferencesWithRequestScopes, validateUrlAllowlist, getResolvedKeyAllowlist, } from "../secrets/substitution.js";
@@ -82,9 +82,11 @@ async function dispatch(event, method, parts, userEmail) {
     if (method === "POST" && parts.length === 1 && parts[0] === "proxy") {
         return handleProxy(event, userEmail);
     }
-    // GET / — list
+    // GET / — list. `?includeGloballyHidden=true` surfaces extensions an
+    // admin/owner has globally hidden (so they can be unhidden for everyone).
     if (method === "GET" && parts.length === 0) {
-        const rows = await listExtensions();
+        const includeGloballyHidden = event.url?.searchParams?.get("includeGloballyHidden") === "true";
+        const rows = await listExtensions({ includeGloballyHidden });
         return Promise.all(rows.map((row) => extensionResponse(row)));
     }
     // POST / — create
@@ -190,6 +192,24 @@ async function dispatch(event, method, parts, userEmail) {
         }
         return { ok: true, hidden: false };
     }
+    // POST /:id/global-hide — admin/owner hides the extension from EVERYONE.
+    if (method === "POST" && parts.length === 2 && parts[1] === "global-hide") {
+        const ok = await globalHideExtension(parts[0]);
+        if (!ok) {
+            setResponseStatus(event, 404);
+            return { error: "Extension not found" };
+        }
+        return { ok: true, globallyHidden: true };
+    }
+    // POST /:id/global-unhide — admin/owner reverses a global hide.
+    if (method === "POST" && parts.length === 2 && parts[1] === "global-unhide") {
+        const ok = await globalUnhideExtension(parts[0]);
+        if (!ok) {
+            setResponseStatus(event, 404);
+            return { error: "Extension not found" };
+        }
+        return { ok: true, globallyHidden: false };
+    }
     // PUT /:id
     if (method === "PUT" && parts.length === 1) {
         const body = await readBody(event);
@@ -246,6 +266,7 @@ async function extensionResponse(row, role) {
             ? ["owner", "admin", "editor"].includes(resolvedRole)
             : false,
         canDelete: resolvedRole ? ["owner", "admin"].includes(resolvedRole) : false,
+        globallyHidden: row.hiddenAt != null,
     };
 }
 async function handleExtensionDataList(event, extensionId, collection, userEmail) {

package/dist/extensions/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/extensions/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,qBAAqB,EACrB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,8BAA8B,EAC9B,eAAe,EACf,aAAa,EACb,eAAe,EACf,sBAAsB,GAEvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,qCAAqC,EACrC,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,aAAa,EACb,YAAY,EACZ,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrE,MAAM,UAAU,uBAAuB;IACrC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;aACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ;YACpB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC/B,IAAI,CAAC;oBACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC;QAE1D,IAAI,CAAC;YACH,OAAO,MAAM,qBAAqB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE;gBAClE,MAAM,sBAAsB,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,KAAc,EACd,MAAc,EACd,KAAe,EACf,SAAiB;IAEjB,wDAAwD;IACxD,IACE,MAAM,KAAK,MAAM;QACjB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EACpB,CAAC;QACD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,mDAAmD;IACnD,IACE,MAAM,KAAK,MAAM;QACjB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EACnB,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,kEAAkE;IAClE,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,8DAA8D;IAC9D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACnE,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzE,CAAC;IAED,iEAAiE;IACjE,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACrE,OAAO,yBAAyB,CAC9B,KAAK,EACL,KAAK,CAAC,CAAC,CAAC,EACR,KAAK,CAAC,CAAC,CAAC,EACR,KAAK,CAAC,CAAC,CAAC,EACR,SAAS,CACV,CAAC;IACJ,CAAC;IAED,cAAc;IACd,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACpE,OAAO,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,eAAe;IACf,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC;QACnC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACvC,mEAAmE;QACnE,gEAAgE;QAChE,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC;QAEpD,MAAM,IAAI,GAAG,kBAAkB,CAC7B,SAAS,CAAC,OAAO,EACjB,SAAS,EACT,MAAM,EACN,KAAK,CAAC,CAAC,CAAC,EACR;YACE,WAAW,EAAE,SAAS,CAAC,UAAU;YACjC,WAAW,EAAE,SAAS;YACtB,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CACF,CAAC;QACF,2EAA2E;QAC3E,iEAAiE;QACjE,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;QACrE,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;QAC1E,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9D,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2DAA2D;IAC3D,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACrE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GACT,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;YAC7C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,MAAM,cAAc,GAClB,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC5C,KAAK;gBACL,cAAc;aACf,CAAC;SACH,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAC1E,IACE,MAAM,KAAK,MAAM;QACjB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACtB,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EACtB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,WAAW;IACX,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,QAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACnE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,sEAAsE;IACtE,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,WAAW;IACX,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,gBAAgB,GACpB,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,IAAI,CAAC,KAAK,KAAK,SAAS;YACxB,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;QAC5B,MAAM,aAAa,GACjB,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,WAAW,KAAK,SAAS;YAC9B,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC;QAEhC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;IACd,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAiB,EACjB,IAAiC;IAEjC,MAAM,YAAY,GAChB,IAAI;QACJ,CAAC,MAAM,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;aACtC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;aACtC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACxB,OAAO;QACL,GAAG,GAAG;QACN,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,YAAY;YACnB,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;YACrD,CAAC,CAAC,KAAK;QACT,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK;KAC5E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,UAAU,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,KAAK,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;;gBAIK;YACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;;;gBAKK;YACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;cAIK;QACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,cAAc,GAAG,EAAE;QACvB,CAAC,CAAC;4EACsE;QACxE,CAAC,CAAC;4EACsE,CAAC;IAE3E,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;OAEF,cAAc,EAAE;QACnB,IAAI,EAAE;YACJ,UAAU,EAAE;YACZ,WAAW;YACX,UAAU;YACV,MAAM;YACN,IAAI;YACJ,SAAS;YACT,KAAK;YACL,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,IAAI;YAC/B,QAAQ;YACR,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,MAAM;QACV,WAAW;QACX,UAAU;QACV,IAAI;QACJ,UAAU,EAAE,SAAS;QACrB,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACrC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,MAAc,EACd,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,2HAA2H;YAChI,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,iIAAiI;QACtI,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC;KACnD,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAc,EACd,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;IACxB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,gFAAgF;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAA2B,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;IAE1B,IAAI,WAAW,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,aAAa,GAA2B,EAAE,CAAC;IACjD,IAAI,YAAY,GAAG,OAAO,CAAC;IAC3B,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,eAAe,GAA2B,EAAE,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,qCAAqC,CAC3D,MAAM,EACN,SAAS,CACV,CAAC;QACF,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC;QACjC,eAAe,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAChD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAExD,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAC9D,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EACxC,SAAS,CACV,CAAC;YACF,aAAa,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC;YAC1C,eAAe,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;YACnD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAC5D,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAC/D,SAAS,CACV,CAAC;YACF,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;YACnC,eAAe,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;YACjD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,0BAA0B,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAE1D,IAAI,MAAM,4BAA4B,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE;QACzC,GAAG;KACJ,CAAC,CACH,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YAClD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,QAAQ,MAAM,CAAC,IAAI,sCAAsC;aACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAE7D,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,8EAA8E;IAC9E,0EAA0E;IAC1E,yDAAyD;IACzD,MAAM,UAAU,GAAG,CAAC,MAAM,wBAAwB,EAAE,CAAC,IAAI,SAAS,CAAC;IAEnE,IAAI,CAAC;QACH,MAAM,SAAS,GAA2C;YACxD,MAAM;YACN,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAClD,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC;YACtD,SAAS,CAAC,IAAI,GAAG,YAAY;gBAC3B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACjC,kEAAkE;YAClE,qEAAqE;YACrE,qEAAqE;YACrE,+DAA+D;YAC/D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,cAAc,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,YAAY,GAChB,CAAC,YAAY;oBACb,CAAC,OAAO,YAAY,KAAK,QAAQ;wBAC/B,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;wBAC7B,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;gBAChC,IAAI,YAAY;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAErD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,IAAI,WAAW,IAAI,CAAC,MAAM,4BAA4B,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBACrE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,MAAM,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;oBACjD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;oBACxD,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;wBAClD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;wBAC9B,OAAO;4BACL,KAAK,EAAE,wCAAwC,MAAM,CAAC,IAAI,GAAG;yBAC9D,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE;oBACJ,QAAQ,EAAE,WAAW;wBACnB,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC;wBACzC,CAAC,CAAC,QAAQ;iBACb;aACF,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC;SAChD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QACjD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,yBAAyB,aAAa,CAC3C,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAC3B,YAAY,CACb,EAAE;SACJ,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,qBAAqB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAE7D,KAAK,UAAU,gBAAgB,CAC7B,EAAqC,EACrC,IAAc;IAEd,MAAM,eAAe,GAAG,qBAAqB,CAAC;IAC9C,IAAI,cAA2B,CAAC;IAChC,qBAAqB,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACpD,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,eAAe,CAAC;IAEtB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;IAChC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;IAC7C,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,CAAY,EAAE,EAAE;QAChC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,CAAY,EAAE,EAAE;QAClC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAU,EAAE,EAAE;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC,CAAQ,CAAC;IACV,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;QACtB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,eAAe,CAAC;QACvC,cAAc,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,6DAA6D;SACrE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,kBAAkB,GACtB,kcAAkc,CAAC;AAErc,iFAAiF;AACjF,0EAA0E;AAC1E,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,gBAAgB,GACpB,mmBAAmmB,CAAC;AAEtmB,8EAA8E;AAC9E,8EAA8E;AAC9E,wEAAwE;AACxE,4DAA4D;AAC5D,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAE7E,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,oEAAoE;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,6DAA6D;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,2HAA2H;SAC9H,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,aAAa,EAAE,CAAC;IAClD,CAAC;AACH,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n  defineEventHandler,\n  getMethod,\n  setResponseStatus,\n  setResponseHeader,\n  type H3Event,\n} from \"h3\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getSession } from \"../server/auth.js\";\nimport {\n  runWithRequestContext,\n  getRequestOrgId,\n} from \"../server/request-context.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport {\n  listExtensions,\n  getExtension,\n  getExtensionHistoryVersion,\n  listExtensionHistory,\n  createExtension,\n  updateExtension,\n  updateExtensionContent,\n  restoreExtensionHistoryVersion,\n  deleteExtension,\n  hideExtension,\n  unhideExtension,\n  ensureExtensionsTables,\n  type ExtensionRow,\n} from \"./store.js\";\nimport { buildExtensionHtml, EXTENSION_IFRAME_CSP } from \"./html-shell.js\";\nimport { getThemeVars } from \"./theme.js\";\nimport {\n  resolveKeyReferencesWithRequestScopes,\n  validateUrlAllowlist,\n  getResolvedKeyAllowlist,\n  type ResolvedKeyReference,\n} from \"../secrets/substitution.js\";\nimport {\n  collectSecretValues,\n  normalizeExtensionProxyMethod,\n  readResponseTextWithLimit,\n  redactSecrets,\n  redactString,\n  sanitizeOutboundHeaders,\n} from \"./proxy-security.js\";\nimport {\n  createSsrfSafeDispatcher,\n  isBlockedExtensionUrlWithDns,\n} from \"./url-safety.js\";\nimport { ForbiddenError, resolveAccess } from \"../sharing/access.js\";\nimport type { ShareRole } from \"../sharing/schema.js\";\n\nexport function createExtensionsHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    const method = getMethod(event);\n    const pathname = (event.url?.pathname || \"\")\n      .replace(/^\\/+/, \"\")\n      .replace(/\\/+$/, \"\");\n    const parts = pathname\n      ? pathname.split(\"/\").map((part) => {\n          try {\n            return decodeURIComponent(part);\n          } catch {\n            return part;\n          }\n        })\n      : [];\n\n    const session = await getSession(event).catch(() => null);\n    if (!session?.email) {\n      setResponseStatus(event, 401);\n      return { error: \"Authentication required\" };\n    }\n\n    const orgCtx = await getOrgContext(event).catch(() => null);\n    const userEmail = session.email;\n    const orgId = orgCtx?.orgId ?? session.orgId ?? undefined;\n\n    try {\n      return await runWithRequestContext({ userEmail, orgId }, async () => {\n        await ensureExtensionsTables();\n        return dispatch(event, method, parts, userEmail);\n      });\n    } catch (err) {\n      if (err instanceof ForbiddenError) {\n        setResponseStatus(event, 403);\n        return { error: err.message };\n      }\n      throw err;\n    }\n  });\n}\n\nasync function dispatch(\n  event: H3Event,\n  method: string,\n  parts: string[],\n  userEmail: string,\n): Promise<unknown> {\n  // POST /sql/query — read-only SQL for extension iframes\n  if (\n    method === \"POST\" &&\n    parts.length === 2 &&\n    parts[0] === \"sql\" &&\n    parts[1] === \"query\"\n  ) {\n    return handleSqlQuery(event);\n  }\n\n  // POST /sql/exec — write SQL for extension iframes\n  if (\n    method === \"POST\" &&\n    parts.length === 2 &&\n    parts[0] === \"sql\" &&\n    parts[1] === \"exec\"\n  ) {\n    return handleSqlExec(event);\n  }\n\n  // GET /data/:extensionId/:collection — list items in a collection\n  if (method === \"GET\" && parts.length === 3 && parts[0] === \"data\") {\n    return handleExtensionDataList(event, parts[1], parts[2], userEmail);\n  }\n\n  // POST /data/:extensionId/:collection — create/upsert an item\n  if (method === \"POST\" && parts.length === 3 && parts[0] === \"data\") {\n    return handleExtensionDataUpsert(event, parts[1], parts[2], userEmail);\n  }\n\n  // DELETE /data/:extensionId/:collection/:itemId — delete an item\n  if (method === \"DELETE\" && parts.length === 4 && parts[0] === \"data\") {\n    return handleExtensionDataDelete(\n      event,\n      parts[1],\n      parts[2],\n      parts[3],\n      userEmail,\n    );\n  }\n\n  // POST /proxy\n  if (method === \"POST\" && parts.length === 1 && parts[0] === \"proxy\") {\n    return handleProxy(event, userEmail);\n  }\n\n  // GET / — list\n  if (method === \"GET\" && parts.length === 0) {\n    const rows = await listExtensions();\n    return Promise.all(rows.map((row) => extensionResponse(row)));\n  }\n\n  // POST / — create\n  if (method === \"POST\" && parts.length === 0) {\n    const body = await readBody(event);\n    if (!body.name) {\n      setResponseStatus(event, 400);\n      return { error: \"name is required\" };\n    }\n    const extension = await createExtension(body);\n    setResponseStatus(event, 201);\n    return extension;\n  }\n\n  // GET /:id/render\n  if (method === \"GET\" && parts.length === 2 && parts[1] === \"render\") {\n    const access = await resolveAccess(\"extension\", parts[0]);\n    const extension = access?.resource;\n    if (!extension) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    const search = event.url?.search || \"\";\n    const isDark = search.includes(\"dark=1\") || search.includes(\"dark=true\");\n    const themeVars = getThemeVars(isDark);\n    // Compute viewer-vs-author binding so the iframe can warn when the\n    // viewer is NOT the author. The role is plumbed through to gate\n    // dangerous bridge helpers in iframe-bridge.ts (audit H4).\n    const isAuthor = extension.ownerEmail === userEmail;\n\n    const html = buildExtensionHtml(\n      extension.content,\n      themeVars,\n      isDark,\n      parts[0],\n      {\n        authorEmail: extension.ownerEmail,\n        viewerEmail: userEmail,\n        isAuthor,\n        role: access.role,\n      },\n    );\n    // Security headers per render. `frame-ancestors` in the CSP must be set as\n    // an HTTP header to be enforced; meta-CSP can't set it per spec.\n    setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n    setResponseHeader(event, \"Content-Security-Policy\", EXTENSION_IFRAME_CSP);\n    setResponseHeader(event, \"X-Content-Type-Options\", \"nosniff\");\n    setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n    return html;\n  }\n\n  // GET /:id/history — list saved snapshots for an extension\n  if (method === \"GET\" && parts.length === 2 && parts[1] === \"history\") {\n    const limitParam = event.url?.searchParams?.get(\"limit\");\n    const limit =\n      limitParam === null || limitParam === undefined\n        ? undefined\n        : Number(limitParam);\n    const includeContent =\n      event.url?.searchParams?.get(\"includeContent\") === \"true\";\n    return {\n      history: await listExtensionHistory(parts[0], {\n        limit,\n        includeContent,\n      }),\n    };\n  }\n\n  // GET /:id/history/:version — fetch one snapshot plus its previous-version diff\n  if (method === \"GET\" && parts.length === 3 && parts[1] === \"history\") {\n    const detail = await getExtensionHistoryVersion(parts[0], parts[2]);\n    if (!detail) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension history version not found\" };\n    }\n    return detail;\n  }\n\n  // POST /:id/history/:version/restore — restore display metadata + content\n  if (\n    method === \"POST\" &&\n    parts.length === 4 &&\n    parts[1] === \"history\" &&\n    parts[3] === \"restore\"\n  ) {\n    const restored = await restoreExtensionHistoryVersion(parts[0], parts[2]);\n    if (!restored) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension history version not found\" };\n    }\n    return extensionResponse(restored);\n  }\n\n  // GET /:id\n  if (method === \"GET\" && parts.length === 1) {\n    const access = await resolveAccess(\"extension\", parts[0]);\n    if (!access) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return extensionResponse(access.resource as ExtensionRow, access.role);\n  }\n\n  // POST /:id/hide — remove from the current user's Extensions list/sidebar\n  // without deleting the underlying extension for teammates or shared slots.\n  if (method === \"POST\" && parts.length === 2 && parts[1] === \"hide\") {\n    const ok = await hideExtension(parts[0]);\n    if (!ok) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return { ok: true, hidden: true };\n  }\n\n  // POST /:id/unhide — restore an extension hidden by the current user.\n  if (method === \"POST\" && parts.length === 2 && parts[1] === \"unhide\") {\n    const ok = await unhideExtension(parts[0]);\n    if (!ok) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return { ok: true, hidden: false };\n  }\n\n  // PUT /:id\n  if (method === \"PUT\" && parts.length === 1) {\n    const body = await readBody(event);\n    const hasContentUpdate =\n      body.content !== undefined ||\n      body.patches !== undefined ||\n      body.edits !== undefined ||\n      body.format !== undefined;\n    const hasMetaUpdate =\n      body.name !== undefined ||\n      body.description !== undefined ||\n      body.icon !== undefined ||\n      body.visibility !== undefined;\n\n    let result = null;\n    if (hasContentUpdate) {\n      result = await updateExtensionContent(parts[0], {\n        content: body.content,\n        patches: body.patches,\n        edits: body.edits,\n        format: body.format === true || body.format === \"true\",\n      });\n    }\n    if (hasMetaUpdate) {\n      result = await updateExtension(parts[0], body);\n    }\n    if (!hasContentUpdate && !hasMetaUpdate) {\n      result = await getExtension(parts[0]);\n    }\n    if (!result) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return result;\n  }\n\n  // DELETE /:id\n  if (method === \"DELETE\" && parts.length === 1) {\n    const ok = await deleteExtension(parts[0]);\n    if (!ok) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return { ok: true };\n  }\n\n  setResponseStatus(event, 404);\n  return { error: \"Not found\" };\n}\n\nasync function extensionResponse(\n  row: ExtensionRow,\n  role?: \"owner\" | ShareRole | null,\n) {\n  const resolvedRole =\n    role ??\n    (await resolveAccess(\"extension\", row.id)\n      .then((access) => access?.role ?? null)\n      .catch(() => null));\n  return {\n    ...row,\n    role: resolvedRole,\n    canEdit: resolvedRole\n      ? [\"owner\", \"admin\", \"editor\"].includes(resolvedRole)\n      : false,\n    canDelete: resolvedRole ? [\"owner\", \"admin\"].includes(resolvedRole) : false,\n  };\n}\n\nasync function handleExtensionDataList(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const client = getDbExec();\n  const url = event.url;\n  const limitParam = url?.searchParams?.get(\"limit\");\n  const limit = limitParam\n    ? Math.min(Math.max(1, Number(limitParam)), 1000)\n    : 100;\n  const scope = url?.searchParams?.get(\"scope\") || \"user\";\n  const orgId = getRequestOrgId();\n\n  if (scope === \"org\") {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"Org context required for scope=org\" };\n    }\n    const result = await client.execute({\n      sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n        FROM tool_data\n        WHERE tool_id = ? AND collection = ? AND scope = 'org' AND org_id = ?\n        ORDER BY created_at DESC\n        LIMIT ?`,\n      args: [extensionId, collection, orgId, limit],\n    });\n    return result.rows ?? [];\n  }\n\n  if (scope === \"all\") {\n    const result = await client.execute({\n      sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n        FROM tool_data\n        WHERE tool_id = ? AND collection = ?\n          AND ((scope = 'user' AND owner_email = ?) OR (scope = 'org' AND org_id = ?))\n        ORDER BY created_at DESC\n        LIMIT ?`,\n      args: [extensionId, collection, userEmail, orgId ?? \"\", limit],\n    });\n    return result.rows ?? [];\n  }\n\n  const result = await client.execute({\n    sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n      FROM tool_data\n      WHERE tool_id = ? AND collection = ? AND scope = 'user' AND owner_email = ?\n      ORDER BY updated_at DESC\n      LIMIT ?`,\n    args: [extensionId, collection, userEmail, limit],\n  });\n  return result.rows ?? [];\n}\n\nasync function handleExtensionDataUpsert(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const body = await readBody(event);\n  if (body.data === undefined) {\n    setResponseStatus(event, 400);\n    return { error: \"data is required\" };\n  }\n  const itemId = String(body.id || randomUUID());\n  const data =\n    typeof body.data === \"string\" ? body.data : JSON.stringify(body.data);\n  const now = new Date().toISOString();\n  const scope = body.scope === \"org\" ? \"org\" : \"user\";\n  const orgId = getRequestOrgId();\n\n  if (scope === \"org\" && !orgId) {\n    setResponseStatus(event, 400);\n    return { error: \"Org context required for scope=org\" };\n  }\n\n  const scopeKey = scope === \"org\" ? `org:${orgId}` : userEmail;\n  const client = getDbExec();\n  const pg = isPostgres();\n  const conflictClause = pg\n    ? `ON CONFLICT (tool_id, collection, scope_key, item_id)\n       DO UPDATE SET data = EXCLUDED.data, updated_at = EXCLUDED.updated_at`\n    : `ON CONFLICT (tool_id, collection, scope_key, item_id)\n       DO UPDATE SET data = excluded.data, updated_at = excluded.updated_at`;\n\n  await client.execute({\n    sql: `INSERT INTO tool_data (id, tool_id, collection, item_id, data, owner_email, scope, org_id, scope_key, created_at, updated_at)\n     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n     ${conflictClause}`,\n    args: [\n      randomUUID(),\n      extensionId,\n      collection,\n      itemId,\n      data,\n      userEmail,\n      scope,\n      scope === \"org\" ? orgId! : null,\n      scopeKey,\n      now,\n      now,\n    ],\n  });\n  return {\n    id: itemId,\n    extensionId,\n    collection,\n    data,\n    ownerEmail: userEmail,\n    scope,\n    orgId: scope === \"org\" ? orgId : null,\n    createdAt: now,\n    updatedAt: now,\n  };\n}\n\nasync function handleExtensionDataDelete(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  itemId: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const url = event.url;\n  const scope = url?.searchParams?.get(\"scope\") || \"user\";\n  const orgId = getRequestOrgId();\n  const client = getDbExec();\n\n  if (scope === \"org\") {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"Org context required for scope=org\" };\n    }\n    await client.execute({\n      sql: `DELETE FROM tool_data WHERE COALESCE(item_id, id) = ? AND tool_id = ? AND collection = ? AND scope = 'org' AND org_id = ?`,\n      args: [itemId, extensionId, collection, orgId],\n    });\n    return { ok: true };\n  }\n\n  await client.execute({\n    sql: `DELETE FROM tool_data WHERE COALESCE(item_id, id) = ? AND tool_id = ? AND collection = ? AND scope = 'user' AND owner_email = ?`,\n    args: [itemId, extensionId, collection, userEmail],\n  });\n  return { ok: true };\n}\n\nasync function handleProxy(\n  event: H3Event,\n  userEmail: string,\n): Promise<unknown> {\n  const body = await readBody(event);\n  const rawUrl = body.url;\n  if (!rawUrl || typeof rawUrl !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"url is required\" };\n  }\n\n  const method = normalizeExtensionProxyMethod(body.method || \"GET\");\n  if (!method) {\n    setResponseStatus(event, 405);\n    return {\n      error:\n        \"Unsupported HTTP method. Allowed methods: GET, POST, PUT, PATCH, DELETE, HEAD.\",\n    };\n  }\n  const rawHeaders: Record<string, string> = body.headers || {};\n  const rawBody = body.body;\n\n  let resolvedUrl = rawUrl;\n  // Resolve secret references per header value rather than over a single\n  // JSON.stringify(headers) blob. A secret value containing a double-quote\n  // would corrupt that JSON, the later JSON.parse would throw, and the request\n  // would silently fall back to the *unresolved* headers (placeholders intact).\n  const parsedHeaders: Record<string, string> = {};\n  let resolvedBody = rawBody;\n  const allSecretValues: string[] = [];\n  const allResolvedKeys: ResolvedKeyReference[] = [];\n\n  try {\n    const urlResult = await resolveKeyReferencesWithRequestScopes(\n      rawUrl,\n      userEmail,\n    );\n    resolvedUrl = urlResult.resolved;\n    allSecretValues.push(...urlResult.secretValues);\n    allResolvedKeys.push(...(urlResult.resolvedKeys ?? []));\n\n    for (const [hk, hv] of Object.entries(rawHeaders)) {\n      const headerResult = await resolveKeyReferencesWithRequestScopes(\n        typeof hv === \"string\" ? hv : String(hv),\n        userEmail,\n      );\n      parsedHeaders[hk] = headerResult.resolved;\n      allSecretValues.push(...headerResult.secretValues);\n      allResolvedKeys.push(...(headerResult.resolvedKeys ?? []));\n    }\n\n    if (rawBody) {\n      const bodyResult = await resolveKeyReferencesWithRequestScopes(\n        typeof rawBody === \"string\" ? rawBody : JSON.stringify(rawBody),\n        userEmail,\n      );\n      resolvedBody = bodyResult.resolved;\n      allSecretValues.push(...bodyResult.secretValues);\n      allResolvedKeys.push(...(bodyResult.resolvedKeys ?? []));\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 400);\n    return { error: `Key resolution failed: ${err?.message ?? err}` };\n  }\n  const secretValues = collectSecretValues(allSecretValues);\n\n  if (await isBlockedExtensionUrlWithDns(resolvedUrl)) {\n    setResponseStatus(event, 403);\n    return { error: \"Requests to private/internal addresses are not allowed\" };\n  }\n\n  const uniqueResolvedKeys = new Map(\n    allResolvedKeys.map((ref) => [\n      `${ref.name}:${ref.scope}:${ref.scopeId}`,\n      ref,\n    ]),\n  );\n  for (const keyRef of uniqueResolvedKeys.values()) {\n    const allowlist = await getResolvedKeyAllowlist(keyRef);\n    if (!validateUrlAllowlist(resolvedUrl, allowlist)) {\n      setResponseStatus(event, 403);\n      return {\n        error: `Key \"${keyRef.name}\" is not allowed for this URL origin`,\n      };\n    }\n  }\n\n  const headers = sanitizeOutboundHeaders(parsedHeaders);\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), 15_000);\n\n  // Best-effort connect-time SSRF guard. When undici is available (it ships\n  // with Node 18+ but is not always exposed as an importable module), the\n  // dispatcher re-checks the resolved IP at TCP-connect time, closing the\n  // TOCTOU between the pre-flight `isBlockedExtensionUrlWithDns` lookup and the\n  // actual fetch lookup. If undici is not importable, fall through to plain\n  // fetch — the pre-flight remains the primary protection.\n  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;\n\n  try {\n    const fetchOpts: RequestInit & { dispatcher?: unknown } = {\n      method,\n      headers,\n      signal: controller.signal,\n      redirect: \"manual\",\n    };\n    if (dispatcher) fetchOpts.dispatcher = dispatcher;\n    if (resolvedBody && [\"POST\", \"PUT\", \"PATCH\"].includes(method)) {\n      const isStringBody = typeof resolvedBody === \"string\";\n      fetchOpts.body = isStringBody\n        ? resolvedBody\n        : JSON.stringify(resolvedBody);\n      // Only inject Content-Type when (a) the caller didn't set one and\n      // (b) the body is actually JSON-shaped (object or stringified JSON).\n      // Otherwise leave it unset so the runtime fetch picks an appropriate\n      // default and we don't misrepresent text/plain bodies as JSON.\n      const hasContentType = Object.keys(headers).some(\n        (k) => k.toLowerCase() === \"content-type\",\n      );\n      if (!hasContentType) {\n        const isJsonShaped =\n          !isStringBody ||\n          (typeof resolvedBody === \"string\" &&\n            /^\\s*[{[]/.test(resolvedBody) &&\n            isLikelyJson(resolvedBody));\n        if (isJsonShaped) headers[\"Content-Type\"] = \"application/json\";\n      }\n    }\n\n    const response = await fetch(resolvedUrl, fetchOpts);\n\n    if (response.status >= 300 && response.status < 400) {\n      const location = response.headers.get(\"location\");\n      const redirectUrl = location ? new URL(location, resolvedUrl).href : null;\n      if (redirectUrl && (await isBlockedExtensionUrlWithDns(redirectUrl))) {\n        setResponseStatus(event, 403);\n        return { error: \"Redirect to private/internal address blocked\" };\n      }\n      if (redirectUrl) {\n        for (const keyRef of uniqueResolvedKeys.values()) {\n          const allowlist = await getResolvedKeyAllowlist(keyRef);\n          if (!validateUrlAllowlist(redirectUrl, allowlist)) {\n            setResponseStatus(event, 403);\n            return {\n              error: `Redirect URL is not allowed for key \"${keyRef.name}\"`,\n            };\n          }\n        }\n      }\n      return {\n        status: response.status,\n        body: {\n          redirect: redirectUrl\n            ? redactString(redirectUrl, secretValues)\n            : location,\n        },\n      };\n    }\n\n    const { text } = await readResponseTextWithLimit(response);\n    let responseBody: unknown;\n    try {\n      responseBody = JSON.parse(text);\n    } catch {\n      responseBody = text;\n    }\n\n    return {\n      status: response.status,\n      body: redactSecrets(responseBody, secretValues),\n    };\n  } catch (err: any) {\n    if (err?.name === \"AbortError\") {\n      setResponseStatus(event, 504);\n      return { error: \"Upstream request timed out\" };\n    }\n    setResponseStatus(event, 502);\n    return {\n      error: `Proxy request failed: ${redactSecrets(\n        err?.message ?? String(err),\n        secretValues,\n      )}`,\n    };\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Capture console output from a CLI script that uses console.log for results.\n * Same technique as wrapCliScript in agent-chat-plugin.ts.\n */\nlet captureCliOutputQueue: Promise<void> = Promise.resolve();\n\nasync function captureCliOutput(\n  fn: (args: string[]) => Promise<void>,\n  args: string[],\n): Promise<string> {\n  const previousCapture = captureCliOutputQueue;\n  let releaseCapture!: () => void;\n  captureCliOutputQueue = new Promise<void>((resolve) => {\n    releaseCapture = resolve;\n  });\n  await previousCapture;\n\n  const logs: string[] = [];\n  const origLog = console.log;\n  const origError = console.error;\n  const origStdoutWrite = process.stdout.write;\n  console.log = (...a: unknown[]) => {\n    logs.push(a.map(String).join(\" \"));\n  };\n  console.error = (...a: unknown[]) => {\n    logs.push(a.map(String).join(\" \"));\n  };\n  process.stdout.write = ((chunk: any) => {\n    if (typeof chunk === \"string\") logs.push(chunk);\n    else if (Buffer.isBuffer(chunk)) logs.push(chunk.toString());\n    return true;\n  }) as any;\n  try {\n    await fn(args);\n  } catch (err: any) {\n    logs.push(`Error: ${err?.message ?? String(err)}`);\n  } finally {\n    console.log = origLog;\n    console.error = origError;\n    process.stdout.write = origStdoutWrite;\n    releaseCapture();\n  }\n  return logs.join(\"\\n\") || \"(no output)\";\n}\n\nasync function handleSqlQuery(event: H3Event): Promise<unknown> {\n  const body = await readBody(event);\n  const sql = body.sql;\n  if (!sql || typeof sql !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"sql is required\" };\n  }\n\n  const cleanSql = stripSqlComments(sql);\n  if (!/^\\s*(SELECT|WITH)\\b/i.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return { error: \"Only SELECT queries are allowed from extensions\" };\n  }\n  if (SENSITIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"Sensitive framework tables are not readable from extensions\",\n    };\n  }\n\n  try {\n    const mod = await import(\"../scripts/db/query.js\");\n    const args = [\"--sql\", sql, \"--format\", \"json\"];\n    if (body.limit) args.push(\"--limit\", String(body.limit));\n    if (body.args !== undefined) {\n      if (!Array.isArray(body.args)) {\n        setResponseStatus(event, 400);\n        return { error: \"args must be an array\" };\n      }\n      args.push(\"--args\", JSON.stringify(body.args));\n    }\n    const output = await captureCliOutput(mod.default, args);\n    try {\n      return JSON.parse(output);\n    } catch {\n      return { output };\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 500);\n    return { error: err?.message ?? \"Query failed\" };\n  }\n}\n\n// TODO(security): replace this regex blocklist with a SQL parser + an explicit\n// allowlist of tables a extension may read/write (e.g. only `tool_data`, plus a\n// per-template list). The current blocklist is best-effort defense in depth\n// and is by design bypassable via SQL constructions that don't include the\n// blocklisted token literally (string concat, dynamic SQL, etc). The temp-\n// view scoping in scripts/db/scoping.ts is the actual ownership boundary.\nconst DESTRUCTIVE_SQL_RE =\n  /\\b(CREATE\\s+(?:(?:LOCAL|GLOBAL)\\s+)?(?:TEMPORARY|TEMP)?\\s*(TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|EXTENSION|ROLE|TABLESPACE|PUBLICATION|SUBSCRIPTION)|DROP\\s+(TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|EXTENSION|ROLE)|TRUNCATE|DELETE\\s+FROM\\s+(?!tool_data\\b)|ALTER\\s+(TABLE|VIEW|SCHEMA|DATABASE|FUNCTION|ROLE|EXTENSION|PUBLICATION)\\s+(?!tool_data\\b)|ATTACH|DETACH|VACUUM|REINDEX|PRAGMA|GRANT|REVOKE|SET\\s+ROLE|RESET\\s+ROLE|COPY)\\b/i;\n\n// Sensitive tables that extensions must not touch directly. Includes Better Auth\n// identity tables, framework infrastructure (tracing, evals, automations,\n// integrations, notifications, scheduling, sharing/orgs), and Postgres\n// catalogs that would let a extension enumerate or read internals.\nconst SENSITIVE_SQL_RE =\n  /\\b(app_secrets|user|users|session|sessions|account|accounts|verification|oauth_tokens|tools|extensions|tool_shares|tool_slots|tool_slot_installs|tool_hidden_extensions|tool_history|member|organization|invitation|jwks|agent_trace_spans|agent_trace_summaries|agent_feedback|agent_satisfaction_scores|agent_evals|agent_runs|agent_run_events|notifications|progress_runs|integration_configs|integration_pending_tasks|integration_thread_mappings|resources|org_members|org_invitations|bigquery_cache|dashboard_views|pg_catalog|information_schema|pg_class|pg_proc|pg_namespace|pg_user|pg_roles|pg_authid|pg_shadow)\\b/i;\n\n// Refuses positional INSERTs (no column list). `INSERT INTO recordings VALUES\n// (...)` would let a extension stuff arbitrary owner_email values into a row.\n// `INSERT INTO recordings (col1, col2) VALUES (...)` is required so the\n// downstream injectOwnership helper can append owner_email.\nconst POSITIONAL_INSERT_RE = /\\bINSERT\\s+INTO\\s+[\"'`]?\\w+[\"'`]?\\s+VALUES\\b/i;\n\nfunction stripSqlComments(sql: string): string {\n  return sql.replace(/\\/\\*[\\s\\S]*?\\*\\//g, \" \").replace(/--[^\\n]*/g, \" \");\n}\n\nfunction isLikelyJson(text: string): boolean {\n  try {\n    const parsed = JSON.parse(text);\n    return parsed !== null && typeof parsed === \"object\";\n  } catch {\n    return false;\n  }\n}\n\nasync function handleSqlExec(event: H3Event): Promise<unknown> {\n  const body = await readBody(event);\n  const sql = body.sql;\n  if (!sql || typeof sql !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"sql is required\" };\n  }\n\n  const cleanSql = stripSqlComments(sql);\n  if (DESTRUCTIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"Schema changes and destructive SQL are not allowed from extensions\",\n    };\n  }\n  if (SENSITIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"Sensitive framework tables are not writable from extensions\",\n    };\n  }\n  if (POSITIONAL_INSERT_RE.test(cleanSql)) {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"INSERT must specify an explicit column list (e.g. INSERT INTO t (col1, col2) VALUES (?, ?)) so ownership can be injected.\",\n    };\n  }\n\n  try {\n    const mod = await import(\"../scripts/db/exec.js\");\n    const args = [\"--sql\", sql, \"--format\", \"json\"];\n    if (body.args !== undefined) {\n      if (!Array.isArray(body.args)) {\n        setResponseStatus(event, 400);\n        return { error: \"args must be an array\" };\n      }\n      args.push(\"--args\", JSON.stringify(body.args));\n    }\n    const output = await captureCliOutput(mod.default, args);\n    try {\n      return JSON.parse(output);\n    } catch {\n      return { output };\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 500);\n    return { error: err?.message ?? \"Exec failed\" };\n  }\n}\n"]}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/extensions/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,qBAAqB,EACrB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,8BAA8B,EAC9B,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,qCAAqC,EACrC,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,aAAa,EACb,YAAY,EACZ,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrE,MAAM,UAAU,uBAAuB;IACrC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;aACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ;YACpB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC/B,IAAI,CAAC;oBACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC;QAE1D,IAAI,CAAC;YACH,OAAO,MAAM,qBAAqB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE;gBAClE,MAAM,sBAAsB,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,KAAc,EACd,MAAc,EACd,KAAe,EACf,SAAiB;IAEjB,wDAAwD;IACxD,IACE,MAAM,KAAK,MAAM;QACjB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EACpB,CAAC;QACD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,mDAAmD;IACnD,IACE,MAAM,KAAK,MAAM;QACjB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EACnB,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,kEAAkE;IAClE,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,8DAA8D;IAC9D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACnE,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzE,CAAC;IAED,iEAAiE;IACjE,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACrE,OAAO,yBAAyB,CAC9B,KAAK,EACL,KAAK,CAAC,CAAC,CAAC,EACR,KAAK,CAAC,CAAC,CAAC,EACR,KAAK,CAAC,CAAC,CAAC,EACR,SAAS,CACV,CAAC;IACJ,CAAC;IAED,cAAc;IACd,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACpE,OAAO,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,qBAAqB,GACzB,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC;QACnC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACvC,mEAAmE;QACnE,gEAAgE;QAChE,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC;QAEpD,MAAM,IAAI,GAAG,kBAAkB,CAC7B,SAAS,CAAC,OAAO,EACjB,SAAS,EACT,MAAM,EACN,KAAK,CAAC,CAAC,CAAC,EACR;YACE,WAAW,EAAE,SAAS,CAAC,UAAU;YACjC,WAAW,EAAE,SAAS;YACtB,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CACF,CAAC;QACF,2EAA2E;QAC3E,iEAAiE;QACjE,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;QACrE,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;QAC1E,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9D,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2DAA2D;IAC3D,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACrE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GACT,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;YAC7C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,MAAM,cAAc,GAClB,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC5C,KAAK;gBACL,cAAc;aACf,CAAC;SACH,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAC1E,IACE,MAAM,KAAK,MAAM;QACjB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACtB,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EACtB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,WAAW;IACX,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,QAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACnE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,sEAAsE;IACtE,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,yEAAyE;IACzE,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC1E,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC5C,CAAC;IAED,gEAAgE;IAChE,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,WAAW;IACX,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,gBAAgB,GACpB,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,IAAI,CAAC,KAAK,KAAK,SAAS;YACxB,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;QAC5B,MAAM,aAAa,GACjB,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,WAAW,KAAK,SAAS;YAC9B,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC;QAEhC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;IACd,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAiB,EACjB,IAAiC;IAEjC,MAAM,YAAY,GAChB,IAAI;QACJ,CAAC,MAAM,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;aACtC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;aACtC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACxB,OAAO;QACL,GAAG,GAAG;QACN,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,YAAY;YACnB,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;YACrD,CAAC,CAAC,KAAK;QACT,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3E,cAAc,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,UAAU,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,KAAK,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;;gBAIK;YACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;;;gBAKK;YACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;cAIK;QACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,cAAc,GAAG,EAAE;QACvB,CAAC,CAAC;4EACsE;QACxE,CAAC,CAAC;4EACsE,CAAC;IAE3E,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;OAEF,cAAc,EAAE;QACnB,IAAI,EAAE;YACJ,UAAU,EAAE;YACZ,WAAW;YACX,UAAU;YACV,MAAM;YACN,IAAI;YACJ,SAAS;YACT,KAAK;YACL,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,IAAI;YAC/B,QAAQ;YACR,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,MAAM;QACV,WAAW;QACX,UAAU;QACV,IAAI;QACJ,UAAU,EAAE,SAAS;QACrB,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACrC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,MAAc,EACd,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,2HAA2H;YAChI,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,iIAAiI;QACtI,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC;KACnD,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAc,EACd,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;IACxB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,gFAAgF;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAA2B,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;IAE1B,IAAI,WAAW,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,aAAa,GAA2B,EAAE,CAAC;IACjD,IAAI,YAAY,GAAG,OAAO,CAAC;IAC3B,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,eAAe,GAA2B,EAAE,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,qCAAqC,CAC3D,MAAM,EACN,SAAS,CACV,CAAC;QACF,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC;QACjC,eAAe,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAChD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAExD,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAC9D,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EACxC,SAAS,CACV,CAAC;YACF,aAAa,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC;YAC1C,eAAe,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;YACnD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAC5D,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAC/D,SAAS,CACV,CAAC;YACF,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;YACnC,eAAe,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;YACjD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,0BAA0B,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAE1D,IAAI,MAAM,4BAA4B,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE;QACzC,GAAG;KACJ,CAAC,CACH,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YAClD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,QAAQ,MAAM,CAAC,IAAI,sCAAsC;aACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAE7D,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,8EAA8E;IAC9E,0EAA0E;IAC1E,yDAAyD;IACzD,MAAM,UAAU,GAAG,CAAC,MAAM,wBAAwB,EAAE,CAAC,IAAI,SAAS,CAAC;IAEnE,IAAI,CAAC;QACH,MAAM,SAAS,GAA2C;YACxD,MAAM;YACN,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAClD,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC;YACtD,SAAS,CAAC,IAAI,GAAG,YAAY;gBAC3B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACjC,kEAAkE;YAClE,qEAAqE;YACrE,qEAAqE;YACrE,+DAA+D;YAC/D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,cAAc,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,YAAY,GAChB,CAAC,YAAY;oBACb,CAAC,OAAO,YAAY,KAAK,QAAQ;wBAC/B,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;wBAC7B,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;gBAChC,IAAI,YAAY;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAErD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,IAAI,WAAW,IAAI,CAAC,MAAM,4BAA4B,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBACrE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,MAAM,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;oBACjD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;oBACxD,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;wBAClD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;wBAC9B,OAAO;4BACL,KAAK,EAAE,wCAAwC,MAAM,CAAC,IAAI,GAAG;yBAC9D,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE;oBACJ,QAAQ,EAAE,WAAW;wBACnB,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC;wBACzC,CAAC,CAAC,QAAQ;iBACb;aACF,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC;SAChD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QACjD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,yBAAyB,aAAa,CAC3C,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAC3B,YAAY,CACb,EAAE;SACJ,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,qBAAqB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAE7D,KAAK,UAAU,gBAAgB,CAC7B,EAAqC,EACrC,IAAc;IAEd,MAAM,eAAe,GAAG,qBAAqB,CAAC;IAC9C,IAAI,cAA2B,CAAC;IAChC,qBAAqB,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACpD,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,eAAe,CAAC;IAEtB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;IAChC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;IAC7C,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,CAAY,EAAE,EAAE;QAChC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,CAAY,EAAE,EAAE;QAClC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAU,EAAE,EAAE;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC,CAAQ,CAAC;IACV,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;QACtB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,eAAe,CAAC;QACvC,cAAc,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,6DAA6D;SACrE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,kBAAkB,GACtB,kcAAkc,CAAC;AAErc,iFAAiF;AACjF,0EAA0E;AAC1E,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,gBAAgB,GACpB,mmBAAmmB,CAAC;AAEtmB,8EAA8E;AAC9E,8EAA8E;AAC9E,wEAAwE;AACxE,4DAA4D;AAC5D,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAE7E,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,oEAAoE;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,6DAA6D;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,2HAA2H;SAC9H,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,aAAa,EAAE,CAAC;IAClD,CAAC;AACH,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n  defineEventHandler,\n  getMethod,\n  setResponseStatus,\n  setResponseHeader,\n  type H3Event,\n} from \"h3\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getSession } from \"../server/auth.js\";\nimport {\n  runWithRequestContext,\n  getRequestOrgId,\n} from \"../server/request-context.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport {\n  listExtensions,\n  getExtension,\n  getExtensionHistoryVersion,\n  listExtensionHistory,\n  createExtension,\n  updateExtension,\n  updateExtensionContent,\n  restoreExtensionHistoryVersion,\n  deleteExtension,\n  hideExtension,\n  unhideExtension,\n  globalHideExtension,\n  globalUnhideExtension,\n  ensureExtensionsTables,\n  type ExtensionRow,\n} from \"./store.js\";\nimport { buildExtensionHtml, EXTENSION_IFRAME_CSP } from \"./html-shell.js\";\nimport { getThemeVars } from \"./theme.js\";\nimport {\n  resolveKeyReferencesWithRequestScopes,\n  validateUrlAllowlist,\n  getResolvedKeyAllowlist,\n  type ResolvedKeyReference,\n} from \"../secrets/substitution.js\";\nimport {\n  collectSecretValues,\n  normalizeExtensionProxyMethod,\n  readResponseTextWithLimit,\n  redactSecrets,\n  redactString,\n  sanitizeOutboundHeaders,\n} from \"./proxy-security.js\";\nimport {\n  createSsrfSafeDispatcher,\n  isBlockedExtensionUrlWithDns,\n} from \"./url-safety.js\";\nimport { ForbiddenError, resolveAccess } from \"../sharing/access.js\";\nimport type { ShareRole } from \"../sharing/schema.js\";\n\nexport function createExtensionsHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    const method = getMethod(event);\n    const pathname = (event.url?.pathname || \"\")\n      .replace(/^\\/+/, \"\")\n      .replace(/\\/+$/, \"\");\n    const parts = pathname\n      ? pathname.split(\"/\").map((part) => {\n          try {\n            return decodeURIComponent(part);\n          } catch {\n            return part;\n          }\n        })\n      : [];\n\n    const session = await getSession(event).catch(() => null);\n    if (!session?.email) {\n      setResponseStatus(event, 401);\n      return { error: \"Authentication required\" };\n    }\n\n    const orgCtx = await getOrgContext(event).catch(() => null);\n    const userEmail = session.email;\n    const orgId = orgCtx?.orgId ?? session.orgId ?? undefined;\n\n    try {\n      return await runWithRequestContext({ userEmail, orgId }, async () => {\n        await ensureExtensionsTables();\n        return dispatch(event, method, parts, userEmail);\n      });\n    } catch (err) {\n      if (err instanceof ForbiddenError) {\n        setResponseStatus(event, 403);\n        return { error: err.message };\n      }\n      throw err;\n    }\n  });\n}\n\nasync function dispatch(\n  event: H3Event,\n  method: string,\n  parts: string[],\n  userEmail: string,\n): Promise<unknown> {\n  // POST /sql/query — read-only SQL for extension iframes\n  if (\n    method === \"POST\" &&\n    parts.length === 2 &&\n    parts[0] === \"sql\" &&\n    parts[1] === \"query\"\n  ) {\n    return handleSqlQuery(event);\n  }\n\n  // POST /sql/exec — write SQL for extension iframes\n  if (\n    method === \"POST\" &&\n    parts.length === 2 &&\n    parts[0] === \"sql\" &&\n    parts[1] === \"exec\"\n  ) {\n    return handleSqlExec(event);\n  }\n\n  // GET /data/:extensionId/:collection — list items in a collection\n  if (method === \"GET\" && parts.length === 3 && parts[0] === \"data\") {\n    return handleExtensionDataList(event, parts[1], parts[2], userEmail);\n  }\n\n  // POST /data/:extensionId/:collection — create/upsert an item\n  if (method === \"POST\" && parts.length === 3 && parts[0] === \"data\") {\n    return handleExtensionDataUpsert(event, parts[1], parts[2], userEmail);\n  }\n\n  // DELETE /data/:extensionId/:collection/:itemId — delete an item\n  if (method === \"DELETE\" && parts.length === 4 && parts[0] === \"data\") {\n    return handleExtensionDataDelete(\n      event,\n      parts[1],\n      parts[2],\n      parts[3],\n      userEmail,\n    );\n  }\n\n  // POST /proxy\n  if (method === \"POST\" && parts.length === 1 && parts[0] === \"proxy\") {\n    return handleProxy(event, userEmail);\n  }\n\n  // GET / — list. `?includeGloballyHidden=true` surfaces extensions an\n  // admin/owner has globally hidden (so they can be unhidden for everyone).\n  if (method === \"GET\" && parts.length === 0) {\n    const includeGloballyHidden =\n      event.url?.searchParams?.get(\"includeGloballyHidden\") === \"true\";\n    const rows = await listExtensions({ includeGloballyHidden });\n    return Promise.all(rows.map((row) => extensionResponse(row)));\n  }\n\n  // POST / — create\n  if (method === \"POST\" && parts.length === 0) {\n    const body = await readBody(event);\n    if (!body.name) {\n      setResponseStatus(event, 400);\n      return { error: \"name is required\" };\n    }\n    const extension = await createExtension(body);\n    setResponseStatus(event, 201);\n    return extension;\n  }\n\n  // GET /:id/render\n  if (method === \"GET\" && parts.length === 2 && parts[1] === \"render\") {\n    const access = await resolveAccess(\"extension\", parts[0]);\n    const extension = access?.resource;\n    if (!extension) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    const search = event.url?.search || \"\";\n    const isDark = search.includes(\"dark=1\") || search.includes(\"dark=true\");\n    const themeVars = getThemeVars(isDark);\n    // Compute viewer-vs-author binding so the iframe can warn when the\n    // viewer is NOT the author. The role is plumbed through to gate\n    // dangerous bridge helpers in iframe-bridge.ts (audit H4).\n    const isAuthor = extension.ownerEmail === userEmail;\n\n    const html = buildExtensionHtml(\n      extension.content,\n      themeVars,\n      isDark,\n      parts[0],\n      {\n        authorEmail: extension.ownerEmail,\n        viewerEmail: userEmail,\n        isAuthor,\n        role: access.role,\n      },\n    );\n    // Security headers per render. `frame-ancestors` in the CSP must be set as\n    // an HTTP header to be enforced; meta-CSP can't set it per spec.\n    setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n    setResponseHeader(event, \"Content-Security-Policy\", EXTENSION_IFRAME_CSP);\n    setResponseHeader(event, \"X-Content-Type-Options\", \"nosniff\");\n    setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n    return html;\n  }\n\n  // GET /:id/history — list saved snapshots for an extension\n  if (method === \"GET\" && parts.length === 2 && parts[1] === \"history\") {\n    const limitParam = event.url?.searchParams?.get(\"limit\");\n    const limit =\n      limitParam === null || limitParam === undefined\n        ? undefined\n        : Number(limitParam);\n    const includeContent =\n      event.url?.searchParams?.get(\"includeContent\") === \"true\";\n    return {\n      history: await listExtensionHistory(parts[0], {\n        limit,\n        includeContent,\n      }),\n    };\n  }\n\n  // GET /:id/history/:version — fetch one snapshot plus its previous-version diff\n  if (method === \"GET\" && parts.length === 3 && parts[1] === \"history\") {\n    const detail = await getExtensionHistoryVersion(parts[0], parts[2]);\n    if (!detail) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension history version not found\" };\n    }\n    return detail;\n  }\n\n  // POST /:id/history/:version/restore — restore display metadata + content\n  if (\n    method === \"POST\" &&\n    parts.length === 4 &&\n    parts[1] === \"history\" &&\n    parts[3] === \"restore\"\n  ) {\n    const restored = await restoreExtensionHistoryVersion(parts[0], parts[2]);\n    if (!restored) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension history version not found\" };\n    }\n    return extensionResponse(restored);\n  }\n\n  // GET /:id\n  if (method === \"GET\" && parts.length === 1) {\n    const access = await resolveAccess(\"extension\", parts[0]);\n    if (!access) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return extensionResponse(access.resource as ExtensionRow, access.role);\n  }\n\n  // POST /:id/hide — remove from the current user's Extensions list/sidebar\n  // without deleting the underlying extension for teammates or shared slots.\n  if (method === \"POST\" && parts.length === 2 && parts[1] === \"hide\") {\n    const ok = await hideExtension(parts[0]);\n    if (!ok) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return { ok: true, hidden: true };\n  }\n\n  // POST /:id/unhide — restore an extension hidden by the current user.\n  if (method === \"POST\" && parts.length === 2 && parts[1] === \"unhide\") {\n    const ok = await unhideExtension(parts[0]);\n    if (!ok) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return { ok: true, hidden: false };\n  }\n\n  // POST /:id/global-hide — admin/owner hides the extension from EVERYONE.\n  if (method === \"POST\" && parts.length === 2 && parts[1] === \"global-hide\") {\n    const ok = await globalHideExtension(parts[0]);\n    if (!ok) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return { ok: true, globallyHidden: true };\n  }\n\n  // POST /:id/global-unhide — admin/owner reverses a global hide.\n  if (method === \"POST\" && parts.length === 2 && parts[1] === \"global-unhide\") {\n    const ok = await globalUnhideExtension(parts[0]);\n    if (!ok) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return { ok: true, globallyHidden: false };\n  }\n\n  // PUT /:id\n  if (method === \"PUT\" && parts.length === 1) {\n    const body = await readBody(event);\n    const hasContentUpdate =\n      body.content !== undefined ||\n      body.patches !== undefined ||\n      body.edits !== undefined ||\n      body.format !== undefined;\n    const hasMetaUpdate =\n      body.name !== undefined ||\n      body.description !== undefined ||\n      body.icon !== undefined ||\n      body.visibility !== undefined;\n\n    let result = null;\n    if (hasContentUpdate) {\n      result = await updateExtensionContent(parts[0], {\n        content: body.content,\n        patches: body.patches,\n        edits: body.edits,\n        format: body.format === true || body.format === \"true\",\n      });\n    }\n    if (hasMetaUpdate) {\n      result = await updateExtension(parts[0], body);\n    }\n    if (!hasContentUpdate && !hasMetaUpdate) {\n      result = await getExtension(parts[0]);\n    }\n    if (!result) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return result;\n  }\n\n  // DELETE /:id\n  if (method === \"DELETE\" && parts.length === 1) {\n    const ok = await deleteExtension(parts[0]);\n    if (!ok) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return { ok: true };\n  }\n\n  setResponseStatus(event, 404);\n  return { error: \"Not found\" };\n}\n\nasync function extensionResponse(\n  row: ExtensionRow,\n  role?: \"owner\" | ShareRole | null,\n) {\n  const resolvedRole =\n    role ??\n    (await resolveAccess(\"extension\", row.id)\n      .then((access) => access?.role ?? null)\n      .catch(() => null));\n  return {\n    ...row,\n    role: resolvedRole,\n    canEdit: resolvedRole\n      ? [\"owner\", \"admin\", \"editor\"].includes(resolvedRole)\n      : false,\n    canDelete: resolvedRole ? [\"owner\", \"admin\"].includes(resolvedRole) : false,\n    globallyHidden: row.hiddenAt != null,\n  };\n}\n\nasync function handleExtensionDataList(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const client = getDbExec();\n  const url = event.url;\n  const limitParam = url?.searchParams?.get(\"limit\");\n  const limit = limitParam\n    ? Math.min(Math.max(1, Number(limitParam)), 1000)\n    : 100;\n  const scope = url?.searchParams?.get(\"scope\") || \"user\";\n  const orgId = getRequestOrgId();\n\n  if (scope === \"org\") {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"Org context required for scope=org\" };\n    }\n    const result = await client.execute({\n      sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n        FROM tool_data\n        WHERE tool_id = ? AND collection = ? AND scope = 'org' AND org_id = ?\n        ORDER BY created_at DESC\n        LIMIT ?`,\n      args: [extensionId, collection, orgId, limit],\n    });\n    return result.rows ?? [];\n  }\n\n  if (scope === \"all\") {\n    const result = await client.execute({\n      sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n        FROM tool_data\n        WHERE tool_id = ? AND collection = ?\n          AND ((scope = 'user' AND owner_email = ?) OR (scope = 'org' AND org_id = ?))\n        ORDER BY created_at DESC\n        LIMIT ?`,\n      args: [extensionId, collection, userEmail, orgId ?? \"\", limit],\n    });\n    return result.rows ?? [];\n  }\n\n  const result = await client.execute({\n    sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n      FROM tool_data\n      WHERE tool_id = ? AND collection = ? AND scope = 'user' AND owner_email = ?\n      ORDER BY updated_at DESC\n      LIMIT ?`,\n    args: [extensionId, collection, userEmail, limit],\n  });\n  return result.rows ?? [];\n}\n\nasync function handleExtensionDataUpsert(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const body = await readBody(event);\n  if (body.data === undefined) {\n    setResponseStatus(event, 400);\n    return { error: \"data is required\" };\n  }\n  const itemId = String(body.id || randomUUID());\n  const data =\n    typeof body.data === \"string\" ? body.data : JSON.stringify(body.data);\n  const now = new Date().toISOString();\n  const scope = body.scope === \"org\" ? \"org\" : \"user\";\n  const orgId = getRequestOrgId();\n\n  if (scope === \"org\" && !orgId) {\n    setResponseStatus(event, 400);\n    return { error: \"Org context required for scope=org\" };\n  }\n\n  const scopeKey = scope === \"org\" ? `org:${orgId}` : userEmail;\n  const client = getDbExec();\n  const pg = isPostgres();\n  const conflictClause = pg\n    ? `ON CONFLICT (tool_id, collection, scope_key, item_id)\n       DO UPDATE SET data = EXCLUDED.data, updated_at = EXCLUDED.updated_at`\n    : `ON CONFLICT (tool_id, collection, scope_key, item_id)\n       DO UPDATE SET data = excluded.data, updated_at = excluded.updated_at`;\n\n  await client.execute({\n    sql: `INSERT INTO tool_data (id, tool_id, collection, item_id, data, owner_email, scope, org_id, scope_key, created_at, updated_at)\n     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n     ${conflictClause}`,\n    args: [\n      randomUUID(),\n      extensionId,\n      collection,\n      itemId,\n      data,\n      userEmail,\n      scope,\n      scope === \"org\" ? orgId! : null,\n      scopeKey,\n      now,\n      now,\n    ],\n  });\n  return {\n    id: itemId,\n    extensionId,\n    collection,\n    data,\n    ownerEmail: userEmail,\n    scope,\n    orgId: scope === \"org\" ? orgId : null,\n    createdAt: now,\n    updatedAt: now,\n  };\n}\n\nasync function handleExtensionDataDelete(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  itemId: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const url = event.url;\n  const scope = url?.searchParams?.get(\"scope\") || \"user\";\n  const orgId = getRequestOrgId();\n  const client = getDbExec();\n\n  if (scope === \"org\") {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"Org context required for scope=org\" };\n    }\n    await client.execute({\n      sql: `DELETE FROM tool_data WHERE COALESCE(item_id, id) = ? AND tool_id = ? AND collection = ? AND scope = 'org' AND org_id = ?`,\n      args: [itemId, extensionId, collection, orgId],\n    });\n    return { ok: true };\n  }\n\n  await client.execute({\n    sql: `DELETE FROM tool_data WHERE COALESCE(item_id, id) = ? AND tool_id = ? AND collection = ? AND scope = 'user' AND owner_email = ?`,\n    args: [itemId, extensionId, collection, userEmail],\n  });\n  return { ok: true };\n}\n\nasync function handleProxy(\n  event: H3Event,\n  userEmail: string,\n): Promise<unknown> {\n  const body = await readBody(event);\n  const rawUrl = body.url;\n  if (!rawUrl || typeof rawUrl !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"url is required\" };\n  }\n\n  const method = normalizeExtensionProxyMethod(body.method || \"GET\");\n  if (!method) {\n    setResponseStatus(event, 405);\n    return {\n      error:\n        \"Unsupported HTTP method. Allowed methods: GET, POST, PUT, PATCH, DELETE, HEAD.\",\n    };\n  }\n  const rawHeaders: Record<string, string> = body.headers || {};\n  const rawBody = body.body;\n\n  let resolvedUrl = rawUrl;\n  // Resolve secret references per header value rather than over a single\n  // JSON.stringify(headers) blob. A secret value containing a double-quote\n  // would corrupt that JSON, the later JSON.parse would throw, and the request\n  // would silently fall back to the *unresolved* headers (placeholders intact).\n  const parsedHeaders: Record<string, string> = {};\n  let resolvedBody = rawBody;\n  const allSecretValues: string[] = [];\n  const allResolvedKeys: ResolvedKeyReference[] = [];\n\n  try {\n    const urlResult = await resolveKeyReferencesWithRequestScopes(\n      rawUrl,\n      userEmail,\n    );\n    resolvedUrl = urlResult.resolved;\n    allSecretValues.push(...urlResult.secretValues);\n    allResolvedKeys.push(...(urlResult.resolvedKeys ?? []));\n\n    for (const [hk, hv] of Object.entries(rawHeaders)) {\n      const headerResult = await resolveKeyReferencesWithRequestScopes(\n        typeof hv === \"string\" ? hv : String(hv),\n        userEmail,\n      );\n      parsedHeaders[hk] = headerResult.resolved;\n      allSecretValues.push(...headerResult.secretValues);\n      allResolvedKeys.push(...(headerResult.resolvedKeys ?? []));\n    }\n\n    if (rawBody) {\n      const bodyResult = await resolveKeyReferencesWithRequestScopes(\n        typeof rawBody === \"string\" ? rawBody : JSON.stringify(rawBody),\n        userEmail,\n      );\n      resolvedBody = bodyResult.resolved;\n      allSecretValues.push(...bodyResult.secretValues);\n      allResolvedKeys.push(...(bodyResult.resolvedKeys ?? []));\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 400);\n    return { error: `Key resolution failed: ${err?.message ?? err}` };\n  }\n  const secretValues = collectSecretValues(allSecretValues);\n\n  if (await isBlockedExtensionUrlWithDns(resolvedUrl)) {\n    setResponseStatus(event, 403);\n    return { error: \"Requests to private/internal addresses are not allowed\" };\n  }\n\n  const uniqueResolvedKeys = new Map(\n    allResolvedKeys.map((ref) => [\n      `${ref.name}:${ref.scope}:${ref.scopeId}`,\n      ref,\n    ]),\n  );\n  for (const keyRef of uniqueResolvedKeys.values()) {\n    const allowlist = await getResolvedKeyAllowlist(keyRef);\n    if (!validateUrlAllowlist(resolvedUrl, allowlist)) {\n      setResponseStatus(event, 403);\n      return {\n        error: `Key \"${keyRef.name}\" is not allowed for this URL origin`,\n      };\n    }\n  }\n\n  const headers = sanitizeOutboundHeaders(parsedHeaders);\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), 15_000);\n\n  // Best-effort connect-time SSRF guard. When undici is available (it ships\n  // with Node 18+ but is not always exposed as an importable module), the\n  // dispatcher re-checks the resolved IP at TCP-connect time, closing the\n  // TOCTOU between the pre-flight `isBlockedExtensionUrlWithDns` lookup and the\n  // actual fetch lookup. If undici is not importable, fall through to plain\n  // fetch — the pre-flight remains the primary protection.\n  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;\n\n  try {\n    const fetchOpts: RequestInit & { dispatcher?: unknown } = {\n      method,\n      headers,\n      signal: controller.signal,\n      redirect: \"manual\",\n    };\n    if (dispatcher) fetchOpts.dispatcher = dispatcher;\n    if (resolvedBody && [\"POST\", \"PUT\", \"PATCH\"].includes(method)) {\n      const isStringBody = typeof resolvedBody === \"string\";\n      fetchOpts.body = isStringBody\n        ? resolvedBody\n        : JSON.stringify(resolvedBody);\n      // Only inject Content-Type when (a) the caller didn't set one and\n      // (b) the body is actually JSON-shaped (object or stringified JSON).\n      // Otherwise leave it unset so the runtime fetch picks an appropriate\n      // default and we don't misrepresent text/plain bodies as JSON.\n      const hasContentType = Object.keys(headers).some(\n        (k) => k.toLowerCase() === \"content-type\",\n      );\n      if (!hasContentType) {\n        const isJsonShaped =\n          !isStringBody ||\n          (typeof resolvedBody === \"string\" &&\n            /^\\s*[{[]/.test(resolvedBody) &&\n            isLikelyJson(resolvedBody));\n        if (isJsonShaped) headers[\"Content-Type\"] = \"application/json\";\n      }\n    }\n\n    const response = await fetch(resolvedUrl, fetchOpts);\n\n    if (response.status >= 300 && response.status < 400) {\n      const location = response.headers.get(\"location\");\n      const redirectUrl = location ? new URL(location, resolvedUrl).href : null;\n      if (redirectUrl && (await isBlockedExtensionUrlWithDns(redirectUrl))) {\n        setResponseStatus(event, 403);\n        return { error: \"Redirect to private/internal address blocked\" };\n      }\n      if (redirectUrl) {\n        for (const keyRef of uniqueResolvedKeys.values()) {\n          const allowlist = await getResolvedKeyAllowlist(keyRef);\n          if (!validateUrlAllowlist(redirectUrl, allowlist)) {\n            setResponseStatus(event, 403);\n            return {\n              error: `Redirect URL is not allowed for key \"${keyRef.name}\"`,\n            };\n          }\n        }\n      }\n      return {\n        status: response.status,\n        body: {\n          redirect: redirectUrl\n            ? redactString(redirectUrl, secretValues)\n            : location,\n        },\n      };\n    }\n\n    const { text } = await readResponseTextWithLimit(response);\n    let responseBody: unknown;\n    try {\n      responseBody = JSON.parse(text);\n    } catch {\n      responseBody = text;\n    }\n\n    return {\n      status: response.status,\n      body: redactSecrets(responseBody, secretValues),\n    };\n  } catch (err: any) {\n    if (err?.name === \"AbortError\") {\n      setResponseStatus(event, 504);\n      return { error: \"Upstream request timed out\" };\n    }\n    setResponseStatus(event, 502);\n    return {\n      error: `Proxy request failed: ${redactSecrets(\n        err?.message ?? String(err),\n        secretValues,\n      )}`,\n    };\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Capture console output from a CLI script that uses console.log for results.\n * Same technique as wrapCliScript in agent-chat-plugin.ts.\n */\nlet captureCliOutputQueue: Promise<void> = Promise.resolve();\n\nasync function captureCliOutput(\n  fn: (args: string[]) => Promise<void>,\n  args: string[],\n): Promise<string> {\n  const previousCapture = captureCliOutputQueue;\n  let releaseCapture!: () => void;\n  captureCliOutputQueue = new Promise<void>((resolve) => {\n    releaseCapture = resolve;\n  });\n  await previousCapture;\n\n  const logs: string[] = [];\n  const origLog = console.log;\n  const origError = console.error;\n  const origStdoutWrite = process.stdout.write;\n  console.log = (...a: unknown[]) => {\n    logs.push(a.map(String).join(\" \"));\n  };\n  console.error = (...a: unknown[]) => {\n    logs.push(a.map(String).join(\" \"));\n  };\n  process.stdout.write = ((chunk: any) => {\n    if (typeof chunk === \"string\") logs.push(chunk);\n    else if (Buffer.isBuffer(chunk)) logs.push(chunk.toString());\n    return true;\n  }) as any;\n  try {\n    await fn(args);\n  } catch (err: any) {\n    logs.push(`Error: ${err?.message ?? String(err)}`);\n  } finally {\n    console.log = origLog;\n    console.error = origError;\n    process.stdout.write = origStdoutWrite;\n    releaseCapture();\n  }\n  return logs.join(\"\\n\") || \"(no output)\";\n}\n\nasync function handleSqlQuery(event: H3Event): Promise<unknown> {\n  const body = await readBody(event);\n  const sql = body.sql;\n  if (!sql || typeof sql !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"sql is required\" };\n  }\n\n  const cleanSql = stripSqlComments(sql);\n  if (!/^\\s*(SELECT|WITH)\\b/i.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return { error: \"Only SELECT queries are allowed from extensions\" };\n  }\n  if (SENSITIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"Sensitive framework tables are not readable from extensions\",\n    };\n  }\n\n  try {\n    const mod = await import(\"../scripts/db/query.js\");\n    const args = [\"--sql\", sql, \"--format\", \"json\"];\n    if (body.limit) args.push(\"--limit\", String(body.limit));\n    if (body.args !== undefined) {\n      if (!Array.isArray(body.args)) {\n        setResponseStatus(event, 400);\n        return { error: \"args must be an array\" };\n      }\n      args.push(\"--args\", JSON.stringify(body.args));\n    }\n    const output = await captureCliOutput(mod.default, args);\n    try {\n      return JSON.parse(output);\n    } catch {\n      return { output };\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 500);\n    return { error: err?.message ?? \"Query failed\" };\n  }\n}\n\n// TODO(security): replace this regex blocklist with a SQL parser + an explicit\n// allowlist of tables a extension may read/write (e.g. only `tool_data`, plus a\n// per-template list). The current blocklist is best-effort defense in depth\n// and is by design bypassable via SQL constructions that don't include the\n// blocklisted token literally (string concat, dynamic SQL, etc). The temp-\n// view scoping in scripts/db/scoping.ts is the actual ownership boundary.\nconst DESTRUCTIVE_SQL_RE =\n  /\\b(CREATE\\s+(?:(?:LOCAL|GLOBAL)\\s+)?(?:TEMPORARY|TEMP)?\\s*(TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|EXTENSION|ROLE|TABLESPACE|PUBLICATION|SUBSCRIPTION)|DROP\\s+(TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|EXTENSION|ROLE)|TRUNCATE|DELETE\\s+FROM\\s+(?!tool_data\\b)|ALTER\\s+(TABLE|VIEW|SCHEMA|DATABASE|FUNCTION|ROLE|EXTENSION|PUBLICATION)\\s+(?!tool_data\\b)|ATTACH|DETACH|VACUUM|REINDEX|PRAGMA|GRANT|REVOKE|SET\\s+ROLE|RESET\\s+ROLE|COPY)\\b/i;\n\n// Sensitive tables that extensions must not touch directly. Includes Better Auth\n// identity tables, framework infrastructure (tracing, evals, automations,\n// integrations, notifications, scheduling, sharing/orgs), and Postgres\n// catalogs that would let a extension enumerate or read internals.\nconst SENSITIVE_SQL_RE =\n  /\\b(app_secrets|user|users|session|sessions|account|accounts|verification|oauth_tokens|tools|extensions|tool_shares|tool_slots|tool_slot_installs|tool_hidden_extensions|tool_history|member|organization|invitation|jwks|agent_trace_spans|agent_trace_summaries|agent_feedback|agent_satisfaction_scores|agent_evals|agent_runs|agent_run_events|notifications|progress_runs|integration_configs|integration_pending_tasks|integration_thread_mappings|resources|org_members|org_invitations|bigquery_cache|dashboard_views|pg_catalog|information_schema|pg_class|pg_proc|pg_namespace|pg_user|pg_roles|pg_authid|pg_shadow)\\b/i;\n\n// Refuses positional INSERTs (no column list). `INSERT INTO recordings VALUES\n// (...)` would let a extension stuff arbitrary owner_email values into a row.\n// `INSERT INTO recordings (col1, col2) VALUES (...)` is required so the\n// downstream injectOwnership helper can append owner_email.\nconst POSITIONAL_INSERT_RE = /\\bINSERT\\s+INTO\\s+[\"'`]?\\w+[\"'`]?\\s+VALUES\\b/i;\n\nfunction stripSqlComments(sql: string): string {\n  return sql.replace(/\\/\\*[\\s\\S]*?\\*\\//g, \" \").replace(/--[^\\n]*/g, \" \");\n}\n\nfunction isLikelyJson(text: string): boolean {\n  try {\n    const parsed = JSON.parse(text);\n    return parsed !== null && typeof parsed === \"object\";\n  } catch {\n    return false;\n  }\n}\n\nasync function handleSqlExec(event: H3Event): Promise<unknown> {\n  const body = await readBody(event);\n  const sql = body.sql;\n  if (!sql || typeof sql !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"sql is required\" };\n  }\n\n  const cleanSql = stripSqlComments(sql);\n  if (DESTRUCTIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"Schema changes and destructive SQL are not allowed from extensions\",\n    };\n  }\n  if (SENSITIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"Sensitive framework tables are not writable from extensions\",\n    };\n  }\n  if (POSITIONAL_INSERT_RE.test(cleanSql)) {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"INSERT must specify an explicit column list (e.g. INSERT INTO t (col1, col2) VALUES (?, ?)) so ownership can be injected.\",\n    };\n  }\n\n  try {\n    const mod = await import(\"../scripts/db/exec.js\");\n    const args = [\"--sql\", sql, \"--format\", \"json\"];\n    if (body.args !== undefined) {\n      if (!Array.isArray(body.args)) {\n        setResponseStatus(event, 400);\n        return { error: \"args must be an array\" };\n      }\n      args.push(\"--args\", JSON.stringify(body.args));\n    }\n    const output = await captureCliOutput(mod.default, args);\n    try {\n      return JSON.parse(output);\n    } catch {\n      return { output };\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 500);\n    return { error: err?.message ?? \"Exec failed\" };\n  }\n}\n"]}

package/dist/extensions/schema.d.ts

@@ -209,6 +209,44 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }, {}, {
             length: number;
         }>;
+        hiddenAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "hidden_at";
+            tableName: "tools";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        hiddenBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "hidden_by";
+            tableName: "tools";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
     };
     dialect: "sqlite";
 }>;
@@ -706,8 +744,8 @@ export declare const extensionHistory: import("drizzle-orm/sqlite-core").SQLiteT
     };
     dialect: "sqlite";
 }>;
-export declare const EXTENSIONS_CREATE_SQL = "CREATE TABLE IF NOT EXISTS tools (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  updated_at TEXT NOT NULL DEFAULT (datetime('now')),\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)";
-export declare const EXTENSIONS_CREATE_SQL_PG = "CREATE TABLE IF NOT EXISTS tools (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT now(),\n  updated_at TEXT NOT NULL DEFAULT now(),\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)";
+export declare const EXTENSIONS_CREATE_SQL = "CREATE TABLE IF NOT EXISTS tools (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  updated_at TEXT NOT NULL DEFAULT (datetime('now')),\n  hidden_at TEXT,\n  hidden_by TEXT,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)";
+export declare const EXTENSIONS_CREATE_SQL_PG = "CREATE TABLE IF NOT EXISTS tools (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT now(),\n  updated_at TEXT NOT NULL DEFAULT now(),\n  hidden_at TEXT,\n  hidden_by TEXT,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)";
 export declare const EXTENSION_SHARES_CREATE_SQL = "CREATE TABLE IF NOT EXISTS tool_shares (\n  id TEXT PRIMARY KEY,\n  resource_id TEXT NOT NULL,\n  principal_type TEXT NOT NULL,\n  principal_id TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'viewer',\n  created_by TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n)";
 export declare const EXTENSION_SHARES_CREATE_SQL_PG = "CREATE TABLE IF NOT EXISTS tool_shares (\n  id TEXT PRIMARY KEY,\n  resource_id TEXT NOT NULL,\n  principal_type TEXT NOT NULL,\n  principal_id TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'viewer',\n  created_by TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT now()\n)";
 export declare const extensionData: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
@@ -935,6 +973,9 @@ export declare const EXTENSION_DATA_DROP_OLD_INDEX_SQL_PG = "DROP INDEX IF EXIST
 export declare const EXTENSIONS_OWNER_INDEX_SQL = "CREATE INDEX IF NOT EXISTS tools_owner_idx ON tools (owner_email)";
 export declare const EXTENSIONS_ORG_INDEX_SQL = "CREATE INDEX IF NOT EXISTS tools_org_idx ON tools (org_id)";
 export declare const EXTENSIONS_UPDATED_INDEX_SQL = "CREATE INDEX IF NOT EXISTS tools_updated_at_idx ON tools (updated_at)";
+export declare const EXTENSIONS_HIDDEN_AT_COLUMN_SQL = "ALTER TABLE tools ADD COLUMN IF NOT EXISTS hidden_at TEXT";
+export declare const EXTENSIONS_HIDDEN_BY_COLUMN_SQL = "ALTER TABLE tools ADD COLUMN IF NOT EXISTS hidden_by TEXT";
+export declare const EXTENSIONS_HIDDEN_AT_INDEX_SQL = "CREATE INDEX IF NOT EXISTS tools_hidden_at_idx ON tools (hidden_at)";
 export declare const EXTENSION_SHARES_RESOURCE_INDEX_SQL = "CREATE INDEX IF NOT EXISTS tool_shares_resource_idx ON tool_shares (resource_id)";
 export declare const EXTENSION_HIDES_CREATE_SQL = "CREATE TABLE IF NOT EXISTS tool_hidden_extensions (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  owner_email TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n)";
 export declare const EXTENSION_HIDES_CREATE_SQL_PG = "CREATE TABLE IF NOT EXISTS tool_hidden_extensions (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  owner_email TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT now()\n)";

package/dist/extensions/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/extensions/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASrB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAmC,CAAC;AAEhE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKzB,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe3B,CAAC;AAEH,eAAO,MAAM,qBAAqB,yZAWhC,CAAC;AAEH,eAAO,MAAM,wBAAwB,iYAWnC,CAAC;AAEH,eAAO,MAAM,2BAA2B,iSAQtC,CAAC;AAEH,eAAO,MAAM,8BAA8B,qRAQzC,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYxB,CAAC;AAEH,eAAO,MAAM,yBAAyB,ubAYpC,CAAC;AAEH,eAAO,MAAM,4BAA4B,+ZAYvC,CAAC;AAEH,eAAO,MAAM,6BAA6B,0HACe,CAAC;AAE1D,eAAO,MAAM,gCAAgC,0HACY,CAAC;AAE1D,eAAO,MAAM,iCAAiC,kDAAkD,CAAC;AACjG,eAAO,MAAM,oCAAoC,kDAAkD,CAAC;AAEpG,eAAO,MAAM,0BAA0B,sEAAsE,CAAC;AAC9G,eAAO,MAAM,wBAAwB,+DAA+D,CAAC;AACrG,eAAO,MAAM,4BAA4B,0EAA0E,CAAC;AACpH,eAAO,MAAM,mCAAmC,qFAAqF,CAAC;AAEtI,eAAO,MAAM,0BAA0B,iMAKrC,CAAC;AAEH,eAAO,MAAM,6BAA6B,qLAKxC,CAAC;AAEH,eAAO,MAAM,gCAAgC,+HACM,CAAC;AAEpD,eAAO,MAAM,+BAA+B,2GACF,CAAC;AAE3C,eAAO,MAAM,4BAA4B,sfAevC,CAAC;AAEH,eAAO,MAAM,+BAA+B,0eAe1C,CAAC;AAEH,eAAO,MAAM,mCAAmC,0GACX,CAAC;AAEtC,eAAO,MAAM,mCAAmC,sGACR,CAAC;AAczC,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK5B,CAAC;AAEH,eAAO,MAAM,6BAA6B,sPAMxC,CAAC;AAEH,eAAO,MAAM,gCAAgC,0OAM3C,CAAC;AAEH,eAAO,MAAM,mCAAmC,iGAAiG,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/extensions/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWrB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAmC,CAAC;AAEhE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKzB,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe3B,CAAC;AAEH,eAAO,MAAM,qBAAqB,+bAahC,CAAC;AAEH,eAAO,MAAM,wBAAwB,uaAanC,CAAC;AAEH,eAAO,MAAM,2BAA2B,iSAQtC,CAAC;AAEH,eAAO,MAAM,8BAA8B,qRAQzC,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYxB,CAAC;AAEH,eAAO,MAAM,yBAAyB,ubAYpC,CAAC;AAEH,eAAO,MAAM,4BAA4B,+ZAYvC,CAAC;AAEH,eAAO,MAAM,6BAA6B,0HACe,CAAC;AAE1D,eAAO,MAAM,gCAAgC,0HACY,CAAC;AAE1D,eAAO,MAAM,iCAAiC,kDAAkD,CAAC;AACjG,eAAO,MAAM,oCAAoC,kDAAkD,CAAC;AAEpG,eAAO,MAAM,0BAA0B,sEAAsE,CAAC;AAC9G,eAAO,MAAM,wBAAwB,+DAA+D,CAAC;AACrG,eAAO,MAAM,4BAA4B,0EAA0E,CAAC;AAKpH,eAAO,MAAM,+BAA+B,8DAA8D,CAAC;AAC3G,eAAO,MAAM,+BAA+B,8DAA8D,CAAC;AAC3G,eAAO,MAAM,8BAA8B,wEAAwE,CAAC;AACpH,eAAO,MAAM,mCAAmC,qFAAqF,CAAC;AAEtI,eAAO,MAAM,0BAA0B,iMAKrC,CAAC;AAEH,eAAO,MAAM,6BAA6B,qLAKxC,CAAC;AAEH,eAAO,MAAM,gCAAgC,+HACM,CAAC;AAEpD,eAAO,MAAM,+BAA+B,2GACF,CAAC;AAE3C,eAAO,MAAM,4BAA4B,sfAevC,CAAC;AAEH,eAAO,MAAM,+BAA+B,0eAe1C,CAAC;AAEH,eAAO,MAAM,mCAAmC,0GACX,CAAC;AAEtC,eAAO,MAAM,mCAAmC,sGACR,CAAC;AAczC,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK5B,CAAC;AAEH,eAAO,MAAM,6BAA6B,sPAMxC,CAAC;AAEH,eAAO,MAAM,gCAAgC,0OAM3C,CAAC;AAEH,eAAO,MAAM,mCAAmC,iGAAiG,CAAC"}

package/dist/extensions/schema.js

@@ -25,6 +25,8 @@ export const extensions = table("tools", {
     icon: text("icon"),
     createdAt: text("created_at").notNull().default(now()),
     updatedAt: text("updated_at").notNull().default(now()),
+    hiddenAt: text("hidden_at"),
+    hiddenBy: text("hidden_by"),
     ...ownableColumns(),
 });
 export const extensionShares = createSharesTable("tool_shares");
@@ -58,6 +60,8 @@ export const EXTENSIONS_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tools (
   icon TEXT,
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
   updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  hidden_at TEXT,
+  hidden_by TEXT,
   owner_email TEXT NOT NULL DEFAULT 'local@localhost',
   org_id TEXT,
   visibility TEXT NOT NULL DEFAULT 'private'
@@ -70,6 +74,8 @@ export const EXTENSIONS_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tools (
   icon TEXT,
   created_at TEXT NOT NULL DEFAULT now(),
   updated_at TEXT NOT NULL DEFAULT now(),
+  hidden_at TEXT,
+  hidden_by TEXT,
   owner_email TEXT NOT NULL DEFAULT 'local@localhost',
   org_id TEXT,
   visibility TEXT NOT NULL DEFAULT 'private'
@@ -140,6 +146,12 @@ export const EXTENSION_DATA_DROP_OLD_INDEX_SQL_PG = `DROP INDEX IF EXISTS tool_d
 export const EXTENSIONS_OWNER_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_owner_idx ON tools (owner_email)`;
 export const EXTENSIONS_ORG_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_org_idx ON tools (org_id)`;
 export const EXTENSIONS_UPDATED_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_updated_at_idx ON tools (updated_at)`;
+// Global (admin) hide: when set, the extension row is hidden from EVERYONE's
+// list, distinct from the per-user `tool_hidden_extensions` table. Additive
+// columns — see ensureExtensionsTables() for the idempotent ADD COLUMN run.
+export const EXTENSIONS_HIDDEN_AT_COLUMN_SQL = `ALTER TABLE tools ADD COLUMN IF NOT EXISTS hidden_at TEXT`;
+export const EXTENSIONS_HIDDEN_BY_COLUMN_SQL = `ALTER TABLE tools ADD COLUMN IF NOT EXISTS hidden_by TEXT`;
+export const EXTENSIONS_HIDDEN_AT_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_hidden_at_idx ON tools (hidden_at)`;
 export const EXTENSION_SHARES_RESOURCE_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tool_shares_resource_idx ON tool_shares (resource_id)`;
 export const EXTENSION_HIDES_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_hidden_extensions (
   id TEXT PRIMARY KEY,

package/dist/extensions/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/extensions/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzE,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAE;IACvC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtD,GAAG,cAAc,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,wBAAwB,EAAE;IAC5D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACtC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,EAAE;IACpD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACtC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACtC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACpE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;EAWnC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;EAWtC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;EAQzC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;;;;;EAQ5C,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC,WAAW,EAAE;IAC9C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACtC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;IACvB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACpE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;IACrB,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAChE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;EAYvC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;EAY1C,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG;yDACY,CAAC;AAE1D,MAAM,CAAC,MAAM,gCAAgC,GAAG;yDACS,CAAC;AAE1D,MAAM,CAAC,MAAM,iCAAiC,GAAG,+CAA+C,CAAC;AACjG,MAAM,CAAC,MAAM,oCAAoC,GAAG,+CAA+C,CAAC;AAEpG,MAAM,CAAC,MAAM,0BAA0B,GAAG,mEAAmE,CAAC;AAC9G,MAAM,CAAC,MAAM,wBAAwB,GAAG,4DAA4D,CAAC;AACrG,MAAM,CAAC,MAAM,4BAA4B,GAAG,uEAAuE,CAAC;AACpH,MAAM,CAAC,MAAM,mCAAmC,GAAG,kFAAkF,CAAC;AAEtI,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;EAKxC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;EAK3C,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG;mDACG,CAAC;AAEpD,MAAM,CAAC,MAAM,+BAA+B,GAAG;0CACL,CAAC;AAE3C,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;EAe1C,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;;;;;;;;;;EAe7C,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG;qCACd,CAAC;AAEtC,MAAM,CAAC,MAAM,mCAAmC,GAAG;wCACX,CAAC;AAEzC,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAC9E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,6EAA6E;AAC7E,mEAAmE;AAEnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,eAAe,EAAE;IACtD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACtC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;EAM3C,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG;;;;;;EAM9C,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,8FAA8F,CAAC","sourcesContent":["/**\n * Drizzle schema for the framework extensions system.\n *\n * Extensions are mini Alpine.js apps that run inside sandboxed iframes. They\n * can call external APIs via a server-side proxy that resolves `${keys.NAME}`\n * secret references. Extensions use the standard sharing model (private by\n * default, shareable with org/others).\n *\n * The tables are auto-created at server boot via `ensureTable()` in store.ts,\n * following the same pattern as `app_secrets`.\n *\n * NOTE: physical SQL table/column names stay as `tools`, `tool_data`,\n * `tool_shares`, `tool_consents`, `tool_id`, etc. — additive-only schema\n * policy means we never rename DB-level identifiers. The JS/TS surface is\n * renamed to `extensions`/`extension*`; the DB-side names stay so existing\n * deployed rows remain readable.\n */\n\nimport { table, text, integer, now } from \"../db/schema.js\";\nimport { ownableColumns, createSharesTable } from \"../sharing/schema.js\";\n\nexport const extensions = table(\"tools\", {\n  id: text(\"id\").primaryKey(),\n  name: text(\"name\").notNull(),\n  description: text(\"description\").notNull().default(\"\"),\n  content: text(\"content\").notNull().default(\"\"),\n  icon: text(\"icon\"),\n  createdAt: text(\"created_at\").notNull().default(now()),\n  updatedAt: text(\"updated_at\").notNull().default(now()),\n  ...ownableColumns(),\n});\n\nexport const extensionShares = createSharesTable(\"tool_shares\");\n\nexport const extensionHides = table(\"tool_hidden_extensions\", {\n  id: text(\"id\").primaryKey(),\n  extensionId: text(\"tool_id\").notNull(),\n  ownerEmail: text(\"owner_email\").notNull(),\n  createdAt: text(\"created_at\").notNull().default(now()),\n});\n\nexport const extensionHistory = table(\"tool_history\", {\n  id: text(\"id\").primaryKey(),\n  extensionId: text(\"tool_id\").notNull(),\n  version: integer(\"version\").notNull(),\n  operation: text(\"operation\").notNull(),\n  summary: text(\"summary\").notNull().default(\"\"),\n  name: text(\"name\").notNull(),\n  description: text(\"description\").notNull().default(\"\"),\n  content: text(\"content\").notNull().default(\"\"),\n  icon: text(\"icon\"),\n  actorEmail: text(\"actor_email\"),\n  ownerEmail: text(\"owner_email\").notNull().default(\"local@localhost\"),\n  orgId: text(\"org_id\"),\n  visibility: text(\"visibility\").notNull().default(\"private\"),\n  createdAt: text(\"created_at\").notNull().default(now()),\n});\n\nexport const EXTENSIONS_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tools (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  updated_at TEXT NOT NULL DEFAULT (datetime('now')),\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)`;\n\nexport const EXTENSIONS_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tools (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT now(),\n  updated_at TEXT NOT NULL DEFAULT now(),\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)`;\n\nexport const EXTENSION_SHARES_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_shares (\n  id TEXT PRIMARY KEY,\n  resource_id TEXT NOT NULL,\n  principal_type TEXT NOT NULL,\n  principal_id TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'viewer',\n  created_by TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n)`;\n\nexport const EXTENSION_SHARES_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tool_shares (\n  id TEXT PRIMARY KEY,\n  resource_id TEXT NOT NULL,\n  principal_type TEXT NOT NULL,\n  principal_id TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'viewer',\n  created_by TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT now()\n)`;\n\nexport const extensionData = table(\"tool_data\", {\n  id: text(\"id\").primaryKey(),\n  extensionId: text(\"tool_id\").notNull(),\n  collection: text(\"collection\").notNull(),\n  itemId: text(\"item_id\"),\n  data: text(\"data\").notNull(),\n  ownerEmail: text(\"owner_email\").notNull().default(\"local@localhost\"),\n  scope: text(\"scope\").notNull().default(\"user\"),\n  orgId: text(\"org_id\"),\n  scopeKey: text(\"scope_key\").notNull().default(\"local@localhost\"),\n  createdAt: text(\"created_at\").notNull().default(now()),\n  updatedAt: text(\"updated_at\").notNull().default(now()),\n});\n\nexport const EXTENSION_DATA_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_data (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  collection TEXT NOT NULL,\n  item_id TEXT,\n  data TEXT NOT NULL,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  scope TEXT NOT NULL DEFAULT 'user',\n  org_id TEXT,\n  scope_key TEXT NOT NULL DEFAULT 'local@localhost',\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  updated_at TEXT NOT NULL DEFAULT (datetime('now'))\n)`;\n\nexport const EXTENSION_DATA_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tool_data (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  collection TEXT NOT NULL,\n  item_id TEXT,\n  data TEXT NOT NULL,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  scope TEXT NOT NULL DEFAULT 'user',\n  org_id TEXT,\n  scope_key TEXT NOT NULL DEFAULT 'local@localhost',\n  created_at TEXT NOT NULL DEFAULT now(),\n  updated_at TEXT NOT NULL DEFAULT now()\n)`;\n\nexport const EXTENSION_DATA_ITEM_INDEX_SQL = `CREATE UNIQUE INDEX IF NOT EXISTS tool_data_scoped_item_idx\n  ON tool_data (tool_id, collection, scope_key, item_id)`;\n\nexport const EXTENSION_DATA_ITEM_INDEX_SQL_PG = `CREATE UNIQUE INDEX IF NOT EXISTS tool_data_scoped_item_idx\n  ON tool_data (tool_id, collection, scope_key, item_id)`;\n\nexport const EXTENSION_DATA_DROP_OLD_INDEX_SQL = `DROP INDEX IF EXISTS tool_data_scope_item_idx`;\nexport const EXTENSION_DATA_DROP_OLD_INDEX_SQL_PG = `DROP INDEX IF EXISTS tool_data_scope_item_idx`;\n\nexport const EXTENSIONS_OWNER_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_owner_idx ON tools (owner_email)`;\nexport const EXTENSIONS_ORG_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_org_idx ON tools (org_id)`;\nexport const EXTENSIONS_UPDATED_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_updated_at_idx ON tools (updated_at)`;\nexport const EXTENSION_SHARES_RESOURCE_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tool_shares_resource_idx ON tool_shares (resource_id)`;\n\nexport const EXTENSION_HIDES_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_hidden_extensions (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  owner_email TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n)`;\n\nexport const EXTENSION_HIDES_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tool_hidden_extensions (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  owner_email TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT now()\n)`;\n\nexport const EXTENSION_HIDES_UNIQUE_INDEX_SQL = `CREATE UNIQUE INDEX IF NOT EXISTS tool_hidden_extensions_user_tool_idx\n  ON tool_hidden_extensions (owner_email, tool_id)`;\n\nexport const EXTENSION_HIDES_OWNER_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tool_hidden_extensions_owner_idx\n  ON tool_hidden_extensions (owner_email)`;\n\nexport const EXTENSION_HISTORY_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_history (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  version INTEGER NOT NULL,\n  operation TEXT NOT NULL,\n  summary TEXT NOT NULL DEFAULT '',\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  actor_email TEXT,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private',\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n)`;\n\nexport const EXTENSION_HISTORY_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tool_history (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  version INTEGER NOT NULL,\n  operation TEXT NOT NULL,\n  summary TEXT NOT NULL DEFAULT '',\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  actor_email TEXT,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private',\n  created_at TEXT NOT NULL DEFAULT now()\n)`;\n\nexport const EXTENSION_HISTORY_VERSION_INDEX_SQL = `CREATE UNIQUE INDEX IF NOT EXISTS tool_history_tool_version_idx\n  ON tool_history (tool_id, version)`;\n\nexport const EXTENSION_HISTORY_CREATED_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tool_history_tool_created_idx\n  ON tool_history (tool_id, created_at)`;\n\n// ---------------------------------------------------------------------------\n// extension_consents — vestigial, kept for additive-schema compliance\n// ---------------------------------------------------------------------------\n//\n// Originally added for an audit-C1 per-(viewer, extension, content_hash)\n// consent gate that prompted viewers to \"Run anyway\" before non-author\n// extensions could execute. We removed the runtime gate after settling on\n// intra-org trust (extensions are shared between trusted teammates; the\n// org-level access controls are sufficient). The table is kept here so\n// deploys that already ran the migration stay healthy — additive-only schema\n// policy means we never drop. Physical name stays `tool_consents`.\n\nexport const extensionConsents = table(\"tool_consents\", {\n  viewerEmail: text(\"viewer_email\").notNull(),\n  extensionId: text(\"tool_id\").notNull(),\n  contentHash: text(\"content_hash\").notNull(),\n  grantedAt: text(\"granted_at\").notNull().default(now()),\n});\n\nexport const EXTENSION_CONSENTS_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_consents (\n  viewer_email TEXT NOT NULL,\n  tool_id TEXT NOT NULL,\n  content_hash TEXT NOT NULL,\n  granted_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (viewer_email, tool_id, content_hash)\n)`;\n\nexport const EXTENSION_CONSENTS_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tool_consents (\n  viewer_email TEXT NOT NULL,\n  tool_id TEXT NOT NULL,\n  content_hash TEXT NOT NULL,\n  granted_at TEXT NOT NULL DEFAULT now(),\n  PRIMARY KEY (viewer_email, tool_id, content_hash)\n)`;\n\nexport const EXTENSION_CONSENTS_VIEWER_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tool_consents_viewer_idx ON tool_consents (viewer_email, tool_id)`;\n"]}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/extensions/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzE,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAE;IACvC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,GAAG,cAAc,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,wBAAwB,EAAE;IAC5D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACtC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,EAAE;IACpD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACtC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACtC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACpE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;EAanC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;EAatC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;EAQzC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;;;;;EAQ5C,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC,WAAW,EAAE;IAC9C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACtC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;IACvB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACpE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;IACrB,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAChE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;EAYvC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;EAY1C,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG;yDACY,CAAC;AAE1D,MAAM,CAAC,MAAM,gCAAgC,GAAG;yDACS,CAAC;AAE1D,MAAM,CAAC,MAAM,iCAAiC,GAAG,+CAA+C,CAAC;AACjG,MAAM,CAAC,MAAM,oCAAoC,GAAG,+CAA+C,CAAC;AAEpG,MAAM,CAAC,MAAM,0BAA0B,GAAG,mEAAmE,CAAC;AAC9G,MAAM,CAAC,MAAM,wBAAwB,GAAG,4DAA4D,CAAC;AACrG,MAAM,CAAC,MAAM,4BAA4B,GAAG,uEAAuE,CAAC;AAEpH,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,2DAA2D,CAAC;AAC3G,MAAM,CAAC,MAAM,+BAA+B,GAAG,2DAA2D,CAAC;AAC3G,MAAM,CAAC,MAAM,8BAA8B,GAAG,qEAAqE,CAAC;AACpH,MAAM,CAAC,MAAM,mCAAmC,GAAG,kFAAkF,CAAC;AAEtI,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;EAKxC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;EAK3C,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG;mDACG,CAAC;AAEpD,MAAM,CAAC,MAAM,+BAA+B,GAAG;0CACL,CAAC;AAE3C,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;EAe1C,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;;;;;;;;;;EAe7C,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG;qCACd,CAAC;AAEtC,MAAM,CAAC,MAAM,mCAAmC,GAAG;wCACX,CAAC;AAEzC,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAC9E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,6EAA6E;AAC7E,mEAAmE;AAEnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,eAAe,EAAE;IACtD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACtC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;;;;EAM3C,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG;;;;;;EAM9C,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,8FAA8F,CAAC","sourcesContent":["/**\n * Drizzle schema for the framework extensions system.\n *\n * Extensions are mini Alpine.js apps that run inside sandboxed iframes. They\n * can call external APIs via a server-side proxy that resolves `${keys.NAME}`\n * secret references. Extensions use the standard sharing model (private by\n * default, shareable with org/others).\n *\n * The tables are auto-created at server boot via `ensureTable()` in store.ts,\n * following the same pattern as `app_secrets`.\n *\n * NOTE: physical SQL table/column names stay as `tools`, `tool_data`,\n * `tool_shares`, `tool_consents`, `tool_id`, etc. — additive-only schema\n * policy means we never rename DB-level identifiers. The JS/TS surface is\n * renamed to `extensions`/`extension*`; the DB-side names stay so existing\n * deployed rows remain readable.\n */\n\nimport { table, text, integer, now } from \"../db/schema.js\";\nimport { ownableColumns, createSharesTable } from \"../sharing/schema.js\";\n\nexport const extensions = table(\"tools\", {\n  id: text(\"id\").primaryKey(),\n  name: text(\"name\").notNull(),\n  description: text(\"description\").notNull().default(\"\"),\n  content: text(\"content\").notNull().default(\"\"),\n  icon: text(\"icon\"),\n  createdAt: text(\"created_at\").notNull().default(now()),\n  updatedAt: text(\"updated_at\").notNull().default(now()),\n  hiddenAt: text(\"hidden_at\"),\n  hiddenBy: text(\"hidden_by\"),\n  ...ownableColumns(),\n});\n\nexport const extensionShares = createSharesTable(\"tool_shares\");\n\nexport const extensionHides = table(\"tool_hidden_extensions\", {\n  id: text(\"id\").primaryKey(),\n  extensionId: text(\"tool_id\").notNull(),\n  ownerEmail: text(\"owner_email\").notNull(),\n  createdAt: text(\"created_at\").notNull().default(now()),\n});\n\nexport const extensionHistory = table(\"tool_history\", {\n  id: text(\"id\").primaryKey(),\n  extensionId: text(\"tool_id\").notNull(),\n  version: integer(\"version\").notNull(),\n  operation: text(\"operation\").notNull(),\n  summary: text(\"summary\").notNull().default(\"\"),\n  name: text(\"name\").notNull(),\n  description: text(\"description\").notNull().default(\"\"),\n  content: text(\"content\").notNull().default(\"\"),\n  icon: text(\"icon\"),\n  actorEmail: text(\"actor_email\"),\n  ownerEmail: text(\"owner_email\").notNull().default(\"local@localhost\"),\n  orgId: text(\"org_id\"),\n  visibility: text(\"visibility\").notNull().default(\"private\"),\n  createdAt: text(\"created_at\").notNull().default(now()),\n});\n\nexport const EXTENSIONS_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tools (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  updated_at TEXT NOT NULL DEFAULT (datetime('now')),\n  hidden_at TEXT,\n  hidden_by TEXT,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)`;\n\nexport const EXTENSIONS_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tools (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT now(),\n  updated_at TEXT NOT NULL DEFAULT now(),\n  hidden_at TEXT,\n  hidden_by TEXT,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)`;\n\nexport const EXTENSION_SHARES_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_shares (\n  id TEXT PRIMARY KEY,\n  resource_id TEXT NOT NULL,\n  principal_type TEXT NOT NULL,\n  principal_id TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'viewer',\n  created_by TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n)`;\n\nexport const EXTENSION_SHARES_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tool_shares (\n  id TEXT PRIMARY KEY,\n  resource_id TEXT NOT NULL,\n  principal_type TEXT NOT NULL,\n  principal_id TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'viewer',\n  created_by TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT now()\n)`;\n\nexport const extensionData = table(\"tool_data\", {\n  id: text(\"id\").primaryKey(),\n  extensionId: text(\"tool_id\").notNull(),\n  collection: text(\"collection\").notNull(),\n  itemId: text(\"item_id\"),\n  data: text(\"data\").notNull(),\n  ownerEmail: text(\"owner_email\").notNull().default(\"local@localhost\"),\n  scope: text(\"scope\").notNull().default(\"user\"),\n  orgId: text(\"org_id\"),\n  scopeKey: text(\"scope_key\").notNull().default(\"local@localhost\"),\n  createdAt: text(\"created_at\").notNull().default(now()),\n  updatedAt: text(\"updated_at\").notNull().default(now()),\n});\n\nexport const EXTENSION_DATA_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_data (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  collection TEXT NOT NULL,\n  item_id TEXT,\n  data TEXT NOT NULL,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  scope TEXT NOT NULL DEFAULT 'user',\n  org_id TEXT,\n  scope_key TEXT NOT NULL DEFAULT 'local@localhost',\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  updated_at TEXT NOT NULL DEFAULT (datetime('now'))\n)`;\n\nexport const EXTENSION_DATA_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tool_data (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  collection TEXT NOT NULL,\n  item_id TEXT,\n  data TEXT NOT NULL,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  scope TEXT NOT NULL DEFAULT 'user',\n  org_id TEXT,\n  scope_key TEXT NOT NULL DEFAULT 'local@localhost',\n  created_at TEXT NOT NULL DEFAULT now(),\n  updated_at TEXT NOT NULL DEFAULT now()\n)`;\n\nexport const EXTENSION_DATA_ITEM_INDEX_SQL = `CREATE UNIQUE INDEX IF NOT EXISTS tool_data_scoped_item_idx\n  ON tool_data (tool_id, collection, scope_key, item_id)`;\n\nexport const EXTENSION_DATA_ITEM_INDEX_SQL_PG = `CREATE UNIQUE INDEX IF NOT EXISTS tool_data_scoped_item_idx\n  ON tool_data (tool_id, collection, scope_key, item_id)`;\n\nexport const EXTENSION_DATA_DROP_OLD_INDEX_SQL = `DROP INDEX IF EXISTS tool_data_scope_item_idx`;\nexport const EXTENSION_DATA_DROP_OLD_INDEX_SQL_PG = `DROP INDEX IF EXISTS tool_data_scope_item_idx`;\n\nexport const EXTENSIONS_OWNER_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_owner_idx ON tools (owner_email)`;\nexport const EXTENSIONS_ORG_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_org_idx ON tools (org_id)`;\nexport const EXTENSIONS_UPDATED_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_updated_at_idx ON tools (updated_at)`;\n\n// Global (admin) hide: when set, the extension row is hidden from EVERYONE's\n// list, distinct from the per-user `tool_hidden_extensions` table. Additive\n// columns — see ensureExtensionsTables() for the idempotent ADD COLUMN run.\nexport const EXTENSIONS_HIDDEN_AT_COLUMN_SQL = `ALTER TABLE tools ADD COLUMN IF NOT EXISTS hidden_at TEXT`;\nexport const EXTENSIONS_HIDDEN_BY_COLUMN_SQL = `ALTER TABLE tools ADD COLUMN IF NOT EXISTS hidden_by TEXT`;\nexport const EXTENSIONS_HIDDEN_AT_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tools_hidden_at_idx ON tools (hidden_at)`;\nexport const EXTENSION_SHARES_RESOURCE_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tool_shares_resource_idx ON tool_shares (resource_id)`;\n\nexport const EXTENSION_HIDES_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_hidden_extensions (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  owner_email TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n)`;\n\nexport const EXTENSION_HIDES_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tool_hidden_extensions (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  owner_email TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT now()\n)`;\n\nexport const EXTENSION_HIDES_UNIQUE_INDEX_SQL = `CREATE UNIQUE INDEX IF NOT EXISTS tool_hidden_extensions_user_tool_idx\n  ON tool_hidden_extensions (owner_email, tool_id)`;\n\nexport const EXTENSION_HIDES_OWNER_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tool_hidden_extensions_owner_idx\n  ON tool_hidden_extensions (owner_email)`;\n\nexport const EXTENSION_HISTORY_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_history (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  version INTEGER NOT NULL,\n  operation TEXT NOT NULL,\n  summary TEXT NOT NULL DEFAULT '',\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  actor_email TEXT,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private',\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n)`;\n\nexport const EXTENSION_HISTORY_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tool_history (\n  id TEXT PRIMARY KEY,\n  tool_id TEXT NOT NULL,\n  version INTEGER NOT NULL,\n  operation TEXT NOT NULL,\n  summary TEXT NOT NULL DEFAULT '',\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  actor_email TEXT,\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private',\n  created_at TEXT NOT NULL DEFAULT now()\n)`;\n\nexport const EXTENSION_HISTORY_VERSION_INDEX_SQL = `CREATE UNIQUE INDEX IF NOT EXISTS tool_history_tool_version_idx\n  ON tool_history (tool_id, version)`;\n\nexport const EXTENSION_HISTORY_CREATED_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tool_history_tool_created_idx\n  ON tool_history (tool_id, created_at)`;\n\n// ---------------------------------------------------------------------------\n// extension_consents — vestigial, kept for additive-schema compliance\n// ---------------------------------------------------------------------------\n//\n// Originally added for an audit-C1 per-(viewer, extension, content_hash)\n// consent gate that prompted viewers to \"Run anyway\" before non-author\n// extensions could execute. We removed the runtime gate after settling on\n// intra-org trust (extensions are shared between trusted teammates; the\n// org-level access controls are sufficient). The table is kept here so\n// deploys that already ran the migration stay healthy — additive-only schema\n// policy means we never drop. Physical name stays `tool_consents`.\n\nexport const extensionConsents = table(\"tool_consents\", {\n  viewerEmail: text(\"viewer_email\").notNull(),\n  extensionId: text(\"tool_id\").notNull(),\n  contentHash: text(\"content_hash\").notNull(),\n  grantedAt: text(\"granted_at\").notNull().default(now()),\n});\n\nexport const EXTENSION_CONSENTS_CREATE_SQL = `CREATE TABLE IF NOT EXISTS tool_consents (\n  viewer_email TEXT NOT NULL,\n  tool_id TEXT NOT NULL,\n  content_hash TEXT NOT NULL,\n  granted_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (viewer_email, tool_id, content_hash)\n)`;\n\nexport const EXTENSION_CONSENTS_CREATE_SQL_PG = `CREATE TABLE IF NOT EXISTS tool_consents (\n  viewer_email TEXT NOT NULL,\n  tool_id TEXT NOT NULL,\n  content_hash TEXT NOT NULL,\n  granted_at TEXT NOT NULL DEFAULT now(),\n  PRIMARY KEY (viewer_email, tool_id, content_hash)\n)`;\n\nexport const EXTENSION_CONSENTS_VIEWER_INDEX_SQL = `CREATE INDEX IF NOT EXISTS tool_consents_viewer_idx ON tool_consents (viewer_email, tool_id)`;\n"]}

package/dist/extensions/store.d.ts

@@ -10,6 +10,8 @@ export interface ExtensionRow {
     icon: string | null;
     createdAt: string;
     updatedAt: string;
+    hiddenAt: string | null;
+    hiddenBy: string | null;
     ownerEmail: string;
     orgId: string | null;
     visibility: "private" | "org" | "public";
@@ -51,6 +53,11 @@ export declare function getExtensionChangeTargets(id: string): Promise<Extension
 export declare function notifyExtensionChangeForResource(id: string, beforeTargets?: ExtensionChangeTarget[]): Promise<void>;
 export interface ListExtensionsOptions {
     includeHidden?: boolean;
+    /**
+     * Include extensions an admin/owner has globally hidden via `hidden_at`.
+     * Off by default so globally-hidden extensions disappear for everyone.
+     */
+    includeGloballyHidden?: boolean;
 }
 export declare function listExtensions(options?: ListExtensionsOptions): Promise<ExtensionRow[]>;
 export declare function getExtension(id: string): Promise<ExtensionRow | null>;
@@ -91,4 +98,17 @@ export declare function deleteExtension(id: string): Promise<boolean>;
 export declare function getHiddenExtensionIdsForCurrentUser(): Promise<Set<string>>;
 export declare function hideExtension(id: string): Promise<boolean>;
 export declare function unhideExtension(id: string): Promise<boolean>;
+/**
+ * Globally hide an extension from EVERYONE's list by stamping `hidden_at` /
+ * `hidden_by` on the `tools` row. Distinct from the per-user `hideExtension`
+ * (`tool_hidden_extensions`) — this affects all viewers. Requires admin/owner
+ * access. The extension is not deleted and stays accessible by id; pass
+ * `includeGloballyHidden: true` to `listExtensions` to surface it again.
+ */
+export declare function globalHideExtension(id: string): Promise<boolean>;
+/**
+ * Clear a global hide so the extension reappears in everyone's list. Requires
+ * admin/owner access. Mirrors `globalHideExtension`.
+ */
+export declare function globalUnhideExtension(id: string): Promise<boolean>;
 //# sourceMappingURL=store.d.ts.map

package/dist/extensions/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/extensions/store.ts"],"names":[],"mappings":"AAgDA,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAW5B,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiF5D;AAwFD,wBAAgB,2BAA2B,SAiB1C;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;CAC1C;AAED,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,UAAU,GACV,iBAAiB,GACjB,gBAAgB,GAChB,SAAS,CAAC;AAEd,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,yBAAyB,GAAG,MAAM,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,IAAI,EAAE,wBAAwB,EAAE,CAAC;IACjC,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AA+ED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAGlC;AA0CD,wBAAsB,gCAAgC,CACpD,EAAE,EAAE,MAAM,EACV,aAAa,GAAE,qBAAqB,EAAO,GAC1C,OAAO,CAAC,IAAI,CAAC,CAMf;AAoTD,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAsB,cAAc,CAClC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,YAAY,EAAE,CAAC,CAazB;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAI3E;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAuBlC;AAED,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,GAAG,MAAM,GAC5B,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA4BxC;AAED,wBAAsB,8BAA8B,CAClD,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,GAAG,MAAM,GAC5B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA+C9B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,YAAY,CAAC,CAwBvB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;CAC3C;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2C9B;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2C9B;AAED,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBlE;AAED,wBAAsB,mCAAmC,IAAI,OAAO,CAClE,GAAG,CAAC,MAAM,CAAC,CACZ,CAWA;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAehE;AAED,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWlE"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/extensions/store.ts"],"names":[],"mappings":"AAmDA,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAW5B,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAqF5D;AAmHD,wBAAgB,2BAA2B,SAiB1C;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;CAC1C;AAED,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,UAAU,GACV,iBAAiB,GACjB,gBAAgB,GAChB,SAAS,CAAC;AAEd,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,yBAAyB,GAAG,MAAM,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,IAAI,EAAE,wBAAwB,EAAE,CAAC;IACjC,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AA+ED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAGlC;AA0CD,wBAAsB,gCAAgC,CACpD,EAAE,EAAE,MAAM,EACV,aAAa,GAAE,qBAAqB,EAAO,GAC1C,OAAO,CAAC,IAAI,CAAC,CAMf;AAoTD,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,wBAAsB,cAAc,CAClC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,YAAY,EAAE,CAAC,CAoBzB;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAI3E;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAuBlC;AAED,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,GAAG,MAAM,GAC5B,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA4BxC;AAED,wBAAsB,8BAA8B,CAClD,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,GAAG,MAAM,GAC5B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA+C9B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,YAAY,CAAC,CA0BvB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;CAC3C;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2C9B;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2C9B;AAED,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBlE;AAED,wBAAsB,mCAAmC,IAAI,OAAO,CAClE,GAAG,CAAC,MAAM,CAAC,CACZ,CAWA;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAehE;AAED,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWlE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBtE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBxE"}